2025-06-24, Version 24.3.0 (Current), @RafaelGSS

Notable Changes

• [841609ac1c] - doc: add islandryu to collaborators (Shima Ryuhei) #58714
• [839964ece8] - (SEMVER-MINOR) fs: allow correct handling of burst in fs-events with AsyncIterator (Philipp Dunkel) #58490
• [9b28f40834] - (SEMVER-MINOR) module: remove experimental warning from type stripping (Marco Ippolito) #58643
• [7cdda927fa] - test: fix test-timeout-flag after revert of auto subtest wait (Pietro Marchini) #58282
• [dce1995c55] - Revert "test_runner: remove promises returned by t.test()" (Romain Menke) #58282
• [8b0c5edbb6] - Revert "test_runner: remove promises returned by test()" (Romain Menke) #58282
• [713fbad7b6] - (SEMVER-MINOR) test_runner: support object property mocking (Idan Goshen) #58438
• [ef0230abaf] - (SEMVER-MINOR) url: add fileURLToPathBuffer API (James M Snell) #58700

Commits

• [2ba2c93dee] - build: fix typo 'Stoage' to 'Storage' in help text (ganglike) #58777
• [11811c15da] - deps: update nghttp2 to 1.66.0 (Node.js GitHub Bot) #58786
• [7643ce9322] - deps: update acorn to 8.15.0 (Node.js GitHub Bot) #58711
• [4b61f10eb6] - deps: V8: cherry-pick e3df60f3f5ab (Chengzhong Wu) #58691
• [fa6854f083] - deps: update amaro to 1.1.0 (Node.js GitHub Bot) #58754
• [68671f4314] - deps: upgrade npm to 11.4.2 (npm team) #58696
• [450f4815b3] - deps: update amaro to 1.0.0 (Node.js GitHub Bot) #58639
• [3aa2762e96] - deps: update sqlite to 3.50.1 (Node.js GitHub Bot) #58630
• [80eac147e6] - deps: update simdjson to 3.13.0 (Node.js GitHub Bot) #58629
• [dc1023878c] - deps: update zlib to 1.3.1-470d3a2 (Node.js GitHub Bot) #58628
• [97fbfd82af] - doc: fix stability 1.x links excluding the decimal digit (Dario Piotrowicz) #58783
• [e2e88d4971] - doc: fix wrong RFC number in http2 (Deokjin Kim) #58753
• [7bb1246c8f] - doc: add history entry for TS support in hooks (Antoine du Hamel) #58732
• [f125310d3a] - doc: run license-builder (github-actions[bot]) #58722
• [841609ac1c] - doc: add islandryu to collaborators (Shima Ryuhei) #58714
• [1cc77c7ee6] - doc: punctuation fix for Node-API versioning clarification (Jiacai Liu) #58599
• [d59680348e] - doc: add path rules and validation for export targets in package.json (0hm☘️) #58604
• [b6760b3379] - esm: syncify default path of ModuleLoader.load (Jacob Smith) #57419
• [96c78d726c] - fs: make Dir disposers idempotent (René) #58692
• [62b5879d88] - fs: avoid computing time coefficient constants in runtime (Livia Medeiros) #58728
• [af18c0e81a] - fs: remove IIFE in glob (LiviaMedeiros) #58418
• [fb4378b72e] - fs: add UV_ENOSPC to list of things to pass to err directly (Jacky Zhao) #56918
• [839964ece8] - (SEMVER-MINOR) fs: allow correct handling of burst in fs-events with AsyncIterator (Philipp Dunkel) #58490
• [c9dc0a8903] - http: fix keep-alive not timing out after post-request empty line (Shima Ryuhei) #58178
• [b11da1115e] - http2: fix DEP0194 message (KaKa) #58669
• [b1f60d2f18] - http2: add diagnostics channel 'http2.server.stream.close' (Darshan Sen) #58602
• [be93091694] - inspector: add protocol methods retrieving sent/received data (Chengzhong Wu) #58645
• [20089e2a2e] - lib: rename validateInternalField into validateThisInternalField (LiviaMedeiros) #58765
• [74983832f9] - lib: make validateInternalField() throw ERR_INVALID_THIS (LiviaMedeiros) #58765
• [081c70878f] - lib: make domexception a native error (Chengzhong Wu) #58691
• [6390f70da2] - lib,src: support DOMException ser-des (Chengzhong Wu) #58649
• [4c2c100f63] - meta: add @nodejs/inspector as codeowner (Chengzhong Wu) #58790
• [ff8a3691c4] - module: fix typescript import.meta.main (Marco Ippolito) #58661
• [45f7d160ed] - module: refactor commonjs typescript loader (Marco Ippolito) #58657
• [9b28f40834] - (SEMVER-MINOR) module: remove experimental warning from type stripping (Marco Ippolito) #58643
• [a3c7a63c73] - module: allow cycles in require() in the CJS handling in ESM loader (Joyee Cheung) #58598
• [d0e42ffa58] - repl: avoid deprecated require.extensions in tab completion (baki gul) #58653
• [82b18ba890] - repl: fix tab completion not working with computer string properties (Dario Piotrowicz) #58709
• [8c2089683e] - src: add FromV8Value<T>() for integral and enum types (Aditi) #57931
• [a0b1378a20] - src: pass resource on permission checks for spawn (Rafael Gonzaga) #58758
• [dfb0144490] - src: enhance error messages for unknown options (Pietro Marchini) #58677
• [e9c6fa514c] - src: replace std::array with static arrays in contextify (Mert Can Altin) #58580
• [4347ce3dba] - src: add new CopyUtimes function to reduce code duplication (Dario Piotrowicz) #58625...

