Skip to content

Conversation

renovate[bot]
Copy link
Contributor

@renovate renovate bot commented May 7, 2025

This PR contains the following updates:

Package Change Age Confidence
node (source) ^23.0.0 -> ^24.0.0 age confidence

Release Notes

nodejs/node (node)

v24.8.0: 2025-09-10, Version 24.8.0 (Current), @​targos

Compare Source

Notable Changes
HTTP/2 Network Inspection Support in Node.js

Node.js now supports inspection of HTTP/2 network calls in Chrome DevTools for Node.js.

Usage

Write a test.js script that makes HTTP/2 requests.

const http2 = require('node:http2');

const client = http2.connect('https://nghttp2.org');

const req = client.request([
  ':path', '/',
  ':method', 'GET',
]);

Run it with these options:

node --inspect-wait --experimental-network-inspection test.js

Open about:inspect on Google Chrome and click on Open dedicated DevTools for Node.
The Network tab will let you track your HTTP/2 calls.

Contributed by Darshan Sen in #​59611.

Other Notable Changes
  • [7a8e2c251d] - (SEMVER-MINOR) crypto: support Ed448 and ML-DSA context parameter in node:crypto (Filip Skokan) #​59570
  • [4b631be0b0] - (SEMVER-MINOR) crypto: support Ed448 and ML-DSA context parameter in Web Cryptography (Filip Skokan) #​59570
  • [3e4b1e732c] - (SEMVER-MINOR) crypto: add KMAC Web Cryptography algorithms (Filip Skokan) #​59647
  • [b1d28785b2] - (SEMVER-MINOR) crypto: add Argon2 Web Cryptography algorithms (Filip Skokan) #​59544
  • [430691d1af] - (SEMVER-MINOR) crypto: support SLH-DSA KeyObject, sign, and verify (Filip Skokan) #​59537
  • [d6d05ba397] - (SEMVER-MINOR) worker: add cpu profile APIs for worker (theanarkh) #​59428
Commits

v24.7.0: 2025-08-27, Version 24.7.0 (Current), @​targos

Compare Source

Notable Changes
Post-Quantum Cryptography in node:crypto

OpenSSL 3.5 on 24.x kicked off post-quantum cryptography efforts in Node.js by
allowing use of NIST's post-quantum cryptography standards for future-proofing
applications against quantum computing threats. The following post-quantum
algorithms are now available in node:crypto:

  • ML-KEM (FIPS 203, Module-Lattice-Based Key-Encapsulation Mechanism Standard) through new crypto.encapsulate() and crypto.decapsulate() methods.
  • ML-DSA (FIPS 204, Module-Lattice-Based Digital Signature Standard) in the existing crypto.sign() and crypto.verify() methods.

Contributed by Filip Skokan in #​59259 and #​59491.

Modern Algorithms in Web Cryptography API

The second substantial extension to the Web Cryptography API
(globalThis.crypto.subtle) was recently accepted for incubation by WICG.
The following algorithms and methods from this extension are now available in
the Node.js Web Cryptography API implementation:

  • AES-OCB
  • ChaCha20-Poly1305
  • ML-DSA
  • ML-KEM
  • SHA-3
  • SHAKE
  • subtle.getPublicKey()
  • SubtleCrypto.supports()
  • ... with more coming in future releases.

Contributed by Filip Skokan in #​59365, #​59569, #​59461, and #​59539.

Node.js execution argument support in single executable applications

The single executable application configuration now supports additional fields
to specify Node.js execution arguments and control how they can be extended when
the application is run.

  • execArgv takes an array of strings for the execution arguments to be used.
  • execArgvExtension takes one of the following values:
    • "none": No additional execution arguments are allowed.
    • "cli": Additional execution arguments can be provided via a special command-line flag --node-options="--flag1 --flag2=value" at run time.
    • "env" (default): Additional execution arguments can be provided via the NODE_OPTIONS environment variable at run time.

For example, with the following configuration:

{
  "main": "/path/to/bundled/script.js",
  "output": "/path/to/write/the/generated/blob.blob",
  "execArgv": ["--no-warnings"],
  "execArgvExtension": "cli",
}

If the generated single executable application is named sea, then running:

sea --node-options="--max-old-space-size=4096" user-arg1 user-arg2

Would be equivalent to running:

node --no-warnings --max-old-space-size=4096 /path/to/bundled/script.js user-arg1 user-arg2

Contributed by Joyee Cheung in #​59314 and #​59560.

Root certificates updated to NSS 3.114

Certificates added:

  • TrustAsia TLS ECC Root CA
  • TrustAsia TLS RSA Root CA
  • SwissSign RSA TLS Root CA 2022 - 1

Certificates removed:

  • GlobalSign Root CA
  • Entrust.net Premium 2048 Secure Server CA
  • Baltimore CyberTrust Root
  • Comodo AAA Services root
  • XRamp Global CA Root
  • Go Daddy Class 2 CA
  • Starfield Class 2 CA
Other Notable Changes
  • [d3afc63c44] - (SEMVER-MINOR) crypto: add argon2() and argon2Sync() methods (Ranieri Althoff) #​50353
  • [6ae202fcdf] - (SEMVER-MINOR) http: add Agent.agentKeepAliveTimeoutBuffer option (Haram Jeong) #​59315
  • [dafee05358] - (SEMVER-MINOR) http2: add support for raw header arrays in h2Stream.respond() (Tim Perry) #​59455
  • [8dc6f5b696] - (SEMVER-MINOR) stream: add brotli support to CompressionStream and DecompressionStream (Matthew Aitken) #​59464
Commits

v24.6.0: 2025-08-14, Version 24.6.0 (Current), @​RafaelGSS

Compare Source

Notable Changes
  • [471fe712b3] - (SEMVER-MINOR) cli: add NODE_USE_SYSTEM_CA=1 (Joyee Cheung) #​59276
  • [38aedfbf73] - (SEMVER-MINOR) crypto: support ML-DSA KeyObject, sign, and verify (Filip Skokan) #​59259
  • [201304537e] - (SEMVER-MINOR) zlib: add dictionary support to zstdCompress and zstdDecompress (lluisemper) #​59240
  • [e79c93a5d0] - (SEMVER-MINOR) http: add server.keepAliveTimeoutBuffer option (Haram Jeong) #​59243
  • [c144d69efc] - lib: docs deprecate _http_* (Sebastian Beltran) #​59293
  • [aeb4de55a7] - (SEMVER-MINOR) fs: port SonicBoom module to fs module as Utf8Stream (James M Snell) #​58897
Commits

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.


  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

Copy link

semanticdiff-com bot commented May 7, 2025

Review changes with  SemanticDiff

Changed Files
File Status
  package-lock.json  1% smaller
  package.json  0% smaller

Copy link

restack-app bot commented May 7, 2025

No applications have been configured for previews targeting branch: Master. To do so go to restack console and configure your applications for previews.

Copy link

coderabbitai bot commented May 7, 2025

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.


Comment @coderabbitai help to get the list of available commands and usage tips.

Copy link

pr-code-reviewer bot commented May 7, 2025

👋 Hi there!

Everything looks good!


Automatically generated with the help of gpt-3.5-turbo.
Feedback? Please don't hesitate to drop me an email at [email protected].

@renovate renovate bot force-pushed the renovate/node-24.x branch from eef0416 to 3eea204 Compare August 1, 2025 05:26
@renovate renovate bot force-pushed the renovate/node-24.x branch from 3eea204 to e699a29 Compare August 15, 2025 02:02
@renovate renovate bot force-pushed the renovate/node-24.x branch from e699a29 to 7d6de2b Compare August 28, 2025 05:34
@renovate renovate bot force-pushed the renovate/node-24.x branch from 7d6de2b to 4746a6d Compare September 11, 2025 02:34
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

0 participants