Skip to content

Conversation

github-actions[bot]
Copy link
Contributor

2025-10-20, Version 22.21.0 'Jod' (LTS), @aduh95

Notable Changes

  • [af8b5fa29d] - (SEMVER-MINOR) http: add shouldUpgradeCallback to let servers control HTTP upgrades (Tim Perry) #59824

Commits

  • [a71dd592e3] - benchmark: calibrate config dgram multi-buffer (Bruno Rodrigues) #59696
  • [16c4b466f4] - benchmark: calibrate config cluster/echo.js (Nam Yooseong) #59836
  • [53cb9f3b6c] - build: add the missing macro definitions for OpenHarmony (hqzing) #59804
  • [ec5290fe01] - build: do not include custom ESLint rules testing in tarball (Antoine du Hamel) #59809
  • [1f93913446] - crypto: use return await when returning Promises from async functions (Renegade334) #59841
  • [f488b2ff73] - crypto: use async functions for non-stub Promise-returning functions (Renegade334) #59841
  • [aed9fd5ac4] - crypto: avoid calls to promise.catch() (Renegade334) #59841
  • [37c2d186f0] - deps: update amaro to 1.1.4 (pmarchini) #60044
  • [28aea13419] - deps: update archs files for openssl-3.5.4 (Node.js GitHub Bot) #60101
  • [ddbc1aa0bb] - deps: upgrade openssl sources to openssl-3.5.4 (Node.js GitHub Bot) #60101
  • [badbba2da9] - deps: update googletest to 50b8600 (Node.js GitHub Bot) #59955
  • [48aaf98a08] - deps: update archs files for openssl-3.5.3 (Node.js GitHub Bot) #59901
  • [e02a562ea6] - deps: upgrade openssl sources to openssl-3.5.3 (Node.js GitHub Bot) #59901
  • [7e0e86cb92] - deps: upgrade npm to 10.9.4 (npm team) #60074
  • [91dda5facf] - deps: update undici to 6.22.0 (Matteo Collina) #60112
  • [3a3220a2f0] - dgram: restore buffer optimization in fixBufferList (Yoo) #59934
  • [09bdcce6b8] - diagnostics_channel: fix race condition with diagnostics_channel and GC (Ugaitz Urien) #59910
  • [b3eeb3bd13] - doc: provide alternative to url.parse() using WHATWG URL (Steven) #59736
  • [1ddaab1904] - doc: mention reverse proxy and include simple example (Steven) #59736
  • [3b3b71e99c] - doc: mark .env files support as stable (Santeri Hiltunen) #59925
  • [d37f67d1bd] - doc: remove optional title prefixes (Aviv Keller) #60087
  • [ca2dff63f9] - doc: fix typo on child_process.md (Angelo Gazzola) #60114
  • [3fca564a05] - doc: add automated migration info to deprecations (Augustin Mauroy) #60022
  • [4bc366fc16] - doc: use "WebAssembly" instead of "Web Assembly" (Tobias Nießen) #59954
  • [4808dbdd9a] - doc: fix typo in section on microtask order (Tobias Nießen) #59932
  • [d6e303d645] - doc: update V8 fast API guidance (René) #58999
  • [0a3a3f729e] - doc: add security escalation policy (Ulises Gascón) #59806
  • [8fd669c70d] - doc: type improvement of file http.md (yusheng chen) #58189
  • [9833dc6060] - doc: rephrase dynamic import() description (Nam Yooseong) #59224
  • [2870a73681] - doc,crypto: update subtle.generateKey and subtle.importKey (Filip Skokan) #59851
  • [85818db93c] - fs,win: do not add a second trailing slash in readdir (Gerhard Stöbich) #59847
  • [af8b5fa29d] - (SEMVER-MINOR) http: add shouldUpgradeCallback to let servers control HTTP upgrades (Tim Perry) #59824
  • [758271ae66] - http: optimize checkIsHttpToken for short strings (방진혁) #59832
  • [a33ed9bf96] - inspector: ensure adequate memory allocation for Binary::toBase64 (René) #59870
  • [34c686be2b] - lib: update inspect output format for subclasses (Miguel Marcondes Filho) #59687
  • [12e553529c] - lib: add source map support for assert messages (Chengzhong Wu) #59751
  • [d2a70571f8] - lib,src: refactor assert to load error source from memory (Chengzhong Wu) #59751
  • [20a9e86b5d] - meta: move Michael to emeritus (Michael Dawson) #60070
  • [c591cca15c] - meta: bump github/codeql-action from 3.30.0 to 3.30.5 (dependabot[bot]) #60089
  • [090ba141b1] - meta: bump codecov/codecov-action from 5.5.0 to 5.5.1 (dependabot[bot]) #60091
