chore(deps): update dependency node to v24 - #2396
Merged
Merged
Conversation
github-actions
Bot
added
the
agents:allow-change
Contributor
Workflow source neededPR #2396 needs either a linked GitHub issue or one valid non-issue Workflow Source before PR metadata automation can manage it safely. Please do one of:
Once a valid source is present, this warning will not be reposted. |
Contributor
Automated Status SummaryHead SHA: c96a0da
Coverage Overview
Coverage Trend
Top Coverage Hotspots (lowest coverage)
Low Coverage Files (<50.0%)
Updated automatically; will refresh on subsequent CI/Docker completions. Keepalive checklistScopeNo scope information available Tasks
Acceptance criteria
|
renovate
Bot
force-pushed
the
renovate/node-24.x
branch
from
June 15, 2026 04:30
9ed5426 to
16c6a0d
Compare
renovate
Bot
force-pushed
the
renovate/node-24.x
branch
from
June 15, 2026 05:50
16c6a0d to
9721b85
Compare
📝 WalkthroughWalkthroughNode.js is upgraded from version 20 to 24 across all ChangesNode.js 20 → 24 Upgrade
Estimated code review effort🎯 1 (Trivial) | ⏱️ ~3 minutes Possibly related issues
🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 3
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
.github/workflows/agents-issue-optimizer.yml (1)
103-107:⚠️ Potential issue | 🟠 MajorPin all third-party actions to immutable SHAs, and sync main workflow with template.
The workflow uses three unpinned third-party actions:
actions/checkout@v6,actions/setup-node@v6, andactions/setup-python@v6(lines 101, 105, 125). Additionally,templates/consumer-repo/.github/workflows/agents-issue-optimizer.ymlalready pinscheckoutandsetup-pythonto SHAs, revealing a sync drift where the main workflow is less secure than the template. Per coding guidelines, changes must be reflected in both locations.🔒 Suggested changes
- name: Checkout repository if: steps.check.outputs.should_run == 'true' - uses: actions/checkout@v6 + uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 - name: Set up Node.js if: steps.check.outputs.should_run == 'true' - uses: actions/setup-node@v6 + uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0 with: node-version: 24 - name: Set up Python if: steps.check.outputs.should_run == 'true' - uses: actions/setup-python@v6 + uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6 with: python-version: '3.14'Apply the same pinning in
templates/consumer-repo/.github/workflows/agents-issue-optimizer.yml(which already has the first two pinned—ensure setup-node matches the main workflow if it's added to the template).🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/agents-issue-optimizer.yml around lines 103 - 107, The workflow uses three unpinned third-party actions (actions/checkout, actions/setup-node, and actions/setup-python) that should be pinned to immutable commit SHAs instead of version tags for security. Replace the version tags (`@v6`) with their specific commit SHAs for each of these three actions. Additionally, ensure that the same pinned SHAs are consistently applied in both the main workflow and the template workflow to maintain synchronization and security standards across both locations.Source: Coding guidelines
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/agents-63-issue-intake.yml:
- Around line 275-278: Pin the actions/setup-node action to a specific commit
SHA instead of using the mutable version tag to enhance supply-chain integrity.
Replace all occurrences of `actions/setup-node@v6` with
`actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6`. Make this
change at three locations: .github/workflows/agents-63-issue-intake.yml lines
275-278 (the uses statement in the first Set up Node.js step),
.github/workflows/agents-63-issue-intake.yml lines 1490-1493 (the uses statement
in the second Set up Node.js step), and
.github/workflows/agents-bot-comment-handler.yml lines 185-189 (the uses
statement in the Set up Node.js step in that workflow file).
In @.github/workflows/agents-weekly-metrics.yml:
- Around line 38-42: The node-version in two workflow files has been updated to
"24" but this breaks the enforced contract test in
tests/workflows/test_workflow_agents_consolidation.py line 424 which requires
node-version to be "20". Revert the node-version setting in
.github/workflows/agents-weekly-metrics.yml line 41 from "24" back to "20", and
also revert the same setting in
templates/consumer-repo/.github/workflows/agents-weekly-metrics.yml line 50 from
"24" back to "20" to maintain sync between the two files and satisfy the
contract test.
In `@templates/consumer-repo/.github/workflows/agents-weekly-metrics.yml`:
- Line 50: The Node version bump to "24" in the agents-weekly-metrics.yml
workflow at the node-version setting is breaking the weekly metrics validation
contract which is still expecting Node 20. Either update the weekly metrics
validation contract and test that explicitly checks against Node 20 to accept
Node 24, or revert the node-version in agents-weekly-metrics.yml back to "20" to
maintain compatibility with the existing contract. Choose one approach
consistently to resolve the merge-blocking selftest failure.
---
Outside diff comments:
In @.github/workflows/agents-issue-optimizer.yml:
- Around line 103-107: The workflow uses three unpinned third-party actions
(actions/checkout, actions/setup-node, and actions/setup-python) that should be
pinned to immutable commit SHAs instead of version tags for security. Replace
the version tags (`@v6`) with their specific commit SHAs for each of these three
actions. Additionally, ensure that the same pinned SHAs are consistently applied
in both the main workflow and the template workflow to maintain synchronization
and security standards across both locations.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: ASSERTIVE
Plan: Pro Plus
Run ID: 49df2b77-21ba-4bcb-9367-fcfdf6f08aa7
📒 Files selected for processing (20)
.devcontainer/devcontainer.json.github/actions/agent-run-base/action.yml.github/workflows/agents-63-issue-intake.yml.github/workflows/agents-auto-pilot.yml.github/workflows/agents-bot-comment-handler.yml.github/workflows/agents-issue-optimizer.yml.github/workflows/agents-keepalive-dispatch-handler.yml.github/workflows/agents-keepalive-loop-reporter.yml.github/workflows/agents-keepalive-loop.yml.github/workflows/agents-weekly-metrics.yml.github/workflows/health-75-api-rate-diagnostic.yml.github/workflows/health-76-codex-cli-freshness.yml.github/workflows/pr-00-gate.yml.github/workflows/reusable-10-ci-python.yml.github/workflows/reusable-20-pr-meta.yml.github/workflows/reusable-cursor-run.yml.github/workflows/selftest-ci.ymltemplates/consumer-repo/.github/workflows/agents-auto-pilot.ymltemplates/consumer-repo/.github/workflows/agents-weekly-metrics.ymltemplates/consumer-repo/.github/workflows/pr-00-gate.yml
🔗 Linked repositories identified
CodeRabbit considers these linked repositories for cross-repo context during reviews:
stranske/Template(auto-detected)
stranske
temporarily deployed
to
agent-high-privilege
June 16, 2026 20:32 — with 
GitHub Actions
Inactive
GitHub Actions
Inactive
stranske
enabled auto-merge (squash)
June 16, 2026 20:33
Contributor
Author
Edited/Blocked NotificationRenovate will not automatically rebase this PR, because it does not recognize the last commit author and assumes somebody else may have edited the PR. You can manually request rebase by checking the rebase/retry box above. |
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@config/template-drift-allowlist.txt`:
- Around line 10-11: The allowlist entries at lines 10-11, 80-82, and 87-88
update main_sha256 without updating template_sha256 for workflows that have
consumer template counterparts, which masks drift instead of enforcing
consistency across consumer repos. Remove these entries from the allowlist, or
first propagate the workflow changes to
templates/consumer-repo/.github/workflows/* to match the main workflow updates,
then update both main_sha256 and template_sha256 together in the allowlist
entries according to the coding guideline that any change to consumer-used
workflows must be reflected in both the main workflows and the consumer template
workflows.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: ASSERTIVE
Plan: Pro Plus
Run ID: 4324a863-9761-4c96-be80-b6656842c43b
📒 Files selected for processing (5)
.github/workflows/agents-63-issue-intake.yml.github/workflows/agents-bot-comment-handler.yml.github/workflows/agents-issue-optimizer.ymlconfig/template-drift-allowlist.txttests/workflows/test_workflow_agents_consolidation.py
🔗 Linked repositories identified
CodeRabbit considers these linked repositories for cross-repo context during reviews:
stranske/Template(auto-detected)
Comment on lines
+10
to
11
| main_sha256 = 8e552c2e168919da4265d78ae3983c21bced979c2896fb4fb928bbb0796c13a0 | ||
| template_sha256 = 689d22e20cc6f21df006a2f7ed54924fc05d63adea5ef89251788f888f2a5495 |
There was a problem hiding this comment.
Do not allowlist main-only workflow changes for consumer-synced pairs.
Line 10, Line 80, and Line 87 update main_sha256 while leaving template_sha256 unchanged for workflows that have consumer template counterparts. That masks drift instead of propagating the workflow change to templates/consumer-repo/.github/workflows/*, which can leave the 9 consumer repos on different behavior.
As per coding guidelines, “Any change to workflows that consumers use must be reflected in BOTH .github/workflows/ (main workflow) and templates/consumer-repo/.github/workflows/ (template).”
Also applies to: 80-82, 87-88
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@config/template-drift-allowlist.txt` around lines 10 - 11, The allowlist
entries at lines 10-11, 80-82, and 87-88 update main_sha256 without updating
template_sha256 for workflows that have consumer template counterparts, which
masks drift instead of enforcing consistency across consumer repos. Remove these
entries from the allowlist, or first propagate the workflow changes to
templates/consumer-repo/.github/workflows/* to match the main workflow updates,
then update both main_sha256 and template_sha256 together in the allowlist
entries according to the coding guideline that any change to consumer-used
workflows must be reflected in both the main workflows and the consumer template
workflows.
Source: Coding guidelines
This was referenced Jun 16, 2026
This was referenced Jun 16, 2026
1 task
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
20→2420→24Release Notes
actions/node-versions (node)
v24.16.0: 24.16.0Compare Source
Node.js 24.16.0
v24.15.0: 24.15.0Compare Source
Node.js 24.15.0
v24.14.1: 24.14.1Compare Source
Node.js 24.14.1
v24.14.0: 24.14.0Compare Source
Node.js 24.14.0
v24.13.1: 24.13.1Compare Source
Node.js 24.13.1
v24.13.0: 24.13.0Compare Source
Node.js 24.13.0
v24.12.0: 24.12.0Compare Source
Node.js 24.12.0
v24.11.1: 24.11.1Compare Source
Node.js 24.11.1
v24.11.0: 24.11.0Compare Source
Node.js 24.11.0
v24.10.0: 24.10.0Compare Source
Node.js 24.10.0
v24.9.0: 24.9.0Compare Source
Node.js 24.9.0
v24.8.0: 24.8.0Compare Source
Node.js 24.8.0
v24.7.0: 24.7.0Compare Source
Node.js 24.7.0
v24.6.0: 24.6.0Compare Source
Node.js 24.6.0
v24.5.0: 24.5.0Compare Source
Node.js 24.5.0
v24.4.1: 24.4.1Compare Source
Node.js 24.4.1
v24.4.0: 24.4.0Compare Source
Node.js 24.4.0
v24.3.0: 24.3.0Compare Source
Node.js 24.3.0
v24.2.0: 24.2.0Compare Source
Node.js 24.2.0
v24.1.0: 24.1.0Compare Source
Node.js 24.1.0
v24.0.2: 24.0.2Compare Source
Node.js 24.0.2
v24.0.1: 24.0.1Compare Source
Node.js 24.0.1
v24.0.0: 24.0.0Compare Source
Node.js 24.0.0
v22.22.3: 22.22.3Compare Source
Node.js 22.22.3
v22.22.2: 22.22.2Compare Source
Node.js 22.22.2
v22.22.1: 22.22.1Compare Source
Node.js 22.22.1
v22.22.0: 22.22.0Compare Source
Node.js 22.22.0
v22.21.1: 22.21.1Compare Source
Node.js 22.21.1
v22.21.0: 22.21.0Compare Source
Node.js 22.21.0
v22.20.0: 22.20.0Compare Source
Node.js 22.20.0
v22.19.0: 22.19.0Compare Source
Node.js 22.19.0
v22.18.0: 22.18.0Compare Source
Node.js 22.18.0
v22.17.1: 22.17.1Compare Source
Node.js 22.17.1
v22.17.0: 22.17.0Compare Source
Node.js 22.17.0
v22.16.0: 22.16.0Compare Source
Node.js 22.16.0
v22.15.1: 22.15.1Compare Source
Node.js 22.15.1
v22.15.0: 22.15.0Compare Source
Node.js 22.15.0
v22.14.0: 22.14.0Compare Source
Node.js 22.14.0
v22.13.1: 22.13.1Compare Source
Node.js 22.13.1
v22.13.0: 22.13.0Compare Source
Node.js 22.13.0
v22.12.0: 22.12.0Compare Source
Node.js 22.12.0
v22.11.0: 22.11.0Compare Source
Node.js 22.11.0
v22.10.0: 22.10.0Compare Source
Node.js 22.10.0
v22.9.0: 22.9.0Compare Source
Node.js 22.9.0
v22.8.0: 22.8.0Compare Source
Node.js 22.8.0
v22.7.0: 22.7.0Compare Source
Node.js 22.7.0
v22.6.0: 22.6.0Compare Source
Node.js 22.6.0
v22.5.1: 22.5.1Compare Source
Node.js 22.5.1
v22.5.0: 22.5.0Compare Source
Node.js 22.5.0
v22.4.1: 22.4.1Compare Source
Node.js 22.4.1
v22.4.0: 22.4.0Compare Source
Node.js 22.4.0
v22.3.0: 22.3.0Compare Source
Node.js 22.3.0
v22.2.0: 22.2.0Compare Source
Node.js 22.2.0
v22.1.0: 22.1.0Compare Source
Node.js 22.1.0
v22.0.0: 22.0.0Compare Source
Node.js 22.0.0
nodejs/node (node)
v24.16.0: 2026-05-21, Version 24.16.0 'Krypton' (LTS), @aduh95Compare Source
Notable Changes
b267f6bca3] - (SEMVER-MINOR) crypto: implementrandomUUIDv7()(nabeel378) #62553ec2451b9cd] - (SEMVER-MINOR) debugger: add edit-free runtime expression probes tonode inspect(Joyee Cheung) #627139705f628d9] - (SEMVER-MINOR) fs: add signal option tofs.stat()(Mert Can Altin) #5777540ccfdecf9] - (SEMVER-MINOR) fs: exposefrsizefield instatfs(Jinho Jang) #62277d7188af5c9] - (SEMVER-MINOR) http: hardenClientRequestoptions merge (Matteo Collina) #63082aa1d8a9afc] - (SEMVER-MINOR) http: addreq.signaltoIncomingMessage(Akshat) #625416f37f7e240] - (SEMVER-MINOR) stream: propagate destruction induplexPair(Ahmed Elhor) #61098d14029be7f] - (SEMVER-MINOR) test_runner: support test order randomization (Pietro Marchini) #61747d142c584cd] - (SEMVER-MINOR) test_runner: align mock timeout api (sangwook) #6282001a9552585] - (SEMVER-MINOR) test_runner: add mock-timers support forAbortSignal.timeout(DeveloperViraj) #6075100705a459a] - (SEMVER-MINOR) util: colorize text with hex colors (Guilherme Araújo) #61556Commits
dd72df060d] - assert,util: fix stale nested cycle memo entries (Ruben Bridgewater) #62509add94f4bc3] - build: track PDL files as inputs in inspector GN build (Robo) #628881b1eb9e334] - build: remove redundant -fuse-linker-plugin from GCC LTO flags (Daniel Lando) #626678752b604ec] - crypto: deduplicate and canonicalize CryptoKey usages (Filip Skokan) #62902341947e7fd] - crypto: reject unintended raw key format string input (Filip Skokan) #6297428a78747fc] - crypto: remove Argon2 KDF derivation from its job setup (Filip Skokan) #6286316e8c2b54d] - crypto: fix unsigned conversion of 4-byte RSA publicExponent (DeepView Autofix) #62839eeae754a87] - crypto: reject inherited key type names (Jonathan Lopes) #628759dd5540325] - crypto: add memory tracking for secureContext openssl objects (Mert Can Altin) #59051b267f6bca3] - (SEMVER-MINOR) crypto: implement randomUUIDv7() (nabeel378) #625537597d204c1] - crypto: add support forEd25519context parameter (Filip Skokan) #624744bf85845da] - debugger: move ProbeInspectorSession and helpers to separate files (Joyee Cheung) #63013ec2451b9cd] - (SEMVER-MINOR) debugger: add edit-free runtime expression probes tonode inspect(Joyee Cheung) #6271383e98f77b7] - deps: update corepack to 0.35.0 (Node.js GitHub Bot) #63375ec8c6b939a] - deps: V8: cherry-pick657d8de(Guy Bedford) #62784722c0c3274] - deps: update nghttp3 to 1.14.0 (Node.js GitHub Bot) #611875304db93d3] - deps: update nghttp3 to 1.13.1 (Node.js GitHub Bot) #60046e073b3811d] - deps: update nghttp3 to 1.11.0 (James M Snell) #592491d00313fb2] - deps: update ngtcp2 to 1.14.0 (James M Snell) #592498b3a4fc18f] - deps: update amaro to 1.1.9 (Node.js GitHub Bot) #6309062fe0cfcd1] - deps: update llhttp to 9.4.1 (Node.js GitHub Bot) #63045137e09c8e9] - deps: update corepack to 0.34.7 (Node.js GitHub Bot) #6281014a4cb8fbc] - deps: update timezone to 2026b (Node.js GitHub Bot) #629623e1036583a] - deps: upgrade npm to 11.13.0 (npm team) #6289801dfe5961c] - deps: cherry-pick libuv/libuv@439a54b(skooch) #628816cd368b10c] - deps: update sqlite to 3.53.0 (Node.js GitHub Bot) #62699f218a4f553] - deps: update nbytes to 0.1.4 (Node.js GitHub Bot) #62698b47688524a] - deps: update archs files for openssl-3.5.6 (Node.js GitHub Bot) #62629d202e2d343] - deps: upgrade openssl sources to openssl-3.5.6 (Node.js GitHub Bot) #626292faba66341] - deps: update minimatch to 10.2.5 (Node.js GitHub Bot) #62594fa46c90c5d] - deps: update googletest tod72f9c8(Node.js GitHub Bot) #62593099ded5713] - deps: update simdjson to 4.6.1 (Node.js GitHub Bot) #625927ce95afe96] - deps: libuv: cherry-pickaabb765(Santiago Gimeno) #6256157ef845623] - deps: update icu to 78.3 (Node.js GitHub Bot) #62324493ac40e12] - deps: update libuv to 1.52.1 (Node.js GitHub Bot) #61829b39508b368] - deps: update undici to 7.25.0 (Node.js GitHub Bot) #63011cb67a925e9] - deps: use npm undici@seven tag inupdate-undici.sh(Matteo Collina) #62739aa1e0bc28b] - doc: fix typos and inconsistencies in crypto.md and webcrypto.md (Filip Skokan) #62828f2a1735ed9] - doc: fix duplicate word "to to" in util.styleText (Daijiro Wachi) #62917b6378e215c] - doc: fix node-config-schema (Сковорода Никита Андреевич) #61596233894a9ce] - doc: fix the TypeScript Execute (tsx) project link (David Thornton) #630935d97919f8f] - doc: correct diagnostics_channel built-in channel names (Bryan English) #629952a9ccc927e] - doc: use mjs/cjs blocks for callbackify null reason example (Daijiro Wachi) #62884ef413b5358] - doc: fix typo in test.md (Rich Trott) #6296076f21c5070] - doc: correct typo in PR contribution instructions (Mike McCready) #62738ca02af1f7d] - doc: fix duplicate word "of of" in postMessageToThread (Daijiro Wachi) #6291746c99ed526] - doc: fix duplicate word "for for" in compile cache (Daijiro Wachi) #629171a60851734] - doc: fix typo in dns.lookup options description (Daijiro Wachi) #62882169b5ea2ed] - doc: fix Argon2 parameter bounds (Tobias Nießen) #628689a3a190f4e] - doc: clarify diffieHellman.generateKeys recomputes same key (Kit Dallege) #622050fba9e87d6] - doc: remove Ayase-252 and meixg from triagger team (Antoine du Hamel) #628419c700f3446] - doc: clarify dns.lookup() callback signature when all is true (eungi) #628006b7280bc17] - doc: add experimental modules lifetime policy (Paolo Insogna) #62753ce47ea31c9] - doc: clarify process._debugProcess() in Permission Model (Fahad Khan) #62537ba01633757] - doc: fix typo in devcontainer guide (Rohan Santhosh Kumar) #6268770b4d5839b] - doc: clarify Backport-PR-URL metadata added automatically (Mike McCready) #626688126d1c3eb] - doc: update WPT test runner README.md (Filip Skokan) #62680978afea4b5] - doc: fix spelling in release announcement guidance (Rohan Santhosh Kumar) #626631684ab8ff8] - doc: note non-monotonic clock in crypto.randomUUIDv7 (nabeel378) #6260086d4f07930] - doc: update bug bounty program (Rafael Gonzaga) #62590736ed8a08f] - doc: document TransformStream transformer.cancel option (Tom Pereira) #62566938af9be01] - doc: mention test runner retry attemp is zero based (Moshe Atlow) #6250494433e450f] - doc,src,test: fix dead inspector help URL (semimikoh) #62745ddf1f01659] - esm: addERR_REQUIRE_ESM_RACE_CONDITION(Antoine du Hamel) #624624a506acd16] - fs: add followSymlinks option to glob (Matteo Collina) #62695f4ea495f9b] - fs: restore fs patchability in ESM loader (Joyee Cheung) #6283563c111cd60] - fs: validate position argument before length === 0 early return (Edy Silva) #626749705f628d9] - (SEMVER-MINOR) fs: add signal option to fs.stat() (Mert Can Altin) #5777540ccfdecf9] - (SEMVER-MINOR) fs: expose frsize field in statfs (Jinho Jang) #62277717476a24e] - http: emit 'drain' on OutgoingMessage only after buffers drain (Robert Nagy) #62936d7188af5c9] - (SEMVER-MINOR) http: harden ClientRequest options merge (Matteo Collina) #6308264f15c274a] - http: fix leaked error listener on sync HTTP req create + destroy (Tim Perry) #628725c4798d799] - http: fix no_proxy leading-dot suffix matching (Daijiro Wachi) #623339f3bc70ae5] - http: cleanup pipeline queue (Robert Nagy) #62534aa1d8a9afc] - (SEMVER-MINOR) http: add req.signal to IncomingMessage (Akshat) #62541900dc758ff] - http2: expose writable stream state on compat response (T) #63003b3bfe35912] - inspector: coerce key and value to string in webstorage events (Ali Hassan) #626163dc3fb6ad8] - inspector: return errors when CDP protocol event emission fails (Ryuhei Shima) #621624f3f21bd7c] - inspector: auto collect webstorage data (Ryuhei Shima) #6214536cc04189d] - inspector: initial support storage inspection (Ryuhei Shima) #611391718bc3b9b] - inspector: fix absolute URLs in network http (bugyaluwang) #6295597e32c7a74] - lib: avoid quadratic shift() in startup snapshot callback (Daijiro Wachi) #6291425d2e999de] - lib: harden kKeyOps lookup with null prototype (Filip Skokan) #6287737d3913c8f] - lib: short-circuit WebIDL BufferSource SAB check (Filip Skokan) #62833430c69d25f] - lib: use js-only implementation ofisDataView()(René) #627803ba0add6a0] - lib: fix lint in internal/webstreams/util.js (Filip Skokan) #628069b95c41398] - lib: fix sequence argument handling in Blob constructor (Ms2ger) #62179314dacdbee] - lib: improve Web Cryptography key validation ordering (Filip Skokan) #627493d18162430] - lib: reject SharedArrayBuffer in web APIs per spec (Ali Hassan) #62632ada3ce879d] - lib: defer AbortSignal.any() following (sangwook) #62367b2981ec7eb] - meta: bump actions/download-artifact from 8.0.0 to 8.0.1 (dependabot[bot]) #625497cd20667b5] - meta: bump github/codeql-action from 4.35.1 to 4.35.3 (dependabot[bot]) #6307491a07cfe9f] - meta: bump Mozilla-Actions/sccache-action from 0.0.9 to 0.0.10 (dependabot[bot]) #6307309e17fe47c] - meta: add automation policy (Chengzhong Wu) #6287159e7fb7986] - meta: move VoltrexKeyva to emeritus (Matteo Collina) #628951e2915cfa6] - meta: bump peter-evans/create-pull-request from 8.1.0 to 8.1.1 (dependabot[bot]) #628450253c6e2be] - meta: bump step-security/harden-runner from 2.16.1 to 2.19.0 (dependabot[bot]) #62844f503675b86] - meta: bump actions/setup-node from 6.3.0 to 6.4.0 (dependabot[bot]) #628425e14e4d26e] - meta: broaden stale bot (Aviv Keller) #62658795db76f87] - meta: pass release version to release worker (flakey5) #62777ef384fe39f] - meta: add QUIC to CODEOWNERS (Tim Perry) #6265267e0ac568d] - meta: move Michael to emeritus (Michael Dawson) #625365dad616393] - meta: populate apt list for slim runner in update-openssl workflow (René) #62628a869d25d8a] - meta: bump step-security/harden-runner from 2.15.0 to 2.16.1 (dependabot[bot]) #62550769efc0403] - meta: bump actions/setup-node from 6.2.0 to 6.3.0 (dependabot[bot]) #6254873fcc2b055] - meta: bump github/codeql-action from 4.32.4 to 4.35.1 (dependabot[bot]) #625476c001246fe] - meta: bump codecov/codecov-action from 5.5.2 to 6.0.0 (dependabot[bot]) #625455ee40d6a03] - meta: bump actions/cache from 5.0.3 to 5.0.4 (dependabot[bot]) #62543ca16ad8a05] - meta: require DCO signoff in commit message guidelines (James M Snell) #62510db9497fc41] - meta: expand memory leak DoS criteria to all DoS (Joyee Cheung) #6250513b7d08b8d] - module: remove duplicated checks from_resolveFilename(Antoine du Hamel) #627296b53efb53a] - module,win: fix long subpath import (Stefan Stojanovic) #62101841dfbf6fc] - node-api: update libuv ABI stability note (Chengzhong Wu) #6278901090f2aa1] - node-api: add napi_create_external_sharedarraybuffer (Ben Noordhuis) #6262387443b4355] - node-api: execute tsfn finalizer after queue drains when aborted (Kevin Eady) #61956e95570c054] - process: handle rejections only when needed (Gürgün Dayıoğlu) #6291937d49f3219] - process: optimize asyncHandledRejections by using FixedQueue (Gürgün Dayıoğlu) #60854f697c55e38] - quic: add QuicEndpoint.listening & QuicStream.destroy() and tests (Tim Perry) #62648c128942b69] - quic: fixup token verification to handle zero expiration (James M Snell) #62620abb881ec92] - quic: support multiple ALPN negotiation (James M Snell) #62620476926c2ad] - quic: apply multiple TLS context improvements and SNI support (James M Snell) #6262076d9c24b95] - quic: implement rapidhash for hashing improvements (James M Snell) #6262008726cd43d] - quic: move quic behind compile time flag (Matteo Collina) #61444ea4f19aaa7] - quic: use arena allocation for packets (James M Snell) #6258921e9239e2a] - quic: fixup linting/formatting issues (James M Snell) #62387edeed4303b] - quic: update http3 impl details (James M Snell) #623877f3a85e6aa] - quic: fix a handful of bugs and missing functionality (James M Snell) #6238745c1ebddf8] - quic: copy options.certs buffer instead of detaching (Chengzhong Wu) #61403a31a8ee680] - quic: reduce boilerplate and other minor cleanups (James M Snell) #593423be70ff43a] - quic: multiple fixups and updates (James M Snell) #59342b91a93444c] - quic: update more of the quic to the new compile guard (James M Snell) #59342ca0080c164] - quic: few additional small comment edits in cid.h (James M Snell) #593426553202d83] - quic: fixup NO_ERROR macro conflict on windows (James M Snell) #593816df1508ac2] - quic: fixup windows coverage compile error (James M Snell) #59381b2b0bf8b04] - quic: update the guard to check openssl version (James M Snell) #592495556b154bd] - quic: start re-enabling quic with openssl 3.5 (James M Snell) #592492ca42c8263] - repl: keep reference count forprocess.on('newListener')(Anna Henningsen) #618952f37f9177f] - sqlite: use OneByte for ASCII text and internalize col names (Ali Hassan) #619543c96ae1b2f] - sqlite: add serialize() and deserialize() (Ali Hassan) #62579be4d2f3a4c] - sqlite: enable Percentile extension (Jurj Andrei George) #61295dafed453b2] - src: clean up experimental flag variables (Antoine du Hamel) #62759dca1e6aeea] - src: expose help texts into node-config-schema.json (Pietro Marchini) #5868028c4f44eb1] - src: add permission support to config file (Marco Ippolito) #60746f49175b220] - src: fix small compile warning in quic/streams.cc (James M Snell) #60118c9d4a446d8] - src: cleanup quic TransportParams class (James M Snell) #5988499bb02fd9e] - src: swap dotenv and config file parsing order (Marco Ippolito) #63035ecb4d49b7b] - src: add missing <cstdlib> for abort() declaration (Charles Kerr) #63001b6219b6362] - src: fix crash in GetErrorSource() for invalid using syntax (semimikoh) #62770b5ca5ad4c5] - src: simplifyTCPWrap::Connectsignature (Anna Henningsen) #62929ef7ffce7cf] - src: use DCHECK in AsyncWrap::MakeCallback instead emiting a warning (Gerhard Stöbich) #62795cd9890a5ab] - src: fix MaybeStackBuffer char_traits deprecation warning (om-ghante) #62507c70ff44aee] - src: use context-free V8 message column getters (René) #6277806c405f1d7] - src: coercespawnSyncargs to string once (Antoine du Hamel) #626336151999ad6] - src: use stack allocation for small string encoding (Ali Hassan) #62431a71a4ac7a3] - src: add contextify interceptor debug logs (Chengzhong Wu) #62460ad9a2909c2] - src: workaround AIX libc++ std::filesystem bug (Richard Lau) #627887792f1ae47] - stream: copyeditwebstreams/adapter.js(Antoine du Hamel) #630341397d8ce5c] - stream: remove duplicated utility (Antoine du Hamel) #63031ff86b1d64f] - stream: simplifysetPromiseHandledutility (Antoine du Hamel) #6303224a078149a] - stream: validate ReadableStream.from iterator objects (Daeyeon Jeong) #62911cfb1fa9680] - stream: reject duplicate nested transferables (Daeyeon Jeong) #62831d0c913758a] - stream: ensuring cross-destruction in _duplexify to prevent leaks (Daijiro Wachi) #62824978f5c15d7] - stream: simplifyreadableStreamFromIterable(Antoine du Hamel) #626513527646ba5] - stream: fix nested compose error propagation (Matteo Collina) #62556dfb9edef4f] - stream: allow shared array buffer sources in writable webstream adapter (René) #62163f00cdab627] - stream: simplifycreatePromiseCallback(Antoine du Hamel) #626503ed783535f] - stream: fix writev unhandled rejection in fromWeb (sangwook) #6229729b196694c] - stream: noop pause/resume on destroyed streams (Robert Nagy) #62557d73dbb9fc8] - stream: refactor duplexify to be less suceptible to prototype pollution (Antoine du Hamel) #625596f37f7e240] - (SEMVER-MINOR) stream: propagate destruction in duplexPair (Ahmed Elhor) #61098b8816580e9] - test: generatelocalstorage.dbin a temp dir (Chengzhong Wu) #6266031a863fd29] - test: update WPT for url to258f285(Node.js GitHub Bot) #63087d0d19bd8e3] - test: update WPT for streams tof8f26a3(Node.js GitHub Bot) #62864f50ac5bc78] - test: improve config-file permission test coverage (Rafael Gonzaga) #60929a0f90000f4] - test: export isRiscv64 from common module (Jamie Magee) #62609da4dd8646f] - test: normalize known inspector crash as completion (Joyee Cheung) #62851b7fdd94a4c] - test: account for RFC 7919 FFDHE negotiation in OpenSSL 4.0 (Filip Skokan) #62805375a993aaf] - test: skip tls-deprecated secp256k1 on OpenSSL 4.0 (Filip Skokan) #62805698d8287d1] - test: use an always invalid cipher and cover OpenSSL 4.0 behaviours (Filip Skokan) #62805036bc6f300] - test: use valid DER OCSP responses (Filip Skokan) #628053aa9938da8] - test: skip test-tls-error-stack when engines are unsupported (Filip Skokan) #62805947f1ae246] - test: accept renamed OpenSSL 4.0 error code and reason (Filip Skokan) #62805afdd355622] - test: update test/addons/openssl-binding for OpenSSL 4.0 (Filip Skokan) #628058637524a99] - test: mark test-snapshot-reproducible flaky (Filip Skokan) [#6280Configuration
📅 Schedule: (UTC)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about these updates again.
This PR was generated by Mend Renovate. View the repository job log.
Summary by CodeRabbit
Chores
Tests