Update dependency node to v24.15.0 #3
Reference in New Issue
Block a user
Delete Branch "renovate/node-24.x"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
This PR contains the following updates:
24.13.1→24.15.0Release Notes
nodejs/node (node)
v24.15.0: 2026-04-15, Version 24.15.0 'Krypton' (LTS), @aduh95Compare Source
Notable Changes
3d87ecacbc] - (SEMVER-MINOR) cli: add --max-heap-size option (tannal) #5870883c38672f7] - cli: add --require-module/--no-require-module (Joyee Cheung) #6095954ef940e01] - (SEMVER-MINOR) crypto: add raw key formats support to the KeyObject APIs (Filip Skokan) #62240f4a3edc47a] - (SEMVER-MINOR) fs: addthrowIfNoEntryoption for fs.stat and fs.promises.stat (Juan José) #611785cdcba17cc] - (SEMVER-MINOR) http2: add http1Options for HTTP/1 fallback configuration (Amol Yadav) #617138b6be3fe14] - module: mark require(esm) as stable (Joyee Cheung) #6095968fbc0c6cc] - module: mark module compile cache as stable (Joyee Cheung) #60971c851e76f8c] - (SEMVER-MINOR) net: addsetTOSandgetTOStoSocket(Amol Yadav) #615036ac4304c87] - (SEMVER-MINOR) sqlite: add limits property to DatabaseSync (Mert Can Altin) #61298aaf9af1672] - sqlite: mark as release candidate (Matteo Collina) #61262eb77a7a297] - (SEMVER-MINOR) src: add C++ support for diagnostics channels (RafaelGSS) #618696834ca13bb] - (SEMVER-MINOR) stream: renameDuplex.toWeb()type option toreadableType(René) #61632f5f21d36a6] - test_runner: add exports option for module mocks (sangwook) #617271f2025fd1e] - (SEMVER-MINOR) test_runner: expose worker ID for concurrent test execution (Ali Hassan) #613941ca20fc33d] - (SEMVER-MINOR) test_runner: show interrupted test on SIGINT (Matteo Collina) #61676Commits
148373cea1] - assert,util: improve comparison performance (Ruben Bridgewater) #61176e5558b0859] - assert,util: fix deep comparing invalid dates skipping properties (Ruben Bridgewater) #6107683cffd92b5] - async_hooks: enabledHooksExist shall return if hooks are enabled (Gerhard Stöbich) #610542c9436b43d] - benchmark: fix destructuring in dgram/single-buffer (Ali Hassan) #62084837acd7382] - benchmark: add startup benchmark for ESM entrypoint (Joyee Cheung) #61769a6ced7d272] - buffer: improve performance of multiple Buffer operations (Ali Hassan) #61871a82003bf8b] - buffer: optimize buffer.concat performance (Mert Can Altin) #6172183dfd0be1d] - buffer: disallow ArrayBuffer transfer on pooled buffer (Chengzhong Wu) #61372ed2d0cb1bf] - build: support empty libname flags inconfigure.py(Antoine du Hamel) #6247709f7920267] - build: fix timezone-update path references (Chengzhong Wu) #62280af46b15b91] - build: use path-ignore in GHA coverage-windows.yml (Chengzhong Wu) #618112cf77eadd1] - build: generate_config_gypi.py generates valid JSON (Shelley Vohr) #61791e0220f0c35] - build: build with v8 gdbjit support on supported platform (Joyee Cheung) #610105505511dcb] - build: enable -DV8_ENABLE_CHECKS flag (Ryuhei Shima) #613275f8ecf3940] - build: add --debug-symbols to build with -g without enabling DCHECKs (Joyee Cheung) #61100ab18c0867b] - build: fix --node-builtin-modules-path (Filip Skokan) #62115bfa60d5782] - build: fix GN for new merve dep (Shelley Vohr) #619840d1975fe3a] - build,win: add WinGet Visual Studio 2022 Build Tools Edition config (Mike McCready) #6165210b2bb5fa6] - child_process: add tracing channel for spawn (Marco) #618363d87ecacbc] - (SEMVER-MINOR) cli: add --max-heap-size option (tannal) #5870883c38672f7] - cli: add --require-module/--no-require-module (Joyee Cheung) #609599d37233824] - crypto: update root certificates to NSS 3.121 (Node.js GitHub Bot) #62485b0cbfe38a4] - crypto: add crypto::GetSSLCtx API for addon access to OpenSSL contexts (Tim Perry) #62254dc034a4ac9] - crypto: reject ML-KEM/ML-DSA PKCS#8 import without seed in SubtleCrypto (Filip Skokan) #622188aa6e706df] - crypto: refactor WebCrypto AEAD algorithms auth tag handling (Filip Skokan) #6216920cb932bcf] - crypto: read algorithm name property only once in normalizeAlgorithm (Filip Skokan) #62170e2934162b4] - crypto: add missing AES dictionaries (Filip Skokan) #620998b8db52f65] - crypto: fix importKey required argument count check (Filip Skokan) #62099bd5458db29] - crypto: fix missing nullptr check on RSA_new() (ndossche) #618887302c7ed22] - crypto: fix handling of null BUF_MEM* in ToV8Value() (Nora Dossche) #618858d0c22ea20] - crypto: fix potential null pointer dereference when BIO_meth_new() fails (Nora Dossche) #6178872aad8b40f] - crypto: always return certificate serial numbers as uppercase (Anna Henningsen) #617522395fc0f4d] - crypto: rename CShakeParams and KmacParams length to outputLength (Filip Skokan) #61875541be3aaf2] - crypto: recognize raw formats in keygen (Filip Skokan) #6248054ef940e01] - (SEMVER-MINOR) crypto: add raw key formats support to the KeyObject APIs (Filip Skokan) #62240bef1949823] - deps: V8: cherry-pick33e7739(Thibaud