  • [a0ba6884a5] - meta: bump actions/stale from 9.1.0 to 10.0.0 (dependabot[bot]) #60092
  • [0feca0c541] - meta: bump actions/setup-node from 4.4.0 to 5.0.0 (dependabot[bot]) #60093
  • [7cd2b42d18] - meta: bump step-security/harden-runner from 2.12.2 to 2.13.1 (dependabot[bot]) #60094
  • [1f3b9d66ac] - meta: bump actions/cache from 4.2.4 to 4.3.0 (dependabot[bot]) #60095
  • [0fedbb3de7] - meta: bump ossf/scorecard-action from 2.4.2 to 2.4.3 (dependabot[bot]) #60096
  • [04590b8267] - meta: bump actions/setup-python from 5.6.0 to 6.0.0 (dependabot[bot]) #60090
  • [2bf0a9318f] - meta: add .npmrc with ignore-scripts=true (Joyee Cheung) #59914
  • [e10dc7b81c] - module: allow overriding linked requests for a ModuleWrap (Chengzhong Wu) #59527
  • [2237142369] - module: link module with a module request record (Chengzhong Wu) #58886
  • [6d24b88fbc] - node-api: added SharedArrayBuffer api (Mert Can Altin) #59071
  • [4cc84c96f4] - node-api: make napi_delete_reference use node_api_basic_env (Jeetu Suthar) #59684
  • [e790eb6b50] - repl: fix cpu overhead pasting big strings to the REPL (Ruben Bridgewater) #59857
  • [99ea08dc43] - repl: add isValidParentheses check before wrap input (Xuguang Mei) #59607
  • [e4a4f63019] - sqlite: fix crash session extension callbacks with workers (Bart Louwers) #59848
  • [84701ff668] - src: clear all linked module caches once instantiated (Chengzhong Wu) #59117
  • [8e182e561f] - src: remove unnecessary Environment::GetCurrent() calls (Moonki Choi) #59814
  • [c9cde35c4d] - src: simplify is_callable by making it a concept (Tobias Nießen) #58169
  • [892b425ee1] - src: rename private fields to follow naming convention (Moonki Choi) #59923
  • [36b68db7f5] - src: reduce the nearest parent package JSON cache size (Michael Smith) #59888
  • [26b40bad02] - src: replace FIXED_ONE_BYTE_STRING with Environment-cached strings (Moonki Choi) #59891
  • [34dcb7dc32] - src: create strings in FIXED_ONE_BYTE_STRING as internalized (Anna Henningsen) #59826
  • [4d748add05] - src: remove std::array overload of FIXED_ONE_BYTE_STRING (Anna Henningsen) #59826
  • [bb6fd7c2d1] - src: ensure v8::Eternal is empty before setting it (Anna Henningsen) #59825
  • [7a91282bf9] - src: use simdjson::pad (0hm☘️) #59391
  • [ba00875f01] - stream: use new AsyncResource instead of bind (Matteo Collina) #59867
  • [7067d79fb3] - test: mark sea tests flaky on macOS x64 (Richard Lau) #60068
  • [ca1942c9d5] - test: testcase demonstrating issue 59541 (Eric Rannaud) #59801
  • [19a7b1ef26] - tls: load bundled and extra certificates off-thread (Joyee Cheung) #59856
  • [095e7a81fc] - tls: only do off-thread certificate loading on loading tls (Joyee Cheung) #59856
  • [c42c1204c7] - tools: fix tools/make-v8.sh for clang (Richard Lau) #59893
  • [b632a1d98d] - tools: skip test-internet workflow for draft PRs (Michaël Zasso) #59817
  • [6021c3ac76] - tools: copyedit build-tarball.yml (Antoine du Hamel) #59808
  • [ef005d0c9b] - typings: update 'types' binding (René) #59692
  • [28ef564ecd] - typings: remove unused imports (Nam Yooseong) #59880
  • [f88752ddb6] - url: replaced slice with at (Mikhail) #59181
  • [24c224960c] - url: add type checking to urlToHttpOptions() (simon-id) #59753
  • [f2fbcc576d] - util: fix debuglog.enabled not being present with callback logger (Ruben Bridgewater) #59858
  • [6277058e43] - vm: sync-ify SourceTextModule linkage (Chengzhong Wu) #59000
  • [5bf21a4309] - vm: explain how to share promises between contexts w/ afterEvaluate (Eric Rannaud) #59801
  • [312b33a083] - vm: "afterEvaluate", evaluate() return a promise from the outer context (Eric Rannaud) #59801
  • [1eadab863c] - win,tools: add description to signature (Martin Costello) #59877
  • [816e1befb1] - zlib: reduce code duplication (jhofstee) #57810

