2025-06-23, Version 20.19.3 'Iron' (LTS), @marco-ippolito

Notable Changes

• [c535a3c483] - crypto: graduate WebCryptoAPI Ed25519 and X25519 algorithms as stable (Filip Skokan) #56142
• [af1dc63815] - crypto: update root certificates to NSS 3.108 (Node.js GitHub Bot) #57381
• [01d63a4ddf] - deps: update timezone to 2025b (Node.js GitHub Bot) #57857
• [b6daa344eb] - doc: add dario-piotrowicz to collaborators (Dario Piotrowicz) #58102

Commits

• [fc1fa7a357] - build: use FILE_OFFSET_BITS=64 esp. on 32-bit arch (RafaelGSS) #58090
• [79e0812181] - build: use glob for dependencies of out/Makefile (Richard Lau) #55789
• [f56e62851a] - crypto: allow length=0 for HKDF and PBKDF2 in SubtleCrypto.deriveBits (Filip Skokan) #55866
• [c535a3c483] - crypto: graduate WebCryptoAPI Ed25519 and X25519 algorithms as stable (Filip Skokan) #56142
• [39925de8b1] - crypto: allow non-multiple of 8 in SubtleCrypto.deriveBits (Filip Skokan) #55296
• [af1dc63815] - crypto: update root certificates to NSS 3.108 (Node.js GitHub Bot) #57381
• [d09008add3] - deps: V8: cherry-pick 1a3ecc2483b2 (Michaël Zasso) #58342
• [fd56652425] - deps: V8: cherry-pick 182d9c05e78b (Andrey Kosyakov) #58342
• [447481e829] - deps: V8: cherry-pick third_party/zlib@646b7f569718 (Hans Wennborg) #58342
• [eb447168df] - deps: update simdutf to 6.4.2 (Node.js GitHub Bot) #57855
• [01d63a4ddf] - deps: update timezone to 2025b (Node.js GitHub Bot) #57857
• [10fb49f2a9] - deps: update icu to 77.1 (Node.js GitHub Bot) #57455
• [f1dc7d0205] - deps: update corepack to 0.32.0 (Node.js GitHub Bot) #57265
• [7a2e64bb8a] - deps: update simdutf to 6.4.0 (Node.js GitHub Bot) #56764
• [e80669be0d] - doc: mention reports should align with Node.js CoC (Rafael Gonzaga) #57607
• [7b2c0bc92e] - doc: add gurgunday as triager (Gürgün Dayıoğlu) #57594
• [791e4879de] - doc: document REPL custom eval arguments (Dario Piotrowicz) #57690
• [2917f09876] - doc: improved fetch docs (Alessandro Miliucci) #57296
• [d940b15843] - doc: clarify unhandledRejection events behaviors in process doc (Dario Piotrowicz) #57654
• [71c664fab7] - doc: update position type to integer | null in fs (Yukihiro Hasegawa) #57745
• [0c0fbfa9c6] - doc: add missing v0.x changelog entries (Antoine du Hamel) #57779
• [e99462c9fc] - doc: correct deprecation type of assert.CallTracker (René) #57997
• [c7e92696ef] - doc: add returns for https.get (Eng Zer Jun) #58025
• [ccc42b69ce] - doc: fix env variable name in util.styleText (Antoine du Hamel) #58072
• [b6daa344eb] - doc: add dario-piotrowicz to collaborators (Dario Piotrowicz) #58102
• [e5d6a3df16] - doc: fix AsyncLocalStorage example response changes after node v18 (Naor Tedgi (Abu Emma)) #57969
• [f006411998] - doc: fix typo of file zlib.md (yusheng chen) #58093
• [5193735df4] - doc: add missing options.signal to readlinePromises.createInterface() (Jimmy Leung) #55456
• [fd44af730f] - doc: fix misaligned options in vm.compileFunction() (Jimmy Leung) #58145
• [0fdcc0ddcd] - doc: add ambassaor message (Brian Muenzenmeyer) #57600
• [5ca9616bd3] - doc: increase z-index of header element (Dario Piotrowicz) #57851
• [81342d10f0] - doc: fix deprecation type for DEP0148 (Livia Medeiros) #57785
• [776becfe01] - doc: remove mention of --require not supporting ES modules (Huáng Jùnliàng) #57620
• [3140a8f133] - doc: add missing deprecated badges in fs.md (Yukihiro Hasegawa) #57384
• [441ce24ae3] - doc: deprecate passing invalid types in fs.existsSync (Carlos Espa) #55892
• [0556f54544] - http: correctly translate HTTP method (Paolo Insogna) #52701
• [c2c6d2b035] - http: be more generational GC friendly (ywave620) #56767
• [cdf3fa241c] - http2: skip writeHead if stream is closed (Shima Ryuhei) #57686
• [bbd5aec785] - http2: fix graceful session close (Kushagra Pandey) #57808
• [b427ae4f34] - meta: remove build-windows.yml (Aviv Keller) #54662
• [49e624f554] - os: fix netmask format check condition in getCIDR function (Wiyeong Seo) #57324
• [d582954434] - src: remove unused variable in crypto_x509.cc (Michaël Zasso) #57754
• [234a505e96] - src: allow embedder customization of OOMErrorHandler (Shelley Vohr) #57325
• [c0252cd380] - src: fix -Wunreachable-code-return in node_sea (Shelley Vohr) #57664
• [fcd1622fc1] - src: fix kill signal 0 on Windows (Stefan Stojanovic) #57695
• [850192b06b] - test: skip broken sea on rhel8 (Marco Ippolito) #58761
• [3cf7cfb695] - test: update WPT for WebCryptoAPI to edd42c005c (Node.js GitHub Bot) #57365
• [f57765bdcf] - test: mark test-without-async-context-frame flaky on windows (James M Snell) #56753
  *...

2025-06-09, Version 24.2.0 (Current), @aduh95

Notable Changes

Remove support for HTTP/2 priority signaling

The support for priority signaling has been removed in nghttp2, following its
deprecation in the RFC 9113.
As a consequence of this, priority signaling is deprecated on all release lines of Node.js,
and removed from Node.js 24 so we can include latest updates from nghttp2.

Contributed by Matteo Collina and Antoine du Hamel in
#58293.

import.meta.main is now available

Boolean value available in ECMAScript modules, which can be used to detect
whether the current module was the entry point of the current process.

export function foo() {
  return 'Hello, world';
}

function main() {
  const message = foo();
  console.log(message);
}

if (import.meta.main) main();
// `foo` can be imported from another module without possible side-effects from `main`

Contributed by Joe and Antoine du Hamel in
#57804.

Other Notable Changes

• [e13930bbe0] - doc: add Filip Skokan to TSC (Rafael Gonzaga) #58499
• [984894b38c] - doc: deprecate util.isNativeError in favor of Error.isError (Miguel Marcondes Filho) #58262
• [d261274b0f] - doc: deprecate passing an empty string to options.shell (Antoine du Hamel) #58564
• [510872a522] - (SEMVER-MINOR) doc: graduate Symbol.dispose/asyncDispose from experimental (James M Snell) #58467
• [6f4c9dd423] - (SEMVER-MINOR) fs: add autoClose option to FileHandle readableWebStream (James M Snell) #58548
• [32efb63242] - http: deprecate instantiating classes without new (Yagiz Nizipli) #58518
• [0234a8ef53] - (SEMVER-MINOR) http2: add diagnostics channel http2.server.stream.finish (Darshan Sen) #58560
• [0f1e94f731] - (SEMVER-MINOR) lib: graduate error codes that have been around for years (James M Snell) #58541
• [13abca3c26] - (SEMVER-MINOR) perf_hooks: make event loop delay histogram disposable (James M Snell) #58384
• [8ea1fc5f3b] - (SEMVER-MINOR) src: support namespace options in configuration file (Pietro Marchini) #58073
• [d6ea36ad6c] - src,permission: implicit allow-fs-read to app entrypoint (Rafael Gonzaga) #58579
• [5936cef60a] - (SEMVER-MINOR) test: add disposable histogram test (James M Snell) #58384
• [7a91f4aaa1] - (SEMVER-MINOR) test: add test for async disposable worker thread (James M Snell) #58385
• [532c173cf2] - (SEMVER-MINOR) util: add none style to styleText (James M Snell) #58437
• [aeb9ab4c4c] - (SEMVER-MINOR) worker: make Worker async disposable (James M Snell) #58385

Commits

• [6c92329b1b] - Revert "benchmark: fix broken fs.cpSync benchmark" (Yuesong Jake Li) #58476
• [8bc045264e] - benchmark: fix broken fs.cpSync benchmark (Dario Piotrowicz) #58472
• [46aa079cce] - benchmark: add callback-based fs.glob to glob benchmark (Livia Medeiros) #58417
• [a57b05e105] - benchmark: add more options to cp-sync (Sonny) #58278
• [8b5ada4b31] - buffer: use Utf8LengthV2() instead of Utf8Length() (Tobias Nießen) #58156
• [22e97362f3] - build: search for libnode.so in multiple places (Jan Staněk) #58213
• [0b4056c573] - build: add support for OpenHarmony operating system (hqzing) #58350
• [db7f413dd3] - build: fix pointer compression builds (Joyee Cheung) #58171
• [7ff37183e5] - build: fix defaults for shared llhttp (Antoine du Hamel) #58269
• [b8c33190fe] - build,win: fix dll build (Stefan Stojanovic) #58357
• [ef9ecbe8a6] - child_process: give names to ChildProcess functions (Livia Medeiros) #58370
• [cec9d9d016] - crypto: forward auth tag to OpenSSL immediately (Tobias Nießen) #58547
• [9fccb0609f] - crypto: expose crypto.constants.OPENSSL_IS_BORINGSSL (Shelley Vohr) #58387
• [e7c69b9345] - deps: update nghttp2 to 1.65.0 (Node.js GitHub Bot) #57269
• [d0b89598a3] - deps: use proper C standard when building libuv (Yaksh Bariya) #58587
• [8a1fe7bc6a] - deps: update simdjson to 3.12.3 (Node.js GitHub Bot) #57682
• [36b639b1eb] - deps: update googletest to e9092b1 (Node.js GitHub Bot) #58565
• [f8a2a1ef52] - deps: update corepack to 0.33.0 (Node.js GitHub Bot) #58566
• [efb28f7895] - deps: V8: cherry-pick 249de887a8d3 (Michaël Zasso) #58561
• [88e621ea97] - deps: update sqlite to 3.50.0 (Node.js GitHub Bot) #58272
• [8d2ba386f1] - deps: update OpenSSL gen container to Ubuntu 22.04 (Michaël Zasso) #58432
• [7e62a77a7f] - deps: update undici to 7.10.0 (Node.js GitHub Bot) #58445
• [87eebd7bad] - deps: keep required OpenSSL doc files (Michaël Zasso) #58431
• [10910660f6] - deps: update undici to 7.9.0 (Node.js GitHub Bot) #58268
• [5e27078ca2] - deps: update ada to 3.2.4 (Node.js GitHub Bot) #58152
• [3b1e4bdbbb] - deps: update libuv to 1.51.0 (Node.js GitHub Bot) #58124
• [6bddf587ae] - dns: fix dns query cache implementation (Ethan Arrowood) #58404
• [984894b38c] - doc: deprecate utilisNativeError in favor of ErrorisError (Miguel Marcondes Filho) #58262
• [377ef3ce3a] - doc: add support link for panva (Filip Skokan) #58591
• [33a69ff9e4] - doc: update metadata for _transformState deprecation (James M Snell) #58530
• [d261274b0f] - doc: deprecate passing an empty string to options.shell (Antoine du Hamel) [#58564]...

2025-05-21, Version 24.1.0 (Current), @aduh95

Notable Changes

• [9d35b4ce95] - doc: add JonasBa to collaborators (Jonas Badalic) #58355
• [b7d1bfa7b4] - doc: add puskin to collaborators (Giovanni Bucci) #58308
• [fcead7c28e] - (SEMVER-MINOR) fs: add to Dir support for explicit resource management (Antoine du Hamel) #58206
• [f7041b9369] - Revert "test_runner: change ts default glob" (Théo LUDWIG) #58202

Commits

• [b33e8d2a71] - async_hooks: ensure AsyncLocalStore instances work isolated (Gerhard Stöbich) #58149
• [a1b078b18c] - buffer: give names to Buffer.prototype.*Write() functions (Livia Medeiros) #58258
• [4c967b73c3] - buffer: use constexpr where possible (Yagiz Nizipli) #58141
• [327095a928] - build: fix uvwasi pkgname (Antoine du Hamel) #58270
• [2e54653d3d] - build: use FILE_OFFSET_BITS=64 esp. on 32-bit arch (RafaelGSS) #58090
• [7e4453fe93] - build: escape > metachar in vcbuild (Gerhard Stöbich) #58157
• [7dabf079b1] - child_process: give names to promisified exec() and execFile() (LiviaMedeiros) #57916
• [a896eff1f2] - crypto: handle missing OPENSSL_TLS_SECURITY_LEVEL (Shelley Vohr) #58103
• [6403aa458f] - crypto: merge CipherBase.initiv into constructor (Tobias Nießen) #58166
• [30897d915c] - deps: V8: backport 1d3362c55396 (Shu-yu Guo) #58230
• [63f5d69d2b] - deps: V8: cherry-pick 4f38995c8295 (Shu-yu Guo) #58230
• [5a5f6bb1d4] - deps: V8: cherry-pick 044b9b6f589d (Rezvan Mahdavi Hezaveh) #58230
• [db57f0a4c0] - deps: patch V8 to 13.6.233.10 (Michaël Zasso) #58230
• [f54a7a44ab] - Revert "deps: patch V8 to support compilation with MSVC" (Michaël Zasso) #58187
• [e3193eeca4] - Revert "deps: always define V8_EXPORT_PRIVATE as no-op" (Michaël Zasso) #58187
• [e75ecf8ad1] - Revert "deps: disable V8 concurrent sparkplug compilation" (Michaël Zasso) #58187
• [a0ca15558d] - deps: update llhttp to 9.3.0 (Fedor Indutny) #58144
• [90d4c11992] - deps: update amaro to 0.5.3 (Node.js GitHub Bot) #58174
• [9d35b4ce95] - doc: add JonasBa to collaborators (Jonas Badalic) #58355
• [2676ca0cf5] - doc: add latest security release steward (Rafael Gonzaga) #58339
• [c35cc1bdd9] - doc: document default test-reporter change (Nico Jansen) #58302
• [2bb433d4a5] - doc: fix CryptoKey.algorithm type and other interfaces in webcrypto.md (Filip Skokan) #58294
• [f04f09d783] - doc: mark the callback argument of crypto.generatePrime as mandatory (Allon Murienik) #58299
• [3b9b010844] - doc: remove comma delimiter mention on permissions doc (Rafael Gonzaga) #58297
• [f0cf1a028d] - doc: make Stability labels not sticky in Stability index (Livia Medeiros) #58291
• [a1b937bdee] - doc: update commit-queue documentation (Dario Piotrowicz) #58275
• [b7d1bfa7b4] - doc: add puskin to collaborators (Giovanni Bucci) #58308
• [fc30cdd8d2] - doc: update stability status for diagnostics_channel to experimental (Idan Goshen) #58261
• [290a5ab8ca] - doc: clarify napi_get_value_string_* for bufsize 0 (Tobias Nießen) #58158
• [c26863a683] - doc: fix typo of file http.md, outgoingMessage.setTimeout section (yusheng chen) #58188
• [62dbd36dcb] - doc: update return types for eventNames method in EventEmitter (Yukihiro Hasegawa) #58083
• [130c135f38] - fs: add support for URL for fs.glob's cwd option (Antoine du Hamel) #58182
• [fcead7c28e] - (SEMVER-MINOR) fs: add to Dir support for explicit resource management (Antoine du Hamel) #58206
• [655326ba9f] - fs: glob is stable, so should not emit experimental warnings (Théo LUDWIG) #58236
• [6ebcce7625] - fs: ensure dir.read() does not throw synchronously (Antoine du Hamel) #58228
• [7715722323] - http: remove unused functions and add todos (Yagiz Nizipli) #58143
• [74a807e31f] - http,https: give names to anonymous or misnamed functions (Livia Medeiros) #58180
• [24a9aefb08] - http2: add diagnostics channel 'http2.client.stream.start' (Darshan Sen) #58292
• [2cb86a3cd6] - http2: add diagnostics channel 'http2.client.stream.created' (Darshan Sen) #58246
• [8f1aee90d9] - http2: give name to promisified connect() (LiviaMedeiros) #57916
• [b66f1b0be6] - inspector: support for worker inspection in chrome devtools (Shima Ryuhei) #56759
• [868e72e367] - lib: fix sourcemaps with ts module mocking (Marco Ippolito) #58193
• [570cb6f6b6] - meta: ignore mailmap changes in linux ci (Jonas Badalic) #58356
• [b94f63b865] - module: handle instantiated async module jobs in require(esm) (Joyee Cheung) #58067
• [714b706f2e] - repl: add proper vertical cursor movements (Giovanni Bucci) #58003
• [629a954477] - repl: add possibility to edit multiline commands while adding them (Giovanni Bucci) #58003
• [17746129f3] - sqlite: set name and length on sqlite.backup() (Livia Medeiros) [#58251](https://github.com/nodejs/node/...

2025-05-21, Version 22.16.0 'Jod' (LTS), @aduh95

Notable Changes

• [c3ceaebb7a] - deps: update timezone to 2025b (Node.js GitHub Bot) #57857
• [5059a746ec] - doc: add dario-piotrowicz to collaborators (Dario Piotrowicz) #58102
• [c8ceaaf397] - (SEMVER-MINOR) doc: graduate multiple experimental apis (James M Snell) #57765
• [e21b37d9df] - (SEMVER-MINOR) esm: graduate import.meta properties (James M Snell) #58011
• [832640c35e] - (SEMVER-MINOR) esm: support top-level Wasm without package type (Guy Bedford) #57610
• [c510391d2f] - (SEMVER-MINOR) sqlite: add StatementSync.prototype.columns() (Colin Ihrig) #57490
• [5d1230bec0] - (SEMVER-MINOR) src: set default config as node.config.json (Marco Ippolito) #57171
• [30bb1ccbb0] - (SEMVER-MINOR) src: create THROW_ERR_OPTIONS_BEFORE_BOOTSTRAPPING (Marco Ippolito) #57016
• [0350c6f478] - (SEMVER-MINOR) src: add config file support (Marco Ippolito) #57016
• [e1d3a9e192] - (SEMVER-MINOR) src: add ExecutionAsyncId getter for any Context (Attila Szegedi) #57820
• [0ec912f452] - (SEMVER-MINOR) stream: preserve AsyncLocalStorage context in finished() (Gürgün Dayıoğlu) #57865
• [43490c8797] - (SEMVER-MINOR) util: add types.isFloat16Array() (Livia Medeiros) #57879
• [dda6ca9172] - (SEMVER-MINOR) worker: add worker.getHeapStatistics() (Matteo Collina) #57888

Commits

• [4252dc798c] - assert: support Float16Array in loose deep equality checks (Livia Medeiros) #57881
• [1c7396b078] - assert,util: fix constructor lookup in deep equal comparison (Ruben Bridgewater) #57876
• [1ded5f25c8] - assert,util: improve deep object comparison performance (Ruben Bridgewater) #57648
• [696b5f85ca] - assert,util: improve unequal number comparison performance (Ruben Bridgewater) #57619
• [775ee4d40f] - assert,util: improve array comparison (Ruben Bridgewater) #57619
• [3766992ba4] - benchmark: add sqlite prepare select get (Vinícius Lourenço) #58040
• [8390276be3] - benchmark: add sqlite prepare select all (Vinícius Lourenço) #58040
• [6a9b79e5c1] - benchmark: add sqlite is transaction (Vinícius Lourenço) #58040
• [f689f98344] - benchmark: add sqlite prepare insert (Vinícius Lourenço) #58040
• [14a82804d7] - benchmark: disambiguate filename and dirname read perf (Antoine du Hamel) #58056
• [e7e8256d35] - buffer: avoid creating unnecessary environment (Yagiz Nizipli) #58053
• [d7d8e8e994] - buffer: define global v8::CFunction objects as const (Mert Can Altin) #57676
• [f37633e85a] - build: use $(BUILDTYPE) when cleaning coverage files (Aviv Keller) #57995
• [e5bf67fe77] - build: define python when generating out/Makefile (Aviv Keller) #57970
• [718f874ae0] - build: fix zstd libname (Antoine du Hamel) #57999
• [53c5fdcae1] - crypto: fix cross-realm SharedArrayBuffer validation (Antoine du Hamel) #57974
• [78f4ffee5d] - crypto: fix cross-realm check of ArrayBuffer (Felipe Forbeck) #57828
• [f606352b63] - crypto: forbid passing Float16Array to getRandomValues() (Livia Medeiros) #57880
• [23c4e941c2] - crypto: remove BoringSSL dh-primes addition (Shelley Vohr) #57023
• [8339d9bc14] - deps: V8: cherry-pick f915fa4c9f41 (Chengzhong Wu) #55484
• [c2111dd126] - deps: V8: backport e5dbbbadcbff (Darshan Sen) #58120
• [4cc49be951] - deps: update zstd to 1.5.7 (Node.js GitHub Bot) #57940
• [c956d37c84] - deps: update zlib to 1.3.0.1-motley-780819f (Node.js GitHub Bot) #57768
• [c3ceaebb7a] - deps: update timezone to 2025b (Node.js GitHub Bot) #57857
• [b5cd0eb590] - deps: update simdutf to 6.4.2 (Node.js GitHub Bot) #57855
• [3eb6b814e9] - deps: update simdutf to 6.4.0 (Node.js GitHub Bot) #56764
• [0be9fa3218] - deps: update icu to 77.1 (Node.js GitHub Bot) #57455
• [d5cf4254fb] - doc: add HBSPS as triager (Wiyeong Seo) #57980
• [ad0861dba0] - doc: add ambassaor message (Brian Muenzenmeyer) #57600
• [0d3ec1aafe] - doc: fix misaligned options in vm.compileFunction() (Jimmy Leung) #58145
• [1f70baf3b0] - doc: add missing options.signal to readlinePromises.createInterface() (Jimmy Leung) #55456
• [ec6a48621f] - doc: fix typo of file zlib.md (yusheng chen) #58093
• [37e360e386] - doc: make stability labels more consistent (Antoine du Hamel) #57516
• [2b5d63d36e] - doc: allow the $schema property in node.config.json (Remco Haszing) #57560
• [a2063638e2] - doc: fix AsyncLocalStorage example response changes after node v18 (Naor Tedgi (Abu Emma)) #57969
• [474c2b14c3] - doc: mark Node.js 18 as End-of-Life (Richard Lau) #58084
• [5059a746ec] - doc: add dario-piotrowicz to collaborators (Dario Piotrowicz) #58102
• [1eec170fc3] - doc: fix formatting of import.meta.filename section (Antoine du Hamel) #58079
• [7f108de525] - ...

2025-05-14, Version 24.0.2 (Current), @RafaelGSS

This is a security release.

Notable Changes

• (CVE-2025-23166) fix error handling on async crypto operation

Commits

• [7d0c17b2ad] - (CVE-2025-23166) src: fix error handling on async crypto operations (RafaelGSS) nodejs-private/node-private#688

2025-05-14, Version 23.11.1 (Current), @RafaelGSS

This is a security release.

Notable Changes

src:

• (CVE-2025-23166) fix error handling on async crypto operation

Commits

• [a271810ce2] - deps: update c-ares to v1.34.5 (Node.js GitHub Bot) #57792
• [a12107f0dd] - (CVE-2025-23166) src: fix error handling on async crypto operations (RafaelGSS) nodejs-private/node-private#688

2025-05-14, Version 22.15.1 'Jod' (LTS), @RafaelGSS

This is a security release.

Notable Changes

• (CVE-2025-23166) fix error handling on async crypto operation
• (CVE-2025-23165) add missing call to uv_fs_req_cleanup

Commits

• [edaf54da00] - fs: added test for missing call to uv_fs_req_cleanup (Justin Nietzel) #57811
• [9f403e98ef] - (CVE-2025-23165) fs: add missing call to uv_fs_req_cleanup (Justin Nietzel) #57811
• [f4494d38f1] - (CVE-2025-23166) src: fix error handling on async crypto operations (RafaelGSS) nodejs-private/node-private#709

2025-05-14, Version 20.19.2 'Iron' (LTS), @RafaelGSS

This is a security release.

Notable Changes

• (CVE-2025-23166) fix error handling on async crypto operation
• (CVE-2025-23167) (SEMVER-MAJOR) update llhttp to 9.2.0
• (CVE-2025-23165) add missing call to uv_fs_req_cleanup

Commits

• [eb25047b1b] - deps: update llhttp to 9.2.0 (Node.js GitHub Bot) #51719
• [12dcd8db08] - deps: update llhttp to 9.1.3 (Node.js GitHub Bot) #50080
• [190e45a291] - (SEMVER-MAJOR) (CVE-2025-23167) deps: update llhttp to 9.1.2 (Paolo Insogna) #48981
• [fc68c44e6a] - fs: added test for missing call to uv_fs_req_cleanup (Justin Nietzel) #57811
• [9e13bf0a81] - (CVE-2025-23165) fs: add missing call to uv_fs_req_cleanup (Justin Nietzel) #57811
• [bd0aa5d44c] - (CVE-2024-27982) http: do not allow OBS fold in headers by default (Paolo Insogna) nodejs-private/node-private#556
• [6c57465920] - (CVE-2025-23166) src: fix error handling on async crypto operations (RafaelGSS) nodejs-private/node-private#710

2025-05-08, Version 24.0.1 (Current), @aduh95

Notable Changes

• [2e1d9581e0] - Revert "buffer: move SlowBuffer to EOL" (Filip Skokan) #58211

Commits

• [d38e811c5b] - benchmark: fix typo in method name for error-stack (Miguel Marcondes Filho) #58128
• [2e1d9581e0] - Revert "buffer: move SlowBuffer to EOL" (Filip Skokan) #58211
• [a883b0c979] - build: use //third_party/simdutf by default in GN (Shelley Vohr) #58115
• [3d84b5c7a4] - doc: add HBSPS as triager (Wiyeong Seo) #57980
• [1e57cb686e] - doc: add history entries to --input-type section (Antoine du Hamel) #58175
• [0b54f06b6f] - doc: add ambassaor message (Brian Muenzenmeyer) #57600
• [46bee52d57] - doc: fix misaligned options in vm.compileFunction() (Jimmy Leung) #58145
• [e732a8bfdd] - doc: fix typo in benchmark script path (Miguel Marcondes Filho) #58129
• [d49ff34adb] - doc: add missing options.signal to readlinePromises.createInterface() (Jimmy Leung) #55456
• [bc9f5a2e79] - doc: fix typo of file zlib.md (yusheng chen) #58093
• [c8e8558958] - doc: clarify future Corepack removal in v25+ (Trivikram Kamat) #57825
• [b13d5d14bd] - meta: bump actions/setup-node from 4.3.0 to 4.4.0 (dependabot[bot]) #58111
• [0ebb17a300] - meta: bump actions/setup-python from 5.5.0 to 5.6.0 (dependabot[bot]) #58107
• [5946785bf4] - tools: exclude deps/v8/tools from CodeQL scans (Rich Trott) #58132
• [0708497c7f] - tools: bump the eslint group in /tools/eslint with 6 updates (dependabot[bot]) #58105

2025-05-06, Version 24.0.0 (Current), @RafaelGSS and @juanarbol

We’re excited to announce the release of Node.js 24! This release brings
several significant updates, including the upgrade of the V8 JavaScript
engine to version 13.6 and npm to version 11. Starting with
Node.js 24, support for MSVC has been removed, and ClangCL is now required
to compile Node.js on Windows. The AsyncLocalStorage API now uses
AsyncContextFrame by default, and URLPattern is available globally.
These changes, along with many other improvements, continue to push the
platform forward.

As a reminder, Node.js 24 will enter long-term support (LTS) in October,
but until then, it will be the "Current" release for the next six months.
We encourage you to explore the new features and benefits offered by this
latest release and evaluate their potential impact on your applications.

Notable Changes

V8 13.6

The V8 engine is updated to version 13.6, which includes several new
JavaScript features:

• Float16Array
• Explicit resource management
• RegExp.escape
• WebAssembly Memory64
• Error.isError

The V8 update was a contribution by Michaël Zasso in #58070.

npm 11

Node.js 24 comes with npm 11, which includes several improvements and new
features. This update brings enhanced performance, improved security features,
and better compatibility with modern JavaScript packages.

The npm update was a contribution by the npm team in #56274.

AsyncLocalStorage defaults to AsyncContextFrame

AsyncLocalStorage now uses AsyncContextFrame by default, which provides a
more efficient implementation of asynchronous context tracking.
This change improves performance and makes the API more robust for advanced
use cases.

This change was a contribution by Stephen Belanger in #55552.

URLPattern as a global

The URLPattern
API is now exposed on the global object, making it easier to use without
explicit imports. This API provides a powerful pattern matching system for URLs,
similar to how regular expressions work for strings.

This feature was a contribution by Jonas Badalič in #56950.

Permission Model Improvements

The experimental Permission Model introduced in Node.js 20 has been improved,
and the flag has been changed from --experimental-permission to simply
--permission, indicating its increasing stability and readiness for broader
adoption.

This change was a contribution by Rafael Gonzaga in #56240.

Test Runner Enhancements

The test runner module now automatically waits for subtests to finish,
eliminating the need to manually await test promises. This makes writing tests
more intuitive and reduces common errors related to unhandled promises.

The test runner improvements were contributions by Colin Ihrig in #56664.

Undici 7

Node.js 24 includes Undici 7, which brings numerous improvements to the
HTTP client capabilities, including better performance and support for newer
HTTP features.

Deprecations and Removals

Several APIs have been deprecated or removed in this release:

• Runtime deprecation of url.parse() - use the WHATWG URL API instead (#55017)
• Removal of deprecated tls.createSecurePair (#57361)
• Runtime deprecation of SlowBuffer (#55175)
• Runtime deprecation of instantiating REPL without new (#54869)
• Deprecation of using Zlib classes without new (#55718)
• Deprecation of passing args to spawn and execFile in child_process (#57199)

Semver-Major Commits

• [c6b934380a] - (SEMVER-MAJOR) src: enable Float16Array on global object (Michaël Zasso) #58154
• [69efb81a73] - (SEMVER-MAJOR) src: enable explicit resource management (Michaël Zasso) #58154
• [b00ff4270e] - (SEMVER-MAJOR) src,test: unregister the isolate after disposal and before freeing (Joyee Cheung) #58070
• [b81697d860] - (SEMVER-MAJOR) src: use non-deprecated WriteUtf8V2() method (Yagiz Nizipli) #58070
• [1f06169b87] - (SEMVER-MAJOR) src: use non-deprecated Utf8LengthV2() method (Yagiz Nizipli) #58070
• [eae9a296f0] - (SEMVER-MAJOR) src: use V8-owned CppHeap (Joyee Cheung) #58070
• [087c254a11] - (SEMVER-MAJOR) test: fix test-fs-write for V8 13.6 (Michaël Zasso) #58070
• [9e49bedd8e] - (SEMVER-MAJOR) build: update list of installed cppgc headers (Michaël Zasso) #58070
• [93cca8a43e] - (SEMVER-MAJOR) tools: update V8 gypfiles for 13.6 (Michaël Zasso) #58070
• [347daa07be] - (SEMVER-MAJOR) tools: update V8 gypfiles for 13.5 (Michaël Zasso) #58070
• [2a35d5a86c] - (SEMVER-MAJOR) build: fix V8 TLS config for shared lib builds (Michaël Zasso) #58070
• [b0fb5a09cf] - (SEMVER-MAJOR) build: pass -fPIC to linker as well for shared builds (Michaël Zasso) #58070
• [dd4c5d6c73] - (SEMVER-MAJOR) src,test: add V8 API to test the hash seed (Michaël Zasso) #58070
• [1d5d7b6eed] - (SEMVER-MAJOR) src: use v8::ExternalMemoryAccounter (Michaël Zasso) #58070
• [3779e43cce] - (SEMVER-MAJOR) tools: update license-builder and LICENSE for V8 deps (Michaël Zasso) #58070
• [82c2255206] - (SEMVER-MAJOR) deps: remove deps/simdutf (Michaël Zasso) #58070
• [8a258eb7b1] - (SEMVER-MAJOR) test: handle explicit resource management globals (Michaël Zasso) #58070
• [9e0d9b6024] - (SEMVER-MAJOR) test: adapt assert tests to stack trace changes (Michaël Zasso) #58070
• [f7406aa56d] - (SEMVER-MAJOR) test: update test-linux-perf-logger (Michaël Zasso) #58070
• [c7493fac5e] - (SEMVER-MAJOR) Revert "test: disable fast API call count checks" (Michaël Zasso) #58070
• [50a8527867] - (SEMVER-MAJOR) src: replace uses of FastApiTypedArray (Michaël Zasso) #58070
• [9c1ebb713c] - (SEMVER-MAJOR) build: add /bigobj to compile V8 on Windows (Michaël Zasso) #58070
• [fb3d5ea45d] - (SEMVER-MAJOR) tools: update V8 gypfiles for 13.4 (Michaël Zasso) #58070
• [756abacf73] - (SEMVER-MAJOR) build,src,tools: adapt build config for V8 13.3 (Michaël Zasso) #58070
• [f8953e54b0] - (SEMVER-MAJOR) tools: update V8 gypfiles for 13.2 (Michaël Zasso) #58070
• [c8a0e205e1] - (SEMVER-MAJOR) tools: update V8 gypfiles for 13.1 (Michaël Zasso) #58070
• [1689ee84ce] - (SEMVER-MAJOR) build: enable shared RO heap with ptr compression (Michaël Zasso) #58070
• [[15f2fb9467](https://github.com/nodejs/node/comm...