Michaud) #625672e1a565a55] - deps: update ada to 3.4.4 (Node.js GitHub Bot) #62414d0418bad10] - deps: update timezone to 2026a (Node.js GitHub Bot) #6216453aad66415] - deps: update googletest to2461743(Node.js GitHub Bot) #6248490fab71a84] - deps: update simdjson to 4.5.0 (Node.js GitHub Bot) #62382a416ddf6d9] - deps: V8: cherry-pickcf1bce4(Richard Lau) #624494d9123e57d] - deps: upgrade npm to 11.12.1 (npm team) #62448952d715028] - deps: update sqlite to 3.51.3 (Node.js GitHub Bot) #62256f3fd7ed426] - deps: update googletest to73a63ea(Node.js GitHub Bot) #6192771a2f82d7c] - deps: upgrade npm to 11.11.1 (npm team) #6221684f60c26f7] - deps: update amaro to 1.1.8 (Node.js GitHub Bot) #6215143159d0e5f] - deps: update sqlite to 3.52.0 (Node.js GitHub Bot) #62150b887657b38] - deps: V8: cherry-pickaa0b288(Richard Lau) #621367ab885b323] - deps: update ada to 3.4.3 (Node.js GitHub Bot) #62049671ddec2b9] - deps: update minimatch to 10.2.4 (Node.js GitHub Bot) #62016290fe37d4d] - deps: update simdjson to 4.3.1 (Node.js GitHub Bot) #61930a13bee76b5] - deps: update acorn-walk to 8.3.5 (Node.js GitHub Bot) #61928f0e40b35b9] - deps: update acorn to 8.16.0 (Node.js GitHub Bot) #61925463dfa023a] - deps: update minimatch to 10.2.2 (Node.js GitHub Bot) #618304b2e4bb108] - deps: update nbytes to 0.1.3 (Node.js GitHub Bot) #618795626cb83d0] - deps: remove stale OpenSSL arch configs (René) #6183452668874fd] - deps: update llhttp to 9.3.1 (Node.js GitHub Bot) #61827b3387b07b1] - deps: update googletest to5a9c3f9(Node.js GitHub Bot) #61731196268cb4c] - deps: V8: cherry-pickc5ff7c4(Chengzhong Wu) #6137236869b52de] - deps: update merve to 1.2.2 (Node.js GitHub Bot) #622133cbac055de] - deps: update merve to 1.2.0 (Node.js GitHub Bot) #621497757cc3495] - deps: V8: backport6a0a25a(Vivian Wang) #61670359797c2fb] - deps,src: prepare for cpplint update (Michaël Zasso) #60901ace802e59b] - diagnostics_channel: add diagnostics channels for web locks (Ilyas Shabi) #62123a072411b03] - doc: remove spawn with shell example from bat/cmd section (Kit Dallege) #622430b152449af] - doc: fix typo in --disable-wasm-trap-handler description (Dmytro Semchuk) #6182073ea387ad7] - doc: remove obsolete Boxstarter automated install (Mike McCready) #617857f234add8e] - doc: deprecatemodule.register()(DEP0205) (Geoffrey Booth) #6239512fc3c6a30] - doc: clarify that features cannot be both experimental and deprecated (Antoine du Hamel) #624561ecc5962a2] - doc: fix 'transfered' typo in quic.md (lilianakatrina684-a11y) #6249256741a1303] - doc: move sqlite type conversion section to correct level (René) #6248212b04d17d5] - doc: add Rafael to last security release steward (Rafael Gonzaga) #62423c4567e4a8d] - doc: fix overstated Date header requirement in response.sendDate (Kit Dallege) #62206384a41047f] - doc: enhance clarification about the main field (Mowafak Almahaini) #6230293d19b1a1c] - doc: minor typo fix (Jeff Matson) #623583db35d2c59] - doc: add path to vulnerabilities.json mention (Rafael Gonzaga) #6235557b105c9d5] - doc: deprecate CryptoKey use in node:crypto (Filip Skokan) #62321490168c993] - doc: fix small environment_variables typo (chris) #622790291be584b] - doc: test and test-only targets do not run linter (Xavier Stouder) #62120ba0a82a1e1] - doc: clarify fs.ReadStream and fs.WriteStream are not constructable (Kit Dallege) #62208125bdbf504] - doc: clarify that any truthy value ofshellis part of DEP0190 (Antoine du Hamel) #62249a141ad0aeb] - doc: remove outdated Chrome 66 and ndb references from debugger (Kit Dallege) #6220244bde8e573] - doc: add note (and caveat) formock.moduleabout customization hooks (Jacob Smith) #620758c46a1ca1a] - doc: copyeditaddons.md(Antoine du Hamel) #620717f989f02f7] - doc: correctutil.convertProcessSignalToExitCodevalidation behavior (René) #62134a4466ebdac] - doc: add efekrskl as triager (Efe) #61876db516eca3a] - doc: fix markdown forexpectFailurevalues (Jacob Smith) #62100ad97045125] - doc: include url.resolve() in DEP0169 application deprecation (Mike McCready) #62002309f37ba42] - doc: expand SECURITY.md with non-vulnerability examples (Rafael Gonzaga) #61972dbb3551b7b] - doc: separate in-types and out-types in SQLite conversion docs (René) #62034191c433db8] - doc: fix small logic error in DETECT_MODULE_SYNTAX (René) #620258511b1c784] - doc: fix module.stripTypeScriptTypes indentation (René) #61992dd1139f52c] - doc: update DEP0040 (punycode) to application type deprecation (Mike McCready) #6191654009e9c62] - doc: explicitly mention Slack handle (Rafael Gonzaga) #6198678fa1a1a49] - doc: support toolchain Visual Studio 2022 & 2026 + Windows 11 SDK (Mike McCready) #61864d8204d3cdb] - doc: rename invalidfunctionparameter (René) #61942a5a14482fb] - doc: clarify status of feature request issues (Antoine du Hamel) #61505bd0688feb6] - doc: add esm and cjs examples to node:vm (Alfredo