Weekly GitHub Report for Node: May 19, 2025 - May 26, 2025 (12:03:49)
Weekly GitHub Report for Node
Thank you for subscribing to our weekly newsletter! Each week, we deliver a comprehensive summary of your GitHub project's latest activity right to your inbox, including an overview of your project's issues, pull requests, contributors, and commit activity.
Table of Contents
I. News
1.1 Recent Version Releases:
The current version of this repository is v23.10.0
1.2 Version Information:
On March 13, 2025, a new version of Node.js was released, introducing the --experimental-config-file feature, which allows developers to use a JSON configuration file to streamline the use of multiple flags, enhancing the developer experience. Notable updates include the addition of the tls.getCACertificates() method, the v8.getCppHeapStatistics() method, and improvements in error handling, along with updates to root certificates and various dependencies.
II. Issues
2.1 Top 5 Active Issues:
We consider active issues to be issues that that have been commented on most frequently within the last week. Bot comments are omitted.
-
HTTP Upgrade IncomingMessage does not parse body: This issue is about a bug in Node.js version 22.15.0 on Linux, where the HTTP
IncomingMessagedoes not parse the body during an upgrade event, leading to unparsed content being potentially included in theheadargument. The expected behavior is for Node.js to parse the body as it would in a normal HTTP request, but instead, the content is ignored or mishandled, especially in cases of chunked encoded bodies.- The comments discuss whether the current behavior is expected due to protocol upgrade, with some arguing that Node.js should parse the body if indicated by headers, while others note that the behavior has been consistent and aligns with certain protocol specifications. There is also a discussion on how other runtimes handle this and references to the HTTP specification, suggesting that the server should process the HTTP request body before switching protocols.
- Number of comments this week: 8
-
Transpile TypeScript code inside
node_modules.: This issue discusses the limitations of Node.js in handling TypeScript code withinnode_modulesin monorepo environments, particularly when using experimental features like--experimental-strip-typesand--experimental-transform-types. The problem arises because Node.js does not apply these transformations to packages insidenode_modules, even if they are symlinked from local workspace packages, forcing developers to pre-transpile dependencies, which undermines the benefits of these features.- The comments highlight concerns about the feasibility of preventing untranspiled code from being published, noting that Node.js should focus on enabling effective workflows rather than enforcing strict rules. A previous suggestion similar to this issue was rejected, and there is a discussion about the intended behavior of symlinked packages in
node_modules. A workaround involving package.json adjustments and specific Node.js conditions is shared, which some find surprising and suggest documenting as a potential solution. - Number of comments this week: 6
- The comments highlight concerns about the feasibility of preventing untranspiled code from being published, noting that Node.js should focus on enabling effective workflows rather than enforcing strict rules. A previous suggestion similar to this issue was rejected, and there is a discussion about the intended behavior of symlinked packages in
-
lib: callbacks firing twice if first attempt throws: This issue addresses a bug in the code where callbacks are being fired twice if the first attempt throws an error, due to the callback call being wrapped in a try block. The problem arises because if the callback itself throws an error, it gets caught and is called again with its own error, leading to unintended behavior.
- The comments discuss concerns about exceptions not being caught and potentially disappearing, with assurances given that errors will be handled properly by checking if an error has already occurred before calling the callback. There is also a discussion on the importance of ensuring that exceptions bubble up correctly to crash the program if not handled, rather than being silently ignored.
- Number of comments this week: 4
-
Update npm to v11 in Node.js v22: This issue involves updating NPM to version 11 in Node.js version 22 to address a bug that is causing difficulties for many users. The discussion also seeks to clarify the breaking changes associated with this update, which appear to be minimal according to the provided changelog.
- The comments discuss specific breaking changes introduced in NPM v11, including changes to publishing behavior, new prompts in
npm init, and modifications to script handling. There is a noted issue with NPM 11.4.0 on Windows, particularly for Powershell users, which is being addressed. Additionally, there is concern about a deprecation warning for non-NPM config options in .npmrc files, which could cause user friction. - Number of comments this week: 4
- The comments discuss specific breaking changes introduced in NPM v11, including changes to publishing behavior, new prompts in
-
Bad reporting unsettled top-level await: This issue reports a bug in Node.js version 23.11.0 where a script using top-level await results in a warning about an "unsettled top-level await" and exits with error code 13, instead of executing as expected. The problem is reproducible on the specified platform and is believed to be related to how the Node.js runtime handles the last statement in the script, with a workaround involving adding a no-op statement.
- The comments discuss that this issue is similar to a previously identified bug, which has been fixed in a newer version of Node.js, and suggest using Node 22 or adding a no-op line as a temporary solution. Additionally, there is a mention of a delay in the release of Node 24 due to unrelated issues with Homebrew, and an explanation is provided about why the exit code 13 occurs due to a deadlock in the script's execution.
- Number of comments this week: 3
2.2 Top 5 Stale Issues:
We consider stale issues to be issues that has had no activity within the last 30 days. The team should work together to get these issues resolved and closed as soon as possible.
- Flaky
test-worker-arraybuffer-zerofillwith V8 12.2: This issue concerns a flaky test namedtest-worker-arraybuffer-zerofillassociated with V8 version 12.2, which has been failing intermittently, as indicated by a timeout error in the console output. The problem might be due to a real bug or broken timing assumptions/messages getting lost, and it has been suggested to mark the test as flaky and add logs for better debugging. - Support loading dynamic addon modules (
.nodefiles) when embedding the Node.js shared library without needing to link withnode.def: This issue addresses the challenge of loading dynamic addon modules, specifically.nodefiles, when embedding the Node.js shared library into a different executable without the need to link withnode.def. The proposed feature suggests a potential solution to bypass this requirement by using an environment variable to facilitate the loading process, although the security implications of this approach are still uncertain. - unable to sign with external OpenSSL engine after usage of crypto.hash: This issue involves a problem with signing using an external OpenSSL engine after utilizing the
crypto.hashfunction in Node.js, specifically occurring after the update to version 21.7.1. The error, which consistently reproduces, is linked to changes in the Node.js codebase and results in an unsupported digital envelope routine error, whereas the code functioned correctly in earlier versions like v21.6.2. - Make
util.isArray()EOL: This issue discusses the potential end-of-life (EOL) status of theutil.isArray()method, which is the last remaining type-checking method from a previous update where similar methods were deprecated in version 23.0.0. The issue raises the question of whether there is any remaining justification for keepingutil.isArray()active, now that its usage in the form-data library has been removed, and seeks input from contributors, including a specific mention to @marco-ippolito. Since there were fewer than 5 open issues, all of the open issues have been listed above.
2.3 Open Issues
This section lists, groups, and then summarizes issues that were created within the last week in the repository.
Issues Opened This Week: 17
Summarized Issues:
- Memory Management Issues in Node.js: Node.js has encountered several memory-related issues across different versions and environments. A memory leak in Node.js version 24.0.2 on Windows 11 is linked to the
fetchAPI'sresponse.text()method, with a noted prevalence on arm64 systems. Additionally, a significant increase in memory consumption is observed on Windows Server 2022 when Node.js is installed outside the default directory, potentially related to OpenSSL operations.
- Node.js API and Functionality Bugs: Various bugs have been reported in Node.js affecting its API and functionality. These include a discrepancy in the zlib module's compression functions, an error with
Readable.toWebconversion, and aTypeErrorinprocess.execvewhen omitting theargsargument. Additionally, a segmentation fault occurs when an error is thrown within an SQLite aggregate function's callback.
- Node.js Event and Stream Handling Issues: Issues have been identified in Node.js related to event and stream handling. The
EventEmitterenhancement proposal aims to introduce automatic event listener removal, while a bug causes a locked readable stream to throw an error during an aborted fetch request. Additionally, callbacks are being fired twice due to improper error handling.
- Node.js HTTP and Protocol Handling Issues: Node.js faces issues with HTTP and protocol handling, particularly when an HTTP server does not parse the request body during a protocol upgrade. This results in the body content being ignored or misplaced, contrary to expected behavior.
- Node.js Version-Specific Bugs: Certain bugs are specific to particular Node.js versions, affecting functionality and performance. A bug in v23.11.0 triggers a warning for "unsettled top-level await," while libuv in version 22.12+ misreports CPU cores in containerized environments, leading to performance issues.