2025-06-24, Version 22.17.0 'Jod' (LTS), @aduh95

Notable Changes

⚠️ Deprecations

Instantiating node:http classes without new

Constructing classes like IncomingMessage or ServerResponse without the new
keyword is now discouraged. This clarifies API expectations and aligns with standard
JavaScript behavior. It may warn or error in future versions.

Contributed by Yagiz Nizipli in #58518.

options.shell = "" in node:child_process

Using an empty string for shell previously had undefined behavior. This change
encourages explicit choices (e.g., shell: true or a shell path) and avoids
relying on implementation quirks.

Contributed by Antoine du Hamel and Renegade334 #58564.

HTTP/2 priority signaling

The HTTP/2 prioritization API (e.g., stream.priority) is now deprecated due to
poor real-world support. Applications should avoid using priority hints and expect future removal.

Contributed by Matteo Collina and Antoine du Hamel #58313.

✅ Features graduated to stable

assert.partialDeepStrictEqual()

This method compares only a subset of properties in deep object comparisons,
useful for flexible test assertions. Its stabilization means it's now safe for
general use and won't change unexpectedly in future releases.

Contributed by Ruben Bridgewater in #57370.

Miscellaneous

• dirent.parentPath
• filehandle.readableWebStream()
• fs.glob()
• fs.openAsBlob()
• node:readline/promises
• port.hasRef()
• readable.compose()
• readable.iterator()
• readable.readableAborted
• readable.readableDidRead
• Duplex.fromWeb()
• Duplex.toWeb()
• Readable.fromWeb()
• Readable.isDisturbed()
• Readable.toWeb()
• stream.isErrored()
• stream.isReadable()
• URL.createObjectURL()
• URL.revokeObjectURL()
• v8.setHeapSnapshotNearHeapLimit()
• Writable.fromWeb()
• Writable.toWeb()
• writable.writableAborted
• Startup Snapshot API
• ERR_INPUT_TYPE_NOT_ALLOWED
• ERR_UNKNOWN_FILE_EXTENSION
• ERR_UNKNOWN_MODULE_FORMAT
• ERR_USE_AFTER_CLOSE

Contributed by James M Snell in
#57513 and
#58541.

Semver-minor features

🔧 fs.FileHandle.readableWebStream gets autoClose option

This gives developers explicit control over whether the file descriptor should
be closed when the stream ends. Helps avoid subtle resource leaks.

Contributed by James M Snell in #58548.

🔧 fs.Dir now supports explicit resource management

This improves ergonomics around async iteration of directories. Developers can
now manually control when a directory is closed using .close() or with Symbol.asyncDispose.

Contributed by Antoine du Hamel in #58206.

📊 http2 gains diagnostics channel: http2.server.stream.finish

Adds observability support for when a stream finishes. Useful for logging,
monitoring, and debugging HTTP/2 behavior without patching internals.

Contributed by Darshan Sen in #58560.

🔐 Permissions: implicit allow-fs-read to entrypoint

Node.js permissions model now allows read access to the entry file by default.
It makes running permission-restricted apps smoother while preserving security.

Contributed by Rafael Gonzaga in #58579.

🎨 util.styleText() adds 'none' style

This lets developers remove styling cleanly without hacks. Useful for overriding
inherited terminal styles when composing styled strings.

Contributed by James M Snell in #58437.

🧑‍💻 Community updates

• [0105c13556] - doc: add Filip Skokan to TSC (Rafael Gonzaga) #58499
• [3b857735ef] - doc: add JonasBa to collaborators (Jonas Badalic) #58355
• [fdf7612735] - doc: add puskin to collaborators (Giovanni Bucci) #58308

