Weekly GitHub Report for Node

Thank you for subscribing to our weekly newsletter! Each week, we deliver a comprehensive summary of your GitHub project's latest activity right to your inbox, including an overview of your project's issues, pull requests, contributors, and commit activity.

Table of Contents

• I. News
  • 1.1. Recent Version Releases
  • 1.2. Other Noteworthy Updates
• II. Issues
  • 2.1. Top 5 Active Issues
  • 2.2. Top 5 Stale Issues
  • 2.3. Open Issues
  • 2.4. Closed Issues
  • 2.5. Issue Discussion Insights

• III. Pull Requests
  • 3.1. Open Pull Requests
  • 3.2. Closed Pull Requests
  • 3.3. Pull Request Discussion Insights

• IV. Contributors
  • 4.1. Contributors

I. News

1.1 Recent Version Releases:

The current version of this repository is v23.10.0

1.2 Version Information:

Released on March 13, 2025, this version introduces the --experimental-config-file feature, allowing developers to use JSON configuration files like node.config.json to simplify flag management for test runners and other experimental features, enhancing developer experience. Additionally, it includes updates to root certificates, new TLS and V8 methods, improved error handling, and various tooling and documentation enhancements.

II. Issues

2.1 Top 5 Active Issues:

We consider active issues to be issues that that have been commented on most frequently within the last week. Bot comments are omitted.

1. [FEATURE REQUEST] [FFI] Remove FFI type aliases while it's still experimental: This issue addresses the confusion caused by multiple synonymous type aliases in the node:ffi module, which increases mental overhead for developers trying to understand if different names represent the same or subtly different types. The proposal suggests removing these synonyms to keep only one canonical spelling per distinct type while the module is still experimental, allowing for easier maintenance and clearer documentation in the future.

   • The comments reflect a range of opinions: some agree that the ffi.types enum should also be cleaned up to avoid redundancy, while others argue that supporting multiple aliases is user-friendly and accommodates different language conventions. A compromise is proposed to retain aliases but clearly document one canonical spelling for each type, with some support for keeping certain aliases like str and ptr.
   • Number of comments this week: 4

2. [FS] Close listener leak in fs/promises createReadStream: This issue reports a listener leak in the fs/promises module's createReadStream method, where each call adds a close event listener to the file handle that is never removed, causing a memory leak and triggering Node.js' event listener leak warning after multiple reads. The expected behavior is that the close listener should be removed once the stream is consumed, even if autoClose is false, allowing applications to read many ranges from a file without leaking listeners.

   • The comments discuss a workaround involving manual removal of the listener and suggest adding a stream.once('close', teardown) to handle early stream destruction; the issue was reopened after a previous fix was reverted, with a recommendation to use eos/finished instead of a close listener for a proper fix, and some requests for clarification on issue closure status.
   • Number of comments this week: 3

3. [HTTP] Node.js server fails to bind on ipv6 if ipv4 is not available: This issue describes a problem where a Node.js HTTP server fails to bind to an IPv6 address when IPv4 is not available on the operating system, resulting in the server being inaccessible despite no errors being thrown. The user provides various code examples attempting to bind the server to IPv6 addresses and notes that the issue reproduces only when TCPv4 support is missing on the system.

   • The comments include a volunteer expressing interest in working on the issue, followed by maintainers politely requesting the removal of an unrelated and critical remark about Node.js and AI from the original report, emphasizing respect for the community and contributors.
   • Number of comments this week: 3

4. Clarify process.report glibcVersionRuntime semantics for statically linked glibc builds: This issue concerns the unclear semantics of the process.report.getReport().header.glibcVersionRuntime field in Node.js diagnostic reports, particularly its absence in statically linked glibc builds. The reporter requests clarification in the documentation on whether the absence of this field is expected behavior, a bug, or should not be interpreted as indicating a non-glibc runtime, as current documentation does not define these presence semantics.

