crypto: use EVP_MAC for HMAC on OpenSSL >=3 by panva · Pull Request #63942 · nodejs/node

panva · 2026-06-16T13:19:28Z

Use OpenSSL 3 provider-backed EVP_MAC APIs for HMAC when available, while keeping the existing HMAC_* implementation around for OpenSSL 1.1.1 and BoringSSL compatibility. Provider fetch/setup failures on OpenSSL 3 surface as HMAC initialization failures instead of falling back to deprecated HMAC_* APIs.

Closes: nodejs#59493 Signed-off-by: Filip Skokan <panva.ip@gmail.com>

nodejs-github-bot · 2026-06-16T13:19:33Z

Review requested:

@nodejs/crypto
@nodejs/security-wg

panva · 2026-06-16T14:06:58Z

https://ci.nodejs.org/view/Node.js%20benchmark/job/benchmark-node-micro-benchmarks/1872/

The EVP_MAC path shows a statistically significant HMAC construction slowdown
in this run, around 4.5% across the createHmac() configurations. That's construction, but then HMAC throughput and WebCrypto HMAC are mostly flat.

nodejs-github-bot · 2026-06-18T08:45:34Z

CI: https://ci.nodejs.org/job/node-test-pull-request/74230/

nodejs-github-bot · 2026-06-19T07:50:59Z

Landed in 8fa5954

Closes: #59493 Signed-off-by: Filip Skokan <panva.ip@gmail.com> PR-URL: #63942 Fixes: #59493 Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com> Reviewed-By: James M Snell <jasnell@gmail.com>

This PR contains the following updates: | Package | Update | Change | |---|---|---| | [node](https://hub.docker.com/_/node) ([source](https://github.com/nodejs/node)) | minor | `24.18.1-alpine` → `24.19.0-alpine` | --- > ⚠️ **Warning** > > Some dependencies could not be looked up. Check the [Dependency Dashboard](issues/107) for more information. --- ### Release Notes <details> <summary>nodejs/node (node)</summary> ### [`v24.19.0`](https://github.com/nodejs/node/releases/tag/v24.19.0): 2026-08-03, Version 24.19.0 'Krypton' (LTS), @aduh95 [Compare Source](https://github.com/nodejs/node/compare/v24.18.1...v24.19.0) ##### Notable Changes - \[[`d08872b530`](https://github.com/nodejs/node/commit/d08872b530)] - **(SEMVER-MINOR)** **buffer**: implement `blob.textStream()` (Matthew Aitken) [#64036](https://github.com/nodejs/node/pull/64036) - \[[`35222948be`](https://github.com/nodejs/node/commit/35222948be)] - **(SEMVER-MINOR)** **deps**: update OpenSSL build config to support compression (Tim Perry) [#62217](https://github.com/nodejs/node/pull/62217) - \[[`d6ab039f24`](https://github.com/nodejs/node/commit/d6ab039f24)] - **(SEMVER-MINOR)** **doc**: update `blockList` stability status to release candidate (alphaleadership) [#63050](https://github.com/nodejs/node/pull/63050) - \[[`1da05fb79d`](https://github.com/nodejs/node/commit/1da05fb79d)] - **doc**: mark `stream.compose` stable (Matteo Collina) [#62562](https://github.com/nodejs/node/pull/62562) - \[[`3c1636dabf`](https://github.com/nodejs/node/commit/3c1636dabf)] - **(SEMVER-MINOR)** **esm**: add `--experimental-import-text` flag (Efe) [#62300](https://github.com/nodejs/node/pull/62300) - \[[`e323e877be`](https://github.com/nodejs/node/commit/e323e877be)] - **(SEMVER-MINOR)** **fs**: support caller-supplied `readFile()` buffers (Matteo Collina) [#63634](https://github.com/nodejs/node/pull/63634) - \[[`c1248c9544`](https://github.com/nodejs/node/commit/c1248c9544)] - **(SEMVER-MINOR)** **http**: add `httpValidation` option to configure header value validation (RajeshKumar11) [#61597](https://github.com/nodejs/node/pull/61597) - \[[`a534b65815`](https://github.com/nodejs/node/commit/a534b65815)] - **(SEMVER-MINOR)** **net**: support `TCP_KEEPINTVL` and `TCP_KEEPCNT` in `setKeepAlive` (Guy Bedford) [#63825](https://github.com/nodejs/node/pull/63825) - \[[`a23cdec683`](https://github.com/nodejs/node/commit/a23cdec683)] - **(SEMVER-MINOR)** **perf\_hooks**: sample delay per event loop iteration (Pablo Erhard) [#62935](https://github.com/nodejs/node/pull/62935) - \[[`7428b57a37`](https://github.com/nodejs/node/commit/7428b57a37)] - **(SEMVER-MINOR)** **src**: allow empty `--experimental-config-file` (Marco Ippolito) [#61610](https://github.com/nodejs/node/pull/61610) - \[[`e57597173c`](https://github.com/nodejs/node/commit/e57597173c)] - **(SEMVER-MINOR)** **stream**: expose `ReadableStreamTee` (Matteo Collina) [#64195](https://github.com/nodejs/node/pull/64195) - \[[`5396235993`](https://github.com/nodejs/node/commit/5396235993)] - **(SEMVER-MINOR)** **tls**: report negotiated TLS groups (Filip Skokan) [#64119](https://github.com/nodejs/node/pull/64119) - \[[`5e901b5cd9`](https://github.com/nodejs/node/commit/5e901b5cd9)] - **(SEMVER-MINOR)** **tls**: add `certificateCompression` option (Tim Perry) [#62217](https://github.com/nodejs/node/pull/62217) ##### Commits - \[[`676467fa9f`](https://github.com/nodejs/node/commit/676467fa9f)] - **benchmark**: trim down the argon2 sets (Filip Skokan) [#64218](https://github.com/nodejs/node/pull/64218) - \[[`a77a2000b7`](https://github.com/nodejs/node/commit/a77a2000b7)] - **benchmark**: add child\_process async path baselines (Yagiz Nizipli) [#63929](https://github.com/nodejs/node/pull/63929) - \[[`dd4482e915`](https://github.com/nodejs/node/commit/dd4482e915)] - **buffer**: remove unreachable overflow check in atob (haramjeong) [#60161](https://github.com/nodejs/node/pull/60161) - \[[`081c41eb86`](https://github.com/nodejs/node/commit/081c41eb86)] - **buffer**: add fast api for isUtf8 and isAscii (Gürgün Dayıoğlu) [#64169](https://github.com/nodejs/node/pull/64169) - \[[`d08872b530`](https://github.com/nodejs/node/commit/d08872b530)] - **(SEMVER-MINOR)** **buffer**: implement blob.textStream() (Matthew Aitken) [#64036](https://github.com/nodejs/node/pull/64036) - \[[`6e2f7e6013`](https://github.com/nodejs/node/commit/6e2f7e6013)] - **build**: remove redundant intermediate node\_aix\_shared (Chengzhong Wu) [#63747](https://github.com/nodejs/node/pull/63747) - \[[`87e0675f51`](https://github.com/nodejs/node/commit/87e0675f51)] - **build**: build codecache and snapshot with libnode (Chengzhong Wu) [#63626](https://github.com/nodejs/node/pull/63626) - \[[`32174a7bae`](https://github.com/nodejs/node/commit/32174a7bae)] - **build**: support setting an emulator from configure script (Ivan Trubach) [#53899](https://github.com/nodejs/node/pull/53899) - \[[`69cfb2f240`](https://github.com/nodejs/node/commit/69cfb2f240)] - **build**: remove duplicated node\_use\_sqlite and node\_use\_ffi conditions (Chengzhong Wu) [#63629](https://github.com/nodejs/node/pull/63629) - \[[`37ac6e8cb5`](https://github.com/nodejs/node/commit/37ac6e8cb5)] - **build**: add manually-dispatched stress-test workflow (Joyee Cheung) [#64118](https://github.com/nodejs/node/pull/64118) - \[[`2424207191`](https://github.com/nodejs/node/commit/2424207191)] - **build**: suppress compiler warnings for histogram (Richard Lau) [#63980](https://github.com/nodejs/node/pull/63980) - \[[`63502b7404`](https://github.com/nodejs/node/commit/63502b7404)] - **build,win**: fix VS2022 arm64 PGO build (Stefan Stojanovic) [#63413](https://github.com/nodejs/node/pull/63413) - \[[`fe4e4055d0`](https://github.com/nodejs/node/commit/fe4e4055d0)] - **child\_process**: fix permission model propagation via NODE\_OPTIONS (Matteo Collina) [#63972](https://github.com/nodejs/node/pull/63972) - \[[`aa2f3c066e`](https://github.com/nodejs/node/commit/aa2f3c066e)] - **child\_process**: pass spawn options to the binding positionally (Yagiz Nizipli) [#63930](https://github.com/nodejs/node/pull/63930) - \[[`fcf32cf77a`](https://github.com/nodejs/node/commit/fcf32cf77a)] - **child\_process**: serialize advanced IPC messages natively (Yagiz Nizipli) [#63933](https://github.com/nodejs/node/pull/63933) - \[[`7907134734`](https://github.com/nodejs/node/commit/7907134734)] - **crypto**: reject small-order EdDSA points during verify (Filip Skokan) [#64026](https://github.com/nodejs/node/pull/64026) - \[[`b505cd5465`](https://github.com/nodejs/node/commit/b505cd5465)] - **crypto**: support non-byte WebCrypto lengths and cSHAKE (Filip Skokan) [#63988](https://github.com/nodejs/node/pull/63988) - \[[`0f54a872e2`](https://github.com/nodejs/node/commit/0f54a872e2)] - **crypto**: share WebCrypto method and usage helpers (Filip Skokan) [#63975](https://github.com/nodejs/node/pull/63975) - \[[`824ec11c05`](https://github.com/nodejs/node/commit/824ec11c05)] - **crypto**: refactor keyObject.toCryptoKey() and SubtleCrypto.getPublicKey() (Filip Skokan) [#63622](https://github.com/nodejs/node/pull/63622) - \[[`73aba92689`](https://github.com/nodejs/node/commit/73aba92689)] - **crypto**: coerce -0 to +0 before native calls (Filip Skokan) [#63556](https://github.com/nodejs/node/pull/63556) - \[[`c83b79874e`](https://github.com/nodejs/node/commit/c83b79874e)] - **crypto**: reject invalid raw key imports (Filip Skokan) [#63134](https://github.com/nodejs/node/pull/63134) - \[[`934fda64b9`](https://github.com/nodejs/node/commit/934fda64b9)] - **crypto**: improve accuracy of SubtleCrypto.supports (Filip Skokan) [#63104](https://github.com/nodejs/node/pull/63104) - \[[`e392e1f791`](https://github.com/nodejs/node/commit/e392e1f791)] - **crypto**: fix large DH generator validation (Tobias Nießen) [#64092](https://github.com/nodejs/node/pull/64092) - \[[`e75a363e70`](https://github.com/nodejs/node/commit/e75a363e70)] - **crypto**: use EVP\_MAC for HMAC on OpenSSL >=3 (Filip Skokan) [#63942](https://github.com/nodejs/node/pull/63942) - \[[`adbaf7af9b`](https://github.com/nodejs/node/commit/adbaf7af9b)] - **crypto**: make webcrypto aliasKeyFormat directional (Filip Skokan) [#63910](https://github.com/nodejs/node/pull/63910) - \[[`bb1aea8897`](https://github.com/nodejs/node/commit/bb1aea8897)] - **crypto**: fix unhandled error in Hash.