Skip to content

Conversation

@renovate
Copy link
Contributor

@renovate renovate bot commented Oct 28, 2025

This PR contains the following updates:

Package Type Update Change Pending Age Confidence
node final major 22-alpine -> 24-alpine 24.10.0 age confidence
node stage major 22.20-alpine -> 24.9-alpine 24.10.0 age confidence
@types/node (source) devDependencies major ^22 -> ^24.0.0 age confidence

Release Notes

nodejs/node (node)

v24.9.0: 2025-09-25, Version 24.9.0 (Current), @​targos

Compare Source

Notable Changes
  • [9b043a9096] - (SEMVER-MINOR) http: add shouldUpgradeCallback to let servers control HTTP upgrades (Tim Perry) #​59824
  • [a6456ab90a] - (SEMVER-MINOR) sqlite: cleanup ERM support and export Session class (James M Snell) #​58378
  • [5563361d22] - (SEMVER-MINOR) sqlite: add tagged template (0hm☘️) #​58748
  • [04013ee933] - (SEMVER-MINOR) worker: add heap profile API (theanarkh) #​59846
Commits

v24.8.0: 2025-09-10, Version 24.8.0 (Current), @​targos

Compare Source

Notable Changes
HTTP/2 Network Inspection Support in Node.js

Node.js now supports inspection of HTTP/2 network calls in Chrome DevTools for Node.js.

Usage

Write a test.js script that makes HTTP/2 requests.

const http2 = require('node:http2');

const client = http2.connect('https://nghttp2.org');

const req = client.request([
  ':path', '/',
  ':method', 'GET',
]);

Run it with these options:

node --inspect-wait --experimental-network-inspection test.js

Open about:inspect on Google Chrome and click on Open dedicated DevTools for Node.
The Network tab will let you track your HTTP/2 calls.

Contributed by Darshan Sen in #​59611.

Other Notable Changes
  • [7a8e2c251d] - (SEMVER-MINOR) crypto: support Ed448 and ML-DSA context parameter in node:crypto (Filip Skokan) #​59570
  • [4b631be0b0] - (SEMVER-MINOR) crypto: support Ed448 and ML-DSA context parameter in Web Cryptography (Filip Skokan) #​59570
  • [3e4b1e732c] - (SEMVER-MINOR) crypto: add KMAC Web Cryptography algorithms (Filip Skokan) #​59647
  • [b1d28785b2] - (SEMVER-MINOR) crypto: add Argon2 Web Cryptography algorithms (Filip Skokan) #​59544
  • [430691d1af] - (SEMVER-MINOR) crypto: support SLH-DSA KeyObject, sign, and verify (Filip Skokan) #​59537
  • [d6d05ba397] - (SEMVER-MINOR) worker: add cpu profile APIs for worker (theanarkh) #​59428
Commits

v24.7.0: 2025-08-27, Version 24.7.0 (Current), @​targos

Compare Source

Notable Changes
Post-Quantum Cryptography in node:crypto

OpenSSL 3.5 on 24.x kicked off post-quantum cryptography efforts in Node.js by
allowing use of NIST's post-quantum cryptography standards for future-proofing
applications against quantum computing threats. The following post-quantum
algorithms are now available in node:crypto:

  • ML-KEM (FIPS 203, Module-Lattice-Based Key-Encapsulation Mechanism Standard) through new crypto.encapsulate() and crypto.decapsulate() methods.
  • ML-DSA (FIPS 204, Module-Lattice-Based Digital Signature Standard) in the existing crypto.sign() and crypto.verify() methods.

Contributed by Filip Skokan in #​59259 and #​59491.

Modern Algorithms in Web Cryptography API

The second substantial extension to the Web Cryptography API
(globalThis.crypto.subtle) was recently accepted for incubation by WICG.
The following algorithms and methods from this extension are now available in
the Node.js Web Cryptography API implementation:

  • AES-OCB
  • ChaCha20-Poly1305
  • ML-DSA
  • ML-KEM
  • SHA-3
  • SHAKE
  • subtle.getPublicKey()
  • SubtleCrypto.supports()
  • ... with more coming in future releases.

