Weekly GitHub Report for Node: March 24, 2025 - March 31, 2025 (12:08:37)
Weekly GitHub Report for Node
Thank you for subscribing to our weekly newsletter! Each week, we deliver a comprehensive summary of your GitHub project's latest activity right to your inbox, including an overview of your project's issues, pull requests, contributors, and commit activity.
Table of Contents
I. News
1.1 Recent Version Releases:
The current version of this repository is v23.10.0
1.2 Version Information:
The version released on March 13, 2025, introduces the --experimental-config-file feature, allowing developers to use a JSON configuration file to streamline the use of multiple flags, enhancing the developer experience. Notable updates include improvements in error handling, the addition of new methods like tls.getCACertificates() and v8.getCppHeapStatistics(), and updates to root certificates and dependencies, reflecting a trend towards increased configurability and security enhancements.
II. Issues
2.1 Top 5 Active Issues:
We consider active issues to be issues that that have been commented on most frequently within the last week. Bot comments are omitted.
-
Accidental breaking change in node 23.6.0 caused by type stripping: This issue reports an accidental breaking change in Node.js version 23.6.0, where the
--experimental-strip-typesflag was enabled by default, causing a change in behavior for a specific JavaScript/TypeScript syntax snippet compared to version 23.5.0. The user highlights that this change was not documented in the changelog or documentation, and suggests a potential fix while acknowledging the possible performance implications and impact on TypeScript users.- The comments discuss the behavior of the code snippet across different Node.js versions and file extensions, with some users noting that the issue primarily affects
.tsfiles. There is a consensus that the change is due to a syntax conflict between JavaScript and TypeScript, and while some see it as a minor issue, others emphasize the importance of being cautious with such changes. The discussion also touches on the historical behavior of Node.js in handling file extensions and the experimental nature of the type stripping feature. - Number of comments this week: 11
- The comments discuss the behavior of the code snippet across different Node.js versions and file extensions, with some users noting that the issue primarily affects
-
Using
MessageChannelpulls inundiciinappropriately: This issue involves the inappropriate loading of theundicimodule when usingMessageChannelin Node.js, which results in an unexpected exception due to the absence of WebAssembly when the--jitlessflag is used. The problem arises becauseMessageEvent, which is part of the HTML standard and used in WebSockets, is being sourced fromundici, leading to conflicts whenundiciis not required.- The comments discuss the unexpected use of
undiciforMessageEventin Node.js, with contributors expressing confusion over the design choice and suggesting that the implementation was changed to useundicifor its spec-compliance and performance. There is a suggestion to add a fallback forMessageEventwhenundiciis not needed, and historical context is provided about the evolution of the implementation. - Number of comments this week: 7
- The comments discuss the unexpected use of
-
Unflag --experimental-webstorage: This issue discusses the proposal to enable the
localStoragefeature by default in version 25 of the project, which involves unflagging the--experimental-webstorageoption. The conversation includes technical details about modifying the code to set this option as default and addresses challenges faced during testing, specifically related to the--localstorage-fileargument causing test failures.- The comments involve a request for guidance on unflagging the feature, a suggestion to push the changes as a draft pull request, and a discussion about the need for a
localStoragefile for tests. There is also a mention of a related pull request being pushed to address the issue. - Number of comments this week: 7
- The comments involve a request for guidance on unflagging the feature, a suggestion to push the changes as a draft pull request, and a discussion about the need for a
-
Mac Installer: npm and npx created with wrong permissions: This issue reports a problem with the Node.js macOS installer, where the symlinks for
npmandnpxare created with incorrect permissions, making them inaccessible to users without elevated privileges. The expected behavior is for these symlinks to have permissions that allow read and execute access for all users, similar to other installed binaries likenodeandcorepack.- The comments discuss the impact of System Integrity Protection on fixing the issue, with suggestions to disable it temporarily to change permissions. There is a debate about whether the umask setting should affect the installer, with some arguing that the installer should respect user umask settings consistently. The root cause is identified as a
postinstallscript setting incorrect permissions, and a potential fix is proposed to adjust the umask within the script. - Number of comments this week: 6
- The comments discuss the impact of System Integrity Protection on fixing the issue, with suggestions to disable it temporarily to change permissions. There is a debate about whether the umask setting should affect the installer, with some arguing that the installer should respect user umask settings consistently. The root cause is identified as a
-
node:sqlite Export problem: This issue is about a problem with the 'node:sqlite' module where the 'backup' function is not being exported as expected on a Debian 12 platform using Node.js version 23.10.0. The user reports that the behavior does not match the documentation, indicating a potential discrepancy or bug in the module's export functionality.