González) #61498240b512f9f] - doc: clarify build environment is trusted in threat model (Matteo Collina) #618655dd48e3456] - doc: remove incorrect mention ofmoduleintypescript.md(Rob Palmer) #618399502c22055] - doc: simplify addAbortListener example (Chemi Atlow) #618426fec397828] - doc: clean up globals.md (René) #61822a810f5ccef] - doc: clarify async caveats forevents.once()(René) #615722bf990bb1a] - doc: update Juan's security steward info (Juan José) #617540312db948d] - doc: fix methods being documented as properties inprocess.md(Antoine du Hamel) #61765e558b26e7f] - doc: add riscv64 info into platform list (Lu Yahan) #4225149254e3dc0] - doc: fix dropdown menu being obscured at <600px due to stacking context (Jeff) #617354ff01b5c10] - doc: fix spacing in process message event (Aviv Keller) #6175694097a79d6] - doc: move describe/it aliases section before expectFailure (Luca Raveri) #61567b7cd31acbe] - doc: fix broken links of net.md (YuSheng Chen) #61673ae5e353fe2] - doc: clean up Windows code snippet inchild_process.md(reillylm) #61422ea9beb6a3c] - doc: update to Visual Studio 2026 manual install (Mike McCready) #6165542057c84e2] - doc,module: add missing doc for syncHooks.deregister() (Joyee Cheung) #61959a035bd5235] - doc,test: clarify --eval syntax for leading '-' scripts (kovan) #62244deb0b78460] - esm: fix typo in worker loader hook comment (jakecastelli) #62475b93bf7dbfc] - esm: fix source phase identity bug in loadCache eviction (Guy Bedford) #62415679d18b57f] - esm: fix path normalization infinalizeResolution(Antoine du Hamel) #62080171e9fc268] - esm: update outdated FIXME comment in translators.js (Karan Mangtani) #61715cc19728228] - events: avoid cloning listeners array on every emit (Gürgün Dayıoğlu) #62261458c92be52] - events: don't call resume after close (Сковорода Никита Андреевич) #605484691f3e7fb] - fs: fix cpSync to handle non-ASCII characters (Stefan Stojanovic) #61950f4a3edc47a] - (SEMVER-MINOR) fs: addthrowIfNoEntryoption for fs.stat and fs.promises.stat (Juan José) #6117858e4d50cd0] - http: fix use-after-free when freeParser is called during llhttp_execute (Gerhard Stöbich) #620950a4ad85ab0] - http: validate ClientRequest path on set (Matteo Collina) #62030f8178ac3e6] - http: validate headers in writeEarlyHints (Richard Clarke) #61897899884d0ed] - http: remove redundant keepAliveTimeoutBuffer assignment (Efe) #6174308d2e40694] - http: attach error handler to socket synchronously in onSocket (RajeshKumar11) #617701c2064c1f8] - http: fix keep-alive socket reuse race in requestOnFinish (Martin Slota) #6171038e9c66e0f] - http2: add strictSingleValueFields option to relax header validation (Tim Perry) #599175cdcba17cc] - (SEMVER-MINOR) http2: add http1Options for HTTP/1 fallback configuration (Amol Yadav) #61713687c0acd00] - http2: fix FileHandle leak in respondWithFile (sangwook) #617070c8f802ec2] - inspector: add Target.getTargets and extract TargetManager (Kohei) #624877de8a303c1] - inspector: unwrap internal/debugger/inspect imports (René) #6197459ac10a4fd] - lib: make SubtleCrypto.supports enumerable (Filip Skokan) #623079dc102ba90] - lib: prefer primordials in SubtleCrypto (Filip Skokan) #6222678a9aa8f32] - lib: fix source map url parse in dynamic imports (Chengzhong Wu) #6199016b8cc6643] - lib: improve argument handling in Blob constructor (Ms2ger) #61980a03b5d39b8] - lib: reduce cycles in esm loader and load it in snapshot (Joyee Cheung) #617691017bf5f86] - lib: remove top-level getOptionValue() calls in lib/internal/modules (Joyee Cheung) #61769d79984b41b] - lib: optimize styleText when validateStream is false (Rafael Gonzaga) #617926462b89d10] - meta: bump actions/download-artifact from 7.0.0 to 8.0.0 (dependabot[bot]) #620635bb89916ea] - meta: bump actions/upload-artifact from 6.0.0 to 7.0.0 (dependabot[bot]) #62062b067d74d94] - meta: bump step-security/harden-runner from 2.14.2 to 2.15.0 (dependabot[bot]) #62064830e5cd125] - meta: bump github/codeql-action from 4.32.0 to 4.32.4 (dependabot[bot]) #6191116c839a3dd] - meta: bump step-security/harden-runner from 2.14.1 to 2.14.2 (dependabot[bot]) #61909498abf661e] - meta: bump actions/stale from 10.1.1 to 10.2.0 (dependabot[bot]) #6190878ac17f426] - module: fix coverage of mocked CJS modules imported from ESM (Marco) #6213346cfad4138] - module: run require.resolve through module.registerHooks() (Joyee Cheung) #620288b6be3fe14] - module: mark require(esm) as stable (Joyee Cheung) #6095968fbc0c6cc] - module: mark module compile cache as stable (Joyee Cheung) #60971c851e76f8c] - (SEMVER-MINOR) net: addsetTOSandgetTOStoSocket(Amol Yadav) #615034c206ecb31] - quic: remove CryptoKey support from session keys option (Filip Skokan) #623352f9c085cf5] - sqlite: handle stmt invalidation (Guilherme Araújo) #618776ac4304c87] - (SEMVER-MINOR) sqlite: add limits property to DatabaseSync (Mert Can Altin) #61298aaf9af1672] - sqlite: mark as release candidate (Matteo Collina) #612627d67e5d693] - src: convert context_frame field in AsyncWrap to internal field (Anna Henningsen) #62103d8ea1aaa8a] - src: make AsyncWrap subclass internal field counts explicit (Anna Henningsen) #621031dbf3bedbe] - src: improve EC JWK import performance (Filip Skokan) #62396cd84af747b] - src: handle null backing store in ArrayBufferViewContents::Read (Mert Can Altin) #623434f553cdc01] - src: enable compilation/linking with OpenSSL 4.0 (Filip Skokan) #6241070f8057258] - src: use stack allocation in indexOf latin1 path (Mert Can Altin) #62268d788467b6a] - src: expose async context frame debugging helper to JS (Anna Henningsen) #621034213f893ec] - src: release context frame in AsyncWrap::EmitDestroy (Gerhard Stöbich) #6199579fb8cbcf5] - src: use validate_ascii_with_errors instead of validate_ascii (Сковорода Никита Андреевич) #611222df328d59e] - src: fix flags argument offset in JSUdpWrap (Weixie Cui) #61948eb77a7a297] - (SEMVER-MINOR) src: add C++ support for diagnostics channels (RafaelGSS) #618696cda3d30c0] - src: remove unnecessaryc_str()conversions in diagnostic messages (Anna Henningsen) #6178626c6045363] - src: use bool literals in TraceEnvVarOptions (Tobias Nießen) #614253c8f700fd7] - src: track allocations made by zstd streams (Anna Henningsen) #6171794dbb36d4d] - src: do not store compression methods on Brotli classes (Anna Henningsen) #61717bef661f182] - src: extract zlib allocation tracking into its own class (Anna Henningsen) #61717e8079a8297] - src: release memory for zstd contexts inClose()(Anna Henningsen) #617176e1197a3cc] - src: add more checks and clarify docs for external references (Joyee Cheung) #61719c28a22c4be] - src: fix cjs_lexer external reference registration (Joyee Cheung) #617189e2c5fd7c9] - src: simply uint32 to string as it must not fail (Chengzhong Wu) #60846df435d32b8] - src: build v8 tick processor as built-in source text modules (Joyee Cheung) #605182cb3573735] - src,sqlite: fix filterFunc dangling reference (Edy Silva) #62281c44f53b544] - stream: preserve error over AbortError in pipeline (Marco) #62113dc541370b4] - stream: replace bind with arrow function for onwrite callback (Ali Hassan) #62087f6cdfbfaa7] - stream: optimize webstreams pipeTo (Mattias Buelens) #62079fcf2a9f788] - stream: fix brotli error handling in web compression streams (Filip Skokan) #62107cdec579c6b] - stream: improve Web Compression spec compliance (Filip Skokan) #62107dbe5898379] - stream: fix UTF-8 character corruption in fast-utf8-stream (Matteo Collina) #61745531e62cd74] - stream: fix TransformStream race on cancel with pending write (Marco) #62040a3751f2249] - stream: accept ArrayBuffer in CompressionStream and DecompressionStream (조수민) #6191365aa8f68d0] - stream: fix pipeTo to defer writes per WHATWG spec (Matteo Collina) #6180015f32b4935] - stream: fix decoded fromList chunk boundary check (Thomas Watson) #61884569767e52e] - stream: add fast paths for webstreams read and pipeTo (Matteo Collina) #618076834ca13bb] - (SEMVER-MINOR) stream: renameDuplex.toWeb()type option toreadableType(René) #616325ed5474437] - test: update WPT for WebCryptoAPI to2cb332d(Node.js GitHub Bot) #624833c9c0f8577] - test: fix test-buffer-zero-fill-cli to be effective (Сковорода Никита Андреевич) #6062319a52a1abe] - test: update WPT for url tofc3e651(Node.js GitHub Bot) #62379111ba9bd5b] - test: wait for reattach before initial break on restart (Yuya Inoue) #624710897c6cc08] - test: disable flaky WPT Blob test on AIX (James M Snell) #624701c3d93bfab] - test: avoid flaky run wait in debugger restart test (Yuya Inoue) #6211283416a640a] - test: skip test-cluster-dgram-reuse on AIX 7.3 (Stewart X Addison) #62238af8d0922dd] - test: add WebCrypto Promise.prototype.then pollution regression tests (Filip Skokan) #62226fc9a60ec74] - test: update WPT for WebCryptoAPI to6a1c545(Node.js GitHub Bot) #6218712ba2d74fe] - test: update WPT for url toc928b19(Node.js GitHub Bot) #621484e15e5b647] - test: update WPT for WebCryptoAPI toc9e9558(Node.js GitHub Bot) #62147dc66a05558] - test: improve WPT report runner (Filip Skokan) #621079536e5621b] - test: update WPT compression toae05f5c(Filip Skokan) #62107fb1c0bda0a] - test: update WPT for WebCryptoAPI to42e4732(Node.js GitHub Bot) #62048d886f27485] - test: fix skipping behavior fortest-runner-run-files-undefined(Antoine du Hamel) #62026f79df03e0b] - test: remove unnecessaryprocess.exitcalls from test files (Antoine du Hamel) #620201319295467] - test: skiptest-urlon--shared-adabuilds (Antoine du Hamel) #620192ea06727c6] - test: skip strace test with shared openssl (Richard Lau) #61987c0680d5df7] - test: avoid flaky debugger restart waits (Yuya Inoue) #6177322b748ef72] - test: fix typos in test files (Daijiro Wachi) #61408a20bf9a84d] - test: allow filtering async internal frames in assertSnapshot (Joyee