Weekly GitHub Report for Node: January 20, 2025 - January 27, 2025
Weekly GitHub Report for Node
Thank you for subscribing to our weekly newsletter! Each week, we deliver a comprehensive summary of your GitHub project's latest activity right to your inbox, including an overview of your project's issues, pull requests, contributors, and commit activity.
Table of Contents
I. News
1.1 Recent Version Releases:
The current version of this repository is v23.6.1
1.2 Version Information:
Released on January 21, 2025, this security update addresses several vulnerabilities, including a high-severity issue (CVE-2025-23083) related to InternalWorker use with the permission model enabled, and medium-severity issues such as an HTTP2 memory leak (CVE-2025-23085) and a path traversal vulnerability on Windows (CVE-2025-23084). Additionally, it updates the undici dependency to mitigate the use of insufficiently random values (CVE-2025-22150).
II. Issues
2.1 Top 5 Active Issues:
We consider active issues to be issues that that have been commented on most frequently within the last week. Bot comments are omitted.
-
Tracking issue: require(esm): This issue is about tracking the progress and tasks required to unflag and stabilize the
require(esm)feature in Node.js, which involves addressing default export interoperability, conditional exports, and module customization hooks. It also includes a list of bug fixes, changes, and related features that need consideration for backporting to different Node.js versions, along with a request for better documentation on publishing packages in the post-require-esm era.- The comments discuss the potential backporting of the
require(esm)feature to older Node.js versions, with some users expressing interest in backporting to Node 18, although it is noted that this would be challenging due to its maintenance phase. There are discussions about implementing conditional exports recognized by bundlers, and the need for testing and npm crawling to avoid conflicts. Some users raise concerns about the feature's interaction with existing module loading mechanisms, and there is a mention of a bug report related torequire(esm)bypassing customization hooks, with suggestions to usemodule.registerHooks()for better coverage. - Number of comments this week: 6
- The comments discuss the potential backporting of the
-
Chrome devtools console method autocompletion for node is not working: This issue is about the autocompletion feature in Chrome DevTools not working for Node.js when using the "global." command, which is expected to display a list of methods but fails to do so in the specified environment. The problem is consistently reproducible on Windows 10 with Node.js version 22.13.0 and Chrome version 132.0.6834.84, and it has been identified as a Node.js issue rather than a Chrome issue.
- The comments discuss attempts to reproduce the issue, with some users unable to replicate it under certain conditions. Suggestions are made to ensure the Node.js process is not in a busy loop, and clarifications are provided that the issue occurs even when the process is idling. A request for a reproduction script is made, but the original poster clarifies that the issue can be reproduced with a simple "node --inspect" command.
- Number of comments this week: 6
-
Promise readline question results in unsettled promise on abortion: This issue describes a bug in the Node.js
readline/promisesmodule where a promise remains unsettled when a user aborts areadlinequestion using SIGINT or Ctrl+D, leading to an uncatchable warning. The expected behavior is for the promise to settle upon areadlineclose event, but instead, the promise remains unresolved, causing a warning about an unsettled top-level await.- The comments discuss the behavior of exit codes and signal handling in Node.js, with users sharing code snippets and observations. One user offers to work on the issue, while another points out that
rl.question()accepts anAbortSignal, but it doesn't work as expected due tocreateInterfacehijacking the SIGINT signal. A solution is suggested to handle SIGINT on the readline interface instead of the process, which resolves the issue, leading to a consensus that the behavior is intended but could benefit from clearer documentation. - Number of comments this week: 5
- The comments discuss the behavior of exit codes and signal handling in Node.js, with users sharing code snippets and observations. One user offers to work on the issue, while another points out that
-
HTTP 449 error sending request from node version 17 and above: This issue involves a persistent HTTP 449 error encountered when sending requests using Node.js version 17 and above, which is expected to return a status code of 200. The problem seems to be related to the TLS cipher list and possibly the OpenSSL version used in these Node.js versions, as altering the cipher list or removing the server name can sometimes resolve the issue.
