2025-11-17, Version 25.2.1 (Current)

CHANGELOG.md

@@ -41,7 +41,8 @@ release.
 </tr>
 <tr>
   <td valign="top">
-<b><a href="doc/changelogs/CHANGELOG_V25.md#25.2.0">25.2.0</a></b><br/>
+<b><a href="doc/changelogs/CHANGELOG_V25.md#25.2.1">25.2.1</a></b><br/>
+<a href="doc/changelogs/CHANGELOG_V25.md#25.2.0">25.2.0</a><br/>
 <a href="doc/changelogs/CHANGELOG_V25.md#25.1.0">25.1.0</a><br/>
 <a href="doc/changelogs/CHANGELOG_V25.md#25.0.0">25.0.0</a><br/>
   </td>

common.gypi

@@ -38,7 +38,7 @@
 
     # Reset this number to 0 on major V8 upgrades.
     # Increment by one for each non-official patch applied to deps/v8.
-    'v8_embedder_string': '-node.13',
+    'v8_embedder_string': '-node.14',
 
     ##### V8 defaults for Node.js #####
 

deps/v8/DEPS

@@ -141,7 +141,7 @@ deps = {
       }
     ],
     'dep_type': 'cipd',
-    'condition': 'host_os == "linux" and host_cpu != "s390" and host_os != "zos" and host_cpu != "ppc"',
+    'condition': 'host_os == "linux" and host_cpu != "s390x" and host_os != "zos" and host_cpu != "ppc64"',
   },
   'buildtools/mac': {
     'packages': [
@@ -171,7 +171,7 @@ deps = {
       }
     ],
     'dep_type': 'cipd',
-    'condition': '(host_os == "linux" or host_os == "mac" or host_os == "win") and host_cpu != "s390" and host_os != "zos" and host_cpu != "ppc" and (host_cpu != "arm64" or host_os == "mac")',
+    'condition': '(host_os == "linux" or host_os == "mac" or host_os == "win") and host_cpu != "s390x" and host_os != "zos" and host_cpu != "ppc64" and (host_cpu != "arm64" or host_os == "mac")',
   },
   'test/benchmarks/data':
     Var('chromium_url') + '/v8/deps/third_party/benchmarks.git' + '@' + '05d7188267b4560491ff9155c5ee13e207ecd65f',
@@ -481,7 +481,7 @@ deps = {
       }
     ],
     'dep_type': 'cipd',
-    'condition': 'host_cpu != "s390" and host_os != "zos" and host_cpu != "ppc"'
+    'condition': 'host_cpu != "s390x" and host_os != "zos" and host_cpu != "ppc64"'
   },
   'third_party/partition_alloc': {
     'url': Var('chromium_url') + '/chromium/src/base/allocator/partition_allocator.git@' + Var('partition_alloc_version'),
@@ -545,7 +545,7 @@ deps = {
       }
     ],
     'dep_type': 'cipd',
-    'condition': 'not build_with_chromium and host_cpu != "s390" and host_os != "zos" and host_cpu != "ppc"',
+    'condition': 'not build_with_chromium and host_cpu != "s390x" and host_os != "zos" and host_cpu != "ppc64"',
   },
   'third_party/zlib':
     Var('chromium_url') + '/chromium/src/third_party/zlib.git'+ '@' + 'caf4afa1afc92e16fef429f182444bed98a46a6c',

doc/api/cli.md

@@ -1741,10 +1741,11 @@
 added: v22.4.0
 -->
 
+> Stability: 1.2 - Release candidate.
+
 The file used to store `localStorage` data. If the file does not exist, it is
 created the first time `localStorage` is accessed. The same file may be shared
-between multiple Node.js processes concurrently. This flag is a no-op if
-Node.js is started with the `--no-webstorage` (or `--no-experimental-webstorage`) flag.
+between multiple Node.js processes concurrently.
 
 ### `--max-http-header-size=size`
 
@@ -1906,6 +1907,20 @@
 
 Disable exposition of {WebSocket} on the global scope.
 
+### `--no-experimental-webstorage`
+
+<!-- YAML
+added: v22.4.0
+changes:
+  - version: v25.0.0
+    pr-url: https://github.com/nodejs/node/pull/57666
+    description: The feature is now enabled by default.
+-->
+
+> Stability: 1.2 - Release candidate.
+
+Disable [`Web Storage`][] support.
+
 ### `--no-extra-info-on-fatal-exception`
 
 <!-- YAML
@@ -1973,14 +1988,6 @@
 
 Silence all process warnings (including deprecations).
 
-### `--no-webstorage`
-
-<!-- YAML
-added: v25.0.0
--->
-
-Disable [`Web Storage`][] support.
-
 ### `--node-memory-debug`
 
 <!-- YAML

doc/api/globals.md

@@ -644,13 +644,23 @@
 
 <!-- YAML
 added: v22.4.0
+changes:
+  - version: v25.0.0
+    pr-url: https://github.com/nodejs/node/pull/57666
+    description: When webstorage is enabled and `--localstorage-file` is not
+                 provided, accessing the `localStorage` global now returns an
+                 empty object.
+  - version: v25.0.0
+    pr-url: https://github.com/nodejs/node/pull/57666
+    description: This API is no longer behind `--experimental-webstorage` runtime flag.
 -->
 
+> Stability: 1.2 - Release candidate. Disable this API with [`--no-experimental-webstorage`][].
+
 A browser-compatible implementation of [`localStorage`][]. Data is stored
 unencrypted in the file specified by the [`--localstorage-file`][] CLI flag.
 The maximum amount of data that can be stored is 10 MB.
 Any modification of this data outside of the Web Storage API is not supported.
-Disable this API with the [`--no-webstorage`][] (or its alias `--no-experimental-webstorage`) CLI flag.
 `localStorage` data is not stored per user or per request when used in the context
 of a server, it is shared across all users and requests.
 
@@ -1073,9 +1083,13 @@
 
 <!-- YAML
 added: v22.4.0
+changes:
+  - version: v25.0.0
+    pr-url: https://github.com/nodejs/node/pull/57666
+    description: This API is no longer behind `--experimental-webstorage` runtime flag.
 -->
 
-> Stability: 1.0 - Early development.
+> Stability: 1.2 - Release candidate. Disable this API with [`--no-experimental-webstorage`][].
 
 A browser-compatible implementation of [`sessionStorage`][]. Data is stored in
 memory, with a storage quota of 10 MB. `sessionStorage` data persists only within
@@ -1111,10 +1125,9 @@
 added: v22.4.0
 -->
 
-> Stability: 1.0 - Early development.
+> Stability: 1.2 - Release candidate. Disable this API with [`--no-experimental-webstorage`][].
 
-A browser-compatible implementation of {Storage}. Disable this API with the
-[`--no-webstorage`][] (or its alias `--no-experimental-webstorage`) CLI flag.
+A browser-compatible implementation of {Storage}.
 
 ## `structuredClone(value[, options])`
 
@@ -1328,7 +1341,7 @@
 [`--localstorage-file`]: cli.md#--localstorage-filefile
 [`--no-experimental-global-navigator`]: cli.md#--no-experimental-global-navigator
 [`--no-experimental-websocket`]: cli.md#--no-experimental-websocket
-[`--no-webstorage`]: cli.md#--no-webstorage
+[`--no-experimental-webstorage`]: cli.md#--no-experimental-webstorage
 [`ByteLengthQueuingStrategy`]: webstreams.md#class-bytelengthqueuingstrategy
 [`CompressionStream`]: webstreams.md#class-compressionstream
 [`CountQueuingStrategy`]: webstreams.md#class-countqueuingstrategy

doc/changelogs/CHANGELOG_V25.md

@@ -8,6 +8,7 @@
 </tr>
 <tr>
 <td>
+<a href="#25.2.1">25.2.1</a><br/>
 <a href="#25.2.0">25.2.0</a><br/>
 <a href="#25.1.0">25.1.0</a><br/>
 <a href="#25.0.0">25.0.0</a><br/>
@@ -42,6 +43,19 @@
   * [io.js](CHANGELOG_IOJS.md)
   * [Archive](CHANGELOG_ARCHIVE.md)
 
+<a id="25.2.1"></a>
+
+## 2025-11-17, Version 25.2.1 (Current), @aduh95
+
+### Notable Changes
+
+### Commits
+
+* \[[`ff89b7b6c7`](https://github.com/nodejs/node/commit/ff89b7b6c7)] - **crypto**: ensure documented RSA-PSS saltLength default is used (Filip Skokan) [#60662](https://github.com/nodejs/node/pull/60662)
+* \[[`5316b580eb`](https://github.com/nodejs/node/commit/5316b580eb)] - **deps**: V8: backport 2e4c5cf9b112 (Michaël Zasso) [#60654](https://github.com/nodejs/node/pull/60654)
+* \[[`ca878bc90e`](https://github.com/nodejs/node/commit/ca878bc90e)] - **doc,src,lib**: clarify experimental status of Web Storage support (Antoine du Hamel) [#60708](https://github.com/nodejs/node/pull/60708)
+* \[[`a4dee613fd`](https://github.com/nodejs/node/commit/a4dee613fd)] - _**Revert**_ "**lib**: throw from localStorage getter on missing storage path" (Antoine du Hamel) [#60750](https://github.com/nodejs/node/pull/60750)
+
 <a id="25.2.0"></a>
 
 ## 2025-11-11, Version 25.2.0 (Current), @aduh95

doc/node.1

@@ -207,8 +207,8 @@ Enable experimental support for the EventSource Web API.
 .It Fl -no-experimental-websocket
 Disable experimental support for the WebSocket API.
 .
-.It Fl -no-webstorage
-Disable webstorage.
+.It Fl -no-experimental-webstorage
+Disable experimental support for the Web Storage API.
 .
 .It Fl -no-experimental-repl-await
 Disable top-level await keyword support in REPL.

lib/internal/crypto/sig.js

@@ -50,6 +50,8 @@ const {
   isArrayBufferView,
 } = require('internal/util/types');
 
+const constants = internalBinding('constants').crypto;
+
 function Sign(algorithm, options) {
   if (!(this instanceof Sign))
     return new Sign(algorithm, options);
@@ -85,7 +87,11 @@ function getPadding(options) {
 }
 
 function getSaltLength(options) {
-  return getIntOption('saltLength', options);
+  let saltLength = getIntOption('saltLength', options);
+  if (options.padding === constants.RSA_PKCS1_PSS_PADDING && saltLength === undefined) {
+    saltLength = constants.RSA_PSS_SALTLEN_MAX_SIGN;
+  }
+  return saltLength;
 }
 
 function getDSASignatureEncoding(options) {

lib/internal/process/pre_execution.js

@@ -398,7 +398,7 @@ function setupQuic() {
 
 function setupWebStorage() {
   if (getEmbedderOptions().noBrowserGlobals ||
-      !getOptionValue('--webstorage')) {
+      !getOptionValue('--experimental-webstorage')) {
     return;
   }
 

lib/internal/webstorage.js

@@ -1,9 +1,9 @@
 'use strict';
 const {
   ObjectDefineProperties,
+  Proxy,
 } = primordials;
 const { getOptionValue } = require('internal/options');
-const { lazyDOMException } = require('internal/util');
 const { kConstructorKey, Storage } = internalBinding('webstorage');
 const { getValidatedPath } = require('internal/fs/utils');
 const kInMemoryPath = ':memory:';
@@ -21,17 +21,34 @@ ObjectDefineProperties(module.exports, {
     enumerable: true,
     get() {
       if (lazyLocalStorage === undefined) {
-        // For consistency with the web specification, throw from the accessor
-        // if the local storage path is not provided.
         const location = getOptionValue('--localstorage-file');
+
         if (location === '') {
-          throw lazyDOMException(
-            'Cannot initialize local storage without a `--localstorage-file` path',
-            'SecurityError',
-          );
-        }
+          let warningEmitted = false;
+          const handler = {
+            __proto__: null,
+            get(target, prop) {
+              if (!warningEmitted) {
+                process.emitWarning('`--localstorage-file` was provided without a valid path');
+                warningEmitted = true;
+              }
+
+              return undefined;
+            },
+            set(target, prop, value) {
+              if (!warningEmitted) {
+                process.emitWarning('`--localstorage-file` was provided without a valid path');
+                warningEmitted = true;
+              }
 