Cheung) #61769ec2913f036] - test: unify assertSnapshot stacktrace transform (Chengzhong Wu) #61665460f41233d] - test: check stability block position in API markdown (René) #585909ad02065d5] - test: adapt buffer test for v8 sandbox (Shelley Vohr) #617725cf001736e] - test: update FileAPI tests from WPT (Ms2ger) #6175084c7a23223] - test: update WPT for WebCryptoAPI to7cbe7e8(Node.js GitHub Bot) #61729276a32fd10] - test: update WPT for url toefb889e(Node.js GitHub Bot) #61728f5f21d36a6] - test_runner: add exports option for module mocks (sangwook) #61727bfc8a12977] - test_runner: make it compatible with fake timers (Matteo Collina) #59272e0cde40e1d] - test_runner: set non-zero exit code when suite errors occur (Edy Silva) #62282d74efd6834] - test_runner: run afterEach on runtime skip (Igor Shevelenkov) #615258287ca749e] - test_runner: expose expectFailure message (sangwook) #615631f2025fd1e] - (SEMVER-MINOR) test_runner: expose worker ID for concurrent test execution (Ali Hassan) #61394b1199c7bb4] - test_runner: replace native methods with primordials (Ayoub Mabrouk) #612191ca20fc33d] - (SEMVER-MINOR) test_runner: show interrupted test on SIGINT (Matteo Collina) #61676207ba4f89f] - test_runner: fix suite rerun (Moshe Atlow) #617759927335c11] - tls: forward keepAlive, keepAliveInitialDelay, noDelay to socket (Sergey Zelenov) #62004a1c3c901c0] - tools: bump picomatch from 4.0.3 to 4.0.4 in /tools/eslint (dependabot[bot]) #624391c6f5ed7c2] - tools: adopt the--check-for-duplicatesNCU flag (Antoine du Hamel) #62478b53377e8fe] - tools: bump flatted from 3.4.1 to 3.4.2 in /tools/eslint (dependabot[bot]) #62375f102e79b80] - tools: bump eslint deps (Huáng Jùnliàng) #62356f5d74f8216] - tools: add eslint-plugin-regexp (Huáng Jùnliàng) #62093bc5b9a04ad] - tools: bump flatted from 3.3.3 to 3.4.1 in /tools/eslint (dependabot[bot]) #62255bad48b9700] - tools: validate all commits that are pushed tomain(Antoine du Hamel) #62246795d663ff4] - tools: keep GN files when updating Merve (Antoine du Hamel) #621670b6fa913f1] - tools: revert timezone update GHA workflow to ubuntu-latest (Richard Lau) #62140840e098e99] - tools: improve error handling in test426 update script (Rich Trott) #62121bd34e53a8e] - tools: bump the eslint group across 1 directory with 2 updates (dependabot[bot]) #6209254dc797644] - tools: fix daily wpt workflow nighly release version lookup (Filip Skokan) #6207630476ddff7] - tools: fix example in release proposal linter (Richard Lau) #620745245900c05] - tools: bump minimatch from 3.1.3 to 3.1.5 in /tools/clang-format (dependabot[bot]) #6201359ad1e4503] - tools: bump eslint to v10, babel to v8.0.0-rc.2 (Huáng Jùnliàng) #619056f93c4b287] - tools: fix parsing of commit trailers inlint-release-proposalGHA (Antoine du Hamel) #62077de1bcfd54c] - tools: bump minimatch from 3.1.2 to 3.1.3 in/tools/clang-format(dependabot[bot]) #61977492868a7aa] - tools: fix permissions for merve update script (Richard Lau) #62023774d0be1b3] - tools: revert tools GHA workflow to ubuntu-latest (Richard Lau) #62024d91a689d6f] - tools: bump minimatch from 3.1.2 to 3.1.3 in /tools/eslint (dependabot[bot]) #6197634b6305933] - tools: roll back to x86 runner onscorecard.yml(Antoine du Hamel) #61944937cd97a63] - tools: fix auto-start-ci (Antoine du Hamel) #619000958f9a9c7] - tools: do not checkout repo inauto-start-ci.yml(Antoine du Hamel) #61874c7607b9208] - tools: automate updates for test/fixtures/test426 (Rich Trott) #6097800df3c1273] - tools: bump unist-util-visit in /tools/doc in the doc group (dependabot[bot]) #61646fe15b0d65e] - tools: bump the eslint group in /tools/eslint with 6 updates (dependabot[bot]) #61628bc38db51fc] - tools: fix small inconsistencies in JSON doc output (Antoine du Hamel) #617573e7010d47f] - tools: refloat 10 Node.js patches to cpplint.py (Michaël Zasso) #60901583e6c67ea] - tools: update cpplint to 2.0.2 (Michaël Zasso) #609014c12ab8abc] - typings: rationalise TypedArray types (René) #621748357ebfe54] - url: suppress warnings from url.format/url.resolve inside node_modules (René) #62005aad7b3cfca] - url: enable simdutf for ada (Yagiz Nizipli) #614777b28fb9812] - util: allow color aliases in styleText (sangwook) #621808bbe0138ce] - util: add fast path to stripVTControlCharacters (Hiroki Osame) #61833f7a408d6f7] - wasm: support js string constant esm import (Guy Bedford) #62198a0316d33b5] - watch: get flags from execArgv (Efe) #61779eee96f7f5d] - worker: heap profile optimizations (Ilyas Shabi) #62201deeeb22e1a] - worker: eliminate race condition in process.cwd() (giulioAZ) #61664b15ea64ed9] - zlib: fix use-after-free when reset() is called during write (Matteo Collina) #62325a9c5bd29c9] - zlib: add support for brotli compression dictionary (Andy Weiss) #61763v24.14.1: 2026-03-24, Version 24.14.1 'Krypton' (LTS), @RafaelGSS prepared by @juanarbolCompare Source
This is a security release.