- The comments discuss various attempts to reproduce the issue, with some users able to replicate the error and others not, suggesting network or server configuration differences. The discussion explores potential causes, including TLS negotiation and server misconfiguration, with some users pointing to specific cipher settings as a possible culprit. There is also a debate on whether the issue is with Node.js or the server, with some users suggesting that the server's behavior is non-standard.
- Number of comments this week: 4
-
Allow Setting Extension Priority (and Then Not Requiring Extensions in Imports): This issue proposes a feature for Node.js that would allow developers to set a priority for file extensions, enabling extension-less imports while maintaining the benefits of recent Node.js features. The feature suggests using a command-line flag to prioritize extensions, which would streamline the import process by automatically appending the appropriate file extension based on the specified priority.
- The comments discuss the potential drawbacks of the proposed feature, such as increased file system overhead and the risk of creating inconsistent behavior across different environments. Some commenters express concerns about the practicality and efficiency of extension guessing, while others suggest that if implemented as an optional flag, it could be acceptable. There is also a discussion about the trade-offs between convenience and performance, with some users willing to accept a slight delay for the benefit of extension-less imports.
- Number of comments this week: 4
2.2 Top 5 Stale Issues:
We consider stale issues to be issues that has had no activity within the last 30 days. The team should work together to get these issues resolved and closed as soon as possible.
As of our latest update, there are no stale issues for the project this week.
2.3 Open Issues
This section lists, groups, and then summarizes issues that were created within the last week in the repository.
Issues Opened This Week: 28
Summarized Issues:
- File Extension Priority in Node.js Imports: This issue proposes a feature for Node.js to allow developers to set a priority for file extensions, enabling extension-less imports by automatically appending extensions like
.js,.jsx,.ts, and.tsxin a specified order. This enhancement aims to improve developer convenience without sacrificing functionality.
- Null Pointer Dereference in Node.js Crypto Subsystem: Multiple issues highlight potential null pointer dereferences in the Node.js crypto subsystem, such as in
TLSWrap::PskClientCallbackandNewRootCertStorefunctions. These issues suggest adding nullptr checks to prevent dereferencing issues and ensure consistent API behavior.
- Bugs in Node.js Debug and Crypto Utilities: Bugs in Node.js include incorrect evaluation of enum values as boolean expressions in
ToStringHelperlogic and uninitialized fields inRSACipherConfigclass. These issues suggest usingstd::is_enum_vand setting default values to resolve these problems.
- Filesystem and Encoding Issues in Node.js: Node.js faces issues with the
FSReqWrapSyncclass not initializing fields and problems with non-ASCII file paths on Japanese Windows systems using Shift-JIS encoding. These bugs lead to uninitialized pointers and process exit errors, respectively.
- Node.js Version Compatibility and Environment Loading: Issues arise with Node.js versions 23.6.0 and 22.13.0 causing errors in Visual Studio Code, and environment variables not loading due to spaces or tabs in preceding blank lines. These problems suggest potential bugs or compatibility issues with newer Node.js versions.
- Documentation and Stream Module Discrepancies in Node.js: Discrepancies in Node.js include inaccurate documentation of the
util.debuglogfunction and Readable streams not starting in paused mode as expected. These issues lead to confusion and behavior contrary to documentation.
- HTTP Subsystem Bugs in Node.js: Bugs in the Node.js HTTP subsystem include missing
Content-Lengthheaders inHEADrequests and unexpected body consumption. These issues result in discrepancies in expected server responses and missing headers in HTTP/2 client responses.
- Node.js Installation and OpenSSL Version Issues: Node.js installation scripts face GPG key verification failures due to unavailable keys, and users experience discrepancies between linked and installed OpenSSL versions. These issues raise questions about key removal and building with different OpenSSL versions.
- Node.js Test Failures and Flaky Tests: Test failures in Node.js include
parallel/test-buffer-tostring-rangeon SmartOS and flaky tests like "parallel.test-tls-min-max-version" and "test-without-async-context-frame" on Windows x64. These issues block releases and indicate broader problems affecting test stability.
- Node.js Feature Proposals and Enhancements: Proposals for Node.js include adding a
--skip-initial-runflag to--watchmode and a REPL feature to reset variables. These enhancements aim to provide greater flexibility and resolve errors without restarting sessions.
- Node.js Locale and Date Function Discrepancies: Discrepancies in Node.js include regression in
Intl.DateTimeFormat.format()for the Finnish locale and differingDate.UTCfunction outputs. These issues result in unexpected formats and seek clarification on expected behavior.
- Node.js Test Module and Assignment Checks: Enhancements in Node.js involve ensuring test plans are fully met and adding self-assignment checks in constructors. These improvements aim to prevent hanging tests and unnecessary
memcpycalls.
- Node.js OpenSSL Support Considerations: Discussions in Node.js consider dropping support for OpenSSL versions earlier than 3, with varying opinions on maintaining support for version 1.1.1. These considerations weigh extended support and performance advantages against newer versions.
2.4 Closed Issues
This section lists, groups, and then summarizes issues that were closed within the last week in the repository. This section also links the associated pull requests if applicable.
Issues Closed This Week: 24
Summarized Issues:
- Node.js Windows Path Issues: Node.js on Windows encounters problems with file paths, such as failing to execute when a space is escaped with a caret instead of quotes, leading to module resolution errors. Additionally, segmentation faults occur with Japanese characters in file paths using
createRequire, affecting tools like eslint.
- Permission and Security Concerns in Node.js: There are several issues related to permissions and security, including the need for a warning system when full file system access is granted and the use of Node.js's permission API to restrict imports to specific npm packages. These measures aim to prevent security vulnerabilities and control code execution.
- Node.js Test Failures and Flakiness: Various tests in Node.js exhibit failures and flakiness, such as the
pummel.test-hash-seedtest on RHEL8 and the "parallel:test-runner-module-mocking" test on Windows x64. These issues are often due to platform-specific conditions or recent updates affecting test environments.
- Node.js Build and Compilation Issues: Node.js faces build failures with GCC version 15 due to undefined types, requiring explicit includes to resolve. Additionally, a proposal for a TypeScript compilation cache aims to improve startup performance by avoiding redundant recompilation.
- Dynamic Import and Module Resolution Problems: Issues with dynamic imports and module resolution include promises returning from the main realm's intrinsic Promise and incorrect resolution of the 'openai' package. These problems disrupt test case isolation and expected module behavior.
- Node.js Documentation and Code Updates: Updates are needed in Node.js documentation to reflect changes in WeakSets and WeakMaps behavior. Additionally, code fixes are required for issues like the HTTP2 client setting TLS ServerName to an IP address, which is not permitted by RFC 6066.
- Node.js Error Handling and Bug Fixes: Node.js encounters various errors, such as unhandled promise rejections in React Native iOS projects and bugs in the
dotenvsubsystem. These issues require specific fixes to prevent disruptions in development and application execution.
- Node.js Compression and File Loading Enhancements: Enhancements are proposed for Node.js, including adding Brotli 1.1.0 bindings for compression dictionary support and a custom loader script for loading files without the
.jsextension. These improvements aim to expand functionality and compatibility.
- Node.js Test Runner and Error Reporting: The
spectest runner reporter in Node.js prints identical error messages twice, leading to verbose output. A solution is proposed to print each failure detail only once, improving readability and focus during development.
- Node.js CommonJS Loader and Coverity Issues: The CommonJS loader hook in Node.js does not utilize modified URLs, preventing URL alterations in the loading process. Additionally, Coverity detects issues in the
ncryptomodule, including resource leaks and logically dead code.
- Node.js Command Line and Execution Errors: Node.js v23.6.1 encounters syntax and execution format errors in a WSL2 environment, disrupting expected command behavior. This issue highlights compatibility challenges with newer Node.js versions and specific environments.
- Node.js Placeholder and Mistaken Entries: A placeholder or mistakenly created entry in the Node.js GitHub project lacks a descriptive title or body, indicating a need for better issue management and entry validation.
2.5 Issue Discussion Insights
This section will analyze the tone and sentiment of discussions within this project's open and closed issues that occurred within the past week. It aims to identify potentially heated exchanges and to maintain a constructive project environment.
Based on our analysis, there are no instances of toxic discussions in the project's open or closed issues from the past week.
III. Pull Requests
3.1 Open Pull Requests
This section provides a summary of pull requests that were opened in the repository over the past week. The top three pull requests with the highest number of commits are highlighted as 'key' pull requests. All other pull requests are grouped based on similar characteristics for easier analysis.
Pull Requests Opened This Week: 31
Key Open Pull Requests
1. v20.18.3 proposal: This pull request proposes the release of Node.js version 20.18.3, codenamed 'Iron', which includes notable changes such as marking import attributes and JSON modules as stable, merging module configuration with package_json_reader, moving the package resolver to C++, adding simdjson as a dependency, updating root certificates, and various documentation updates, among other improvements and fixes.
- URL: pull/56699
- Merged: No
- Associated Commits: d50c5, c8bf8, 38dc5, 310c4, d764f, 3e05e, 5c90e, f1549, 04628, 535aa, 4b1a7, 94f74, 5c49e, 6f10f, caf09, b44c2, ad7bc, a90bc, 0459c, b0172, aeb48, 3bcdf, a1c85, bec83, 7fcba, f6f89, 7e000, 9e19a, bc445, e954e, eb5f7, 5bf61, 2f015, da76a, 43abc, 595e7, ec8d1
2. http: return Content-Length header for HEADs: This pull request addresses an issue in the Node.js HTTP library by ensuring that the Content-Length header is returned for HEAD requests, even when the response does not include a body, thereby fixing issue #56680 and including several commits that add tests to verify the correct behavior.
- URL: pull/56681
- Merged: No
3. doc: improve accessibility of expandable lists: This pull request aims to enhance the accessibility of expandable lists by focusing the first link in the list for screen reader users, removing unnecessary focusability on the wrapping div, and fixing keyboard navigation when JavaScript is disabled.
- URL: pull/56749
- Merged: No
Other Open Pull Requests
- Dependency Updates: The Node.js project has updated its simdjson dependency to version 3.11.6. This update involved running a manual script to ensure the process completes correctly, even if the current version matches the new one, with the expectation that no file changes occur.
- Test Runner Enhancements: The test runner in Node.js has been improved by removing Promise return values from certain APIs. This change ensures subtests automatically wait to finish, providing a more consistent experience without explicit awaiting.
- Continuous Integration Improvements: Enhancements to the CI process include enabling ccache on Windows for Clang, replacing clcache, and adding a new vcbuild option for specifying the ccache directory. These changes address issues with V8-generated header files and update documentation to support the transition.
- Test and Code Quality Improvements: Several pull requests focus on improving test and code quality in Node.js. These include fixing the
require.resolvefunction, eliminating redundancy in test reporter specifications, and using strict mode in test files to ensure correct error handling.
- Flaky Test Management: Node.js has addressed flaky tests by marking certain tests as unreliable or skipping them on specific platforms. This includes marking the "test-without-async-context-frame" as unreliable and skipping the "test-buffer-tostring-range" on SmartOS.
- Documentation Updates: Documentation updates include adding notes about commit message trailers and features using
InternalWorkerwith the permission model. These updates aim to provide clarity and additional context for developers.
- Security and Stability Enhancements: Security and stability have been enhanced by modifying the
util.inspectfunction to prevent crashes and updating theerrno.hheader to address the deprecation of theENODATAmacro. These changes ensure better handling of edge cases and deprecated features.
- Test Optimization: Test optimizations include eliminating internal dependencies in test files and reducing unnecessary buffer allocations. These changes streamline the code and improve test efficiency.
- Bug Fixes and Feature Enhancements: Bug fixes and feature enhancements include adding nullptr handling in OpenSSL functions, checking Bignum in specific functions, and enforcing colorization in style text arrays. These changes address specific issues and improve functionality.
- Performance and Accessibility Improvements: Performance improvements include refactoring the
emitmethod for better error handling and reducing written chunks to minimize write errors. Accessibility enhancements involve adding a "Skip to content" button for better screen reader support.
- Network and Connection Handling: Network handling improvements include temporarily increasing the
network_family_autoselection_attempt_timeoutto support parallel connections. This change aims to prevent connection closures and will be reverted once parallel connections are fully implemented.
- Debugging and Inspection Enhancements: Support for inspecting worker threads in Chrome DevTools has been introduced. This feature utilizes the
attachedToTargetevent, allowing developers to debug worker threads in Node.js environments.
- Shell Invocation Validation: The
child_processmodule has been enhanced by validating theoptions.shellparameter. This ensures correct enforcement of shell invocation inexecandexecSyncfunctions, with added test cases for validation.
- V8 Bug Fix Backporting: Several V8 bug fixes related to the compile cache have been backported to the v20.x branch. These fixes facilitate the backporting of the
require(esm)feature and enhance functionalities likecompileFunction()andimport()when using code cache.
3.2 Closed Pull Requests
This section provides a summary of pull requests that were closed in the repository over the past week. The top three pull requests with the highest number of commits are highlighted as 'key' pull requests. All other pull requests are grouped based on similar characteristics for easier analysis.
Pull Requests Closed This Week: 56
Key Closed Pull Requests
1. [v20.x] backport unflagging of require(esm), part 1 (of 4?): This pull request involves backporting the unflagging of require(esm) to the v20.x branch of Node.js, following a detailed worklist to ensure all relevant code path changes are included while omitting unnecessary or incompatible changes, and it introduces a semver-minor change to support NODE_COMPILE_CACHE, which is considered safe for backporting.
- URL: pull/56730
- Merged: No
- Associated Commits: 5dfcc, 2a772, b6343, 3f4d4, 0035c, e7553, d64b1, 9ec64, 0e84b, 75359, 75171, 11eac, 78a94, 3cf5b, c65fc, 9fb3a, af259, f7f5c, acd94, c0293, 76ae9, 55918, 282e6, c8e04, af204, f09fb, 62b86, 266ad, c954b, 90a23, c910e, 3c65c, 0077c, 8a20f, 4c75a, b62a2, 236ab, b2ced, ea557, e7356, c6112, 5cb2a, c94e7, c987b, 31aaa, 0fb5d, 95ca8, 86143, c2165, 3cc94, 92315, 146af, 8d584, f95ce, 327f1, bc780, d4355, 0e872, 3fc15, b2c29, e26c6, 56d74, cbccc, 3945b, fe04f, f7c4a, 1eee3, 03c03, 93fdd, 2ba82, 60805, da379, 0d791, e614c, 72347, e9f25, 0789d, b406b, 00222, 8a6e4, 3ff8e, 92460, 5b77b, 9c370, 87ff1, e0325, ffb0d, afa44, 24326, b2b50, 0751a, e1c4f, aceb0, 97ffe, fbb86, e0015, 9ebf3, 98e02, f41aa, 6173c, 155e4, 093fb, 8ba8b, c237b, bc3a0, 06808, 31839, e152f, 47617, 5e3f2, a4445, dde58, f985e, 69bd8, ab1e7, 32f0e, e8943, ded14, 38590, d795e, 07aad, 0e0d6, 86341, 0ae1c, 9c34e, 87047, a8f2e, 07252, e058f, 795b2, 8bbf8, c7af5, c88e2, 01687, aa07b, bfbf5, dc6ac, e8db1, 40abc, 9cb8d, d3e93, e2198, c6dec, 512d9, 578dc, 65b8c, 14983, 957c7, 97e90, 63fa8, c9c8d, 69ec7, 175fc, ae4d2, 06373, 19e38, c54dc, 014aa, 54a59, 06943, 91a6e, f384a, 5cd34, cc70e, fc11e, cf6d3, fa821, b4cc5, b04ab, c48b7, ee89f, 4644b, d803f, 3aa28, 2b6bd, c7a58, c9537, 548c3, 1cc70, bfb1e, ffe3d, 0f1d2, 30019, 19801, f9d16, 18fbc, e08e4, 23d66, f6632, df3d4, dbe04, c68a5, 1e379, 1103e, 1dc2a, a4b37, 5419e, fb24e, e2e22, 7ce09, a2f06, 5f0c8, 4b779, f508e, 5733a, 87c2d, d229a, 4e180, 567f5, ce533, f7c13, 4c077, f9a4e, 46008, 62133, d6790, cc7d1, 0a046, c5ee9, d61c8, df151, 94fe8, 50ad8, 40034, 2abdc, df97c, 6f26c, 32844, 5ac76, 196a6, 6cfdb, 35e18, 988f8, d56bf, 49aa6, 5d03f
2. module: fixing url change in load sync hook chain: This pull request addresses a URL change issue in the load sync hook chain of a module, as referenced in issue #56376, by implementing several commits that include fixes for URL rewriting, test improvements, and linting adjustments, although it was ultimately not merged.
- URL: pull/56402
- Merged: No
3. [v20.x backport] src: move package_json_reader cache to c++ : This pull request attempts to backport changes from a previous pull request to the Node.js v20.x branch by moving the package_json_reader cache to C++ in order to reduce conflicts when backporting the require(esm) feature, and includes several commits related to adding simdjson, moving the package resolver to C++, and merging configuration with package_json_reader.
- URL: pull/56590
- Merged: No
Other Closed Pull Requests
- Refactoring and Code Simplification: Several pull requests focus on refactoring and simplifying code to enhance readability and performance. These include changes to the
test-event-emitter-num-argsfile, simplification of thecommon/index.js, and refactoring of stdio in worker threads. The aim is to improve code maintainability and execution efficiency by reducing dependencies and optimizing operations.
- Backporting and Security Fixes: Multiple pull requests involve backporting changes and addressing security vulnerabilities. These include marking import attributes as stable, addressing a security vulnerability in V8, and backporting documentation updates for the permission model. These efforts ensure that older versions of Node.js remain secure and up-to-date with the latest features.
- Documentation Updates: Several pull requests focus on updating documentation to reflect current behaviors and correct errors. These include updates for
WeakMapandWeakSetcomparison details, adding historical information for the permission model, and correcting typos in example code. These updates help maintain accurate and helpful documentation for developers.
- Bug Fixes and Enhancements: Various pull requests address specific bugs and enhance functionality. These include fixing server name omission in HTTP2, resolving segmentation faults in module resolution, and improving shell invocation validation. These changes aim to improve the stability and reliability of Node.js.
- Testing and CI Improvements: Some pull requests focus on enhancing testing and continuous integration processes. These include adding missing tests, updating test files to remove dependencies, and addressing flaky tests. These improvements help ensure robust testing and reliable CI workflows.
3.3 Pull Request Discussion Insights
This section will analyze the tone and sentiment of discussions within this project's open and closed pull requests that occurred within the past week. It aims to identify potentially heated exchanges and to maintain a constructive project environment.
Based on our analysis, there are no instances of toxic discussions in the project's open or closed pull requests from the past week.
IV. Contributors
4.1 Contributors
Active Contributors:
We consider an active contributor in this project to be any contributor who has made at least 1 commit, opened at least 1 issue, created at least 1 pull request, or made more than 2 comments in the last month.
If there are more than 10 active contributors, the list is truncated to the top 10 based on contribution metrics for better clarity.
| Contributor | Commits | Pull Requests | Issues | Comments |
|---|---|---|---|---|
| jasnell | 91 | 22 | 5 | 164 |
| aduh95 | 89 | 24 | 2 | 50 |
| cjihrig | 43 | 13 | 0 | 94 |
| joyeecheung | 40 | 10 | 1 | 88 |
| RafaelGSS | 69 | 13 | 0 | 15 |
| anonrig | 16 | 1 | 0 | 68 |
| legendecas | 34 | 9 | 0 | 33 |
| pmarchini | 22 | 5 | 0 | 43 |
| marco-ippolito | 28 | 6 | 2 | 26 |
| timja | 34 | 1 | 0 | 27 |