- The comments discuss attempts to reproduce the issue, with one user unable to replicate the problem and suggesting it might be a user or configuration error. Another user questions if the reporter is using the correct Node.js version that includes the new API. A reference is made to existing tests that verify the functionality, implying the issue might not be with the module itself.
- Number of comments this week: 6
2.2 Top 5 Stale Issues:
We consider stale issues to be issues that has had no activity within the last 30 days. The team should work together to get these issues resolved and closed as soon as possible.
- Flaky GC-related tests with V8 12.2: This issue addresses the problem of flaky garbage collection-related tests in the V8 12.2 environment, specifically concerning the
test-shadow-realm-gc-module,test-shadow-realm-gc, andtest-net-write-fully-async-hex-string. The tests are believed to be unreliable due to incorrect assumptions that have been disrupted by V8's new garbage collection strategy, and the proposed temporary solution is to skip these tests while a more effective testing method is developed. - Flaky
test-worker-arraybuffer-zerofillwith V8 12.2: This issue concerns a flaky test namedtest-worker-arraybuffer-zerofillassociated with V8 version 12.2, which has been failing intermittently, as indicated by a timeout error in the console output. The problem might be due to a real bug or broken timing assumptions/messages getting lost, and it has been suggested to mark the test as flaky and add logs for better debugging. - Support loading dynamic addon modules (
.nodefiles) when embedding the Node.js shared library without needing to link withnode.def: This issue addresses the challenge of loading dynamic addon modules, specifically.nodefiles, when embedding the Node.js shared library into a different executable without the need to link withnode.def. The proposed solution suggests modifying the delay load hook to utilize an environment variable, potentially namedNODE_LIBRARY, to facilitate the loading process, although the security implications of this approach are still uncertain. - unable to sign with external OpenSSL engine after usage of crypto.hash: This issue involves a bug where users are unable to sign with an external OpenSSL engine after using the
crypto.hashfunction in Node.js version v21.7.1 on a Linux platform. The problem consistently reproduces and results in an "unsupported" error, which seems to be linked to recent changes in the Node.js codebase, as the code worked correctly in earlier versions like v21.6.2. - Restrict authentication tag length for GCM by default: This issue addresses the lack of a default authentication tag length in the Node.js crypto module when using Galois Counter Mode (GCM) for decryption, which can lead to insecure implementations as the module currently accepts multiple tag lengths, including a brute-forceable 4-byte tag. The proposed solution is to set a default expected tag length of 16 bytes, similar to the ChachaPoly mode, to enhance security by making the API secure-by-default while still allowing users to specify different tag lengths if needed.
2.3 Open Issues
This section lists, groups, and then summarizes issues that were created within the last week in the repository.
Issues Opened This Week: 28
Summarized Issues:
- DatabaseSync Timeout Proposal: This issue proposes adding a "timeout" option for initializing DatabaseSync in node:sqlite to prevent "database is locked" errors. By allowing users to set a busy_timeout value greater than the default of 0, such as 1 or 2 seconds, it aims to improve database access reliability.
- Node.js Module Bugs: Several issues describe bugs in various Node.js modules, including
node:readline,stat.isFIFO(), andNumber.prototype.toLocaleString(). These bugs cause incorrect handling of terminal escape sequences, false returns on Windows, and improper number formatting in Italian locale, respectively, disrupting expected functionality.
- Node.js Debugging and Testing Issues: Issues in Node.js debugging and testing include a fatal error in the V8 debugging context and a
MaxListenersExceededWarninginTestsStream. These problems prevent proper debugging and indicate potential memory leaks, suggesting the need for increased event listener limits.
