Skip to content

Comments

2026-02-24, Version 25.7.0 (Current)#61922

Open
github-actions[bot] wants to merge 90 commits intov25.xfrom
v25.7.0-proposal
Open

2026-02-24, Version 25.7.0 (Current)#61922
github-actions[bot] wants to merge 90 commits intov25.xfrom
v25.7.0-proposal

Conversation

@github-actions
Copy link
Contributor

@github-actions github-actions bot commented Feb 22, 2026

  • [b0a79b10f0] - (SEMVER-MINOR) http2: add http1Options for HTTP/1 fallback configuration (Amol Yadav) #61713
  • [2d874dfb8e] - (SEMVER-MINOR) sea: support ESM entry point in SEA (Joyee Cheung) #61813
  • [ee59127664] - sqlite: mark as release candidate (Matteo Collina) #61262
  • [608736e19e] - (SEMVER-MINOR) stream: rename Duplex.toWeb() type option to readableType (René) #61632
  • [a43375999f] - (SEMVER-MINOR) test_runner: show interrupted test on SIGINT (Matteo Collina) #61676
Commits
  • [ab4375e141] - benchmark: add startup benchmark for ESM entrypoint (Joyee Cheung) #61769
  • [8d83d8026b] - build: add temporal test on GHA windows (Chengzhong Wu) #61810
  • [aab153eec3] - build: skip sscache action on non-main branches (Joyee Cheung) #61790
  • [9e40fb93bc] - build: use path-ignore in GHA coverage-windows.yml (Chengzhong Wu) #61811
  • [4896653361] - build: generate_config_gypi.py generates valid JSON (Shelley Vohr) #61791
  • [bb82b44de0] - build: build with v8 gdbjit support on supported platform (Joyee Cheung) #61010
  • [e7173a093a] - build: show cc outputs when version detection failed (Chengzhong Wu) #61700
  • [848050d38f] - build,win: add WinGet Visual Studio 2022 Build Tools Edition config (Mike McCready) #61652
  • [938841e1cd] - crypto: always return certificate serial numbers as uppercase (Anna Henningsen) #61752
  • [dba9001d6f] - deps: upgrade npm to 11.10.1 (npm team) #61892
  • [75c8e18d2f] - deps: update nbytes to 0.1.3 (Node.js GitHub Bot) #61879
  • [4ca1597f25] - deps: remove stale OpenSSL arch configs (René) #61834
  • [c4f298c729] - deps: update llhttp to 9.3.1 (Node.js GitHub Bot) #61827
  • [7d63a2df93] - deps: V8: cherry-pick 64b36b441179 (Rafael Magrin) #61712
  • [241a6b7088] - deps: update googletest to 5a9c3f9e8d9b90bbbe8feb32902146cb8f7c1757 (Node.js GitHub Bot) #61731
  • [eec896c0e0] - deps: V8: backport 6a0a25abaed3 (Vivian Wang) #61666
  • [5a9874af09] - doc: clarify status of feature request issues (Antoine du Hamel) #61505
  • [0648ac64aa] - doc: add esm and cjs examples to node:vm (Alfredo González) #61498
  • [8b38718294] - doc: clarify build environment is trusted in threat model (Matteo Collina) #61865
  • [10e86818ee] - doc: remove incorrect mention of module in typescript.md (Rob Palmer) #61839
  • [b50376f527] - doc: simplify addAbortListener example (Chemi Atlow) #61842
  • [dea0e7a856] - doc: fix typo in --disable-wasm-trap-handler description (Dmytro Semchuk) #61820
  • [57ac1f5aa0] - doc: clean up globals.md (René) #61822
  • [4c30d2bb4d] - doc: remove obsolete Boxstarter automated install (Mike McCready) #61785
  • [db610b9e32] - doc: clarify async caveats for events.once() (René) #61572
  • [b4a826b11c] - doc: update Juan's security steward info (Juan José) #61754
  • [7d9cc5dc54] - doc: fix methods being documented as properties in process.md (Antoine du Hamel) #61765
  • [aa0362c26a] - doc: add riscv64 info into platform list (Lu Yahan) #42251
  • [9b0101b65b] - doc: fix dropdown menu being obscured at <600px due to stacking context (Jeff) #61735
  • [df2c65b3e4] - doc: fix spacing in process message event (Aviv Keller) #61756
  • [01018559f5] - doc: move describe/it aliases section before expectFailure (Luca Raveri) #61567
  • [49443583af] - doc: fix broken links of net.md (YuSheng Chen) #61673
  • [af7c927a2a] - doc: clean up Windows code snippet in child_process.md (reillylm) #61422
  • [221648a687] - esm: update outdated FIXME comment in translators.js (Karan Mangtani) #61715
  • [4484e14a31] - events: don't call resume after close (Сковорода Никита Андреевич) #60548
  • [4cecbe1f53] - fs: add throwIfNoEntry option for fs.stat and fs.promises.stat (Juan José) #61178
  • [2c94967684] - http: remove redundant keepAliveTimeoutBuffer assignment (Efe) #61743
  • [435f3dd8e4] - http: attach error handler to socket synchronously in onSocket (RajeshKumar11) #61770
  • [ce0ebd853d] - http: fix keep-alive socket reuse race in requestOnFinish (Martin Slota) #61710
  • [8103a78b6a] - http2: add strictSingleValueFields option to relax header validation (Tim Perry) #59917
  • [b0a79b10f0] - (SEMVER-MINOR) http2: add http1Options for HTTP/1 fallback configuration (Amol Yadav) #61713
  • [c589b6b23c] - http2: fix FileHandle leak in respondWithFile (sangwook) #61707
  • [df477202ae] - lib: reduce cycles in esm loader and load it in snapshot (Joyee Cheung) #61769
  • [deda50a819] - lib: remove top-level getOptionValue() calls in lib/internal/modules (Joyee Cheung) #61769
  • [b1c1ddff79] - lib: optimize styleText when validateStream is false (Rafael Gonzaga) #61792
  • [df334f7fa0] - meta: use SCCACHE_GHA_ENABLED for shared build workflows (René) #61640
  • [24b858547a] - module: fix extensionless entry with explicit type=commonjs (Yuya Inoue) #61600
  • [4f2f8006bd] - repl: fix FileHandle leak in history initialization (sangwook) #61706
  • [2d874dfb8e] - (SEMVER-MINOR) sea: support ESM entry point in SEA (Joyee Cheung) #61813
  • [ee59127664] - sqlite: mark as release candidate (Matteo Collina) #61262
  • [f14ff14473] - src: remove unnecessary c_str() conversions in diagnostic messages (Anna Henningsen) #61786
  • [26a09e541d] - src: use bool literals in TraceEnvVarOptions (Tobias Nießen) #61425
  • [62b0758c47] - src: fix --build-sea default executable path (Alex Schwartz) #61708
  • [b5724921b1] - src: track allocations made by zstd streams (Anna Henningsen) #61717
  • [3d1d1523a5] - src: do not store compression methods on Brotli classes (Anna Henningsen) #61717
  • [b2915cda77] - src: extract zlib allocation tracking into its own class (Anna Henningsen) #61717
  • [3032a7e3c6] - src: release memory for zstd contexts in Close() (Anna Henningsen) #61717
  • [bc2287db74] - src: add more checks and clarify docs for external references (Joyee Cheung) #61719
  • [5daf282e33] - src: fix cjs_lexer external reference registration (Joyee Cheung) #61718
  • [fb2db5f947] - src: support import() and import.meta in embedder-run modules (Joyee Cheung) #61654
  • [e146591002] - stream: fix decoded fromList chunk boundary check (Thomas Watson) #61884
  • [065200a5f0] - stream: add fast paths for webstreams read and pipeTo (Matteo Collina) #61807
  • [608736e19e] - (SEMVER-MINOR) stream: rename Duplex.toWeb() type option to readableType (René) #61632
  • [51587d684d] - test: fix typos in test files (Daijiro Wachi) #61408
  • [17b2361360] - test: allow filtering async internal frames in assertSnapshot (Joyee Cheung) #61769
  • [3f6a5f5f7f] - test: unify assertSnapshot stacktrace transform (Chengzhong Wu) #61665
  • [c8dac320de] - test: check stability block position in API markdown (René) #58590
  • [6809ef8d04] - test: adapt buffer test for v8 sandbox (Shelley Vohr) #61772
  • [60f5771a74] - test: update FileAPI tests from WPT (Ms2ger) #61750
  • [d2fef4a31a] - test: update WPT for WebCryptoAPI to 7cbe7e8ed9 (Node.js GitHub Bot) #61729
  • [d7a87f14da] - test: update WPT for url to efb889eb4c (Node.js GitHub Bot) #61728
  • [b6ae1fc4b8] - test: split test-embedding.js and run tests in parallel (Joyee Cheung) #61571
  • [a43375999f] - (SEMVER-MINOR) test_runner: show interrupted test on SIGINT (Matteo Collina) #61676
  • [1c02aa09b0] - test_runner: fix suite rerun (Moshe Atlow) #61775
  • [47821ec609] - tools: switch to ARM runners on GHA jobs (Antoine du Hamel) #61903
  • [1630a56370] - tools: avoid building twice in coverage jobs (Antoine du Hamel) #61899
  • [89318b0a02] - tools: fix auto-start-ci (Antoine du Hamel) #61900
  • [ee107f5e84] - tools: do not checkout repo in auto-start-ci.yml (Antoine du Hamel) #61874
  • [c2de1fa619] - tools: cache V8 build on test-shared workflow (Antoine du Hamel) #61860
  • [111c77ec94] - tools: automate updates for test/fixtures/test426 (Rich Trott) #60978
  • [ea8886f7d5] - tools: use ubuntu-slim runner in GHA (Antoine du Hamel) #61759
  • [9db82ba786] - tools: bump unist-util-visit in /tools/doc in the doc group (dependabot[bot]) #61646
  • [c8e58c56b9] - tools: bump the eslint group in /tools/eslint with 6 updates (dependabot[bot]) #61628
  • [2518ec77e8] - tools: use ubuntu-slim runner in GHA (Antoine du Hamel) #61734
  • [c5ad2beba3] - tools: fix small inconsistencies in JSON doc output (Antoine du Hamel) #61757
  • [a9f90bee0a] - tools: use ubuntu-latest runner in notify-on-push workflow (Antoine du Hamel) #61742
  • [30e38182d9] - watch: get flags from execArgv (Efe) #61779
  • [da1a08a3a5] - worker: eliminate race condition in process.cwd() (giulioAZ) #61664
  • [dfac82a235] - zlib: add support for brotli compression dictionary (Andy Weiss) #61763

reillylm and others added 30 commits February 19, 2026 11:13
PR-URL: #61422
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
Split the tests so that it's easier to isolate and debug issues,
and we can run the test cases in parallel to speed up. Also
add more comments about what they are testing.

PR-URL: #61571
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Original commit message:

    [riscv] Fix sp handling in MacroAssembler::LeaveFrame

    Keep sp <= fp to ensure that data right above fp doesn't get clobbered
    by an inopportune signal and its handler.

    Such clobbering can happen in e.g. Node.js when JIT-compiled code is
    interrupted by a SIGCHLD handler.

    Bug: None
    Change-Id: Ief0836032ada7942e89f081f7605f61632c4d414
    Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7540554
    Reviewed-by: Ji Qiu <qiuji@iscas.ac.cn>
    Commit-Queue: Yahan Lu (LuYahan) <yahan@iscas.ac.cn>
    Reviewed-by: Rezvan Mahdavi Hezaveh <rezvan@chromium.org>
    Cr-Commit-Position: refs/heads/main@{#105069}

Refs: v8/v8@6a0a25a
Co-authored-by: kxxt <rsworktech@outlook.com>
PR-URL: #61666
Reviewed-By: Richard Lau <richard.lau@ibm.com>
Reviewed-By: Michaël Zasso <targos@protonmail.com>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
PR-URL: #61742
Reviewed-By: Filip Skokan <panva.ip@gmail.com>
Reviewed-By: Richard Lau <richard.lau@ibm.com>
PR-URL: #61700
Reviewed-By: Juan José Arboleda <soyjuanarbol@gmail.com>
Reviewed-By: Richard Lau <richard.lau@ibm.com>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Ensure that the file handle is closed if header validation fails in
respondWithFile. This prevents ERR_INVALID_STATE errors where a
FileHandle object is closed during garbage collection.

PR-URL: #61707
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
Reviewed-By: Tim Perry <pimterry@gmail.com>
PR-URL: #61715
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
Reviewed-By: Joyee Cheung <joyeec9h3@gmail.com>
Ensure that the history file handle is closed if initialization fails or
flushing throws an error. This prevents ERR_INVALID_STATE errors where
a FileHandle object is closed during garbage collection.

PR-URL: #61706
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Gürgün Dayıoğlu <hey@gurgun.day>
Reviewed-By: Anna Henningsen <anna@addaleax.net>
This adds a embedder_module_hdo for identifying embedder-run
modules in the dynamic import handler and import.meta initializer,
and a SourceTextModuleTypes for customizing source text module
compilation in the JS land via compileSourceTextModule().
Also, refactors the existing embedder module compilation code
to reuse the builtin resolution logic.

PR-URL: #61654
Reviewed-By: Chengzhong Wu <legendecas@gmail.com>
Reviewed-By: Aditi Singh <aditisingh1400@gmail.com>
It needs to be added to the list to actually get registered.

PR-URL: #61718
Reviewed-By: Anna Henningsen <anna@addaleax.net>
Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
PR-URL: #61673
Reviewed-By: Richard Lau <richard.lau@ibm.com>
Reviewed-By: Tim Perry <pimterry@gmail.com>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Ethan Arrowood <ethan@arrowood.dev>
Reviewed-By: Ulises Gascón <ulisesgascongonzalez@gmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
To help catch unregistered bindings.

PR-URL: #61719
Refs: #61718
Reviewed-By: Anna Henningsen <anna@addaleax.net>
Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
PR-URL: #61567
Reviewed-By: Tierney Cyren <hello@bnb.im>
Reviewed-By: Jacob Smith <jacob@frende.me>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Chemi Atlow <chemi@atlow.co.il>
Reviewed-By: Pietro Marchini <pietro.marchini94@gmail.com>
This aligns zstd streams with other compression libraries in this
regard, and enables releasing memory early when the stream ends in
JS instead of waiting for GC to clean up the wrapper object (which
is a problem that is exacerbated in the zstd context because we
do not track memory and report memory pressure to V8 yet).

PR-URL: #61717
Reviewed-By: Benjamin Gruenbaum <benjamingr@gmail.com>
Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com>
Reviewed-By: Rafael Gonzaga <rafael.nunu@hotmail.com>
This makes it a bit easier to separate concerns, and results in
reduced code duplication when compiling since this code does not
depend on template parameters.

PR-URL: #61717
Reviewed-By: Benjamin Gruenbaum <benjamingr@gmail.com>
Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com>
Reviewed-By: Rafael Gonzaga <rafael.nunu@hotmail.com>
This addresses a long-standing TODO comment, referencing the fact
that these values are either known at compile time or can be
inferred from the `this` value in the context class.

PR-URL: #61717
Reviewed-By: Benjamin Gruenbaum <benjamingr@gmail.com>
Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com>
Reviewed-By: Rafael Gonzaga <rafael.nunu@hotmail.com>
This is both valuable as a diagnostic tool and as a way to inform
the JS runtime about external allocations.

Currently, this is a feature only enabled in the statically linked
builds of zstd, so with `--shared-zstd`, we fall back to the
non-tracking variant.

PR-URL: #61717
Reviewed-By: Benjamin Gruenbaum <benjamingr@gmail.com>
Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com>
Reviewed-By: Rafael Gonzaga <rafael.nunu@hotmail.com>
PR-URL: #61757
Reviewed-By: Claudio Wunder <cwunder@gnome.org>
Reviewed-By: Chengzhong Wu <legendecas@gmail.com>
Reviewed-By: Aviv Keller <me@aviv.sh>
Build it with gdbjit support on supported platforms by default
allows debugging JIT-compiled code in gdb when it's also enabled
at run time (via --gdbjit). Simply building it in should not
incur an overhead if it's not also enabled at run time.

PR-URL: #61010
Reviewed-By: Chengzhong Wu <legendecas@gmail.com>
PR-URL: #61708
Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com>
Reviewed-By: Joyee Cheung <joyeec9h3@gmail.com>
PR-URL: #61728
Reviewed-By: Daeyeon Jeong <daeyeon.dev@gmail.com>
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
Reviewed-By: Filip Skokan <panva.ip@gmail.com>
Reviewed-By: Michaël Zasso <targos@protonmail.com>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
PR-URL: #61729
Reviewed-By: Filip Skokan <panva.ip@gmail.com>
Reviewed-By: Michaël Zasso <targos@protonmail.com>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
PR-URL: #61731
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
Reviewed-By: Michaël Zasso <targos@protonmail.com>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
PR-URL: #61756
Reviewed-By: René <contact.9a5d6388@renegade334.me.uk>
Reviewed-By: Daeyeon Jeong <daeyeon.dev@gmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
PR-URL: #61734
Reviewed-By: René <contact.9a5d6388@renegade334.me.uk>
Reviewed-By: Michaël Zasso <targos@protonmail.com>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Rafael Gonzaga <rafael.nunu@hotmail.com>
PR-URL: #61735
Fixes: #59282
Reviewed-By: Aviv Keller <me@aviv.sh>
Reviewed-By: Claudio Wunder <cwunder@gnome.org>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
PR-URL: #42251
Reviewed-By: Stewart X Addison <sxa@redhat.com>
PR-URL: #61765
Reviewed-By: René <contact.9a5d6388@renegade334.me.uk>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
PR-URL: #61632
Refs: #58664
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
Reviewed-By: Mattias Buelens <mattias@buelens.com>
Original commit message:

    optimize ascii fast path in WriteUtf8V2

    Change-Id: If28168cb4395b953d0ec642ef4fc618ce963dbcd
    Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7124103
    Reviewed-by: Toon Verwaest <verwaest@chromium.org>
    Commit-Queue: Erik Corry <erikcorry@chromium.org>
    Reviewed-by: Erik Corry <erikcorry@chromium.org>
    Cr-Commit-Position: refs/heads/main@{#103542}

Refs: v8/v8@64b36b4
PR-URL: #61712
Reviewed-By: Rafael Gonzaga <rafael.nunu@hotmail.com>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
joyeecheung and others added 16 commits February 22, 2026 01:07
PR-URL: #61769
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
Reviewed-By: Daijiro Wachi <daijiro.wachi@gmail.com>
Reviewed-By: Geoffrey Booth <webadmin@geoffreybooth.com>
Reviewed-By: Chengzhong Wu <legendecas@gmail.com>
Reviewed-By: Rafael Gonzaga <rafael.nunu@hotmail.com>
Reviewed-By: Jacob Smith <jacob@frende.me>
PR-URL: #61769
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
Reviewed-By: Daijiro Wachi <daijiro.wachi@gmail.com>
Reviewed-By: Geoffrey Booth <webadmin@geoffreybooth.com>
Reviewed-By: Chengzhong Wu <legendecas@gmail.com>
Reviewed-By: Rafael Gonzaga <rafael.nunu@hotmail.com>
Reviewed-By: Jacob Smith <jacob@frende.me>
Add build system attacks (command injection via environment
variables, path hijacking, file permissions) to the list of
non-vulnerabilities. The build environment is a trusted element
and these scenarios require an already-compromised system.

PR-URL: #61865
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
Reviewed-By: Beth Griggs <bethanyngriggs@gmail.com>
Reviewed-By: Rafael Gonzaga <rafael.nunu@hotmail.com>
Reviewed-By: Chemi Atlow <chemi@atlow.co.il>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Ulises Gascón <ulisesgascongonzalez@gmail.com>
Reviewed-By: Chengzhong Wu <legendecas@gmail.com>
PR-URL: #61810
Refs: #58730
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Chemi Atlow <chemi@atlow.co.il>
Reviewed-By: Stefan Stojanovic <stefan.stojanovic@janeasystems.com>
Reviewed-By: Tierney Cyren <hello@bnb.im>
Add internal fast paths to improve webstreams performance without
changing the public API or breaking spec compliance.

1. ReadableStreamDefaultReader.read() fast path:
   When data is already buffered in the controller's queue, return
   PromiseResolve() directly without creating a DefaultReadRequest
   object. This is spec-compliant because read() returns a Promise,
   and resolved promises still run callbacks in the microtask queue.

2. pipeTo() batch read fast path:
   When data is buffered, batch reads directly from the controller
   queue up to highWaterMark without creating
   PipeToReadableStreamReadRequest objects per chunk. Respects
   backpressure by checking desiredSize after each write.

Benchmark results:
  - pipeTo:          ~11% faster (***)
  - buffered read(): ~17-20% faster (***)

Co-Authored-By: Malte Ubl <malte@vercel.com>
PR-URL: #61807
Reviewed-By: Stephen Belanger <admin@stephenbelanger.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Gürgün Dayıoğlu <hey@gurgun.day>
Reviewed-By: Ethan Arrowood <ethan@arrowood.dev>
Refs: #42616
PR-URL: #61834
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Rafael Gonzaga <rafael.nunu@hotmail.com>
Reviewed-By: Chemi Atlow <chemi@atlow.co.il>
PR-URL: #61874
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Rafael Gonzaga <rafael.nunu@hotmail.com>
Reviewed-By: René <contact.9a5d6388@renegade334.me.uk>
Reviewed-By: Chengzhong Wu <legendecas@gmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Tierney Cyren <hello@bnb.im>
PR-URL: #61900
Refs: #61874
Reviewed-By: Michaël Zasso <targos@protonmail.com>
Reviewed-By: René <contact.9a5d6388@renegade334.me.uk>
PR-URL: #61879
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
PR-URL: REPLACEME
PR-URL: #61262
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Moshe Atlow <moshe@atlow.co.il>
Reviewed-By: Zeyu "Alex" Yang <himself65@outlook.com>
Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com>
Reviewed-By: Trivikram Kamat <trivikr.dev@gmail.com>
Reviewed-By: Edy Silva <edigleyssonsilva@gmail.com>
Previously it was impossible to send multiple values for any header
or trailer defined officially as supporting only a single value.

This is a good default, but in practice many of these headers are used
in weird & wonderful ways where this can be problematic. This new
option allows for relaxing this restriction to support those cases
where required.

This option defaults to true so validation will still be applied
as before, rejecting multiple single-value fields, unless explicitly
disabled.

PR-URL: #59917
Reviewed-By: Stephen Belanger <admin@stephenbelanger.com>
PR-URL: #61408
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Ethan Arrowood <ethan@arrowood.dev>
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
Reviewed-By: Ulises Gascón <ulisesgascongonzalez@gmail.com>
PR-URL: #61498
Reviewed-By: Zeyu "Alex" Yang <himself65@outlook.com>
Reviewed-By: Gürgün Dayıoğlu <hey@gurgun.day>
Reviewed-By: Ulises Gascón <ulisesgascongonzalez@gmail.com>
PR-URL: #61505
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Rafael Gonzaga <rafael.nunu@hotmail.com>
Correct `fromList()` in decoded string mode to compare `n` against the
current chunk length, not the buffer array length.

This prevents over-consuming chunks, which can corrupt readable state
and crash with `TypeError` when mixing `setEncoding()` and `read(n)`.

PR-URL: #61884
Reviewed-By: Robert Nagy <ronagy@icloud.com>
Reviewed-By: Ruben Bridgewater <ruben@bridgewater.de>
Reviewed-By: Ilyas Shabi <ilyasshabi94@gmail.com>
Reviewed-By: Gürgün Dayıoğlu <hey@gurgun.day>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
Reviewed-By: Minwoo Jung <nodecorelab@gmail.com>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Ethan Arrowood <ethan@arrowood.dev>
PR-URL: #61892
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
nodejs-github-bot added a commit that referenced this pull request Feb 22, 2026
Notable changes:

http2:
  * (SEMVER-MINOR) add http1Options for HTTP/1 fallback configuration (Amol Yadav) #61713
sea:
  * (SEMVER-MINOR) support ESM entry point in SEA (Joyee Cheung) #61813
sqlite:
  * mark as release candidate (Matteo Collina) #61262
stream:
  * (SEMVER-MINOR) rename `Duplex.toWeb()` type option to `readableType` (René) #61632
test_runner:
  * (SEMVER-MINOR) show interrupted test on SIGINT (Matteo Collina) #61676

PR-URL: #61922
@github-actions github-actions bot added release Issues and PRs related to Node.js releases. v25.x Issues that can be reproduced on v25.x or PRs targeting the v25.x-staging branch. labels Feb 22, 2026
@nodejs-github-bot
Copy link
Collaborator

Review requested:

  • @nodejs/actions
  • @nodejs/build
  • @nodejs/releasers
  • @nodejs/security-wg
  • @nodejs/tsc
  • @nodejs/v8-update

@nodejs-github-bot
Copy link
Collaborator

nodejs-github-bot commented Feb 22, 2026

@nodejs-github-bot
Copy link
Collaborator

PR-URL: #61899
Reviewed-By: Michaël Zasso <targos@protonmail.com>
Reviewed-By: Chengzhong Wu <legendecas@gmail.com>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
PR-URL: #61903
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
Notable changes:

http2:
  * (SEMVER-MINOR) add http1Options for HTTP/1 fallback configuration (Amol Yadav) #61713
sea:
  * (SEMVER-MINOR) support ESM entry point in SEA (Joyee Cheung) #61813
sqlite:
  * mark as release candidate (Matteo Collina) #61262
stream:
  * (SEMVER-MINOR) rename `Duplex.toWeb()` type option to `readableType` (René) #61632
test_runner:
  * (SEMVER-MINOR) show interrupted test on SIGINT (Matteo Collina) #61676

PR-URL: #61922
@aduh95 aduh95 marked this pull request as ready for review February 22, 2026 22:09
@aduh95 aduh95 requested a review from a team as a code owner February 22, 2026 22:09
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

release Issues and PRs related to Node.js releases. v25.x Issues that can be reproduced on v25.x or PRs targeting the v25.x-staging branch.

Projects

None yet

Development

Successfully merging this pull request may close these issues.