\_transform (Haram Jeong) [#63261](https://github.com/nodejs/node/pull/63261) - \[[`12c87732c1`](https://github.com/nodejs/node/commit/12c87732c1)] - **crypto**: handle cipher context allocation failures (Tian Teng) [#63542](https://github.com/nodejs/node/pull/63542) - \[[`858496b453`](https://github.com/nodejs/node/commit/858496b453)] - **crypto**: deduplicate X509 subject matching logic (Tobias Nießen) [#63644](https://github.com/nodejs/node/pull/63644) - \[[`9a29cb0964`](https://github.com/nodejs/node/commit/9a29cb0964)] - **crypto**: fix warnings in test\_node\_crypto.cc (Maya Lekova) [#63490](https://github.com/nodejs/node/pull/63490) - \[[`8bb536066d`](https://github.com/nodejs/node/commit/8bb536066d)] - **crypto**: optimize normalizeAlgorithm dispatch hot path (Filip Skokan) [#62756](https://github.com/nodejs/node/pull/62756) - \[[`329e5496ff`](https://github.com/nodejs/node/commit/329e5496ff)] - **crypto,tls**: do not ignore BN\_get\_word error (Tobias Nießen) [#63895](https://github.com/nodejs/node/pull/63895) - \[[`97b7a3f9c7`](https://github.com/nodejs/node/commit/97b7a3f9c7)] - **debugger**: add --max-hit option to probe mode (Joyee Cheung) [#63704](https://github.com/nodejs/node/pull/63704) - \[[`9098585c5e`](https://github.com/nodejs/node/commit/9098585c5e)] - **debugger**: add more logs to probe mode (Joyee Cheung) [#63663](https://github.com/nodejs/node/pull/63663) - \[[`59cca26cd5`](https://github.com/nodejs/node/commit/59cca26cd5)] - **debugger**: surface inspector failures in probe mode (Joyee Cheung) [#63437](https://github.com/nodejs/node/pull/63437) - \[[`2922290eae`](https://github.com/nodejs/node/commit/2922290eae)] - **debugger**: disambiguate probe location binding (Joyee Cheung) [#63286](https://github.com/nodejs/node/pull/63286) - \[[`6fb2c2c7e2`](https://github.com/nodejs/node/commit/6fb2c2c7e2)] - **debugger**: lazily wait for initial break output (Trivikram Kamat) [#63969](https://github.com/nodejs/node/pull/63969) - \[[`688e792551`](https://github.com/nodejs/node/commit/688e792551)] - **debugger**: defer probe pause handling until startup (Trivikram Kamat) [#63608](https://github.com/nodejs/node/pull/63608) - \[[`1ac93cc05a`](https://github.com/nodejs/node/commit/1ac93cc05a)] - **debugger**: await initialization after run and restart (Trivikram Kamat) [#63607](https://github.com/nodejs/node/pull/63607) - \[[`92a909cf72`](https://github.com/nodejs/node/commit/92a909cf72)] - **debugger,test**: deflake resume failure test and add debug logs (Joyee Cheung) [#63524](https://github.com/nodejs/node/pull/63524) - \[[`8b37af8b11`](https://github.com/nodejs/node/commit/8b37af8b11)] - **deps**: V8: backport [`bef0d9c`](https://github.com/nodejs/node/commit/bef0d9c1bc90) (Joyee Cheung) [#62132](https://github.com/nodejs/node/pull/62132) - \[[`8832126422`](https://github.com/nodejs/node/commit/8832126422)] - **deps**: V8: cherry-pick [`64b36b4`](https://github.com/nodejs/node/commit/64b36b441179) (Dan Carney) [#61712](https://github.com/nodejs/node/pull/61712) - \[[`75990c2cd6`](https://github.com/nodejs/node/commit/75990c2cd6)] - **deps**: update googletest to [`8b53336`](https://github.com/nodejs/node/commit/8b53336594cc52213c6c2c7a0b29194fa896d039) (Node.js GitHub Bot) [#64181](https://github.com/nodejs/node/pull/64181) - \[[`8500c7ba86`](https://github.com/nodejs/node/commit/8500c7ba86)] - **deps**: update sqlite to 3.53.3 (Node.js GitHub Bot) [#64180](https://github.com/nodejs/node/pull/64180) - \[[`dc78091b45`](https://github.com/nodejs/node/commit/dc78091b45)] - **deps**: c-ares: cherry-pick [`8ba37af`](https://github.com/nodejs/node/commit/8ba37af8e3fb) (René) [#64110](https://github.com/nodejs/node/pull/64110) - \[[`873cc72125`](https://github.com/nodejs/node/commit/873cc72125)] - **deps**: update googletest to [`0b1e895`](https://github.com/nodejs/node/commit/0b1e895ba4226c2fda5ee0178c9b5b1195a741aa) (Node.js GitHub Bot) [#64039](https://github.com/nodejs/node/pull/64039) - \[[`1d3d166538`](https://github.com/nodejs/node/commit/1d3d166538)] - **deps**: update acorn to 8.17.0 (Node.js GitHub Bot) [#63901](https://github.com/nodejs/node/pull/63901) - \[[`35222948be`](https://github.com/nodejs/node/commit/35222948be)] - **(SEMVER-MINOR)** **deps**: update OpenSSL build config to support compression (Tim Perry) [#62217](https://github.com/nodejs/node/pull/62217) - \[[`e40cee5f79`](https://github.com/nodejs/node/commit/e40cee5f79)] - **deps**: upgrade npm to 11.17.0 (npm team) [#63857](https://github.com/nodejs/node/pull/63857) - \[[`85c6d46606`](https://github.com/nodejs/node/commit/85c6d46606)] - **deps**: add ngtcp2\_fmt.c to build configuration (ngtcp2.gyp) (沈鸿飞) [#63821](https://github.com/nodejs/node/pull/63821) - \[[`d2ea8b7a8c`](https://github.com/nodejs/node/commit/d2ea8b7a8c)] - **deps**: update googletest to [`7140cd4`](https://github.com/nodejs/node/commit/7140cd416cecd7462a8aae488024abeee55598e4) (Node.js GitHub Bot) [#63775](https://github.com/nodejs/node/pull/63775) - \[[`25b4d57bb6`](https://github.com/nodejs/node/commit/25b4d57bb6)] - **deps**: update sqlite to 3.53.2 (Node.js GitHub Bot) [#63774](https://github.com/nodejs/node/pull/63774) - \[[`a96368e4c7`](https://github.com/nodejs/node/commit/a96368e4c7)] - **deps**: update zlib to 1.3.2.1-motley-3246f1b (Node.js GitHub Bot) [#63773](https://github.com/nodejs/node/pull/63773) - \[[`b59f1f5f37`](https://github.com/nodejs/node/commit/b59f1f5f37)] - **deps**: update amaro to 1.1.10 (Node.js GitHub Bot) [#63670](https://github.com/nodejs/node/pull/63670) - \[[`0b3b56ee95`](https://github.com/nodejs/node/commit/0b3b56ee95)] - **deps**: update googletest to [`8736d2c`](https://github.com/nodejs/node/commit/8736d2cd5c1dcba41170ed2fddca14021d4916c3) (Node.js GitHub Bot) [#63669](https://github.com/nodejs/node/pull/63669) - \[[`aa67b5b9c4`](https://github.com/nodejs/node/commit/aa67b5b9c4)] - **dgram**: add synchronous Socket connectSync() (Guy Bedford) [#63932](https://github.com/nodejs/node/pull/63932) - \[[`ef38374875`](https://github.com/nodejs/node/commit/ef38374875)] - **dgram**: add synchronous Socket.prototype.bindSync() (Guy Bedford) [#63838](https://github.com/nodejs/node/pull/63838) - \[[`6edc3a9967`](https://github.com/nodejs/node/commit/6edc3a9967)] - **dgram**: skip dns.lookup() for literal IP addresses (Ruben Bridgewater) [#64133](https://github.com/nodejs/node/pull/64133) - \[[`d4cfe2d8ac`](https://github.com/nodejs/node/commit/d4cfe2d8ac)] - **dns**: coerce -0 to +0 in lookup and resolver inputs (Filip Skokan) [#63556](https://github.com/nodejs/node/pull/63556) - \[[`91c9ce5a45`](https://github.com/nodejs/node/commit/91c9ce5a45)] - **doc**: improve `fs.StatFs` properties descriptions (aymanxdev) [#62578](https://github.com/nodejs/node/pull/62578) - \[[`54e21675fa`](https://github.com/nodejs/node/commit/54e21675fa)] - **doc**: fix inconsistencies in CJS code snippets (Antoine du Hamel) [#63199](https://github.com/nodejs/node/pull/63199) - \[[`64c23daa76`](https://github.com/nodejs/node/commit/64c23daa76)] - **doc**: remove typo comma from man page (Vas Sudanagunta) [#63080](https://github.com/nodejs/node/pull/63080) - \[[`bc943cd34a`](https://github.com/nodejs/node/commit/bc943cd34a)] - **doc**: update Http2SecureServer.on("timeout") default value (YuSheng Chen) [#64187](https://github.com/nodejs/node/pull/64187) - \[[`a46bc452a6`](https://github.com/nodejs/node/commit/a46bc452a6)] - **doc**: add note on visibility of CI failures to new contributor guide (Stewart X Addison) [#64256](https://github.com/nodejs/node/pull/64256) - \[[`c0fb52506c`](https://github.com/nodejs/node/commit/c0fb52506c)] - **doc**: clarify HTTP/1.1 response ordering (Matteo Collina) [#64213](https://github.com/nodejs/node/pull/64213) - \[[`d3073a7ba6`](https://github.com/nodejs/node/commit/d3073a7ba6)] - **doc**: recommend node-stress-single-test for flaky tests (Trivikram Kamat) [#64223](https://github.com/nodejs/node/pull/64223) - \[[`bb9951ead0`](https://github.com/nodejs/node/commit/bb9951ead0)] - **doc**: fix typo in examples (Vas Sudanagunta) [#64184](https://github.com/nodejs/node/pull/64184) - \[[`fe674e96fc`](https://github.com/nodejs/node/commit/fe674e96fc)] - **doc**: clarify defense-in-depth issues (Matteo Collina) [#64215](https://github.com/nodejs/node/pull/64215) - \[[`faad042184`](https://github.com/nodejs/node/commit/faad042184)] - **doc**: add guide and answers to FAQs for first-time contributors (Joyee Cheung) [#63685](https://github.com/nodejs/node/pull/63685) - \[[`79d685adf3`](https://github.com/nodejs/node/commit/79d685adf3)] - **doc**: update `Http2Server.close` & `Http2SecureServer.close` (YuSheng Chen) [#63298](https://github.com/nodejs/node/pull/63298) - \[[`744e40e05e`](https://github.com/nodejs/node/commit/744e40e05e)] - **doc**: update list of people in `SECURITY.md` (Richard Lau) [#64152](https://github.com/nodejs/node/pull/64152) - \[[`185f57c4a4`](https://github.com/nodejs/node/commit/185f57c4a4)] - **doc**: add missing option to man page (Richard Lau) [#64156](https://github.com/nodejs/node/pull/64156) - \[[`8933303568`](https://github.com/nodejs/node/commit/8933303568)] - **doc**: fix callback example import in fs docs (Kamal Rawal) [#63912](https://github.com/nodejs/node/pull/63912) - \[[`3a0549dacb`](https://github.com/nodejs/node/commit/3a0549dacb)] - **doc**: fix keepAliveTimeout default in http.createServer options (Jahanzaib iqbal) [#63974](https://github.com/nodejs/node/pull/63974) - \[[`5a35e48d08`](https://github.com/nodejs/node/commit/5a35e48d08)] - **doc**: add sxa GPG key ([`ed25519`](https://github.com/nodejs/node/commit/ed25519)) (Stewart X Addison) [#64193](https://github.com/nodejs/node/pull/64193) - \[[`66e7f815f1`](https://github.com/nodejs/node/commit/66e7f815f1)] - **doc**: add aduh95 to last security release steward (Antoine du Hamel) [#63981](https://github.com/nodejs/node/pull/63981) - \[[`a7e35040dd`](https://github.com/nodejs/node/commit/a7e35040dd)] - **doc**: fix typo in util.md (Daijiro Wachi) [#63961](https://github.com/nodejs/node/pull/63961) - \[[`d74b3a7e90`](https://github.com/nodejs/node/commit/d74b3a7e90)] - **doc**: clarify callback exceptions (Matteo Collina) [#63939](https://github.com/nodejs/node/pull/63939) - \[[`b7a8f8fabd`](https://github.com/nodejs/node/commit/b7a8f8fabd)] - **doc**: fix incorrect test runner mock examples (Kimaswa Emmanuel Yusufu) [#63656](https://github.com/nodejs/node/pull/63656) - \[[`f11aa690cd`](https://github.com/nodejs/node/commit/f11aa690cd)] - **doc**: fix typo in cli.md (Daijiro Wachi) [#63883](https://github.com/nodejs/node/pull/63883) - \[[`df85f50269`](https://github.com/nodejs/node/commit/df85f50269)] - **doc**: fix typo in vm.md (Daijiro Wachi) [#63881](https://github.com/nodejs/node/pull/63881) - \[[`a00a567175`](https://github.com/nodejs/node/commit/a00a567175)] - **doc**: fix typo in packages.md (Daijiro Wachi) [#63882](https://github.com/nodejs/node/pull/63882) - \[[`206c1b8437`](https://github.com/nodejs/node/commit/206c1b8437)] - **doc**: fix a/an article typos in module, util, and dns (Daijiro Wachi) [#63766](https://github.com/nodejs/node/pull/63766) - \[[`e3e5ef1cff`](https://github.com/nodejs/node/commit/e3e5ef1cff)] - **doc**: update npm supported versions link (hojeong park) [#63672](https://github.com/nodejs/node/pull/63672) - \[[`e3c4852413`](https://github.com/nodejs/node/commit/e3c4852413)] - **doc**: fix AES-OCB IV length in SubtleCrypto.supports example (Anshika Jain) [#63717](https://github.com/nodejs/node/pull/63717) - \[[`0b3fbc82d7`](https://github.com/nodejs/node/commit/0b3fbc82d7)] - **doc**: add webstreams to args for `pipeline` from `stream/promises` (David Sanders) [#63628](https://github.com/nodejs/node/pull/63628) - \[[`62078a8328`](https://github.com/nodejs/node/commit/62078a8328)] - **doc**: fix "used to sent" → "used to send" in http2 (Daijiro Wachi) [#63700](https://github.com/nodejs/node/pull/63700) - \[[`fd74eefb23`](https://github.com/nodejs/node/commit/fd74eefb23)] - **doc**: clarify tty raw mode applies to input processing only (Muhammad Zeeshan) [#63438](https://github.com/nodejs/node/pull/63438) - \[[`42cd7e47de`](https://github.com/nodejs/node/commit/42cd7e47de)] - **doc**: add worker\_threads history entries (Bob Put) [#63545](https://github.com/nodejs/node/pull/63545) - \[[`d6ab039f24`](https://github.com/nodejs/node/commit/d6ab039f24)] - **(SEMVER-MINOR)** **doc**: update `blockList` stability status to release candidate (alphaleadership) [#63050](https://github.com/nodejs/node/pull/63050) - \[[`56bdd87378`](https://github.com/nodejs/node/commit/56bdd87378)] - **doc**: move hyperlinks outside of text blocks (Aviv Keller) [#63493](https://github.com/nodejs/node/pull/63493) - \[[`1da05fb79d`](https://github.com/nodejs/node/commit/1da05fb79d)] - **doc**: mark stream.compose stable (Matteo Collina) [#62562](https://github.com/nodejs/node/pull/62562) - \[[`7bb6dab70c`](https://github.com/nodejs/node/commit/7bb6dab70c)] - **doc,crypto**: mark argon2 and encap/decap as stable (Filip Skokan) [#63924](https://github.com/nodejs/node/pull/63924) - \[[`1a4edb3c22`](https://github.com/nodejs/node/commit/1a4edb3c22)] - **doc,lib**: align WebCrypto names with spec (Filip Skokan) [#63518](https://github.com/nodejs/node/pull/63518) - \[[`3c1636dabf`](https://github.com/nodejs/node/commit/3c1636dabf)] - **(SEMVER-MINOR)** **esm**: add `--experimental-import-text` flag (Efe) [#62300](https://github.com/nodejs/node/pull/62300) - \[[`e0f211ca79`](https://github.com/nodejs/node/commit/e0f211ca79)] - **events**: improve `addAbortListener` perf by caching options object (Raz Luvaton) [#52367](https://github.com/nodejs/node/pull/52367) - \[[`a124429b36`](https://github.com/nodejs/node/commit/a124429b36)] - **fs**: do not treat EPERM as ENOTEMPTY on Windows (Kirill Saied) [#63709](https://github.com/nodejs/node/pull/63709) - \[[`e323e877be`](https://github.com/nodejs/node/commit/e323e877be)] - **(SEMVER-MINOR)** **fs**: support caller-supplied readFile() buffers (Matteo Collina) [#63634](https://github.com/nodejs/node/pull/63634) - \[[`a41b4824d7`](https://github.com/nodejs/node/commit/a41b4824d7)] - **fs**: prevent spurious recursive watch events on prefix siblings (Marco) [#63095](https://github.com/nodejs/node/pull/63095) - \[[`c63e00e3a5`](https://github.com/nodejs/node/commit/c63e00e3a5)] - **fs**: ignore deleted dirs in recursive watch scan (Trivikram Kamat) [#63686](https://github.com/nodejs/node/pull/63686) - \[[`d3d7cd05e3`](https://github.com/nodejs/node/commit/d3d7cd05e3)] - **fs**: coerce -0 to +0 in mode flags and watch intervals (Filip Skokan) [#63556](https://github.com/nodejs/node/pull/63556) - \[[`6f6387ecb3`](https://github.com/nodejs/node/commit/6f6387ecb3)] - **gyp**: update deps gypfiles (Nad Alaba) [#63117](https://github.com/nodejs/node/pull/63117) - \[[`592544af44`](https://github.com/nodejs/node/commit/592544af44)] - **http**: document and validate options.path when it's in absolute-form (Joyee Cheung) [#64108](https://github.com/nodejs/node/pull/64108) - \[[`c1248c9544`](https://github.com/nodejs/node/commit/c1248c9544)] - **(SEMVER-MINOR)** **http**: add httpValidation option to configure header value validation (RajeshKumar11) [#61597](https://github.com/nodejs/node/pull/61597) - \[[`85a223bf15`](https://github.com/nodejs/node/commit/85a223bf15)] - **http**: fix drain event with cork/uncork (David Evans) [#64038](https://github.com/nodejs/node/pull/64038) - \[[`8b060a9628`](https://github.com/nodejs/node/commit/8b060a9628)] - **inspector**: fix crash when writing to closed inspector socket (ympark2011) [#64209](https://github.com/nodejs/node/pull/64209) - \[[`e68a3d33ac`](https://github.com/nodejs/node/commit/e68a3d33ac)] - **inspector**: fix inspector.close() documented behavior (Chengzhong Wu) [#63837](https://github.com/nodejs/node/pull/63837) - \[[`d3682930b7`](https://github.com/nodejs/node/commit/d3682930b7)] - **lib**: fix missing lazyDOMException import (Filip Skokan) [#64033](https://github.com/nodejs/node/pull/64033) - \[[`af9ea9cfcf`](https://github.com/nodejs/node/commit/af9ea9cfcf)] - **lib**: reject string "0" in validatePort when allowZero is false (Daijiro Wachi) [#64174](https://github.com/nodejs/node/pull/64174) - \[[`cd1ea26110`](https://github.com/nodejs/node/commit/cd1ea26110)] - **lib**: use `__proto__: null` when calling `ObjectDefineProperty` (Antoine du Hamel) [#64239](https://github.com/nodejs/node/pull/64239) - \[[`5b264398ce`](https://github.com/nodejs/node/commit/5b264398ce)] - **lib**: lazily initialize kEvents and kHandlers maps (Guilherme Araújo) [#63702](https://github.com/nodejs/node/pull/63702) - \[[`823efe8c71`](https://github.com/nodejs/node/commit/823efe8c71)] - **lib**: improve control abstraction coverage in frozen intrinsics (Renegade334) [#63698](https://github.com/nodejs/node/pull/63698) - \[[`7f4af5568f`](https://github.com/nodejs/node/commit/7f4af5568f)] - **lib**: add Iterator global to primordials (Renegade334) [#63698](https://github.com/nodejs/node/pull/63698) - \[[`c8f3f5e5a5`](https://github.com/nodejs/node/commit/c8f3f5e5a5)] - **lib**: make `Navigator#language` getter throw on invalid `this` (Mohamed Sayed) [#63601](https://github.com/nodejs/node/pull/63601) - \[[`1ebbbd59cf`](https://github.com/nodejs/node/commit/1ebbbd59cf)] - **lib**: optimize webidl conversion options (Filip Skokan) [#62756](https://github.com/nodejs/node/pull/62756) - \[[`88590d1bb7`](https://github.com/nodejs/node/commit/88590d1bb7)] - **meta**: bump actions/checkout from 6.0.2 to 6.0.3 (dependabot\[bot]) [#63726](https://github.com/nodejs/node/pull/63726) - \[[`0ea9cb9630`](https://github.com/nodejs/node/commit/0ea9cb9630)] - **meta**: bump actions/upload-artifact from 7.0.0 to 7.0.1 (dependabot\[bot]) [#62850](https://github.com/nodejs/node/pull/62850) - \[[`f7275a0864`](https://github.com/nodejs/node/commit/f7275a0864)] - **meta**: fix linter warning in `stale.yml` (Antoine du Hamel) [#64281](https://github.com/nodejs/node/pull/64281) - \[[`3a77d21d8c`](https://github.com/nodejs/node/commit/3a77d21d8c)] - **meta**: bump actions/cache from 5.0.5 to 6.1.0 (dependabot\[bot]) [#64248](https://github.com/nodejs/node/pull/64248) - \[[`84e2836c95`](https://github.com/nodejs/node/commit/84e2836c95)] - **meta**: bump github/codeql-action/autobuild from 4.36.1 to 4.36.2 (dependabot\[bot]) [#64247](https://github.com/nodejs/node/pull/64247) - \[[`09f800eec6`](https://github.com/nodejs/node/commit/09f800eec6)] - **meta**: bump github/codeql-action/analyze from 4.36.1 to 4.36.2 (dependabot\[bot]) [#64246](https://github.com/nodejs/node/pull/64246) - \[[`6df1f97e64`](https://github.com/nodejs/node/commit/6df1f97e64)] - **meta**: bump codecov/codecov-action from 6.0.1 to 7.0.0 (dependabot\[bot]) [#64244](https://github.com/nodejs/node/pull/64244) - \[[`737eb89651`](https://github.com/nodejs/node/commit/737eb89651)] - **meta**: bump rtCamp/action-slack-notify from 2.3.3 to 2.4.0 (dependabot\[bot]) [#64243](https://github.com/nodejs/node/pull/64243) - \[[`dac3cd8b8f`](https://github.com/nodejs/node/commit/dac3cd8b8f)] - **meta**: bump github/codeql-action/init from 4.36.1 to 4.36.2 (dependabot\[bot]) [#64242](https://github.com/nodejs/node/pull/64242) - \[[`108a6bc481`](https://github.com/nodejs/node/commit/108a6bc481)] - **meta**: bump github/codeql-action/upload-sarif from 4.36.1 to 4.36.2 (dependabot\[bot]) [#64240](https://github.com/nodejs/node/pull/64240) - \[[`34d09a725d`](https://github.com/nodejs/node/commit/34d09a725d)] - **meta**: clarify V8 flags are outside threat model (Matteo Collina) [#64224](https://github.com/nodejs/node/pull/64224) - \[[`944d9bc25f`](https://github.com/nodejs/node/commit/944d9bc25f)] - **meta**: move one or more collaborators to emeritus (Node.js GitHub Bot) [#64057](https://github.com/nodejs/node/pull/64057) - \[[`cc22555402`](https://github.com/nodejs/node/commit/cc22555402)] - **meta**: update status of past strategic initiatives (Joyee Cheung) [#63480](https://github.com/nodejs/node/pull/63480) - \[[`da7a21931e`](https://github.com/nodejs/node/commit/da7a21931e)] - **meta**: speed up stale bot (Aviv Keller) [#64075](https://github.com/nodejs/node/pull/64075) - \[[`7bfcf7ca56`](https://github.com/nodejs/node/commit/7bfcf7ca56)] - **meta**: bump github/codeql-action from 4.35.3 to 4.36.1 (dependabot\[bot]) [#63724](https://github.com/nodejs/node/pull/63724) - \[[`db6c983cdd`](https://github.com/nodejs/node/commit/db6c983cdd)] - **meta**: bump actions/cache from 5.0.4 to 5.0.5 (dependabot\[bot]) [#62847](https://github.com/nodejs/node/pull/62847) - \[[`9e4f1339d1`](https://github.com/nodejs/node/commit/9e4f1339d1)] - **meta**: bump codecov/codecov-action from 6.0.0 to 6.0.1 (dependabot\[bot]) [#63725](https://github.com/nodejs/node/pull/63725) - \[[`92c98d3ade`](https://github.com/nodejs/node/commit/92c98d3ade)] - **meta**: bump actions/stale from 10.2.0 to 10.3.0 (dependabot\[bot]) [#63728](https://github.com/nodejs/node/pull/63728) - \[[`bbd3ffde89`](https://github.com/nodejs/node/commit/bbd3ffde89)] - **meta**: bump step-security/harden-runner from 2.19.0 to 2.19.4 (dependabot\[bot]) [#63727](https://github.com/nodejs/node/pull/63727) - \[[`a6dd675c82`](https://github.com/nodejs/node/commit/a6dd675c82)] - **module**: enable import support for addons by default (Chengzhong Wu) [#64221](https://github.com/nodejs/node/pull/64221) - \[[`fb2ccb15a1`](https://github.com/nodejs/node/commit/fb2ccb15a1)] - **module**: use file: URL as sourceURL for type-stripped CommonJS (Joyee Cheung) [#63705](https://github.com/nodejs/node/pull/63705) - \[[`b9e17dc424`](https://github.com/nodejs/node/commit/b9e17dc424)] - **net**: early TCP binding via synchronous net.BoundSocket (Guy Bedford) [#63951](https://github.com/nodejs/node/pull/63951) - \[[`a534b65815`](https://github.com/nodejs/node/commit/a534b65815)] - **(SEMVER-MINOR)** **net**: support TCP\_KEEPINTVL and TCP\_KEEPCNT in setKeepAlive (Guy Bedford) [#63825](https://github.com/nodejs/node/pull/63825) - \[[`c55dd030e6`](https://github.com/nodejs/node/commit/c55dd030e6)] - **net**: coerce -0 to +0 in BlockList prefixes (Filip Skokan) [#63556](https://github.com/nodejs/node/pull/63556) - \[[`a23cdec683`](https://github.com/nodejs/node/commit/a23cdec683)] - **(SEMVER-MINOR)** **perf\_hooks**: sample delay per event loop iteration (Pablo Erhard) [#62935](https://github.com/nodejs/node/pull/62935) - \[[`f08b83bc1d`](https://github.com/nodejs/node/commit/f08b83bc1d)] - **perf\_hooks**: add NODE\_PERFORMANCE\_GC\_MINOR\_MARK\_SWEEP constant (Attila Szegedi) [#63877](https://github.com/nodejs/node/pull/63877) - \[[`8d58e1b415`](https://github.com/nodejs/node/commit/8d58e1b415)] - **process**: fix finalization cleanup ref tracking (Trivikram Kamat) [#64087](https://github.com/nodejs/node/pull/64087) - \[[`c757e3ef59`](https://github.com/nodejs/node/commit/c757e3ef59)] - **sqlite**: do not leave database open after failed open (Yagiz Nizipli) [#63854](https://github.com/nodejs/node/pull/63854) - \[[`87064a096b`](https://github.com/nodejs/node/commit/87064a096b)] - **sqlite**: fix stack-use-after-scope with function callback (ndossche) [#63640](https://github.com/nodejs/node/pull/63640) - \[[`7428b57a37`](https://github.com/nodejs/node/commit/7428b57a37)] - **(SEMVER-MINOR)** **src**: allow empty --experimental-config-file (Marco Ippolito) [#61610](https://github.com/nodejs/node/pull/61610) - \[[`d7946c9c07`](https://github.com/nodejs/node/commit/d7946c9c07)] - **src**: add test flag to config file (Marco Ippolito) [#60798](https://github.com/nodejs/node/pull/60798) - \[[`a642657d71`](https://github.com/nodejs/node/commit/a642657d71)] - **src**: rename config file testRunner to test (Marco Ippolito) [#60798](https://github.com/nodejs/node/pull/60798) - \[[`818b43d09e`](https://github.com/nodejs/node/commit/818b43d09e)] - **src**: do not enable wasm trap handler if there's not enough vmem (Joyee Cheung) [#62132](https://github.com/nodejs/node/pull/62132) - \[[`af5e1a9729`](https://github.com/nodejs/node/commit/af5e1a9729)] - **src**: fix escaping of single quotes in task runner (Antoine du Hamel) [#64089](https://github.com/nodejs/node/pull/64089) - \[[`8a5d3bc168`](https://github.com/nodejs/node/commit/8a5d3bc168)] - **src**: abstract tracing agent for both legacy and perfetto (Chengzhong Wu) [#64053](https://github.com/nodejs/node/pull/64053) - \[[`ce6f29e45b`](https://github.com/nodejs/node/commit/ce6f29e45b)] - **src**: avoid redundant call to `std::get_if<>()` (Tobias Nießen) [#64094](https://github.com/nodejs/node/pull/64094) - \[[`96478050f2`](https://github.com/nodejs/node/commit/96478050f2)] - **src**: omit unconvertible names in cjs\_lexer::Parse (Yagiz Nizipli) [#63943](https://github.com/nodejs/node/pull/63943) - \[[`0147ed746e`](https://github.com/nodejs/node/commit/0147ed746e)] - **src**: guard OpenSSL compression header include (Filip Skokan) [#64009](https://github.com/nodejs/node/pull/64009) - \[[`8d2858a9c4`](https://github.com/nodejs/node/commit/8d2858a9c4)] - **src**: handle empty MaybeLocal in cjs\_lexer::Parse (Yagiz Nizipli) [#63885](https://github.com/nodejs/node/pull/63885) - \[[`e5289d180f`](https://github.com/nodejs/node/commit/e5289d180f)] - **src**: do not track weak `BaseObject`s as childrens of `Realm`s (Anna Henningsen) [#63842](https://github.com/nodejs/node/pull/63842) - \[[`e8352ff754`](https://github.com/nodejs/node/commit/e8352ff754)] - **src**: allow tracking children in `MemoryTracker` with weak edges (Anna Henningsen) [#63842](https://github.com/nodejs/node/pull/63842) - \[[`a408f279c5`](https://github.com/nodejs/node/commit/a408f279c5)] - **src**: use C++14 deprecated attribute for `NODE_DEPRECATED` (Anna Henningsen) [#63755](https://github.com/nodejs/node/pull/63755) - \[[`4b5eb7b72d`](https://github.com/nodejs/node/commit/4b5eb7b72d)] - **src**: add cleanup hooks to `node::ObjectWrap` (Anna Henningsen) [#63642](https://github.com/nodejs/node/pull/63642) - \[[`44976c6071`](https://github.com/nodejs/node/commit/44976c6071)] - **src**: fix edge case when deflateInit2() fails with Z\_VERSION\_ERROR (Nora Dossche) [#63476](https://github.com/nodejs/node/pull/63476) - \[[`5b3bb284f3`](https://github.com/nodejs/node/commit/5b3bb284f3)] - **src**: add Latin1 fast path in StringBytes::Encode utf8 (Mert Can Altin) [#63385](https://github.com/nodejs/node/pull/63385) - \[[`7cdad636c4`](https://github.com/nodejs/node/commit/7cdad636c4)] - **src**: fix crash when reading length on Storage.prototype (Mohamed Sayed) [#63529](https://github.com/nodejs/node/pull/63529) - \[[`c438250c68`](https://github.com/nodejs/node/commit/c438250c68)] - **stream**: cut per-chunk overhead in WHATWG streams (Matteo Collina) [#64252](https://github.com/nodejs/node/pull/64252) - \[[`291c127947`](https://github.com/nodejs/node/commit/291c127947)] - **stream**: reduce allocations on WHATWG streams hot paths (Matteo Collina) [#63876](https://github.com/nodejs/node/pull/63876) - \[[`3d91aeb434`](https://github.com/nodejs/node/commit/3d91aeb434)] - **stream**: optimize pipeTo promise handling (Matteo Collina) [#63572](https://github.com/nodejs/node/pull/63572) - \[[`fcbff00a44`](https://github.com/nodejs/node/commit/fcbff00a44)] - **stream**: preserve half-open duplexes in async iteration (Efe) [#64275](https://github.com/nodejs/node/pull/64275) - \[[`e57597173c`](https://github.com/nodejs/node/commit/e57597173c)] - **(SEMVER-MINOR)** **stream**: expose ReadableStreamTee (Matteo Collina) [#64195](https://github.com/nodejs/node/pull/64195) - \[[`a48edf40e8`](https://github.com/nodejs/node/commit/a48edf40e8)] - **stream**: proxy first own method in Readable.wrap() (Daijiro Wachi) [#64048](https://github.com/nodejs/node/pull/64048) - \[[`f58c5bafcf`](https://github.com/nodejs/node/commit/f58c5bafcf)] - **stream**: fix Writable.toWeb() desiredSize for non-object-mode (Matteo Collina) [#62986](https://github.com/nodejs/node/pull/62986) - \[[`7261276f45`](https://github.com/nodejs/node/commit/7261276f45)] - **stream**: fix Utf8Stream stall after full write of multi-byte data (Daijiro Wachi) [#63964](https://github.com/nodejs/node/pull/63964) - \[[`1558986b78`](https://github.com/nodejs/node/commit/1558986b78)] - **stream**: only pass the expected number of parameters to callbacks (Antoine du Hamel) [#63909](https://github.com/nodejs/node/pull/63909) - \[[`edef89ba6a`](https://github.com/nodejs/node/commit/edef89ba6a)] - **stream**: fix dropped first chunk in Utf8Stream buffer mode (Daijiro Wachi) [#63833](https://github.com/nodejs/node/pull/63833) - \[[`915e3e2f42`](https://github.com/nodejs/node/commit/915e3e2f42)] - **stream**: check done before backpressure in stream reader (Daijiro Wachi) [#63699](https://github.com/nodejs/node/pull/63699) - \[[`2d29628b5b`](https://github.com/nodejs/node/commit/2d29628b5b)] - **test**: update WPT for WebCryptoAPI to [`03a1476`](https://github.com/nodejs/node/commit/03a1476844) (Node.js GitHub Bot) [#63900](https://github.com/nodejs/node/pull/63900) - \[[`89e23b70c4`](https://github.com/nodejs/node/commit/89e23b70c4)] - **test**: deflake test-debugger-probe-timeout (Joyee Cheung) [#63547](https://github.com/nodejs/node/pull/63547) - \[[`54ca514414`](https://github.com/nodejs/node/commit/54ca514414)] - **test**: make blob desiredSize assertion robust (Trivikram Kamat) [#64106](https://github.com/nodejs/node/pull/64106) - \[[`01cbe530eb`](https://github.com/nodejs/node/commit/01cbe530eb)] - **test**: update WPT for urlpattern to [`11a459a`](https://github.com/nodejs/node/commit/11a459a2b1) (Node.js GitHub Bot) [#64037](https://github.com/nodejs/node/pull/64037) - \[[`6fcd3cf516`](https://github.com/nodejs/node/commit/6fcd3cf516)] - **test**: improve lcov reporter snapshot diagnostics (Trivikram Kamat) [#64049](https://github.com/nodejs/node/pull/64049) - \[[`f50a55d7e5`](https://github.com/nodejs/node/commit/f50a55d7e5)] - **test**: keep finalization close fixture ref alive (Trivikram Kamat) [#64085](https://github.com/nodejs/node/pull/64085) - \[[`3085714530`](https://github.com/nodejs/node/commit/3085714530)] - **test**: fix typo from overriden to overridden (parkhojeong) [#63403](https://github.com/nodejs/node/pull/63403) - \[[`9f5347e8df`](https://github.com/nodejs/node/commit/9f5347e8df)] - **test**: mark hr-time WPT flaky on macos15-x64 (Trivikram Kamat) [#64054](https://github.com/nodejs/node/pull/64054) - \[[`44b4fe4246`](https://github.com/nodejs/node/commit/44b4fe4246)] - **test**: use one-off agent in http consumed timeout test (Trivikram Kamat) [#64052](https://github.com/nodejs/node/pull/64052) - \[[`2f567edaca`](https://github.com/nodejs/node/commit/2f567edaca)] - **test**: fix flaky test-runner coverage threshold test (Trivikram Kamat) [#64051](https://github.com/nodejs/node/pull/64051) - \[[`a56fbb2d36`](https://github.com/nodejs/node/commit/a56fbb2d36)] - **test**: tolerate duplicate watch change events (Trivikram Kamat) [#63937](https://github.com/nodejs/node/pull/63937) - \[[`b636f4769c`](https://github.com/nodejs/node/commit/b636f4769c)] - **test**: mark test-debugger-run-after-quit-restart as flaky on macOS (Matteo Collina) [#64006](https://github.com/nodejs/node/pull/64006) - \[[`ba23eb9717`](https://github.com/nodejs/node/commit/ba23eb9717)] - **test**: update WPT for url to [`d4598eb`](https://github.com/nodejs/node/commit/d4598eba09) (Node.js GitHub Bot) [#63899](https://github.com/nodejs/node/pull/63899) - \[[`bc420f20d8`](https://github.com/nodejs/node/commit/bc420f20d8)] - **test**: update WPT for urlpattern to [`23aac92`](https://github.com/nodejs/node/commit/23aac92784) (Node.js GitHub Bot) [#63898](https://github.com/nodejs/node/pull/63898) - \[[`d2c9c07af8`](https://github.com/nodejs/node/commit/d2c9c07af8)] - **test**: add tests for 3 methods in utils (Daijiro Wachi) [#63765](https://github.com/nodejs/node/pull/63765) - \[[`4e00c8ec2e`](https://github.com/nodejs/node/commit/4e00c8ec2e)] - **test**: mark SEA tests flaky on linux arm debug (Trivikram Kamat) [#63743](https://github.com/nodejs/node/pull/63743) - \[[`a17cf06d12`](https://github.com/nodejs/node/commit/a17cf06d12)] - **test**: validate ERR\_INVALID\_THIS for scheduler methods (Daijiro Wachi) [#63764](https://github.com/nodejs/node/pull/63764) - \[[`d59d7fdd16`](https://github.com/nodejs/node/commit/d59d7fdd16)] - **test**: add coverage outside SEA (Daijiro Wachi) [#63744](https://github.com/nodejs/node/pull/63744) - \[[`71a32d31bf`](https://github.com/nodejs/node/commit/71a32d31bf)] - **test**: update WPT for urlpattern to [`2f28df5`](https://github.com/nodejs/node/commit/2f28df545c) (Node.js GitHub Bot) [#63771](https://github.com/nodejs/node/pull/63771) - \[[`28c77ab174`](https://github.com/nodejs/node/commit/28c77ab174)] - **test**: make Brotli 16GB test wait for backpressure (Trivikram Kamat) [#63389](https://github.com/nodejs/node/pull/63389) - \[[`9a81921d4a`](https://github.com/nodejs/node/commit/9a81921d4a)] - **test**: add regression test for using `ObjectWrap` in worker (Mohamed Akram) [#63642](https://github.com/nodejs/node/pull/63642) - \[[`88ab61f2f8`](https://github.com/nodejs/node/commit/88ab61f2f8)] - **test**: accept SIGILL aborts in async-hooks tests (Trivikram Kamat) [#63687](https://github.com/nodejs/node/pull/63687) - \[[`b4f5c86463`](https://github.com/nodejs/node/commit/b4f5c86463)] - **test**: add more test cases for pathToFileURL (Rafael Gonzaga) [#63293](https://github.com/nodejs/node/pull/63293) - \[[`812a66f0ac`](https://github.com/nodejs/node/commit/812a66f0ac)] - **test**: update test426-fixtures to [`2965987`](https://github.com/nodejs/node/commit/2965987bf4c96afa400c9356c8e620cb340aaee) (Node.js GitHub Bot) [#63668](https://github.com/nodejs/node/pull/63668) - \[[`2bf0de838d`](https://github.com/nodejs/node/commit/2bf0de838d)] - **test**: cover webcrypto prototype pollution systematically (Filip Skokan) [#63520](https://github.com/nodejs/node/pull/63520) - \[[`bec6856ae8`](https://github.com/nodejs/node/commit/bec6856ae8)] - **test,debugger**: add test for type stripping in debugger probe mode (Joyee Cheung) [#63748](https://github.com/nodejs/node/pull/63748) - \[[`a2b9095e03`](https://github.com/nodejs/node/commit/a2b9095e03)] - **test\_runner**: avoid recompiling coverage globs for every file (sangwook) [#63675](https://github.com/nodejs/node/pull/63675) - \[[`02fbff446f`](https://github.com/nodejs/node/commit/02fbff446f)] - **test\_runner**: cache `shouldSkipFileCoverage` result per URL (sangwook) [#63675](https://github.com/nodejs/node/pull/63675) - \[[`094869354a`](https://github.com/nodejs/node/commit/094869354a)] - **test\_runner**: ignore erased TS lines in coverage (Matteo Collina) [#63510](https://github.com/nodejs/node/pull/63510) - \[[`68edc2b009`](https://github.com/nodejs/node/commit/68edc2b009)] - **test\_runner**: fix suite diagnostic chanel end (Moshe Atlow) [#63533](https://github.com/nodejs/node/pull/63533) - \[[`659d5bf068`](https://github.com/nodejs/node/commit/659d5bf068)] - **test\_runner**: add parentId to test events with testId (Moshe Atlow) [#63435](https://github.com/nodejs/node/pull/63435) - \[[`eaebeb8b88`](https://github.com/nodejs/node/commit/eaebeb8b88)] - **test\_runner**: fix hooks test context (Moshe Atlow) [#63285](https://github.com/nodejs/node/pull/63285) - \[[`d03d96889b`](https://github.com/nodejs/node/commit/d03d96889b)] - **test\_runner**: add tags option and tag-name filter (Chemi Atlow) [#63221](https://github.com/nodejs/node/pull/63221) - \[[`e8c3db1364`](https://github.com/nodejs/node/commit/e8c3db1364)] - **test\_runner**: add `getTestContext()` (Moshe Atlow) [#62501](https://github.com/nodejs/node/pull/62501) - \[[`345c591d10`](https://github.com/nodejs/node/commit/345c591d10)] - **test\_runner**: filter execArgv fallback for child tests (Trivikram Kamat) [#64056](https://github.com/nodejs/node/pull/64056) - \[[`2f47fb23bf`](https://github.com/nodejs/node/commit/2f47fb23bf)] - **test\_runner**: improve coverage failure diagnostics (Trivikram Kamat) [#64050](https://github.com/nodejs/node/pull/64050) - \[[`260cf1ac89`](https://github.com/nodejs/node/commit/260cf1ac89)] - **test\_runner**: add timestamp to JUnit reporter testsuites (sangwook) [#64029](https://github.com/nodejs/node/pull/64029) - \[[`24140eafdf`](https://github.com/nodejs/node/commit/24140eafdf)] - **test\_runner**: remove unused shuffleArrayWithSeed (Daijiro Wachi) [#63847](https://github.com/nodejs/node/pull/63847) - \[[`b7fdb4891a`](https://github.com/nodejs/node/commit/b7fdb4891a)] - **test\_runner**: fix watch cwd with isolation none (Trivikram Kamat) [#63690](https://github.com/nodejs/node/pull/63690) - \[[`e48b307e09`](https://github.com/nodejs/node/commit/e48b307e09)] - **timers**: reuse Timeout objects in setStreamTimeout (Matteo Collina) [#64254](https://github.com/nodejs/node/pull/64254) - \[[`5396235993`](https://github.com/nodejs/node/commit/5396235993)] - **(SEMVER-MINOR)** **tls**: report negotiated TLS groups (Filip Skokan) [#64119](https://github.com/nodejs/node/pull/64119) - \[[`a653e9bb57`](https://github.com/nodejs/node/commit/a653e9bb57)] - **tls**: handle large RSA exponents in X.509 cert (Tobias Nießen) [#64093](https://github.com/nodejs/node/pull/64093) - \[[`5e901b5cd9`](https://github.com/nodejs/node/commit/5e901b5cd9)] - **(SEMVER-MINOR)** **tls**: add certificateCompression option (Tim Perry) [#62217](https://github.com/nodejs/node/pull/62217) - \[[`3abcfa723c`](https://github.com/nodejs/node/commit/3abcfa723c)] - **tls**: route event listener exceptions through error handlers (Antoine du Hamel) [#63822](https://github.com/nodejs/node/pull/63822) - \[[`eaba4cd59d`](https://github.com/nodejs/node/commit/eaba4cd59d)] - **tools**: bump the eslint group in /tools/eslint with 8 updates (dependabot\[bot]) [#64249](https://github.com/nodejs/node/pull/64249) - \[[`7d7ea1dbca`](https://github.com/nodejs/node/commit/7d7ea1dbca)] - **tools**: update c-ares updater script (Antoine du Hamel) [#64194](https://github.com/nodejs/node/pull/64194) - \[[`976827cd71`](https://github.com/nodejs/node/commit/976827cd71)] - **tools**: validate version number in release proposal commit message lint (Antoine du Hamel) [#64070](https://github.com/nodejs/node/pull/64070) - \[[`cc0c586b52`](https://github.com/nodejs/node/commit/cc0c586b52)] - **tools**: update sccache to v0.16.0 (Michaël Zasso) [#63078](https://github.com/nodejs/node/pull/63078) - \[[`f0a35fa56a`](https://github.com/nodejs/node/commit/f0a35fa56a)] - **tools**: bump js-yaml from 4.1.1 to 4.2.0 in /tools/lint-md (dependabot\[bot]) [#63948](https://github.com/nodejs/node/pull/63948) - \[[`dafbd23240`](https://github.com/nodejs/node/commit/dafbd23240)] - **tools**: bump js-yaml from 4.1.1 to 4.2.0 in /tools/eslint (dependabot\[bot]) [#63947](https://github.com/nodejs/node/pull/63947) - \[[`0ae1552650`](https://github.com/nodejs/node/commit/0ae1552650)] - **tools**: update the llhttp updater script (Antoine du Hamel) [#63819](https://github.com/nodejs/node/pull/63819) - \[[`3623586d1f`](https://github.com/nodejs/node/commit/3623586d1f)] - **tools**: align Bash snippets in GHA with `lint-sh` conventions (Antoine du Hamel) [#63829](https://github.com/nodejs/node/pull/63829) - \[[`64b130ce1d`](https://github.com/nodejs/node/commit/64b130ce1d)] - **tools**: bump the eslint group in /tools/eslint with 7 updates (dependabot\[bot]) [#63730](https://github.com/nodejs/node/pull/63730) - \[[`4900cac251`](https://github.com/nodejs/node/commit/4900cac251)] - **tools**: fix zlib updater script (Antoine du Hamel) [#63707](https://github.com/nodejs/node/pull/63707) - \[[`8edf3abafc`](https://github.com/nodejs/node/commit/8edf3abafc)] - **typings**: add typing for crypto (Filip Skokan) [#64122](https://github.com/nodejs/node/pull/64122) - \[[`d5be94e820`](https://github.com/nodejs/node/commit/d5be94e820)] - **url**: fix URLSearchParams(null) to prudce null= per spec (Marco) [#63782](https://github.com/nodejs/node/pull/63782) - \[[`ee66a3851c`](https://github.com/nodejs/node/commit/ee66a3851c)] - **util**: fix OOM in inspect color stack formatting (Ijtihed Kilani) [#64022](https://github.com/nodejs/node/pull/64022) - \[[`e26f183699`](https://github.com/nodejs/node/commit/e26f183699)] - **util**: fix scientific notation formatting (Daijiro Wachi) [#63823](https://github.com/nodejs/node/pull/63823) - \[[`7993e3e476`](https://github.com/nodejs/node/commit/7993e3e476)] - **util**: fix -0 formatting when numericSeparator is enabled (Daijiro Wachi) [#63815](https://github.com/nodejs/node/pull/63815) - \[[`38758a7789`](https://github.com/nodejs/node/commit/38758a7789)] - **util**: remove style caches from styleText slow path (Guilherme Araújo) [#63706](https://github.com/nodejs/node/pull/63706) - \[[`46a0ca256a`](https://github.com/nodejs/node/commit/46a0ca256a)] - **watch**: print name of changed file that triggers restart (Marco) [#63781](https://github.com/nodejs/node/pull/63781) - \[[`e1582818ad`](https://github.com/nodejs/node/commit/e1582818ad)] - **watch**: cancel pending restart on shutdown (Trivikram Kamat) [#63383](https://github.com/nodejs/node/pull/63383) - \[[`9a208668b0`](https://github.com/nodejs/node/commit/9a208668b0)] - **zlib**: validate flush king for all streams (Ic3b3rg) [#63746](https://github.com/nodejs/node/pull/63746) - \[[`928981d803`](https://github.com/nodejs/node/commit/928981d803)] - **zlib**: validate flush kind for brotli streams (Ic3b3rg) [#63746](https://github.com/nodejs/node/pull/63746) - \[[`fd0fb00164`](https://github.com/nodejs/node/commit/fd0fb00164)] - **zlib**: expose rejectGarbageAfterEnd option (Filip Skokan) [#64023](https://github.com/nodejs/node/pull/64023) - \[[`e334d30b4c`](https://github.com/nodejs/node/commit/e334d30b4c)] - **zlib**: reject trailing gzip members in web streams (Filip Skokan) [#64023](https://github.com/nodejs/node/pull/64023) - \[[`7433c3df2e`](https://github.com/nodejs/node/commit/7433c3df2e)] - **zlib**: coerce -0 to +0 for crc32 seeds (Filip Skokan) [#63556](https://github.com/nodejs/node/pull/63556) </details> --- ### Configuration 📅 **Schedule**: (in timezone America/Toronto) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled because a matching PR was automerged previously. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about these updates again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate CLI](https://github.com/renovatebot/renovate).  Reviewed-on: https://git.dcunha.io/Exikle/Artemis-Cluster/pulls/1374