-        lazyLocalStorage = new Storage(kConstructorKey, getValidatedPath(location));
+              return false;
+            },
+          };
+
+          lazyLocalStorage = new Proxy({}, handler);
+        } else {
+          lazyLocalStorage = new Storage(kConstructorKey, getValidatedPath(location));
+        }
       }
 
       return lazyLocalStorage;

src/node_options.cc

@@ -567,12 +567,12 @@ EnvironmentOptionsParser::EnvironmentOptionsParser() {
             NoOp{},
 #endif
             kAllowedInEnvvar);
-  AddOption("--webstorage",
-            "Web Storage API",
+  AddOption("--experimental-webstorage",
+            "experimental Web Storage API",
             &EnvironmentOptions::webstorage,
             kAllowedInEnvvar,
             true);
-  AddAlias("--experimental-webstorage", "--webstorage");
+  AddAlias("--webstorage", "--experimental-webstorage");
   AddOption("--localstorage-file",
             "file used to persist localStorage data",
             &EnvironmentOptions::localstorage_file,

src/node_version.h

@@ -29,7 +29,7 @@
 #define NODE_VERSION_IS_LTS 0
 #define NODE_VERSION_LTS_CODENAME ""
 
-#define NODE_VERSION_IS_RELEASE 0
+#define NODE_VERSION_IS_RELEASE 1
 
 #ifndef NODE_STRINGIFY
 #define NODE_STRINGIFY(n) NODE_STRINGIFY_HELPER(n)

test/common/index.js

@@ -59,14 +59,6 @@ const hasSQLite = Boolean(process.versions.sqlite);
 
 const hasQuic = hasCrypto && !!process.features.quic;
 
-const hasLocalStorage = (() => {
-  try {
-    return hasSQLite && globalThis.localStorage !== undefined;
-  } catch {
-    return false;
-  }
-})();
-
 /**
  * Parse test metadata from the specified file.
  * @param {string} filename - The name of the file to parse.
@@ -359,6 +351,7 @@ const knownGlobals = new Set([
  'CompressionStream',
  'DecompressionStream',
  'Storage',
+ 'localStorage',
  'sessionStorage',
 ].forEach((i) => {
   if (globalThis[i] !== undefined) {
@@ -373,10 +366,6 @@ if (hasCrypto) {
   knownGlobals.add(globalThis.SubtleCrypto);
 }
 
-if (hasLocalStorage) {
-  knownGlobals.add(globalThis.localStorage);
-}
-
 const { Worker } = require('node:worker_threads');
 knownGlobals.add(Worker);
 
@@ -401,11 +390,6 @@ if (process.env.NODE_TEST_KNOWN_GLOBALS !== '0') {
       if (val === 'crypto' && !hasCrypto) {
         continue;
       }
-      // globalThis.localStorage is a getter that throws if Node.js was
-      // executed without a --localstorage-file path.
-      if (val === 'localStorage' && !hasLocalStorage) {
-        continue;
-      }
       if (!knownGlobals.has(globalThis[val])) {
         leaked.push(val);
       }
@@ -956,7 +940,6 @@ const common = {
   hasQuic,
   hasInspector,
   hasSQLite,
-  hasLocalStorage,
   invalidArgTypeHelper,
   isAlive,
   isASan,

test/common/index.mjs

@@ -19,7 +19,6 @@ const {
   hasQuic,
   hasInspector,
   hasSQLite,
-  hasLocalStorage,
   hasIntl,
   hasIPv6,
   isAIX,
@@ -73,7 +72,6 @@ export {
   hasQuic,
   hasInspector,
   hasSQLite,
-  hasLocalStorage,
   hasIntl,
   hasIPv6,
   isAIX,