- Node.js HTTP/2 and Stream Errors: Bugs in Node.js HTTP/2 server and Transform stream callback cause improper connection handling and ERR_INTERNAL_ASSERTION errors. These issues disrupt server shutdown processes and stream wrapping, affecting HTTP request handling.
- Node.js Feature Proposals: Proposals for Node.js include a
--initcommand for ESM environments and integration ofdbhashandsqldiffutilities. These features aim to simplify project initialization and enhance SQLite functionality, though they raise concerns about file extensions and integration challenges.
- Node.js Build and Configuration Issues: Issues with Node.js builds and configurations include errors in
cc_flagsgeneration and pointer compression failures. These problems cause build inconsistencies and segmentation faults across platforms, complicating development processes.
- Node.js DNS and Cache Management: Changes in DNS caching behavior and proposals for DNS querying cache management affect default TTL settings. These issues highlight the need for configurable cache options to align with user expectations and c-ares defaults.
- Node.js Version and Compatibility Issues: Version updates in Node.js introduce breaking changes and compatibility issues, such as the
--experimental-strip-typesflag andsubprocess.kill(0)behavior. These changes cause unexpected outputs and process terminations, raising concerns about documentation and backward compatibility.
- Node.js Stream and Readline Bugs: Bugs in Node.js streams and
readlinesubsystem cause unexpected errors and process hangs. These issues involve incorrect error handling and assertion failures, affecting stream operations and user input processing.
- Node.js Watch Mode and Web Storage: Enhancements to Node.js watch mode and
localStoragefeature aim to improve script restart behavior and default web storage availability. These proposals address user convenience and test failures, seeking to align with common development practices.
- Node.js Security and Error Handling: Security improvements and error handling in Node.js include hardening macOS postinstall scripts and addressing missing error messages. These efforts focus on preventing environment attacks and providing clear guidance for ES module execution.
2.4 Closed Issues
This section lists, groups, and then summarizes issues that were closed within the last week in the repository. This section also links the associated pull requests if applicable.
Issues Closed This Week: 9
Summarized Issues:
- GitHub Action Configuration Issues: The GitHub action meant to close "stalled" issues after 30 days is malfunctioning due to the
remove-stale-when-updatedsetting beingfalse. This prevents automatic closure if comments are made within the period, suggesting manual intervention or configuration changes as solutions.
- Node.js Crash and Error Handling: Node.js version 22.1 and later crashes when many VM processes are handled in parallel, affecting Vitest with exit code 129 errors. Additionally, synchronous errors in asynchronous handlers are delayed, complicating error management in systems using MQTT and OPCUA.
- JavaScript and Internal Assertion Errors: An uncaught exception in Node.js leads to an internal assertion error, indicating a potential bug or misuse of internals. This issue is linked to a previously reported problem, suggesting a deeper underlying issue in Node.js.
- Corepack and Node.js Version Issues: Node.js version 20.18.3 ships with a faulty Corepack version, causing command failures due to signature verification errors. The issue is resolved in version 20.19.0, but a workaround exists for earlier versions.
- Random Fatal Errors in CI: During Appium CI tests on Ubuntu GitHub Actions, Node.js encounters fatal errors due to unreachable code, possibly from memory or snapshot corruption. The exact cause remains unidentified, complicating debugging efforts.
- Intermittent Database Connection Failures: A sporadic issue with database connections is resolved by rebuilding the application. This suggests a potential underlying problem with the build process or environment configuration.
- ECMAScript Modules and
require.mainParity: Node.js lacks arequire.mainequivalent for ECMAScript Modules, complicating module identification. Current workarounds are limited, prompting suggestions for a built-in solution akin to thees-mainpackage.
- Windows Build Configuration Errors: Errors in generating
cc_flagsfor Windows builds using Ninja result in incorrectbuild.ninjafiles. The unexpected<map object>output indicates a misconfiguration in precompiled header settings.
2.5 Issue Discussion Insights
This section will analyze the tone and sentiment of discussions within this project's open and closed issues that occurred within the past week. It aims to identify potentially heated exchanges and to maintain a constructive project environment.
