Skip to content

test_runner: avoid hanging on incomplete v8 frames#62704

Merged
nodejs-github-bot merged 2 commits into
nodejs:mainfrom
thisalihassan:fix/test-runner-hangs
May 18, 2026
Merged

test_runner: avoid hanging on incomplete v8 frames#62704
nodejs-github-bot merged 2 commits into
nodejs:mainfrom
thisalihassan:fix/test-runner-hangs

Conversation

@thisalihassan

@thisalihassan thisalihassan commented Apr 12, 2026

Copy link
Copy Markdown
Contributor

The test runner could hang while draining child stdout when the buffered data started with bytes that matched the V8 serializer header (0xff 0x0f) but did not contain a complete serialized frame.

In that case #processRawBuffer() made no progress, and #drainRawBuffer() kept calling it in a loop forever.

This change makes the deserializer recover from that end-of-stream case by flushing the buffered bytes as stdout and continuing to resync. It also preserves the ordering of a trailing partial V8 header split across chunks.

Closes #62693

Assisted-by: Claude Opus

@nodejs-github-bot

Copy link
Copy Markdown
Collaborator

Review requested:

  • @nodejs/test_runner

@nodejs-github-bot nodejs-github-bot added needs-ci PRs that need a full CI run. test_runner Issues and PRs related to the test runner subsystem. labels Apr 12, 2026
// size, causing #processRawBuffer to make no progress and
// #drainRawBuffer to loop forever without the no-progress guard.
const reported = await collectReported([oversizedLengthHeader]);
assert(reported.every((event) => event.type === 'test:stdout'));

@aduh95 aduh95 Apr 12, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

We can get a much more useful error output by using partialDeepStrictEqual here

Suggested change
assert(reported.every((event) => event.type === 'test:stdout'));
assert.partialDeepStrictEqual(reported, Array.from({ length: reported.length }, () => ({ type: 'test:stdout' }));

Comment thread lib/internal/test_runner/runner.js Outdated
data: {
__proto__: null,
file: this.name,
message: TypedArrayPrototypeSubarray(bufferHead, 0, 1).toString('utf-8'),

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

If we're dealing with a single-byte UTF-8 char, we don't need the intermediate view I think

Suggested change
message: TypedArrayPrototypeSubarray(bufferHead, 0, 1).toString('utf-8'),
message: StringFromCharCode(bufferHead[0]),

@thisalihassan thisalihassan Apr 12, 2026

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

it changes the output semantics here StringFromCharCode(0xff) gives "ΓΏ" but Buffer.from([0xff]).toString('utf8') gives "οΏ½" which matches the current stdout path so I’m keeping the UTF-8 decode

@aduh95 aduh95 Apr 12, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

String.fromCodePoint then – but I'm surprised we would get non-ASCII chars here

@thisalihassan thisalihassan Apr 12, 2026

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Right, switched to StringFromCharCode the byte here is always the V8 version tag (0xFF)

Signed-off-by: Ali Hassan <ali-hassan27@outlook.com>
@thisalihassan thisalihassan force-pushed the fix/test-runner-hangs branch from 631f70a to 825b3e3 Compare April 12, 2026 11:20
@thisalihassan thisalihassan requested a review from aduh95 April 12, 2026 11:21
@avivkeller

Copy link
Copy Markdown
Member

Can you add a proper PR description?

@codecov

codecov Bot commented Apr 12, 2026

Copy link
Copy Markdown

Codecov Report

❌ Patch coverage is 95.65217% with 2 lines in your changes missing coverage. Please review.
βœ… Project coverage is 89.80%. Comparing base (0fea430) to head (e07cdd4).
⚠️ Report is 355 commits behind head on main.

Files with missing lines Patch % Lines
lib/internal/test_runner/runner.js 95.65% 2 Missing ⚠️
Additional details and impacted files
@@            Coverage Diff             @@
##             main   #62704      +/-   ##
==========================================
- Coverage   89.80%   89.80%   -0.01%     
==========================================
  Files         699      699              
  Lines      216363   216417      +54     
  Branches    41370    41377       +7     
==========================================
+ Hits       194309   194356      +47     
- Misses      14140    14141       +1     
- Partials     7914     7920       +6     
Files with missing lines Coverage Ξ”
lib/internal/test_runner/runner.js 93.68% <95.65%> (+0.03%) ⬆️

... and 34 files with indirect coverage changes

πŸš€ New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
  • πŸ“¦ JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

…-byte fallback path

Signed-off-by: Ali Hassan <ali-hassan27@outlook.com>
@thisalihassan

Copy link
Copy Markdown
Contributor Author

@aduh95 can you please take a relook at this again?

@panva panva added the request-ci Add this label to start a Jenkins CI on a PR. label May 17, 2026
@github-actions github-actions Bot removed the request-ci Add this label to start a Jenkins CI on a PR. label May 17, 2026
@nodejs-github-bot

Copy link
Copy Markdown
Collaborator

@atlowChemi atlowChemi added commit-queue Add this label to land a pull request using GitHub Actions. commit-queue-squash Add this label to instruct the Commit Queue to squash all the PR commits into the first one. labels May 18, 2026
@nodejs-github-bot nodejs-github-bot removed the commit-queue Add this label to land a pull request using GitHub Actions. label May 18, 2026
@nodejs-github-bot nodejs-github-bot merged commit debe2ed into nodejs:main May 18, 2026
71 checks passed
@nodejs-github-bot

Copy link
Copy Markdown
Collaborator

Landed in debe2ed

aduh95 pushed a commit that referenced this pull request May 19, 2026
Signed-off-by: Ali Hassan <ali-hassan27@outlook.com>
PR-URL: #62704
Reviewed-By: Moshe Atlow <moshe@atlow.co.il>
Reviewed-By: Chemi Atlow <chemi@atlow.co.il>
aduh95 pushed a commit that referenced this pull request May 19, 2026
Signed-off-by: Ali Hassan <ali-hassan27@outlook.com>
PR-URL: #62704
Reviewed-By: Moshe Atlow <moshe@atlow.co.il>
Reviewed-By: Chemi Atlow <chemi@atlow.co.il>
panva pushed a commit to panva/node that referenced this pull request May 23, 2026
Signed-off-by: Ali Hassan <ali-hassan27@outlook.com>
PR-URL: nodejs#62704
Reviewed-By: Moshe Atlow <moshe@atlow.co.il>
Reviewed-By: Chemi Atlow <chemi@atlow.co.il>
aduh95 pushed a commit that referenced this pull request May 23, 2026
Signed-off-by: Ali Hassan <ali-hassan27@outlook.com>
PR-URL: #62704
Reviewed-By: Moshe Atlow <moshe@atlow.co.il>
Reviewed-By: Chemi Atlow <chemi@atlow.co.il>
araujogui pushed a commit to araujogui/node that referenced this pull request May 26, 2026
Signed-off-by: Ali Hassan <ali-hassan27@outlook.com>
PR-URL: nodejs#62704
Reviewed-By: Moshe Atlow <moshe@atlow.co.il>
Reviewed-By: Chemi Atlow <chemi@atlow.co.il>
aduh95 pushed a commit that referenced this pull request Jun 18, 2026
Signed-off-by: Ali Hassan <ali-hassan27@outlook.com>
PR-URL: #62704
Reviewed-By: Moshe Atlow <moshe@atlow.co.il>
Reviewed-By: Chemi Atlow <chemi@atlow.co.il>
jkleinsc added a commit to electron/electron that referenced this pull request Jun 30, 2026
This test synthesizes fake V8-serialized messages with the serialization format version hardcoded to 15 (0x0f). Electron bundles Chromium's V8, whose value-serializer format version is 16 (0x10), so the hardcoded headers are not recognized by the test runner's deserializer and the bytes fall through the UTF-8 stdout path (0xff -> U+FFFD), failing the assertions. The version difference is environmental and cannot be reconciled without re-patching the test on every V8 bump.

The failing subtests were introduced upstream in nodejs/node#62704 (test_runner: avoid hanging on incomplete v8 frames).
jkleinsc added a commit to electron/electron that referenced this pull request Jul 1, 2026
This test synthesizes fake V8-serialized messages with the serialization format version hardcoded to 15 (0x0f). Electron bundles Chromium's V8, whose value-serializer format version is 16 (0x10), so the hardcoded headers are not recognized by the test runner's deserializer and the bytes fall through the UTF-8 stdout path (0xff -> U+FFFD), failing the assertions. The version difference is environmental and cannot be reconciled without re-patching the test on every V8 bump.

