2025-07-29, Version 24.5.0 (Current) by github-actions[bot] · Pull Request #59257 · nodejs/node · GitHub

Upgrade to OpenSSL 3.5

This release is distributed with OpenSSL 3.5.1, following the announcement that
OpenSSL 3.5 will be supported until April 2030, while Node.js 24 will be
supported until April 2028. Read more about OpenSSL support in their blog post:
https://openssl-library.org/post/2025-02-20-openssl-3.5-lts/.

Contributed in #59234.

Unflag --experimental-wasm-modules

Node.js supports both source phase imports and instance phase imports to WebAssembly
modules and for WASM imports to JavaScript, in line with the current Phase 3
WebAssembly ESM Integration proposal.
The implementation and the specification are still subject to change.

Contributed by Guy Bedford in #57038.

Built-in proxy support in request() and Agent

node:http and node:https now support proxies. When NODE_USE_ENV_PROXY
is set to 1, the default global agent would parse the http_proxy/HTTP_PROXY,
https_proxy/HTTPS_PROXY, no_proxy/NO_PROXY settings from the
environment variables, and proxy the requests sent through the built-in http/https
client accordingly.

To use global proxy support from the command line:

NODE_USE_ENV_PROXY=1 HTTP_PROXY=http://proxy.example.com:8080 HTTPS_PROXY=http://proxy.example.com:8080 NO_PROXY=localhost,127.0.0.1 node client.js

In addition, http.Agent and https.Agent now support the custom proxyEnv options.

const agent = new https.Agent({ proxyEnv: { HTTPS_PROXY: 'http://proxy.example.com:8080' } });

For reference, fetch() already supports NODE_USE_ENV_PROXY as of Node.js 24.0.0.

Contributed by Joyee Cheung in #58980.

Add setDefaultCACertificates() to node:tls

This API allows dynamically configuring CA certificates that will be used by the
Node.js TLS clients by default.

Once called, the provided certificates will become the default CA certificate list
returned by tls.getCACertificates('default') and used by TLS connections that
don't specify their own CA certificates.

To add system CA certificates to the default bundle (which includes the Mozilla
CA certificates):

tls.setDefaultCACertificates(tls.getCACertificates('default').concat(tls.getCACertificates('system')));

Contributed by Joyee Cheung in #58822.

Other notable changes

[d5640ca58a] - (SEMVER-MINOR) cli: support ${pid} placeholder in --cpu-prof-name (Haram Jeong) #59072
[eeeb40e95b] - (SEMVER-MINOR) crypto: add tls.setDefaultCACertificates() (Joyee Cheung) #58822
[c52aaacfc5] - (SEMVER-MINOR) dns: support max timeout (theanarkh) #58440
[927742b342] - doc: update the instruction on how to verify releases (Antoine du Hamel) #59113
[7f654cee9e] - (SEMVER-MINOR) http,https: add built-in proxy support in http/https.request and Agent (Joyee Cheung) #58980
[f753645cd8] - (SEMVER-MINOR) net: update net.blocklist to allow file save and file management (alphaleadership) #58087
[16dc53c143] - (SEMVER-MINOR) test: move http proxy tests to test/client-proxy (Joyee Cheung) #58980
[9791ff3480] - (SEMVER-MINOR) worker: add web locks api (ishabi) #58666