Based on our analysis, there are no instances of toxic discussions in the project's open or closed issues from the past week.
III. Pull Requests
3.1 Open Pull Requests
This section provides a summary of pull requests that were opened in the repository over the past week. The top three pull requests with the highest number of commits are highlighted as 'key' pull requests. Other pull requests are grouped based on similar characteristics for easier analysis. Up to 25 pull requests are displayed in this section, while any remaining pull requests beyond this limit are omitted for brevity.
Pull Requests Opened This Week: 45
Key Open Pull Requests
1. doc: add "Do I still need this dependency for my Node.js app?" to ambassadors program: This pull request proposes the addition of a new section titled "Do I still need this dependency for my Node.js app?" to the Node.js ambassadors program documentation, along with fixing typos and normalizing markdown headers to improve document clarity and structure.
- URL: pull/57600
- Merged: No
2. assert,util: improve deep object comparison performance: This pull request aims to enhance the performance of deep object comparisons in the Node.js project by optimizing the assert and util modules, including improvements for comparing sparse arrays, arrays with undefined values, and unequal numbers, as well as introducing a fast path for sets containing two objects, with local benchmarks demonstrating significant performance gains across various test cases.
- URL: pull/57648
- Merged: No
3. module: improve getPackageType performance: This pull request aims to enhance the performance of the getPackageType function by modifying the packageJsonReader#getPackageType method to retrieve only the type field directly from the C++ layer, thereby avoiding the overhead of serializing the entire package scope configuration across the C++/JS boundary.
- URL: pull/57599
- Merged: No
Other Open Pull Requests
- WebAssembly Execution and Testing: This topic covers the execution of top-level WebAssembly (Wasm) files without requiring a package type by ensuring the ESM loader is always used. It introduces a comprehensive test case for top-level Wasm execution, which can be expanded to various end-to-end Wasm scenarios, such as creating and manipulating JavaScript objects.
- Experimental Features and Flags: The
--experimental-webstoragefeature is made available by default by removing its experimental flag, addressing issue #57658. Changes include returningundefinedforlocalStoragewhen the location is invalid and updating tests to remove the experimental flag.
- Test Runner and Timeout Settings: A bug in the test runner is addressed by changing the
--test-timeoutsetting from being applied per test execution to per test. This ensures consistent timeout behavior and resolves an issue where the--test-timeoutwas not respected when running tests without the--testflag.
- Corepack Distribution: The proposal to stop distributing Corepack as part of the build process in the Node.js project is discussed. This change is referenced in a discussion on the Node.js TSC GitHub repository.
- SQLite Compatibility: Common flags for SQLite are enabled in the Node.js ecosystem, aligning with practices used by other SQLite libraries such as node-sqlite3 and better-sqlite3. This enhances compatibility and ease of use for developers, although it does not include the RBU extension.
- Code Updates and Modifications: Updates to the Node.js project involve modifying the files
string_bytes.handnode_main.cc. These changes are indicated by the commits included in the request.
- Deep Comparison Usability: A usability improvement is proposed by modifying the deep comparison functionality in the Node.js project to treat invalid dates as equal. This addresses previous issues where such comparisons would result in errors.
- TLS Module Deprecation: The runtime deprecation of the
_tls_commonand_tls_wrapmodules in Node.js is proposed. Users are suggested to transition to usingnode:tlsinstead, with the exception oftranslatePeerCertificate, which can be re-implemented externally.
- Linting Enhancements: Linting is re-enabled on certain files within the
fixtures/directory of the Node.js project, which were previously excluded from lint rules. The newly addedglobalIgnoresfeature is utilized to apply more precise file-specific linting rules.
- TypeScript Error Message Formatting: The format of TypeScript error messages in Node.js is enhanced by removing internal file paths and unnecessary padding. This aligns the error message style more closely with the standard Node.js error format.
- HMAC Function Verification: The need to verify the result of the
HMAC_Init_exfunction within theSecureContext::TicketKeyCallbackmethod is addressed. This ensures that the function returns -1 in case of failure, thereby enhancing error handling in the Node.js project.