The failing subtests were introduced upstream in nodejs/node#62704 (test_runner: avoid hanging on incomplete v8 frames).
jkleinsc added a commit to electron/electron that referenced this pull request Jul 1, 2026
This test synthesizes fake V8-serialized messages with the serialization format version hardcoded to 15 (0x0f). Electron bundles Chromium's V8, whose value-serializer format version is 16 (0x10), so the hardcoded headers are not recognized by the test runner's deserializer and the bytes fall through the UTF-8 stdout path (0xff -> U+FFFD), failing the assertions. The version difference is environmental and cannot be reconciled without re-patching the test on every V8 bump.

The failing subtests were introduced upstream in nodejs/node#62704 (test_runner: avoid hanging on incomplete v8 frames).
jkleinsc added a commit to electron/electron that referenced this pull request Jul 1, 2026
This test synthesizes fake V8-serialized messages with the serialization format version hardcoded to 15 (0x0f). Electron bundles Chromium's V8, whose value-serializer format version is 16 (0x10), so the hardcoded headers are not recognized by the test runner's deserializer and the bytes fall through the UTF-8 stdout path (0xff -> U+FFFD), failing the assertions. The version difference is environmental and cannot be reconciled without re-patching the test on every V8 bump.

The failing subtests were introduced upstream in nodejs/node#62704 (test_runner: avoid hanging on incomplete v8 frames).
dsanders11 pushed a commit to electron/electron that referenced this pull request Jul 2, 2026
* chore: bump node in DEPS to v24.17.0

* chore: update patches (trivial only)

Co-Authored-By: GPT-5.3-Codex <copilot@github.com>

* chore: bump node in DEPS to v24.18.0

* fix(patch): BoringSSL and OpenSSL incompatibilities

Ref: nodejs/node@677ca7e76c9

Co-Authored-By: GPT-5.3-Codex <copilot@github.com>

* fix(patch): crypto tests to run with BoringSSL

Ref: nodejs/node@61b20f60a39

Co-Authored-By: GPT-5.3-Codex <copilot@github.com>

* fix(patch): expose built-in electron module in ESM loader

Ref: nodejs/node@69df688fff4

Co-Authored-By: GPT-5.3-Codex <copilot@github.com>

* chore: update patches (trivial only)

* fix(patch): adapt ESM tests for Electron

Ref: nodejs/node@69df688fff4

Co-Authored-By: GPT-5.3-Codex <copilot@github.com>

* chore: update filenames.auto.gni

* test: update JWK error message assertion for unsupported algorithm

The error thrown for an unsupported OKP (Ed448) JWK changed from 'Invalid JWK data' to the more specific 'Invalid JWK OKP key'.

Ref: nodejs/node#62499

* test: disable parallel/test-runner-v8-deserializer

This test synthesizes fake V8-serialized messages with the serialization format version hardcoded to 15 (0x0f). Electron bundles Chromium's V8, whose value-serializer format version is 16 (0x10), so the hardcoded headers are not recognized by the test runner's deserializer and the bytes fall through the UTF-8 stdout path (0xff -> U+FFFD), failing the assertions. The version difference is environmental and cannot be reconciled without re-patching the test on every V8 bump.

The failing subtests were introduced upstream in nodejs/node#62704 (test_runner: avoid hanging on incomplete v8 frames).

* docs: update node upgrade skill to reflect boringSSL updates

* chore: update patch after rebase

---------

Co-authored-by: electron-roller[bot] <84116207+electron-roller[bot]@users.noreply.github.com>
Co-authored-by: John Kleinschmidt <jkleinsc@electronjs.org>
Co-authored-by: GPT-5.3-Codex <copilot@github.com>
jkleinsc added a commit to electron/electron that referenced this pull request Jul 2, 2026
This test synthesizes fake V8-serialized messages with the serialization format version hardcoded to 15 (0x0f). Electron bundles Chromium's V8, whose value-serializer format version is 16 (0x10), so the hardcoded headers are not recognized by the test runner's deserializer and the bytes fall through the UTF-8 stdout path (0xff -> U+FFFD), failing the assertions. The version difference is environmental and cannot be reconciled without re-patching the test on every V8 bump.

The failing subtests were introduced upstream in nodejs/node#62704 (test_runner: avoid hanging on incomplete v8 frames).
jkleinsc added a commit to electron/electron that referenced this pull request Jul 2, 2026
* chore: bump node in DEPS to v24.17.0

Co-authored-by: electron-roller[bot] <84116207+electron-roller[bot]@users.noreply.github.com>

* chore: update patches (trivial only)

Co-Authored-By: GPT-5.3-Codex <copilot@github.com>

Co-authored-by: John Kleinschmidt <jkleinsc@electronjs.org>

* chore: bump node in DEPS to v24.18.0

Co-authored-by: electron-roller[bot] <84116207+electron-roller[bot]@users.noreply.github.com>

* fix(patch): BoringSSL and OpenSSL incompatibilities

Ref: nodejs/node@677ca7e76c9

Co-Authored-By: GPT-5.3-Codex <copilot@github.com>

Co-authored-by: John Kleinschmidt <jkleinsc@electronjs.org>

* fix(patch): crypto tests to run with BoringSSL

Ref: nodejs/node@61b20f60a39

Co-Authored-By: GPT-5.3-Codex <copilot@github.com>

Co-authored-by: John Kleinschmidt <jkleinsc@electronjs.org>

* fix(patch): expose built-in electron module in ESM loader

Ref: nodejs/node@69df688fff4

Co-Authored-By: GPT-5.3-Codex <copilot@github.com>

Co-authored-by: John Kleinschmidt <jkleinsc@electronjs.org>

* chore: update patches (trivial only)

Co-authored-by: John Kleinschmidt <jkleinsc@electronjs.org>

* fix(patch): adapt ESM tests for Electron

Ref: nodejs/node@69df688fff4

Co-Authored-By: GPT-5.3-Codex <copilot@github.com>

Co-authored-by: John Kleinschmidt <jkleinsc@electronjs.org>

* chore: update filenames.auto.gni

Co-authored-by: John Kleinschmidt <jkleinsc@electronjs.org>

* test: update JWK error message assertion for unsupported algorithm

The error thrown for an unsupported OKP (Ed448) JWK changed from 'Invalid JWK data' to the more specific 'Invalid JWK OKP key'.

Ref: nodejs/node#62499

Co-authored-by: John Kleinschmidt <jkleinsc@electronjs.org>

* test: disable parallel/test-runner-v8-deserializer

This test synthesizes fake V8-serialized messages with the serialization format version hardcoded to 15 (0x0f). Electron bundles Chromium's V8, whose value-serializer format version is 16 (0x10), so the hardcoded headers are not recognized by the test runner's deserializer and the bytes fall through the UTF-8 stdout path (0xff -> U+FFFD), failing the assertions. The version difference is environmental and cannot be reconciled without re-patching the test on every V8 bump.

The failing subtests were introduced upstream in nodejs/node#62704 (test_runner: avoid hanging on incomplete v8 frames).

Co-authored-by: John Kleinschmidt <jkleinsc@electronjs.org>

* docs: update node upgrade skill to reflect boringSSL updates

Co-authored-by: John Kleinschmidt <jkleinsc@electronjs.org>

* chore: update patch after rebase

Co-authored-by: John Kleinschmidt <jkleinsc@electronjs.org>

---------

Co-authored-by: trop[bot] <37223003+trop[bot]@users.noreply.github.com>
Co-authored-by: electron-roller[bot] <84116207+electron-roller[bot]@users.noreply.github.com>
Co-authored-by: John Kleinschmidt <jkleinsc@electronjs.org>
jkleinsc added a commit to electron/electron that referenced this pull request Jul 2, 2026
* chore: bump node in DEPS to v24.18.0

* fix(patch): crypto tests to run with BoringSSL

Ref: nodejs/node@61b20f60a39

(cherry picked from commit 432172c)
Co-Authored-By: GPT-5.3-Codex <copilot@github.com>

* fix(patch): adapt ESM tests for Electron

Ref: nodejs/node@69df688fff4

Co-Authored-By: GPT-5.3-Codex <copilot@github.com>
(cherry picked from commit ce40736)

* test: update JWK error message assertion for unsupported algorithm

The error thrown for an unsupported OKP (Ed448) JWK changed from 'Invalid JWK data' to the more specific 'Invalid JWK OKP key'.