Commits

[5457c7a8a1] - benchmark: adjust configuration for string-decoder bench (Rafael Gonzaga) #59187
[28538f2255] - benchmark: add --track to benchmark (Rafael Gonzaga) #59174
[a28d804497] - benchmark: small lint fix on _cli.js (Rafael Gonzaga) #59172
[09717eb68e] - benchmark: drop misc/punycode benchmark (Rafael Gonzaga) #59171
[ad6757ef02] - benchmark: fix sqlite-is-transaction (Rafael Gonzaga) #59170
[7fc3143f61] - benchmark: reduce N for diagnostics_channel subscribe benchmark (Arthur Angelo) #59116
[f2812723a0] - buffer: cache Environment::GetCurrent to avoid repeated calls (Mert Can Altin) #59043
[e3e729ca60] - build: remove suppressions.supp (Rafael Gonzaga) #59079
[dc66422768] - build,deps,tools: prepare to update to OpenSSL 3.5 (Richard Lau) #58100
[f5da4947d9] - cli: add --use-env-proxy (Joyee Cheung) #59151
[d5640ca58a] - (SEMVER-MINOR) cli: support ${pid} placeholder in --cpu-prof-name (Haram Jeong) #59072
[eeeb40e95b] - (SEMVER-MINOR) crypto: add tls.setDefaultCACertificates() (Joyee Cheung) #58822
[135fca5b72] - crypto: avoid copying buffers to UTF-8 strings in crypto.hash() (Renegade334) #59067
[998cef10e3] - deps: update archs files for openssl-3.5.1 (Node.js GitHub Bot) #59234
[1f06ca956a] - deps: upgrade openssl sources to openssl-3.5.1 (Node.js GitHub Bot) #59234
[55a90eed8d] - deps: upgrade npm to 11.5.1 (npm team) #59199
[2b5d451ae0] - deps: update amaro to 1.1.1 (Node.js GitHub Bot) #59141
[af789d9b5c] - deps: update undici to 7.12.0 (Node.js GitHub Bot) #59135
[a34e44545e] - deps: update sqlite to 3.50.3 (Node.js GitHub Bot) #59132
[bfe4781c7d] - deps: update googletest to 7e17b15 (Node.js GitHub Bot) #59131
[72adf52e51] - deps: update ada to 3.2.6 (Node.js GitHub Bot) #58966
[2a5f35b589] - deps: V8: cherry-pick 3d750c2aa9ef (Michaël Zasso) #58750
[3f813eaba7] - deps: update archs files for openssl-3.0.17 (Node.js GitHub Bot) #59134
[fb52d0d8df] - deps: upgrade openssl sources to openssl-3.0.17 (Node.js GitHub Bot) #59134
[f122602f9d] - deps: update corepack to 0.34.0 (Node.js GitHub Bot) #59133
[c52aaacfc5] - (SEMVER-MINOR) dns: support max timeout (theanarkh) #58440
[927742b342] - doc: update the instruction on how to verify releases (Antoine du Hamel) #59113
[9a8d2020ad] - doc: copyedit SECURITY.md (Rich Trott) #59190
[3da5bc0668] - doc: fix broken sentence in URL.parse (Superchupu) #59164
[06cd7461e0] - doc: improve onboarding instructions (Joyee Cheung) #59159
[dfb72d158b] - doc: add constraints for mem leak to threat model (Rafael Gonzaga) #58917
[51b8dfd5c6] - doc: add Aditi-1400 to collaborators (Aditi) #59157
[4ffa756ce3] - doc: avoid suggesting testing fast api with intense loop (Chengzhong Wu) #59111
[6f81b274f7] - doc: fix typo in writing-test.md (SeokHun) #59123
[88e434e687] - doc: add new environment variables doc page (Dario Piotrowicz) #59052
[b1a318d706] - doc: update release key for aduh95 (Antoine du Hamel) #58877
[34c49000c9] - doc: add missing section for setReturnArrays in sqlite.md (Edy Silva) #59074
[9b2e965aff] - doc: add RafaelGSS as steward July 25 (Rafael Gonzaga) #59078
[2d1dcb87e6] - doc: clarify ERR_FS_FILE_TOO_LARGE to reflect fs.readFile() I/O limit (Haram Jeong) #59050
[999b5e51e7] - doc: run license-builder (github-actions[bot]) #59056
[1940a2cb46] - doc: fix typed list formatting (Aviv Keller) #59019
[6cb5e0d22f] - doc: refine util.parseArgs default definition (Slayer95) #58958
[d2e7f8e13a] - doc: remove unused import in zlib.md (coderaiser) #59041
[9d02960149] - doc: add missing environment variables to manpage (amir lavasani) #58963
[45ffdb34fb] - doc: add stability index to the --watch-kill-signal flag (Dario Piotrowicz) #58997
[3924c43600] - doc: add missing <code> blocks (Antoine du Hamel) #58995
[cb95e183f3] - doc: add scroll margin to links (Roman Reiss) #58982
[c9ded6ba15] - doc: add sponsorship link to RafaelGSS (Rafael Gonzaga) #58983
[b919fe0447] - (SEMVER-MINOR) esm: unflag --experimental-wasm-modules (Guy Bedford) #57038
[71bb6cd077] - esm: js-string Wasm builtins in ESM Integration (Guy Bedford) #59020
[8d869e6d62] - fs: fix return value of fs APIs (theanarkh) #58996
[7f654cee9e] - (SEMVER-MINOR) http,https: add built-in proxy support in http/https.request and Agent (Joyee Cheung) #58980
[85d6a28f4f] - inspector: initial support for Network.loadNetworkResource (Shima Ryuhei) #58077
[cfaa299f2e] - lib: fix incorrect ArrayBufferPrototypeGetDetached primordial type (Dario Piotrowicz) #58978
[d555db22ad] - lib: flag to conditionally modify proto on deprecate (Rafael Gonzaga) #58928
[96c9dd79e6] - meta: move one or more collaborators to emeritus (Node.js GitHub Bot) #59140
[324d9fc9d4] - meta: enable jsdoc/check-tag-names rule (Yagiz Nizipli) #58521
[04c751463b] - meta: add marco-ippolito to security release stewards (Marco Ippolito) #58944
[fe0195fdcc] - module: fix conditions override in synchronous resolve hooks (Joyee Cheung) #59011
[515b581d47] - module: throw error when re-runing errored module jobs (Joyee Cheung) #58957
[f753645cd8] - (SEMVER-MINOR) net: update net.blocklist to allow file save and file management (alphaleadership) #58087
[15e6c28d82] - node-api,doc: update links to ecma262 with section names (Chengzhong Wu) #59087
[f67b686551] - perf_hooks: do not expose SafeMap via Histogram wrapper (René) #59094
[3d2f919f7c] - process: make execve's args argument optional (Allon Murienik) #58412
[1a44265810] - repl: handle errors from getters during completion (Shima Ryuhei) #59044
[467dbd31e6] - repl: fix repl crashing on variable declarations without init (Dario Piotrowicz) #59032
[3a3eb6852d] - repl: improve REPL disabling completion on proxies and getters (Dario Piotrowicz) #58891
[55838e79b8] - src: call unmask after install signal handler (theanarkh) #59059
[77649ad93b] - src: use FastStringKey for TrackV8FastApiCall (Anna Henningsen) #59148
[86babf9c4b] - src: use C++20 consteval for FastStringKey (Anna Henningsen) #59148
[88b99eeae1] - src: remove declarations of removed BaseObject static fns (Anna Henningsen) #59093
[d89390fc8f] - src: add cache to nearest parent package json (Ilyas Shabi) #59086
[21780075e4] - src: check import attributes value types as strings (Chengzhong Wu) #58986
[ef89c2fac9] - src,test: fix config file parsing for flags defaulted to true (Edy Silva) #59110
[1e990866e0] - test: mark web lock held test as flaky (Ilyas Shabi) #59144
[ba8e95a785] - test: use mustSucceed in test-fs-read (Sungwon) #59204
[39978f507f] - test: prepare test-crypto-rsa-dsa for newer OpenSSL (Richard Lau) #58100
[1c3aadb9d6] - test: fix flaky test-worker-message-port-transfer-filehandle test (Alex Yang) #59158
[a0d22e9c51] - test: remove timeout in test-https-proxy-request-handshake-failure (Joyee Cheung) #59165
[7e0a0fccc1] - test: expand linting rules around assert w literal messages (Anna Henningsen) #59147
[c6070046c3] - test: update WPT for WebCryptoAPI to ab08796857 (Node.js GitHub Bot) #59129
[15d8cc908e] - test: update WPT for WebCryptoAPI to 19d82c57ab (Node.js GitHub Bot) #59129
[83023e5144] - test: skip tests that cause timeouts on IBM i (Abdirahim Musse) #59014
[82d4175ec3] - test: update startCLI to set --port=0 by default (Dario Piotrowicz) #59042
[16dc53c143] - (SEMVER-MINOR) test: move http proxy tests to test/client-proxy (Joyee Cheung) #58980
[a9511a6066] - test: mark test-inspector-network-fetch as flaky on Windows (Joyee Cheung) #59091
[1cffcc02a3] - test: add missing port=0 arg in test-debugger-extract-function-name (Dario Piotrowicz) #58977
[83cdf1701b] - test_runner: clean up promisified interval generation (René) #58824
[195d6038dc] - tools: clarify README linter error message (Joyee Cheung) #59160
[51f578a3bf] - tools: add support for URLs to PR commits in merge.sh (Antoine du Hamel) #59162
[20be9012eb] - tools: bump @eslint/plugin-kit from 0.3.1 to 0.3.3 in /tools/eslint (dependabot[bot]) #59119
[623e264e93] - tools: ignore CVE mention when linting release proposals (Antoine du Hamel) #59037
[0e547e09ab] - tools,test: enforce best practices to detect never settling promises (Antoine du Hamel) #58992
[075d1968db] - util: respect nested formats in styleText (Alex Yang) #59098
[9791ff3480] - (SEMVER-MINOR) worker: add web locks api (ishabi) #58666

Refs: #58218 Signed-off-by: RafaelGSS <rafael.nunu@hotmail.com> PR-URL: #58928 Reviewed-By: Juan José Arboleda <soyjuanarbol@gmail.com> Reviewed-By: Ulises Gascón <ulisesgascongonzalez@gmail.com>

PR-URL: #58087 Fixes: #56252 Reviewed-By: Ethan Arrowood <ethan@arrowood.dev> Reviewed-By: James M Snell <jasnell@gmail.com>

PR-URL: #58977 Reviewed-By: James M Snell <jasnell@gmail.com> Reviewed-By: Luigi Pinca <luigipinca@gmail.com>

PR-URL: #58944 Fixes: nodejs/TSC#1764 Reviewed-By: Matteo Collina <matteo.collina@gmail.com> Reviewed-By: James M Snell <jasnell@gmail.com> Reviewed-By: Richard Lau <richard.lau@ibm.com> Reviewed-By: Gireesh Punathil <gpunathi@in.ibm.com> Reviewed-By: Chengzhong Wu <legendecas@gmail.com> Reviewed-By: Juan José Arboleda <soyjuanarbol@gmail.com> Reviewed-By: Jordan Harband <ljharb@gmail.com> Reviewed-By: Rafael Gonzaga <rafael.nunu@hotmail.com> Reviewed-By: Darshan Sen <raisinten@gmail.com>

PR-URL: #58978 Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com> Reviewed-By: Michaël Zasso <targos@protonmail.com> Reviewed-By: James M Snell <jasnell@gmail.com> Reviewed-By: Chengzhong Wu <legendecas@gmail.com> Reviewed-By: Juan José Arboleda <soyjuanarbol@gmail.com>

PR-URL: #58983 Reviewed-By: James M Snell <jasnell@gmail.com> Reviewed-By: Juan José Arboleda <soyjuanarbol@gmail.com> Reviewed-By: Moshe Atlow <moshe@atlow.co.il> Reviewed-By: Luigi Pinca <luigipinca@gmail.com> Reviewed-By: Ruben Bridgewater <ruben@bridgewater.de> Reviewed-By: Darshan Sen <raisinten@gmail.com>

Re-evaluating an errored ESM should lead to rejecting the rejection again - this is also the case when importing it twice. In the case of retrying with require after import, just throw the cached error. Drive-by: add some debug logs. PR-URL: #58957 Fixes: #58945 Reviewed-By: Marco Ippolito <marcoippolito54@gmail.com> Reviewed-By: Luigi Pinca <luigipinca@gmail.com> Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>

#57909 introduced the disabling of REPL tab completion on object containing proxies and getters (since such completion triggers code evaluation which can be unexpected/disruptive for the user) the solution in 57909 did not address all possible such cases, the changes here improve on such solution by using acorn and AST analysis to cover most if not all possible cases PR-URL: #58891 Reviewed-By: James M Snell <jasnell@gmail.com>

PR-URL: #58986 Reviewed-By: Guy Bedford <guybedford@gmail.com> Reviewed-By: James M Snell <jasnell@gmail.com> Reviewed-By: Anna Henningsen <anna@addaleax.net> Reviewed-By: Marco Ippolito <marcoippolito54@gmail.com> Reviewed-By: Ethan Arrowood <ethan@arrowood.dev>

Fixes: #57873 PR-URL: #58077 Reviewed-By: James M Snell <jasnell@gmail.com> Reviewed-By: Chengzhong Wu <legendecas@gmail.com>

PR-URL: #58982 Reviewed-By: Claudio Wunder <cwunder@gnome.org> Reviewed-By: Moshe Atlow <moshe@atlow.co.il> Reviewed-By: Luigi Pinca <luigipinca@gmail.com> Reviewed-By: James M Snell <jasnell@gmail.com> Reviewed-By: Ulises Gascón <ulisesgascongonzalez@gmail.com> Reviewed-By: Tierney Cyren <hello@bnb.im>

PR-URL: #58440 Reviewed-By: Luigi Pinca <luigipinca@gmail.com> Reviewed-By: Matteo Collina <matteo.collina@gmail.com>

PR-URL: #58995 Reviewed-By: Luigi Pinca <luigipinca@gmail.com> Reviewed-By: Juan José Arboleda <soyjuanarbol@gmail.com>

PR-URL: #58997 Reviewed-By: Rafael Gonzaga <rafael.nunu@hotmail.com> Reviewed-By: Moshe Atlow <moshe@atlow.co.il> Reviewed-By: Luigi Pinca <luigipinca@gmail.com>

* yield from loop instead of setting up custom iterator * cancel abort listener on exit * do not call <Array>.at(0) PR-URL: #58824 Reviewed-By: Chemi Atlow <chemi@atlow.co.il> Reviewed-By: James M Snell <jasnell@gmail.com> Reviewed-By: Moshe Atlow <moshe@atlow.co.il>

PR-URL: #58963 Fixes: #58894 Reviewed-By: Dario Piotrowicz <dario.piotrowicz@gmail.com> Reviewed-By: Luigi Pinca <luigipinca@gmail.com>

PR-URL: #59032 Fixes: #59029 Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com> Reviewed-By: Matthew Aitken <maitken033380023@gmail.com> Reviewed-By: James M Snell <jasnell@gmail.com>

PR-URL: #59037 Reviewed-By: Luigi Pinca <luigipinca@gmail.com> Reviewed-By: Marco Ippolito <marcoippolito54@gmail.com>

PR-URL: #59041 Reviewed-By: Luigi Pinca <luigipinca@gmail.com> Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>

The default value is legal by means other than defaulting. PR-URL: #58958 Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>

PR-URL: #59019 Refs: nodejs/doc-kit#348 Reviewed-By: Chemi Atlow <chemi@atlow.co.il> Reviewed-By: Zeyu "Alex" Yang <himself65@outlook.com> Reviewed-By: Claudio Wunder <cwunder@gnome.org>

PR-URL: #59056 Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com> Reviewed-By: James M Snell <jasnell@gmail.com> Reviewed-By: Filip Skokan <panva.ip@gmail.com> Reviewed-By: Darshan Sen <raisinten@gmail.com> Reviewed-By: Moshe Atlow <moshe@atlow.co.il> Reviewed-By: Rafael Gonzaga <rafael.nunu@hotmail.com> Reviewed-By: Luigi Pinca <luigipinca@gmail.com> Reviewed-By: Tobias Nießen <tniessen@tnie.de> Reviewed-By: Ulises Gascón <ulisesgascongonzalez@gmail.com>

PR-URL: #59050 Reviewed-By: James M Snell <jasnell@gmail.com> Reviewed-By: Luigi Pinca <luigipinca@gmail.com> Reviewed-By: LiviaMedeiros <livia@cirno.name>

PR-URL: #58992 Reviewed-By: Luigi Pinca <luigipinca@gmail.com>

PR-URL: #59078 Reviewed-By: Richard Lau <richard.lau@ibm.com> Reviewed-By: Marco Ippolito <marcoippolito54@gmail.com> Reviewed-By: Chengzhong Wu <legendecas@gmail.com> Reviewed-By: Ulises Gascón <ulisesgascongonzalez@gmail.com>

PR-URL: #59074 Refs: #57542 Reviewed-By: Chemi Atlow <chemi@atlow.co.il> Reviewed-By: Luigi Pinca <luigipinca@gmail.com>

We have removed the UBSan workflow and there's no ongoing initiative to bring it back. PR-URL: #59079 Reviewed-By: Richard Lau <richard.lau@ibm.com> Reviewed-By: Marco Ippolito <marcoippolito54@gmail.com> Reviewed-By: Luigi Pinca <luigipinca@gmail.com>

PR-URL: #59091 Refs: #59090 Reviewed-By: Chengzhong Wu <legendecas@gmail.com> Reviewed-By: Ryuhei Shima <shimaryuhei@gmail.com> Reviewed-By: Filip Skokan <panva.ip@gmail.com>

Rewrite to ESM to use TLA. Also add a test to make sure case precedence is honored. Refs: https://about.gitlab.com/blog/we-need-to-talk-no-proxy PR-URL: #58980 Refs: #57872 Refs: #8381 Refs: #15620 Reviewed-By: Matteo Collina <matteo.collina@gmail.com>

This patch implements proxy support for HTTP and HTTPS clients and agents in the `http` and `https` built-ins`. When NODE_USE_ENV_PROXY is set to 1, the default global agent would parse the HTTP_PROXY/http_proxy, HTTPS_PROXY/https_proxy, NO_PROXY/no_proxy settings from the environment variables, and proxy the requests sent through the built-in http/https client accordingly. To support this, `http.Agent` and `https.Agent` now accept a few new options: - `proxyEnv`: when it's an object, the agent would read and parse the HTTP_PROXY/http_proxy, HTTPS_PROXY/https_proxy, NO_PROXY/no_proxy properties from it, and apply them based on the protocol it uses to send requests. This option allows custom agents to reuse built-in proxy support by composing options. Global agents set this to `process.env` when NODE_USE_ENV_PROXY is 1. - `defaultPort` and `protocol`: these allow setting of the default port and protocol of the agents. We also need these when configuring proxy settings and deciding whether a request should be proxied. Implementation-wise, this adds a `ProxyConfig` internal class to handle parsing and application of proxy configurations. The configuration is parsed during agent construction. When requests are made, the `createConnection()` methods on the agents would check whether the request should be proxied. If yes, they either connect to the proxy server (in the case of HTTP reqeusts) or establish a tunnel (in the case of HTTPS requests) through either a TCP socket (if the proxy uses HTTP) or a TLS socket (if the proxy uses HTTPS). When proxying HTTPS requests through a tunnel, the connection listener is invoked after the tunnel is established. Tunnel establishment uses the timeout of the request options, if there is one. Otherwise it uses the timeout of the agent. If an error is encountered during tunnel establishment, an ERR_PROXY_TUNNEL would be emitted on the returned socket. If the proxy server sends a errored status code, the error would contain an `statusCode` property. If the error is caused by timeout, the error would contain a `proxyTunnelTimeout` property. This implementation honors the built-in socket pool and socket limits. Pooled sockets are still keyed by request endpoints, they are just connected to the proxy server instead, and the persistence of the connection can be maintained as long as the proxy server respects connection/proxy-connection or persist by default (HTTP/1.1) PR-URL: #58980 Refs: #57872 Refs: #8381 Refs: #15620 Reviewed-By: Matteo Collina <matteo.collina@gmail.com>

CI: https://ci.nodejs.org/job/node-test-pull-request/68297/

By looking at https://ci-release.nodejs.org/job/iojs+release/, it seems macOS arm64 release runners are not ready.

This is true, I am working on getting these up and running today.

CI: https://ci.nodejs.org/job/node-test-pull-request/68301/
📦: https://ci-release.nodejs.org/job/iojs+release/11146/

**Upgrade to OpenSSL 3.5**

This release is distributed with OpenSSL 3.5.1, following the announcement that
OpenSSL 3.5 will be supported until April 2030, while Node.js 24 will be
supported until April 2028. Read more about OpenSSL support in their blog post:
[openssl-library.org/post/2025-02-20-openssl-3.5-lts](https://openssl-library.org/post/2025-02-20-openssl-3.5-lts/).

Contributed in https://github.com/nodejs/node/pull/59234.

I believe this should be rightfully attributed to @richardlau (#58100)

CI: https://ci.nodejs.org/job/node-test-pull-request/68307/

Notable changes: cli: * (SEMVER-MINOR) support `${pid}` placeholder in `--cpu-prof-name` (Haram Jeong) #59072 crypto: * (SEMVER-MINOR) add `tls.setDefaultCACertificates()` (Joyee Cheung) #58822 deps: * upgrade to openssl-3.5.1 (Node.js GitHub Bot) #59234 dns: * (SEMVER-MINOR) support max timeout (theanarkh) #58440 doc: * update the instruction on how to verify releases (Antoine du Hamel) #59113 esm: * (SEMVER-MINOR) unflag `--experimental-wasm-modules` (Guy Bedford) #57038 http,https: * (SEMVER-MINOR) add built-in proxy support in http/https.request and `Agent` (Joyee Cheung) #58980 net: * (SEMVER-MINOR) update net.blocklist to allow file save and file management (alphaleadership) #58087 test: * (SEMVER-MINOR) move http proxy tests to test/client-proxy (Joyee Cheung) #58980 worker: * (SEMVER-MINOR) add web locks api (ishabi) #58666 PR-URL: #59257

Maybe #59270 can be pulled in? 🙄

Notable changes: cli: * (SEMVER-MINOR) support `${pid}` placeholder in `--cpu-prof-name` (Haram Jeong) #59072 crypto: * (SEMVER-MINOR) add `tls.setDefaultCACertificates()` (Joyee Cheung) #58822 deps: * upgrade to openssl-3.5.1 (Node.js GitHub Bot) #59234 dns: * (SEMVER-MINOR) support max timeout (theanarkh) #58440 doc: * update the instruction on how to verify releases (Antoine du Hamel) #59113 esm: * (SEMVER-MINOR) unflag `--experimental-wasm-modules` (Guy Bedford) #57038 http,https: * (SEMVER-MINOR) add built-in proxy support in http/https.request and `Agent` (Joyee Cheung) #58980 net: * (SEMVER-MINOR) update net.blocklist to allow file save and file management (alphaleadership) #58087 test: * (SEMVER-MINOR) move http proxy tests to test/client-proxy (Joyee Cheung) #58980 worker: * (SEMVER-MINOR) add web locks api (ishabi) #58666 PR-URL: #59257

PR-URL: #59257

Refs: nodejs/node#59256 Refs: nodejs/node#59257

* Blog: v22.18.0 and v24.5.0 release post Refs: nodejs/node#59256 Refs: nodejs/node#59257 * Update apps/site/pages/en/blog/release/v22.18.0.md Signed-off-by: Antoine du Hamel <duhamelantoine1995@gmail.com> --------- Signed-off-by: Antoine du Hamel <duhamelantoine1995@gmail.com>

Notable changes: cli: * (SEMVER-MINOR) support `${pid}` placeholder in `--cpu-prof-name` (Haram Jeong) nodejs#59072 crypto: * (SEMVER-MINOR) add `tls.setDefaultCACertificates()` (Joyee Cheung) nodejs#58822 deps: * upgrade to openssl-3.5.1 (Node.js GitHub Bot) nodejs#59234 dns: * (SEMVER-MINOR) support max timeout (theanarkh) nodejs#58440 doc: * update the instruction on how to verify releases (Antoine du Hamel) nodejs#59113 esm: * (SEMVER-MINOR) unflag `--experimental-wasm-modules` (Guy Bedford) nodejs#57038 http,https: * (SEMVER-MINOR) add built-in proxy support in http/https.request and `Agent` (Joyee Cheung) nodejs#58980 net: * (SEMVER-MINOR) update net.blocklist to allow file save and file management (alphaleadership) nodejs#58087 test: * (SEMVER-MINOR) move http proxy tests to test/client-proxy (Joyee Cheung) nodejs#58980 worker: * (SEMVER-MINOR) add web locks api (ishabi) nodejs#58666 PR-URL: nodejs#59257

RafaelGSS and others added 30 commits July 17, 2025 16:57

lib: flag to conditionally modify proto on deprecate

d555db2

Refs: #58218 Signed-off-by: RafaelGSS <rafael.nunu@hotmail.com> PR-URL: #58928 Reviewed-By: Juan José Arboleda <soyjuanarbol@gmail.com> Reviewed-By: Ulises Gascón <ulisesgascongonzalez@gmail.com>

net: update net.blocklist to allow file save and file management

f753645

PR-URL: #58087 Fixes: #56252 Reviewed-By: Ethan Arrowood <ethan@arrowood.dev> Reviewed-By: James M Snell <jasnell@gmail.com>

test: add missing port=0 arg in test-debugger-extract-function-name

1cffcc0

PR-URL: #58977 Reviewed-By: James M Snell <jasnell@gmail.com> Reviewed-By: Luigi Pinca <luigipinca@gmail.com>

inspector: initial support for Network.loadNetworkResource

85d6a28

Fixes: #57873 PR-URL: #58077 Reviewed-By: James M Snell <jasnell@gmail.com> Reviewed-By: Chengzhong Wu <legendecas@gmail.com>

dns: support max timeout

c52aaac

PR-URL: #58440 Reviewed-By: Luigi Pinca <luigipinca@gmail.com> Reviewed-By: Matteo Collina <matteo.collina@gmail.com>

doc: add missing <code> blocks

3924c43

PR-URL: #58995 Reviewed-By: Luigi Pinca <luigipinca@gmail.com> Reviewed-By: Juan José Arboleda <soyjuanarbol@gmail.com>

doc: add stability index to the --watch-kill-signal flag

45ffdb3

PR-URL: #58997 Reviewed-By: Rafael Gonzaga <rafael.nunu@hotmail.com> Reviewed-By: Moshe Atlow <moshe@atlow.co.il> Reviewed-By: Luigi Pinca <luigipinca@gmail.com>

doc: add missing environment variables to manpage

9d02960

PR-URL: #58963 Fixes: #58894 Reviewed-By: Dario Piotrowicz <dario.piotrowicz@gmail.com> Reviewed-By: Luigi Pinca <luigipinca@gmail.com>

repl: fix repl crashing on variable declarations without init

467dbd3

PR-URL: #59032 Fixes: #59029 Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com> Reviewed-By: Matthew Aitken <maitken033380023@gmail.com> Reviewed-By: James M Snell <jasnell@gmail.com>

tools: ignore CVE mention when linting release proposals

623e264

PR-URL: #59037 Reviewed-By: Luigi Pinca <luigipinca@gmail.com> Reviewed-By: Marco Ippolito <marcoippolito54@gmail.com>

doc: remove unused import in zlib.md

d2e7f8e

PR-URL: #59041 Reviewed-By: Luigi Pinca <luigipinca@gmail.com> Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>

doc: refine util.parseArgs default definition

6cb5e0d

The default value is legal by means other than defaulting. PR-URL: #58958 Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>

doc: fix typed list formatting

1940a2c

PR-URL: #59019 Refs: nodejs/doc-kit#348 Reviewed-By: Chemi Atlow <chemi@atlow.co.il> Reviewed-By: Zeyu "Alex" Yang <himself65@outlook.com> Reviewed-By: Claudio Wunder <cwunder@gnome.org>

doc: clarify ERR_FS_FILE_TOO_LARGE to reflect fs.readFile() I/O limit

2d1dcb8

PR-URL: #59050 Reviewed-By: James M Snell <jasnell@gmail.com> Reviewed-By: Luigi Pinca <luigipinca@gmail.com> Reviewed-By: LiviaMedeiros <livia@cirno.name>

tools,test: enforce best practices to detect never settling promises

0e547e0

PR-URL: #58992 Reviewed-By: Luigi Pinca <luigipinca@gmail.com>

doc: add RafaelGSS as steward July 25

9b2e965

PR-URL: #59078 Reviewed-By: Richard Lau <richard.lau@ibm.com> Reviewed-By: Marco Ippolito <marcoippolito54@gmail.com> Reviewed-By: Chengzhong Wu <legendecas@gmail.com> Reviewed-By: Ulises Gascón <ulisesgascongonzalez@gmail.com>

doc: add missing section for setReturnArrays in sqlite.md

34c4900

PR-URL: #59074 Refs: #57542 Reviewed-By: Chemi Atlow <chemi@atlow.co.il> Reviewed-By: Luigi Pinca <luigipinca@gmail.com>

build: remove suppressions.supp

e3e729c

We have removed the UBSan workflow and there's no ongoing initiative to bring it back. PR-URL: #59079 Reviewed-By: Richard Lau <richard.lau@ibm.com> Reviewed-By: Marco Ippolito <marcoippolito54@gmail.com> Reviewed-By: Luigi Pinca <luigipinca@gmail.com>

test: mark test-inspector-network-fetch as flaky on Windows

a9511a6

PR-URL: #59091 Refs: #59090 Reviewed-By: Chengzhong Wu <legendecas@gmail.com> Reviewed-By: Ryuhei Shima <shimaryuhei@gmail.com> Reviewed-By: Filip Skokan <panva.ip@gmail.com>

github-actions Bot removed the request-ci Add this label to start a Jenkins CI on a PR. label Jul 29, 2025

geeksilva97 approved these changes Jul 29, 2025

View reviewed changes

panva approved these changes Jul 29, 2025

View reviewed changes

aduh95 force-pushed the v24.5.0-proposal branch from 47dfe77 to 22bd082 Compare July 31, 2025 08:22

aduh95 force-pushed the v24.5.0-proposal branch from 22bd082 to 8f6b7d7 Compare July 31, 2025 08:25

aduh95 force-pushed the v24.5.0-proposal branch from 8f6b7d7 to 931ec10 Compare July 31, 2025 08:27

prabhu mentioned this pull request Jul 31, 2025

[security] CVE-2025-27210 - Bypass Path Traversal Protection in path.normalize() cdxgen/cdxgen#2065

Closed

aduh95 merged commit 931ec10 into v24.x Jul 31, 2025
20 checks passed

aduh95 deleted the v24.5.0-proposal branch July 31, 2025 21:44

aduh95 added a commit that referenced this pull request Jul 31, 2025

Working on v24.5.1

c37bef1

PR-URL: #59257

aduh95 added a commit to aduh95/nodejs.org that referenced this pull request Jul 31, 2025

Blog: v22.18.0 and v24.5.0 release post

2cca0ec

Refs: nodejs/node#59256 Refs: nodejs/node#59257

aduh95 mentioned this pull request Jul 31, 2025

Blog: v22.18.0 and v24.5.0 release posts nodejs/nodejs.org#8055

Merged

5 tasks

aduh95 mentioned this pull request Jul 31, 2025

Retweet v24.5.0 release announcement nodejs/bluesky#149

Merged

muhfauzi658-crypto mentioned this pull request Aug 3, 2025

build,deps,tools: prepare to update to OpenSSL 3.5 #58100

Closed

risantos mentioned this pull request Jan 8, 2026

Failure to publish via OIDC when using readonly token for private package install semantic-release/npm#1054

Closed

2025-07-29, Version 24.5.0 (Current) by github-actions[bot] · Pull Request #59257 · nodejs/node · GitHub

Uh oh!

Uh oh!

2025-07-29, Version 24.5.0 (Current) - #59257

2025-07-29, Version 24.5.0 (Current)#59257
aduh95 merged 96 commits into
v24.xfrom
v24.5.0-proposal

github-actions Bot commented Jul 28, 2025 •
edited by aduh95
Loading

Uh oh!

Uh oh!

nodejs-github-bot commented Jul 29, 2025

Uh oh!

ryanaslett commented Jul 29, 2025

Uh oh!

nodejs-github-bot commented Jul 29, 2025 •
edited by aduh95
Loading

Uh oh!

Uh oh!

panva commented Jul 29, 2025

Uh oh!

nodejs-github-bot commented Jul 29, 2025

Uh oh!

bricss commented Jul 31, 2025

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

20 participants

2025-07-29, Version 24.5.0 (Current) by github-actions[bot] · Pull Request #59257 · nodejs/node · GitHub

Uh oh!

Uh oh!

2025-07-29, Version 24.5.0 (Current) - #59257

2025-07-29, Version 24.5.0 (Current)#59257aduh95 merged 96 commits intov24.xnodejs/node:v24.xfrom v24.5.0-proposalnodejs/node:v24.5.0-proposalCopy head branch name to clipboard

Conversation

github-actions Bot commented Jul 28, 2025 • edited by aduh95 Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Upgrade to OpenSSL 3.5

Unflag --experimental-wasm-modules

Built-in proxy support in request() and Agent

Add setDefaultCACertificates() to node:tls

Other notable changes

Uh oh!

nodejs-github-bot commented Jul 29, 2025

Uh oh!

ryanaslett commented Jul 29, 2025

Uh oh!

nodejs-github-bot commented Jul 29, 2025 • edited by aduh95 Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

panva commented Jul 29, 2025

Uh oh!

nodejs-github-bot commented Jul 29, 2025

Uh oh!

bricss commented Jul 31, 2025

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

20 participants

2025-07-29, Version 24.5.0 (Current)#59257
aduh95 merged 96 commits into
v24.xfrom
v24.5.0-proposal

github-actions Bot commented Jul 28, 2025 •
edited by aduh95
Loading

nodejs-github-bot commented Jul 29, 2025 •
edited by aduh95
Loading