2025-07-29, Version 24.5.0 (Current) #59257

github-actions · 2025-07-28T09:27:16Z

Upgrade to OpenSSL 3.5

This release is distributed with OpenSSL 3.5.1, following the announcement that
OpenSSL 3.5 will be supported until April 2030, while Node.js 24 will be
supported until April 2028. Read more about OpenSSL support in their blog post:
https://openssl-library.org/post/2025-02-20-openssl-3.5-lts/.

Contributed in #59234.

Unflag `--experimental-wasm-modules`

Node.js supports both source phase imports and instance phase imports to WebAssembly
modules and for WASM imports to JavaScript, in line with the current Phase 3
WebAssembly ESM Integration proposal.
The implementation and the specification are still subject to change.

Contributed by Guy Bedford in #57038.

Built-in proxy support in `request()` and `Agent`

node:http and node:https now support proxies. When NODE_USE_ENV_PROXY
is set to 1, the default global agent would parse the http_proxy/HTTP_PROXY,
https_proxy/HTTPS_PROXY, no_proxy/NO_PROXY settings from the
environment variables, and proxy the requests sent through the built-in http/https
client accordingly.

To use global proxy support from the command line:

NODE_USE_ENV_PROXY=1 HTTP_PROXY=http://proxy.example.com:8080 HTTPS_PROXY=http://proxy.example.com:8080 NO_PROXY=localhost,127.0.0.1 node client.js

In addition, http.Agent and https.Agent now support the custom proxyEnv options.

const agent = new https.Agent({ proxyEnv: { HTTPS_PROXY: 'http://proxy.example.com:8080' } });

For reference, fetch() already supports NODE_USE_ENV_PROXY as of Node.js 24.0.0.

Contributed by Joyee Cheung in #58980.

Add `setDefaultCACertificates()` to `node:tls`

This API allows dynamically configuring CA certificates that will be used by the
Node.js TLS clients by default.

Once called, the provided certificates will become the default CA certificate list
returned by tls.getCACertificates('default') and used by TLS connections that
don't specify their own CA certificates.

To add system CA certificates to the default bundle (which includes the Mozilla
CA certificates):

tls.setDefaultCACertificates(tls.getCACertificates('default').concat(tls.getCACertificates('system')));

Contributed by Joyee Cheung in #58822.

Other notable changes

[d5640ca58a] - (SEMVER-MINOR) cli: support ${pid} placeholder in --cpu-prof-name (Haram Jeong) #59072
[eeeb40e95b] - (SEMVER-MINOR) crypto: add tls.setDefaultCACertificates() (Joyee Cheung) #58822
[c52aaacfc5] - (SEMVER-MINOR) dns: support max timeout (theanarkh) #58440
[927742b342] - doc: update the instruction on how to verify releases (Antoine du Hamel) #59113
[7f654cee9e] - (SEMVER-MINOR) http,https: add built-in proxy support in http/https.request and Agent (Joyee Cheung) #58980
[f753645cd8] - (SEMVER-MINOR) net: update net.blocklist to allow file save and file management (alphaleadership) #58087
[16dc53c143] - (SEMVER-MINOR) test: move http proxy tests to test/client-proxy (Joyee Cheung) #58980
[9791ff3480] - (SEMVER-MINOR) worker: add web locks api (ishabi) #58666