Contributed by Filip Skokan in #​59365, #​59569, #​59461, and #​59539.

Node.js execution argument support in single executable applications

The single executable application configuration now supports additional fields
to specify Node.js execution arguments and control how they can be extended when
the application is run.

  • execArgv takes an array of strings for the execution arguments to be used.
  • execArgvExtension takes one of the following values:
    • "none": No additional execution arguments are allowed.
    • "cli": Additional execution arguments can be provided via a special command-line flag --node-options="--flag1 --flag2=value" at run time.
    • "env" (default): Additional execution arguments can be provided via the NODE_OPTIONS environment variable at run time.

For example, with the following configuration:

{
  "main": "/path/to/bundled/script.js",
  "output": "/path/to/write/the/generated/blob.blob",
  "execArgv": ["--no-warnings"],
  "execArgvExtension": "cli",
}

If the generated single executable application is named sea, then running:

sea --node-options="--max-old-space-size=4096" user-arg1 user-arg2

Would be equivalent to running:

node --no-warnings --max-old-space-size=4096 /path/to/bundled/script.js user-arg1 user-arg2

Contributed by Joyee Cheung in #​59314 and #​59560.

Root certificates updated to NSS 3.114

Certificates added:

  • TrustAsia TLS ECC Root CA
  • TrustAsia TLS RSA Root CA
  • SwissSign RSA TLS Root CA 2022 - 1

Certificates removed:

  • GlobalSign Root CA
  • Entrust.net Premium 2048 Secure Server CA
  • Baltimore CyberTrust Root
  • Comodo AAA Services root
  • XRamp Global CA Root
  • Go Daddy Class 2 CA
  • Starfield Class 2 CA
Other Notable Changes
  • [d3afc63c44] - (SEMVER-MINOR) crypto: add argon2() and argon2Sync() methods (Ranieri Althoff) #​50353
  • [6ae202fcdf] - (SEMVER-MINOR) http: add Agent.agentKeepAliveTimeoutBuffer option (Haram Jeong) #​59315
  • [dafee05358] - (SEMVER-MINOR) http2: add support for raw header arrays in h2Stream.respond() (Tim Perry) #​59455
  • [8dc6f5b696] - (SEMVER-MINOR) stream: add brotli support to CompressionStream and DecompressionStream (Matthew Aitken) #​59464
Commits
  • [0fa22cbf7c] - benchmark: calibrate config v8/serialize.js (Rafael Gonzaga) #​59586
  • [f5ece45b45] - benchmark: reduce readfile-permission-enabled config (Rafael Gonzaga) #​59589
  • [8ebd4f4434] - benchmark: calibrate length of util.diff (Rafael Gonzaga) #​59588
  • [7dee3ffd14] - benchmark: reflect current OpenSSL in crypto key benchmarks (Filip Skokan) #​59459
  • [027b861ca1] - benchmark, test: replace CRLF variable with string literal (Lee Jiho) #​59466
  • [89dd770889] - build: do not set -mminimal-toc with clang (Richard Lau) #​59484
  • [e13de4542f] - child_process: remove unsafe array iteration (hotpineapple) #​59347
  • [89fe63551e] - crypto: load system CA certificates off thread (Joyee Cheung) #​59550
  • [152c5ef518] - (SEMVER-MINOR) crypto: add AES-OCB Web Cryptography algorithm (Filip Skokan) #​59539
  • [c6c418343d] - crypto: update root certificates to NSS 3.114 (Node.js GitHub Bot) #​59571
  • [18a2ee5b6c] - (SEMVER-MINOR) crypto: support ML-KEM in Web Cryptography (Filip Skokan) #​59569
  • [72937e5144] - crypto: require HMAC key length with SHA-3 hashes in Web Cryptography (Filip Skokan) #​59567
  • [b7383186c7] - crypto: fix subtle.getPublicKey error for secret type key inputs (Filip Skokan) #​59558
  • [2d05c046db] - crypto: return cached copies from CryptoKey algorithm and usages getters (Filip Skokan) #​59538
  • [207ffbeb07] - crypto: use CryptoKey internal slots in Web Cryptography (Filip Skokan) #​59538
  • [4276516781] - crypto: normalize RsaHashedKeyParams publicExponent (Filip Skokan) #​59538
  • [14741539a7] - (SEMVER-MINOR) crypto: support ML-KEM, DHKEM, and RSASVE key encapsulation mechanisms (Filip Skokan) #​59491
  • [d3afc63c44] - (SEMVER-MINOR) crypto: add argon2() and argon2Sync() methods (Ranieri Althoff) #​50353
  • [4fe383e45a] - (SEMVER-MINOR) crypto: support ML-DSA spki/pkcs8 key formats in Web Cryptography (Filip Skokan) #​59365
  • [a95386fbf9] - (SEMVER-MINOR) crypto: subject some algorithms in Web Cryptography on BoringSSL absence (Filip Skokan) #​59365
  • [3f47a2fb63] - (SEMVER-MINOR) crypto: add ChaCha20-Poly1305 Web Cryptography algorithm (Filip Skokan) #​59365
  • [6fcce9058a] - (SEMVER-MINOR) crypto: add subtle.getPublicKey() utility function in Web Cryptography (Filip Skokan) #​59365
  • [76cde76429] - (SEMVER-MINOR) crypto: add SHA-3 Web Cryptography digest algorithms (Filip Skokan) #​59365
  • [247d017501] - (SEMVER-MINOR) crypto: add SHAKE Web Cryptography digest algorithms (Filip Skokan) #​59365
  • [f4fbcca5ce] - (SEMVER-MINOR) crypto: add SubtleCrypto.supports feature detection in Web Cryptography (Filip Skokan) #​59365
  • [a55382214f] - (SEMVER-MINOR) crypto: support ML-DSA in Web Cryptography (Filip Skokan) #​59365
  • [c38988c860] - crypto: fix EVPKeyCtxPointer::publicCheck() (Tobias Nießen) #​59471
  • [61c3bcdc56] - (SEMVER-MINOR) crypto: support ML-KEM KeyObject (Filip Skokan) #​59461
  • [0821b446fb] - deps: update undici to 7.14.0 (Node.js GitHub Bot) #​59507
  • [b3af17c065] - deps: V8: cherry-pick 7b91e3e (Milad Fa) #​59485
  • [9b69baf146] - deps: V8: cherry-pick 59d52e3 (Milad Fa) #​59485
  • [b4f202c2f1] - doc: improve sqlite.backup() progress/fulfillment documentation (René) #​59598
  • [40b217a2f9] - doc: clarify experimental platform vulnerability policy (Matteo Collina) #​59591
  • [cf84fffea5] - doc: link to TypedArray.from() in signature (Aviv Keller) #​59226
  • [4bf6ed0bf5] - doc: fix typos in environment_variables.md (PhistucK) #​59536
  • [1784c35a49] - doc: add security incident reponse plan (Rafael Gonzaga) #​59470
  • [b962560240] - doc: clarify maxRSS unit in process.resourceUsage() (Alex Yang) #​59511
  • [e6a6cdb9df] - doc: add missing Zstd strategy constants (RANDRIAMANANTENA Narindra Tiana Annaick) #​59312
  • [a6a31cb467] - (SEMVER-MINOR) doc: compress Web Cryptography Algorithm matrix (Filip Skokan) #​59365
  • [8f8960cfcb] - doc: fix the version tls.DEFAULT_CIPHERS was added (Allon Murienik) [#&

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Enabled.

Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about these updates again.


  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate renovate bot enabled auto-merge October 28, 2025 02:02
@renovate renovate bot added this pull request to the merge queue Oct 28, 2025
@github-merge-queue github-merge-queue bot removed this pull request from the merge queue due to a conflict with the base branch Oct 28, 2025
@renovate renovate bot enabled auto-merge October 28, 2025 05:52
@renovate renovate bot force-pushed the renovate/node-24.x branch from c7fff14 to 9806f2b Compare October 28, 2025 05:52
@renovate renovate bot added this pull request to the merge queue Oct 28, 2025
Merged via the queue into main with commit f60aaf1 Oct 28, 2025
12 checks passed
@renovate renovate bot deleted the renovate/node-24.x branch October 28, 2025 05:54
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant