Weekly GitHub Report for Node

Thank you for subscribing to our weekly newsletter! Each week, we deliver a comprehensive summary of your GitHub project's latest activity right to your inbox, including an overview of your project's issues, pull requests, contributors, and commit activity.

Table of Contents

• I. News
  • 1.1. Recent Version Releases
  • 1.2. Other Noteworthy Updates
• II. Issues
  • 2.1. Top 5 Active Issues
  • 2.2. Top 5 Stale Issues
  • 2.3. Open Issues
  • 2.4. Closed Issues
  • 2.5. Issue Discussion Insights

• III. Pull Requests
  • 3.1. Open Pull Requests
  • 3.2. Closed Pull Requests
  • 3.3. Pull Request Discussion Insights

• IV. Contributors
  • 4.1. Contributors

I. News

1.1 Recent Version Releases:

The current version of this repository is v23.10.0

1.2 Version Information:

Released on March 13, 2025, this version introduces the --experimental-config-file feature, allowing developers to use JSON configuration files to simplify flag management for the test runner and other experimental features, enhancing developer experience. Additionally, it includes updates to root certificates, new TLS and V8 methods, improved error handling, and various tooling and documentation enhancements.

II. Issues

2.1 Top 5 Active Issues:

We consider active issues to be issues that that have been commented on most frequently within the last week. Bot comments are omitted.

1. Yarn PnP: require.cache and require.extensions are undefined in dependencies (regression in v22.22.3): This issue reports a regression in Node.js versions 22.22.3 through 22.23.1 where Yarn Plug'n'Play (PnP) causes require.cache and require.extensions to be undefined in dependencies, leading to build failures with tools like webpack-cli that rely on these properties. The problem stems from a synthetic require function created during module loading that lacks these standard CommonJS properties, breaking packages such as rechoir that expect them to exist.

   • Comments confirm the root cause is a regression introduced by Yarn PnP's handling of module loading, suggest a fix by attaching missing properties to the synthetic require function, and discuss workarounds like upgrading webpack-cli or switching to nodeLinker: node-modules; however, upgrading does not fully resolve the issue, and further investigation or Yarn-side fixes are recommended.
   • Number of comments this week: 8

2. Node.js consuming and reporting heap_size_limit larger than memory available via cgroups v2: This issue discusses a discrepancy where Node.js reports a heap_size_limit that is larger than the memory limit set for containers managed by cgroups v2, leading to confusion about expected memory boundaries and potential causes of out-of-memory errors. The user seeks clarification on how V8 calculates these memory limits, why the reported heap size can exceed container limits, and how to properly configure memory settings to avoid garbage collection failures and OOM kills in constrained environments.

   • The comments clarify that V8 uses default values for young and old generation heap sizes unless explicitly limited by command line flags, and suggest using --max-heap-size to control heap limits; the discussion ends with the original poster still questioning why the heap size limit does not strictly adhere to cgroups v2 limits and expressing a desire to understand the rationale behind this behavior.
   • Number of comments this week: 6

3. [LOADERS] [NEEDS MORE INFO] EBADF fstat error with 25.7.0 but not 25.6.1: This issue reports an EBADF (bad file descriptor) error occurring with Node.js version 25.7.0 and later when running tools like Cypress and ESLint using Yarn in PnP mode on Alpine Linux, which does not happen in version 25.6.1. The problem appears related to changes in the internal ESM loader and module loading order introduced in a specific commit, causing the loader to use an unpatched fs.readFileSync and resulting in failures when loading CommonJS modules from zip archives; partial workarounds exist in Yarn but full resolution requires changes to Node.js module loading hooks.

   • Commenters confirmed the issue reproduces across multiple platforms and tools, identified the problematic commit altering internal module loading order, discussed the brittleness of patching fs methods, shared minimal repro examples, noted partial fixes in Yarn releases, and tracked ongoing efforts and related regressions in Node.js versions up to 26.x, with some users reporting continued issues and requests for backports to older LTS lines.
   • Number of comments this week: 4

4. [RISCV64] [FFI] test-code-cache fails on a Linux/riscv64 build with FFI enabled.: This issue reports that the parallel/test-code-cache test fails consistently on a Linux/riscv64 build when FFI is enabled, with multiple internal modules not being compiled with code cache as expected. The problem appears to be specific to this platform and may be related to the compiler used, as disabling FFI or using a different compiler version seems to avoid the failure.

   • The comments discuss the issue's specificity to Linux/riscv64 and FFI, note that the test passes without FFI, and suggest the problem might be linked to the compiler version, with a recommendation to try different compilers like clang-21 to isolate the cause.
   • Number of comments this week: 4

5. [CRYPTO] [TOOLS] crypto: mk-ca-bundle.pl drops Izenpe.com and loses NSS SERVER_DISTRUST_AFTER semantics: This issue reports that the mk-ca-bundle.pl script in the crypto subsystem drops the Izenpe.com root certificate and loses the NSS SERVER_DISTRUST_AFTER semantics, causing TLS server chains anchored to Izenpe to fail in Node.js despite valid certificate issuance dates. The problem arises because the distrust-after metadata is discarded during PEM generation, leading to the removal of Izenpe.com from the bundled CA store, which should instead retain roots with server distrust-after constraints.

   • The comments discuss the practice of opening issues alongside pull requests, with the original poster clarifying their intent to track bugs and encourage contributions; it is also noted that cURL has removed distrust-after logic from their mk-ca-bundle script, and there is a suggestion to align Node.js’s approach with cURL’s upstream changes.
   • Number of comments this week: 4

2.2 Top 5 Stale Issues:

We consider stale issues to be issues that has had no activity within the last 30 days. The team should work together to get these issues resolved and closed as soon as possible.

As of our latest update, there are no stale issues for the project this week.

2.3 Open Issues

This section lists, groups, and then summarizes issues that were created within the last week in the repository.

Issues Opened This Week: 27

Summarized Issues:

• FFI subsystem bugs: Multiple issues in the FFI subsystem cause incorrect behavior after optimization, including fast FFI buffer and arraybuffer signatures rejecting valid bigint inputs and bypassing i32 range validation, allowing out-of-range values to be accepted without errors. These bugs lead to invalid argument errors and unexpected truncation of values, affecting the reliability of FFI calls.
• [issues/64638, issues/64690, issues/64717]

• SQLite and database connection issues: Problems in the SQLite subsystem include leaking SQLite connections due to improper closure on initialization failure and crashes caused by session methods called after a DatabaseSync instance is closed and reopened. These issues result in resource leaks and segmentation faults, impacting database stability and reliability.
• [issues/64640, issues/64782]

• Memory and container limits discrepancy: Node.js reports a V8 heap size limit that exceeds the memory limit set by cgroups v2 for containers, causing confusion about memory boundaries and potentially contributing to out-of-memory errors despite container constraints. This discrepancy complicates memory management in containerized environments.
• [issues/64646]

• Networking and connectivity failures: HTTPS requests fail on Node.js v24 running in Docker Desktop on Windows due to the process attempting only IPv6 connections without falling back to IPv4, despite IPv4 being available. This causes previously successful HTTPS connections to fail with ENETUNREACH errors.
• [issues/64652]

• Label management and contribution workflow: The "good first issue" label is overused and spammed, prompting proposals to improve its usefulness by changing the label, removing it when a PR is active, or implementing a claim system. These measures aim to maintain the label's effectiveness for new contributors.
• [issues/64662]

• SQLite test improvements: SQLite tests are inconsistent, leading to a proposal to refactor them to use mostly in-memory databases for faster execution while retaining some tests with temporary files to verify filesystem persistence. This approach balances test speed and coverage.
• [issues/64665]

• Internal API deprecation: The undocumented legacy alias Server.prototype._listen2 is proposed for deprecation and removal in favor of directly using the renamed internal function setupListenHandle within listenInCluster. This change aims to clean up internal APIs.
• [issues/64666]

• WebAssembly streaming API type validation: The WebAssembly streaming APIs incorrectly accept response body chunks that are not Uint8Array instances, such as ArrayBuffer, allowing modules to compile when they should reject with a TypeError. This undermines type safety in module compilation.
• [issues/64669]

• HTTP Agent backpressure handling: The http.Agent does not respect the highWaterMark setting when reusing sockets with different writable high water marks, causing ignored backpressure settings and potential permanent deadlocks under TCP backpressure. Proposed fixes include adjusting drain emission logic and avoiding socket reuse with mismatched settings.
• [issues/64680]

• CommonJS module resolution inefficiency: The CommonJS loader does not cache negative filesystem stat results during module resolution, causing repeated unnecessary re-stat calls for the same missing paths within a single require tree. This inefficiency can degrade performance during module loading.
• [issues/64681]

• Text styling enhancements: A proposal to extend util.styleText() to support background colors specified with hex codes by introducing a bg prefix would allow users to style text with both foreground and background TrueColor hex colors. This enhances text styling flexibility.
• [issues/64685]

• Stream/iter cancellation and abort handling: Falsy cancellation reasons in stream/iter's broadcast and share functions incorrectly result in clean EOF signals instead of propagating errors, and the Writer.end() method does not properly reject when aborted, resolving successfully instead. These bugs cause incorrect cancellation and abort semantics.
• [issues/64704, issues/64726]

• CommonJS properties regression under Yarn PnP: A regression in Node.js v22.22.3 through v22.23.1 causes require.cache and require.extensions to be undefined in dependencies under Yarn Plug'n'Play mode, breaking builds with tools like webpack-cli that rely on these properties.
• [issues/64709]

• TypeScript build integration proposal: A proposal suggests enabling Node.js to combine TypeScript type stripping with creating a single executable application, allowing developers to build a single executable directly from TypeScript files. This would streamline TypeScript deployment.
• [issues/64723]

• URLPattern property order bugs: The URLPattern.exec() method returns result object properties and named capture groups in an order different from WebIDL dictionary specifications, causing incompatibility with expected property order and observable differences in enumeration and serialization.
• [issues/64732, issues/64734]

• Zstd decompression stream bug: Decoding concatenated frames in a single write causes the zstd decompression stream to halt prematurely, decoding only the first frame instead of all frames, unlike when frames are written separately. This limits correct decompression of concatenated data.
• [issues/64741]

• Empty externalized builtin module crash: Loading an empty externalized builtin module causes the Node.js process to abort due to a null data pointer check failure in V8's external string handling, instead of handling the empty source gracefully. This leads to unexpected process termination.
• [issues/64749]

• Crypto root certificate removal error: The mk-ca-bundle.pl script incorrectly removes the Izenpe.com root certificate and fails to preserve NSS SERVER_DISTRUST_AFTER semantics, causing TLS server chains anchored to Izenpe to fail validation despite valid certificates. This breaks expected TLS trust policies.
• [issues/64752]

• ESLint configuration update: The ESLint configuration needs updating by replacing the deprecated global value 'readable' with 'readonly' for the EventSource entry to ensure consistency and future-proof linting.
• [issues/64757]

• Potential dead code in quic/blob module: The relevance and functionality of code involving the 'fin' variable in the quic/blob module is questioned, suggesting it may be obsolete dead code that should be removed or fixed.
• [issues/64767]

• Stream/iter zero-byte broadcast bug: Zero-byte broadcast writes bypass backpressure controls and cause the internal buffer to grow without bound, resulting in all empty batches being buffered instead of treated as no-ops. This leads to unbounded memory growth.
• [issues/64771]

• URLPatternInit dictionary conversion issues: The URLPatternInit dictionary conversion does not follow expected WebIDL semantics, causing incorrect member access order and inclusion of absent dictionary members as enumerable properties with undefined values. This breaks expected API behavior.
• [issues/64780]

2.4 Closed Issues

This section lists, groups, and then summarizes issues that were closed within the last week in the repository. This section also links the associated pull requests if applicable.

Issues Closed This Week: 257

Summarized Issues:

• HTTP2 Performance and Data Corruption: Uploading data over HTTP2 is significantly slower than HTTP1.1 due to flow control and smaller chunk sizes causing higher CPU usage and system calls. Additionally, data transmitted via HTTP2 between Docker containers becomes corrupted, resulting in mismatched file sizes and checksums despite working outside containers.
  • issues/31932, issues/40679, issues/44212

• DNS and Network Socket Issues: Setting the DNS server to 0.0.0.0 causes DNS lookups to time out because Node.js ignores replies, unlike 127.0.0.1 which works. Also, TCP keepalive in http.Agent does not send packets on the first request, causing incomplete client responses, and environment variable encoding issues occur when passing env vars to macOS open command.
  • issues/39795, issues/41965, issues/40513

• HTTP and Socket Connection Errors: Intermittent socket hang-up errors occur with HTTP keep-alive connections causing unexpected request failures. The 'aborted' event on client requests no longer functions as expected in recent Node.js versions, affecting detection of client aborts. Also, HTTP status code 102 Processing responses cause socket hang-ups behind proxies like nginx or AWS ELB.
  • issues/39810, issues/46666, issues/43944

• Cluster and Load Balancing Problems: The cluster round_robin load balancing method in Node.js v14.2.0 on Linux does not evenly distribute requests, causing some workers to receive multiple consecutive requests instead of an even distribution.
  • issues/39815

• Documentation and API Confusion: Multiple issues highlight confusion and lack of clarity in Node.js documentation, including unclear distinctions between 'base64' and 'base64url' encodings, undocumented or confusing behavior of NodeEventTarget, unclear crypto.randomUUID() version info, and missing or inconsistent documentation for various APIs like module.createRequire(), performance API, and Package exports target fallbacks.
  • issues/39903, issues/39975, issues/40037, issues/40567, issues/40723, issues/40896

• Memory Leaks and Resource Management: Memory leaks occur due to Buffer references not being properly finalized, WritableStream objects leaking file descriptors if not closed, ServerResponse objects leaking memory on client errors, and HTTP2 sessions and streams not being garbage collected properly, causing continuous memory growth.
  • issues/39915, issues/40053, issues/44463, issues/44523

• Feature Requests for Debugging and Error Handling: Requests include capturing stack traces at event emitter creation for better debugging, adding support for custom exit code handling in execSync, improving error messages for dynamic import in ES modules, and enhancing async_hooks to track unresolved async resources during tests.
  • issues/39916, issues/39917, issues/40544, issues/46232

• Build and Compilation Failures: Various build failures occur on different platforms and architectures, including M1 Mac cross-compilation issues, Linux arm64 linker errors, FreeBSD LTO linking errors, and Windows MSVC thin LTO flag problems, often requiring patches or updated tooling to resolve.
  • issues/40302, issues/42544, issues/41995, issues/64674

• Test Flakiness and CI Failures: Multiple tests intermittently fail or crash across platforms, including parallel test-worker-init-failure on macOS, wpt/test-user-timing, sequential/test-net-connect-econnrefused on s390x, and inspector-connect-main-thread on Linux, often due to resource limits, timing issues, or environment changes.
  • issues/40448, issues/40449, issues/40461, issues/40611

• Stream and Pipeline Issues: Problems include pipeline callbacks not running on normal socket end, pipeline hanging when calling end() inside _write(), pipeline failing if a readable event listener is attached, and Writable streams incorrectly rejecting null output or mishandling backpressure strategies.
  • issues/40256, issues/40471, issues/40279, issues/64416, [issues/64461](https://github.com/issues/64461]

• Node.js Worker Threads and Async Context Issues: Worker threads sometimes fail to produce logs, resourceLimits options are ignored with cluster module, AsyncLocalStorage loses context in nested async calls, and workers only generate coverage if main thread env var is set, causing confusion and bugs in async context propagation and debugging.
  • issues/40548, issues/41066, issues/45848, [issues/46378](https://github.com/issues/46378]

• Security and Cryptography Concerns: Weak Diffie-Hellman MODP groups are exposed by crypto module and proposed for removal, OpenSSL MDC2 hash function is not available without legacy provider, and PKCS#11 engine TLS connections fail to reconnect due to session count errors.
  • issues/44539, issues/44221, [issues/41644](https://github.com/issues/41644]

• Node.js Core Module and Loader Bugs: Dynamic imports in loader hooks cause crashes, requiring fixes; requiring subfolders as modules fails unless "main" is used; ESM resolver does not honor package.json main entrypoints; and module resolution fails when exports array first path is missing, causing errors instead of fallback.
  • issues/40602, issues/46344, issues/41940, [issues/44282](https://github.com/issues/44282]

• Node.js Process and CLI Behavior Issues: The CLI debugger does not exit automatically after script finishes, causing hangs; running with -e flag triggers unexpected deprecation warnings; and node --inspect-brk starts debugger without immediate error on missing file, delaying error until disconnect.
  • issues/40982, issues/40871, issues/42600

• File System and Path Handling Problems: fsPromises.mkdir with recursive returns only first directory created, fs.copyFile fails on read-only source to WSL target, path.join and path.isAbsolute behave unexpectedly on Windows with drive letters, and process.cwd() resolves symlinks without documented option to avoid it.
  • issues/40829, issues/44261, issues/44063, [issues/45617](https://github.com/issues/45617]

• Node.js Performance and Startup Regressions: NODE_EXTRA_CA_CERTS environment variable causes significant startup slowdown in Node.js v17+ due to OpenSSL 3 certificate loading; brotli compression is slower than gzip across platforms; and custom buffer write functions outperform built-in buffer.writeUInt* methods.
  • issues/40524, issues/40220, [issues/44645](https://github.com/issues/44645]

• Node.js Event and Error Handling Quirks: The events.on function throws on 'error' events preventing opt-out; registering 'unhandledRejection' blocks 'uncaughtExceptionMonitor'; and errors thrown on aborting operations use custom AbortError instead of DOMException, causing inconsistency.
  • issues/40797, issues/41222, [issues/40692](https://github.com/issues/40692]

• Node.js Internal and V8 Integration Issues: Async_hooks causes crashes when promises are frozen and symbol properties deleted; V8 coverage in workers depends on main thread env var; and V8 engine crashes with "FromJust Maybe value is Nothing" error during tests in VSCode debug console.
  • issues/42229, issues/46378, [issues/43304](https://github.com/issues/43304]

• Node.js Security and Permissions: Proposal to add runtime permission dropping to narrow process permissions after initialization to improve security.
  • issues/62223

• Node.js Build and Packaging Issues: Incorrect shebang in npm, npx, and corepack scripts causes execution failures; system-wide googletest headers cause build errors on OpenBSD; and prebuilt Node.js builds include unused OpenSSL headers increasing size.
  • issues/42367, issues/41834, [issues/46451](https://github.com/issues/46451]

• Node.js Module Resolution and Exports Bugs: Node.js incorrectly allows and ignores #name/ prefix in package map; requiring dynamically added dependencies without index.js fails due to cache issues; and node_modules lookup for built-in module subpaths proposed to be disabled to prevent incorrect resolutions.
  • issues/40579, issues/44663, [issues/44651](https://github.com/issues/44651]

• Node.js Worker and Child Process Issues: Forked child processes using ES6 import syntax crash on low-memory Heroku environments; spawning and unreferencing child processes inside worker threads cause zombie processes; and worker thread heap snapshot streams cause segmentation faults due to race conditions.
  • issues/41893, issues/46569, [issues/46210](https://github.com/issues/46210]

• Node.js Experimental and Proposal Features: Proposal to add Entrypoint Hook phase to allow preload scripts to complete before user script loads; discussion on marking trace_events module as stable; and proposal to implement Symbol.dispose for module.registerHooks() to support using keyword.
  • issues/43408, issues/43294, [issues/63846](https://github.com/issues/63846]

• Node.js Documentation and Usability Improvements: Requests for CI.md documentation, clearer error messages for unsupported directory imports, better error messages for dynamic import in ES modules, and improved documentation on AsyncLocalStorage and AbortSignal event handling.
  • issues/42533, issues/40973, issues/45862, [issues/42259](https://github.com/issues/42259]

• Node.js Security and Cryptography Updates: Proposal to deprecate weak Diffie-Hellman MODP groups; issues with OpenSSL MDC2 hash availability; and PKCS#11 TLS connections failing to reconnect due to session count errors.
  • issues/44539, issues/44221, [issues/41644](https://github.com/issues/41644]

• Node.js Stream/Iter Module Bugs: share() with "drop-newest" backpressure strategy fails to discard newest data; broadcast with strict backpressure rejects with wrong error type; merge() does not abort pending reads on abort signal; and stateful stream transforms reject null output incorrectly.
  • issues/64416, issues/64419, issues/64444, [issues/64461](https://github.com/issues/64461]

• Node.js Crash and Segmentation Fault Issues: Crashes occur due to invalid hex string writes to http.ClientRequest, unhandled ECONNRESET errors on abruptly closed HTTP2 connections, segmentation faults when debugging workers with private class members, and crashes when piping worker heap snapshots after worker termination.
  • issues/45150, issues/45244, issues/46280, [issues/46210](https://github.com/issues/46210]

• Node.js Intl and Date Formatting Changes: Intl.DateTimeFormat output for 'de-CH' locale changed separator between year and month between Node.js versions 24.13.0 and 24.13.1, breaking SSR and hydration in frameworks like Next.js.
  • issues/61861

• Node.js V8 Bytecode and Cache Issues: Critical bug in Node.js v20.20.2 where V8 accepts incompatible cached bytecode from earlier versions causing segmentation faults due to on-disk encoding changes not detected by cache sanity checks.
  • issues/62781

• Node.js Experimental Features and Proposals: Proposal to add an elastic backpressure policy for stream/iter interfaces; discussion on eliminating floating V8 patches; and proposal to replace ICU with faster UTF-8 encoding libraries.
  • issues/63688, issues/45118, issues/45389

• Node.js Miscellaneous Bugs and Issues: Issues include npm uninstall not supporting uninstall by version, random corruption of binary files during HTTP POST due to unsafe concurrent writes, and tty.WriteStream.getColorDepth() returning incorrect color depth inside tmux sessions.
  • issues/64759, issues/64758, issues/62404

2.5 Issue Discussion Insights

This section will analyze the tone and sentiment of discussions within this project's open and closed issues that occurred within the past week. It aims to identify potentially heated exchanges and to maintain a constructive project environment.

Based on our analysis, there are no instances of toxic discussions in the project's open or closed issues from the past week.

III. Pull Requests

3.1 Open Pull Requests

This section provides a summary of pull requests that were opened in the repository over the past week. The top three pull requests with the highest number of commits are highlighted as 'key' pull requests. Other pull requests are grouped based on similar characteristics for easier analysis. Up to 25 pull requests are displayed in this section, while any remaining pull requests beyond this limit are omitted for brevity.

Pull Requests Opened This Week: 78

Key Open Pull Requests

1. [v24.x backport] build: build codecache and snapshot with libnode: This pull request backports the changes from PRs #63626 and #63747 to the v24.x branch, enabling the build of codecache and snapshot components with libnode and removing the redundant intermediate node_aix_shared target.

• URL: pull/64632

• Associated Commits: 6fb5b, 521e6, f2994, 4e8db, b7b57, a42aa, b8d3f, 7e851, e55ee, 6f3e3, 1bac0, 622f4, 1d62b, 6723b, 84904, dfefe, cf039, 16c51, d73c8, b351f, 8e769, 02cbc, 957f0, 62a82, 7e4b8, bd1ea, 03f0b, 14d0b, fdc56, bca6a, 1a3bb, 19368, 6ef38, 69084, 0dc20, 2ab22, 5c5dc, 1d1a9, c4063, 57d0b, f67b4, 82760, 2c08d, 0855d, d03a6, a6629, 76e82, 5e4d3, 672ad, c1993, e408d, 842e7, 0ce12, ad71b, 84fc8, 0fdfa, a46e9, 9d91d, f6f93, 188fa, 9bb7b, fece0, c44b4, cb609, 5568d, 74f29, ae644, e5d71, 9204b, dd4e5, 02ea0, 07a05, 2d123, b5130, 78a48, 97420, 98075, 646f9, 44077, a37b3, 37a30, 563f9, 3a13f, 0936f, 383cf, dd0c5, 62d69, d81b1, 93d4c, 8a713, 55608, e4b5b, 4af57, 351d3, 9909e, db776, 69cc1, b1c1c, f0e48, fcd9e, 9109f, 47eb9, 046c3, 75605, 6969d, 39f53, 0b8df, 08a46, 6dae5, 8c538, 30c0b, fcd8e, 2a544, e2236, bbf61, 670a4, 8e0c4, 55dea, aecae, 7269a, c6c94, b717f, 07fe9, 721c0, 4cb38, c8bbe, 16325, 28a8f, 08041, 78c5f, 4ddde, ae598, 151e3, f9c7f, 470f7, b7a83, 0cd9a, 6bd94, 9d7df, dc6d6, 85690, 9860d, 0e2e4, bf426, b8054, 19b34, aaa5f, f0c83, 02754, d97fb, 6ca50, 0a81d, 43ba6, b2f92, e6db7, 6e4e7

2. [v24.x backport] node:stream/iter and QUIC backports: This pull request backports numerous updates and improvements related to the node:stream/iter experimental implementation and the QUIC protocol, including adding test binaries, enhancing stream iteration APIs, fixing bugs, optimizing performance, updating dependencies like ngtcp2 and nghttp3, refining QUIC internals, and improving documentation and CI workflows for the Node.js v24.x branch.

• URL: pull/64675

• Associated Commits: 4deef, 2dd99, 7eb3c, 6249b, 843a5, ef37d, 88971, e4499, d03e1, 10862, be757, 141dc, 03d2b, 3504a, 9cfed, 407ac, dfee1, 55855, 043f7, 49b7f, 64b4f, 55cdd, 454cf, a2920, 052f3, 5a512, 44852, d52c9, a92de, 5c466, cd126, a4488, 28938, c13c2, dbd99, c4778, 0b045, 234af, 22e22, 416bc, a8d98, c90f6, 6e498, 493da, 004e2, 11664, 2c966, b3cc9, ba78a, 3172f, 53b19, 12a03, 4d2ac, 440af, 88a61, 40bdc, f5970, b4e06, 285d8, 7674a, e8099, 8bd15, 3dc6c, aeee8, 3429f, 5e291, 37567, caf01, a004e, 4f4bd, 9e4db, c5450, 4a3f7, 19a50, 1c164, b5c5e, 74d06, 4cf7a, 31297, 30c2b, 95887, 6759b, eeeef, 826ce, 639ce, 2c228, e3956, 38d37, a9242, 08223, 68146, 2296d, 4667d, 2d36c, 38d69, 89c95, 39f1d, adc7d, b4cfc, 96543, b2e4a, f1d09, 255c5, 5c940, cef41, 5e712, 2f075, edde0, 312b6, b13bf, 40557, fb79d, 69c3e, c463d, 720d6, 8939d, 79cb5, cc7e9, 56c46, 421ba

3. crypto,build: require OpenSSL 3, remove runtime FIPS API: This pull request updates the Node.js crypto and build systems to require OpenSSL 3.0 or later by removing support for OpenSSL 1.x and its legacy FIPS runtime API, eliminates outdated FIPS-related features and tests, refines version checks to accommodate BoringSSL, and improves error reporting for FIPS mode activation while restricting FIPS-related build options to shared OpenSSL usage.

• URL: pull/64777

• Associated Commits: 540b4, c3762, 159fd, 08898, d19a0, c1fa1, 5e039, 5b3cf, 1e2b7

Other Open Pull Requests

• Crypto module backend split and fixes: This pull request backports changes to the Node.js 26.x branch that separate the crypto module's backend implementations for OpenSSL 3, BoringSSL, and legacy OpenSSL versions to improve maintainability and deprecation handling. It also includes follow-up fixes such as limiting KangarooTwelveParams customization, preserving legacy Diffie-Hellman validation, handling incomplete RSA private keys safely, cleansing private key copies, preserving legacy RSA-PSS public key encoding, and reducing redundant memory allocations.
  • pull/64657, pull/64768

• V8 engine enhancements: These pull requests introduce the v8.setHeapProfileNearHeapLimit(limit) API for writing active sampling heap profiles near heap limits and backport a fix ensuring promises related to inspector evaluations are retained until settled or cancelled. Additionally, a new SetAbortHandler API allows embedders to customize abort behavior with descriptive messages replacing prior abort calls.
  • pull/64676, pull/64631, pull/64684

• HTTP/2 performance improvements: This pull request backports performance optimizations to reduce per-request allocations in the HTTP/2 module by optimizing header construction, minimizing closure allocations in the write path, and decreasing response-option allocations, thereby improving throughput and efficiency without requiring extensive stream lifecycle changes.
  • pull/64663

• Utility and styling updates: This pull request extends util.styleText() to support background TrueColor hex color codes with a bg# prefix, adding necessary regex and ANSI escape sequence handling, updating documentation and tests, and addressing previous limitations where hex colors were only supported for foreground styling.
  • pull/64702

• Warning option stabilization: This pull request marks the --disable-warning=code-or-type option as stable in the documentation, informing Fastify users that they can reliably silence specific warnings, aligning with its availability since Node.js 21.3.0 and supporting related Fastify development.
  • pull/64742

• Blob memory leak fix: This pull request backports a fix to Node.js v24.x that resolves a memory leak in Blob.stream() by properly clearing the reader's wakeup callback to prevent source buffer retention, including a prerequisite patch to allow the C++ Blob::Reader::SetWakeup method to accept an undefined argument for compatibility.
  • pull/64664

• WebAssembly streaming validation: This pull request enforces that WebAssembly streaming response chunks must be of type Uint8Array, rejecting any non-Uint8Array chunks to comply with the Fetch API's body consumption requirements.
  • pull/64670

• TLS client certificate resumption fix: This pull request fixes a bug in TLS 1.3 client certificate resumption where resumed sessions incorrectly reported an authorized state of true if the client did not send a certificate and rejectUnauthorized was false, aligning behavior with TLS 1.2 and ensuring consistent authorization reporting.
  • pull/64677

• WebAssembly SetURL registration: This pull request adds the registration of the previously missing SetURL function in the WebAssembly (wasm) module of Node.js.
  • pull/64679

• Test reporter improvements: This pull request improves the dot test reporter to display detailed coverage error messages when coverage thresholds are not met by handling test:diagnostic events with error level, providing clear diagnostic output instead of just dots and an exit code.
  • pull/64695

• File system retry and Windows fixes: This pull request updates the RmSync operation to treat std::errc::permission_denied as an EPERM error for retry logic consistency, fixes Windows retryDelay calculation to correctly handle milliseconds in the Sleep function, and adds a Windows test to ensure proper retry behavior.
  • pull/64698

• SQLite test improvements: This pull request updates SQLite tests to use in-memory databases for tests that only exercise SQL behavior, improving test speed and simplifying temporary file management while retaining file-based databases for tests requiring on-disk verification.
  • pull/64701

• Unified TLS certificate handling: This pull request unifies TLS certificate handling across the tls, dtls, and quic modules by extracting and sharing certificate management logic to reduce code duplication, fix bugs, and align dtls and quic behavior with tls.
  • pull/64711

• Debugger and REPL test flakiness fixes: This pull request addresses flakiness in debugger and REPL tests by modifying synchronization to use long-lived debugger targets, implementing a synchronous VM evaluator for REPL error handling, and adding explicit assertions and lifecycle management to prevent hangs and race conditions.
  • pull/64718

• Perfetto build and test workflow: This pull request adds a GitHub Actions workflow to build and test Perfetto, ensuring compatibility of changes in src and lib directories with Perfetto and V8 compiled with Perfetto, addressing related issues and referencing prior work.
  • pull/64721

• URLPattern property ordering fixes: These pull requests ensure that properties in URLPattern result objects and the URLPatternInit dictionary are created and returned in the correct WebIDL-defined lexicographical order by reordering dictionary templates and using compiled component group name lists, omitting absent members from execution results.
  • pull/64735, pull/64781

• Performance improvements via vector capacity reservation: This pull request improves performance by adding upfront capacity reservation to vectors in Message::Serialize() and ParseTxtReply() functions to avoid unnecessary reallocations during element insertion when the upper bound on elements is known.
  • pull/64763

• QUIC stream stalling fix: This pull request fixes an issue in the QUIC implementation where the desired size for writing data on a max stream was not updated, which could cause streams to stall when chunks are close to or exceed the window size, preventing this stalling behavior.
  • pull/64768

• Argon2 FIPS mode and error preservation: This pull request fixes the Argon2 cryptographic function's unintended bypass of FIPS mode by ensuring availability checks use the default OpenSSL context and preserves OpenSSL error details from key derivation failures for more informative error reporting.
  • pull/64776

• Node.js test command regression fix: This pull request restores previous behavior of the node --test command by expanding directory arguments into searches for default test files within those directories, fixing a regression where directories were incorrectly treated as glob patterns causing test failures.
  • pull/64637

• Node.js FFI buffer conversion fix: This pull request fixes optimized buffer conversions in the Node.js FFI by preserving pointer-like argument conversions for buffer and ArrayBuffer signatures after Fast API optimization, ensuring compatibility with raw pointer conversions while maintaining specialized native fast paths and accepting documented argument types.
  • pull/64639

3.2 Closed Pull Requests

This section provides a summary of pull requests that were closed in the repository over the past week. The top three pull requests with the highest number of commits are highlighted as 'key' pull requests. Other pull requests are grouped based on similar characteristics for easier analysis. Up to 25 pull requests are displayed in this section, while any remaining pull requests beyond this limit are omitted for brevity.

Pull Requests Closed This Week: 89

Key Closed Pull Requests

1. deps: update V8 to 14.8: This pull request proposes updating the V8 JavaScript engine dependency to version 14.8 in the Node.js project, including various patches, build adjustments, API deprecations, and compatibility fixes to prepare for Node.js 26.0.0, although it was not merged.

• URL: pull/62572

• Associated Commits: 26ea5, d7aa9, 58a47, 66aef, 019b1, 67472, 33370, 78897, 89b1f, 5393e, 9fc31, 1e704, fb889, a1472, 96b08, efc83, 5fc6a, 84e5f, e62e3, 0d136, 9257d, 06dca, 0aa2a, a4290, 4a0d1, f1e0d, 501be, cd9f8, 1433e, c56b1, beff1, bec98, da393, ff7a7, e326f, 668da, c79dd, b0016, c4229, 95be4, 2deb0, 480b6, c9065, 0bf28, e4bb9, cf134, dd206, 34dcb, 80869, 41773, dace3, dc4df, ac8f6, 1cc13, 7c927, a9261, 1b581, 245ba, d7bdb, 74576, 7e2b5, 1fb4c, 59dfd, c2636, c9738, c2a89, 30c89

• Associated Commits: 26ea5, d7aa9, 58a47, 66aef, 019b1, 67472, 33370, 78897, 89b1f, 5393e, 9fc31, 1e704, fb889, a1472, 96b08, efc83, 5fc6a, 84e5f, e62e3, 0d136, 9257d, 06dca, 0aa2a, a4290, 4a0d1, f1e0d, 501be, cd9f8, 1433e, c56b1, beff1, bec98, da393, ff7a7, e326f, 668da, c79dd, b0016, c4229, 95be4, 2deb0, 480b6, c9065, 0bf28, e4bb9, cf134, dd206, 34dcb, 80869, 41773, dace3, dc4df, ac8f6, 1cc13, 7c927, a9261, 1b581, 245ba, d7bdb, 74576, 7e2b5, 1fb4c, 59dfd, c2636, c9738, c2a89, 30c89

2. doc: add diagnostics_channel bypass API documentation: This pull request adds comprehensive documentation for the new diagnostics_channel bypass API introduced in issue #63651, including detailed parameter descriptions, examples for APM use cases, multi-vendor coordination, async boundaries, and code samples in both MJS and CJS formats.

• URL: pull/64250

• Associated Commits: 68b89, b508e, a6aa4, 9f9bd, 556b2, f60e2

• Associated Commits: 68b89, b508e, a6aa4, 9f9bd, 556b2, f60e2

3. stream: abort pending single-source merge reads: This pull request improves the single-source merge() method in Node.js streams by making it abort-aware, ensuring that signal cancellation properly rejects pending reads and closes the active source iterator, while also enhancing the abort cleanup helper to handle iterators with synchronous return() results.

• URL: pull/64445

• Associated Commits: 1ed23, 62c9f, 1ee60, 6d6be, 93cad, 5a03b

• Associated Commits: 1ed23, 62c9f, 1ee60, 6d6be, 93cad, 5a03b

Other Closed Pull Requests

• Tracing and Performance Monitoring: This topic covers the implementation of Perfetto tracing support in Node.js, enabling trace generation via a configure flag and producing protobuf-encoded trace files viewable on the Perfetto UI. It also includes standardizing parameter validation in PerformanceObserver.observe to ensure compliance with the Performance Timeline specification.
  [pull/64565, pull/47025]

• OpenSSL and Cryptography Enhancements: These pull requests restore legacy Diffie-Hellman validation behavior, improve handling of incomplete RSA private keys, and securely cleanse private key material to maintain compatibility without deprecated APIs. Additionally, documentation updates clarify the usage and performance benefits of crypto.hash() over crypto.createHash().
  [pull/64547, pull/63420]

• REPL and Syntax Highlighting: This pull request introduces basic syntax highlighting to the Node.js REPL using util.inspect.styles to ensure consistent coloring when the useColors option is enabled.
  [pull/64591]

• Bug Fixes in Core Modules and Streams: Multiple fixes address critical bugs including a libuv assertion issue on Windows by nullifying pointers after uv_close, a crash in SQLite integration by keeping the database alive during sessions, and preventing uncatchable TypeError crashes in half-open Duplex.toWeb() streams by adding optional chaining.
  [pull/61999, pull/63797, pull/64161]

• Networking and Socket Improvements: This topic includes extending net.BoundSocket to support binding named Unix-domain sockets and Windows pipes synchronously with enhanced error handling and compatibility. It also covers deferring QUIC server session event emission until TLS ClientHello processing completes to improve usability and support dynamic application selection.
  [pull/64399, pull/64132]

• Dependency and Build Updates: Updates to dependencies include upgrading the temporal_rs crate to version 0.2.3 with bug fixes and spec compliance improvements, backporting relevant changes to V8 14.9.6, and increasing the Rust compiler requirement. A backport of a V8 fix resolves a fatal error on LoongArch64 architecture during documentation generation.
  [pull/64543, pull/63731]

• Compression and Buffer Handling: The zlib module is updated to accept an ArrayBuffer as a dictionary input for Zstd compression, addressing a specific issue. Additionally, a previous optimization in the buffer API is reverted to fix compatibility issues with zero-length buffers used by some libraries.
  [pull/64599, pull/44579]

• Compiler and Platform Compatibility Fixes: Fixes include correcting the _BitScanReverse64 output parameter pointer type in hdr_histogram.c for MSVC and clang-cl compatibility, and addressing assertion crashes in URL error handling that are not security issues.
  [pull/64647, pull/62521]

• Module Loader and Hooks Enhancements: Improvements include enforcing path normalization before package map lookups to prevent mismatches in createRequire calls, and implementing the Symbol.dispose key in the ModuleHooks class as an alias for deregister to support the using keyword.
  [pull/63917, pull/63928]

• Performance and Internal Optimizations: HTTP header field names are internalized as strings within the isolate's string table to optimize repeated comparisons and improve header building efficiency. Iterable streams are updated to align with the byte-budget backpressure model specified in the iterable streams specification.
  [pull/64149, pull/64277]

• FFI and Native Call Safety: The caching strategy for temporary string conversion buffers in the Node.js FFI implementation is modified to be scoped by both the FFI wrapper and active call depth, preventing nested reentrant calls from overwriting buffers still in use and ensuring safe string preservation.
  [pull/64551]

3.3 Pull Request Discussion Insights

This section will analyze the tone and sentiment of discussions within this project's open and closed pull requests that occurred within the past week. It aims to identify potentially heated exchanges and to maintain a constructive project environment.

Based on our analysis, there are no instances of toxic discussions in the project's open or closed pull requests from the past week.

IV. Contributors

4.1 Contributors

Active Contributors:

We consider an active contributor in this project to be any contributor who has made at least 1 commit, opened at least 1 issue, created at least 1 pull request, or made more than 2 comments in the last month.

If there are more than 10 active contributors, the list is truncated to the top 10 based on contribution metrics for better clarity.