- Node.js Version 24.0.0 Release: The release of Node.js Version 24.0.0, scheduled for April 23, 2025, includes several semver-major changes. These changes include updates to the V8 engine, deprecations in the
fsandlibmodules, and various build and dependency updates, all aimed at enhancing performance, security, and compatibility.
- StreamPipe Conversion Result: The addition of a conversion result for the
StreamPipe::Newfunction in the Node.js project is addressed. This aims to fix issue #57612 by implementing changes similar to those in other parts of the codebase.
- Recursive Breaking Change Reversion: A previous commit that introduced a recursive breaking change in the 'assert' and 'util' modules is reverted. The intention is to correct the algorithm to function more accurately without negatively impacting user code.
- Code Maintainability Enhancements: Code maintainability is enhanced by narrowing the scope of local variables to within the loop. This improves code clarity and reduces the risk of variable misuse.
- Governance Document Update: An update to the Node.js governance document is proposed by adding a new "companion status". This acknowledges significant contributions before nominating individuals as collaborators, as discussed in recent project meetings.
- Chrome DevTools Protocol Classification: The Chrome DevTools Protocol is proposed to be classified as a tier 2 component in the Node.js project. This acknowledges its regular testing in the Node.js test suite and CI, while aiming for a future upgrade to tier 1 status once comprehensive documentation is available.
- DNS Query Cache TTL Restoration: An issue with the DNS query cache TTL in the Node.js project is addressed by restoring the previous caching behavior. This was altered when c-ares was updated, and a cache management API for DNS queries is suggested as a follow-up.
- V8 Local Handle Transition: The transition from using
std::vector<v8::Local<T>>tov8::LocalVector<T>in the codebase is continued. This is part of an ongoing effort to improve the handling of V8 local handles.
- HTTP/2 Code Typo Correction: A typo in the HTTP/2 code is corrected by ensuring the check for
frame->hd.typeproperly verifies againstNGHTTP2_GOAWAYwith the correct value of0x07. This is related to CVE-2025-23085.
- Worker Documentation Enhancement: The worker documentation is enhanced by adding examples using the ECMAScript Module (ESM) version. The 'use strict' directive is consistently applied to all CommonJS blocks, and the first argument in the ESM version of
new Worker()is updated.
- REPL Documentation Update: The documentation is updated by clarifying that the lexical scope of
constis invalidated when using top-levelawaitin the Node.js REPL. Additional tests are included to verify this documented behavior.
- UnhandledRejection Event Clarification: The behaviors of
unhandledRejectionevents in the Node.js process documentation are clarified. This addresses issue #50075 on GitHub.
3.2 Closed Pull Requests
This section provides a summary of pull requests that were closed in the repository over the past week. The top three pull requests with the highest number of commits are highlighted as 'key' pull requests. Other pull requests are grouped based on similar characteristics for easier analysis. Up to 25 pull requests are displayed in this section, while any remaining pull requests beyond this limit are omitted for brevity.
Pull Requests Closed This Week: 23
Key Closed Pull Requests
1. doc: clarify behaviour of node-api adjust function: This pull request involves clarifying the behavior of the Node-API adjust function by updating the documentation and addressing comments, based on a recent request to update one of the tests, with contributions from multiple authors and ensuring compliance with linter requirements.
- URL: pull/57463
- Merged: 2025-03-28T15:17:07Z
- Associated Commits: e9982, 0fcc8, 53d4b, f982c, 2425f, 3ca64, d4da3, d7aec, 0e337, d8cdc, 37531, 5176d, a2012, 0792c
2. v18.20.8 proposal: This pull request proposes the release of Node.js version 18.20.8, codenamed 'Hydrogen', which includes significant updates such as upgrading OpenSSL to version 3.0.16, updating root certificates to NSS 3.108, implementing an inspector API without async_wrap, and various other improvements and fixes across the build, crypto, dependencies, documentation, and testing components.
