Skip to content

2026-06-23, Version 24.18.0 'Krypton' (LTS) - #64062

Merged
richardlau merged 150 commits into
v24.xfrom
v24.18.0-proposal
Jun 23, 2026
Merged

2026-06-23, Version 24.18.0 'Krypton' (LTS)#64062
richardlau merged 150 commits into
v24.xfrom
v24.18.0-proposal

Conversation

@sxa

@sxa sxa commented Jun 22, 2026 •
edited
Loading

Copy link
aduh95 and others added 30 commits June 18, 2026 00:15
@aduh95
doc: remove list of versions in BUILDING.md
27c1c1d 
Signed-off-by: Antoine du Hamel <duhamelantoine1995@gmail.com>
PR-URL: #63113
Reviewed-By: Filip Skokan <panva.ip@gmail.com>
Reviewed-By: René <contact.9a5d6388@renegade334.me.uk>
Reviewed-By: Michaël Zasso <targos@protonmail.com>
Reviewed-By: Marco Ippolito <marcoippolito54@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Rafael Gonzaga <rafael.nunu@hotmail.com>
Reviewed-By: Trivikram Kamat <trivikr.dev@gmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Paolo Insogna <paolo@cowtech.it>
@marco-ippolito @aduh95
doc: document the latest-vX.x schema
ececd80 
Signed-off-by: Marco Ippolito <marcoippolito54@gmail.com>
PR-URL: #63033
Reviewed-By: Pietro Marchini <pietro.marchini94@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
@Anshikakalpana @aduh95
doc: add Hmac.digest() documentation-only deprecation (DEP0206)
7d81419 
Signed-off-by: anshikakalpana <anshikajain196872@gmail.com>
PR-URL: #63121
Refs: #62838
Reviewed-By: René <contact.9a5d6388@renegade334.me.uk>
Reviewed-By: Filip Skokan <panva.ip@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
@mcollina @aduh95
sqlite: keep source database alive during backup
30e71c7 
Signed-off-by: Matteo Collina <hello@matteocollina.com>
PR-URL: #62673
Reviewed-By: Daniel Lemire <daniel@lemire.me>
Reviewed-By: Tobias Nießen <tniessen@tnie.de>
Reviewed-By: Edy Silva <edigleyssonsilva@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
@joyeecheung @aduh95
module: fix sync hook short-circuit in require() in imported CJS
69df688 
- For imported CJS, if it's not customized by asynchronous hooks,
  make sure it won't use the quirky re-invented require in all
  cases.
- When the imported CJS module is customized by synchronous hooks,
  in the synthetic module evalutation step, avoid calling the
  respective default step again.
- Make the branching of loadCJSModuleWithModuleLoad() and
  loadCJSModuleWithSpecialRequire() more explicit, and fold
  the tentative fs read in the 'commonjs' translator into the
  share createCJSModuleWrap() helper instead of checking it
  twice in the same path.

Signed-off-by: Joyee Cheung <joyeec9h3@gmail.com>
PR-URL: #62920
Fixes: #63060
Reviewed-By: Paolo Insogna <paolo@cowtech.it>
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
Reviewed-By: Gürgün Dayıoğlu <hey@gurgun.day>
@Renegade334 @aduh95
test: use ERM to destroy sqlite database handles after tests
64efbfd 
Signed-off-by: Renegade334 <contact.9a5d6388@renegade334.me.uk>
PR-URL: #63076
Refs: #63052
Reviewed-By: Chemi Atlow <chemi@atlow.co.il>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Edy Silva <edigleyssonsilva@gmail.com>
@geeksilva97 @aduh95
doc,sqlite: document entryPoint argument for loadExtension
e369886 
Signed-off-by: geeksilva97 <edigleyssonsilva@gmail.com>
PR-URL: #63152
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: René <contact.9a5d6388@renegade334.me.uk>
@RafaelGSS @aduh95
doc: update release steps when post-release fails
aaef29e 
Signed-off-by: RafaelGSS <rafael.nunu@hotmail.com>
PR-URL: #63131
Reviewed-By: Marco Ippolito <marcoippolito54@gmail.com>
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
@panva @aduh95
tls: add unsupported renegotiation error
94e5f63 
Map BoringSSL's native renegotiation failure to
ERR_TLS_RENEGOTIATION_UNSUPPORTED when TLSSocket#renegotiate() is
called. This avoids exposing an implementation-specific OpenSSL error
when the TLS backend does not support caller-initiated renegotiation.

Signed-off-by: Filip Skokan <panva.ip@gmail.com>
PR-URL: #63161
Reviewed-By: Tim Perry <pimterry@gmail.com>
Reviewed-By: Anna Henningsen <anna@addaleax.net>
Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com>
@jasnell @aduh95
quic: remove unused binding variable in session.cc
4b367cb 
Signed-off-by: James M Snell <jasnell@gmail.com>
PR-URL: #63177
Reviewed-By: Tim Perry <pimterry@gmail.com>
Reviewed-By: Anna Henningsen <anna@addaleax.net>
@mokashang @aduh95
doc: clarify SEA platform support excludes darwin-x64
a95fc1f 
The Platform support section of the single-executable-applications doc
listed `macOS` without qualifying which architecture is supported.
SEA on x64 macOS is not supported and is skipped in CI; only arm64
macOS is exercised.

Refs: #62893
Signed-off-by: mokashang <64570909+mokashang@users.noreply.github.com>
PR-URL: #63181
Reviewed-By: Joyee Cheung <joyeec9h3@gmail.com>
Reviewed-By: Chemi Atlow <chemi@atlow.co.il>
@aduh95
panva and others added 6 commits June 23, 2026 01:06
@panva @sxa
lib: refactor internal webidl converters
1c16b45 
Rework lib/internal/webidl.js into a documented shared converter module
that follows the Web IDL conversion algorithms more closely.

Improvements:
- Add documented converters and helper factories for primitive values,
  dictionaries, enums, sequences, interfaces, required arguments,
  integers, `Uint8Array`, and `BufferSource`.
- Move WebCrypto onto the shared converters, while keeping compatibility
  wrappers for its existing `BufferSource` and `BigInteger` behavior.
- Use shared converters from Blob, Performance, Web Locks, and
  structured clone option handling.
- Add benchmarks for `ConvertToInt` and WebCrypto Web IDL converter hot
  paths.
- Add focused tests for core converters, WebCrypto converters, integer
  conversion, and buffer source behavior.

Fixes:
- Make the shared `BufferSource` and `Uint8Array` converters reject
  resizable `ArrayBuffer` and growable `SharedArrayBuffer` backing
  stores unless explicitly allowed. WebCrypto preserves its legacy
  resizable backing-store behavior through compatibility wrappers until
  a semver-major follow-up can opt in to the stricter behavior.
- Use Web IDL `ToNumber` and `ToString` behavior for BigInt, Symbol, and
  object primitive conversion.
- Use exact BigInt modulo for 64-bit `ConvertToInt` wrapping and
  document the final Number approximation behavior.
- Normalize mathematical modulo results to `+0` where Web IDL requires
  it.
- Process inherited dictionaries in least-derived to most-derived order,
  sorting members only within each dictionary level.
- Use `IteratorComplete` truthiness for sequence conversion.
- Cover detached buffers, resizable-backed views, growable-backed views,
  cross-realm buffer sources, mutation-after-call behavior, inherited
  dictionary member order, and sequence iterator completion behavior.

Signed-off-by: Filip Skokan <panva.ip@gmail.com>
PR-URL: #62979
Backport-PR-URL: #63563
Reviewed-By: Сковорода Никита Андреевич <chalkerx@gmail.com>
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
@tniessen @sxa
crypto: strengthen argument CHECKs in TurboSHAKE
e8a55ce 
Instead of first discarding the top 24 bits of the argument and then
checking that the low 8 bits are within the expected range, first check
that the original 32-bit integer is within the expected range and then
discard the top 24 bits.

PR-URL: #62763
Backport-PR-URL: #63563
Reviewed-By: Filip Skokan <panva.ip@gmail.com>
Reviewed-By: Xuguang Mei <meixuguang@gmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
@panva @sxa
lib: cleanup stateless diffiehellman key handling
c05f382 
Signed-off-by: Filip Skokan <panva.ip@gmail.com>
PR-URL: #62645
Backport-PR-URL: #63563
Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
@panva @sxa
test: update tls/crypto behaviour expectations when using BoringSSL
61b20f6 
Signed-off-by: Filip Skokan <panva.ip@gmail.com>
PR-URL: #63161
Backport-PR-URL: #63563
Reviewed-By: Tim Perry <pimterry@gmail.com>
Reviewed-By: Anna Henningsen <anna@addaleax.net>
Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com>
@mcollina @sxa
http: avoid stream listeners on idle agent sockets
44c8ebc 
Signed-off-by: Matteo Collina <hello@matteocollina.com>
PR-URL: #64004
Fixes: #63989
Reviewed-By: René <contact.9a5d6388@renegade334.me.uk>
Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Robert Nagy <ronagy@icloud.com>
@sxa
2026-06-23, Version 24.18.0 'Krypton' (LTS)
20da4ae 
Notable changes:

buffer:
  * (SEMVER-MINOR) increase Buffer.poolSize default to 64 KiB (Matteo Collina) #63597
crypto:
  * update root certificates to NSS 3.123.1 (Node.js GitHub Bot) #63527
  * (SEMVER-MINOR)  align key argument names in docs and error messages (Filip Skokan) #62527
  * (SEMVER-MINOR)  accept key data in crypto.diffieHellman() and cleanup DH jobs (Filip Skokan) #62527
  * (SEMVER-MINOR)  add TurboSHAKE and KangarooTwelve Web Cryptography algorithms (Filip Skokan) #62183
http:
  * http: avoid stream listeners on idle agent sockets (Matteo Collina) #64004
  * (SEMVER-MINOR) add writeInformation to send arbitrary 1xx status codes (Tim Perry) #63155
inspector:
  * (SEMVER-MINOR) expose precise coverage start to JS runtime (sangwook) #63079
stream:
  * stream: Revert noop pause/resume on destroyed streams" (Stewart X Addison) #63834

PR-URL: #64062
@sxa sxa added the request-ci Add this label to start a Jenkins CI on a PR. label Jun 23, 2026
@sxa
sxa force-pushed the v24.18.0-proposal branch from 01ecf45 to 20da4ae Compare June 23, 2026 00:29
@sxa sxa self-assigned this Jun 23, 2026
@github-actions github-actions Bot added request-ci-failed Starting CI with the request-ci label failed and requires manual intervention. and removed request-ci Add this label to start a Jenkins CI on a PR. labels Jun 23, 2026
@github-actions

github-actions Bot commented Jun 23, 2026

Copy link
Copy Markdown
Contributor
Failed to start CI
   ⚠  Commits were pushed since the last approving review:
   ⚠  - test: deflake watch mode worker test
   ⚠  - test: avoid repeated writes in watch helper
   ⚠  - doc: update http2's `push` and `trailers` events with `rawHeaders` param
   ⚠  - doc: remove the bi-monthly contributor spotlight section
   ⚠  - doc: fix article usage before vowel-sound acronyms
   ⚠  - test: deflake connection refused proxy tests
   ⚠  - test: disable Maglev in near-heap-limit worker test
   ⚠  - meta: move one or more collaborators to emeritus
   ⚠  - doc: remove unsupported template type from v8.md
   ⚠  - Revert "stream: noop pause/resume on destroyed streams"
   ⚠  - test_runner: preserve run duration when using test-rerun
   ⚠  - test_runner: show replayed-from-attempt hint in spec reporter
   ⚠  - src: expose `node::RegisterContext` to make a node managed context
   ⚠  - test: wait for ok before initial break after restart
   ⚠  - doc: fix typo in deprecations
   ⚠  - meta: add additional gitignore entries
   ⚠  - quic: fixup linting issue after other changes
   ⚠  - quic: implement rate limiting for version nego and immediate close
   ⚠  - quic: add reusePort option to QuicEndpoint
   ⚠  - stream: fix Writable.toWeb() hang on synchronous drain
   ⚠  - test: isolate rerun-failures state file under tmpdir
   ⚠  - doc: fix "options" to "option" in tls.createServer
   ⚠  - deps: upgrade npm to 11.15.0
   ⚠  - inspector: expose precise coverage start to JS runtime
   ⚠  - doc: fix double space in modules.md
   ⚠  - test_runner: fix --test-rerun-failures swallowing failures on retry
   ⚠  - tools: fix skip of `test-internet` on forks
   ⚠  - test_runner: dont buffer unordered events in process isolation mode
   ⚠  - tools: skip commit-lint on backport pull requests
   ⚠  - test: reduce watch mode restart flakiness
   ⚠  - test: avoid test_runner watch restart in spec snapshot
   ⚠  - test: deflake async-hooks statwatcher test
   ⚠  - src: improve token return value check
   ⚠  - test: update WPT for url to e4a4672e9e
   ⚠  - doc: fix double spaces in ERR_TLS_INVALID_PROTOCOL_METHOD
   ⚠  - test: update test426-fixtures to 9b9e225b5a63139e9a95cdd1bf874a8f0b9d131
   ⚠  - src,sqlite: only pass `xFilter` when user provided a callback
   ⚠  - test: remove test-node-output-v8-warning
   ⚠  - crypto: coerce -0 keylen to +0 in pbkdf2 and scrypt
   ⚠  - crypto: update root certificates to NSS 3.123.1
   ⚠  - doc: clarify `filter` option of `sqlite.database.applyChangeset`
   ⚠  - tools: bump brace-expansion from 5.0.5 to 5.0.6 in /tools/eslint
   ⚠  - doc: fix URL postMessage example in worker_threads
   ⚠  - doc: explicitly ask for reproducible in JS
   ⚠  - lib: fix typos in esm loader comments
   ⚠  - deps: SQLite: cherry-pick b869ed6b067d623cb1383549f2a18aa35508385d
   ⚠  - meta: skip scheduled workflows on forks
   ⚠  - src: skip duplicate UTF-8 validation in TextDecoder fatal path
   ⚠  - test: shorten path in net pipe connect errors
   ⚠  - http2: emit session close before stream close
   ⚠  - meta: add `vfs` subsystem label
   ⚠  - doc: drop --experimental from --permission
   ⚠  - module: load ESM helpers eagerly in the snapshot
   ⚠  - doc: update `git node land` instructions for security releases
   ⚠  - build: def `NODE_USE_NODE_CODE_CACHE` only used in node_mksnapshot
   ⚠  - meta: label "source maps" PRs
   ⚠  - stream: use data listener for compose forwarding
   ⚠  - buffer: increase Buffer.poolSize default to 64 KiB
   ⚠  - errors: handle V8 warnings in DisallowJavascriptExecutionScope
   ⚠  - util: create hex style cache and fast path
   ⚠  - deps: upgrade npm to 11.16.0
   ⚠  - lib: define `kEnumerableProperty` atomically
   ⚠  - stream: switch to internal `sleep` binding
   ⚠  - util: remove unused functions
   ⚠  - meta: flip mcollina emails in .mailmap
   ⚠  - src: remove TOCTOU race condition when encoding SAB-backed `Buffer`s
   ⚠  - doc: remove duplicated sentences in large-pull-requests.md
   ⚠  - build: add --enable-all-experimentals build flag
   ⚠  - build,win: enable x64 PGO
   ⚠  - src: split profiling helpers from util
   ⚠  - src: remove license headers for new node_profiling files
   ⚠  - test: update WPT resources, interfaces and WebCryptoAPI
   ⚠  - crypto: add TurboSHAKE and KangarooTwelve Web Cryptography algorithms
   ⚠  - crypto: unify asymmetric key import through KeyObjectHandle::Init
   ⚠  - crypto: accept key data in crypto.diffieHellman() and cleanup DH jobs
   ⚠  - crypto: align key argument names in docs and error messages
   ⚠  - crypto: guard against size_t overflow on experimental 32-bit arch
   ⚠  - crypto: add JWK support for ML-KEM and SLH-DSA key types
   ⚠  - crypto: reject duplicate ML-KEM JWK key_ops
   ⚠  - crypto: add guards and adjust tests for BoringSSL
   ⚠  - src: decouple KeyObject and CryptoKey and move CryptoKey to src
   ⚠  - crypto: harden KeyObject internal slots
   ⚠  - crypto: harden CryptoKey algorithm slots
   ⚠  - tools: prevent lib code from reading KeyObject and CryptoKey accessors
   ⚠  - src: add BoringSSL EVP enumeration fallback
   ⚠  - src: simplify OpenSSL feature gates
   ⚠  - crypto: wire AES-KW in Web Cryptography when using BoringSSL
   ⚠  - crypto: wire ChaCha20-Poly1305 in Web Cryptography when using BoringSSL
   ⚠  - crypto: wire ML-DSA and ML-KEM for use when using BoringSSL
   ⚠  - crypto: add WebCrypto CryptoJob mode
   ⚠  - crypto: remove async from WebCrypto methods
   ⚠  - crypto: pass CryptoKey handles to KDF jobs
   ⚠  - crypto: harden WebCrypto against prototype pollution
   ⚠  - test: update WPT for WebCryptoAPI to 97bbc7247a
   ⚠  - lib: refactor internal webidl converters
   ⚠  - crypto: strengthen argument CHECKs in TurboSHAKE
   ⚠  - lib: cleanup stateless diffiehellman key handling
   ⚠  - test: update tls/crypto behaviour expectations when using BoringSSL
   ⚠  - http: avoid stream listeners on idle agent sockets
   ⚠  - 2026-06-23, Version 24.18.0 'Krypton' (LTS)
   ✘  Refusing to run CI on potentially unsafe PR
https://github.com/nodejs/node/actions/runs/27995253754
@panva panva removed the request-ci-failed Starting CI with the request-ci label failed and requires manual intervention. label Jun 23, 2026
@nodejs-github-bot

nodejs-github-bot commented Jun 23, 2026

Copy link
Copy Markdown
Collaborator

CI: https://ci.nodejs.org/job/node-test-pull-request/74376/
mcollina
mcollina approved these changes Jun 23, 2026
View reviewed changes

@mcollina mcollina left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

lgtm
@nodejs-github-bot

nodejs-github-bot commented Jun 23, 2026

Copy link
Copy Markdown
Collaborator

CI: https://ci.nodejs.org/job/node-test-pull-request/74379/
@sxa

sxa commented Jun 23, 2026 •
edited by richardlau
Loading

Copy link
Copy Markdown
Member Author

Results:

Based on the above I have disabled the following three machines temporarily for analysis and to do another clean base run at https://ci.nodejs.org/job/citgm-smoker/nodes=win-vs2022_clang/3738/ but I don't feel it necessary to block on this:

📦 https://ci-release.nodejs.org/job/iojs+release/11881/ Failed due to nodejs/build#4380
📦 https://ci-release.nodejs.org/job/iojs+release/11887/nodes=osx13-release-pkg/
📦 https://ci-release.nodejs.org/job/iojs+release/11892/nodes=rhel8-arm64-release/ https://ci-release.nodejs.org/job/iojs+release/11893/nodes=rhel8-arm64-release/
@sakkadak sakkadak mentioned this pull request Jun 23, 2026
Closed
@miguelzapataj

miguelzapataj commented Jun 23, 2026

Copy link
Copy Markdown

Hi @sxa

Is there an expected date to release this new version?
@richardlau richardlau mentioned this pull request Jun 23, 2026
Closed
@richardlau
richardlau merged commit 20da4ae into v24.x Jun 23, 2026
50 checks passed
richardlau pushed a commit that referenced this pull request Jun 23, 2026
@sxa @richardlau
2026-06-23, Version 24.18.0 'Krypton' (LTS)
9f23e70 
Notable changes:

buffer:
  * (SEMVER-MINOR) increase Buffer.poolSize default to 64 KiB (Matteo Collina) #63597
crypto:
  * update root certificates to NSS 3.123.1 (Node.js GitHub Bot) #63527
  * (SEMVER-MINOR)  align key argument names in docs and error messages (Filip Skokan) #62527
  * (SEMVER-MINOR)  accept key data in crypto.diffieHellman() and cleanup DH jobs (Filip Skokan) #62527
  * (SEMVER-MINOR)  add TurboSHAKE and KangarooTwelve Web Cryptography algorithms (Filip Skokan) #62183
http:
  * http: avoid stream listeners on idle agent sockets (Matteo Collina) #64004
  * (SEMVER-MINOR) add writeInformation to send arbitrary 1xx status codes (Tim Perry) #63155
inspector:
  * (SEMVER-MINOR) expose precise coverage start to JS runtime (sangwook) #63079
stream:
  * stream: Revert noop pause/resume on destroyed streams" (Stewart X Addison) #63834

PR-URL: #64062
@richardlau
richardlau deleted the v24.18.0-proposal branch June 23, 2026 23:02
R31K4G3 pushed a commit to R31K4G3/node that referenced this pull request Jun 28, 2026
@richardlau
Working on v24.18.1
9de263a 
PR-URL: nodejs#64062
This was referenced Jun 29, 2026
Open
Closed
@coderabbitai coderabbitai Bot mentioned this pull request Jul 15, 2026
Merged
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

build Issues and PRs related to Node.js builds or CI infrastructure. dependencies PRs that add, update, or configure Node.js dependencies. doc Issues and PRs related to Node.js documentation. meta Issues and PRs related to the general management of the project. needs-ci PRs that need a full CI run. release Issues and PRs related to Node.js releases. v24.x Issues that can be reproduced on v24.x or PRs targeting the v24.x-staging branch.