2025-05-14, Version 20.19.2 'Iron' (LTS), @RafaelGSS

This is a security release.

Notable Changes

• (CVE-2025-23166) fix error handling on async crypto operation
• (CVE-2025-23167) (SEMVER-MAJOR) update llhttp to 9.2.0
• (CVE-2025-23165) add missing call to uv_fs_req_cleanup

Commits

• [eb25047b1b] - deps: update llhttp to 9.2.0 (Node.js GitHub Bot) #51719
• [12dcd8db08] - deps: update llhttp to 9.1.3 (Node.js GitHub Bot) #50080
• [190e45a291] - (SEMVER-MAJOR) (CVE-2025-23167) deps: update llhttp to 9.1.2 (Paolo Insogna) #48981
• [fc68c44e6a] - fs: added test for missing call to uv_fs_req_cleanup (Justin Nietzel) #57811
• [9e13bf0a81] - (CVE-2025-23165) fs: add missing call to uv_fs_req_cleanup (Justin Nietzel) #57811
• [bd0aa5d44c] - (CVE-2024-27982) http: do not allow OBS fold in headers by default (Paolo Insogna) nodejs-private/node-private#556
• [6c57465920] - (CVE-2025-23166) src: fix error handling on async crypto operations (RafaelGSS) nodejs-private/node-private#710

2025-05-08, Version 24.0.1 (Current), @aduh95

Notable Changes

• [2e1d9581e0] - Revert "buffer: move SlowBuffer to EOL" (Filip Skokan) #58211

Commits

• [d38e811c5b] - benchmark: fix typo in method name for error-stack (Miguel Marcondes Filho) #58128
• [2e1d9581e0] - Revert "buffer: move SlowBuffer to EOL" (Filip Skokan) #58211
• [a883b0c979] - build: use //third_party/simdutf by default in GN (Shelley Vohr) #58115
• [3d84b5c7a4] - doc: add HBSPS as triager (Wiyeong Seo) #57980
• [1e57cb686e] - doc: add history entries to --input-type section (Antoine du Hamel) #58175
• [0b54f06b6f] - doc: add ambassaor message (Brian Muenzenmeyer) #57600
• [46bee52d57] - doc: fix misaligned options in vm.compileFunction() (Jimmy Leung) #58145
• [e732a8bfdd] - doc: fix typo in benchmark script path (Miguel Marcondes Filho) #58129
• [d49ff34adb] - doc: add missing options.signal to readlinePromises.createInterface() (Jimmy Leung) #55456
• [bc9f5a2e79] - doc: fix typo of file zlib.md (yusheng chen) #58093
• [c8e8558958] - doc: clarify future Corepack removal in v25+ (Trivikram Kamat) #57825
• [b13d5d14bd] - meta: bump actions/setup-node from 4.3.0 to 4.4.0 (dependabot[bot]) #58111
• [0ebb17a300] - meta: bump actions/setup-python from 5.5.0 to 5.6.0 (dependabot[bot]) #58107
• [5946785bf4] - tools: exclude deps/v8/tools from CodeQL scans (Rich Trott) #58132
• [0708497c7f] - tools: bump the eslint group in /tools/eslint with 6 updates (dependabot[bot]) #58105

2025-05-06, Version 24.0.0 (Current), @RafaelGSS and @juanarbol

We’re excited to announce the release of Node.js 24! This release brings
several significant updates, including the upgrade of the V8 JavaScript
engine to version 13.6 and npm to version 11. Starting with
Node.js 24, support for MSVC has been removed, and ClangCL is now required
to compile Node.js on Windows. The AsyncLocalStorage API now uses
AsyncContextFrame by default, and URLPattern is available globally.
These changes, along with many other improvements, continue to push the
platform forward.

As a reminder, Node.js 24 will enter long-term support (LTS) in October,
but until then, it will be the "Current" release for the next six months.
We encourage you to explore the new features and benefits offered by this
latest release and evaluate their potential impact on your applications.

Notable Changes

V8 13.6

The V8 engine is updated to version 13.6, which includes several new
JavaScript features:

• Float16Array
• Explicit resource management
• RegExp.escape
• WebAssembly Memory64
• Error.isError

The V8 update was a contribution by Michaël Zasso in #58070.

npm 11

Node.js 24 comes with npm 11, which includes several improvements and new
features. This update brings enhanced performance, improved security features,
and better compatibility with modern JavaScript packages.

The npm update was a contribution by the npm team in #56274.

AsyncLocalStorage defaults to AsyncContextFrame

AsyncLocalStorage now uses AsyncContextFrame by default, which provides a
more efficient implementation of asynchronous context tracking.
This change improves performance and makes the API more robust for advanced
use cases.

This change was a contribution by Stephen Belanger in #55552.

URLPattern as a global

The URLPattern
API is now exposed on the global object, making it easier to use without
explicit imports. This API provides a powerful pattern matching system for URLs,
similar to how regular expressions work for strings.

This feature was a contribution by Jonas Badalič in #56950.

Permission Model Improvements

The experimental Permission Model introduced in Node.js 20 has been improved,
and the flag has been changed from --experimental-permission to simply
--permission, indicating its increasing stability and readiness for broader
adoption.

This change was a contribution by Rafael Gonzaga in #56240.

Test Runner Enhancements

The test runner module now automatically waits for subtests to finish,
eliminating the need to manually await test promises. This makes writing tests
more intuitive and reduces common errors related to unhandled promises.

The test runner improvements were contributions by Colin Ihrig in #56664.

Undici 7

Node.js 24 includes Undici 7, which brings numerous improvements to the
HTTP client capabilities, including better performance and support for newer
HTTP features.

Deprecations and Removals

Several APIs have been deprecated or removed in this release:

• Runtime deprecation of url.parse() - use the WHATWG URL API instead (#55017)
• Removal of deprecated tls.createSecurePair (#57361)
• Runtime deprecation of SlowBuffer (#55175)
• Runtime deprecation of instantiating REPL without new (#54869)
• Deprecation of using Zlib classes without new (#55718)
• Deprecation of passing args to spawn and execFile in child_process (#57199)

Semver-Major Commits

• [c6b934380a] - (SEMVER-MAJOR) src: enable Float16Array on global object (Michaël Zasso) #58154
• [69efb81a73] - (SEMVER-MAJOR) src: enable explicit resource management (Michaël Zasso) #58154
• [b00ff4270e] - (SEMVER-MAJOR) src,test: unregister the isolate after disposal and before freeing (Joyee Cheung) #58070
• [b81697d860] - (SEMVER-MAJOR) src: use non-deprecated WriteUtf8V2() method (Yagiz Nizipli) #58070
• [1f06169b87] - (SEMVER-MAJOR) src: use non-deprecated Utf8LengthV2() method (Yagiz Nizipli) #58070
• [eae9a296f0] - (SEMVER-MAJOR) src: use V8-owned CppHeap (Joyee Cheung) #58070
• [087c254a11] - (SEMVER-MAJOR) test: fix test-fs-write for V8 13.6 (Michaël Zasso) #58070
• [9e49bedd8e] - (SEMVER-MAJOR) build: update list of installed cppgc headers (Michaël Zasso) #58070
• [93cca8a43e] - (SEMVER-MAJOR) tools: update V8 gypfiles for 13.6 (Michaël Zasso) #58070
• [347daa07be] - (SEMVER-MAJOR) tools: update V8 gypfiles for 13.5 (Michaël Zasso) #58070
• [2a35d5a86c] - (SEMVER-MAJOR) build: fix V8 TLS config for shared lib builds (Michaël Zasso) #58070
• [b0fb5a09cf] - (SEMVER-MAJOR) build: pass -fPIC to linker as well for shared builds (Michaël Zasso) #58070
• [dd4c5d6c73] - (SEMVER-MAJOR) src,test: add V8 API to test the hash seed (Michaël Zasso) #58070
• [1d5d7b6eed] - (SEMVER-MAJOR) src: use v8::ExternalMemoryAccounter (Michaël Zasso) #58070
• [3779e43cce] - (SEMVER-MAJOR) tools: update license-builder and LICENSE for V8 deps (Michaël Zasso) #58070
• [82c2255206] - (SEMVER-MAJOR) deps: remove deps/simdutf (Michaël Zasso) #58070
• [8a258eb7b1] - (SEMVER-MAJOR) test: handle explicit resource management globals (Michaël Zasso) #58070
• [9e0d9b6024] - (SEMVER-MAJOR) test: adapt assert tests to stack trace changes (Michaël Zasso) #58070
• [f7406aa56d] - (SEMVER-MAJOR) test: update test-linux-perf-logger (Michaël Zasso) #58070
• [c7493fac5e] - (SEMVER-MAJOR) Revert "test: disable fast API call count checks" (Michaël Zasso) #58070
• [50a8527867] - (SEMVER-MAJOR) src: replace uses of FastApiTypedArray (Michaël Zasso) #58070
• [9c1ebb713c] - (SEMVER-MAJOR) build: add /bigobj to compile V8 on Windows (Michaël Zasso) #58070
• [fb3d5ea45d] - (SEMVER-MAJOR) tools: update V8 gypfiles for 13.4 (Michaël Zasso) #58070
• [756abacf73] - (SEMVER-MAJOR) build,src,tools: adapt build config for V8 13.3 (Michaël Zasso) #58070
• [f8953e54b0] - (SEMVER-MAJOR) tools: update V8 gypfiles for 13.2 (Michaël Zasso) #58070
• [c8a0e205e1] - (SEMVER-MAJOR) tools: update V8 gypfiles for 13.1 (Michaël Zasso) #58070
• [1689ee84ce] - (SEMVER-MAJOR) build: enable shared RO heap with ptr compression (Michaël Zasso) #58070
• [[15f2fb9467](https://github.com/nodejs/node/comm...