   • The comments discuss a two-part fix involving a documentation update to clarify the optional nature of glibcVersionRuntime in static builds and a potential C++ code change to provide a fallback for the runtime version; there is general agreement on the value of resolving the issue, with plans to start with the documentation update.
   • Number of comments this week: 2

5. [V8 ENGINE] JSON.parse returns unexpected keys after decoding specified JSON key: This issue describes a bug in Node.js version 24.x where JSON.parse returns incorrect keys after decoding certain escaped JSON keys, causing the second key in the parsed object to change unexpectedly. The problem is reproducible on multiple platforms and Node 24 versions but does not occur on earlier versions like Node 20 or 22, and it has been identified as a V8 engine bug related to cache poisoning triggered by specific escaped characters in object keys.

   • The comments confirm the issue is a V8 bug rather than a Node.js bug, provide additional reproductions across Node versions and platforms, detail the conditions under which the bug occurs (notably trailing backslash escapes in keys), and report ongoing investigations and version sweeps that show the bug persists in current V8 versions without a fix yet.
   • Number of comments this week: 2

2.2 Top 5 Stale Issues:

We consider stale issues to be issues that has had no activity within the last 30 days. The team should work together to get these issues resolved and closed as soon as possible.

As of our latest update, there are no stale issues for the project this week.

2.3 Open Issues

This section lists, groups, and then summarizes issues that were created within the last week in the repository.

Issues Opened This Week: 25

Summarized Issues:

• Stream and HTTP/3 QUIC Issues: Multiple issues affect stream handling and HTTP/3 QUIC sessions, including a bug where fused stateless transforms fail to normalize output batches, causing downstream transforms to receive raw data instead of normalized arrays. Additionally, a segmentation fault occurs on process exit after writing to a unidirectional QUIC stream, and new error codes and cancellation APIs are proposed to improve HTTP/3 stream closure signaling.
• [issues/65366, issues/65408, issues/65509]

• IPv6 and Network Binding Problems: There is a problem where Node.js HTTP servers fail to bind to IPv6 addresses when IPv4 support is unavailable, with no errors logged, causing silent failures in network connectivity.
• [issues/65400]

• Permission Model and Flags: The permission audit mode incorrectly enforces permissions instead of only auditing them, and proposals aim to add a new --allow-fs-tmp flag for simplified temporary directory access and to enable environment variables in all permission specification methods for better flexibility.
• [issues/65419, issues/65420, issues/65422]

• SQLite Use-After-Free and Session Management Bugs: Several issues describe use-after-free vulnerabilities and crashes in SQLite integration, including callbacks freeing sessions still in use, garbage collection of in-use sessions causing memory violations, and silent ignoring of invalid state errors during session disposal, leading to inconsistent error handling and crashes.
• [issues/65428, issues/65447, issues/65460]

• QUIC API Enhancements: A proposal suggests adding an API to migrate established QUIC sessions between local endpoints, enabling connection migration while preserving session state, streams, and datagram flows for improved network interface flexibility.
• [issues/65429]

• SQLite API Feature Requests: There is a proposal to add incremental BLOB I/O support via a database.openBlob() method to allow partial reads and writes of large BLOB or TEXT values, addressing current limitations of full-value operations only.
• [issues/65445]

• Node.js Addon Cleanup Crash: A deterministic crash occurs in Node.js v24.19.0 when addons use backported node::ObjectWrap cleanup hooks without the necessary registry, causing assertion failures and aborts on every 24.x runtime.
• [issues/65446]

• Build and Performance Improvements: Proposals include backporting Profile-Guided Optimization and ThinLTO performance improvements from v26 to v24 LTS to enhance build speed by about 15%, and a report of unreproducible libnode binaries when building with --shared twice on Linux due to recent changes.
• [issues/65452, issues/65508]

• File System API and Permission Bugs: Issues include a regression causing fs.cpSync to fail with permission denied errors on Docker bind mounts using VirtioFS on macOS, and fs.openAsBlob throwing generic errors without proper system error details, complicating debugging. A proposal also suggests adding a synchronous fs.openAsBlob or similar API for faster file streaming.
• [issues/65462, issues/65497, issues/65514]

• Module and Package Resolution Bugs: Bugs include temporary file descriptor leaks in the module compile cache during persistence failures, and package map subpaths incorrectly resolving outside the target package directory instead of failing, causing potential security or correctness issues.
• [issues/65473, issues/65501]

• Executable Build and Loader Issues: On macOS x64 with Node.js v26.7.0, executables built with the --build-sea flag segfault immediately due to likely misplacement of the __DATA_CONST segment, while alternative build methods produce working executables.
• [issues/65479]

• Explicit Resource Management Bug: Using or await using statements reject bound functions and proxied callables as valid dispose methods, causing unexpected TypeErrors despite these being callable and expected to work per the Explicit Resource Management proposal.
• [issues/65482]

• Child Process Timeout Handling Bug: The timeout option in the child_process module does not clear on spawn-time failures like ENOENT, causing the process to hang until the full timeout expires instead of exiting promptly after the error.
• [issues/65504]

• FFI Memory Helper Silent Failures: The ffi memory helper functions return undefined instead of throwing errors when required arguments are omitted, leading to silent failures and inconsistent behavior across these helpers.
• [issues/65499]

2.4 Closed Issues

This section lists, groups, and then summarizes issues that were closed within the last week in the repository. This section also links the associated pull requests if applicable.

Issues Closed This Week: 103

Summarized Issues:

• File system symbolic link handling issues: Multiple issues report problems with symbolic link handling in Node.js file system APIs. These include fs.readdir incorrectly reporting symlinked directories as files on some remote file systems, fs.realpathSync failing to resolve parent directories of symlinked folders due to premature normalization, and fs.copyFile() lacking documentation on always dereferencing symlinks, which contrasts with fs.cp()'s explicit symlink handling.
  • issues/30646, issues/60779, issues/61518

• Stream and file descriptor lifecycle bugs: There are issues where calling destroy() on writable streams or sockets leads to unexpected behavior. For example, destroying a writable stream from a FileHandle with {autoClose: false, emitClose: false} closes the underlying file descriptor unexpectedly, and a destroyed socket on Windows can be reopened and connected again, contradicting expected behavior.
  • issues/49241, issues/57367

• Test runner flakiness and timeout inconsistencies: Several issues describe flaky tests and timeout handling problems in the Node.js test runner. These include flaky failures in watch mode tests across platforms, suite timeouts not overriding run() timeouts, and flaky debugger tests on macOS due to inspector delays under CI load.
  • issues/54534, issues/59701, issues/64005

• Module resolution and loader hook problems: Issues highlight bugs in module resolution, especially with ESM and CommonJS interop. The require hooks receive resolved URLs instead of original specifiers, breaking expected behavior, and mocking dual-package ESM/CJS modules fails to restore mocks properly if cached. Additionally, unreadable package.json files cause silent fallback ignoring exports fields.
  • issues/55808, issues/58231, issues/65220, issues/61841

• Memory management and resource lifecycle concerns: There are reports of memory being held unnecessarily, such as the zlib inflate() function retaining a large internal buffer for the program's lifetime, and continuous garbage collection loops triggered by PerformanceObserver for 'gc' entries, causing high CPU usage.
  • issues/45303, issues/62721

• Cryptography API and security feature bugs: Several issues describe cryptographic API problems, including the crypto hash update function failing with stream piping, crypto.sign and crypto.verify incorrectly hashing prehashed inputs when passed null as the algorithm, and requests for exposing AES-SIV ciphers. There are also proposals for secure memory management to pin and zeroize sensitive data.
  • issues/60011, issues/60263, issues/63393, issues/59965

• Build and platform-specific failures: Multiple build failures and platform-specific bugs are reported, such as Windows build failures with small-icu, PPC64 assembler errors in LIEF, Linux x64 binaries failing on WSL1 due to segment alignment, and Node.js failing to start when /etc/ssl is inaccessible.
  • issues/58751, issues/62445, issues/63735, issues/62230

• Networking and protocol implementation issues: Problems include the HTTP proxy agent breaking WebSocket connections when using --use-env-proxy, TLS configuration errors where setting @SECLEVEL=0 does not enable TLSv1, and bugs in HTTP/2 and HTTP/3 session handling causing assertion failures or improper stream resets.
  • issues/62054, issues/60569, issues/61304, issues/65441

• Documentation and naming consistency improvements: There are requests to improve documentation clarity and naming conventions, such as renaming GitHub workflow files for consistency, clarifying keepAlive option behavior in HTTP/net servers, and adding mentions of useful modules like node:stream/consumers in main docs.
  • issues/50546, issues/61850, issues/62535

• Regular expression and string handling bugs: Issues include problematic non-linear backtracking in regex causing performance issues, inconsistent querystring parsing and stringifying of malformed Unicode, and bugs in util.stripVTControlCharacters() failing to strip certain OSC 8 hyperlink sequences properly.
  • issues/61904, issues/62814, issues/64313

• Test coverage and reporting limitations: The test coverage tool does not exclude dotfiles by default as intended, and the JUnit reporter truncates XML and throws errors when handling empty diagnostic messages, affecting CI integrations.
  • issues/63397, issues/65355

• Socket and domain socket feature requests and bugs: Requests include adding support for Unix domain datagram sockets and AF_CAN (SocketCAN) sockets for Linux, while bugs include flaky IPv6-only listen tests due to IPv4 port collisions and inability to reopen Windows console input as raw TTY when stdin is a pipe.
  • issues/61933, issues/62398, issues/64172, issues/63852

• AbortSignal and timeout handling issues: Problems include deprecating AbortSignal usage on resource APIs in favor of disposal protocols, and AbortSignal.timeout throwing RangeError on decimal inputs despite expectations to accept them.
  • issues/48725, issues/58592

• Miscellaneous API and runtime behavior bugs: These include dns.lookupService crashing on Buffer input, tls.connect() aborting process on malformed ALPNProtocols, ffi subsystem making native functions constructible incorrectly, and util.inspect failing on functions returned from getters.
  • issues/64877, issues/65069, issues/65183, issues/64838

2.5 Issue Discussion Insights

This section will analyze the tone and sentiment of discussions within this project's open and closed issues that occurred within the past week. It aims to identify potentially heated exchanges and to maintain a constructive project environment.

Based on our analysis, there are no instances of toxic discussions in the project's open or closed issues from the past week.

III. Pull Requests

3.1 Open Pull Requests

This section provides a summary of pull requests that were opened in the repository over the past week. The top three pull requests with the highest number of commits are highlighted as 'key' pull requests. Other pull requests are grouped based on similar characteristics for easier analysis. Up to 25 pull requests are displayed in this section, while any remaining pull requests beyond this limit are omitted for brevity.

Pull Requests Opened This Week: 77

Key Open Pull Requests

1. dtls: large update to the dtls implementation: This pull request is a comprehensive and logically structured large update to the DTLS implementation in Node.js, addressing numerous gaps in the initial transport functionality by enhancing error handling, session management, API surface, security features like PSK and SNI support, performance optimizations, and documentation improvements to provide a robust and complete DTLS module.

• URL: pull/65511

• Associated Commits: cc974, 57e0f, 21836, 82c18, 1f5f0, bfa94, 8dc04, 8ef12, 1e44b, a4bd7, 0d009, fb714, 910a8, a055d, d773d, 3d387, f4883, 2eae1, 8308e, 09026, b4828, 62751, f1a67, 8473c, 536ec, 86f30, d8fbf, 8e2d2, e9569, b6078, 97ae7, f171f, 1eb32, e2514, 9d68f, 6afaf, 1a159, c004a, e0437, 7988e, 07834, 948ab, 68c5f, 2132f, 355ea, f48cc, f742f, 0c0db, 062e0, 7b642, e0186, 9f41e, f9a0e, 6f274, 853c4, e26f7, 483c4, ce44c, bba2a, d2f00, 7947d, 16146, 5531b, 54b96, 088bf, af389, c35fb, 10066, 866c9, 3d18e, 71192, 6c9b4, 8674e, a7d66, 3e303, 06ba1, f442a, d9c4d, c3c5f, 3da12

2. permission: keep parent allowlist when Worker execArgv is empty: This pull request ensures that when creating a Worker with an explicitly empty execArgv array under the --permission flag, the Worker retains the parent process's filesystem allowlist and permission model flags, preventing unintended permission drops by intersecting or clamping the Worker's permission grants to those of the parent.

• URL: pull/65359

• Associated Commits: bca44, 9a7e3, abc76, 445a6, f89a4, 7d453, e1839

3. http2: fix write deadlock exposed by larger window sizes: This pull request fixes a real HTTP/2 write deadlock in Node.js caused by a now-exposed issue with larger window sizes by removing a redundant security guard that blocked reading while writing, thereby resolving test flakes, eliminating unreachable code, improving performance with up to a 25% throughput boost, and maintaining security through other existing mechanisms like maxSessionMemory.

• URL: pull/65440

• Associated Commits: 46498, a46d6, 364ed, a68ec

Other Open Pull Requests

• Crypto module enhancements and compatibility: This set of pull requests improves the Node.js crypto module by enabling discovery and caching of hashes, ciphers, and their aliases from OpenSSL 3 providers while maintaining backward compatibility and supporting new algorithm options and FIPS state transitions. Additionally, it removes obsolete BoringSSL shims, updates BoringSSL versions in tests, replaces custom cryptographic prechecks with native API calls, and optimizes key validation by using native FunctionTemplate brand checks for better performance and reliability.
  • pull/65484, pull/65483, pull/65503

• SQLite session and blob management improvements: These pull requests enhance SQLite integration by preventing session closing or disposal within callbacks to avoid use-after-free errors and segfaults, maintaining strong references to session objects during callbacks to prevent premature garbage collection, and adding an incremental blob I/O API that allows efficient reading and writing of ranges within a single BLOB or TEXT value without materializing the entire value. Error handling and resource disposal semantics are also improved in this area.
  • pull/65454, pull/65465, pull/65444

• WHATWG streams and web streams performance optimizations: These pull requests introduce multiple performance improvements to WHATWG streams by encoding whole chunks natively in TextEncoderStream and refactoring ReadableStream.from() to a more efficient callback style, eliminating async pull overhead. They also optimize web streams pipelines by processing CompressionStream chunks synchronously without threadpool round trips, implementing fast-path encoding, and removing obsolete error-handling hooks, resulting in significant benchmark improvements.
  • pull/65414, pull/65437

• Filesystem module enhancements and performance: These pull requests refactor fs.copyFile by unifying path validation and file URL handling into a single C++ binding shared across sync, callback, and promise APIs, fixing crashes related to file URLs with hostnames. They also implement a native glob functionality ported to C++ with AI assistance, improving speed and benchmarking, and enhance fs.cp() and fs.promises.cp() by moving directory tree walks to a single thread pool request and ensuring directory permissions are inherited, significantly boosting performance.
  • pull/65376, pull/65488, [pull/65483](https://github.com/pull/65483]

• V8 and JavaScript engine related updates: These pull requests update the return type of ModuleWrap::SyntheticModuleEvaluationStepsCallback to return a Promise in line with V8 API changes, defer JavaScript execution from V8 interrupt handlers in the Node.js inspector to preserve timing contracts, and add new configure options to enable or disable WebAssembly GDB remote debugging with LLDB support on major platforms.
  • pull/65375, pull/65397, pull/65356

• Diagnostics, monitoring, and debugging improvements: These pull requests add a built-in node:diagnostics_channel family for monitoring file system operations with detailed event channels, introduce an opt-in WPT_INSPECT mode for debugging Web Platform Tests running in child processes with inspector support, and improve test coverage reporting by excluding known directories from serialization and deserialization to save time.
  • pull/65370, pull/65510, pull/65371

• Security and permission model refinements: These pull requests refine the security vulnerability policy for experimental features gated by runtime flags by narrowing valid vulnerability reports to those impacting stable features and excluding complex, actively developed features like QUIC/H3 unless they affect stable functionality. They also enhance the permission model by adding checks to guard the adoption of UDP handles during IPC communication from parent to child processes.
  • pull/65438, pull/65358

• Performance and API improvements in URLPattern and stream transforms: These pull requests improve the performance of the WHATWG URLPattern constructor, test(), and exec() methods by eliminating unnecessary UTF-8 copies and optimizing key lookups, and normalize stateless transform results before passing them to subsequent transforms to ensure consistent Uint8Array[] batches in both synchronous and asynchronous pipelines.
  • pull/65364, pull/65367

• Child process and timer handling fixes: This pull request fixes the child_process module to clear the timeout timer not only on the 'exit' event but also on spawn-time errors like ENOENT, preventing the timer from keeping the event loop active unnecessarily after an error has been emitted.
  • pull/65506

3.2 Closed Pull Requests

This section provides a summary of pull requests that were closed in the repository over the past week. The top three pull requests with the highest number of commits are highlighted as 'key' pull requests. Other pull requests are grouped based on similar characteristics for easier analysis. Up to 25 pull requests are displayed in this section, while any remaining pull requests beyond this limit are omitted for brevity.

Pull Requests Closed This Week: 162

Key Closed Pull Requests

1. V22.23.2 proposal: This pull request is a proposal for the Node.js version 22.23.2 "Jod" (LTS) release, detailing notable changes including an update to root certificates to NSS 3.123.1 and various fixes and improvements across multiple subsystems such as crypto, benchmark, buffer, build, child_process, and others, although it was ultimately not merged.

• URL: pull/64567

• Associated Commits: f1635, abf0a, 7eec8, 5d0a1, 7d679, afb72, 03f41, 26312, 8be50, 6501e, 4106f, 90548, 8ec00, 861fb, b4201, 4da5c, 02061, 956d8, 5c4d6, 775ae, 831b9, aab80, cd636, 0e103, 80d65, 2308c, eb88e, b933e, a8933, eb3d1, 6e532, 98c53, 52a36, 78c76, cfeaa, ed7c6, 46f24, cd694, 289e7, 15a79, e7bf3, 7a294, 020d2, 38984, 49cc3, 2d4e3, 979e0, c4e51, d2754, b60f3, 7748f, ced02, d11fb, f417a, 5ca31, cb75e, d9962, 2377e, 86f5f, c5870, 3e8ad, 6018b, 6eeef, f5e11, 9e6df, fbfbc, 7ea1b, 5dca7, fb078, df6e2, 9b190, 7fc38, f0982, 5e84a, 90161, 48322, 0a704, 9cc46, 885f2, 19a1e, a3097, d30f9, 7f78d, b27b8, ab955, fb0e8, 29d5a, 33b0b, b9945, 94e87, 5e40c, 5ff84, fff43, 207d6, f2a14, 8198b, c1432, dae96, 90f90, 35784, bfb7f, 12a37, 2238a, 04e1e, f3708, 558d2, dcbb7, 2e5ea, 3bc2b, 737db, faa6d, a77a3, c4c94, 1878e, 53fe5, b86fb, e9e73, 0e83b, 0a8aa, 521f5, de8e6, ddc8f, 0454a, 16db5, b9d77, aafbd, 56903, 6963d, fdac5, 9e1a0, 8ece7, b4fce, 67e64, e32b0, 434fe, e2278, 782b7, d3a7b, e7f59, 8931c, 94080, d7d6f, e1df7, 2ffb9, 96800, 5a9b8, 75b0b, a0b97, da3ac, 99ff8, 1a2ed, 9a26d, ff7b0, 46258, eaa81, 70668, 7ea06, 4226f, 78bf3, c3372, a1495, ffe86, cac00, f83f1, b1043, 6e1e1, 457ad, 694c1, b1fda, 47921, 8a5d5, 07877, 830dd, cd829, 0bc4e, 65839, f84f4, b943a, 8450c, f0569, 1b042, 39826, 1efbb, 7bd09, 7073f, 5c582, 9fc3e, 51609, 18705, 89650, d2ae0, ac2f8, 93bd6, 530ec, 58241, 971bc, 64ff4, c12b3, 98057, daa64, f54cd, 158f5, 3dbf6, 7590f, 73dae, 377cb, 2ef79, e3b53, de3b1, 6c5d1, e30f8, c6780, 83ca1, 1060f, 4ed89, 0320e, faf83, a60aa, 20c6e, 29048, 20ca3, 2c91e, 5facf, f159a, 310f6, 02492, f0a40, b131f, 7f115, 2dfd7, e739f, 693c4, fd1be, a7c40, 5240c, 633b8, cb597, 4a6fb, f9573, 88fff, f1f7c, 61bae, 30c40, 7929e, a0ab4, 5c5da, 0b80e, 26607, a6b3a, 74391

2. fs: extend signal option to lstat, fstat and promises API: This pull request extends the AbortSignal support to the fs.lstat, fs.fstat, and related promises API methods in Node.js, enabling these file system operations to be aborted mid-flight, thereby achieving feature parity with fs.stat and improving control over asynchronous file status checks.

• URL: pull/63143

• Associated Commits: ad92c, aabb7, 78e9f, 919bc, b4289, 8b582, 649d7, 8f92f, f2bac, 86d82

3. tty: add raw-vt and io raw modes: This pull request enhances the tty.ReadStream#setRawMode() method by adding support for selecting specific raw modes—'raw' for the existing Node raw mode and 'io' for a binary-safe I/O mode on Unix—while preserving the original boolean behavior, exposing the current mode via readStream.rawMode, rejecting unknown string modes, and aligning with libuv's UV_TTY_MODE_IO semantics to address output-processing distinctions.

• URL: pull/64140

• Associated Commits: 812d2, e0d8b, 1c0e5, 15fdb, 7af5c, ed187, 8bbfd, 5da06, 3a851, f94af

Other Closed Pull Requests

• stripVTControlCharacters function fix: This pull request updates the stripVTControlCharacters() function in the util module to use a more generic matching pattern for OSC 8 hyperlink sequences, aligning with ansi-regex v6.2.0. This change correctly strips hyperlinks containing RFC 3986-valid characters like parentheses and brackets that were previously mishandled due to a restrictive URI character class in the regex.
  • pull/64319

• QUIC module and nghttp2 compatibility: This pull request prepares Node.js for the upcoming nghttp2 version 2 callback and stream closing function by adapting the QUIC module to the new nghttp3_conn_close_stream2 interface. It also includes lint fixes and improvements to maintain compatibility and code quality.
  • pull/64574

• Permission auditing backport and enhancements: This pull request backports multiple permission-related updates to the v24 branch, including a new --permission-audit flag for warning-only permission checks, improvements to permission drop functionality, fixes to permission denial in audit mode, expanded documentation, and unique warning codes for permission-related security warnings.
  • pull/65354

• nix-changes tool coverage and refactoring: This pull request improves the nix-changes tool by tracking dependencies related to disabled-by-default features, conditional shared dependencies, and V8-specific components. It refactors the logic into a separate, lintable script to enhance readability and remove a previous workaround.
  • pull/65403

• llms.txt module description enhancement: This pull request adds llm_description YAML nodes to the llms.txt module descriptions to provide more meaningful and structured documentation entries, improving upon the previous implementation that relied on these nodes or the first paragraph of the module documentation.
  • pull/59264

• Test runner statement coverage support: This pull request introduces statement coverage support by parsing source files with acorn to extract AST statement nodes and mapping V8 coverage ranges to these statements. It adds a --test-coverage-statements CLI option, updates coverage reporting to include statement metrics, and ensures graceful degradation for unparseable files.
  • pull/62340

• TLS module ALPNProtocols input validation: This pull request changes the TLS module to throw a recoverable JavaScript exception (ERR_INVALID_ARG_VALUE) for invalid ALPNProtocols inputs instead of aborting the process. It preserves support for valid inputs and improves input validation in both client and server contexts.
  • pull/65076

• Documentation tooling dependency updates: This pull request updates documentation tooling dependencies by bumping undici from 6.27.0 to 6.28.0, upgrading brace-expansion to 1.1.18, and upgrading @node-core/doc-kit from 1.4.1 to 2.0.0 to incorporate latest features and breaking changes.
  • pull/65474

• Source maps error handling fix: This pull request fixes an ERR_INVALID_ARG_TYPE error when using --enable-source-maps without a source map by making getErrorSourceLocation() fall back to the raw generated source line. It adds tests for .mjs and .cjs files to verify this behavior.
  • pull/63215

• AbortSignal cleanup documentation update: This pull request updates documentation to advise against cleaning up AbortSignal instances for long-lived resources, improving guidance on resource management.
  • pull/64342

• Test runner dot reporter coverage improvements: This pull request enhances the dot reporter by adding coverage and diagnostic output for coverage threshold failures, providing detailed failure reasons and coverage reports consistent with the spec reporter.
  • pull/61423

• Timer mocks benchmarking additions: This pull request adds benchmarks for Node.js focusing on --test-only mode and various mock timer functionalities, including mocked setTimeout, setInterval, setImmediate, scheduler.wait, AbortSignal.timeout, mocked Date.now(), and timer control methods.
  • pull/64097

• Commit Queue failure comment improvements: This pull request improves Commit Queue failure comments by surfacing concise, actionable reasons and recovery steps before the full output, enhancing clarity and retry instructions for contributors.
  • pull/65433

• ESM data URL MIME regex update: This pull request updates ESM data URL MIME extraction regexes to remove overlapping quantifiers causing super-linear backtracking, preserving behavior while preventing performance issues on crafted inputs. It includes regression tests and benchmarks.
  • pull/61951

• Crypto module cache invalidation fix: This pull request fixes cache invalidation for getCiphers() and getHashes() after calls to setFips() or setEngine() by replacing memoization with manual cache variables and adding a cache eviction function triggered on state changes.
  • pull/62985

• Crypto module SIV and GCM-SIV mode enablement: This pull request enables SIV and GCM-SIV encryption modes in the Cipher and Decipher APIs, enhancing cryptographic capabilities.
  • pull/63411

• Transform streams backpressure and performance improvements: This pull request improves transform streams by replacing promise records with direct continuation delivery, aligning performTransform with reference promise behavior, and adding a pipe-through benchmark. It achieves up to ~14% throughput improvements while maintaining correctness.
  • pull/65143

• Test runner run() options fix for isolation="none": This pull request fixes an issue where run() with isolation="none" ignored options like testNamePatterns, testSkipPatterns, and only. It ensures these options override globalOptions and take effect without relying on CLI flag parsing.
  • pull/62269

• fs.cp symlink type preservation on Windows: This pull request fixes fs.cp and fs.cpSync to correctly preserve directory symlink types when called with verbatimSymlinks: true and a filter on Windows by explicitly detecting and passing the symlink type to symlink calls. It includes regression tests.
  • pull/62654

• FileHandle close listener removal for autoClose=false streams: This pull request removes an extra FileHandle close listener that can persist in streams created with autoClose: false, ensuring proper release of listeners and references when streams finish or close independently. Default behavior for autoClose: true streams is maintained.
  • pull/64229

• Removal of --no-experimental-websocket CLI flag: This pull request removes the --no-experimental-websocket CLI flag, indicating the experimental WebSocket feature is no longer optional or experimental.
  • pull/65284

• Memory management improvements with std::unique_ptr: This pull request improves memory management by replacing multiple manual new/delete pointer usages with safer and more consistent use of std::unique_ptr.
  • pull/65348

• Removal of obsolete BoringSSL shims: This pull request removes obsolete BoringSSL shims by using current RSA and DH validation APIs, reporting negotiated TLS groups and security levels via compatibility APIs, eliminating unused ClientHello helpers, and consolidating secure heap management.
  • pull/65423

• Performance improvement by replacing startsWith/endsWith: This pull request replaces startsWith and endsWith method calls with bracket notation for single-character checks to enhance performance and prevent potential prototype pollution.
  • pull/61500

3.3 Pull Request Discussion Insights

This section will analyze the tone and sentiment of discussions within this project's open and closed pull requests that occurred within the past week. It aims to identify potentially heated exchanges and to maintain a constructive project environment.

Based on our analysis, there are no instances of toxic discussions in the project's open or closed pull requests from the past week.

IV. Contributors

4.1 Contributors

Active Contributors:

We consider an active contributor in this project to be any contributor who has made at least 1 commit, opened at least 1 issue, created at least 1 pull request, or made more than 2 comments in the last month.

If there are more than 10 active contributors, the list is truncated to the top 10 based on contribution metrics for better clarity.