Commits

• [ffe7e1ace0] - (SEMVER-MINOR) assert: mark partialDeepStrictEqual() as stable (Ruben Bridgewater) #57370
• [269931f289] - async_hooks: ensure AsyncLocalStore instances work isolated (Gerhard Stöbich) #58149
• [9e0746a4ff] - benchmark: fix broken fs.cpSync benchmark (Dario Piotrowicz) #58472
• [dee8cb5bcb] - benchmark: add more options to cp-sync (Sonny) #58278
• [e840fd5b85] - benchmark: fix typo in method name for error-stack (Miguel Marcondes Filho) #58128
• [b9a16e97e0] - buffer: give names to Buffer.prototype.*Write() functions (Livia Medeiros) #58258
• [d56a5e40af] - buffer: use constexpr where possible (Yagiz Nizipli) #58141
• [215587feca] - build: add support for OpenHarmony operating system (hqzing) #58350
• [9bcef6821c] - build: fix uvwasi pkgname (Antoine du Hamel) #58270
• [7c3883c2ae] - build: search for libnode.so in multiple places (Jan Staněk) #58213
• [3f954accb3] - build: fix pointer compression builds (Joyee Cheung) #58171
• [04c8f59f84] - build: use FILE_OFFSET_BITS=64 esp. on 32-bit arch (RafaelGSS) #58090
• [8c2cf3a372] - build: use //third_party/simdutf by default in GN (Shelley Vohr) #58115
• [cff8006792] - child_process: give names to ChildProcess functions (Livia Medeiros) #58370
• [6816d779b6] - child_process: give names to promisified exec() and execFile() (LiviaMedeiros) #57916
• [5572cecca4] - crypto: expose crypto.constants.OPENSSL_IS_BORINGSSL (Shelley Vohr) #58387
• [d6aa02889c] - deps: use proper C standard when building libuv (Yaksh Bariya) #58587
• [375a6413d5] - deps: update simdjson to 3.12.3 (Node.js GitHub Bot) #57682
• [e0cd138e52] - deps: update googletest to e9092b1 (Node.js GitHub Bot) #58565
• [31e592631f] - deps: update corepack to 0.33.0 (Node.js GitHub Bot) #58566
• [386c24260b] - deps: update sqlite to 3.50.0 (Node.js GitHub Bot) #58272
• [f84998d40b] - deps: update OpenSSL gen container to Ubuntu 22.04 (Michaël Zasso) #58432
• [d49fd29859] - deps: update llhttp to 9.3.0 (Fedor Indutny) #58144
• [e397980a1a] - deps: update libuv to 1.51.0 (Node.js GitHub Bot) #58124
• [a28c33645c] - dns: fix dns query cache implementation (Ethan Arrowood) #58404
• [6939b0c624] - doc: fix the order of process.md sections (Allon Murienik) #58403
• [1ca253c363] - doc: add support link for panva (Filip Skokan) #58591
• [8319edbcf6] - doc: update metadata for _transformState deprecation (James M Snell) #58530
• [697d258136] - doc: deprecate passing an empty string to options.shell (Antoine du Hamel) #58564
• [[132fc804e8](https://gi...

2025-06-23, Version 20.19.3 'Iron' (LTS), @marco-ippolito

Notable Changes

• [c535a3c483] - crypto: graduate WebCryptoAPI Ed25519 and X25519 algorithms as stable (Filip Skokan) #56142
• [af1dc63815] - crypto: update root certificates to NSS 3.108 (Node.js GitHub Bot) #57381
• [01d63a4ddf] - deps: update timezone to 2025b (Node.js GitHub Bot) #57857
• [b6daa344eb] - doc: add dario-piotrowicz to collaborators (Dario Piotrowicz) #58102