2025-04-23, Version 22.15.0 'Jod' (LTS), @UlisesGascon prepared by @RafaelGSS

Notable Changes

• [3c88f3938b] - (SEMVER-MINOR) assert: implement partial error comparison (Ruben Bridgewater) #57370
• [db19a3f9fc] - (SEMVER-MINOR) assert: improve partialDeepStrictEqual (Ruben Bridgewater) #57370
• [1ee5f840b4] - (SEMVER-MINOR) cli: allow --cpu-prof* in NODE_OPTIONS (Carlos Espa) #57018
• [872ee0f2ac] - crypto: update root certificates to NSS 3.108 (Node.js GitHub Bot) #57381
• [03a0f3a56b] - (SEMVER-MINOR) crypto: support --use-system-ca on Windows (Joyee Cheung) #56833
• [94647bbdb2] - (SEMVER-MINOR) crypto: added support for reading certificates from macOS system store (Tim Jacomb) #56599
• [8f7b86a6e7] - deps: update timezone to 2025a (Node.js GitHub Bot) #56876
• [f9f611fb58] - (SEMVER-MINOR) deps,tools: add zstd 1.5.6 (Jan Martin) #52100
• [07a6d5f8cf] - (SEMVER-MINOR) dns: add TLSA record query and parsing (Rithvik Vibhu) #52983
• [d8a83ef2f3] - doc: add @geeksilva97 to collaborators (Edy Silva) #57241
• [6b93ba723b] - (SEMVER-MINOR) module: use synchronous hooks for preparsing in import(cjs) (Joyee Cheung) #55698
• [b2e44a8079] - (SEMVER-MINOR) module: implement module.registerHooks() (Joyee Cheung) #55698
• [dc91ae7471] - (SEMVER-MINOR) process: add execve (Paolo Insogna) #56496
• [bc672fcfdd] - (SEMVER-MINOR) sqlite: allow returning ArrayBufferViews from user-defined functions (René) #56790
• [5edee197ab] - (SEMVER-MINOR) tls: implement tls.getCACertificates() (Joyee Cheung) #57107
• [f9fe0e09ee] - (SEMVER-MINOR) util: expose diff function used by the assertion errors (Giovanni Bucci) #57462
• [673a424180] - (SEMVER-MINOR) v8: add v8.getCppHeapStatistics() method (Aditi) #57146
• [4991e5d826] - (SEMVER-MINOR) zlib: add zstd support (Jan Martin) #52100

Commits

• [ea70a379c3] - assert: improve partialDeepStrictEqual performance (Ruben Bridgewater) #57509
• [2b419d7e79] - (SEMVER-MINOR) assert: implement partial error comparison (Ruben Bridgewater) #57370
• [d817c17fd7] - (SEMVER-MINOR) assert: improve partialDeepStrictEqual (Ruben Bridgewater) #57370
• [7af0440073] - assert: improve myers diff performance (Giovanni Bucci) #57279
• [01cf5fb871] - (SEMVER-MINOR) assert,util: improve performance (Ruben Bridgewater) #57370
• [a58842cee4] - (SEMVER-MINOR) benchmark: adjust assert runtimes (Ruben Bridgewater) #57370
• [b20b3697aa] - (SEMVER-MINOR) benchmark: skip running some assert benchmarks by default (Ruben Bridgewater) #57370
• [ec5570fd1e] - (SEMVER-MINOR) benchmark: add assert partialDeepStrictEqual benchmark (Ruben Bridgewater) #57370
• [b991bf4ca6] - benchmark: add a warmup on bench-openSync (Elves Vieira) #57051
• [4a455bc806] - build: fix update-wpt workflow (Jonas) #57468
• [6ec397e61c] - build: fix compatibility with V8's depot_tools (Richard Lau) #57330
• [475aaca336] - build: print 'Formatting Markdown...' for long task markdown formatting (1ilsang) #57108
• [73fced7a97] - build: fix GN build failure (Cheng) #57013
• [af05f91425] - build: fix GN build of uv (Cheng) #56955
• [fd3053e947] - build: gyp exclude libm linking on macOS (deepak1556) #56901
• [5ec6b9a50f] - build: remove explicit linker call to libm on macOS (deepak1556) #56901
• [a893da9be7] - build: link with Security.framework in GN build (Cheng) #56895
• [02cd8e0a50] - build: do not put commands in sources variables (Cheng) #56885
• [73dc8c2140] - build: add double quotes around <(python) (Luigi Pinca) #56826
• [65a3b5f73c] - build: add build option suppress_all_error_on_warn (Michael Dawson) #56647
• [424aacc942] - build,win: disable node pch with ccache (Stefan Stojanovic) #57224
• [901685c723] - build,win: enable ccache (Stefan Stojanovic) #56847
• [79987676c1] - cli: clarify --cpu-prof-name allowed values (Eugenio Ceschia) #57433
• [503d4237aa] - (SEMVER-MINOR) cli: allow --cpu-prof* in NODE_OPTIONS (Carlos Espa) #57018
• [ada572b733] - crypto: ensure expected JWK alg in SubtleCrypto.importKey RSA imports (Filip Skokan) #57450
• [7e5aabde55] - crypto: update root certificates to NSS 3.108 (Node.js GitHub Bot) #57381
• [7ea6ac1e09] - crypto: add support for intermediate certs in --use-system-ca (Tim Jacomb) #57164
• [44b19ec534] - crypto: support --use-system-ca on non-Windows and non-macOS (Joyee Cheung) #57009
• [e21d126438] - crypto: fix missing OPENSSL_NO_ENGINE guard (Shelley Vohr) #57012
• [2fdf82b357] - crypto: cleanup root certificates and skip PEM deserialization (Joyee Cheung) #56999
• [03a0f3a56b] - (SEMVER-MINOR) crypto: support --use-system-ca on Windows (Joyee Cheung) #56833
• [bbdb10bc2c] - crypto: fix X509* leak in --use-system-ca (Joyee Cheung) #56832
• [5470cab6d3] ...

2025-04-22, Version 20.19.1 'Iron' (LTS), @UlisesGascon prepared by @RafaelGSS

Notable Changes

• [d5e73ce0f8] - deps: update undici to 6.21.2 (Matteo Collina) #57442
• [e4a6323ab2] - deps: update c-ares to v1.34.5 (Node.js GitHub Bot) #57792

Commits

• [d5e73ce0f8] - deps: update undici to 6.21.2 (Matteo Collina) #57442
• [e4a6323ab2] - deps: update c-ares to v1.34.5 (Node.js GitHub Bot) #57792
• [b2b9eb36af] - dns: restore dns query cache ttl (Ethan Arrowood) #57640
• [07a99a5c0b] - doc: correct status of require(esm) warning in v20 changelog (Joyee Cheung) #57529
• [d45517ccbf] - meta: bump Mozilla-Actions/sccache-action from 0.0.8 to 0.0.9 (dependabot[bot]) #57720
• [fa93bb2633] - test: update parallel/test-tls-dhe for OpenSSL 3.5 (Richard Lau) #57477
• [29c032403c] - tools: update sccache to support GH cache changes (Michaël Zasso) #57573

2025-04-01, Version 23.11.0 (Current), @aduh95

Notable Changes

• [64b086740a] - (SEMVER-MINOR) assert: implement partial error comparison (Ruben Bridgewater) #57370
• [053cef70e0] - (SEMVER-MINOR) crypto: add optional callback to crypto.diffieHellman (Filip Skokan) #57274
• [f8aff90235] - (SEMVER-MINOR) process: add execve (Paolo Insogna) #56496
• [4b04c92d7d] - (SEMVER-MINOR) sqlite: add StatementSync.prototype.columns() (Colin Ihrig) #57490
• [1b8d1d3a3a] - (SEMVER-MINOR) util: expose diff function used by the assertion errors (Giovanni Bucci) #57462

Commits

• [7b72396c8b] - assert: improve partialDeepStrictEqual performance (Ruben Bridgewater) #57509
• [64b086740a] - (SEMVER-MINOR) assert: implement partial error comparison (Ruben Bridgewater) #57370
• [f694d7de0e] - (SEMVER-MINOR) assert: improve partialDeepStrictEqual (Ruben Bridgewater) #57370
• [80d9d5653f] - (SEMVER-MINOR) assert,util: improve performance (Ruben Bridgewater) #57370
• [d52a71f832] - (SEMVER-MINOR) benchmark: adjust assert runtimes (Ruben Bridgewater) #57370
• [7592cf4cd7] - (SEMVER-MINOR) benchmark: skip running some assert benchmarks by default (Ruben Bridgewater) #57370
• [e4cc54a746] - (SEMVER-MINOR) benchmark: add assert partialDeepStrictEqual benchmark (Ruben Bridgewater) #57370
• [de48407011] - build: fix update-wpt workflow (Jonas) #57468
• [52cd0954f9] - cli: clarify --cpu-prof-name allowed values (Eugenio Ceschia) #57433
• [7611fc14de] - crypto: fix output of privateDecrypt with zero-length data (Filip Skokan) #57575
• [cc42ee8fc7] - crypto: ensure expected JWK alg in SubtleCrypto.importKey RSA imports (Filip Skokan) #57450
• [053cef70e0] - (SEMVER-MINOR) crypto: add optional callback to crypto.diffieHellman (Filip Skokan) #57274
• [1f08864fd7] - debugger: fix behavior of plain object exec in debugger repl (Dario Piotrowicz) #57498
• [162b2828eb] - deps: update undici to 6.21.2 (Matteo Collina) #57442
• [43bea6bb80] - deps: V8: cherry-pick c172ffc5bf54 (Choongwoo Han) #57437
• [99f93afb9d] - deps: update ada to v3.2.1 (Yagiz Nizipli) #57429
• [30e5658f12] - deps: update googletest to 0bdccf4 (Node.js GitHub Bot) #57380
• [573467c070] - deps: update acorn to 8.14.1 (Node.js GitHub Bot) #57382
• [affeaac0c7] - doc: add gurgunday as triager (Gürgün Dayıoğlu) #57594
• [4ed1a098f5] - doc: clarify behaviour of node-api adjust function (Michael Dawson) #57463
• [921041b284] - doc: remove Corepack documentation (Antoine du Hamel) #57635
• [99dbd8b391] - doc: remove mention of --require not supporting ES modules (Huáng Jùnliàng) #57620
• [8c76b2949e] - doc: mention reports should align with Node.js CoC (Rafael Gonzaga) #57607
• [ee1c78a7a3] - doc: add section stating that very stale PRs should be closed (Dario Piotrowicz) #57541
• [595e9e5ad6] - doc: add bjohansebas as triager (Sebastian Beltran) #57564
• [3742d2a198] - doc: update support channels (Claudio W.) #57538
• [717c44dead] - doc: make stability labels more consistent (Antoine du Hamel) #57516
• [b4576a6f57] - doc: remove cryptoStream API reference (Jonas) #57579
• [2c4f894036] - doc: module resolution pseudocode corrections (Marcel Laverdet) #57080
• [c45894f90c] - doc: add history entry for DEP0190 in child_process.md (Antoine du Hamel) #57544
• [c21068b696] - doc: remove deprecated pattern in child_process.md (Antoine du Hamel) #57568
• [87e0dda352] - doc: mark multiple experimental APIS as stable (James M Snell) #57510
• [d637763e4e] - doc: remove mertcanaltin from Triagers (Mert Can Altin) #57531
• [ee6025495d] - doc: recommend watching the collaborators repo in the onboarding doc (Darshan Sen) #57527
• [706b64638b] - doc: remove mention of visa fees from onboarding doc (Darshan Sen) #57526
• [176d951bd0] - doc: deprecate passing args to spawn and execFile (Antoine du Hamel) #57389
• [5c05ba119b] - doc: remove some inconsistencies in deprecations.md (Antoine du Hamel) #57512
• [9d5be4bb8c] - doc: run license-builder (github-actions[bot]) #57511
• [273607edb4] - doc: add new writing-docs contributing md (Dario Piotrowicz) #57502
• [e28c723f24] - doc: add node.js streams references to Web Streams doc (Dario Piotrowicz) #57393
• [47296492ba] - doc: replace NOTEs that do not render properly (Colin Ihrig) #57484
• [db9c37f792] - doc: prefer to sign commits under nodejs repository (Rafael Gonzaga) #57311
• [e5e3987ae7] - doc: fixed the incorrect splitting of multiple words (letianpailove) #57454
• [91a824e43b] - doc: add review guidelines for collaborator nominations (Antoine du Hamel) #57449
• [2a5fcb2172] - doc: fix typo in url.md (Allon Murienik) #57467
• [17ccf9282f] - doc: add history info for --use-system-ca (Darshan Sen) #57432
• ...

2025-03-27, Version 18.20.8 'Hydrogen' (LTS), @richardlau

Notable Changes

This release updates OpenSSL to 3.0.16 and root certificates to NSS 3.108.

Commits

• [f737a79073] - async_hooks,inspector: implement inspector api without async_wrap (Gabriel Bota) #51501
• [fce923ba69] - build: update gcovr to 7.2 and codecov config (Benjamin E. Coe) #54019
• [8b7ffd807c] - build: fix compatibility with V8's depot_tools (Richard Lau) #57330
• [ee9a343413] - crypto: update root certificates to NSS 3.108 (Node.js GitHub Bot) #57381
• [738bf8aea4] - crypto: update root certificates to NSS 3.104 (Richard Lau) #55681
• [69d661d591] - deps: update undici to v5.29.0 (Matteo Collina) #57557
• [59fcf43b0e] - deps: update corepack to 0.32.0 (Node.js GitHub Bot) #57265
• [1b72869503] - deps: update archs files for openssl-3.0.16 (Node.js GitHub Bot) #57335
• [a566560235] - deps: upgrade openssl sources to quictls/openssl-3.0.16 (Node.js GitHub Bot) #57335
• [50c4e1da2f] - doc: add missing deprecated badges in fs.md (Yukihiro Hasegawa) #57384
• [c3babb4671] - doc: update Xcode version used for arm64 and pkg (Michaël Zasso) #57104
• [784da606a6] - doc: fix link and history of SourceMap sections (Antoine du Hamel) #57098
• [f5dbceccbe] - test: update error code in tls-psk-circuit for for OpenSSL 3.4 (sebastianas) #56420

2025-03-13, Version 23.10.0 (Current), @aduh95

Notable Changes

Introducing --experimental-config-file

With the introduction of test runner, SEA, and other feature that require a lot
of flags, a JSON config flag would improve by a lot the developer experience and
increase adoption.

You can have a node.config.json containing:

{
  "$schema": "https://nodejs.org/dist/v23.10.0/docs/node-config-schema.json",
  "nodeOptions": {
    "test-coverage-lines": 80,
    "test-coverage-branches": 60
  }
}

You can run your tests without passing the flags defined in the config file.

node --experimental-default-config-file --test --experimental-test-coverage

or

node --experimental-config-file=node.config.json --test --experimental-test-coverage

Node.js will not sanitize or perform validation on the user-provided configuration,
so only ever use trusted configuration files.

Contributed by Marco Ippolito in #57016
and #57171.

Other Notable Changes

• [323e3ac93c] - crypto: update root certificates to NSS 3.108 (Node.js GitHub Bot) #57381
• [6fd2ec6816] - doc: add @geeksilva97 to collaborators (Edy Silva) #57241
• [d8937f1742] - (SEMVER-MINOR) src: create THROW_ERR_OPTIONS_BEFORE_BOOTSTRAPPING (Marco Ippolito) #57016
• [5054fc7941] - (SEMVER-MINOR) test_runner: change ts default glob (Marco Ippolito) #57359
• [75f11ae1cc] - (SEMVER-MINOR) tls: implement tls.getCACertificates() (Joyee Cheung) #57107
• [a22c21ceb8] - (SEMVER-MINOR) v8: add v8.getCppHeapStatistics() method (Aditi) #57146

Commits

• [2daee76b26] - assert: improve myers diff performance (Giovanni Bucci) #57279
• [2fbd3bbea7] - build: fix compatibility with V8's depot_tools (Richard Lau) #57330
• [6a2e4c5fc1] - build,win: disable node pch with ccache (Stefan Stojanovic) #57224
• [323e3ac93c] - crypto: update root certificates to NSS 3.108 (Node.js GitHub Bot) #57381
• [906f23d0e7] - crypto: add support for intermediate certs in --use-system-ca (Tim Jacomb) #57164
• [03cd7920c8] - deps: update simdjson to 3.12.2 (Node.js GitHub Bot) #57084
• [9e1fce9a5c] - deps: update archs files for openssl-3.0.16 (Node.js GitHub Bot) #57335
• [4056c1f83e] - deps: upgrade openssl sources to quictls/openssl-3.0.16 (Node.js GitHub Bot) #57335
• [b402799070] - deps: update corepack to 0.32.0 (Node.js GitHub Bot) #57265
• [ce1cfff79a] - deps: update amaro to 0.4.1 (marco-ippolito) #57121
• [0ac977d679] - deps: update gyp file for ngtcp2 1.11.0 (Richard Lau) #57225
• [f34d78df1f] - deps: update ada to 3.1.3 (Node.js GitHub Bot) #57222
• [4fe9916701] - dns: remove redundant code using common variable (Deokjin Kim) #57386
• [1c271b162b] - doc: make first parameter optional in util.getCallSites (Deokjin Kim) #57387
• [77668fffec] - doc: fix usage of module.registerSync in comment (Timo Kössler) #57328
• [9b4f7aac69] - doc: add Darshan back as voting TSC member (Michael Dawson) #57402
• [d44ccb319c] - doc: revise webcrypto.md types, interfaces, and added versions (Filip Skokan) #57376
• [f4de7cef01] - doc: add info on how project manages social media (Michael Dawson) #57318
• [792ef16921] - doc: revise tsconfig.json note (Steven) #57353
• [4e438c3fa3] - doc: use more clear name in getSystemErrorMessage's example (ikuma-t) #57310
• [5c9f1a40e4] - doc: recommend setting noEmit: true in tsconfig.json (Steven) #57320
• [e178acf9d8] - doc: ping nodejs/tsc for each security pull request (Rafael Gonzaga) #57309
• [fbe464e28c] - doc: fix Windows ccache section position (Stefan Stojanovic) #57326
• [3fe8eac0ba] - doc: update node-api version matrix (Chengzhong Wu) #57287
• [d2f49e7fcf] - doc: recommend erasableSyntaxOnly in ts docs (Rob Palmer) #57271
• [03844d99f8] - doc: clarify path.isAbsolute is not path traversal mitigation (Eric Fortis) #57073
• [0f8cd32986] - doc: fix rendering of DEP0174 description (David Sanders) #56835
• [f95ecca71f] - doc: add 1ilsang to triage team (1ilsang) #57183
• [6fd2ec6816] - doc: add @geeksilva97 to collaborators (Edy Silva) #57241
• [b74e0ff7d7] - doc: add missing assert return types (Colin Ihrig) #57219
• [83eed33562] - doc: add streamResetBurst and streamResetRate (Sujal Raj) #57195
• [7f48811295] - doc: add esm examples to node:util (Alfredo González) #56793
• [5c20dcc166] - esm: fix module.exports export on CJS modules (Guy Bedford) #57366
• [041a217a4d] - fs: fix rmSync error code (Paul Schwabauer) #57103
• [cea50b7f39] - lib: optimize priority queue (Gürgün Dayıoğlu) #57100
• [5204d495ae] - meta: bump codecov/codecov-action from 5.3.1 to 5.4.0 (dependabot[bot]) #57257
• [89599be988] - meta: bump github/codeql-action from 3.28.8 to 3.28.10 (dependabot[bot]) #57254
• [66cd3850bc] - meta: bump ossf/scorecard-action from 2.4.0 to 2.4.1 (dependabot[bot]) #57253
• [6c22e446bc] - meta: set nodejs/config as codeowner (Marco Ippolito) #57237
• [ee5ce5ccde] - meta: move RaisinTen back to collaborators, triagers and SEA champion (Darshan Sen) #57292
• [0b0c9cc0f5] - meta: bump actions/download-artifact from 4.1.8 to 4.1.9 (dependabot[bot]) [#57260](https://github.c...

2025-03-13, Version 20.19.0 'Iron' (LTS), @marco-ippolito

Notable Changes

require(esm) is now enabled by default

Support for loading native ES modules using require() had been available on v20.x under the command line flag --experimental-require-module, and available by default on v22.x and v23.x. In this release, it is now no longer behind a flag on v20.x.

This feature has been tested on v23.x and v22.x, and we are looking for user feedback from v20.x to make more final tweaks before fully stabilizing it.
It now no longer emits a warning unless --trace-require-module is explicitly used.
If there happens to be any regressions caused by this feature, users can report it to the Node.js issue tracker. Meanwhile this feature can also be disabled using --no-experimental-require-module as a workaround.

With this feature enabled, Node.js will no longer throw ERR_REQUIRE_ESM if require() is used to load a ES module. It can, however, throw ERR_REQUIRE_ASYNC_MODULE if the ES module being loaded or its dependencies contain top-level await. When the ES module is loaded successfully by require(), the returned object will either be a ES module namespace object similar to what's returned by import(), or what gets exported as "module.exports" in the ES module.

Users can check process.features.require_module to see whether require(esm) is enabled in the current Node.js instance. For packages, the "module-sync" exports condition can be used as a way to detect require(esm) support in the current Node.js instance and allow both require() and import to load the same native ES module. See the documentation for more details about this feature.

Contributed by Joyee Cheung in #55085

Module syntax detection is now enabled by default

Module syntax detection (the --experimental-detect-module flag) is now
enabled by default. Use --no-experimental-detect-module to disable it if
needed.

Syntax detection attempts to run ambiguous files as CommonJS, and if the module
fails to parse as CommonJS due to ES module syntax, Node.js tries again and runs
the file as an ES module.
Ambiguous files are those with a .js or no extension, where the nearest parent
package.json has no "type" field (either "type": "module" or
"type": "commonjs").
Syntax detection should have no performance impact on CommonJS modules, but it
incurs a slight performance penalty for ES modules; add "type": "module" to
the nearest parent package.json file to eliminate the performance cost.
A use case unlocked by this feature is the ability to use ES module syntax in
extensionless scripts with no nearby package.json.

Thanks to Geoffrey Booth for making this work on #53619.

Other Notable Changes

• [285bb4ee14] - crypto: update root certificates to NSS 3.107 (Node.js GitHub Bot) #56566
• [73b5c16684] - (SEMVER-MINOR) worker: add postMessageToThread (Paolo Insogna) #53682
• [de313b2336] - (SEMVER-MINOR) module: only emit require(esm) warning under --trace-require-module (Joyee Cheung) #56194
• [4fba01911d] - (SEMVER-MINOR) process: add process.features.require_module (Joyee Cheung) #55241
• [df8a045afe] - (SEMVER-MINOR) module: implement the "module-sync" exports condition (Joyee Cheung) #54648
• [f9dc1eaef5] - (SEMVER-MINOR) module: add __esModule to require()'d ESM (Joyee Cheung) #52166

Commits

• [d84be843e3] - benchmark: add validateStream to styleText bench (Rafael Gonzaga) #56556
• [d8eaf5b9b8] - build: fix compatibility with V8's depot_tools (Richard Lau) #57330
• [1ee4bf9690] - build: test macos-13 on GitHub actions (Michaël Zasso) #56307
• [1cc8d69882] - build: build v8 with -fvisibility=hidden on macOS (Joyee Cheung) #56275
• [52f1f7e22b] - child_process: fix parsing messages with splitted length field (Maksim Gorkov) #56106
• [5ef3c3c996] - crypto: add missing return value check (Michael Dawson) #56615
• [285bb4ee14] - crypto: update root certificates to NSS 3.107 (Node.js GitHub Bot) #56566
• [46ceb9dc1c] - deps: update timezone to 2025a (Node.js GitHub Bot) #56876
• [d4ca38fe8e] - deps: macro ENODATA is deprecated in libc++ (Cheng) #56698
• [15214e6508] - deps: update simdutf to 6.0.3 (Node.js GitHub Bot) #56567
• [1e44f5d84b] - deps: update simdutf to 5.7.2 (Node.js GitHub Bot) #56388
• [b92ff7be38] - deps: update googletest to 7d76a23 (Node.js GitHub Bot) #56387
• [e1b71a81a9] - deps: update googletest to e54519b (Node.js GitHub Bot) #56370
• [c0d45e7f38] - deps: update simdutf to 5.7.0 (Node.js GitHub Bot) #56332
• [d69107f5a8] - deps: update icu to 76.1 (Node.js GitHub Bot) #55551
• [5c9a397699] - deps: V8: backport 9ab40592f697 (Lu Yahan) #56781
• [8342233f6d] - deps: update corepack to 0.31.0 (Node.js GitHub Bot) #56795
• [561493d35e] - deps,src: simplify base64 encoding (Daniel Lemire) #52714
• [6207b2936c] - doc: move anatoli to emeritus (Michael Dawson) #56592
• [b0ab483400] - doc: fix styles of the expandable TOC (Antoine du Hamel) #56755
• [53e4dc2a82] - doc: add "Skip to content" button (Antoine du Hamel) #56750
• [33ee4645c3] - doc: improve accessibility of expandable lists (Antoine du Hamel) #56749
• [b514438418] - doc: add note regarding commit message trailers (Dario Piotrowicz) #56736
• [627f2997e3] - doc: fix typo in example code for util.styleText (Robin Mehner) #56720
• [68548dcb48] - doc: fix inconsistencies in WeakSet and WeakMap comparison details (Shreyans Pathak) #56683
• [337cfb2549] - doc: add RafaelGSS as latest sec release stewards (Rafael Gonzaga) #56682
• [e890c86d7b] - doc: clarify cjs/esm diff in queueMicrotask() vs process.nextTick() (Dario Piotrowicz) #56659
• [978263923f] - doc: WeakSet and WeakMap comparison details (Shreyans Pathak) #56648
• [aba280ccd8] - doc: mention prepare --security (Rafael Gonzaga) #56617
• [0a009a527b] - doc: tweak info on reposts in ambassador program (Michael Dawson) #56589
• [d2f09e2ab3] - doc: add type stripping to ambassadors ...

2025-02-26, Version 23.9.0 (Current), @targos

Notable Changes

• [927d985aa0] - (SEMVER-MINOR) dns: add TLSA record query and parsing (Rithvik Vibhu) #52983
• [0236fbf75a] - (SEMVER-MINOR) process: add threadCpuUsage (Paolo Insogna) #56467

Commits

• [f4a82fddb1] - benchmark: add a warmup on bench-openSync (Elves Vieira) #57051
• [b384baa073] - build: print 'Formatting Markdown...' for long task markdown formatting (1ilsang) #57108
• [fec2d50308] - build: add skip_apidoc_files and include QUIC (RafaelGSS) #56941
• [5af35d1850] - build: fix GN build failure (Cheng) #57013
• [35f89aa66f] - build: fix GN build of uv (Cheng) #56955
• [e26d4841d1] - cli: allow --cpu-prof* in NODE_OPTIONS (Carlos Espa) #57018
• [b50fc42a99] - crypto: support --use-system-ca on non-Windows and non-macOS (Joyee Cheung) #57009
• [dfdaa92a37] - crypto: fix missing OPENSSL_NO_ENGINE guard (Shelley Vohr) #57012
• [18ea88bcbe] - crypto: cleanup root certificates and skip PEM deserialization (Joyee Cheung) #56999
• [8076284f9e] - deps: update cjs-module-lexer to 2.1.0 (Node.js GitHub Bot) #57180
• [8644cf3e5a] - deps: update ngtcp2 to 1.11.0 (Node.js GitHub Bot) #57179
• [2aceca15d6] - deps: update sqlite to 3.49.1 (Node.js GitHub Bot) #57178
• [8421021427] - deps: update ada to 3.1.0 (Node.js GitHub Bot) #57083
• [21d795a5f0] - (SEMVER-MINOR) dns: add TLSA record query and parsing (Rithvik Vibhu) #52983
• [455bf5a0a8] - doc: update options to filehandle.appendFile() (Hasegawa-Yukihiro) #56972
• [f35bd869ee] - doc: add additional caveat for fs.watch (Michael Dawson) #57150
• [4413ce7ed3] - doc: fix typo in Windows building instructions (Tim Jacomb) #57158
• [66614cfcf3] - doc: fix web.libera.chat link in pull-requests.md (Samuel Bronson) #57076
• [587112cb08] - doc: remove buffered flag from performance hooks examples (Pavel Romanov) #52607
• [fdc8aeb8a0] - doc: fix 'introduced_in' version in typescript module (1ilsang) #57109
• [b6960499c8] - doc: fix link and history of SourceMap sections (Antoine du Hamel) #57098
• [0de128ca97] - doc: add module namespace object links (Dario Piotrowicz) #57093
• [5a74568320] - doc: disambiguate pseudo-code statement (Dario Piotrowicz) #57092
• [46df14ddcb] - doc: update clang-cl on Windows building guide (Joyee Cheung) #57087
• [4b02fdc72f] - doc: update Xcode version used for arm64 and pkg (Michaël Zasso) #57104
• [78d4e52a52] - doc: fix wrong articles used to address modules (Dario Piotrowicz) #57090
• [ed5671f1bc] - doc: update module.builtinModules sentence (Dario Piotrowicz) #57089
• [9de45cbac9] - doc: modules.md: fix distance definition (Alexander “weej” Jones) #57046
• [a7e5ef9e01] - doc: fix wrong verb form (Dario Piotrowicz) #57091
• [c02494f5fe] - doc: fix transpiler loader hooks documentation (Joyee Cheung) #57037
• [5b2dfadd40] - doc: add a note about require('../common') in testing documentation (Aditi) #56953
• [50ba04e214] - doc: recommend writing tests in new files and including comments (Joyee Cheung) #57028
• [6951133e1a] - doc: improve documentation on argument validation (Aditi) #56954
• [44dd8a5cc2] - doc: buffer: fix typo on Buffer.copyBytesFrom( offset option (tpoisseau) #57015
• [c011271a70] - doc: update cleanup to trust on vuln db automation (Rafael Gonzaga) #57004
• [a6b7bce3a0] - doc: move stability index after history section for consistency (Antoine du Hamel) #56997
• [3bc6d626b4] - doc: add signal to filehandle.writeFile() options (Yukihiro Hasegawa) #56804
• [2990cc8616] - doc: run license-builder (github-actions[bot]) #56985
• [40f3a516bf] - fs: handle UV_ENOTDIR in fs.statSync with throwIfNoEntry provided (Juan José Arboleda) #56996
• [e10ef275e8] - inspector: convert event params to protocol without json (Chengzhong Wu) #57027
• [d6234b4652] - inspector: skip promise hook in the inspector async hook (Joyee Cheung) #57148
• [aa817853cd] - lib: fixup more incorrect ERR_INVALID_ARG_VALUE uses (James M Snell) #57177
• [e08d7d4e53] - lib: fixup incorrect argument order in assertEncoding (James M Snell) #57177
• [f77069b4e0] - meta: bump actions/setup-python from 5.3.0 to 5.4.0 (dependabot[bot]) #56867
• [35cdd9b9fe] - meta: bump peter-evans/create-pull-request from 7.0.5 to 7.0.6 (dependabot[bot]) #56866
• [3d61604f2a] - meta: bump mozilla-actions/sccache-action from 0.0.6 to 0.0.7 (dependabot[bot]) #56865
• [0dd0108fc5] - meta: bump codecov/codecov-action from 5.0.7 to 5.3.1 (dependabot[bot]) #56864
• [58d70369e3] - meta: bump step-security/harden-runner from 2.10.2 to 2.10.4 (dependabot[bot]) #56863
• [dfd42db739] - meta: bump actions/cache from 4.1.2 to 4.2.0 (dependabot[bot]) #56862
• [[7f5f02ba2b](https://github.com/nodejs/node/co...