- URL: pull/57631
- Merged: 2025-03-27T13:01:31Z
- Associated Commits: 8b7ff, f5dbc, a5665, 1b728, 738bf, ee9a3, 59fcf, f737a, 784da, c3bab, 50c4e, 69d66, fce92, 4d0b4
3. src: add --run-from runtime flag: This pull request proposes the addition of a --run-from runtime flag to the Node.js project, aiming to address issue #57489, and includes multiple commits for implementing the flag, updating tests for package.json file path handling, optimizing code, and refining documentation.
- URL: pull/57523
- Merged: No
Other Closed Pull Requests
- Module Removal from BuiltinModules: This pull request aims to remove modules starting with an underscore from
Module#builtinModulesandModule#isBuiltinin the Node.js project. These modules are not properly documented as public, and their usage should be discouraged despite their widespread use in libraries.
- Timer Function Optimization: This pull request focuses on optimizing timer functions in the Node.js project by improving argument handling. The changes result in enhanced performance metrics across various timer-related benchmarks.
- Documentation and Policy Updates: Several pull requests address documentation updates and policy changes within the Node.js project. These include establishing a policy for closing inactive pull requests, updating the nomination process, and specifying report alignments with the Code of Conduct.
- ES Module Support and Corepack Documentation: This pull request updates the documentation to reflect that the
node --require modulecommand now supports ES modules. Additionally, outdated Corepack documentation is removed, with thecorepack.mdfile retained temporarily to prevent broken links.
- Support and Community Engagement: Updates to the SUPPORT.md file and the addition of new triagers highlight efforts to enhance community engagement. These changes include adding information about the Node.js Website Learn section and the new Discord server, as well as adding new contributors as triagers.
- MIMEType Utility Class Stabilization: This pull request proposes transitioning the
MIMETypeutility class in Node.js from an experimental feature to a stable one. It highlights its minimal issues and changes since its introduction, despite low adoption and known limitations.
- Dependency and Tool Updates: Pull requests involve updating dependencies and tools within the Node.js project. These include updating the 'undici' dependency and backporting updates to the gcovr tool to resolve coverage workflow issues.
- V8 Fast-Calls Header Exposure: This pull request aims to expose the V8 fast-calls header to native addons, addressing a previously unimplemented issue due to stability concerns. The change is intended to enhance the functionality available to native addons.
- Code Refactoring and Cleanup: This pull request focuses on refactoring and enhancing the
CollationRuleParsercode. It includes renaming constants for clarity, utilizingconstexprfor performance improvements, and removing unused variables to clean up the code.
- Label and Schedule Adjustments: Pull requests address the removal of incorrectly labeled stalled issues and adjust the WPT update schedule. These changes aim to reduce noise and ensure accurate labeling within the Node.js GitHub repository.
- HTTP/2 Server Session Management: This pull request introduces a mechanism for tracking and gracefully closing HTTP/2 server sessions. It implements a new
kSessionssymbol and updates server close methods to align with the HTTP/2 protocol specification.
3.3 Pull Request Discussion Insights
This section will analyze the tone and sentiment of discussions within this project's open and closed pull requests that occurred within the past week. It aims to identify potentially heated exchanges and to maintain a constructive project environment.
Based on our analysis, there are no instances of toxic discussions in the project's open or closed pull requests from the past week.
IV. Contributors
4.1 Contributors
Active Contributors:
We consider an active contributor in this project to be any contributor who has made at least 1 commit, opened at least 1 issue, created at least 1 pull request, or made more than 2 comments in the last month.
If there are more than 10 active contributors, the list is truncated to the top 10 based on contribution metrics for better clarity.
| Contributor | Commits | Pull Requests | Issues | Comments |
|---|---|---|---|---|
| aduh95 | 63 | 19 | 0 | 156 |
| jasnell | 52 | 12 | 4 | 164 |
| anonrig | 17 | 10 | 1 | 84 |
| cjihrig | 10 | 7 | 1 | 74 |
| joyeecheung | 21 | 3 | 0 | 59 |
| dario-piotrowicz | 40 | 14 | 2 | 19 |
| mertcanaltin | 32 | 5 | 0 | 33 |
| BridgeAR | 17 | 7 | 0 | 44 |
| marco-ippolito | 8 | 6 | 2 | 47 |
| mhdawson | 34 | 4 | 0 | 16 |