Notable Changes
Commits
6fae244080] - (CVE-2026-21717) build,test: test array index hash collision (Joyee Cheung) nodejs-private/node-private#828cc0910c62e] - (CVE-2026-21713) crypto: use timing-safe comparison in Web Cryptography HMAC and KMAC (Filip Skokan) nodejs-private/node-private#82280cb042cf3] - deps: update undici to 7.24.4 (Node.js GitHub Bot) #62271f5b8667dc2] - deps: update undici to 7.24.3 (Node.js GitHub Bot) #6223308852637d9] - deps: update undici to 7.22.0 (Node.js GitHub Bot) #6203561097db9fb] - deps: upgrade npm to 11.11.0 (npm team) #619949ac0f9f81e] - deps: upgrade npm to 11.10.1 (npm team) #618923dab3c4698] - deps: V8: overridedepot_toolsversion (Richard Lau) #6234487521e99d1] - deps: V8: backport1361b2a(Joyee Cheung) nodejs-private/node-private#828045013366f] - deps: V8: backport185f0fe(Joyee Cheung) nodejs-private/node-private#828af22629ea8] - deps: V8: backport0a8b1cd(snek) nodejs-private/node-private#828380ea72eef] - (CVE-2026-21710) http: use null prototype for headersDistinct/trailersDistinct (Matteo Collina) nodejs-private/node-private#821d6b6051e08] - (CVE-2026-21716) permission: include permission check on lib/fs/promises (RafaelGSS) nodejs-private/node-private#795bfdecef9da] - (CVE-2026-21715) permission: add permission check to realpath.native (RafaelGSS) nodejs-private/node-private#794c015edf313] - (CVE-2026-21714) src: handle NGHTTP2_ERR_FLOW_CONTROL error code (RafaelGSS) nodejs-private/node-private#832cba66c48a5] - (CVE-2026-21712) src: handle url crash on different url formats (RafaelGSS) nodejs-private/node-private#816df8fbfb93d] - (CVE-2026-21637) tls: wrap SNICallback invocation in try/catch (Matteo Collina) nodejs-private/node-private#819v24.14.0: 2026-02-24, Version 24.14.0 'Krypton' (LTS), @ruyadorno prepared by @aduh95Compare Source
Notable Changes
8b6d31d379] - (SEMVER-MINOR) async_hooks: addtrackPromisesoption tocreateHook()(Joyee Cheung) #6141568da144b4e] - build,deps: replace cjs-module-lexer with merve (Yagiz Nizipli) #61456f3a24c76e4] - (SEMVER-MINOR) deps: add LIEF as a dependency (Joyee Cheung) #611671948861d23] - (SEMVER-MINOR) events: repurposeevents.listenerCount()to accept EventTargets (René) #60214d6f7c8d06f] - (SEMVER-MINOR) fs: addignoreoption tofs.watch(Matteo Collina) #61433cb54b3ca6e] - (SEMVER-MINOR) http: addhttp.setGlobalProxyFromEnv()(Joyee Cheung) #6095335b1759d06] - (SEMVER-MINOR) module: allow subpath imports that start with#/(Jan Martin) #608642d72ea66f2] - (SEMVER-MINOR) process: preserveAsyncLocalStorageinqueueMicrotaskonly when needed (Gürgün Dayıoğlu) #609136f4a4f6c8e] - (SEMVER-MINOR) sea: split sea binary manipulation code (Joyee Cheung) #61167c0ceb9b065] - (SEMVER-MINOR) sqlite: enable defensive mode by default (Bart Louwers) #6126633d8e8303b] - (SEMVER-MINOR) sqlite: add sqlite prepare options args (Guilherme Araújo) #61311563ab699eb] - (SEMVER-MINOR) src: add initial support for ESM in embedder API (Joyee Cheung) #615484c80031000] - (SEMVER-MINOR) stream: addbytes()method tonode:stream/consumers(wantaek) #60426f5233df4ff] - (SEMVER-MINOR) stream: do not passreadable.compose()output viaReadable.from()(René) #60907345a40fda3] - (SEMVER-MINOR) test: use fixture directories for sea tests (Joyee Cheung) #61167972f82411d] - (SEMVER-MINOR) test_runner: addenvoption torunfunction (Ethan Arrowood) #61367d77f98c4b6] - (SEMVER-MINOR) test_runner: support expecting a test-case to fail (Jacob Smith) #606698e900af6ba] - (SEMVER-MINOR) util: addconvertProcessSignalToExitCodeutility (Erick Wendel) #60963Commits
180778fb9a] - assert: fix loose deepEqual arrays with undefined and null failing (Ruben Bridgewater) #615878b6d31d379] - (SEMVER-MINOR) async_hooks: add trackPromises option to createHook() (Joyee Cheung) #6141583bcd38d35] - benchmark: add streaming TextDecoder benchmark (Сковорода Никита Андреевич) #615494c105844c5] - build: add support for Visual Studio 2026 (Michaël Zasso) #607271f84fd91d9] - build: skip sscache action on non-main branches (Joyee Cheung) #6179030601b680f] - build: add--shared-nbytesconfigure flag (Antoine du Hamel) #61341c6253eda49] - build: add--shared-hdr-histogramconfigure flag (Antoine du Hamel) #61280584c189037] - build: add--shared-gtestconfigure flag (Antoine du Hamel) #612795998987881] - build: aix: deoptimize implementation-visitor.cc with --shared (Stewart X Addison) #6155068da144b4e] - build,deps: replace cjs-module-lexer with merve (Yagiz Nizipli) #614566a4511bafb] - build,win: fix vs2022 compilation (Stefan Stojanovic) #615302d6735db8a] - deps: upgrade npm to 11.9.0 (npm team) #61685699e2f8f81] - deps: update amaro to 1.1.7 (Node.js GitHub Bot) #617307be76316d6] - deps: update minimatch to 10.1.2 (Node.js GitHub