- Node.js Feature Proposals and Enhancements: Proposals for enhancing Node.js include adding a
--watch-path-if-existsflag to improve file watching and consolidating export options in themock.moduleAPI. These enhancements aim to align with existing functionalities and reduce user confusion.
- Node.js Module and Package Management Challenges: Challenges in module and package management include enabling TypeScript transpilation within
node_modulesin monorepo environments. Current behavior necessitates pre-transpilation, defeating the purpose of experimental features, with proposed solutions involving specific flags andtsconfighandling.
- Node.js NPM and Configuration Updates: Updating NPM to version 11 in Node.js version 22 addresses specific bugs and user friction, focusing on Windows-specific issues and deprecation warnings for non-NPM config options in
.npmrcfiles.
2.4 Closed Issues
This section lists, groups, and then summarizes issues that were closed within the last week in the repository. This section also links the associated pull requests if applicable.
Issues Closed This Week: 9
Summarized Issues:
- Documentation Issues: Node.js documentation has several issues, including the
--watch-pathoption requiring a file to be specified, which is not clearly documented, and theprocessAPI section not being sorted alphabetically. These documentation gaps can lead to confusion among users, necessitating updates to ensure clarity and usability.
- Build and Installation Problems: Users have reported build failures on macOS and issues with the Node.js v22.16.0 installer on macOS 10.14 Mojave. These problems are due to errors during the build process and the installer not checking for OS compatibility, which can disrupt development workflows and require fixes to prevent such occurrences.
- Flaky and Intermittent Test Failures: The Node.js project is experiencing flaky test failures, such as the "pummel/test-heapdump-zlib" on Linux x64 and the 'node-test-commit-v8-linux' CI task. These failures are due to timeouts and incorrect parameters, respectively, causing disruptions in the CI process and blocking pull requests.
- Environment and Path Issues: There are issues with the
spawnfunction not correctly using thePATHenvironment variable on Linux and TypeScript type-only imports causing unnecessary module loading. These problems can lead to failures in locating binaries and runtime errors, highlighting the need for documentation updates or fixes.
2.5 Issue Discussion Insights
This section will analyze the tone and sentiment of discussions within this project's open and closed issues that occurred within the past week. It aims to identify potentially heated exchanges and to maintain a constructive project environment.
Based on our analysis, there are no instances of toxic discussions in the project's open or closed issues from the past week.
III. Pull Requests
3.1 Open Pull Requests
This section provides a summary of pull requests that were opened in the repository over the past week. The top three pull requests with the highest number of commits are highlighted as 'key' pull requests. Other pull requests are grouped based on similar characteristics for easier analysis. Up to 25 pull requests are displayed in this section, while any remaining pull requests beyond this limit are omitted for brevity.
Pull Requests Opened This Week: 29
Key Open Pull Requests
1. test_runner: support object property mocking: This pull request introduces support for object property mocking in the test runner, allowing developers to mock property values, track access counts and types, and restore original values, as demonstrated in the provided example usage.
- URL: pull/58438
- Merged: No
2. [WIP] buffer: implement native C++ fast-path for Buffer.concat: This pull request aims to implement a native C++ fast-path for the Buffer.concat method in Node.js, resulting in significant performance improvements as demonstrated by benchmark results showing reductions in execution time by up to 81.98% across various test scenarios.
- URL: pull/58409
- Merged: No
3. fs: remove IIFE in glob: This pull request aims to enhance the Node.js project by removing an Immediately Invoked Function Expression (IIFE) from the 'glob' module, as referenced in issue #58419, and includes several commits that remove obsolete comments, add and simplify tests, but has not yet been merged.
- URL: pull/58418
- Merged: No
Other Open Pull Requests
- Callback-based
fs.globfunction: This topic introduces a callback-basedfs.globfunction to the glob benchmark in the Node.js project. The pull request includes additional commits for optimizing the benchmark and addressing linting issues.
- Asynchronous Worker disposal: This topic proposes making the Worker object in the Node.js project asynchronously disposable. The pull request includes commits for implementing this feature and adding a corresponding test.
- Error handling and method reorganization: This topic aims to enhance error handling in the
CompileFunctionAndCacheResultfunction and reorganize methods related toContextifyFunction. The pull request references a previous discussion for context.
- Module deprecation warnings: This topic enhances module deprecation warnings by suggesting alternative modules to use. The pull request updates the system warning to reference
node:utilinstead ofutil.
- V8 sandbox preparation: This topic prepares the codebase for future v8 sandboxing by introducing compile-time branches to handle ArrayBuffer allocations within the isolate. The pull request disables the
--secure-heapfeature due to compatibility issues.
- SQLite module cleanup: This topic involves cleaning up the ERM support and exporting the Session class in the SQLite module. The pull request updates the SQLite Session to support
Symbol.disposeand relocates the definition of the dispose methods to C++.
- FIPS initialization error handling: This topic addresses an issue where the process might incorrectly exit with a success code when FIPS initialization fails. The pull request modifies the logic to exit with a generic user error code and updates the test case.
- Disposable event loop histogram: This topic proposes making the event loop display histogram in the
perf_hooksmodule disposable. The pull request provides a test example for clarification.
- Fast API implementations in
http_parser: This topic proposes the addition of fast API implementations to thehttp_parser. The pull request includes several other code cleanups.
- SourceURL magic comments: This topic enhances the Node.js project by utilizing the V8 API to directly obtain sourceURL magic comments. The pull request updates the source map snapshot normalization to facilitate testing of full pathnames.
- HTTP/2 diagnostics channel: This topic introduces a new diagnostics channel named 'http2.server.stream.created' to the Node.js project. The pull request aims at enhancing the observability of HTTP/2 server stream creation events.
- SecureContext error handling: This topic addresses the need to verify the return values of the functions
EVP_EncryptInit_exandEVP_DecryptInit_ex. The pull request ensures proper error handling and robustness in the Node.js codebase.
- Class member initialization: This topic aims to initialize the
CID::cid_class member within the constructor. The pull request ensures proper setup and functionality of the class in the Node.js project.
- Explicit Resource Management consistency: This topic enhances consistency in Node.js's core by modifying ERM functions to return
undefined. The pull request aligns with theDisposableInterface specification and improves error traceability.
- DNS query cache implementation: This topic addresses an incomplete implementation of the DNS query cache by adding a missing option mask flag. The pull request acknowledges the contribution of @augjoh for highlighting the oversight.
- Optional
argsinprocess.execve: This topic proposes making theargsargument in theprocess.execvefunction optional. The pull request aligns the implementation with the documentation and similar methods for executing OS commands.
- Test warning flag removal: This topic proposes the removal of the
--no-warningsflag from a test in the Node.js project. The pull request suggests that any potential warnings should be addressed directly rather than suppressed.
- SQLite aggregate function crash fix: This topic addresses an issue by updating the SQLite aggregate function 'result' callback handling. The pull request prevents crashes when exceptions are thrown.
- Callback invocation fix in
Dirclass: This topic addresses an issue by preventing multiple invocations of a callback in theDirclass. The pull request implements a fix to handle cases where an error is produced during the first callback invocation.
- OpenSSL documentation retention: This topic ensures that two specific OpenSSL documentation files are retained in the Node.js project. The pull request facilitates the generation of platform-specific files.
- OpenSSL generation container update: This topic proposes updating the OpenSSL generation container to use Ubuntu 22.04. The pull request ensures that the
make gen-opensslcommand produces consistent assembly files across different systems.
node:zlibdocumentation enhancement: This topic aims to enhance the documentation for thenode:zlibclasses by adding links to their parent classes. The pull request improves navigability and understanding of the class hierarchy.
styleTextutility function update: This topic introduces a 'none' style option to thestyleTextutility function. The pull request allows developers to bypass styling when it is unnecessary.
-Wreturn-stack-addresserror fix: This topic addresses a-Wreturn-stack-addresserror in the Node.js project. The pull request fixes an issue in thenode_config_file.ccfile where a local temporary object's address was being returned.
- DNS module timeout limit: This topic introduces a feature to the DNS module that implements a maximum timeout limit for query retries. The pull request ensures that the timeout does not increase indefinitely.
3.2 Closed Pull Requests
This section provides a summary of pull requests that were closed in the repository over the past week. The top three pull requests with the highest number of commits are highlighted as 'key' pull requests. Other pull requests are grouped based on similar characteristics for easier analysis. Up to 25 pull requests are displayed in this section, while any remaining pull requests beyond this limit are omitted for brevity.
Pull Requests Closed This Week: 39
Key Closed Pull Requests
1. fs: improve cpSync dest overriding performance: This pull request enhances the performance of the cpSync function in Node.js by moving the logic for overriding existing destination files from JavaScript to C++, resulting in improved efficiency and speed.
- URL: pull/58160
- Merged: 2025-05-23T12:26:05Z
- Associated Commits: a29c2, 48621, bac88, 8bb5d, d3fd7, 198d7, 15c2c, d486a, b1ef7, 0e7fa, 28289, 6956e
2. doc: clarify --watch and --watch-path usage with --run: This pull request aims to clarify the usage of the --watch and --watch-path command-line interface options in the cli.md documentation by adding a note that these flags require a file path and cannot be used with the --run option, addressing user confusion and preventing runtime errors, as discussed in a related issue.
- URL: pull/58136
- Merged: No
3. esm: add support for dynamic source phase hook: This pull request aims to introduce support for the dynamic import.source() phase from the latest V8 engine into the Node.js project, along with enabling the relevant tests, as indicated by the commits addressing the addition of the feature, an ESLint fix, and a validation function adjustment.
- URL: pull/58147
- Merged: No
Other Closed Pull Requests
- OpenHarmony Support: This topic involves adding support for the OpenHarmony operating system by adapting the build process for the arm64 architecture. The pull request marks the support type as 'Experimental' and removes conditions that will never be triggered.
- Pointer Compression Builds: The pull request addresses issues with pointer compression builds by removing the deprecated
V8::InitializeSandbox()function. It ensures that external code space and pointer compression shared cage are enabled, and skips certain WebAssembly allocation tests due to limitations with virtual memory allocation in V8 isolate group initialization.
- Benchmark Enhancements: Enhancements to the benchmark for the
fs.cpSyncfunction are made by adding and testing the performance of thedereferenceandforceoptions. The implementation includes aprepareTestDirectoryfunction to create a test directory with symbolic links and pre-copy logic for the force option.
- Obsolete Types Removal: This pull request removes two obsolete types,
revokeDataObjectandFixedSizeBlobCopyJob, from theblob.d.tsfile. Their corresponding C++ implementations had been previously removed in earlier pull requests.
- Path Resolution Optimization: The performance of the
path.resolve()function is enhanced, particularly when used without arguments as an alternative toprocess.cwd(). The optimization significantly improves execution speed in specific scenarios, as demonstrated by local benchmark results.
- Diagnostic Message Output: An issue is addressed by changing the output of diagnostic messages in watch mode from stdout to stderr. This ensures that these messages do not interfere with the normal output of programs that use stdout, although the pull request was not merged.
- Documentation Reordering: The reordering of functions in the
processAPI documentation is addressed by moving theavailableMemoryandexecveentries to their correct alphabetical positions. This resolves issue #58402 on the Node.js GitHub repository.
- Crypto Tests Update: Updates to the crypto tests ensure compatibility with BoringSSL, as indicated by the title and commit message. The changes follow similar updates made in previous pull requests.
- Color Support Detection: Improvements in the detection of color support in terminal environments are made by adding new entries and enhancing existing support. The updates are based on data from sources like ncurses, tput, supports-color, and termstandard, with most updates derived from supports-color.
- Build Process Update: The build process is updated to correctly locate the
libnode.sofile in thelibsubdirectory when building with the--sharedoption. This addresses an issue discovered during a Fedora RPM review where the file was previously being manually moved to the root of the build directory.
- Module Replacement: The codebase is updated by replacing the deprecated
optparsemodule with the recommendedargparsemodule. This ensures the project uses a currently maintained and supported library, asoptparsehas been deprecated since Python 3.2 / 2.7.
- Readline Module Validation: Stricter validation for the
readlinemodule is introduced by ensuring that callingpause(),resume(), orwrite()on a closed interface throwsERR_USE_AFTER_CLOSEerrors. The changes reintroduce previous attempts while addressing issues with the REPL still invoking these functions post-closure.
- Diagnostics Channel Addition: A new diagnostics channel named 'http2.client.stream.close' is introduced to the Node.js project. This enhances the ability to monitor and debug HTTP/2 client stream closures.
- Stream Modules Deprecation: The runtime deprecation of all the
_stream_*modules, except for_stream_wrap, is proposed. This is part of an effort to phase out undocumented modules from Node.js's public API, following a previous related pull request.
- CI Process Improvement: Improvements to the continuous integration (CI) process for the 20.x branch of the Node.js project are made by disabling certain test environments in the
test-linuxCI. These environments were added in a previous commit but are not functioning correctly, thereby enhancing the usefulness of the CI results.
- TTY Mode Update: The use of the
UV_TTY_MODE_RAW_VTflag in libuv for Windows applications is introduced. This allows the terminal to translate keypresses into control sequences instead of libuv, aligning the TTY setup more closely with POSIX platforms.
- Error Messaging Improvement: Error messaging is improved by clarifying the error that occurs when the
process.cwd()function fails due to a missing directory. This is indicated by the commit message and its association with issue #57045.
- Deprecated Methods Removal: References to the deprecated
createCipher()andcreateDecipher()methods are removed. These methods were eliminated in Node.js 22 to ensure compatibility and maintain the codebase's relevance with the latest Node.js version.
- ChaCha20-Poly1305 Algorithm Addition: The ChaCha20-Poly1305 algorithm is added to the authentication tag order test suite. This ensures that the authentication tag can be set either before or after calling the
update()function, and standardizes the key size to 256 bits across all tested algorithms.
- Test Loop Removal: The removal of an unnecessary loop in a test is addressed. The test previously iterated over two elements but now only iterates over a single element due to a prior commit, simplifying the code by moving the test outside the loop.
- Function Naming in ChildProcess: Specific names are assigned to functions within the
ChildProcessmodule. This change is indicated by the commit message and the title, and it was successfully merged into the Node.js project.
- ESLint Rule Removal: The "no-mixed-operators" ESLint rule is removed from the project. It often reduces code readability by necessitating additional brackets, and the author has not observed it catching any real issues in the code.
- Buffer Handling Improvements: Minor improvements to buffer handling are proposed by suggesting that when using
Buffer::Newwith an externally allocated buffer and V8 sandbox enabled, the buffer should be copied instead of wrapped. Additionally, when performing an immediatememcpyinto the full buffer, it should be allocated withkUninitializedfor a slight performance optimization.
- OCB Decryption in FIPS Mode: The issue of skipping OCB decryption in FIPS mode is addressed by proposing that OCB should function correctly in this mode, with only CCM being skipped. A commit is included to implement this change.
- OpenSSL/BoringSSL Feature Exposure: A feature is introduced that exposes
process.features.openssl_is_boringsslto allow JavaScript code to determine whether BoringSSL or OpenSSL is being used. This facilitates the adaptation of Node.js crypto tests to be compatible with both libraries.
3.3 Pull Request Discussion Insights
This section will analyze the tone and sentiment of discussions within this project's open and closed pull requests that occurred within the past week. It aims to identify potentially heated exchanges and to maintain a constructive project environment.
Based on our analysis, there are no instances of toxic discussions in the project's open or closed pull requests from the past week.
IV. Contributors
4.1 Contributors
Active Contributors:
We consider an active contributor in this project to be any contributor who has made at least 1 commit, opened at least 1 issue, created at least 1 pull request, or made more than 2 comments in the last month.
If there are more than 10 active contributors, the list is truncated to the top 10 based on contribution metrics for better clarity.
| Contributor | Commits | Pull Requests | Issues | Comments |
|---|---|---|---|---|
| targos | 53 | 3 | 1 | 7 |
| anonrig | 21 | 5 | 0 | 34 |
| aduh95 | 20 | 4 | 1 | 35 |
| miguelmarcondesf | 43 | 5 | 0 | 8 |
| dario-piotrowicz | 29 | 5 | 1 | 15 |
| jasnell | 11 | 8 | 2 | 25 |
| LiviaMedeiros | 22 | 5 | 1 | 10 |
| joyeecheung | 18 | 6 | 2 | 9 |
| legendecas | 15 | 4 | 0 | 15 |
| tniessen | 16 | 9 | 0 | 1 |