Commits

• [fc1fa7a357] - build: use FILE_OFFSET_BITS=64 esp. on 32-bit arch (RafaelGSS) #58090
• [79e0812181] - build: use glob for dependencies of out/Makefile (Richard Lau) #55789
• [f56e62851a] - crypto: allow length=0 for HKDF and PBKDF2 in SubtleCrypto.deriveBits (Filip Skokan) #55866
• [c535a3c483] - crypto: graduate WebCryptoAPI Ed25519 and X25519 algorithms as stable (Filip Skokan) #56142
• [39925de8b1] - crypto: allow non-multiple of 8 in SubtleCrypto.deriveBits (Filip Skokan) #55296
• [af1dc63815] - crypto: update root certificates to NSS 3.108 (Node.js GitHub Bot) #57381
• [d09008add3] - deps: V8: cherry-pick 1a3ecc2483b2 (Michaël Zasso) #58342
• [fd56652425] - deps: V8: cherry-pick 182d9c05e78b (Andrey Kosyakov) #58342
• [447481e829] - deps: V8: cherry-pick third_party/zlib@646b7f569718 (Hans Wennborg) #58342
• [eb447168df] - deps: update simdutf to 6.4.2 (Node.js GitHub Bot) #57855
• [01d63a4ddf] - deps: update timezone to 2025b (Node.js GitHub Bot) #57857
• [10fb49f2a9] - deps: update icu to 77.1 (Node.js GitHub Bot) #57455
• [f1dc7d0205] - deps: update corepack to 0.32.0 (Node.js GitHub Bot) #57265
• [7a2e64bb8a] - deps: update simdutf to 6.4.0 (Node.js GitHub Bot) #56764
• [e80669be0d] - doc: mention reports should align with Node.js CoC (Rafael Gonzaga) #57607
• [7b2c0bc92e] - doc: add gurgunday as triager (Gürgün Dayıoğlu) #57594
• [791e4879de] - doc: document REPL custom eval arguments (Dario Piotrowicz) #57690
• [2917f09876] - doc: improved fetch docs (Alessandro Miliucci) #57296
• [d940b15843] - doc: clarify unhandledRejection events behaviors in process doc (Dario Piotrowicz) #57654
• [71c664fab7] - doc: update position type to integer | null in fs (Yukihiro Hasegawa) #57745
• [0c0fbfa9c6] - doc: add missing v0.x changelog entries (Antoine du Hamel) #57779
• [e99462c9fc] - doc: correct deprecation type of assert.CallTracker (René) #57997
• [c7e92696ef] - doc: add returns for https.get (Eng Zer Jun) #58025
• [ccc42b69ce] - doc: fix env variable name in util.styleText (Antoine du Hamel) #58072
• [b6daa344eb] - doc: add dario-piotrowicz to collaborators (Dario Piotrowicz) #58102
• [e5d6a3df16] - doc: fix AsyncLocalStorage example response changes after node v18 (Naor Tedgi (Abu Emma)) #57969
• [f006411998] - doc: fix typo of file zlib.md (yusheng chen) #58093
• [5193735df4] - doc: add missing options.signal to readlinePromises.createInterface() (Jimmy Leung) #55456
• [fd44af730f] - doc: fix misaligned options in vm.compileFunction() (Jimmy Leung) #58145
• [0fdcc0ddcd] - doc: add ambassaor message (Brian Muenzenmeyer) #57600
• [5ca9616bd3] - doc: increase z-index of header element (Dario Piotrowicz) #57851
• [81342d10f0] - doc: fix deprecation type for DEP0148 (Livia Medeiros) #57785
• [776becfe01] - doc: remove mention of --require not supporting ES modules (Huáng Jùnliàng) #57620
• [3140a8f133] - doc: add missing deprecated badges in fs.md (Yukihiro Hasegawa) #57384
• [441ce24ae3] - doc: deprecate passing invalid types in fs.existsSync (Carlos Espa) #55892
• [0556f54544] - http: correctly translate HTTP method (Paolo Insogna) #52701
• [c2c6d2b035] - http: be more generational GC friendly (ywave620) #56767
• [cdf3fa241c] - http2: skip writeHead if stream is closed (Shima Ryuhei) #57686
• [bbd5aec785] - http2: fix graceful session close (Kushagra Pandey) #57808
• [b427ae4f34] - meta: remove build-windows.yml (Aviv Keller) #54662
• [49e624f554] - os: fix netmask format check condition in getCIDR function (Wiyeong Seo) #57324
• [d582954434] - src: remove unused variable in crypto_x509.cc (Michaël Zasso) #57754
• [234a505e96] - src: allow embedder customization of OOMErrorHandler (Shelley Vohr) #57325
• [c0252cd380] - src: fix -Wunreachable-code-return in node_sea (Shelley Vohr) #57664
• [fcd1622fc1] - src: fix kill signal 0 on Windows (Stefan Stojanovic) #57695
• [850192b06b] - test: skip broken sea on rhel8 (Marco Ippolito) #58761
• [3cf7cfb695] - test: update WPT for WebCryptoAPI to edd42c005c (Node.js GitHub Bot) #57365
• [f57765bdcf] - test: mark test-without-async-context-frame flaky on windows (James M Snell) #56753
  *...

2025-06-09, Version 24.2.0 (Current), @aduh95

Notable Changes

Remove support for HTTP/2 priority signaling

The support for priority signaling has been removed in nghttp2, following its
deprecation in the RFC 9113.
As a consequence of this, priority signaling is deprecated on all release lines of Node.js,
and removed from Node.js 24 so we can include latest updates from nghttp2.

Contributed by Matteo Collina and Antoine du Hamel in
#58293.

import.meta.main is now available

Boolean value available in ECMAScript modules, which can be used to detect
whether the current module was the entry point of the current process.

export function foo() {
  return 'Hello, world';
}

function main() {
  const message = foo();
  console.log(message);
}

if (import.meta.main) main();
// `foo` can be imported from another module without possible side-effects from `main`

Contributed by Joe and Antoine du Hamel in
#57804.