mcollina and others added 30 commits October 7, 2025 15:53
Signed-off-by: Matteo Collina <hello@matteocollina.com>
PR-URL: #60112
Reviewed-By: Richard Lau <richard.lau@ibm.com>
Reviewed-By: Matthew Aitken <maitken033380023@gmail.com>
PR-URL: #60074
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Marco Ippolito <marcoippolito54@gmail.com>
PR-URL: #59607
Backport-PR-URL: #60066
Reviewed-By: Ruben Bridgewater <ruben@bridgewater.de>
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
When a module is being statically linked with module requests, if two
module requests with a same specifier but different attributes are
resolved to two modules, the module requests should be linked to these
two modules.

PR-URL: #58886
Backport-PR-URL: #60000
Refs: https://tc39.es/ecma262/#sec-HostLoadImportedModule
Refs: https://github.com/tc39/proposal-import-attributes?tab=readme-ov-file#how-would-this-proposal-work-with-caching
Reviewed-By: Guy Bedford <guybedford@gmail.com>
Reviewed-By: Joyee Cheung <joyeec9h3@gmail.com>
PR-URL: #59391
Refs: #59389
Reviewed-By: Daniel Lemire <daniel@lemire.me>
Reviewed-By: Joyee Cheung <joyeec9h3@gmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
PR-URL: #59808
Refs: https://www.shellcheck.net/wiki/SC2006
Refs: https://www.shellcheck.net/wiki/SC2086
Reviewed-By: Tierney Cyren <hello@bnb.im>
Reviewed-By: Michaël Zasso <targos@protonmail.com>
Reviewed-By: Richard Lau <richard.lau@ibm.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
PR-URL: #59809
Reviewed-By: Richard Lau <richard.lau@ibm.com>
Reviewed-By: Tierney Cyren <hello@bnb.im>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
PR-URL: #59817
Reviewed-By: Chengzhong Wu <legendecas@gmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Marco Ippolito <marcoippolito54@gmail.com>
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
Reviewed-By: Moshe Atlow <moshe@atlow.co.il>
The source code is available from V8 API and assert can avoid reading
the source file from the filesystem and parse the file again.

PR-URL: #59751
Reviewed-By: Marco Ippolito <marcoippolito54@gmail.com>
Map source lines in assert messages with cached source maps.

PR-URL: #59751
Reviewed-By: Marco Ippolito <marcoippolito54@gmail.com>
V8 does not check this for us, but this is a requirement of the API.

PR-URL: #59825
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Chengzhong Wu <legendecas@gmail.com>
Reviewed-By: Juan José Arboleda <soyjuanarbol@gmail.com>
The description is updated to clarify that dynamic import() is
asynchronous, dynamic, and works in both CJS and ESM contexts.
The new phrasing also avoids implying it is the only method for
loading ES modules in CommonJS.

Fixes: #59077
PR-URL: #59224
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
PR-URL: #59753
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Ruben Bridgewater <ruben@bridgewater.de>
Reviewed-By: Bryan English <bryan@bryanenglish.com>
PR-URL: #59836
Reviewed-By: Rafael Gonzaga <rafael.nunu@hotmail.com>
Reviewed-By: Daeyeon Jeong <daeyeon.dev@gmail.com>
PR-URL: #59684
Refs: #59583
Reviewed-By: Chengzhong Wu <legendecas@gmail.com>
Reviewed-By: Vladimir Morozov <vmorozov@microsoft.com>
This overload was only used in one place, in a cold path, and in
particular in a place where the compiler would be able to generate
the exact same code using just a call to `.size()`.

PR-URL: #59826
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Juan José Arboleda <soyjuanarbol@gmail.com>
Reviewed-By: Gerhard Stöbich <deb2001-github@yahoo.de>
Reviewed-By: Chengzhong Wu <legendecas@gmail.com>
These string keys can generally be assumed to be long-lived.

PR-URL: #59826
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Juan José Arboleda <soyjuanarbol@gmail.com>
Reviewed-By: Gerhard Stöbich <deb2001-github@yahoo.de>
Reviewed-By: Chengzhong Wu <legendecas@gmail.com>
Pasting input should not trigger any completions and other
calculations. This is now handled by just writing the string to the
terminal in case the user is pasting. As soon as pasting is done,
the completions will be re-enabled.

Fixes: #40626
Fixes: #43343
PR-URL: #59857
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
The method returned by the callback is missing the .enabled property.
This is added in a consistent way that it also verifies that it's a
getter.

Fixes: #56676
PR-URL: #59858
Reviewed-By: Michaël Zasso <targos@protonmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
`outgoingMessage.setHeader` and `outgoingMessage.getHeader` section

PR-URL: #58189
Reviewed-By: Ethan Arrowood <ethan@arrowood.dev>
Reviewed-By: Ruben Bridgewater <ruben@bridgewater.de>
PR-URL: #59181
Reviewed-By: Jordan Harband <ljharb@gmail.com>
Reviewed-By: Zeyu "Alex" Yang <himself65@outlook.com>
Reviewed-By: Daniel Lemire <daniel@lemire.me>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Ruben Bridgewater <ruben@bridgewater.de>
PR-URL: #59696
Reviewed-By: Rafael Gonzaga <rafael.nunu@hotmail.com>
Reviewed-By: Ruben Bridgewater <ruben@bridgewater.de>
Use lookup table instead of regex for strings shorter than 10
characters to improve performance for common short header names
while maintaining compatibility.

PR-URL: #59832
Reviewed-By: Ethan Arrowood <ethan@arrowood.dev>
Reviewed-By: Tim Perry <pimterry@gmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Ruben Bridgewater <ruben@bridgewater.de>
PR-URL: #59870
Reviewed-By: Anna Henningsen <anna@addaleax.net>
Reviewed-By: Chengzhong Wu <legendecas@gmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
PR-URL: #59806
Refs: openjs-foundation/cross-project-council#1588
Reviewed-By: Marco Ippolito <marcoippolito54@gmail.com>
Reviewed-By: Rafael Gonzaga <rafael.nunu@hotmail.com>
Reviewed-By: Richard Lau <richard.lau@ibm.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
PR-URL: #59880
Reviewed-By: Daeyeon Jeong <daeyeon.dev@gmail.com>
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
PR-URL: #59071
Reviewed-By: Chengzhong Wu <legendecas@gmail.com>
The bind method uses ObjectDefineProperty that shows up
in flamegraphs. This changes it to avoid the utility.

Signed-off-by: Matteo Collina <hello@matteocollina.com>
PR-URL: #59867
Reviewed-By: Robert Nagy <ronagy@icloud.com>
Reviewed-By: Ruben Bridgewater <ruben@bridgewater.de>
Reviewed-By: Rafael Gonzaga <rafael.nunu@hotmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Stephen Belanger <admin@stephenbelanger.com>
PR-URL: #59891
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Anna Henningsen <anna@addaleax.net>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Gerhard Stöbich <deb2001-github@yahoo.de>
PR-URL: #59888
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
Reviewed-By: Rafael Gonzaga <rafael.nunu@hotmail.com>
Reviewed-By: Edy Silva <edigleyssonsilva@gmail.com>
Reviewed-By: Ruben Bridgewater <ruben@bridgewater.de>
louwers and others added 26 commits October 11, 2025 20:49
PR-URL: #59848
Reviewed-By: Anna Henningsen <anna@addaleax.net>
Reviewed-By: Zeyu "Alex" Yang <himself65@outlook.com>
Reviewed-By: Edy Silva <edigleyssonsilva@gmail.com>
PR-URL: #60101
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Michaël Zasso <targos@protonmail.com>
Reviewed-By: Filip Skokan <panva.ip@gmail.com>
Reviewed-By: Richard Lau <richard.lau@ibm.com>
PR-URL: #60101
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Michaël Zasso <targos@protonmail.com>
Reviewed-By: Filip Skokan <panva.ip@gmail.com>
Reviewed-By: Richard Lau <richard.lau@ibm.com>
PR-URL: #60044
Fixes: #60007
Fixes: #59737
Reviewed-By: Zeyu "Alex" Yang <himself65@outlook.com>
Reviewed-By: Rafael Gonzaga <rafael.nunu@hotmail.com>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Pietro Marchini <pietro.marchini94@gmail.com>
Reviewed-By: Ulises Gascón <ulisesgascongonzalez@gmail.com>
Reviewed-By: Marco Ippolito <marcoippolito54@gmail.com>
Bumps [actions/setup-python](https://github.com/actions/setup-python) from 5.6.0 to 6.0.0.
- [Release notes](https://github.com/actions/setup-python/releases)
- [Commits](actions/setup-python@a26af69...e797f83)

---
updated-dependencies:
- dependency-name: actions/setup-python
  dependency-version: 6.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
PR-URL: #60090
Reviewed-By: Rafael Gonzaga <rafael.nunu@hotmail.com>
Reviewed-By: Michaël Zasso <targos@protonmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Bumps [ossf/scorecard-action](https://github.com/ossf/scorecard-action) from 2.4.2 to 2.4.3.
- [Release notes](https://github.com/ossf/scorecard-action/releases)
- [Changelog](https://github.com/ossf/scorecard-action/blob/main/RELEASE.md)
- [Commits](ossf/scorecard-action@05b42c6...4eaacf0)

---
updated-dependencies:
- dependency-name: ossf/scorecard-action
  dependency-version: 2.4.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
PR-URL: #60096
Reviewed-By: Michaël Zasso <targos@protonmail.com>
Reviewed-By: Ulises Gascón <ulisesgascongonzalez@gmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Bumps [actions/cache](https://github.com/actions/cache) from 4.2.4 to 4.3.0.
- [Release notes](https://github.com/actions/cache/releases)
- [Changelog](https://github.com/actions/cache/blob/main/RELEASES.md)
- [Commits](actions/cache@0400d5f...0057852)

---
updated-dependencies:
- dependency-name: actions/cache
  dependency-version: 4.3.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
PR-URL: #60095
Reviewed-By: Michaël Zasso <targos@protonmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Bumps [step-security/harden-runner](https://github.com/step-security/harden-runner) from 2.12.2 to 2.13.1.
- [Release notes](https://github.com/step-security/harden-runner/releases)
- [Commits](step-security/harden-runner@6c439dc...f4a75cf)

---
updated-dependencies:
- dependency-name: step-security/harden-runner
  dependency-version: 2.13.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
PR-URL: #60094
Reviewed-By: Michaël Zasso <targos@protonmail.com>
Reviewed-By: Ulises Gascón <ulisesgascongonzalez@gmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Bumps [actions/setup-node](https://github.com/actions/setup-node) from 4.4.0 to 5.0.0.
- [Release notes](https://github.com/actions/setup-node/releases)
- [Commits](actions/setup-node@49933ea...a0853c2)

