Skip to content

2025-07-29, Version 24.5.0 (Current) #59257

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 96 commits into
base: v24.x
Choose a base branch
from
Open

Conversation

github-actions[bot]
Copy link
Contributor

@github-actions github-actions bot commented Jul 28, 2025

Upgrade to OpenSSL 3.5

This release is distributed with OpenSSL 3.5.1, following the announcement that
OpenSSL 3.5 will be supported until April 2030, while Node.js 24 will be
supported until April 2028. Read more about OpenSSL support in their blog post:
https://openssl-library.org/post/2025-02-20-openssl-3.5-lts/.

Contributed in #59234.

Unflag --experimental-wasm-modules

Node.js supports both source phase imports and instance phase imports to WebAssembly
modules and for WASM imports to JavaScript, in line with the current Phase 3
WebAssembly ESM Integration proposal.
The implementation and the specification are still subject to change.

Contributed by Guy Bedford in #57038.

Built-in proxy support in request() and Agent

node:http and node:https now support proxies. When NODE_USE_ENV_PROXY
is set to 1, the default global agent would parse the http_proxy/HTTP_PROXY,
https_proxy/HTTPS_PROXY, no_proxy/NO_PROXY settings from the
environment variables, and proxy the requests sent through the built-in http/https
client accordingly.

To use global proxy support from the command line:

NODE_USE_ENV_PROXY=1 HTTP_PROXY=http://proxy.example.com:8080 HTTPS_PROXY=http://proxy.example.com:8080 NO_PROXY=localhost,127.0.0.1 node client.js

In addition, http.Agent and https.Agent now support the custom proxyEnv options.

const agent = new https.Agent({ proxyEnv: { HTTPS_PROXY: 'http://proxy.example.com:8080' } });

For reference, fetch() already supports NODE_USE_ENV_PROXY as of Node.js 24.0.0.

Contributed by Joyee Cheung in #58980.

Add setDefaultCACertificates() to node:tls

This API allows dynamically configuring CA certificates that will be used by the
Node.js TLS clients by default.

Once called, the provided certificates will become the default CA certificate list
returned by tls.getCACertificates('default') and used by TLS connections that
don't specify their own CA certificates.

To add system CA certificates to the default bundle (which includes the Mozilla
CA certificates):

tls.setDefaultCACertificates(tls.getCACertificates('default').concat(tls.getCACertificates('system')));

Contributed by Joyee Cheung in #58822.

Other notable changes

  • [d5640ca58a] - (SEMVER-MINOR) cli: support ${pid} placeholder in --cpu-prof-name (Haram Jeong) #59072
  • [eeeb40e95b] - (SEMVER-MINOR) crypto: add tls.setDefaultCACertificates() (Joyee Cheung) #58822
  • [c52aaacfc5] - (SEMVER-MINOR) dns: support max timeout (theanarkh) #58440
  • [927742b342] - doc: update the instruction on how to verify releases (Antoine du Hamel) #59113
  • [7f654cee9e] - (SEMVER-MINOR) http,https: add built-in proxy support in http/https.request and Agent (Joyee Cheung) #58980
  • [f753645cd8] - (SEMVER-MINOR) net: update net.blocklist to allow file save and file management (alphaleadership) #58087
  • [16dc53c143] - (SEMVER-MINOR) test: move http proxy tests to test/client-proxy (Joyee Cheung) #58980
  • [9791ff3480] - (SEMVER-MINOR) worker: add web locks api (ishabi) #58666
Commits
  • [5457c7a8a1] - benchmark: adjust configuration for string-decoder bench (Rafael Gonzaga) #59187
  • [28538f2255] - benchmark: add --track to benchmark (Rafael Gonzaga) #59174
  • [a28d804497] - benchmark: small lint fix on _cli.js (Rafael Gonzaga) #59172
  • [09717eb68e] - benchmark: drop misc/punycode benchmark (Rafael Gonzaga) #59171
  • [ad6757ef02] - benchmark: fix sqlite-is-transaction (Rafael Gonzaga) #59170
  • [7fc3143f61] - benchmark: reduce N for diagnostics_channel subscribe benchmark (Arthur Angelo) #59116
  • [f2812723a0] - buffer: cache Environment::GetCurrent to avoid repeated calls (Mert Can Altin) #59043
  • [e3e729ca60] - build: remove suppressions.supp (Rafael Gonzaga) #59079
  • [dc66422768] - build,deps,tools: prepare to update to OpenSSL 3.5 (Richard Lau) #58100
  • [f5da4947d9] - cli: add --use-env-proxy (Joyee Cheung) #59151
  • [d5640ca58a] - (SEMVER-MINOR) cli: support ${pid} placeholder in --cpu-prof-name (Haram Jeong) #59072
  • [eeeb40e95b] - (SEMVER-MINOR) crypto: add tls.setDefaultCACertificates() (Joyee Cheung) #58822
  • [135fca5b72] - crypto: avoid copying buffers to UTF-8 strings in crypto.hash() (Renegade334) #59067
  • [998cef10e3] - deps: update archs files for openssl-3.5.1 (Node.js GitHub Bot) #59234
  • [1f06ca956a] - deps: upgrade openssl sources to openssl-3.5.1 (Node.js GitHub Bot) #59234
  • [55a90eed8d] - deps: upgrade npm to 11.5.1 (npm team) #59199
  • [2b5d451ae0] - deps: update amaro to 1.1.1 (Node.js GitHub Bot) #59141
  • [af789d9b5c] - deps: update undici to 7.12.0 (Node.js GitHub Bot) #59135
  • [a34e44545e] - deps: update sqlite to 3.50.3 (Node.js GitHub Bot) #59132
  • [bfe4781c7d] - deps: update googletest to 7e17b15 (Node.js GitHub Bot) #59131
  • [72adf52e51] - deps: update ada to 3.2.6 (Node.js GitHub Bot) #58966
  • [2a5f35b589] - deps: V8: cherry-pick 3d750c2aa9ef (Michaël Zasso) #58750
  • [3f813eaba7] - deps: update archs files for openssl-3.0.17 (Node.js GitHub Bot) #59134
  • [fb52d0d8df] - deps: upgrade openssl sources to openssl-3.0.17 (Node.js GitHub Bot) #59134
  • [f122602f9d] - deps: update corepack to 0.34.0 (Node.js GitHub Bot) #59133
  • [c52aaacfc5] - (SEMVER-MINOR) dns: support max timeout (theanarkh) #58440
  • [927742b342] - doc: update the instruction on how to verify releases (Antoine du Hamel) #59113
  • [9a8d2020ad] - doc: copyedit SECURITY.md (Rich Trott) #59190
  • [3da5bc0668] - doc: fix broken sentence in URL.parse (Superchupu) #59164
  • [06cd7461e0] - doc: improve onboarding instructions (Joyee Cheung) #59159
  • [dfb72d158b] - doc: add constraints for mem leak to threat model (Rafael Gonzaga) #58917
  • [51b8dfd5c6] - doc: add Aditi-1400 to collaborators (Aditi) #59157
  • [4ffa756ce3] - doc: avoid suggesting testing fast api with intense loop (Chengzhong Wu) #59111
  • [6f81b274f7] - doc: fix typo in writing-test.md (SeokHun) #59123
  • [88e434e687] - doc: add new environment variables doc page (Dario Piotrowicz) #59052
  • [b1a318d706] - doc: update release key for aduh95 (Antoine du Hamel) #58877
  • [34c49000c9] - doc: add missing section for setReturnArrays in sqlite.md (Edy Silva) #59074
  • [9b2e965aff] - doc: add RafaelGSS as steward July 25 (Rafael Gonzaga) #59078
  • [2d1dcb87e6] - doc: clarify ERR_FS_FILE_TOO_LARGE to reflect fs.readFile() I/O limit (Haram Jeong) #59050
  • [999b5e51e7] - doc: run license-builder (github-actions[bot]) #59056
  • [1940a2cb46] - doc: fix typed list formatting (Aviv Keller) #59019
  • [6cb5e0d22f] - doc: refine util.parseArgs default definition (Slayer95) #58958
  • [d2e7f8e13a] - doc: remove unused import in zlib.md (coderaiser) #59041
  • [9d02960149] - doc: add missing environment variables to manpage (amir lavasani) #58963
  • [45ffdb34fb] - doc: add stability index to the --watch-kill-signal flag (Dario Piotrowicz) #58997
  • [3924c43600] - doc: add missing <code> blocks (Antoine du Hamel) #58995
  • [cb95e183f3] - doc: add scroll margin to links (Roman Reiss) #58982
  • [c9ded6ba15] - doc: add sponsorship link to RafaelGSS (Rafael Gonzaga) #58983
  • [b919fe0447] - (SEMVER-MINOR) esm: unflag --experimental-wasm-modules (Guy Bedford) #57038
  • [71bb6cd077] - esm: js-string Wasm builtins in ESM Integration (Guy Bedford) #59020
  • [8d869e6d62] - fs: fix return value of fs APIs (theanarkh) #58996
  • [7f654cee9e] - (SEMVER-MINOR) http,https: add built-in proxy support in http/https.request and Agent (Joyee Cheung) #58980
  • [85d6a28f4f] - inspector: initial support for Network.loadNetworkResource (Shima Ryuhei) #58077
  • [cfaa299f2e] - lib: fix incorrect ArrayBufferPrototypeGetDetached primordial type (Dario Piotrowicz) #58978
  • [d555db22ad] - lib: flag to conditionally modify proto on deprecate (Rafael Gonzaga) #58928
  • [96c9dd79e6] - meta: move one or more collaborators to emeritus (Node.js GitHub Bot) #59140
  • [324d9fc9d4] - meta: enable jsdoc/check-tag-names rule (Yagiz Nizipli) #58521
  • [04c751463b] - meta: add marco-ippolito to security release stewards (Marco Ippolito) #58944
  • [fe0195fdcc] - module: fix conditions override in synchronous resolve hooks (Joyee Cheung) #59011
  • [515b581d47] - module: throw error when re-runing errored module jobs (Joyee Cheung) #58957
  • [f753645cd8] - (SEMVER-MINOR) net: update net.blocklist to allow file save and file management (alphaleadership) #58087
  • [15e6c28d82] - node-api,doc: update links to ecma262 with section names (Chengzhong Wu) #59087
  • [f67b686551] - perf_hooks: do not expose SafeMap via Histogram wrapper (René) #59094
  • [3d2f919f7c] - process: make execve's args argument optional (Allon Murienik) #58412
  • [1a44265810] - repl: handle errors from getters during completion (Shima Ryuhei) #59044
  • [467dbd31e6] - repl: fix repl crashing on variable declarations without init (Dario Piotrowicz) #59032
  • [3a3eb6852d] - repl: improve REPL disabling completion on proxies and getters (Dario Piotrowicz) #58891
  • [55838e79b8] - src: call unmask after install signal handler (theanarkh) #59059
  • [77649ad93b] - src: use FastStringKey for TrackV8FastApiCall (Anna Henningsen) #59148
  • [86babf9c4b] - src: use C++20 consteval for FastStringKey (Anna Henningsen) #59148
  • [88b99eeae1] - src: remove declarations of removed BaseObject static fns (Anna Henningsen) #59093
  • [d89390fc8f] - src: add cache to nearest parent package json (Ilyas Shabi) #59086
  • [21780075e4] - src: check import attributes value types as strings (Chengzhong Wu) #58986
  • [ef89c2fac9] - src,test: fix config file parsing for flags defaulted to true (Edy Silva) #59110
  • [1e990866e0] - test: mark web lock held test as flaky (Ilyas Shabi) #59144
  • [ba8e95a785] - test: use mustSucceed in test-fs-read (Sungwon) #59204
  • [39978f507f] - test: prepare test-crypto-rsa-dsa for newer OpenSSL (Richard Lau) #58100
  • [1c3aadb9d6] - test: fix flaky test-worker-message-port-transfer-filehandle test (Alex Yang) #59158
  • [a0d22e9c51] - test: remove timeout in test-https-proxy-request-handshake-failure (Joyee Cheung) #59165
  • [7e0a0fccc1] - test: expand linting rules around assert w literal messages (Anna Henningsen) #59147
  • [c6070046c3] - test: update WPT for WebCryptoAPI to ab08796857 (Node.js GitHub Bot) #59129
  • [15d8cc908e] - test: update WPT for WebCryptoAPI to 19d82c57ab (Node.js GitHub Bot) #59129
  • [83023e5144] - test: skip tests that cause timeouts on IBM i (Abdirahim Musse) #59014
  • [82d4175ec3] - test: update startCLI to set --port=0 by default (Dario Piotrowicz) #59042
  • [16dc53c143] - (SEMVER-MINOR) test: move http proxy tests to test/client-proxy (Joyee Cheung) #58980
  • [a9511a6066] - test: mark test-inspector-network-fetch as flaky on Windows (Joyee Cheung) #59091
  • [1cffcc02a3] - test: add missing port=0 arg in test-debugger-extract-function-name (Dario Piotrowicz) #58977
  • [83cdf1701b] - test_runner: clean up promisified interval generation (René) #58824
  • [195d6038dc] - tools: clarify README linter error message (Joyee Cheung) #59160
  • [51f578a3bf] - tools: add support for URLs to PR commits in merge.sh (Antoine du Hamel) #59162
  • [20be9012eb] - tools: bump @eslint/plugin-kit from 0.3.1 to 0.3.3 in /tools/eslint (dependabot[bot]) #59119
  • [623e264e93] - tools: ignore CVE mention when linting release proposals (Antoine du Hamel) #59037
  • [0e547e09ab] - tools,test: enforce best practices to detect never settling promises (Antoine du Hamel) #58992
  • [075d1968db] - util: respect nested formats in styleText (Alex Yang) #59098
  • [9791ff3480] - (SEMVER-MINOR) worker: add web locks api (ishabi) #58666

RafaelGSS and others added 30 commits July 17, 2025 16:57
Refs: #58218
Signed-off-by: RafaelGSS <rafael.nunu@hotmail.com>
PR-URL: #58928
Reviewed-By: Juan José Arboleda <soyjuanarbol@gmail.com>
Reviewed-By: Ulises Gascón <ulisesgascongonzalez@gmail.com>
PR-URL: #58087
Fixes: #56252
Reviewed-By: Ethan Arrowood <ethan@arrowood.dev>
Reviewed-By: James M Snell <jasnell@gmail.com>
PR-URL: #58977
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
PR-URL: #58944
Fixes: nodejs/TSC#1764
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Richard Lau <richard.lau@ibm.com>
Reviewed-By: Gireesh Punathil <gpunathi@in.ibm.com>
Reviewed-By: Chengzhong Wu <legendecas@gmail.com>
Reviewed-By: Juan José Arboleda <soyjuanarbol@gmail.com>
Reviewed-By: Jordan Harband <ljharb@gmail.com>
Reviewed-By: Rafael Gonzaga <rafael.nunu@hotmail.com>
Reviewed-By: Darshan Sen <raisinten@gmail.com>
PR-URL: #58978
Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com>
Reviewed-By: Michaël Zasso <targos@protonmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Chengzhong Wu <legendecas@gmail.com>
Reviewed-By: Juan José Arboleda <soyjuanarbol@gmail.com>
PR-URL: #58983
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Juan José Arboleda <soyjuanarbol@gmail.com>
Reviewed-By: Moshe Atlow <moshe@atlow.co.il>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Ruben Bridgewater <ruben@bridgewater.de>
Reviewed-By: Darshan Sen <raisinten@gmail.com>
Re-evaluating an errored ESM should lead to rejecting
the rejection again - this is also the case when importing
it twice. In the case of retrying with
require after import, just throw the cached error.

Drive-by: add some debug logs.
PR-URL: #58957
Fixes: #58945
Reviewed-By: Marco Ippolito <marcoippolito54@gmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
#57909 introduced the disabling
of REPL tab completion on object containing proxies and getters
(since such completion triggers code evaluation which can be
unexpected/disruptive for the user)

the solution in 57909 did not address all possible such cases,
the changes here improve on such solution by using acorn and
AST analysis to cover most if not all possible cases

PR-URL: #58891
Reviewed-By: James M Snell <jasnell@gmail.com>
PR-URL: #58986
Reviewed-By: Guy Bedford <guybedford@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Anna Henningsen <anna@addaleax.net>
Reviewed-By: Marco Ippolito <marcoippolito54@gmail.com>
Reviewed-By: Ethan Arrowood <ethan@arrowood.dev>
Fixes: #57873
PR-URL: #58077
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Chengzhong Wu <legendecas@gmail.com>
PR-URL: #58982
Reviewed-By: Claudio Wunder <cwunder@gnome.org>
Reviewed-By: Moshe Atlow <moshe@atlow.co.il>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Ulises Gascón <ulisesgascongonzalez@gmail.com>
Reviewed-By: Tierney Cyren <hello@bnb.im>
PR-URL: #58440
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
PR-URL: #58995
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Juan José Arboleda <soyjuanarbol@gmail.com>
PR-URL: #58997
Reviewed-By: Rafael Gonzaga <rafael.nunu@hotmail.com>
Reviewed-By: Moshe Atlow <moshe@atlow.co.il>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
* yield from loop instead of setting up custom iterator
* cancel abort listener on exit
* do not call <Array>.at(0)

PR-URL: #58824
Reviewed-By: Chemi Atlow <chemi@atlow.co.il>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Moshe Atlow <moshe@atlow.co.il>
PR-URL: #58963
Fixes: #58894
Reviewed-By: Dario Piotrowicz <dario.piotrowicz@gmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
PR-URL: #59032
Fixes: #59029
Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com>
Reviewed-By: Matthew Aitken <maitken033380023@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
PR-URL: #59037
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Marco Ippolito <marcoippolito54@gmail.com>
PR-URL: #59041
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
The default value is legal by means other than defaulting.

PR-URL: #58958
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
PR-URL: #59019
Refs: nodejs/doc-kit#348
Reviewed-By: Chemi Atlow <chemi@atlow.co.il>
Reviewed-By: Zeyu "Alex" Yang <himself65@outlook.com>
Reviewed-By: Claudio Wunder <cwunder@gnome.org>
PR-URL: #59056
Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Filip Skokan <panva.ip@gmail.com>
Reviewed-By: Darshan Sen <raisinten@gmail.com>
Reviewed-By: Moshe Atlow <moshe@atlow.co.il>
Reviewed-By: Rafael Gonzaga <rafael.nunu@hotmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Tobias Nießen <tniessen@tnie.de>
Reviewed-By: Ulises Gascón <ulisesgascongonzalez@gmail.com>
PR-URL: #59050
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: LiviaMedeiros <livia@cirno.name>
PR-URL: #58992
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
PR-URL: #59078
Reviewed-By: Richard Lau <richard.lau@ibm.com>
Reviewed-By: Marco Ippolito <marcoippolito54@gmail.com>
Reviewed-By: Chengzhong Wu <legendecas@gmail.com>
Reviewed-By: Ulises Gascón <ulisesgascongonzalez@gmail.com>
PR-URL: #59074
Refs: #57542
Reviewed-By: Chemi Atlow <chemi@atlow.co.il>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
We have removed the UBSan workflow
and there's no ongoing initiative to
bring it back.

PR-URL: #59079
Reviewed-By: Richard Lau <richard.lau@ibm.com>
Reviewed-By: Marco Ippolito <marcoippolito54@gmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
PR-URL: #59091
Refs: #59090
Reviewed-By: Chengzhong Wu <legendecas@gmail.com>
Reviewed-By: Ryuhei Shima <shimaryuhei@gmail.com>
Reviewed-By: Filip Skokan <panva.ip@gmail.com>
Rewrite to ESM to use TLA.
Also add a test to make sure case precedence is honored.
Refs: https://about.gitlab.com/blog/we-need-to-talk-no-proxy

PR-URL: #58980
Refs: #57872
Refs: #8381
Refs: #15620
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
This patch implements proxy support for HTTP and HTTPS clients and
agents in the `http` and `https` built-ins`. When NODE_USE_ENV_PROXY
is set to 1, the default global agent would parse the
HTTP_PROXY/http_proxy, HTTPS_PROXY/https_proxy, NO_PROXY/no_proxy
settings from the environment variables, and proxy the requests
sent through the built-in http/https client accordingly.

To support this, `http.Agent` and `https.Agent` now accept a few new
options:

- `proxyEnv`: when it's an object, the agent would read and parse
  the HTTP_PROXY/http_proxy, HTTPS_PROXY/https_proxy, NO_PROXY/no_proxy
  properties from it, and apply them based on the protocol it uses
  to send requests. This option allows custom agents to
  reuse built-in proxy support by composing options. Global agents
  set this to `process.env` when NODE_USE_ENV_PROXY is 1.
- `defaultPort` and `protocol`: these allow setting of the default port
  and protocol of the agents. We also need these when configuring
  proxy settings and deciding whether a request should be proxied.

Implementation-wise, this adds a `ProxyConfig` internal class to handle
parsing and application of proxy configurations. The configuration
is parsed during agent construction. When requests are made,
the `createConnection()` methods on the agents would check whether
the request should be proxied. If yes, they either connect to the
proxy server (in the case of HTTP reqeusts) or establish a tunnel
(in the case of HTTPS requests) through either a TCP socket (if the
proxy uses HTTP) or a TLS socket (if the proxy uses HTTPS).

When proxying HTTPS requests through a tunnel, the connection listener
is invoked after the tunnel is established. Tunnel establishment uses
the timeout of the request options, if there is one. Otherwise it uses
the timeout of the agent.

If an error is encountered during tunnel establishment, an
ERR_PROXY_TUNNEL would be emitted on the returned socket. If the proxy
server sends a errored status code, the error would contain an
`statusCode` property. If the error is caused by timeout, the error
would contain a `proxyTunnelTimeout` property.

This implementation honors the built-in socket pool and socket limits.
Pooled sockets are still keyed by request endpoints, they are just
connected to the proxy server instead, and the persistence of the
connection can be maintained as long as the proxy server respects
connection/proxy-connection or persist by default (HTTP/1.1)

PR-URL: #58980
Refs: #57872
Refs: #8381
Refs: #15620
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
@nodejs-github-bot

This comment was marked as outdated.

@nodejs-github-bot
Copy link
Collaborator

nodejs-github-bot commented Jul 29, 2025

@targos
Copy link
Member

targos commented Jul 29, 2025

By looking at https://ci-release.nodejs.org/job/iojs+release/, it seems macOS arm64 release runners are not ready.

@joyeecheung
Copy link
Member

joyeecheung commented Jul 29, 2025

Text for the proxy and CA certificate changes..

http,https: add built-in proxy support in http/https.request and Agent

http and https builtins now support proxies. When NODE_USE_ENV_PROXY
is set to 1, the default global agent would parse the http_proxy/HTTP_PROXY,
https_proxy/HTTPS_PROXY, no_proxy/NO_PROXY settings from the
environment variables, and proxy the requests sent through the built-in http/https
client accordingly.

To use global proxy support from the command line:

NODE_USE_ENV_PROXY=1 HTTP_PROXY=http://proxy.example.com:8080 HTTPS_PROXY=http://proxy.example.com:8080 NO_PROXY=localhost,127.0.0.1 node client.js

In addition, http.Agent and https.Agent now support the custom proxyEnv options.

const agent = new https.Agent({ proxyEnv: { HTTPS_PROXY: 'http://proxy.example.com:8080' } });

Contributed by Joyee Cheung in #58980

crypto: add tls.setDefaultCACertificates()

This API allows dynamically configuring CA certificates that will be used by the Node.js TLS clients by default.

Once called, the provided certificates will become the default CA certificate list returned by tls.getCACertificates('default') and used by TLS connections that don't specify their own CA certificates.

To add system CA certificates to the default bundle (which includes the mozilla CA certificates):

tls.setDefaultCACertificates(tls.getCACertificates('default').concat(tls.getCACertificates('system')));

Contributed by Joyee Cheung in #58822

Copy link

codecov bot commented Jul 29, 2025

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 89.55%. Comparing base (5576dec) to head (931ec10).
⚠️ Report is 5 commits behind head on v24.x.

Additional details and impacted files
@@            Coverage Diff             @@
##            v24.x   #59257      +/-   ##
==========================================
- Coverage   90.09%   89.55%   -0.54%     
==========================================
  Files         638      645       +7     
  Lines      189175   191537    +2362     
  Branches    37093    37237     +144     
==========================================
+ Hits       170446   171540    +1094     
- Misses      11454    12572    +1118     
- Partials     7275     7425     +150     

see 168 files with indirect coverage changes

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
  • 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

@aduh95 aduh95 force-pushed the v24.5.0-proposal branch from 2507c52 to f6a312d Compare July 29, 2025 12:06
aduh95 added a commit that referenced this pull request Jul 29, 2025
Notable changes:

cli:
  * (SEMVER-MINOR) support `${pid}` placeholder in `--cpu-prof-name` (Haram Jeong) #59072
crypto:
  * (SEMVER-MINOR) add `tls.setDefaultCACertificates()` (Joyee Cheung) #58822
deps:
  * upgrade to openssl-3.5.1 (Node.js GitHub Bot) #59234
dns:
  * (SEMVER-MINOR) support max timeout (theanarkh) #58440
doc:
  * update the instruction on how to verify releases (Antoine du Hamel) #59113
esm:
  * (SEMVER-MINOR) unflag `--experimental-wasm-modules` (Guy Bedford) #57038
http,https:
  * (SEMVER-MINOR) add built-in proxy support in http/https.request and `Agent` (Joyee Cheung) #58980
net:
  * (SEMVER-MINOR) update net.blocklist to allow file save and file management (alphaleadership) #58087
test:
  * (SEMVER-MINOR) move http proxy tests to test/client-proxy (Joyee Cheung) #58980
worker:
  * (SEMVER-MINOR) add web locks api (ishabi) #58666

PR-URL: #59257
@aduh95 aduh95 force-pushed the v24.5.0-proposal branch from f6a312d to 5b65243 Compare July 29, 2025 12:10
aduh95 added a commit that referenced this pull request Jul 29, 2025
Notable changes:

cli:
  * (SEMVER-MINOR) support `${pid}` placeholder in `--cpu-prof-name` (Haram Jeong) #59072
crypto:
  * (SEMVER-MINOR) add `tls.setDefaultCACertificates()` (Joyee Cheung) #58822
deps:
  * upgrade to openssl-3.5.1 (Node.js GitHub Bot) #59234
dns:
  * (SEMVER-MINOR) support max timeout (theanarkh) #58440
doc:
  * update the instruction on how to verify releases (Antoine du Hamel) #59113
esm:
  * (SEMVER-MINOR) unflag `--experimental-wasm-modules` (Guy Bedford) #57038
http,https:
  * (SEMVER-MINOR) add built-in proxy support in http/https.request and `Agent` (Joyee Cheung) #58980
net:
  * (SEMVER-MINOR) update net.blocklist to allow file save and file management (alphaleadership) #58087
test:
  * (SEMVER-MINOR) move http proxy tests to test/client-proxy (Joyee Cheung) #58980
worker:
  * (SEMVER-MINOR) add web locks api (ishabi) #58666

PR-URL: #59257
@aduh95 aduh95 force-pushed the v24.5.0-proposal branch from 5b65243 to 47dfe77 Compare July 29, 2025 12:15
aduh95 added a commit that referenced this pull request Jul 29, 2025
Notable changes:

cli:
  * (SEMVER-MINOR) support `${pid}` placeholder in `--cpu-prof-name` (Haram Jeong) #59072
crypto:
  * (SEMVER-MINOR) add `tls.setDefaultCACertificates()` (Joyee Cheung) #58822
deps:
  * upgrade to openssl-3.5.1 (Node.js GitHub Bot) #59234
dns:
  * (SEMVER-MINOR) support max timeout (theanarkh) #58440
doc:
  * update the instruction on how to verify releases (Antoine du Hamel) #59113
esm:
  * (SEMVER-MINOR) unflag `--experimental-wasm-modules` (Guy Bedford) #57038
http,https:
  * (SEMVER-MINOR) add built-in proxy support in http/https.request and `Agent` (Joyee Cheung) #58980
net:
  * (SEMVER-MINOR) update net.blocklist to allow file save and file management (alphaleadership) #58087
test:
  * (SEMVER-MINOR) move http proxy tests to test/client-proxy (Joyee Cheung) #58980
worker:
  * (SEMVER-MINOR) add web locks api (ishabi) #58666

PR-URL: #59257
Copy link
Member

@mcollina mcollina left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

lgtm

@aduh95 aduh95 added the request-ci Add this label to start a Jenkins CI on a PR. label Jul 29, 2025
@aduh95
Copy link
Contributor

aduh95 commented Jul 29, 2025

@blakeembrey path-to-regexp seems to be failing on that proposal: https://ci.nodejs.org/view/Node.js-citgm/job/citgm-smoker/3622/

@github-actions github-actions bot removed the request-ci Add this label to start a Jenkins CI on a PR. label Jul 29, 2025
@nodejs-github-bot
Copy link
Collaborator

@ryanaslett
Copy link

By looking at https://ci-release.nodejs.org/job/iojs+release/, it seems macOS arm64 release runners are not ready.

This is true, I am working on getting these up and running today.

@nodejs-github-bot
Copy link
Collaborator

nodejs-github-bot commented Jul 29, 2025

@panva
Copy link
Member

panva commented Jul 29, 2025

**Upgrade to OpenSSL 3.5**

This release is distributed with OpenSSL 3.5.1, following the announcement that
OpenSSL 3.5 will be supported until April 2030, while Node.js 24 will be
supported until April 2028. Read more about OpenSSL support in their blog post:
[openssl-library.org/post/2025-02-20-openssl-3.5-lts](https://openssl-library.org/post/2025-02-20-openssl-3.5-lts/).

Contributed in https://github.com/nodejs/node/pull/59234.

I believe this should be rightfully attributed to @richardlau (#58100)

@nodejs-github-bot
Copy link
Collaborator

aduh95 added a commit that referenced this pull request Jul 31, 2025
Notable changes:

cli:
  * (SEMVER-MINOR) support `${pid}` placeholder in `--cpu-prof-name` (Haram Jeong) #59072
crypto:
  * (SEMVER-MINOR) add `tls.setDefaultCACertificates()` (Joyee Cheung) #58822
deps:
  * upgrade to openssl-3.5.1 (Node.js GitHub Bot) #59234
dns:
  * (SEMVER-MINOR) support max timeout (theanarkh) #58440
doc:
  * update the instruction on how to verify releases (Antoine du Hamel) #59113
esm:
  * (SEMVER-MINOR) unflag `--experimental-wasm-modules` (Guy Bedford) #57038
http,https:
  * (SEMVER-MINOR) add built-in proxy support in http/https.request and `Agent` (Joyee Cheung) #58980
net:
  * (SEMVER-MINOR) update net.blocklist to allow file save and file management (alphaleadership) #58087
test:
  * (SEMVER-MINOR) move http proxy tests to test/client-proxy (Joyee Cheung) #58980
worker:
  * (SEMVER-MINOR) add web locks api (ishabi) #58666

PR-URL: #59257
@aduh95 aduh95 force-pushed the v24.5.0-proposal branch from 47dfe77 to 22bd082 Compare July 31, 2025 08:22
aduh95 added a commit that referenced this pull request Jul 31, 2025
Notable changes:

cli:
  * (SEMVER-MINOR) support `${pid}` placeholder in `--cpu-prof-name` (Haram Jeong) #59072
crypto:
  * (SEMVER-MINOR) add `tls.setDefaultCACertificates()` (Joyee Cheung) #58822
deps:
  * upgrade to openssl-3.5.1 (Node.js GitHub Bot) #59234
dns:
  * (SEMVER-MINOR) support max timeout (theanarkh) #58440
doc:
  * update the instruction on how to verify releases (Antoine du Hamel) #59113
esm:
  * (SEMVER-MINOR) unflag `--experimental-wasm-modules` (Guy Bedford) #57038
http,https:
  * (SEMVER-MINOR) add built-in proxy support in http/https.request and `Agent` (Joyee Cheung) #58980
net:
  * (SEMVER-MINOR) update net.blocklist to allow file save and file management (alphaleadership) #58087
test:
  * (SEMVER-MINOR) move http proxy tests to test/client-proxy (Joyee Cheung) #58980
worker:
  * (SEMVER-MINOR) add web locks api (ishabi) #58666

PR-URL: #59257
@aduh95 aduh95 force-pushed the v24.5.0-proposal branch from 22bd082 to 8f6b7d7 Compare July 31, 2025 08:25
Notable changes:

cli:
  * (SEMVER-MINOR) support `${pid}` placeholder in `--cpu-prof-name` (Haram Jeong) #59072
crypto:
  * (SEMVER-MINOR) add `tls.setDefaultCACertificates()` (Joyee Cheung) #58822
deps:
  * upgrade to openssl-3.5.1 (Node.js GitHub Bot) #59234
dns:
  * (SEMVER-MINOR) support max timeout (theanarkh) #58440
doc:
  * update the instruction on how to verify releases (Antoine du Hamel) #59113
esm:
  * (SEMVER-MINOR) unflag `--experimental-wasm-modules` (Guy Bedford) #57038
http,https:
  * (SEMVER-MINOR) add built-in proxy support in http/https.request and `Agent` (Joyee Cheung) #58980
net:
  * (SEMVER-MINOR) update net.blocklist to allow file save and file management (alphaleadership) #58087
test:
  * (SEMVER-MINOR) move http proxy tests to test/client-proxy (Joyee Cheung) #58980
worker:
  * (SEMVER-MINOR) add web locks api (ishabi) #58666

PR-URL: #59257
@aduh95 aduh95 force-pushed the v24.5.0-proposal branch from 8f6b7d7 to 931ec10 Compare July 31, 2025 08:27
@bricss
Copy link
Contributor

bricss commented Jul 31, 2025

Maybe #59270 can be pulled in? 🙄

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
release Issues and PRs related to Node.js releases. v24.x Issues that can be reproduced on v24.x or PRs targeting the v24.x-staging branch.
Projects
None yet
Development

Successfully merging this pull request may close these issues.