crypto: use EVP_MAC for HMAC on OpenSSL >=3

21b49d6

Closes: nodejs#59493 Signed-off-by: Filip Skokan <panva.ip@gmail.com>

nodejs-github-bot added lib / src Issues and PRs related to general changes in the lib or src directory. needs-ci PRs that need a full CI run. labels Jun 16, 2026

fixup! crypto: use EVP_MAC for HMAC on OpenSSL >=3

0994a65

panva requested review from jasnell and tniessen June 16, 2026 14:12

anonrig approved these changes Jun 17, 2026

View reviewed changes

panva added author ready PRs that have at least one approval, no pending requests for changes, and a CI started. request-ci Add this label to start a Jenkins CI on a PR. labels Jun 17, 2026

github-actions Bot removed the request-ci Add this label to start a Jenkins CI on a PR. label Jun 17, 2026

This comment was marked as outdated.

Sign in to view

jasnell approved these changes Jun 19, 2026

View reviewed changes

panva added the commit-queue Add this label to land a pull request using GitHub Actions. label Jun 19, 2026

nodejs-github-bot removed the commit-queue Add this label to land a pull request using GitHub Actions. label Jun 19, 2026

nodejs-github-bot merged commit 8fa5954 into nodejs:main Jun 19, 2026
73 of 74 checks passed

panva deleted the use-evp_mac branch June 19, 2026 08:09

github-actions Bot mentioned this pull request Jun 22, 2026

2026-06-23, Version 26.4.0 (Current) #64058

Merged

github-actions Bot mentioned this pull request Jul 21, 2026

2026-07-22, Version 24.19.0 'Krypton' (LTS) #64654

Merged

Navigation Menu

Uh oh!

Uh oh!

crypto: use EVP_MAC for HMAC on OpenSSL >=3 - #63942

crypto: use EVP_MAC for HMAC on OpenSSL >=3#63942
nodejs-github-bot merged 2 commits into
nodejs:mainfrom
panva:use-evp_mac

panva commented Jun 16, 2026

Uh oh!

nodejs-github-bot commented Jun 16, 2026

Uh oh!

panva commented Jun 16, 2026

Uh oh!

This comment was marked as outdated.

This comment was marked as outdated.

nodejs-github-bot commented Jun 18, 2026

Uh oh!

Uh oh!

nodejs-github-bot commented Jun 19, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Uh oh!

Uh oh!

Conversation

panva commented Jun 16, 2026

Uh oh!

nodejs-github-bot commented Jun 16, 2026

Uh oh!

panva commented Jun 16, 2026

Uh oh!

This comment was marked as outdated.

This comment was marked as outdated.

nodejs-github-bot commented Jun 18, 2026

Uh oh!

Uh oh!

nodejs-github-bot commented Jun 19, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants