When Promise.race() or Promise.any() settles, V8 fires
kPromiseResolveAfterResolved / kPromiseRejectAfterResolved for each
"losing" promise. The PromiseRejectCallback in node_task_queue.cc was
crossing into JS for these events, but since the multipleResolves
event reached EOL in v25 (PR #58707), the JS handler does nothing.

The unnecessary C++-to-JS boundary crossings accumulate references in
a tight loop, causing OOM when using Promise.race() with
immediately-resolving promises.

Return early in PromiseRejectCallback() for these two events, skipping
the JS callback entirely. Also remove the dead case branches and
unused constant imports from the JS side.

Move early returns for kPromiseResolveAfterResolved and
kPromiseRejectAfterResolved before Number::New and CHECK(!callback),
avoiding unnecessary work. Remove dead NODE_DEFINE_CONSTANT exports
and fix comment placement in the JS switch statement. Bump test
--max-old-space-size from 20 to 64 for safety on instrumented builds.

Fixes: #51452
Refs: #60184
Refs: #61960
PR-URL: #62336
Refs: #51452
Reviewed-By: Jordan Harband <ljharb@gmail.com>
Reviewed-By: Benjamin Gruenbaum <benjamingr@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Gürgün Dayıoğlu <hey@gurgun.day>

Signed-off-by: Mert Can Altin <mertgold60@gmail.com>
PR-URL: #63144
Reviewed-By: Filip Skokan <panva.ip@gmail.com>
Reviewed-By: Michaël Zasso <targos@protonmail.com>
Reviewed-By: Chemi Atlow <chemi@atlow.co.il>

Replace the O(n) case-insensitive algorithm-name scan
with an O(1) SafeMap lookup. The map is pre-built at
module init alongside kSupportedAlgorithms.

Hoist the opts object literal used in normalizeAlgorithm
to module level to avoid allocating identical
{ prefix, context } objects on every call.

Pre-compute ObjectKeys() for simpleAlgorithmDictionaries
entries at module init to avoid allocating a new keys
array on every normalizeAlgorithm call.

Signed-off-by: Filip Skokan <panva.ip@gmail.com>
PR-URL: #62756
Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com>

Replace object spread in nested WebIDL conversion
options with stable-shape ordinary objects. This keeps
hot dictionary and sequence conversion paths from
allocating null-prototype spread results.

Apply the same pattern to Web Crypto converter wrappers
that override allowResizable or enable [EnforceRange].

Signed-off-by: Filip Skokan <panva.ip@gmail.com>
PR-URL: #62756
Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com>

Signed-off-by: Antoine du Hamel <duhamelantoine1995@gmail.com>
PR-URL: #63113
Reviewed-By: Filip Skokan <panva.ip@gmail.com>
Reviewed-By: René <contact.9a5d6388@renegade334.me.uk>
Reviewed-By: Michaël Zasso <targos@protonmail.com>
Reviewed-By: Marco Ippolito <marcoippolito54@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Rafael Gonzaga <rafael.nunu@hotmail.com>
Reviewed-By: Trivikram Kamat <trivikr.dev@gmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Paolo Insogna <paolo@cowtech.it>

Signed-off-by: Filip Skokan <panva.ip@gmail.com>
PR-URL: #63104
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com>

Signed-off-by: Marco Ippolito <marcoippolito54@gmail.com>
PR-URL: #63033
Reviewed-By: Pietro Marchini <pietro.marchini94@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>

Signed-off-by: Marco Ippolito <marcoippolito54@gmail.com>
PR-URL: #63033
Reviewed-By: Pietro Marchini <pietro.marchini94@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>

Since they aren't built by default

Signed-off-by: James M Snell <jasnell@gmail.com>
PR-URL: #63149
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
Reviewed-By: Filip Skokan <panva.ip@gmail.com>
Reviewed-By: Moshe Atlow <moshe@atlow.co.il>
Reviewed-By: Tim Perry <pimterry@gmail.com>

Signed-off-by: anshikakalpana <anshikajain196872@gmail.com>
PR-URL: #63121
Refs: #62838
Reviewed-By: René <contact.9a5d6388@renegade334.me.uk>
Reviewed-By: Filip Skokan <panva.ip@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>

Signed-off-by: RafaelGSS <rafael.nunu@hotmail.com>
PR-URL: #63047
Reviewed-By: Paolo Insogna <paolo@cowtech.it>
Reviewed-By: James M Snell <jasnell@gmail.com>

Signed-off-by: Matteo Collina <hello@matteocollina.com>
PR-URL: #62673
Reviewed-By: Daniel Lemire <daniel@lemire.me>
Reviewed-By: Tobias Nießen <tniessen@tnie.de>
Reviewed-By: Edy Silva <edigleyssonsilva@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>

- For imported CJS, if it's not customized by asynchronous hooks,
  make sure it won't use the quirky re-invented require in all
  cases.
- When the imported CJS module is customized by synchronous hooks,
  in the synthetic module evalutation step, avoid calling the
  respective default step again.
- Make the branching of loadCJSModuleWithModuleLoad() and
  loadCJSModuleWithSpecialRequire() more explicit, and fold
  the tentative fs read in the 'commonjs' translator into the
  share createCJSModuleWrap() helper instead of checking it
  twice in the same path.

Signed-off-by: Joyee Cheung <joyeec9h3@gmail.com>
PR-URL: #62920
Fixes: #63060
Reviewed-By: Paolo Insogna <paolo@cowtech.it>
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
Reviewed-By: Gürgün Dayıoğlu <hey@gurgun.day>

Signed-off-by: Filip Skokan <panva.ip@gmail.com>
PR-URL: #63134
Reviewed-By: Anna Henningsen <anna@addaleax.net>
Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com>
Reviewed-By: James M Snell <jasnell@gmail.com>

Move KeyObject type and handle storage behind NativeKeyObject and
expose it to JS through a module-private slot reader, mirroring the
CryptoKey hardening. Cache the native slot tuple in a private field
and lazily derive secret and asymmetric metadata from the cached
KeyObjectHandle.

Update internal crypto, QUIC, and comparison callers to use private
helpers instead of public KeyObject accessors. Keep getKeyObjectSlots
restricted to internal/crypto/keys with an ESLint guard.

Add regression coverage for brand checks, hidden slots, clone and
transfer behavior, own-property reflection, and post-clone crypto
operations. Extend the CryptoKey brand test to assert getSlots is not
reachable through the public constructor or prototype chain.

Signed-off-by: Filip Skokan <panva.ip@gmail.com>
PR-URL: #63111
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com>

Clone CryptoKey algorithm dictionaries into null-prototype objects
before storing or caching them internally. Copy nested hash dictionaries
and publicExponent bytes so internal consumers and transferred keys do
not observe user-mutable input objects or polluted Object.prototype
fields.

Keep public algorithm and inspect output as ordinary objects. Make the
clone path check only own hash and publicExponent properties.

Signed-off-by: Filip Skokan <panva.ip@gmail.com>
PR-URL: #63111
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com>

Add ESLint rules that reject public KeyObject and CryptoKey accessor
reads after internal brand checks. Internal code must use the private
key helpers so it reads native-backed slots instead of user-replaceable
properties.

Add a separate rule that rejects instanceof checks against KeyObject
and CryptoKey constructors, including the global CryptoKey constructor.

Signed-off-by: Filip Skokan <panva.ip@gmail.com>
PR-URL: #63111
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com>

Signed-off-by: Antoine du Hamel <duhamelantoine1995@gmail.com>
PR-URL: #63147
Reviewed-By: Filip Skokan <panva.ip@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Trivikram Kamat <trivikr.dev@gmail.com>

Signed-off-by: Renegade334 <contact.9a5d6388@renegade334.me.uk>
PR-URL: #63076
Refs: #63052
Reviewed-By: Chemi Atlow <chemi@atlow.co.il>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Edy Silva <edigleyssonsilva@gmail.com>

Signed-off-by: geeksilva97 <edigleyssonsilva@gmail.com>
PR-URL: #63152
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: René <contact.9a5d6388@renegade334.me.uk>

Signed-off-by: Renegade334 <contact.9a5d6388@renegade334.me.uk>
PR-URL: #63132
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>

Signed-off-by: RafaelGSS <rafael.nunu@hotmail.com>
PR-URL: #63131
Reviewed-By: Marco Ippolito <marcoippolito54@gmail.com>
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>

Signed-off-by: James M Snell <jasnell@gmail.com>
Assisted-by: Opencode:Opus 4.6
PR-URL: #63157
Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com>
Reviewed-By: Trivikram Kamat <trivikr.dev@gmail.com>
Reviewed-By: Tim Perry <pimterry@gmail.com>

PR-URL: #62812
Reviewed-By: James M Snell <jasnell@gmail.com>

Map BoringSSL's native renegotiation failure to
ERR_TLS_RENEGOTIATION_UNSUPPORTED when TLSSocket#renegotiate() is
called. This avoids exposing an implementation-specific OpenSSL error
when the TLS backend does not support caller-initiated renegotiation.

Signed-off-by: Filip Skokan <panva.ip@gmail.com>
PR-URL: #63161
Reviewed-By: Tim Perry <pimterry@gmail.com>
Reviewed-By: Anna Henningsen <anna@addaleax.net>
Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com>

Signed-off-by: James M Snell <jasnell@gmail.com>
PR-URL: #63177
Reviewed-By: Tim Perry <pimterry@gmail.com>
Reviewed-By: Anna Henningsen <anna@addaleax.net>

Signed-off-by: James M Snell <jasnell@gmail.com>
PR-URL: #63177
Reviewed-By: Tim Perry <pimterry@gmail.com>
Reviewed-By: Anna Henningsen <anna@addaleax.net>

The Platform support section of the single-executable-applications doc
listed `macOS` without qualifying which architecture is supported.
SEA on x64 macOS is not supported and is skipped in CI; only arm64
macOS is exercised.

Refs: #62893
Signed-off-by: mokashang <64570909+mokashang@users.noreply.github.com>
PR-URL: #63181
Reviewed-By: Joyee Cheung <joyeec9h3@gmail.com>
Reviewed-By: Chemi Atlow <chemi@atlow.co.il>

Signed-off-by: Antoine du Hamel <duhamelantoine1995@gmail.com>
PR-URL: #63199
Reviewed-By: Jacob Smith <jacob@frende.me>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Chemi Atlow <chemi@atlow.co.il>
Reviewed-By: Ulises Gascón <ulisesgascongonzalez@gmail.com>

Use performFileOperation() for test runner watch updates so the
run() API path schedules a single delayed write instead of rewriting
the file until the second run completes.

Repeated writes can trigger another watch restart while the previous
rerun is still active. The runner then terminates the in-flight child
process with SIGTERM, which can make the captured output include both
a failed file-level subtest and the next successful run.

Also count only root summary duration lines when detecting completed
runs.

Signed-off-by: Kamat, Trivikram <16024985+trivikr@users.noreply.github.com>
Assisted-by: openai:gpt-5.5
PR-URL: #63386
Refs: https://github.com/nodejs/reliability/blob/main/reports/2026-05-17.md#jstest-failure
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
Reviewed-By: Chemi Atlow <chemi@atlow.co.il>

PR-URL: #62734
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Michaël Zasso <targos@protonmail.com>
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>

Several prose references to HTTP, HTTPS, SSL, HPE_HEADER_OVERFLOW
and ECMAScript used the article "a" where the acronym starts with
a vowel sound and should take "an". The rule is based on
pronunciation, not spelling: HTTP is read "aitch-tee-tee-pee",
SSL is read "ess-es-el", ECMAScript is read "ek-mah-script",
and HPE is read "aitch-pee-ee" — all starting with a vowel sound.

Affected files:

* doc/api/crypto.md — "disable a SSL 3.0/TLS 1.0 vulnerability"
* doc/api/http.md — five occurrences ("a HTTP '400 Bad Request'",
  "a HTTP '431 Request Header Fields Too Large'", "a HTTP/1.1 102
  Processing message", two copies of "use a HTTP parser") plus
  two references to "a HPE_HEADER_OVERFLOW"
* doc/api/http2.md — two code-sample comments reading
  "// Detects if it is a HTTPS request or HTTP/2"
* doc/api/module.md — "compiles a CommonJS, a ECMAScript Module,
  or a TypeScript module" (only the middle article changes; the
  adjacent "a CommonJS" and "a TypeScript" are both correct)
* doc/api/tls.md — two references to "part of a SSL/TLS handshake"
  in tlsSocket.getFinished() and tlsSocket.getPeerFinished()

No behavior changes, documentation only.

Signed-off-by: João Victor Oliveira <joao.oliveira@softtor.com.br>
PR-URL: #62696
Reviewed-By: Aviv Keller <me@aviv.sh>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Akhil Marsonya <akhil.marsonya27@gmail.com>
Reviewed-By: Jacob Smith <jacob@frende.me>

Use 127.0.0.1:10, matching existing refused-connection tests, instead
of binding and releasing an ephemeral port that can be reused before
the child process connects.

Clear NO_PROXY and no_proxy so local proxy bypass settings do not skip
the proxy connection attempt.

Signed-off-by: Kamat, Trivikram <16024985+trivikr@users.noreply.github.com>
Assisted-by: openai:gpt-5.5
PR-URL: #63395
Refs: https://github.com/nodejs/reliability/blob/main/reports/2026-05-15.md#jstest-failure
Reviewed-By: Joyee Cheung <joyeec9h3@gmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>

The test expects the worker to run out of memory during startup while
creating the message port. With Maglev enabled, the tiny worker heap
can be exhausted earlier while generating deoptimization data, which
changes the failure mode.

Disable Maglev so the induced OOM reaches the path covered by the test.

Signed-off-by: Kamat, Trivikram <16024985+trivikr@users.noreply.github.com>
Assisted-by: openai:gpt-5.5
PR-URL: #63398
Refs: https://github.com/nodejs/reliability/blob/main/reports/2026-05-18.md#jstest-failure
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Richard Lau <richard.lau@ibm.com>

PR-URL: #63402
Reviewed-By: Moshe Atlow <moshe@atlow.co.il>
Reviewed-By: Debadree Chatterjee <debadree333@gmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>

Signed-off-by: Antoine du Hamel <duhamelantoine1995@gmail.com>
PR-URL: #63406
Reviewed-By: René <contact.9a5d6388@renegade334.me.uk>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>

Signed-off-by: Renegade334 <contact.9a5d6388@renegade334.me.uk>
PR-URL: #63410
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
Reviewed-By: Chengzhong Wu <legendecas@gmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>

Notable changes:

doc:
  * mark `stream.compose` stable (Matteo Collina) #62562
fs:
  * (SEMVER-MINOR) add `Temporal.Instant` support to `Stats` and `BigIntStats` (Livia Medeiros) #60789
http:
  * (SEMVER-MINOR) add `writeInformation` to send arbitrary 1xx status codes (Tim Perry) #63155

PR-URL: #63440