deps: upgrade npm to 11.19.0 - #64883
Closed
npm-cli-bot wants to merge 1069 commits into
Closed
Conversation
Disable connection pooling for the client request so server.close() does not wait on an idle keep-alive socket before retrying the test. This keeps the test focused on request timeout behavior instead of HTTP keep-alive teardown timing. Signed-off-by: Kamat, Trivikram <16024985+trivikr@users.noreply.github.com> PR-URL: nodejs#64052 Refs: https://github.com/nodejs/reliability/issues?q=%22test-http-server-consumed-timeout%22 Reviewed-By: Luigi Pinca <luigipinca@gmail.com> Reviewed-By: Filip Skokan <panva.ip@gmail.com> Reviewed-By: Gürgün Dayıoğlu <hey@gurgun.day>
Signed-off-by: Rawal27 <obviouslykamal@gmail.com> PR-URL: nodejs#63912 Reviewed-By: Luigi Pinca <luigipinca@gmail.com> Reviewed-By: Trivikram Kamat <trivikr.dev@gmail.com>
The basic.any.js test compares elapsed performance.now() with elapsed Date.now(). On macos15-x64 CI, Date.now() can shift relative to the monotonic clock and exceed the test's 30 ms tolerance. Convert the status file to .cjs so the flaky expectation is scoped to macOS 15 on x64. Signed-off-by: Kamat, Trivikram <16024985+trivikr@users.noreply.github.com> PR-URL: nodejs#64054 Refs: https://github.com/nodejs/reliability/issues?q=%22wpt%2Ftest-hr-time%22 Reviewed-By: Matteo Collina <matteo.collina@gmail.com> Reviewed-By: Filip Skokan <panva.ip@gmail.com> Reviewed-By: Daijiro Wachi <daijiro.wachi@gmail.com> Reviewed-By: Jason Zhang <xzha4350@gmail.com>
Starting with Node.js 26.0.0, official binaries for AIX are built with Clang 20.1. Signed-off-by: Richard Lau <richard.lau@ibm.com> PR-URL: nodejs#64068 Reviewed-By: Chengzhong Wu <legendecas@gmail.com> Reviewed-By: Beth Griggs <bethanyngriggs@gmail.com> Reviewed-By: Luigi Pinca <luigipinca@gmail.com> Reviewed-By: Stewart X Addison <sxa@redhat.com>
Signed-off-by: parkhojeong <parkhj062@gmail.com> PR-URL: nodejs#63403 Reviewed-By: Luigi Pinca <luigipinca@gmail.com> Reviewed-By: Deokjin Kim <deokjin81.kim@gmail.com>
Signed-off-by: parkhojeong <parkhj062@gmail.com> PR-URL: nodejs#63403 Reviewed-By: Luigi Pinca <luigipinca@gmail.com> Reviewed-By: Deokjin Kim <deokjin81.kim@gmail.com>
Add a samplePerIteration option to monitorEventLoopDelay that records event loop delay from libuv event loop iterations instead of the timer interval sampler. The default remains interval-based; existing uses of monitorEventLoopDelay() keep behaving the same unless the samplePerIteration option is passed through. Signed-off-by: Pablo Erhard <pablo.erhardhernandez@datadoghq.com> PR-URL: nodejs#62935 Reviewed-By: Bryan English <bryan@bryanenglish.com> Reviewed-By: Ruben Bridgewater <ruben@bridgewater.de> Reviewed-By: James M Snell <jasnell@gmail.com>
The close fixture expects the registered object to still be reachable when the process emits exit. Keep a strong reference outside setup() so the assertion does not depend on platform-specific GC timing. Signed-off-by: Kamat, Trivikram <16024985+trivikr@users.noreply.github.com> Assisted-by: openai:gpt-5.5 PR-URL: nodejs#64085 Refs: https://github.com/nodejs/reliability/issues?q=%22test-process-finalization%22 Reviewed-By: Luigi Pinca <luigipinca@gmail.com> Reviewed-By: Gürgün Dayıoğlu <hey@gurgun.day> Reviewed-By: Stefan Stojanovic <stefan.stojanovic@janeasystems.com>
V8’s JIT infrastructure requires binaries such as mksnapshot to be run during the build. However, these binaries must have the same bit-width as the host platform (e.g. a x86_64 build platform targeting ARMv6 needs to produce a 32-bit binary). To work around this issue, allow building the binaries for the host platform and running them on the build platform with an emulator. Based on Buildroot’s nodejs-src 0001-add-qemu-wrapper-support.patch. https://gitlab.com/buildroot.org/buildroot/-/blob/c1d5eada4d4db9eeaa1c44dd1dea95a67c8a70ca/package/nodejs/nodejs-src/0001-add-qemu-wrapper-support.patch PR-URL: nodejs#53899 Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com> Reviewed-By: Aviv Keller <me@aviv.sh>
Unfortunately, `std::optional<>` implements `operator<` in such a way that this check will fail for very large generators. Since `bn_g` is unsigned, if its value does not fit into a single word, we can be certain that it is at least 2. By only checking the value if it does indeed fit into a word, the check correctly ignores very large generators. Signed-off-by: Tobias Nießen <tniessen@tnie.de> PR-URL: nodejs#64092 Reviewed-By: Filip Skokan <panva.ip@gmail.com> Reviewed-By: Anna Henningsen <anna@addaleax.net>
If the exponent does not fit into a single word, previous versions of Node.js would report an incorrect value or, recently, return `null`. Change `GetExponentString()` to handle arbitrarily large RSA public exponents properly. Signed-off-by: Tobias Nießen <tniessen@tnie.de> PR-URL: nodejs#64093 Refs: nodejs#63895 Reviewed-By: Filip Skokan <panva.ip@gmail.com> Reviewed-By: Anna Henningsen <anna@addaleax.net>
Signed-off-by: Tobias Nießen <tniessen@tnie.de> PR-URL: nodejs#64094 Reviewed-By: Juan José Arboleda <soyjuanarbol@gmail.com> Reviewed-By: Filip Skokan <panva.ip@gmail.com> Reviewed-By: Luigi Pinca <luigipinca@gmail.com> Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com> Reviewed-By: Anna Henningsen <anna@addaleax.net> Reviewed-By: Colin Ihrig <cjihrig@gmail.com> Reviewed-By: Edy Silva <edigleyssonsilva@gmail.com>
Signed-off-by: Antoine du Hamel <duhamelantoine1995@gmail.com> PR-URL: nodejs#64046 Reviewed-By: Paolo Insogna <paolo@cowtech.it> Reviewed-By: René <contact.9a5d6388@renegade334.me.uk>
Signed-off-by: Antoine du Hamel <duhamelantoine1995@gmail.com> PR-URL: nodejs#64059 Reviewed-By: Jithil P Ponnan <jithil@outlook.com> Reviewed-By: Filip Skokan <panva.ip@gmail.com>
Original commit message:
[api] Deprecate kPromiseRejectAfterResolved and kPromiseResolveAfterResolved
These events will be removed soon.
Bug: 42213031
Change-Id: Ie70474ff33c40c7d9cb0c2d0fbe6b75da3c53a22
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7774767
Commit-Queue: Kevin Gibbons <bakkot@gmail.com>
Reviewed-by: Olivier Flückiger <olivf@chromium.org>
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/main@{#107395}
Refs: v8/v8@1a391f9
PR-URL: nodejs#64101
Reviewed-By: Michaël Zasso <targos@protonmail.com>
Reviewed-By: Richard Lau <richard.lau@ibm.com>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Marco Ippolito <marcoippolito54@gmail.com>
Original commit message:
[api] Remove PromiseResolveAfterResolved and PromiseRejectAfterResolved
These were previously deprecated in https://crrev.com/c/7774767
Bug: 42213031
Change-Id: I07b802b743bf052611f30a61c1132231df22f0bd
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7897881
Commit-Queue: Olivier Flückiger <olivf@chromium.org>
Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Reviewed-by: Olivier Flückiger <olivf@chromium.org>
Cr-Commit-Position: refs/heads/main@{#108040}
Refs: v8/v8@0cc9eb2
PR-URL: nodejs#64101
Reviewed-By: Michaël Zasso <targos@protonmail.com>
Reviewed-By: Richard Lau <richard.lau@ibm.com>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Marco Ippolito <marcoippolito54@gmail.com>
Original commit message:
[builtins] Make Promise resolvers not keep resolved Promises alive
Currently a Promise's resolve/reject functions unconditionally hold the
Promise, plus a separate bit to track whether the Promise has been
resolved. Instead, hold a single field with Promise|Undefined.
This allows GC'ing a resolved Promise even if its resolvers are still
alive.
R=olivf@chromium.org
Fixed: 42213031
Change-Id: Ice645dbabb79e63dfcac8ae843cad95439d7a1f1
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7646250
Reviewed-by: Darius Mercadier <dmercadier@chromium.org>
Commit-Queue: Kevin Gibbons <bakkot@gmail.com>
Reviewed-by: Olivier Flückiger <olivf@chromium.org>
Cr-Commit-Position: refs/heads/main@{#108183}
Refs: v8/v8@da20a19
Co-authored-by: Kevin Gibbons <bakkot@gmail.com>
PR-URL: nodejs#64101
Reviewed-By: Michaël Zasso <targos@protonmail.com>
Reviewed-By: Richard Lau <richard.lau@ibm.com>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Marco Ippolito <marcoippolito54@gmail.com>
This makes tracePromise return the original thenable to allow custom thenable types to retain their methods rather than producing the chained result type. Signed-off-by: Stephen Belanger <admin@stephenbelanger.com> PR-URL: nodejs#62407 Reviewed-By: René <contact.9a5d6388@renegade334.me.uk> Reviewed-By: James M Snell <jasnell@gmail.com> Reviewed-By: Gerhard Stöbich <deb2001-github@yahoo.de>
Signed-off-by: Antoine du Hamel <duhamelantoine1995@gmail.com> PR-URL: nodejs#63931 Reviewed-By: Richard Lau <richard.lau@ibm.com> Reviewed-By: Michaël Zasso <targos@protonmail.com> Reviewed-By: Matteo Collina <matteo.collina@gmail.com> Reviewed-By: Daijiro Wachi <daijiro.wachi@gmail.com> Reviewed-By: Colin Ihrig <cjihrig@gmail.com> Reviewed-By: René <contact.9a5d6388@renegade334.me.uk> Reviewed-By: Rafael Gonzaga <rafael.nunu@hotmail.com> Reviewed-By: Stewart X Addison <sxa@redhat.com>
Original commit message:
Fixes nodejs#1056
The commit
c-ares/c-ares@1d1b3d4
refactored the function to use wide strings, but didn't touch this
check. Because an empty wide string would now be size 2 and not 1, the
empty string would go on and cause the DNS domain list to be replaced
with nothing.
Signed-off-by: @dankmeme01
Refs: c-ares/c-ares@8ba37af
PR-URL: nodejs#64110
Fixes: nodejs#62347
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Tim Perry <pimterry@gmail.com>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Signed-off-by: Efe Karasakal <hi@efe.dev> PR-URL: nodejs#62300 Reviewed-By: Aviv Keller <me@aviv.sh> Reviewed-By: Ilyas Shabi <ilyasshabi94@gmail.com> Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
Add missing `--experimental-import-text` option to `doc/node.1`. Signed-off-by: Richard Lau <richard.lau@ibm.com> PR-URL: nodejs#64156 Refs: nodejs#62300 Reviewed-By: Colin Ihrig <cjihrig@gmail.com> Reviewed-By: Chengzhong Wu <legendecas@gmail.com> Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com> Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Currently they all run `npx envinfo` without pinning the version. This can be a supply-chain risk. Signed-off-by: Joyee Cheung <joyeec9h3@gmail.com> PR-URL: nodejs#64117 Reviewed-By: Rafael Gonzaga <rafael.nunu@hotmail.com> Reviewed-By: Michaël Zasso <targos@protonmail.com> Reviewed-By: Luigi Pinca <luigipinca@gmail.com> Reviewed-By: Marco Ippolito <marcoippolito54@gmail.com> Reviewed-By: Filip Skokan <panva.ip@gmail.com> Reviewed-By: Matteo Collina <matteo.collina@gmail.com> Reviewed-By: Gürgün Dayıoğlu <hey@gurgun.day>
Read RealFileHandle contents through the open file descriptor instead of reopening the original real path. This keeps already-open VFS file descriptors usable after the backing file is renamed. Use positioned reads so readFileSync() and readFile() preserve the handle's current offset. Signed-off-by: Kamat, Trivikram <16024985+trivikr@users.noreply.github.com> Assisted-by: openai:gpt-5.5 PR-URL: nodejs#64104 Fixes: nodejs#64103 Reviewed-By: Matteo Collina <matteo.collina@gmail.com> Reviewed-By: James M Snell <jasnell@gmail.com>
Signed-off-by: Filip Skokan <panva.ip@gmail.com> PR-URL: nodejs#64122 Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com> Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com>
Pass the existing rejectGarbageAfterEnd option through to the native zlib context and skip gunzip's concatenated-member loop when it is set. This lets DecompressionStream reject a second gzip member as trailing input while preserving default zlib gunzip behavior. Also make the sync zlib path honor rejectGarbageAfterEnd when native decompression leaves unused input, covering Brotli as well. Fixes: nodejs#58247 Signed-off-by: Filip Skokan <panva.ip@gmail.com> PR-URL: nodejs#64023 Fixes: nodejs#58247 Reviewed-By: Anna Henningsen <anna@addaleax.net>
Document rejectGarbageAfterEnd as a public decompression option and validate it as a boolean. Add coverage for stream, async convenience, and sync convenience APIs across zlib, gzip, Brotli, and Zstd-backed decompression. Signed-off-by: Filip Skokan <panva.ip@gmail.com> PR-URL: nodejs#64023 Fixes: nodejs#58247 Reviewed-By: Anna Henningsen <anna@addaleax.net>
Signed-off-by: Antoine du Hamel <duhamelantoine1995@gmail.com> PR-URL: nodejs#64130 Reviewed-By: Jacob Smith <jacob@frende.me> Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Signed-off-by: Aviv Keller <me@aviv.sh> PR-URL: nodejs#64075 Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com> Reviewed-By: Gürgün Dayıoğlu <hey@gurgun.day>
Signed-off-by: Matteo Collina <hello@matteocollina.com> PR-URL: nodejs#64143 Reviewed-By: René <contact.9a5d6388@renegade334.me.uk> Reviewed-By: James M Snell <jasnell@gmail.com> Reviewed-By: Tobias Nießen <tniessen@tnie.de> Reviewed-By: Luigi Pinca <luigipinca@gmail.com> Reviewed-By: Rafael Gonzaga <rafael.nunu@hotmail.com>
ljharb
previously approved these changes
Jul 31, 2026
avivkeller
previously approved these changes
Jul 31, 2026
github-actions
Bot
removed
the
request-ci
Collaborator
Collaborator
lpinca
previously approved these changes
Aug 1, 2026
Collaborator
MikeMcC399
previously approved these changes
Aug 1, 2026
trivikr
previously approved these changes
Aug 2, 2026
aduh95
force-pushed
the
v26.x-staging
branch
2 times, most recently
from
August 4, 2026 16:41
6396dbb to
c03c909
Compare
aduh95
dismissed stale reviews from trivikr, MikeMcC399, lpinca, avivkeller, and ljharb
August 4, 2026 19:21
The base branch was changed.
aduh95
pushed a commit
that referenced
this pull request
Aug 4, 2026
PR-URL: #64883 Reviewed-By: Jordan Harband <ljharb@gmail.com> Reviewed-By: Aviv Keller <me@aviv.sh> Reviewed-By: Luigi Pinca <luigipinca@gmail.com> Reviewed-By: Mike McCready <66998419+MikeMcC399@users.noreply.github.com> Reviewed-By: Trivikram Kamat <trivikr.dev@gmail.com>
Contributor
|
Landed in c8fa0b1 |
aduh95
pushed a commit
that referenced
this pull request
Aug 4, 2026
PR-URL: #64883 Reviewed-By: Jordan Harband <ljharb@gmail.com> Reviewed-By: Aviv Keller <me@aviv.sh> Reviewed-By: Luigi Pinca <luigipinca@gmail.com> Reviewed-By: Mike McCready <66998419+MikeMcC399@users.noreply.github.com> Reviewed-By: Trivikram Kamat <trivikr.dev@gmail.com>
aduh95
added
author ready
Renegade334
added
the
dont-land-on-v22.x
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
20 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
11.19.0 (2026-07-28)
Features
7d39aa6#9698 install-scripts: use install-scripts as the warning log title (@manzoorwanijk)Bug Fixes
3529ca2#9811 pack: honor min-release-age-exclude (#9811) (@github-actions[bot], @martinrrm, @Copilot)67f12ae#9810 owner: use scoped registry for user lookup (#9810) (@github-actions[bot], @martinrrm, @Copilot)Dependencies
@npmcli/arborist@9.9.1libnpmdiff@8.1.12libnpmexec@10.3.2libnpmfund@7.0.26libnpmpack@9.1.12