Ref: nodejs/node#62499
(cherry picked from commit 5718143)

* fix(patch): BoringSSL and OpenSSL incompatibilities

Ref: nodejs/node@677ca7e76c9

Co-Authored-By: GPT-5.3-Codex <copilot@github.com>
(cherry picked from commit 4d514ff)

* chore: update patches (trivial only)

* fix(patch): expose built-in electron module in ESM loader

Ref: nodejs/node@69df688fff4

Co-Authored-By: GPT-5.3-Codex <copilot@github.com>

* test: disable parallel/test-runner-v8-deserializer

This test synthesizes fake V8-serialized messages with the serialization format version hardcoded to 15 (0x0f). Electron bundles Chromium's V8, whose value-serializer format version is 16 (0x10), so the hardcoded headers are not recognized by the test runner's deserializer and the bytes fall through the UTF-8 stdout path (0xff -> U+FFFD), failing the assertions. The version difference is environmental and cannot be reconciled without re-patching the test on every V8 bump.

The failing subtests were introduced upstream in nodejs/node#62704 (test_runner: avoid hanging on incomplete v8 frames).

* docs: update node upgrade skill to reflect boringSSL updates

* chore: update filenames.auto.gni

---------

Co-authored-by: electron-roller[bot] <84116207+electron-roller[bot]@users.noreply.github.com>
Co-authored-by: John Kleinschmidt <jkleinsc@electronjs.org>
Co-authored-by: GPT-5.3-Codex <copilot@github.com>
jkleinsc added a commit to electron/electron that referenced this pull request Jul 2, 2026
* chore: bump node in DEPS to v24.18.0

* fix(patch): crypto tests to run with BoringSSL

Ref: nodejs/node@61b20f60a39

(cherry picked from commit 432172c)
Co-Authored-By: GPT-5.3-Codex <copilot@github.com>

* fix(patch): adapt ESM tests for Electron

Ref: nodejs/node@69df688fff4

Co-Authored-By: GPT-5.3-Codex <copilot@github.com>
(cherry picked from commit ce40736)

* test: update JWK error message assertion for unsupported algorithm

The error thrown for an unsupported OKP (Ed448) JWK changed from 'Invalid JWK data' to the more specific 'Invalid JWK OKP key'.

Ref: nodejs/node#62499
(cherry picked from commit 5718143)

* fix(patch): BoringSSL and OpenSSL incompatibilities

Ref: nodejs/node@677ca7e76c9

Co-Authored-By: GPT-5.3-Codex <copilot@github.com>
(cherry picked from commit 4d514ff)

* fix(patch): expose built-in electron module in ESM loader

Ref: nodejs/node@69df688fff4

Co-Authored-By: GPT-5.3-Codex <copilot@github.com>

* test: disable parallel/test-runner-v8-deserializer

This test synthesizes fake V8-serialized messages with the serialization format version hardcoded to 15 (0x0f). Electron bundles Chromium's V8, whose value-serializer format version is 16 (0x10), so the hardcoded headers are not recognized by the test runner's deserializer and the bytes fall through the UTF-8 stdout path (0xff -> U+FFFD), failing the assertions. The version difference is environmental and cannot be reconciled without re-patching the test on every V8 bump.

The failing subtests were introduced upstream in nodejs/node#62704 (test_runner: avoid hanging on incomplete v8 frames).

* docs: update node upgrade skill to reflect boringSSL updates

* chore: update patches (trivial only)

* fix(patch): skip PQC crypto tests unsupported by BoringSSL

Chromium 148's BoringSSL does not implement ML-KEM/ML-DSA/SLH-DSA, which upstream wired up for BoringSSL in nodejs/node#63255. Skip or disable the affected tests on BoringSSL for this Electron version.

Ref: nodejs/node#63255

Co-Authored-By: Claude <noreply@anthropic.com>

---------

Co-authored-by: electron-roller[bot] <84116207+electron-roller[bot]@users.noreply.github.com>
Co-authored-by: John Kleinschmidt <jkleinsc@electronjs.org>
Co-authored-by: GPT-5.3-Codex <copilot@github.com>
Co-authored-by: Claude <noreply@anthropic.com>
jkleinsc added a commit to electron/electron that referenced this pull request Jul 2, 2026
This test synthesizes fake V8-serialized messages with the serialization format version hardcoded to 15 (0x0f). Electron bundles Chromium's V8, whose value-serializer format version is 16 (0x10), so the hardcoded headers are not recognized by the test runner's deserializer and the bytes fall through the UTF-8 stdout path (0xff -> U+FFFD), failing the assertions. The version difference is environmental and cannot be reconciled without re-patching the test on every V8 bump.

The failing subtests were introduced upstream in nodejs/node#62704 (test_runner: avoid hanging on incomplete v8 frames).
jkleinsc added a commit to electron/electron that referenced this pull request Jul 3, 2026
* chore: bump node in DEPS to v24.18.0

* fix(patch): crypto tests to run with BoringSSL

Ref: nodejs/node@61b20f60a39

(cherry picked from commit 432172c)
Co-Authored-By: GPT-5.3-Codex <copilot@github.com>

* fix(patch): adapt ESM tests for Electron

Ref: nodejs/node@69df688fff4

Co-Authored-By: GPT-5.3-Codex <copilot@github.com>
(cherry picked from commit ce40736)

* test: update JWK error message assertion for unsupported algorithm

The error thrown for an unsupported OKP (Ed448) JWK changed from 'Invalid JWK data' to the more specific 'Invalid JWK OKP key'.

Ref: nodejs/node#62499
(cherry picked from commit 5718143)

* fix(patch): BoringSSL and OpenSSL incompatibilities

Ref: nodejs/node@677ca7e76c9

Co-Authored-By: GPT-5.3-Codex <copilot@github.com>
(cherry picked from commit 4d514ff)

* fix(patch): expose built-in electron module in ESM loader

Ref: nodejs/node@69df688fff4

Co-Authored-By: GPT-5.3-Codex <copilot@github.com>

* test: disable parallel/test-runner-v8-deserializer

This test synthesizes fake V8-serialized messages with the serialization format version hardcoded to 15 (0x0f). Electron bundles Chromium's V8, whose value-serializer format version is 16 (0x10), so the hardcoded headers are not recognized by the test runner's deserializer and the bytes fall through the UTF-8 stdout path (0xff -> U+FFFD), failing the assertions. The version difference is environmental and cannot be reconciled without re-patching the test on every V8 bump.

The failing subtests were introduced upstream in nodejs/node#62704 (test_runner: avoid hanging on incomplete v8 frames).

* docs: update node upgrade skill to reflect boringSSL updates

* fix(patch): skip PQC crypto tests unsupported by BoringSSL

Chromium 148's BoringSSL does not implement ML-KEM/ML-DSA/SLH-DSA, which upstream wired up for BoringSSL in nodejs/node#63255. Skip or disable the affected tests on BoringSSL for this Electron version.

Ref: nodejs/node#63255

Co-Authored-By: Claude <noreply@anthropic.com>

* chore: update patches (trivial only)

* fix(patch): gate BoringSSL PQC surface on BORINGSSL_API_VERSION

Chromium 146 ships BoringSSL API version 39, which exposes the ML-DSA
and ML-KEM NIDs but not the ML-KEM EVP_PKEY_ALG accessors, the ML-KEM
encapsulate/decapsulate APIs, or EVP_PKEY_CTX_set1_signature_context_string.
Those only became available at API version 40 (Chromium 148). Gate the
BoringSSL PQC/KEM/signature-context capability macros on the API version
so the older BoringSSL builds with PQC reported as unsupported.

Ref: nodejs/node#63255

Co-Authored-By: GPT-5.3-Codex <copilot@github.com>

* fix(patch): skip PQC tests unsupported by 41-x-y BoringSSL

Chromium 146's BoringSSL (API v39) lacks ML-KEM and ML-DSA support, so
guard the new PQC keygen/webcrypto tests that assume BoringSSL provides
PQC (as it does on newer Chromium). Drops the boringssl PQC-enable
disjunct so these tests skip on this branch's BoringSSL.

Ref: nodejs/node#63255

Co-Authored-By: GPT-5.3-Codex <copilot@github.com>

---------

Co-authored-by: electron-roller[bot] <84116207+electron-roller[bot]@users.noreply.github.com>
Co-authored-by: John Kleinschmidt <jkleinsc@electronjs.org>
Co-authored-by: GPT-5.3-Codex <copilot@github.com>
Co-authored-by: Claude <noreply@anthropic.com>
mwalbeck pushed a commit to mwalbeck/docker-cyberchef that referenced this pull request Jul 11, 2026
This PR contains the following updates:

| Package | Type | Update | Change |
|---|---|---|---|
| [node](https://github.com/nodejs/node) | stage | minor | `24.16.0-trixie` β†’ `24.18.0-trixie` |

---

### Release Notes

<details>
<summary>nodejs/node (node)</summary>

### [`v24.18.0`](https://github.com/nodejs/node/releases/tag/v24.18.0): 2026-06-23, Version 24.18.0 'Krypton' (LTS), @&#8203;richardlau prepared by @&#8203;sxa

[Compare Source](nodejs/node@v24.17.0...v24.18.0)

##### Notable Changes

- \[[`e07e7a31e1`](nodejs/node@e07e7a31e1)] - **crypto**: update root certificates to NSS 3.123.1 (Node.js GitHub Bot) [#&#8203;63527](nodejs/node#63527)
- \[[`44c8ebcbd6`](nodejs/node@44c8ebcbd6)] - **http**: avoid stream listeners on idle agent sockets (Matteo Collina) [#&#8203;64004](nodejs/node#64004)
- \[[`d3ef4122ee`](nodejs/node@d3ef4122ee)] - **(SEMVER-MINOR)** **buffer**: increase Buffer.poolSize default to 64 KiB (Matteo Collina) [#&#8203;63597](nodejs/node#63597)
- \[[`bb2857b85a`](nodejs/node@bb2857b85a)] - **(SEMVER-MINOR)** **crypto**: align key argument names in docs and error messages (Filip Skokan) [#&#8203;62527](nodejs/node#62527)
- \[[`b9d5e87880`](nodejs/node@b9d5e87880)] - **(SEMVER-MINOR)** **crypto**: accept key data in crypto.diffieHellman() and cleanup DH jobs (Filip Skokan) [#&#8203;62527](nodejs/node#62527)
- \[[`ccd756d61e`](nodejs/node@ccd756d61e)] - **(SEMVER-MINOR)** **crypto**: add TurboSHAKE and KangarooTwelve Web Cryptography algorithms (Filip Skokan) [#&#8203;62183](nodejs/node#62183)
- \[[`4c9251fc09`](nodejs/node@4c9251fc09)] - **(SEMVER-MINOR)** **http**: add writeInformation to send arbitrary 1xx status codes (Tim Perry) [#&#8203;63155](nodejs/node#63155)
- \[[`8c989ec4a3`](nodejs/node@8c989ec4a3)] - **(SEMVER-MINOR)** **inspector**: expose precise coverage start to JS runtime (sangwook) [#&#8203;63079](nodejs/node#63079)
- \[[`3f54c8ba32`](nodejs/node@3f54c8ba32)] - ***Revert*** "**stream**: noop pause/resume on destroyed streams" (Stewart X Addison) [#&#8203;63834](nodejs/node#63834)

##### Commits

- \[[`d3ef4122ee`](nodejs/node@d3ef4122ee)] - **(SEMVER-MINOR)** **buffer**: increase Buffer.poolSize default to 64 KiB (Matteo Collina) [#&#8203;63597](nodejs/node#63597)
- \[[`9ff36e40f0`](nodejs/node@9ff36e40f0)] - **build**: add --enable-all-experimentals build flag (Paolo Insogna) [#&#8203;62755](nodejs/node#62755)
- \[[`7c22ee23aa`](nodejs/node@7c22ee23aa)] - **build**: def `NODE_USE_NODE_CODE_CACHE` only used in node\_mksnapshot (Chengzhong Wu) [#&#8203;63588](nodejs/node#63588)
- \[[`2551abdb4a`](nodejs/node@2551abdb4a)] - **build,win**: enable x64 PGO (Stefan Stojanovic) [#&#8203;62761](nodejs/node#62761)
- \[[`e8a55ce9b1`](nodejs/node@e8a55ce9b1)] - **crypto**: strengthen argument CHECKs in TurboSHAKE (Tobias Nießen) [#&#8203;62763](nodejs/node#62763)
- \[[`ae61cd68f3`](nodejs/node@ae61cd68f3)] - **crypto**: harden WebCrypto against prototype pollution (Filip Skokan) [#&#8203;63363](nodejs/node#63363)
- \[[`3d05a1d396`](nodejs/node@3d05a1d396)] - **crypto**: pass CryptoKey handles to KDF jobs (Filip Skokan) [#&#8203;63363](nodejs/node#63363)
- \[[`f9d10a3f6b`](nodejs/node@f9d10a3f6b)] - **crypto**: remove async from WebCrypto methods (Filip Skokan) [#&#8203;63363](nodejs/node#63363)
- \[[`e431d93e9e`](nodejs/node@e431d93e9e)] - **crypto**: add WebCrypto CryptoJob mode (Filip Skokan) [#&#8203;63363](nodejs/node#63363)
- \[[`56e2505e48`](nodejs/node@56e2505e48)] - **crypto**: wire ML-DSA and ML-KEM for use when using BoringSSL (Filip Skokan) [#&#8203;63255](nodejs/node#63255)
- \[[`3bac77f2a8`](nodejs/node@3bac77f2a8)] - **crypto**: wire ChaCha20-Poly1305 in Web Cryptography when using BoringSSL (Filip Skokan) [#&#8203;63255](nodejs/node#63255)
- \[[`1bff901b09`](nodejs/node@1bff901b09)] - **crypto**: wire AES-KW in Web Cryptography when using BoringSSL (Filip Skokan) [#&#8203;63255](nodejs/node#63255)
- \[[`4433fca3df`](nodejs/node@4433fca3df)] - **crypto**: harden CryptoKey algorithm slots (Filip Skokan) [#&#8203;63111](nodejs/node#63111)
- \[[`b5cf01217a`](nodejs/node@b5cf01217a)] - **crypto**: harden KeyObject internal slots (Filip Skokan) [#&#8203;63111](nodejs/node#63111)
- \[[`ce84aef37d`](nodejs/node@ce84aef37d)] - **crypto**: add guards and adjust tests for BoringSSL (Filip Skokan) [#&#8203;62883](nodejs/node#62883)
- \[[`26781689b0`](nodejs/node@26781689b0)] - **crypto**: reject duplicate ML-KEM JWK key\_ops (Filip Skokan) [#&#8203;62905](nodejs/node#62905)
- \[[`aeea8f4970`](nodejs/node@aeea8f4970)] - **crypto**: add JWK support for ML-KEM and SLH-DSA key types (Filip Skokan) [#&#8203;62706](nodejs/node#62706)
- \[[`407cf91656`](nodejs/node@407cf91656)] - **crypto**: guard against size\_t overflow on experimental 32-bit arch (Filip Skokan) [#&#8203;62626](nodejs/node#62626)
- \[[`bb2857b85a`](nodejs/node@bb2857b85a)] - **(SEMVER-MINOR)** **crypto**: align key argument names in docs and error messages (Filip Skokan) [#&#8203;62527](nodejs/node#62527)
- \[[`b9d5e87880`](nodejs/node@b9d5e87880)] - **(SEMVER-MINOR)** **crypto**: accept key data in crypto.diffieHellman() and cleanup DH jobs (Filip Skokan) [#&#8203;62527](nodejs/node#62527)
- \[[`b46d52b283`](nodejs/node@b46d52b283)] - **crypto**: unify asymmetric key import through KeyObjectHandle::Init (Filip Skokan) [#&#8203;62499](nodejs/node#62499)
- \[[`ccd756d61e`](nodejs/node@ccd756d61e)] - **(SEMVER-MINOR)** **crypto**: add TurboSHAKE and KangarooTwelve Web Cryptography algorithms (Filip Skokan) [#&#8203;62183](nodejs/node#62183)
- \[[`e07e7a31e1`](nodejs/node@e07e7a31e1)] - **crypto**: update root certificates to NSS 3.123.1 (Node.js GitHub Bot) [#&#8203;63527](nodejs/node#63527)
- \[[`61826df455`](nodejs/node@61826df455)] - **crypto**: coerce -0 keylen to +0 in pbkdf2 and scrypt (Jordan Harband) [#&#8203;63531](nodejs/node#63531)
- \[[`16d2fd3c07`](nodejs/node@16d2fd3c07)] - **crypto**: align verifyOneShot accepted types (Anshika Jain) [#&#8203;63280](nodejs/node#63280)
- \[[`3b8330deda`](nodejs/node@3b8330deda)] - **crypto**: improve system certificate enumeration logic on macOS (Robo) [#&#8203;62576](nodejs/node#62576)
- \[[`141de35399`](nodejs/node@141de35399)] - **debugger**: add --help to `node inspect` and improve docs (Joyee Cheung) [#&#8203;63201](nodejs/node#63201)
- \[[`b76bfcd4fa`](nodejs/node@b76bfcd4fa)] - **deps**: upgrade npm to 11.16.0 (npm team) [#&#8203;63602](nodejs/node#63602)
- \[[`4ec142314c`](nodejs/node@4ec142314c)] - **deps**: SQLite: cherry-pick [`b869ed6`](nodejs/node@b869ed6) (Junsu Han) [#&#8203;63525](nodejs/node#63525)
- \[[`19e8ce1c36`](nodejs/node@19e8ce1c36)] - **deps**: upgrade npm to 11.15.0 (npm team) [#&#8203;63463](nodejs/node#63463)
- \[[`8a264260e2`](nodejs/node@8a264260e2)] - **deps**: update sqlite to 3.53.1 (Node.js GitHub Bot) [#&#8203;63217](nodejs/node#63217)
- \[[`50c8ff3f94`](nodejs/node@50c8ff3f94)] - **deps**: update simdjson to 4.6.4 (Node.js GitHub Bot) [#&#8203;62811](nodejs/node#62811)
- \[[`6e56f01c4b`](nodejs/node@6e56f01c4b)] - **deps**: V8: cherry-pick [`435a2cd`](nodejs/node@435a2cdf664c) (Matthias Liedtke) [#&#8203;63136](nodejs/node#63136)
- \[[`3ba813b242`](nodejs/node@3ba813b242)] - **deps**: cherry-pick [libuv/libuv@`a43e543`](libuv/libuv@a43e543) (Ali Hassan) [#&#8203;63222](nodejs/node#63222)
- \[[`2390e3a5ac`](nodejs/node@2390e3a5ac)] - **doc**: remove duplicated sentences in large-pull-requests.md (Joyee Cheung) [#&#8203;63650](nodejs/node#63650)
- \[[`52a1c18374`](nodejs/node@52a1c18374)] - **doc**: update `git node land` instructions for security releases (Antoine du Hamel) [#&#8203;63586](nodejs/node#63586)
- \[[`3e6b4da037`](nodejs/node@3e6b4da037)] - **doc**: drop --experimental from --permission (Rafael Gonzaga) [#&#8203;63583](nodejs/node#63583)
- \[[`84d05163b9`](nodejs/node@84d05163b9)] - **doc**: explicitly ask for reproducible in JS (Rafael Gonzaga) [#&#8203;63479](nodejs/node#63479)
- \[[`7da2a4450e`](nodejs/node@7da2a4450e)] - **doc**: fix URL postMessage example in worker\_threads (Kit Dallege) [#&#8203;62203](nodejs/node#62203)
- \[[`3d79bd8b29`](nodejs/node@3d79bd8b29)] - **doc**: clarify `filter` option of `sqlite.database.applyChangeset` (Antoine du Hamel) [#&#8203;63515](nodejs/node#63515)
- \[[`4f4174aace`](nodejs/node@4f4174aace)] - **doc**: fix double spaces in ERR\_TLS\_INVALID\_PROTOCOL\_METHOD (Daijiro Wachi) [#&#8203;63511](nodejs/node#63511)
- \[[`388323ca4b`](nodejs/node@388323ca4b)] - **doc**: fix double space in modules.md (Daijiro Wachi) [#&#8203;63512](nodejs/node#63512)
- \[[`5258ccc058`](nodejs/node@5258ccc058)] - **doc**: fix "options" to "option" in tls.createServer (Daijiro Wachi) [#&#8203;63453](nodejs/node#63453)
- \[[`43e83e6507`](nodejs/node@43e83e6507)] - **doc**: fix typo in deprecations (Daijiro Wachi) [#&#8203;63434](nodejs/node#63434)
- \[[`f05a61d54c`](nodejs/node@f05a61d54c)] - **doc**: remove unsupported template type from v8.md (RenΓ©) [#&#8203;63410](nodejs/node#63410)
- \[[`c39d5fc820`](nodejs/node@c39d5fc820)] - **doc**: fix article usage before vowel-sound acronyms (joao-oliveira-softtor) [#&#8203;62696](nodejs/node#62696)
- \[[`398261f911`](nodejs/node@398261f911)] - **doc**: remove the bi-monthly contributor spotlight section (Claudio Wunder) [#&#8203;62734](nodejs/node#62734)
- \[[`fd9e14c405`](nodejs/node@fd9e14c405)] - **doc**: update http2's `push` and `trailers` events with `rawHeaders` param (YuSheng Chen) [#&#8203;63259](nodejs/node#63259)
- \[[`b943ce6933`](nodejs/node@b943ce6933)] - **doc**: remove inactive members from Triagers list (Antoine du Hamel) [#&#8203;63329](nodejs/node#63329)