Other Notable Changes

• [e13930bbe0] - doc: add Filip Skokan to TSC (Rafael Gonzaga) #58499
• [984894b38c] - doc: deprecate util.isNativeError in favor of Error.isError (Miguel Marcondes Filho) #58262
• [d261274b0f] - doc: deprecate passing an empty string to options.shell (Antoine du Hamel) #58564
• [510872a522] - (SEMVER-MINOR) doc: graduate Symbol.dispose/asyncDispose from experimental (James M Snell) #58467
• [6f4c9dd423] - (SEMVER-MINOR) fs: add autoClose option to FileHandle readableWebStream (James M Snell) #58548
• [32efb63242] - http: deprecate instantiating classes without new (Yagiz Nizipli) #58518
• [0234a8ef53] - (SEMVER-MINOR) http2: add diagnostics channel http2.server.stream.finish (Darshan Sen) #58560
• [0f1e94f731] - (SEMVER-MINOR) lib: graduate error codes that have been around for years (James M Snell) #58541
• [13abca3c26] - (SEMVER-MINOR) perf_hooks: make event loop delay histogram disposable (James M Snell) #58384
• [8ea1fc5f3b] - (SEMVER-MINOR) src: support namespace options in configuration file (Pietro Marchini) #58073
• [d6ea36ad6c] - src,permission: implicit allow-fs-read to app entrypoint (Rafael Gonzaga) #58579
• [5936cef60a] - (SEMVER-MINOR) test: add disposable histogram test (James M Snell) #58384
• [7a91f4aaa1] - (SEMVER-MINOR) test: add test for async disposable worker thread (James M Snell) #58385
• [532c173cf2] - (SEMVER-MINOR) util: add none style to styleText (James M Snell) #58437
• [aeb9ab4c4c] - (SEMVER-MINOR) worker: make Worker async disposable (James M Snell) #58385

Commits

• [6c92329b1b] - Revert "benchmark: fix broken fs.cpSync benchmark" (Yuesong Jake Li) #58476
• [8bc045264e] - benchmark: fix broken fs.cpSync benchmark (Dario Piotrowicz) #58472
• [46aa079cce] - benchmark: add callback-based fs.glob to glob benchmark (Livia Medeiros) #58417
• [a57b05e105] - benchmark: add more options to cp-sync (Sonny) #58278
• [8b5ada4b31] - buffer: use Utf8LengthV2() instead of Utf8Length() (Tobias Nießen) #58156
• [22e97362f3] - build: search for libnode.so in multiple places (Jan Staněk) #58213
• [0b4056c573] - build: add support for OpenHarmony operating system (hqzing) #58350
• [db7f413dd3] - build: fix pointer compression builds (Joyee Cheung) #58171
• [7ff37183e5] - build: fix defaults for shared llhttp (Antoine du Hamel) #58269
• [b8c33190fe] - build,win: fix dll build (Stefan Stojanovic) #58357
• [ef9ecbe8a6] - child_process: give names to ChildProcess functions (Livia Medeiros) #58370
• [cec9d9d016] - crypto: forward auth tag to OpenSSL immediately (Tobias Nießen) #58547
• [9fccb0609f] - crypto: expose crypto.constants.OPENSSL_IS_BORINGSSL (Shelley Vohr) #58387
• [e7c69b9345] - deps: update nghttp2 to 1.65.0 (Node.js GitHub Bot) #57269
• [d0b89598a3] - deps: use proper C standard when building libuv (Yaksh Bariya) #58587
• [8a1fe7bc6a] - deps: update simdjson to 3.12.3 (Node.js GitHub Bot) #57682
• [36b639b1eb] - deps: update googletest to e9092b1 (Node.js GitHub Bot) #58565
• [f8a2a1ef52] - deps: update corepack to 0.33.0 (Node.js GitHub Bot) #58566
• [efb28f7895] - deps: V8: cherry-pick 249de887a8d3 (Michaël Zasso) #58561
• [88e621ea97] - deps: update sqlite to 3.50.0 (Node.js GitHub Bot) #58272
• [8d2ba386f1] - deps: update OpenSSL gen container to Ubuntu 22.04 (Michaël Zasso) #58432
• [7e62a77a7f] - deps: update undici to 7.10.0 (Node.js GitHub Bot) #58445
• [87eebd7bad] - deps: keep required OpenSSL doc files (Michaël Zasso) #58431
• [10910660f6] - deps: update undici to 7.9.0 (Node.js GitHub Bot) #58268
• [5e27078ca2] - deps: update ada to 3.2.4 (Node.js GitHub Bot) #58152
• [3b1e4bdbbb] - deps: update libuv to 1.51.0 (Node.js GitHub Bot) #58124
• [6bddf587ae] - dns: fix dns query cache implementation (Ethan Arrowood) #58404
• [984894b38c] - doc: deprecate utilisNativeError in favor of ErrorisError (Miguel Marcondes Filho) #58262
• [377ef3ce3a] - doc: add support link for panva (Filip Skokan) #58591
• [33a69ff9e4] - doc: update metadata for _transformState deprecation (James M Snell) #58530
• [d261274b0f] - doc: deprecate passing an empty string to options.shell (Antoine du Hamel) [#58564]...

2025-05-21, Version 24.1.0 (Current), @aduh95

Notable Changes

• [9d35b4ce95] - doc: add JonasBa to collaborators (Jonas Badalic) #58355
• [b7d1bfa7b4] - doc: add puskin to collaborators (Giovanni Bucci) #58308
• [fcead7c28e] - (SEMVER-MINOR) fs: add to Dir support for explicit resource management (Antoine du Hamel) #58206
• [f7041b9369] - Revert "test_runner: change ts default glob" (Théo LUDWIG) #58202

Commits

• [b33e8d2a71] - async_hooks: ensure AsyncLocalStore instances work isolated (Gerhard Stöbich) #58149
• [a1b078b18c] - buffer: give names to Buffer.prototype.*Write() functions (Livia Medeiros) #58258
• [4c967b73c3] - buffer: use constexpr where possible (Yagiz Nizipli) #58141
• [327095a928] - build: fix uvwasi pkgname (Antoine du Hamel) #58270
• [2e54653d3d] - build: use FILE_OFFSET_BITS=64 esp. on 32-bit arch (RafaelGSS) #58090
• [7e4453fe93] - build: escape > metachar in vcbuild (Gerhard Stöbich) #58157
• [7dabf079b1] - child_process: give names to promisified exec() and execFile() (LiviaMedeiros) #57916
• [a896eff1f2] - crypto: handle missing OPENSSL_TLS_SECURITY_LEVEL (Shelley Vohr) #58103
• [6403aa458f] - crypto: merge CipherBase.initiv into constructor (Tobias Nießen) #58166
• [30897d915c] - deps: V8: backport 1d3362c55396 (Shu-yu Guo) #58230
• [63f5d69d2b] - deps: V8: cherry-pick 4f38995c8295 (Shu-yu Guo) #58230
• [5a5f6bb1d4] - deps: V8: cherry-pick 044b9b6f589d (Rezvan Mahdavi Hezaveh) #58230
• [db57f0a4c0] - deps: patch V8 to 13.6.233.10 (Michaël Zasso) #58230
• [f54a7a44ab] - Revert "deps: patch V8 to support compilation with MSVC" (Michaël Zasso) #58187
• [e3193eeca4] - Revert "deps: always define V8_EXPORT_PRIVATE as no-op" (Michaël Zasso) #58187
• [e75ecf8ad1] - Revert "deps: disable V8 concurrent sparkplug compilation" (Michaël Zasso) #58187
• [a0ca15558d] - deps: update llhttp to 9.3.0 (Fedor Indutny) #58144
• [90d4c11992] - deps: update amaro to 0.5.3 (Node.js GitHub Bot) #58174
• [9d35b4ce95] - doc: add JonasBa to collaborators (Jonas Badalic) #58355
• [2676ca0cf5] - doc: add latest security release steward (Rafael Gonzaga) #58339
• [c35cc1bdd9] - doc: document default test-reporter change (Nico Jansen) #58302
• [2bb433d4a5] - doc: fix CryptoKey.algorithm type and other interfaces in webcrypto.md (Filip Skokan) #58294
• [f04f09d783] - doc: mark the callback argument of crypto.generatePrime as mandatory (Allon Murienik) #58299
• [3b9b010844] - doc: remove comma delimiter mention on permissions doc (Rafael Gonzaga) #58297
• [f0cf1a028d] - doc: make Stability labels not sticky in Stability index (Livia Medeiros) #58291
• [a1b937bdee] - doc: update commit-queue documentation (Dario Piotrowicz) #58275
• [b7d1bfa7b4] - doc: add puskin to collaborators (Giovanni Bucci) #58308
• [fc30cdd8d2] - doc: update stability status for diagnostics_channel to experimental (Idan Goshen) #58261
• [290a5ab8ca] - doc: clarify napi_get_value_string_* for bufsize 0 (Tobias Nießen) #58158
• [c26863a683] - doc: fix typo of file http.md, outgoingMessage.setTimeout section (yusheng chen) #58188
• [62dbd36dcb] - doc: update return types for eventNames method in EventEmitter (Yukihiro Hasegawa) #58083
• [130c135f38] - fs: add support for URL for fs.glob's cwd option (Antoine du Hamel) #58182
• [fcead7c28e] - (SEMVER-MINOR) fs: add to Dir support for explicit resource management (Antoine du Hamel) #58206
• [655326ba9f] - fs: glob is stable, so should not emit experimental warnings (Théo LUDWIG) #58236
• [6ebcce7625] - fs: ensure dir.read() does not throw synchronously (Antoine du Hamel) #58228
• [7715722323] - http: remove unused functions and add todos (Yagiz Nizipli) #58143
• [74a807e31f] - http,https: give names to anonymous or misnamed functions (Livia Medeiros) #58180
• [24a9aefb08] - http2: add diagnostics channel 'http2.client.stream.start' (Darshan Sen) #58292
• [2cb86a3cd6] - http2: add diagnostics channel 'http2.client.stream.created' (Darshan Sen) #58246
• [8f1aee90d9] - http2: give name to promisified connect() (LiviaMedeiros) #57916
• [b66f1b0be6] - inspector: support for worker inspection in chrome devtools (Shima Ryuhei) #56759
• [868e72e367] - lib: fix sourcemaps with ts module mocking (Marco Ippolito) #58193
• [570cb6f6b6] - meta: ignore mailmap changes in linux ci (Jonas Badalic) #58356
• [b94f63b865] - module: handle instantiated async module jobs in require(esm) (Joyee Cheung) #58067
• [714b706f2e] - repl: add proper vertical cursor movements (Giovanni Bucci) #58003
• [629a954477] - repl: add possibility to edit multiline commands while adding them (Giovanni Bucci) #58003
• [17746129f3] - sqlite: set name and length on sqlite.backup() (Livia Medeiros) [#58251](https://github.com/nodejs/node/...