Bot) #6173297e5a65013] - deps: update undici to 7.21.0 (Node.js GitHub Bot) #6168374e4710ee7] - deps: update googletest to56efe39(Node.js GitHub Bot) #61605b5113e2a2a] - deps: update amaro to 1.1.6 (Node.js GitHub Bot) #61603f3a24c76e4] - (SEMVER-MINOR) deps: add LIEF as a dependency (Joyee Cheung) #61167c370c3dc06] - (SEMVER-MINOR) deps: add tools and scripts to pull LIEF as a dependency (Joyee Cheung) #61167e54975e17d] - deps: V8: cherry-pick highway@dcc0ca1(Richard Lau) #61008625b90b76b] - deps: update undici to 7.19.2 (Node.js GitHub Bot) #6156605e9a9fb5e] - deps: update undici to 7.19.1 (Node.js GitHub Bot) #615143d41643e38] - deps: update undici to 7.19.0 (Node.js GitHub Bot) #6147017b363a66c] - dns: fix Windows SRV ECONNREFUSED by adjusting c-ares fallback detection (notvivek12) #6145333d0a8c22d] - doc: clarify EventEmitter error handling in threat model (Matteo Collina) #617015b8e72cf85] - doc: mention default option for test runner env (Steven) #61659f44e67fac2] - doc: fix --inspect security warning section (Tim Perry) #61675a0e09c9043] - doc: documenturl.format(urlString)as deprecated under DEP0169 (René) #616445e719248fe] - doc: deprecation add more codemod (Augustin Mauroy) #616428f5a3e5df4] - doc: fix grammatical error in README.md (ayj8201) #61653d52b535163] - doc: correct tools README Boxstarter link (Mike McCready) #616384889dc4f59] - doc: updateserver.dropMaxConnectionlink (YuSheng Chen) #615848e48e72f2a] - doc: clean up writing-and-running-benchmarks.md (Hardanish Singh) #613451948861d23] - (SEMVER-MINOR) events: repurposeevents.listenerCount()to accept EventTargets (René) #60214d6f7c8d06f] - (SEMVER-MINOR) fs: add ignore option to fs.watch (Matteo Collina) #614332d7e5f9581] - http: implement slab allocation for HTTP header parsing (Mert Can Altin) #61375cb54b3ca6e] - (SEMVER-MINOR) http: add http.setGlobalProxyFromEnv() (Joyee Cheung) #609536df8be48ce] - lib: use utf8 fast path for streaming TextDecoder (Сковорода Никита Андреевич) #61549830fff0aca] - lib: recycle queues (Robert Nagy) #61461069874bdbd] - lib: use StringPrototypeStartsWith from primordials in locks (Taejin Kim) #614927824c7589e] - lib: unify ICU and no-ICU TextDecoder (Сковорода Никита Андреевич) #61409f81430702a] - lib: prefercall()overapply()if argument list is not array (Livia Medeiros) #60796a723f72e1e] - lib: add support for readable byte streams to .toWeb() (Hans Klunder) #58664b78d814b3d] - meta: persist sccache daemon until end of build workflows (René) #6163940a872a4b9] - meta: bump github/codeql-action from 4.31.9 to 4.32.0 (dependabot[bot]) #616220637bdb3be] - meta: bump step-security/harden-runner from 2.14.0 to 2.14.1 (dependabot[bot]) #61621e8d9bd9fc5] - meta: bump actions/setup-python from 6.1.0 to 6.2.0 (dependabot[bot]) #61627c517df2b65] - meta: bump actions/setup-node from 6.1.0 to 6.2.0 (dependabot[bot]) #616259a64f2f25d] - meta: bump actions/cache from 5.0.1 to 5.0.3 (dependabot[bot]) #616240e5922e95e] - meta: bump peter-evans/create-pull-request from 8.0.0 to 8.1.0 (dependabot[bot]) #616235da7b51091] - meta: bump actions/stale from 10.1.0 to 10.1.1 (dependabot[bot]) #61620c085c8a43f] - meta: bump actions/checkout from 6.0.1 to 6.0.2 (dependabot[bot]) #61619ce2acf0275] - meta: bump actions/download-artifact from 6.0.0 to 7.0.0 (dependabot[bot]) #61242629f0eaac5] - meta: bump actions/checkout from 6.0.0 to 6.0.1 (dependabot[bot]) #61239cd80d369c9] - meta: bump actions/upload-artifact from 5.0.0 to 6.0.0 (dependabot[bot]) #612388c75e4e1fa] - meta: bump actions/checkout from 5.0.1 to 6.0.0 (dependabot[bot]) #609255a9e9f4127] - meta: bump actions/checkout from 5.0.0 to 5.0.1 (dependabot[bot]) #607671519251dd1] - module: do not invoke resolve hooks twice for imported cjs (Joyee Cheung) #615298d7190b3fe] - module: do not wrap module._load when tracing is not enabled (Joyee Cheung) #6147935b1759d06] - (SEMVER-MINOR) module: allow subpath imports that start with#/(Jan Martin) #608647a83b38921] - net: defer synchronous destroy calls in internalConnect (RajeshKumar11) #6165816bab79421] - process: do not truncate long strings in--print(Mohamed Akram) #614972d72ea66f2] - (SEMVER-MINOR) process: preserve AsyncLocalStorage in queueMicrotask only when needed (Gürgün Dayıoğlu) #609139cc1c4604f] - repl: fix getters triggering side effects during completion (Dario Piotrowicz) #6104393703306a1] - repl: tab completion targets<class>instead ofnew <class>(Đỗ Trọng Hải) #603196f4a4f6c8e] - (SEMVER-MINOR) sea: split sea binary manipulation code (Joyee Cheung) #6116746a2dad4db] - sqlite: avoid extra copy for large text binds (Ali Hassan) #61580f91a377f7e] - sqlite: use DictionaryTemplate for run() result (Mert Can Altin) #614320e7571ae3e] - sqlite: change approach to fix segfault SQLTagStore (Bart Louwers) #604628e8f70524a] - sqlite: reserve vectors space (Guilherme Araújo) #61540c0ceb9b065] - (SEMVER-MINOR) sqlite: enable defensive mode by default (Bart Louwers) #6126633d8e8303b] - (SEMVER-MINOR) sqlite: add sqlite prepare options args (Guilherme Araújo) #61311f0d8f37002] - src: elide heap allocation in structured clone implementation (Anna Henningsen) #61703db478c4336] - src: use simdutf for one-byte string UTF-8 write in stringBytes (Mert Can Altin) #61696563ab699eb] - (SEMVER-MINOR) src: add initial support for ESM in embedder API (Joyee Cheung) #61548da13186a15] - src: throw RangeError on failed ArrayBuffer BackingStore allocation (Chengzhong Wu) #614804c80031000] - (SEMVER-MINOR) stream: add bytes() method to stream/consumers (wantaek) #60426f5233df4ff] - (SEMVER-MINOR) stream: do not passreadable.compose()output viaReadable.from()(René) #60907ad04a469c8] - test: restraint version replacement pattern in snapshots (Chengzhong Wu) #617482d3b4a8d65] - test: print stack immediately avoiding GC interleaving (Chengzhong Wu) #6169938f43a6d4e] - test: fix case-insensitive path matching on Windows (Matteo Collina) #6168206513f5ff2] - test: fix flaky test-performance-eventloopdelay (Matteo Collina) #616299d79c66c61] - test: remove duplicate wpt tests (Filip Skokan) #61617eac9f4f401] - test: fix race condition in watch mode tests (Matteo Collina) #61615ecf5947575] - test: update WPT for url toe3c46fd(Node.js GitHub Bot) #61602356ff5fece] - test: use the skipIfNoWatch() utility function (Luigi Pinca) #615314b2187aea2] - test: unify assertSnapshot common patterns (Chengzhong Wu) #615908c25489d63] - test: split test-fs-watch-ignore-* (Luigi Pinca) #6149443b8a2b7e7] - test: add some validation for JSON doc output (Antoine du Hamel) #61413345a40fda3] - (SEMVER-MINOR) test: use fixture directories for sea tests (Joyee Cheung) #6116724cf6b8326] - test: reveal wpt evaluation errors in status files (Chengzhong Wu) #61358d4034dfb62] - test: forbid use of named imports for fixtures (Antoine du Hamel) #612284f871ee897] - test: enforce better never-settling-promise detection (Antoine du Hamel) #609768e9adedf02] - test: ensure assertions are reached on all tests (Antoine du Hamel) #60845273832802e] - test: ensure assertions are reached on more tests (Antoine du Hamel) #60763e06adcb52f] - test: ensure assertions are reached on more tests (Antoine du Hamel) #60760aeed0ccc02] - test: useRegExp.escapeto improve test reliability (Antoine du Hamel) #6080374bcd0adab] - test: ensure assertions are reached on more tests (Antoine du Hamel) #60728407807b08e] - test: skip tests not passing withoutNODE_OPTIONSsupport (Antoine du Hamel) #60912a9e70cefb0] - test: ensure assertions are reached on more tests (Antoine du Hamel) #6063421b23cd0d0] - test_runner: fix test enqueue when test file has syntax error (Edy Silva) #615736a4de694b2] - test_runner: fix passingexpectFailure(Moshe Atlow) #615686640de2b0f] - test_runner: differentiate todo and failure styles (Moshe Atlow) #61564972f82411d] - (SEMVER-MINOR) test_runner: add env option to run function (Ethan Arrowood) #61367d77f98c4b6] - (SEMVER-MINOR) test_runner: support expecting a test-case to fail (Jacob Smith) #60669f98986cbb9] - tools: switch to ARM runners on GHA jobs (Antoine du Hamel) #61903034589dd93] - tools: avoid building twice in coverage jobs (Antoine du Hamel) #61899e50e2f00bb] - tools: use ubuntu-slim runner in GHA (Antoine du Hamel) #61759f658f48ccb] - tools: use ubuntu-slim runner in GHA (Antoine du Hamel) #6173465c77d74ff] - tools: use ubuntu-latest runner innotify-on-pushworkflow (Antoine du Hamel) #61742605905556a] - tools: enforce removal oflts-watch-*labels on release proposals (Antoine du Hamel) #61672f0f98d4c03] - tools: use ubuntu-slim runner in meta GitHub Actions (Tierney Cyren) #61663ab63ddf354] - tools: add LIEF to license builder (Chengzhong Wu) #615238a0f6192c9] - tools: enforce trailing commas intest/es-module(Antoine du Hamel) #608914afbbcf39e] - tools: enforce trailing commas intest/sequential(Antoine du Hamel) #608924c1abf752c] - tools,win: upgrade install additional tools to Visual Studio 2026 (Mike McCready) #615628e900af6ba] - (SEMVER-MINOR) util: add convertProcessSignalToExitCode utility (Erick Wendel) #60963Configuration
📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR has been generated by Renovate Bot.
d8c0db09f7to168194aea9Update dependency node to v24.14.0to Update dependency node to v24.14.1168194aea9tocaff87f7f4Update dependency node to v24.14.1to Update dependency node to v24.15.0View command line instructions
Checkout
From your project repository, check out a new branch and test the changes.