Commits

[5457c7a8a1] - benchmark: adjust configuration for string-decoder bench (Rafael Gonzaga) #59187
[28538f2255] - benchmark: add --track to benchmark (Rafael Gonzaga) #59174
[a28d804497] - benchmark: small lint fix on _cli.js (Rafael Gonzaga) #59172
[09717eb68e] - benchmark: drop misc/punycode benchmark (Rafael Gonzaga) #59171
[ad6757ef02] - benchmark: fix sqlite-is-transaction (Rafael Gonzaga) #59170
[7fc3143f61] - benchmark: reduce N for diagnostics_channel subscribe benchmark (Arthur Angelo) #59116
[f2812723a0] - buffer: cache Environment::GetCurrent to avoid repeated calls (Mert Can Altin) #59043
[e3e729ca60] - build: remove suppressions.supp (Rafael Gonzaga) #59079
[dc66422768] - build,deps,tools: prepare to update to OpenSSL 3.5 (Richard Lau) #58100
[f5da4947d9] - cli: add --use-env-proxy (Joyee Cheung) #59151
[d5640ca58a] - (SEMVER-MINOR) cli: support ${pid} placeholder in --cpu-prof-name (Haram Jeong) #59072
[eeeb40e95b] - (SEMVER-MINOR) crypto: add tls.setDefaultCACertificates() (Joyee Cheung) #58822
[135fca5b72] - crypto: avoid copying buffers to UTF-8 strings in crypto.hash() (Renegade334) #59067
[998cef10e3] - deps: update archs files for openssl-3.5.1 (Node.js GitHub Bot) #59234
[1f06ca956a] - deps: upgrade openssl sources to openssl-3.5.1 (Node.js GitHub Bot) #59234
[55a90eed8d] - deps: upgrade npm to 11.5.1 (npm team) #59199
[2b5d451ae0] - deps: update amaro to 1.1.1 (Node.js GitHub Bot) #59141
[af789d9b5c] - deps: update undici to 7.12.0 (Node.js GitHub Bot) #59135
[a34e44545e] - deps: update sqlite to 3.50.3 (Node.js GitHub Bot) #59132
[bfe4781c7d] - deps: update googletest to 7e17b15 (Node.js GitHub Bot) #59131
[72adf52e51] - deps: update ada to 3.2.6 (Node.js GitHub Bot) #58966
[2a5f35b589] - deps: V8: cherry-pick 3d750c2aa9ef (Michaël Zasso) #58750
[3f813eaba7] - deps: update archs files for openssl-3.0.17 (Node.js GitHub Bot) #59134
[fb52d0d8df] - deps: upgrade openssl sources to openssl-3.0.17 (Node.js GitHub Bot) #59134
[f122602f9d] - deps: update corepack to 0.34.0 (Node.js GitHub Bot) #59133
[c52aaacfc5] - (SEMVER-MINOR) dns: support max timeout (theanarkh) #58440
[927742b342] - doc: update the instruction on how to verify releases (Antoine du Hamel) #59113
[9a8d2020ad] - doc: copyedit SECURITY.md (Rich Trott) #59190
[3da5bc0668] - doc: fix broken sentence in URL.parse (Superchupu) #59164
[06cd7461e0] - doc: improve onboarding instructions (Joyee Cheung) #59159
[dfb72d158b] - doc: add constraints for mem leak to threat model (Rafael Gonzaga) #58917
[51b8dfd5c6] - doc: add Aditi-1400 to collaborators (Aditi) #59157
[4ffa756ce3] - doc: avoid suggesting testing fast api with intense loop (Chengzhong Wu) #59111
[6f81b274f7] - doc: fix typo in writing-test.md (SeokHun) #59123
[88e434e687] - doc: add new environment variables doc page (Dario Piotrowicz) #59052
[b1a318d706] - doc: update release key for aduh95 (Antoine du Hamel) #58877
[34c49000c9] - doc: add missing section for setReturnArrays in sqlite.md (Edy Silva) #59074
[9b2e965aff] - doc: add RafaelGSS as steward July 25 (Rafael Gonzaga) #59078
[2d1dcb87e6] - doc: clarify ERR_FS_FILE_TOO_LARGE to reflect fs.readFile() I/O limit (Haram Jeong) #59050
[999b5e51e7] - doc: run license-builder (github-actions[bot]) #59056
[1940a2cb46] - doc: fix typed list formatting (Aviv Keller) #59019
[6cb5e0d22f] - doc: refine util.parseArgs default definition (Slayer95) #58958
[d2e7f8e13a] - doc: remove unused import in zlib.md (coderaiser) #59041
[9d02960149] - doc: add missing environment variables to manpage (amir lavasani) #58963
[45ffdb34fb] - doc: add stability index to the --watch-kill-signal flag (Dario Piotrowicz) #58997
[3924c43600] - doc: add missing <code> blocks (Antoine du Hamel) #58995
[cb95e183f3] - doc: add scroll margin to links (Roman Reiss) #58982
[c9ded6ba15] - doc: add sponsorship link to RafaelGSS (Rafael Gonzaga) #58983
[b919fe0447] - (SEMVER-MINOR) esm: unflag --experimental-wasm-modules (Guy Bedford) #57038
[71bb6cd077] - esm: js-string Wasm builtins in ESM Integration (Guy Bedford) #59020
[8d869e6d62] - fs: fix return value of fs APIs (theanarkh) #58996
[7f654cee9e] - (SEMVER-MINOR) http,https: add built-in proxy support in http/https.request and Agent (Joyee Cheung) #58980
[85d6a28f4f] - inspector: initial support for Network.loadNetworkResource (Shima Ryuhei) #58077
[cfaa299f2e] - lib: fix incorrect ArrayBufferPrototypeGetDetached primordial type (Dario Piotrowicz) #58978
[d555db22ad] - lib: flag to conditionally modify proto on deprecate (Rafael Gonzaga) #58928
[96c9dd79e6] - meta: move one or more collaborators to emeritus (Node.js GitHub Bot) #59140
[324d9fc9d4] - meta: enable jsdoc/check-tag-names rule (Yagiz Nizipli) #58521
[04c751463b] - meta: add marco-ippolito to security release stewards (Marco Ippolito) #58944
[fe0195fdcc] - module: fix conditions override in synchronous resolve hooks (Joyee Cheung) #59011
[515b581d47] - module: throw error when re-runing errored module jobs (Joyee Cheung) #58957
[f753645cd8] - (SEMVER-MINOR) net: update net.blocklist to allow file save and file management (alphaleadership) #58087
[15e6c28d82] - node-api,doc: update links to ecma262 with section names (Chengzhong Wu) #59087
[f67b686551] - perf_hooks: do not expose SafeMap via Histogram wrapper (René) #59094
[3d2f919f7c] - process: make execve's args argument optional (Allon Murienik) #58412
[1a44265810] - repl: handle errors from getters during completion (Shima Ryuhei) #59044
[467dbd31e6] - repl: fix repl crashing on variable declarations without init (Dario Piotrowicz) #59032
[3a3eb6852d] - repl: improve REPL disabling completion on proxies and getters (Dario Piotrowicz) #58891
[55838e79b8] - src: call unmask after install signal handler (theanarkh) #59059
[77649ad93b] - src: use FastStringKey for TrackV8FastApiCall (Anna Henningsen) #59148
[86babf9c4b] - src: use C++20 consteval for FastStringKey (Anna Henningsen) #59148
[88b99eeae1] - src: remove declarations of removed BaseObject static fns (Anna Henningsen) #59093
[d89390fc8f] - src: add cache to nearest parent package json (Ilyas Shabi) #59086
[21780075e4] - src: check import attributes value types as strings (Chengzhong Wu) #58986
[ef89c2fac9] - src,test: fix config file parsing for flags defaulted to true (Edy Silva) #59110
[1e990866e0] - test: mark web lock held test as flaky (Ilyas Shabi) #59144
[ba8e95a785] - test: use mustSucceed in test-fs-read (Sungwon) #59204
[39978f507f] - test: prepare test-crypto-rsa-dsa for newer OpenSSL (Richard Lau) #58100
[1c3aadb9d6] - test: fix flaky test-worker-message-port-transfer-filehandle test (Alex Yang) #59158
[a0d22e9c51] - test: remove timeout in test-https-proxy-request-handshake-failure (Joyee Cheung) #59165
[7e0a0fccc1] - test: expand linting rules around assert w literal messages (Anna Henningsen) #59147
[c6070046c3] - test: update WPT for WebCryptoAPI to ab08796857 (Node.js GitHub Bot) #59129
[15d8cc908e] - test: update WPT for WebCryptoAPI to 19d82c57ab (Node.js GitHub Bot) #59129
[83023e5144] - test: skip tests that cause timeouts on IBM i (Abdirahim Musse) #59014
[82d4175ec3] - test: update startCLI to set --port=0 by default (Dario Piotrowicz) #59042
[16dc53c143] - (SEMVER-MINOR) test: move http proxy tests to test/client-proxy (Joyee Cheung) #58980
[a9511a6066] - test: mark test-inspector-network-fetch as flaky on Windows (Joyee Cheung) #59091
[1cffcc02a3] - test: add missing port=0 arg in test-debugger-extract-function-name (Dario Piotrowicz) #58977
[83cdf1701b] - test_runner: clean up promisified interval generation (René) #58824
[195d6038dc] - tools: clarify README linter error message (Joyee Cheung) #59160
[51f578a3bf] - tools: add support for URLs to PR commits in merge.sh (Antoine du Hamel) #59162
[20be9012eb] - tools: bump @eslint/plugin-kit from 0.3.1 to 0.3.3 in /tools/eslint (dependabot[bot]) #59119
[623e264e93] - tools: ignore CVE mention when linting release proposals (Antoine du Hamel) #59037
[0e547e09ab] - tools,test: enforce best practices to detect never settling promises (Antoine du Hamel) #58992
[075d1968db] - util: respect nested formats in styleText (Alex Yang) #59098
[9791ff3480] - (SEMVER-MINOR) worker: add web locks api (ishabi) #58666

Refs: #58218 Signed-off-by: RafaelGSS <[email protected]> PR-URL: #58928 Reviewed-By: Juan José Arboleda <[email protected]> Reviewed-By: Ulises Gascón <[email protected]>

PR-URL: #58087 Fixes: #56252 Reviewed-By: Ethan Arrowood <[email protected]> Reviewed-By: James M Snell <[email protected]>

PR-URL: #58977 Reviewed-By: James M Snell <[email protected]> Reviewed-By: Luigi Pinca <[email protected]>

PR-URL: #58944 Fixes: nodejs/TSC#1764 Reviewed-By: Matteo Collina <[email protected]> Reviewed-By: James M Snell <[email protected]> Reviewed-By: Richard Lau <[email protected]> Reviewed-By: Gireesh Punathil <[email protected]> Reviewed-By: Chengzhong Wu <[email protected]> Reviewed-By: Juan José Arboleda <[email protected]> Reviewed-By: Jordan Harband <[email protected]> Reviewed-By: Rafael Gonzaga <[email protected]> Reviewed-By: Darshan Sen <[email protected]>

PR-URL: #58978 Reviewed-By: Yagiz Nizipli <[email protected]> Reviewed-By: Michaël Zasso <[email protected]> Reviewed-By: James M Snell <[email protected]> Reviewed-By: Chengzhong Wu <[email protected]> Reviewed-By: Juan José Arboleda <[email protected]>

PR-URL: #58983 Reviewed-By: James M Snell <[email protected]> Reviewed-By: Juan José Arboleda <[email protected]> Reviewed-By: Moshe Atlow <[email protected]> Reviewed-By: Luigi Pinca <[email protected]> Reviewed-By: Ruben Bridgewater <[email protected]> Reviewed-By: Darshan Sen <[email protected]>

Re-evaluating an errored ESM should lead to rejecting the rejection again - this is also the case when importing it twice. In the case of retrying with require after import, just throw the cached error. Drive-by: add some debug logs. PR-URL: #58957 Fixes: #58945 Reviewed-By: Marco Ippolito <[email protected]> Reviewed-By: Luigi Pinca <[email protected]> Reviewed-By: Antoine du Hamel <[email protected]>

#57909 introduced the disabling of REPL tab completion on object containing proxies and getters (since such completion triggers code evaluation which can be unexpected/disruptive for the user) the solution in 57909 did not address all possible such cases, the changes here improve on such solution by using acorn and AST analysis to cover most if not all possible cases PR-URL: #58891 Reviewed-By: James M Snell <[email protected]>

PR-URL: #58986 Reviewed-By: Guy Bedford <[email protected]> Reviewed-By: James M Snell <[email protected]> Reviewed-By: Anna Henningsen <[email protected]> Reviewed-By: Marco Ippolito <[email protected]> Reviewed-By: Ethan Arrowood <[email protected]>

Fixes: #57873 PR-URL: #58077 Reviewed-By: James M Snell <[email protected]> Reviewed-By: Chengzhong Wu <[email protected]>

PR-URL: #58982 Reviewed-By: Claudio Wunder <[email protected]> Reviewed-By: Moshe Atlow <[email protected]> Reviewed-By: Luigi Pinca <[email protected]> Reviewed-By: James M Snell <[email protected]> Reviewed-By: Ulises Gascón <[email protected]> Reviewed-By: Tierney Cyren <[email protected]>

PR-URL: #58440 Reviewed-By: Luigi Pinca <[email protected]> Reviewed-By: Matteo Collina <[email protected]>

PR-URL: #58995 Reviewed-By: Luigi Pinca <[email protected]> Reviewed-By: Juan José Arboleda <[email protected]>

PR-URL: #58997 Reviewed-By: Rafael Gonzaga <[email protected]> Reviewed-By: Moshe Atlow <[email protected]> Reviewed-By: Luigi Pinca <[email protected]>

* yield from loop instead of setting up custom iterator * cancel abort listener on exit * do not call <Array>.at(0) PR-URL: #58824 Reviewed-By: Chemi Atlow <[email protected]> Reviewed-By: James M Snell <[email protected]> Reviewed-By: Moshe Atlow <[email protected]>

PR-URL: #58963 Fixes: #58894 Reviewed-By: Dario Piotrowicz <[email protected]> Reviewed-By: Luigi Pinca <[email protected]>

PR-URL: #59032 Fixes: #59029 Reviewed-By: Yagiz Nizipli <[email protected]> Reviewed-By: Matthew Aitken <[email protected]> Reviewed-By: James M Snell <[email protected]>

PR-URL: #59037 Reviewed-By: Luigi Pinca <[email protected]> Reviewed-By: Marco Ippolito <[email protected]>

PR-URL: #59041 Reviewed-By: Luigi Pinca <[email protected]> Reviewed-By: Antoine du Hamel <[email protected]>

The default value is legal by means other than defaulting. PR-URL: #58958 Reviewed-By: Antoine du Hamel <[email protected]>

PR-URL: #59019 Refs: nodejs/doc-kit#348 Reviewed-By: Chemi Atlow <[email protected]> Reviewed-By: Zeyu "Alex" Yang <[email protected]> Reviewed-By: Claudio Wunder <[email protected]>

PR-URL: #59056 Reviewed-By: Yagiz Nizipli <[email protected]> Reviewed-By: James M Snell <[email protected]> Reviewed-By: Filip Skokan <[email protected]> Reviewed-By: Darshan Sen <[email protected]> Reviewed-By: Moshe Atlow <[email protected]> Reviewed-By: Rafael Gonzaga <[email protected]> Reviewed-By: Luigi Pinca <[email protected]> Reviewed-By: Tobias Nießen <[email protected]> Reviewed-By: Ulises Gascón <[email protected]>

PR-URL: #59050 Reviewed-By: James M Snell <[email protected]> Reviewed-By: Luigi Pinca <[email protected]> Reviewed-By: LiviaMedeiros <[email protected]>

PR-URL: #58992 Reviewed-By: Luigi Pinca <[email protected]>

PR-URL: #59078 Reviewed-By: Richard Lau <[email protected]> Reviewed-By: Marco Ippolito <[email protected]> Reviewed-By: Chengzhong Wu <[email protected]> Reviewed-By: Ulises Gascón <[email protected]>

PR-URL: #59074 Refs: #57542 Reviewed-By: Chemi Atlow <[email protected]> Reviewed-By: Luigi Pinca <[email protected]>

We have removed the UBSan workflow and there's no ongoing initiative to bring it back. PR-URL: #59079 Reviewed-By: Richard Lau <[email protected]> Reviewed-By: Marco Ippolito <[email protected]> Reviewed-By: Luigi Pinca <[email protected]>

PR-URL: #59091 Refs: #59090 Reviewed-By: Chengzhong Wu <[email protected]> Reviewed-By: Ryuhei Shima <[email protected]> Reviewed-By: Filip Skokan <[email protected]>

Rewrite to ESM to use TLA. Also add a test to make sure case precedence is honored. Refs: https://about.gitlab.com/blog/we-need-to-talk-no-proxy PR-URL: #58980 Refs: #57872 Refs: #8381 Refs: #15620 Reviewed-By: Matteo Collina <[email protected]>

This patch implements proxy support for HTTP and HTTPS clients and agents in the `http` and `https` built-ins`. When NODE_USE_ENV_PROXY is set to 1, the default global agent would parse the HTTP_PROXY/http_proxy, HTTPS_PROXY/https_proxy, NO_PROXY/no_proxy settings from the environment variables, and proxy the requests sent through the built-in http/https client accordingly. To support this, `http.Agent` and `https.Agent` now accept a few new options: - `proxyEnv`: when it's an object, the agent would read and parse the HTTP_PROXY/http_proxy, HTTPS_PROXY/https_proxy, NO_PROXY/no_proxy properties from it, and apply them based on the protocol it uses to send requests. This option allows custom agents to reuse built-in proxy support by composing options. Global agents set this to `process.env` when NODE_USE_ENV_PROXY is 1. - `defaultPort` and `protocol`: these allow setting of the default port and protocol of the agents. We also need these when configuring proxy settings and deciding whether a request should be proxied. Implementation-wise, this adds a `ProxyConfig` internal class to handle parsing and application of proxy configurations. The configuration is parsed during agent construction. When requests are made, the `createConnection()` methods on the agents would check whether the request should be proxied. If yes, they either connect to the proxy server (in the case of HTTP reqeusts) or establish a tunnel (in the case of HTTPS requests) through either a TCP socket (if the proxy uses HTTP) or a TLS socket (if the proxy uses HTTPS). When proxying HTTPS requests through a tunnel, the connection listener is invoked after the tunnel is established. Tunnel establishment uses the timeout of the request options, if there is one. Otherwise it uses the timeout of the agent. If an error is encountered during tunnel establishment, an ERR_PROXY_TUNNEL would be emitted on the returned socket. If the proxy server sends a errored status code, the error would contain an `statusCode` property. If the error is caused by timeout, the error would contain a `proxyTunnelTimeout` property. This implementation honors the built-in socket pool and socket limits. Pooled sockets are still keyed by request endpoints, they are just connected to the proxy server instead, and the persistence of the connection can be maintained as long as the proxy server respects connection/proxy-connection or persist by default (HTTP/1.1) PR-URL: #58980 Refs: #57872 Refs: #8381 Refs: #15620 Reviewed-By: Matteo Collina <[email protected]>

aduh95 · 2025-07-29T13:28:26Z

@blakeembrey path-to-regexp seems to be failing on that proposal: https://ci.nodejs.org/view/Node.js-citgm/job/citgm-smoker/3622/

nodejs-github-bot · 2025-07-29T13:32:02Z

CI: https://ci.nodejs.org/job/node-test-pull-request/68297/

ryanaslett · 2025-07-29T17:00:37Z

By looking at https://ci-release.nodejs.org/job/iojs+release/, it seems macOS arm64 release runners are not ready.

This is true, I am working on getting these up and running today.

nodejs-github-bot · 2025-07-29T17:17:50Z

CI: https://ci.nodejs.org/job/node-test-pull-request/68301/
📦: https://ci-release.nodejs.org/job/iojs+release/11146/

panva · 2025-07-29T19:09:12Z

**Upgrade to OpenSSL 3.5**

This release is distributed with OpenSSL 3.5.1, following the announcement that
OpenSSL 3.5 will be supported until April 2030, while Node.js 24 will be
supported until April 2028. Read more about OpenSSL support in their blog post:
[openssl-library.org/post/2025-02-20-openssl-3.5-lts](https://openssl-library.org/post/2025-02-20-openssl-3.5-lts/).

Contributed in https://github.com/nodejs/node/pull/59234.

I believe this should be rightfully attributed to @richardlau (#58100)

nodejs-github-bot · 2025-07-29T22:16:25Z

CI: https://ci.nodejs.org/job/node-test-pull-request/68307/

Notable changes: cli: * (SEMVER-MINOR) support `${pid}` placeholder in `--cpu-prof-name` (Haram Jeong) #59072 crypto: * (SEMVER-MINOR) add `tls.setDefaultCACertificates()` (Joyee Cheung) #58822 deps: * upgrade to openssl-3.5.1 (Node.js GitHub Bot) #59234 dns: * (SEMVER-MINOR) support max timeout (theanarkh) #58440 doc: * update the instruction on how to verify releases (Antoine du Hamel) #59113 esm: * (SEMVER-MINOR) unflag `--experimental-wasm-modules` (Guy Bedford) #57038 http,https: * (SEMVER-MINOR) add built-in proxy support in http/https.request and `Agent` (Joyee Cheung) #58980 net: * (SEMVER-MINOR) update net.blocklist to allow file save and file management (alphaleadership) #58087 test: * (SEMVER-MINOR) move http proxy tests to test/client-proxy (Joyee Cheung) #58980 worker: * (SEMVER-MINOR) add web locks api (ishabi) #58666 PR-URL: #59257

bricss · 2025-07-31T08:28:41Z

Maybe #59270 can be pulled in? 🙄

Notable changes: cli: * (SEMVER-MINOR) support `${pid}` placeholder in `--cpu-prof-name` (Haram Jeong) #59072 crypto: * (SEMVER-MINOR) add `tls.setDefaultCACertificates()` (Joyee Cheung) #58822 deps: * upgrade to openssl-3.5.1 (Node.js GitHub Bot) #59234 dns: * (SEMVER-MINOR) support max timeout (theanarkh) #58440 doc: * update the instruction on how to verify releases (Antoine du Hamel) #59113 esm: * (SEMVER-MINOR) unflag `--experimental-wasm-modules` (Guy Bedford) #57038 http,https: * (SEMVER-MINOR) add built-in proxy support in http/https.request and `Agent` (Joyee Cheung) #58980 net: * (SEMVER-MINOR) update net.blocklist to allow file save and file management (alphaleadership) #58087 test: * (SEMVER-MINOR) move http proxy tests to test/client-proxy (Joyee Cheung) #58980 worker: * (SEMVER-MINOR) add web locks api (ishabi) #58666 PR-URL: #59257

PR-URL: #59257

Refs: nodejs/node#59256 Refs: nodejs/node#59257

* Blog: v22.18.0 and v24.5.0 release post Refs: nodejs/node#59256 Refs: nodejs/node#59257 * Update apps/site/pages/en/blog/release/v22.18.0.md Signed-off-by: Antoine du Hamel <[email protected]> --------- Signed-off-by: Antoine du Hamel <[email protected]>

Notable changes: cli: * (SEMVER-MINOR) support `${pid}` placeholder in `--cpu-prof-name` (Haram Jeong) nodejs#59072 crypto: * (SEMVER-MINOR) add `tls.setDefaultCACertificates()` (Joyee Cheung) nodejs#58822 deps: * upgrade to openssl-3.5.1 (Node.js GitHub Bot) nodejs#59234 dns: * (SEMVER-MINOR) support max timeout (theanarkh) nodejs#58440 doc: * update the instruction on how to verify releases (Antoine du Hamel) nodejs#59113 esm: * (SEMVER-MINOR) unflag `--experimental-wasm-modules` (Guy Bedford) nodejs#57038 http,https: * (SEMVER-MINOR) add built-in proxy support in http/https.request and `Agent` (Joyee Cheung) nodejs#58980 net: * (SEMVER-MINOR) update net.blocklist to allow file save and file management (alphaleadership) nodejs#58087 test: * (SEMVER-MINOR) move http proxy tests to test/client-proxy (Joyee Cheung) nodejs#58980 worker: * (SEMVER-MINOR) add web locks api (ishabi) nodejs#58666 PR-URL: nodejs#59257

RafaelGSS and others added 30 commits July 17, 2025 16:57

lib: flag to conditionally modify proto on deprecate

d555db2

Refs: #58218 Signed-off-by: RafaelGSS <[email protected]> PR-URL: #58928 Reviewed-By: Juan José Arboleda <[email protected]> Reviewed-By: Ulises Gascón <[email protected]>

net: update net.blocklist to allow file save and file management

f753645

PR-URL: #58087 Fixes: #56252 Reviewed-By: Ethan Arrowood <[email protected]> Reviewed-By: James M Snell <[email protected]>

test: add missing port=0 arg in test-debugger-extract-function-name

1cffcc0

PR-URL: #58977 Reviewed-By: James M Snell <[email protected]> Reviewed-By: Luigi Pinca <[email protected]>

inspector: initial support for Network.loadNetworkResource

85d6a28

Fixes: #57873 PR-URL: #58077 Reviewed-By: James M Snell <[email protected]> Reviewed-By: Chengzhong Wu <[email protected]>

dns: support max timeout

c52aaac

PR-URL: #58440 Reviewed-By: Luigi Pinca <[email protected]> Reviewed-By: Matteo Collina <[email protected]>

doc: add missing <code> blocks

3924c43

PR-URL: #58995 Reviewed-By: Luigi Pinca <[email protected]> Reviewed-By: Juan José Arboleda <[email protected]>

doc: add stability index to the --watch-kill-signal flag

45ffdb3

PR-URL: #58997 Reviewed-By: Rafael Gonzaga <[email protected]> Reviewed-By: Moshe Atlow <[email protected]> Reviewed-By: Luigi Pinca <[email protected]>

doc: add missing environment variables to manpage

9d02960

PR-URL: #58963 Fixes: #58894 Reviewed-By: Dario Piotrowicz <[email protected]> Reviewed-By: Luigi Pinca <[email protected]>

repl: fix repl crashing on variable declarations without init

467dbd3

PR-URL: #59032 Fixes: #59029 Reviewed-By: Yagiz Nizipli <[email protected]> Reviewed-By: Matthew Aitken <[email protected]> Reviewed-By: James M Snell <[email protected]>

tools: ignore CVE mention when linting release proposals

623e264

PR-URL: #59037 Reviewed-By: Luigi Pinca <[email protected]> Reviewed-By: Marco Ippolito <[email protected]>

doc: remove unused import in zlib.md

d2e7f8e

PR-URL: #59041 Reviewed-By: Luigi Pinca <[email protected]> Reviewed-By: Antoine du Hamel <[email protected]>

doc: refine util.parseArgs default definition

6cb5e0d

The default value is legal by means other than defaulting. PR-URL: #58958 Reviewed-By: Antoine du Hamel <[email protected]>

doc: fix typed list formatting

1940a2c

PR-URL: #59019 Refs: nodejs/doc-kit#348 Reviewed-By: Chemi Atlow <[email protected]> Reviewed-By: Zeyu "Alex" Yang <[email protected]> Reviewed-By: Claudio Wunder <[email protected]>

doc: clarify ERR_FS_FILE_TOO_LARGE to reflect fs.readFile() I/O limit

2d1dcb8

PR-URL: #59050 Reviewed-By: James M Snell <[email protected]> Reviewed-By: Luigi Pinca <[email protected]> Reviewed-By: LiviaMedeiros <[email protected]>

tools,test: enforce best practices to detect never settling promises

0e547e0

PR-URL: #58992 Reviewed-By: Luigi Pinca <[email protected]>

doc: add RafaelGSS as steward July 25

9b2e965

PR-URL: #59078 Reviewed-By: Richard Lau <[email protected]> Reviewed-By: Marco Ippolito <[email protected]> Reviewed-By: Chengzhong Wu <[email protected]> Reviewed-By: Ulises Gascón <[email protected]>

