HTTP CONNECT now preserves the target host header (
0e2126d)
http.request() now uses the CONNECT target as the Host header when one isn't explicitly set, instead of reusing the proxy host. This fixes proxy tunnel behavior and adds regression coverage for both the default CONNECT header and TLS-over-HTTP tunneling.
Security docs clarify V8 flags are out of scope (
8410a91)
SECURITY.md was updated to spell out that V8 flags are outside Node's threat model. This is a policy/documentation change, but it matters for how the project frames security expectations and disclosures.
Internal property-definition helpers hardened (
dc15da3)
Several internal modules switched to prototype-null descriptor objects or bulk descriptor APIs when copying/defining properties. This is a defense-in-depth refactor that reduces the chance of prototype pollution or inherited-property surprises in debugger, HTTP/2, DOMException, and test-mocking internals.
Other misc changes
- Dependency bumps in ESLint tooling and GitHub Actions workflows, including
actions/checkout,actions/cache,setup-python, CodeQL actions, Codecov, and Slack notify. - Small doc typo fix in
node-config-schema.jsonandsrc/node_options.cc.