---
updated-dependencies:
- dependency-name: actions/setup-node
  dependency-version: 5.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
PR-URL: #60093
Reviewed-By: Rafael Gonzaga <rafael.nunu@hotmail.com>
Reviewed-By: Michaël Zasso <targos@protonmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Bumps [actions/stale](https://github.com/actions/stale) from 9.1.0 to 10.0.0.
- [Release notes](https://github.com/actions/stale/releases)
- [Changelog](https://github.com/actions/stale/blob/main/CHANGELOG.md)
- [Commits](actions/stale@5bef64f...3a9db7e)

---
updated-dependencies:
- dependency-name: actions/stale
  dependency-version: 10.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
PR-URL: #60092
Reviewed-By: Michaël Zasso <targos@protonmail.com>
Reviewed-By: Ulises Gascón <ulisesgascongonzalez@gmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Bumps [codecov/codecov-action](https://github.com/codecov/codecov-action) from 5.5.0 to 5.5.1.
- [Release notes](https://github.com/codecov/codecov-action/releases)
- [Changelog](https://github.com/codecov/codecov-action/blob/main/CHANGELOG.md)
- [Commits](codecov/codecov-action@fdcc847...5a10915)

---
updated-dependencies:
- dependency-name: codecov/codecov-action
  dependency-version: 5.5.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
PR-URL: #60091
Reviewed-By: Michaël Zasso <targos@protonmail.com>
Reviewed-By: Ulises Gascón <ulisesgascongonzalez@gmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Bumps [github/codeql-action](https://github.com/github/codeql-action) from 3.30.0 to 3.30.5.
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](github/codeql-action@2d92b76...3599b3b)

---
updated-dependencies:
- dependency-name: github/codeql-action
  dependency-version: 3.30.5
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
PR-URL: #60089
Reviewed-By: Michaël Zasso <targos@protonmail.com>
Reviewed-By: Ulises Gascón <ulisesgascongonzalez@gmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
I won't have enough time to contribute to Node.js to stay as a TSC
member for a while so moving myself to emeritus.

Signed-off-by: Michael Dawson <midawson@redhat.com>
PR-URL: #60070
Reviewed-By: Juan José Arboleda <soyjuanarbol@gmail.com>
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
Reviewed-By: Jordan Harband <ljharb@gmail.com>
Reviewed-By: Marco Ippolito <marcoippolito54@gmail.com>
Reviewed-By: Filip Skokan <panva.ip@gmail.com>
Reviewed-By: Michaël Zasso <targos@protonmail.com>
Reviewed-By: Richard Lau <richard.lau@ibm.com>
Reviewed-By: Ruben Bridgewater <ruben@bridgewater.de>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Abdirahim Musse <abdirahim.musse@ibm.com>
PR-URL: #60022
Reviewed-By: Stephen Belanger <admin@stephenbelanger.com>
Reviewed-By: Jacob Smith <jacob@frende.me>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
This note on `options.stdio` mentions that it's not recommended to pass
`stdin` as a writable stream and `stdout/stderr` as readable, but then
proceeds to say to always check that `stdin` is writable and
`stdout/stderr` are readable.

Going by the examples and the fact that `process.stdin` is readable and
`process.stdout/process.stderr` are writable, I'm assuming that the
types in the recommendation got swapped.

PR-URL: #60114
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Akhil Marsonya <akhil.marsonya27@gmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
PR-URL: #60087
Refs: nodejs/doc-kit#378
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Anna Henningsen <anna@addaleax.net>
As discussed in the referenced issue the feature should be ready to be
marked as stable.

Refs: #49148 (comment)
PR-URL: #59925
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com>
PR-URL: #59736
Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com>
Reviewed-By: Rich Trott <rtrott@gmail.com>
Reviewed-By: Gerhard Stöbich <deb2001-github@yahoo.de>
Reviewed-By: Trivikram Kamat <trivikr.dev@gmail.com>
PR-URL: #59736
Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com>
Reviewed-By: Rich Trott <rtrott@gmail.com>
Reviewed-By: Gerhard Stöbich <deb2001-github@yahoo.de>
Reviewed-By: Trivikram Kamat <trivikr.dev@gmail.com>
- Adds:
  - isGeneratorObject
  - isProxy
  - isSharedArrayBuffer
  - isSymbolObject
- Removes:
  - isTypedArray
- Fixes:
  - isDate
  - isNativeError
  - isRegExp
- Improves:
  - isArgumentsObject
  - isExternal

PR-URL: #59692
Reviewed-By: Daeyeon Jeong <daeyeon.dev@gmail.com>
Reviewed-By: Chengzhong Wu <legendecas@gmail.com>
Reviewed-By: Ruben Bridgewater <ruben@bridgewater.de>
Reviewed-By: James M Snell <jasnell@gmail.com>
There are two phases in module linking: link, and instantiate. These
two operations are required to be separated to allow cyclic
dependencies.

`v8::Module::InstantiateModule` is only required to be invoked on the
root module. The global references created by `ModuleWrap::Link` are
only cleared at `ModuleWrap::Instantiate`. So the global references
created for depended modules are usually not cleared because
`ModuleWrap::Instantiate` is not invoked for each of depended modules,
and caused memory leak.

The change references the linked modules in an object internal slot.

This is not an issue for Node.js ESM support as these modules can not be
off-loaded. However, this could be outstanding for `vm.Module`.

PR-URL: #59117
Backport-PR-URL: #60152
Fixes: #50113
Reviewed-By: Joyee Cheung <joyeec9h3@gmail.com>
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
This allows overriding linked requests for a `ModuleWrap`. The
`statusOverride` in `vm.SourceTextModule` could call `moduleWrap.link`
a second time when `statusOverride` of `linking` is set to undefined.

Overriding of linked requests should be no harm but better to be
avoided. However, this will require a follow-up fix on `statusOverride`
in `vm.SourceTextModule`.

PR-URL: #59527
Backport-PR-URL: #60152
Fixes: #59480
Reviewed-By: Joyee Cheung <joyeec9h3@gmail.com>
Reviewed-By: Marco Ippolito <marcoippolito54@gmail.com>
Split `module.link(linker)` into two synchronous step
`sourceTextModule.linkRequests()` and
`sourceTextModule.instantiate()`. This allows creating vm modules and
resolving the dependencies in a complete synchronous procedure.

This also makes `syntheticModule.link()` redundant. The link step for a
SyntheticModule is no-op and is already taken care in the constructor
by initializing the binding slots with the given export names.

PR-URL: #59000
Backport-PR-URL: #60152
Refs: #37648
Reviewed-By: Joyee Cheung <joyeec9h3@gmail.com>
When signing files for Windows, add "Node.js" as the description.

PR-URL: #59877
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Daeyeon Jeong <daeyeon.dev@gmail.com>
Reviewed-By: Stefan Stojanovic <stefan.stojanovic@janeasystems.com>
PR-URL: #60068
Refs: #59553
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Michaël Zasso <targos@protonmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Rafael Gonzaga <rafael.nunu@hotmail.com>
Reviewed-By: Ruben Bridgewater <ruben@bridgewater.de>
Reviewed-By: Anna Henningsen <anna@addaleax.net>
Notable changes:

http:
  * (SEMVER-MINOR) add shouldUpgradeCallback to let servers control HTTP upgrades (Tim Perry) #59824

PR-URL: #60230
@nodejs-github-bot
Copy link
Collaborator

Review requested:

  • @nodejs/actions
  • @nodejs/releasers
  • @nodejs/security-wg
  • @nodejs/tsc
  • @nodejs/v8-update

@github-actions github-actions bot added the release Issues and PRs related to Node.js releases. label Oct 12, 2025
@github-actions github-actions bot added the v22.x Issues that can be reproduced on v22.x or PRs targeting the v22.x-staging branch. label Oct 12, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

release Issues and PRs related to Node.js releases. v22.x Issues that can be reproduced on v22.x or PRs targeting the v22.x-staging branch.

Projects

None yet

Development

Successfully merging this pull request may close these issues.