doc: add missing section for setReturnArrays in sqlite.md

34c4900

PR-URL: #59074 Refs: #57542 Reviewed-By: Chemi Atlow <[email protected]> Reviewed-By: Luigi Pinca <[email protected]>

build: remove suppressions.supp

e3e729c

We have removed the UBSan workflow and there's no ongoing initiative to bring it back. PR-URL: #59079 Reviewed-By: Richard Lau <[email protected]> Reviewed-By: Marco Ippolito <[email protected]> Reviewed-By: Luigi Pinca <[email protected]>

test: mark test-inspector-network-fetch as flaky on Windows

a9511a6

PR-URL: #59091 Refs: #59090 Reviewed-By: Chengzhong Wu <[email protected]> Reviewed-By: Ryuhei Shima <[email protected]> Reviewed-By: Filip Skokan <[email protected]>

github-actions bot removed the request-ci Add this label to start a Jenkins CI on a PR. label Jul 29, 2025

geeksilva97 approved these changes Jul 29, 2025

View reviewed changes

panva approved these changes Jul 29, 2025

View reviewed changes

aduh95 force-pushed the v24.5.0-proposal branch from 47dfe77 to 22bd082 Compare July 31, 2025 08:22

aduh95 force-pushed the v24.5.0-proposal branch from 22bd082 to 8f6b7d7 Compare July 31, 2025 08:25

aduh95 force-pushed the v24.5.0-proposal branch from 8f6b7d7 to 931ec10 Compare July 31, 2025 08:27

prabhu mentioned this pull request Jul 31, 2025

[security] CVE-2025-27210 - Bypass Path Traversal Protection in path.normalize() CycloneDX/cdxgen#2065

Open

aduh95 merged commit 931ec10 into v24.x Jul 31, 2025
20 checks passed

aduh95 deleted the v24.5.0-proposal branch July 31, 2025 21:44

aduh95 added a commit that referenced this pull request Jul 31, 2025

Working on v24.5.1

c37bef1

PR-URL: #59257

aduh95 added a commit to aduh95/nodejs.org that referenced this pull request Jul 31, 2025

Blog: v22.18.0 and v24.5.0 release post

2cca0ec

Refs: nodejs/node#59256 Refs: nodejs/node#59257

aduh95 mentioned this pull request Jul 31, 2025

Blog: v22.18.0 and v24.5.0 release posts nodejs/nodejs.org#8055

Merged

5 tasks

aduh95 mentioned this pull request Jul 31, 2025

Retweet v24.5.0 release announcement nodejs/bluesky#149

Merged

muhfauzi658-crypto mentioned this pull request Aug 3, 2025

build,deps,tools: prepare to update to OpenSSL 3.5 #58100

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Uh oh!

2025-07-29, Version 24.5.0 (Current) #59257

2025-07-29, Version 24.5.0 (Current) #59257

github-actions bot commented Jul 28, 2025 •

edited by aduh95

Loading

Uh oh!

aduh95 commented Jul 29, 2025

Uh oh!

nodejs-github-bot commented Jul 29, 2025

Uh oh!

ryanaslett commented Jul 29, 2025

Uh oh!

nodejs-github-bot commented Jul 29, 2025 •

edited by aduh95

Loading

Uh oh!

panva commented Jul 29, 2025

Uh oh!

nodejs-github-bot commented Jul 29, 2025

Uh oh!

bricss commented Jul 31, 2025

Uh oh!

Uh oh!

Uh oh!

Uh oh!

2025-07-29, Version 24.5.0 (Current) #59257

2025-07-29, Version 24.5.0 (Current) #59257

Conversation

github-actions bot commented Jul 28, 2025 • edited by aduh95 Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Upgrade to OpenSSL 3.5

Unflag --experimental-wasm-modules

Built-in proxy support in request() and Agent

Add setDefaultCACertificates() to node:tls

Other notable changes

Uh oh!

aduh95 commented Jul 29, 2025

Uh oh!

nodejs-github-bot commented Jul 29, 2025

Uh oh!

ryanaslett commented Jul 29, 2025

Uh oh!

nodejs-github-bot commented Jul 29, 2025 • edited by aduh95 Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

panva commented Jul 29, 2025

Uh oh!

nodejs-github-bot commented Jul 29, 2025

Uh oh!

bricss commented Jul 31, 2025

Uh oh!

Uh oh!

Uh oh!

github-actions bot commented Jul 28, 2025 •

edited by aduh95

Loading

Unflag `--experimental-wasm-modules`

Built-in proxy support in `request()` and `Agent`

Add `setDefaultCACertificates()` to `node:tls`

nodejs-github-bot commented Jul 29, 2025 •

edited by aduh95

Loading