2025-05-21, Version 22.16.0 'Jod' (LTS), @aduh95

Notable Changes

• [c3ceaebb7a] - deps: update timezone to 2025b (Node.js GitHub Bot) #57857
• [5059a746ec] - doc: add dario-piotrowicz to collaborators (Dario Piotrowicz) #58102
• [c8ceaaf397] - (SEMVER-MINOR) doc: graduate multiple experimental apis (James M Snell) #57765
• [e21b37d9df] - (SEMVER-MINOR) esm: graduate import.meta properties (James M Snell) #58011
• [832640c35e] - (SEMVER-MINOR) esm: support top-level Wasm without package type (Guy Bedford) #57610
• [c510391d2f] - (SEMVER-MINOR) sqlite: add StatementSync.prototype.columns() (Colin Ihrig) #57490
• [5d1230bec0] - (SEMVER-MINOR) src: set default config as node.config.json (Marco Ippolito) #57171
• [30bb1ccbb0] - (SEMVER-MINOR) src: create THROW_ERR_OPTIONS_BEFORE_BOOTSTRAPPING (Marco Ippolito) #57016
• [0350c6f478] - (SEMVER-MINOR) src: add config file support (Marco Ippolito) #57016
• [e1d3a9e192] - (SEMVER-MINOR) src: add ExecutionAsyncId getter for any Context (Attila Szegedi) #57820
• [0ec912f452] - (SEMVER-MINOR) stream: preserve AsyncLocalStorage context in finished() (Gürgün Dayıoğlu) #57865
• [43490c8797] - (SEMVER-MINOR) util: add types.isFloat16Array() (Livia Medeiros) #57879
• [dda6ca9172] - (SEMVER-MINOR) worker: add worker.getHeapStatistics() (Matteo Collina) #57888

Commits

• [4252dc798c] - assert: support Float16Array in loose deep equality checks (Livia Medeiros) #57881
• [1c7396b078] - assert,util: fix constructor lookup in deep equal comparison (Ruben Bridgewater) #57876
• [1ded5f25c8] - assert,util: improve deep object comparison performance (Ruben Bridgewater) #57648
• [696b5f85ca] - assert,util: improve unequal number comparison performance (Ruben Bridgewater) #57619
• [775ee4d40f] - assert,util: improve array comparison (Ruben Bridgewater) #57619
• [3766992ba4] - benchmark: add sqlite prepare select get (Vinícius Lourenço) #58040
• [8390276be3] - benchmark: add sqlite prepare select all (Vinícius Lourenço) #58040
• [6a9b79e5c1] - benchmark: add sqlite is transaction (Vinícius Lourenço) #58040
• [f689f98344] - benchmark: add sqlite prepare insert (Vinícius Lourenço) #58040
• [14a82804d7] - benchmark: disambiguate filename and dirname read perf (Antoine du Hamel) #58056
• [e7e8256d35] - buffer: avoid creating unnecessary environment (Yagiz Nizipli) #58053
• [d7d8e8e994] - buffer: define global v8::CFunction objects as const (Mert Can Altin) #57676
• [f37633e85a] - build: use $(BUILDTYPE) when cleaning coverage files (Aviv Keller) #57995
• [e5bf67fe77] - build: define python when generating out/Makefile (Aviv Keller) #57970
• [718f874ae0] - build: fix zstd libname (Antoine du Hamel) #57999
• [53c5fdcae1] - crypto: fix cross-realm SharedArrayBuffer validation (Antoine du Hamel) #57974
• [78f4ffee5d] - crypto: fix cross-realm check of ArrayBuffer (Felipe Forbeck) #57828
• [f606352b63] - crypto: forbid passing Float16Array to getRandomValues() (Livia Medeiros) #57880
• [23c4e941c2] - crypto: remove BoringSSL dh-primes addition (Shelley Vohr) #57023
• [8339d9bc14] - deps: V8: cherry-pick f915fa4c9f41 (Chengzhong Wu) #55484
• [c2111dd126] - deps: V8: backport e5dbbbadcbff (Darshan Sen) #58120
• [4cc49be951] - deps: update zstd to 1.5.7 (Node.js GitHub Bot) #57940
• [c956d37c84] - deps: update zlib to 1.3.0.1-motley-780819f (Node.js GitHub Bot) #57768
• [c3ceaebb7a] - deps: update timezone to 2025b (Node.js GitHub Bot) #57857
• [b5cd0eb590] - deps: update simdutf to 6.4.2 (Node.js GitHub Bot) #57855
• [3eb6b814e9] - deps: update simdutf to 6.4.0 (Node.js GitHub Bot) #56764
• [0be9fa3218] - deps: update icu to 77.1 (Node.js GitHub Bot) #57455
• [d5cf4254fb] - doc: add HBSPS as triager (Wiyeong Seo) #57980
• [ad0861dba0] - doc: add ambassaor message (Brian Muenzenmeyer) #57600
• [0d3ec1aafe] - doc: fix misaligned options in vm.compileFunction() (Jimmy Leung) #58145
• [1f70baf3b0] - doc: add missing options.signal to readlinePromises.createInterface() (Jimmy Leung) #55456
• [ec6a48621f] - doc: fix typo of file zlib.md (yusheng chen) #58093
• [37e360e386] - doc: make stability labels more consistent (Antoine du Hamel) #57516
• [2b5d63d36e] - doc: allow the $schema property in node.config.json (Remco Haszing) #57560
• [a2063638e2] - doc: fix AsyncLocalStorage example response changes after node v18 (Naor Tedgi (Abu Emma)) #57969
• [474c2b14c3] - doc: mark Node.js 18 as End-of-Life (Richard Lau) #58084
• [5059a746ec] - doc: add dario-piotrowicz to collaborators (Dario Piotrowicz) #58102
• [1eec170fc3] - doc: fix formatting of import.meta.filename section (Antoine du Hamel) #58079
• [7f108de525] - ...

2025-05-14, Version 24.0.2 (Current), @RafaelGSS

This is a security release.

Notable Changes

• (CVE-2025-23166) fix error handling on async crypto operation

Commits

• [7d0c17b2ad] - (CVE-2025-23166) src: fix error handling on async crypto operations (RafaelGSS) nodejs-private/node-private#688

2025-05-14, Version 23.11.1 (Current), @RafaelGSS

This is a security release.

Notable Changes

src:

• (CVE-2025-23166) fix error handling on async crypto operation

Commits

• [a271810ce2] - deps: update c-ares to v1.34.5 (Node.js GitHub Bot) #57792
• [a12107f0dd] - (CVE-2025-23166) src: fix error handling on async crypto operations (RafaelGSS) nodejs-private/node-private#688

2025-05-14, Version 22.15.1 'Jod' (LTS), @RafaelGSS

This is a security release.

Notable Changes

• (CVE-2025-23166) fix error handling on async crypto operation
• (CVE-2025-23165) add missing call to uv_fs_req_cleanup

Commits

• [edaf54da00] - fs: added test for missing call to uv_fs_req_cleanup (Justin Nietzel) #57811
• [9f403e98ef] - (CVE-2025-23165) fs: add missing call to uv_fs_req_cleanup (Justin Nietzel) #57811
• [f4494d38f1] - (CVE-2025-23166) src: fix error handling on async crypto operations (RafaelGSS) nodejs-private/node-private#709

2025-05-14, Version 20.19.2 'Iron' (LTS), @RafaelGSS

This is a security release.

Notable Changes

• (CVE-2025-23166) fix error handling on async crypto operation
• (CVE-2025-23167) (SEMVER-MAJOR) update llhttp to 9.2.0
• (CVE-2025-23165) add missing call to uv_fs_req_cleanup

Commits

• [eb25047b1b] - deps: update llhttp to 9.2.0 (Node.js GitHub Bot) #51719
• [12dcd8db08] - deps: update llhttp to 9.1.3 (Node.js GitHub Bot) #50080
• [190e45a291] - (SEMVER-MAJOR) (CVE-2025-23167) deps: update llhttp to 9.1.2 (Paolo Insogna) #48981
• [fc68c44e6a] - fs: added test for missing call to uv_fs_req_cleanup (Justin Nietzel) #57811
• [9e13bf0a81] - (CVE-2025-23165) fs: add missing call to uv_fs_req_cleanup (Justin Nietzel) #57811
• [bd0aa5d44c] - (CVE-2024-27982) http: do not allow OBS fold in headers by default (Paolo Insogna) nodejs-private/node-private#556
• [6c57465920] - (CVE-2025-23166) src: fix error handling on async crypto operations (RafaelGSS) nodejs-private/node-private#710