- \[[`4b9cdfc022`](nodejs/node@4b9cdfc022)] - **doc**: reference correct function in Module docs (Robin Malfait) [#&#8203;63247](nodejs/node#63247)
- \[[`bed84b6df2`](nodejs/node@bed84b6df2)] - **doc**: replace Visual Studio 2022 Evergreen version reference with 17.14 (Mike McCready) [#&#8203;63211](nodejs/node#63211)
- \[[`32ea70569b`](nodejs/node@32ea70569b)] - **doc**: recommend explicitly Tier 1 or 2 for production applications (Mike McCready) [#&#8203;63187](nodejs/node#63187)
- \[[`4627bcfd82`](nodejs/node@4627bcfd82)] - **doc**: run license-builder (github-actions\[bot]) [#&#8203;63232](nodejs/node#63232)
- \[[`28eba71845`](nodejs/node@28eba71845)] - **doc**: add large pull requests contributing guide (Matteo Collina) [#&#8203;62829](nodejs/node#62829)
- \[[`2648efd438`](nodejs/node@2648efd438)] - **doc**: remove unnecessary `<!-- eslint-` magic comments (Antoine du Hamel) [#&#8203;63200](nodejs/node#63200)
- \[[`a95fc1f8fc`](nodejs/node@a95fc1f8fc)] - **doc**: clarify SEA platform support excludes darwin-x64 (MJSHANG) [#&#8203;63181](nodejs/node#63181)
- \[[`aaef29e2e1`](nodejs/node@aaef29e2e1)] - **doc**: update release steps when post-release fails (Rafael Gonzaga) [#&#8203;63131](nodejs/node#63131)
- \[[`7d81419cf2`](nodejs/node@7d81419cf2)] - **doc**: add Hmac.digest() documentation-only deprecation (DEP0206) (Anshika Jain) [#&#8203;63121](nodejs/node#63121)
- \[[`ececd80d81`](nodejs/node@ececd80d81)] - **doc**: document the latest-vX.x schema (Marco Ippolito) [#&#8203;63033](nodejs/node#63033)
- \[[`27c1c1d842`](nodejs/node@27c1c1d842)] - **doc**: remove list of versions in `BUILDING.md` (Antoine du Hamel) [#&#8203;63113](nodejs/node#63113)
- \[[`e369886a65`](nodejs/node@e369886a65)] - **doc,sqlite**: document entryPoint argument for loadExtension (Edy Silva) [#&#8203;63152](nodejs/node#63152)
- \[[`e4e5137cbd`](nodejs/node@e4e5137cbd)] - **errors**: handle V8 warnings in DisallowJavascriptExecutionScope (Divyanshu Sharma) [#&#8203;63491](nodejs/node#63491)
- \[[`6d1f6048d2`](nodejs/node@6d1f6048d2)] - **fs**: make `Date` properties on `Stats` enumerable (LiviaMedeiros) [#&#8203;63328](nodejs/node#63328)
- \[[`44c8ebcbd6`](nodejs/node@44c8ebcbd6)] - **http**: avoid stream listeners on idle agent sockets (Matteo Collina) [#&#8203;64004](nodejs/node#64004)
- \[[`4c9251fc09`](nodejs/node@4c9251fc09)] - **(SEMVER-MINOR)** **http**: add writeInformation to send arbitrary 1xx status codes (Tim Perry) [#&#8203;63155](nodejs/node#63155)
- \[[`39f61fb06c`](nodejs/node@39f61fb06c)] - **http2**: emit session close before stream close (Matteo Collina) [#&#8203;63414](nodejs/node#63414)
- \[[`8a8f2127d1`](nodejs/node@8a8f2127d1)] - **http2**: validate non-link headers in writeEarlyHints (Matteo Collina) [#&#8203;62017](nodejs/node#62017)
- \[[`8c989ec4a3`](nodejs/node@8c989ec4a3)] - **(SEMVER-MINOR)** **inspector**: expose precise coverage start to JS runtime (sangwook) [#&#8203;63079](nodejs/node#63079)
- \[[`c05f38229b`](nodejs/node@c05f38229b)] - **lib**: cleanup stateless diffiehellman key handling (Filip Skokan) [#&#8203;62645](nodejs/node#62645)
- \[[`1c16b45d35`](nodejs/node@1c16b45d35)] - **lib**: refactor internal webidl converters (Filip Skokan) [#&#8203;62979](nodejs/node#62979)
- \[[`02f35d6dce`](nodejs/node@02f35d6dce)] - **lib**: define `kEnumerableProperty` atomically (Antoine du Hamel) [#&#8203;63609](nodejs/node#63609)
- \[[`12c51547ba`](nodejs/node@12c51547ba)] - **lib**: fix typos in esm loader comments (RonGamzu) [#&#8203;63465](nodejs/node#63465)
- \[[`9b03b84262`](nodejs/node@9b03b84262)] - **lib**: fix typo idenity => identity (Daijiro Wachi) [#&#8203;63112](nodejs/node#63112)
- \[[`a84e6b0567`](nodejs/node@a84e6b0567)] - **lib**: fixes validator message (Daijiro Wachi) [#&#8203;62823](nodejs/node#62823)
- \[[`11734166a8`](nodejs/node@11734166a8)] - **lib**: narrow ReadableStreamBYOBRequest.view return type to Uint8Array (RoomWithOutRoof) [#&#8203;63017](nodejs/node#63017)
- \[[`7cead61d21`](nodejs/node@7cead61d21)] - **meta**: flip mcollina emails in .mailmap (Matteo Collina) [#&#8203;63621](nodejs/node#63621)
- \[[`a08cfcfd35`](nodejs/node@a08cfcfd35)] - **meta**: label "source maps" PRs (Chengzhong Wu) [#&#8203;63591](nodejs/node#63591)
- \[[`d56e8d2512`](nodejs/node@d56e8d2512)] - **meta**: add `vfs` subsystem label (RenΓ©) [#&#8203;62331](nodejs/node#62331)
- \[[`6201cfe488`](nodejs/node@6201cfe488)] - **meta**: skip scheduled workflows on forks (Jamie Magee) [#&#8203;63565](nodejs/node#63565)
- \[[`f095e2bd31`](nodejs/node@f095e2bd31)] - **meta**: add additional gitignore entries (James M Snell) [#&#8203;63267](nodejs/node#63267)
- \[[`1ea52c444c`](nodejs/node@1ea52c444c)] - **meta**: move one or more collaborators to emeritus (Node.js GitHub Bot) [#&#8203;63402](nodejs/node#63402)
- \[[`b1b2327611`](nodejs/node@b1b2327611)] - **meta**: move one or more collaborators to emeritus (Node.js GitHub Bot) [#&#8203;63235](nodejs/node#63235)
- \[[`7d88e130a9`](nodejs/node@7d88e130a9)] - **meta**: ignore AI assistants files (Matteo Collina) [#&#8203;62612](nodejs/node#62612)
- \[[`a53b51df38`](nodejs/node@a53b51df38)] - **module**: load ESM helpers eagerly in the snapshot (Joyee Cheung) [#&#8203;63550](nodejs/node#63550)
- \[[`69df688fff`](nodejs/node@69df688fff)] - **module**: fix sync hook short-circuit in require() in imported CJS (Joyee Cheung) [#&#8203;62920](nodejs/node#62920)
- \[[`75d9a4ed47`](nodejs/node@75d9a4ed47)] - **node-api**: support SharedArrayBuffer in napi\_create\_typedarray (Yilong Li) [#&#8203;62710](nodejs/node#62710)
- \[[`c20aa4c47b`](nodejs/node@c20aa4c47b)] - **quic**: add reusePort option to QuicEndpoint (James M Snell) [#&#8203;63267](nodejs/node#63267)
- \[[`26a30d8a7f`](nodejs/node@26a30d8a7f)] - **quic**: implement rate limiting for version nego and immediate close (James M Snell) [#&#8203;63267](nodejs/node#63267)
- \[[`0b534b5770`](nodejs/node@0b534b5770)] - **quic**: fixup linting issue after other changes (James M Snell) [#&#8203;63267](nodejs/node#63267)
- \[[`4b367cbe09`](nodejs/node@4b367cbe09)] - **quic**: remove unused binding variable in session.cc (James M Snell) [#&#8203;63177](nodejs/node#63177)
- \[[`2574bef5a6`](nodejs/node@2574bef5a6)] - **repl**: fix dedup comparing normalized line against raw history (Daijiro Wachi) [#&#8203;62886](nodejs/node#62886)
- \[[`30e71c7e49`](nodejs/node@30e71c7e49)] - **sqlite**: keep source database alive during backup (Matteo Collina) [#&#8203;62673](nodejs/node#62673)
- \[[`677ca7e76c`](nodejs/node@677ca7e76c)] - **src**: simplify OpenSSL feature gates (Filip Skokan) [#&#8203;63255](nodejs/node#63255)
- \[[`c863c75c39`](nodejs/node@c863c75c39)] - **src**: add BoringSSL EVP enumeration fallback (Filip Skokan) [#&#8203;63206](nodejs/node#63206)
- \[[`f6b2466921`](nodejs/node@f6b2466921)] - **src**: decouple KeyObject and CryptoKey and move CryptoKey to src (Filip Skokan) [#&#8203;62924](nodejs/node#62924)
- \[[`92d4f07dd2`](nodejs/node@92d4f07dd2)] - **src**: remove license headers for new node\_profiling files (Chengzhong Wu) [#&#8203;63066](nodejs/node#63066)
- \[[`8ac5d771c8`](nodejs/node@8ac5d771c8)] - **src**: split profiling helpers from util (Ilyas Shabi) [#&#8203;63008](nodejs/node#63008)
- \[[`85d1639495`](nodejs/node@85d1639495)] - **src**: remove TOCTOU race condition when encoding SAB-backed `Buffer`s (Antoine du Hamel) [#&#8203;63517](nodejs/node#63517)
- \[[`9473c5f05c`](nodejs/node@9473c5f05c)] - **src**: skip duplicate UTF-8 validation in TextDecoder fatal path (Mert Can Altin) [#&#8203;63231](nodejs/node#63231)
- \[[`f35c91ee68`](nodejs/node@f35c91ee68)] - **src**: improve token return value check (James M Snell) [#&#8203;63483](nodejs/node#63483)
- \[[`26f677c1c5`](nodejs/node@26f677c1c5)] - **src**: expose `node::RegisterContext` to make a node managed context (Chengzhong Wu) [#&#8203;62322](nodejs/node#62322)
- \[[`275cf909b6`](nodejs/node@275cf909b6)] - **src,sqlite**: only pass `xFilter` when user provided a callback (Antoine du Hamel) [#&#8203;63516](nodejs/node#63516)
- \[[`287e02303f`](nodejs/node@287e02303f)] - **src,sqlite**: remove dead code (Edy Silva) [#&#8203;63204](nodejs/node#63204)
- \[[`58fa2ee189`](nodejs/node@58fa2ee189)] - **stream**: switch to internal `sleep` binding (Antoine du Hamel) [#&#8203;63611](nodejs/node#63611)
- \[[`f954ab3f1a`](nodejs/node@f954ab3f1a)] - **stream**: use data listener for compose forwarding (Trivikram Kamat) [#&#8203;63593](nodejs/node#63593)
- \[[`dc57173003`](nodejs/node@dc57173003)] - **stream**: fix Writable.toWeb() hang on synchronous drain (sangwook) [#&#8203;61197](nodejs/node#61197)
- \[[`3f54c8ba32`](nodejs/node@3f54c8ba32)] - ***Revert*** "**stream**: noop pause/resume on destroyed streams" (Stewart X Addison) [#&#8203;63834](nodejs/node#63834)
- \[[`cee279c5d6`](nodejs/node@cee279c5d6)] - **stream**: remove unnecessary check (Antoine du Hamel) [#&#8203;63030](nodejs/node#63030)
- \[[`61b20f60a3`](nodejs/node@61b20f60a3)] - **test**: update tls/crypto behaviour expectations when using BoringSSL (Filip Skokan) [#&#8203;63161](nodejs/node#63161)
- \[[`a835363808`](nodejs/node@a835363808)] - **test**: update WPT for WebCryptoAPI to [`97bbc72`](nodejs/node@97bbc7247a) (Node.js GitHub Bot) [#&#8203;63417](nodejs/node#63417)
- \[[`a00297480b`](nodejs/node@a00297480b)] - **test**: update WPT resources, interfaces and WebCryptoAPI (Node.js GitHub Bot) [#&#8203;62389](nodejs/node#62389)
- \[[`5a95a2b055`](nodejs/node@5a95a2b055)] - **test**: shorten path in net pipe connect errors (Matteo Collina) [#&#8203;63405](nodejs/node#63405)
- \[[`5e8ff22d8f`](nodejs/node@5e8ff22d8f)] - **test**: remove test-node-output-v8-warning (Joyee Cheung) [#&#8203;63469](nodejs/node#63469)
- \[[`ee15380950`](nodejs/node@ee15380950)] - **test**: update test426-fixtures to [`9b9e225`](nodejs/node@9b9e225) (Node.js GitHub Bot) [#&#8203;63373](nodejs/node#63373)
- \[[`9e063d9bea`](nodejs/node@9e063d9bea)] - **test**: update WPT for url to [`e4a4672`](nodejs/node@e4a4672e9e) (Node.js GitHub Bot) [#&#8203;63372](nodejs/node#63372)
- \[[`503bee4b43`](nodejs/node@503bee4b43)] - **test**: deflake async-hooks statwatcher test (Trivikram Kamat) [#&#8203;63396](nodejs/node#63396)
- \[[`cccc7c32d8`](nodejs/node@cccc7c32d8)] - **test**: avoid test\_runner watch restart in spec snapshot (Trivikram Kamat) [#&#8203;63392](nodejs/node#63392)
- \[[`c89489258c`](nodejs/node@c89489258c)] - **test**: reduce watch mode restart flakiness (Trivikram Kamat) [#&#8203;63390](nodejs/node#63390)
- \[[`e4d5e2578e`](nodejs/node@e4d5e2578e)] - **test**: isolate rerun-failures state file under tmpdir (Chemi Atlow) [#&#8203;63449](nodejs/node#63449)
- \[[`362644a9ba`](nodejs/node@362644a9ba)] - **test**: wait for ok before initial break after restart (Yuya Inoue) [#&#8203;62807](nodejs/node#62807)
- \[[`c4058d0e05`](nodejs/node@c4058d0e05)] - **test**: disable Maglev in near-heap-limit worker test (Trivikram Kamat) [#&#8203;63398](nodejs/node#63398)
- \[[`214da630a7`](nodejs/node@214da630a7)] - **test**: deflake connection refused proxy tests (Trivikram Kamat) [#&#8203;63395](nodejs/node#63395)
- \[[`1d61a29876`](nodejs/node@1d61a29876)] - **test**: avoid repeated writes in watch helper (Trivikram Kamat) [#&#8203;63386](nodejs/node#63386)
- \[[`2004e25387`](nodejs/node@2004e25387)] - **test**: deflake watch mode worker test (Trivikram Kamat) [#&#8203;63384](nodejs/node#63384)
- \[[`d691cccfc1`](nodejs/node@d691cccfc1)] - **test**: relax test-memory-usage arrayBuffers check (inoway46) [#&#8203;63244](nodejs/node#63244)
- \[[`0ff6bf853c`](nodejs/node@0ff6bf853c)] - **test**: reduce flakiness of `different-registry-per-thread` (Antoine du Hamel) [#&#8203;63244](nodejs/node#63244)
- \[[`d9f4e8e503`](nodejs/node@d9f4e8e503)] - **test**: fix flaky test-watch-mode-inspect timeout (Matteo Collina) [#&#8203;63361](nodejs/node#63361)
- \[[`6d7cd50328`](nodejs/node@6d7cd50328)] - **test**: relax min assertion in test-performance-eventloopdelay (Marco) [#&#8203;63100](nodejs/node#63100)
- \[[`9dafe1d2d8`](nodejs/node@9dafe1d2d8)] - **test**: avoid flaky restart sync in debugger exceptions test (Yuya Inoue) [#&#8203;62055](nodejs/node#62055)
- \[[`989b2de973`](nodejs/node@989b2de973)] - **test**: avoid initial-break wait in restart-message (inoway46) [#&#8203;62060](nodejs/node#62060)
- \[[`a072a25ee7`](nodejs/node@a072a25ee7)] - **test**: move FFI tests to `NATIVE_SUITES` (Antoine du Hamel) [#&#8203;63165](nodejs/node#63165)
- \[[`64efbfd878`](nodejs/node@64efbfd878)] - **test**: use ERM to destroy sqlite database handles after tests (RenΓ©) [#&#8203;63076](nodejs/node#63076)
- \[[`7dee66cd94`](nodejs/node@7dee66cd94)] - **test\_runner**: dont buffer unordered events in process isolation mode (Moshe Atlow) [#&#8203;63432](nodejs/node#63432)
- \[[`d257eec1e3`](nodejs/node@d257eec1e3)] - **test\_runner**: fix --test-rerun-failures swallowing failures on retry (Chemi Atlow) [#&#8203;63431](nodejs/node#63431)
- \[[`288c320e2f`](nodejs/node@288c320e2f)] - **test\_runner**: show replayed-from-attempt hint in spec reporter (Moshe Atlow) [#&#8203;63429](nodejs/node#63429)
- \[[`904bdf5bb4`](nodejs/node@904bdf5bb4)] - **test\_runner**: preserve run duration when using test-rerun (Moshe Atlow) [#&#8203;63429](nodejs/node#63429)
- \[[`df183d7bfa`](nodejs/node@df183d7bfa)] - **test\_runner**: avoid hanging on incomplete v8 frames (Ali Hassan) [#&#8203;62704](nodejs/node#62704)
- \[[`ec86c69726`](nodejs/node@ec86c69726)] - **test\_runner**: fix diagnostics channel context tracking (Moshe Atlow) [#&#8203;63283](nodejs/node#63283)
- \[[`94e5f63b83`](nodejs/node@94e5f63b83)] - **tls**: add unsupported renegotiation error (Filip Skokan) [#&#8203;63161](nodejs/node#63161)
- \[[`06d308fb61`](nodejs/node@06d308fb61)] - **tools**: prevent lib code from reading KeyObject and CryptoKey accessors (Filip Skokan) [#&#8203;63111](nodejs/node#63111)
- \[[`2e4a0d0c91`](nodejs/node@2e4a0d0c91)] - **tools**: bump brace-expansion from 5.0.5 to 5.0.6 in /tools/eslint (dependabot\[bot]) [#&#8203;63415](nodejs/node#63415)
- \[[`4c9666b366`](nodejs/node@4c9666b366)] - **tools**: skip commit-lint on backport pull requests (Marco) [#&#8203;63378](nodejs/node#63378)
- \[[`67d0c490a8`](nodejs/node@67d0c490a8)] - **tools**: fix skip of `test-internet` on forks (Antoine du Hamel) [#&#8203;63492](nodejs/node#63492)
- \[[`02f73c7cac`](nodejs/node@02f73c7cac)] - **tools**: bump the eslint group in /tools/eslint with 4 updates (dependabot\[bot]) [#&#8203;63075](nodejs/node#63075)
- \[[`5d016d3241`](nodejs/node@5d016d3241)] - **tools**: update gyp-next to 0.22.2 (Node.js GitHub Bot) [#&#8203;63374](nodejs/node#63374)
- \[[`55af0f0edb`](nodejs/node@55af0f0edb)] - **tools**: fix test426 updater (Antoine du Hamel) [#&#8203;63271](nodejs/node#63271)
- \[[`d8475e167a`](nodejs/node@d8475e167a)] - **tools**: use different branch for tool updates on staging branches (Antoine du Hamel) [#&#8203;63110](nodejs/node#63110)
- \[[`c605df9e50`](nodejs/node@c605df9e50)] - **util**: remove unused functions (Antoine du Hamel) [#&#8203;63612](nodejs/node#63612)
- \[[`fe4540ebdb`](nodejs/node@fe4540ebdb)] - **util**: create hex style cache and fast path (Guilherme AraΓΊjo) [#&#8203;62999](nodejs/node#62999)

### [`v24.17.0`](https://github.com/nodejs/node/releases/tag/v24.17.0): 2026-06-18, Version 24.17.0 'Krypton' (LTS), @&#8203;aduh95

[Compare Source](nodejs/node@v24.16.0...v24.17.0)

This is a security release.

##### Notable Changes

- (CVE-2026-48618) tls: normalize hostname for server identity checks (Matteo Collina) – High
- (CVE-2026-48933) crypto: guard WebCrypto cipher output length (Filip Skokan) – High
- (CVE-2026-48615) lib,test: redact proxy credentials in tunnel errors (Matteo Collina) – Medium
- (CVE-2026-48619) http2: cap originSet size to prevent unbounded memory growth (Matteo Collina) – Medium
- (CVE-2026-48928) tls: fix case-sensitive SNI context matching (Matteo Collina) – Medium
- (CVE-2026-48930) dns,net: reject hostnames with embedded NUL bytes (Matteo Collina) – Medium
- (CVE-2026-48934) tls: bind reusable sessions to authenticated host (Matteo Collina) – Medium
- (CVE-2026-48937) deps: fix integration issues with the latest nghttp2 – Medium
- (CVE-2026-48617) permission: handle process.chdir on writereport (RafaelGSS) – Low
- (CVE-2026-48931) http: fix response queue poisoning in http.Agent (Matteo Collina) – Low
- (CVE-2026-48935) permission: disable FileHandle utimes with permission model (RafaelGSS) – Low

##### Commits

- \[[`9e4dfc7bba`](nodejs/node@9e4dfc7bba)] - **(CVE-2026-48933)** **crypto**: guard WebCrypto cipher output length (Filip Skokan) [nodejs-private/node-private#878](https://github.com/nodejs-private/node-private/pull/878)
- \[[`cb2aed980c`](nodejs/node@cb2aed980c)] - **deps**: update llhttp to 9.4.2 (Antoine du Hamel) [nodejs-private/node-private#890](https://github.com/nodejs-private/node-private/pull/890)
- \[[`a8a0d12875`](nodejs/node@a8a0d12875)] - **(CVE-2026-48937)** **deps**: fix integration issues with the latest nghttp2 (Tim Perry) [#&#8203;62891](nodejs/node#62891)
- \[[`66e6203c1c`](nodejs/node@66e6203c1c)] - **(SEMVER-MAJOR)** **deps**: update nghttp2 to 1.69.0 (Node.js GitHub Bot) [#&#8203;62891](nodejs/node#62891)
- \[[`dd627ced27`](nodejs/node@dd627ced27)] - **deps**: update archs files for openssl-3.5.7 (Node.js GitHub Bot) [#&#8203;63820](nodejs/node#63820)
- \[[`684bae568f`](nodejs/node@684bae568f)] - **deps**: upgrade openssl sources to openssl-3.5.7 (Node.js GitHub Bot) [#&#8203;63820](nodejs/node#63820)
- \[[`3a631e7f83`](nodejs/node@3a631e7f83)] - **deps**: fix aix implicit declaration in OpenSSL (Abdirahim Musse) [#&#8203;62656](nodejs/node#62656)
- \[[`cf44df3996`](nodejs/node@cf44df3996)] - **deps**: update undici to 7.28.0 (Node.js GitHub Bot) [#&#8203;63703](nodejs/node#63703)
- \[[`138c70294b`](nodejs/node@138c70294b)] - **(CVE-2026-48930)** **dns,net**: reject hostnames with embedded NUL bytes (Matteo Collina) [nodejs-private/node-private#868](https://github.com/nodejs-private/node-private/pull/868)
- \[[`be7e719c3f`](nodejs/node@be7e719c3f)] - **(CVE-2026-48931)** **http**: fix response queue poisoning in http.Agent (Matteo Collina) [nodejs-private/node-private#846](https://github.com/nodejs-private/node-private/pull/846)
- \[[`cc7c11b4d1`](nodejs/node@cc7c11b4d1)] - **(CVE-2026-48619)** **http2**: cap originSet size to prevent unbounded memory growth (Matteo Collina) [nodejs-private/node-private#855](https://github.com/nodejs-private/node-private/pull/855)
- \[[`9224427b92`](nodejs/node@9224427b92)] - **(CVE-2026-48615)** **lib,test**: redact proxy credentials in tunnel errors (Matteo Collina) [nodejs-private/node-private#867](https://github.com/nodejs-private/node-private/pull/867)
- \[[`cf85d54839`](nodejs/node@cf85d54839)] - **(CVE-2026-48935)** **permission**: disable FileHandle utimes with permission model (RafaelGSS) [nodejs-private/node-private#873](https://github.com/nodejs-private/node-private/pull/873)
- \[[`a1bbc24f96`](nodejs/node@a1bbc24f96)] - **(CVE-2026-48617)** **permission**: handle process.chdir on writereport (RafaelGSS) [nodejs-private/node-private#870](https://github.com/nodejs-private/node-private/pull/870)
- \[[`e3723ff2d6`](nodejs/node@e3723ff2d6)] - **test**: add session reuse host verification regressions (Matteo Collina) [nodejs-private/node-private#854](https://github.com/nodejs-private/node-private/pull/854)
- \[[`a77af4867b`](nodejs/node@a77af4867b)] - **(CVE-2026-48934)** **tls**: bind reusable sessions to authenticated host (Matteo Collina) [nodejs-private/node-private#854](https://github.com/nodejs-private/node-private/pull/854)
- \[[`31beb4f707`](nodejs/node@31beb4f707)] - **(CVE-2026-48928)** **tls**: fix case-sensitive SNI context matching (Matteo Collina) [nodejs-private/node-private#857](https://github.com/nodejs-private/node-private/pull/857)
- \[[`8e75c73f91`](nodejs/node@8e75c73f91)] - **(CVE-2026-48618)** **tls**: normalize hostname for server identity checks (Matteo Collina) [nodejs-private/node-private#869](https://github.com/nodejs-private/node-private/pull/869)

</details>

---

### Configuration

πŸ“… **Schedule**: (UTC)

- Branch creation
  - At any time (no schedule defined)
- Automerge
  - At any time (no schedule defined)

🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied.

β™» **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

πŸ”• **Ignore**: Close this PR and you won't be reminded about this update again.

---

 - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box

---

This PR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4xNzAuMTkiLCJ1cGRhdGVkSW5WZXIiOiI0My4xNzAuMTkiLCJ0YXJnZXRCcmFuY2giOiJtYWluIiwibGFiZWxzIjpbXX0=-->

Reviewed-on: https://git.walbeck.it/mwalbeck/docker-cyberchef/pulls/488
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

commit-queue-squash Add this label to instruct the Commit Queue to squash all the PR commits into the first one. needs-ci PRs that need a full CI run. test_runner Issues and PRs related to the test runner subsystem.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

test_runner: infinite loop in FileTest#drainRawBuffer when child stdout contains FF 0F followed by large size bytes

7 participants