Changelog

nodejs/node · · 18 commits

HTTP/2 flow control and VFS fixes

Notable HTTP/2 API expansion plus security-oriented VFS, sqlite, crypto, and inspector-related fixes.

aduh95 panva trivikr HoonDongKang christopher-buss HBSPS pimterry richardlau

HTTP/2 gains a new connectionWindowSize option (pimterryb12688c)

The http2 APIs now let callers set the session-level flow-control window separately from per-stream initialWindowSize. The docs and implementation were updated to explain the semantics, including how decreases apply and the default 32 MiB connection window for clients and servers.

Crypto key preparation is now optimized and benchmarked (panvae026733)

prepareAsymmetricKey() was refactored for faster key preparation across the supported input shapes, with new benchmark coverage and regression tests. This should improve asymmetric key handling in hot paths while guarding against functional regressions.

Growable SharedArrayBuffer validation no longer trusts JS properties (panvafd6682c)

WebIDL buffer-source checks now use an intrinsic getter instead of reading buffer.growable, so shadowed or overridden properties can’t bypass validation. The change closes a correctness/safety gap for shared buffer growability detection and adds tests covering tampered prototypes and accessors.

SQLite changeset application now copies inputs unconditionally (trivikrf9072f3)

database.applyChangeset() now always copies the changeset before applying it, because SQLite can run JavaScript indirectly through user-defined SQL functions during apply. That prevents the input buffer from being detached or mutated while SQLite is still reading it.

VFS fs.promises.open() now returns a real FileHandle (trivikrdfcfe25)

Mounted virtual file descriptors are wrapped in the public FileHandle interface instead of returning the raw provider handle. That makes VFS-backed fsp.open() behave more like normal fs.promises.open(), including exposing the expected methods and fd shape.

fs.statfs*() now reports ENOENT for missing VFS paths (trivikr1dd48de)

The VFS layer now validates paths before synthesizing statfs data, so missing mounted paths correctly fail with ENOENT for sync, promise, and callback forms. The callback path also forwards validation errors asynchronously instead of throwing synchronously.

Inspector/V8 interrupt handling was reverted (aduh95a284965, aduh958b52f14, aduh95875d905)

A three-commit revert backed out recent inspector and V8 interrupt changes, including the JS-in-interrupt gating and related V8 backport. This is a significant rollback that likely restores prior behavior after the earlier changes proved problematic.

Other misc changes

  • Commit-message lint workflow hardened for forks and PR-target execution (panvaee51d13)
  • path.posix internal string-char optimizations (HBSPSb3fb344)
  • Docs updates for child_process.fork(), fs ordering, and changelog/version metadata (christopher-bussfb4f759, trivikr36f16e7, aduh957ac314f, aduh95dab3a73)
  • CI/build/version sync and workflow maintenance, including Rust toolchain warnings and author-ready conflict handling (richardlaucb9b870, panva8c9d141)
  • cli_table iteration safety fix to avoid user-mutable iterators (HoonDongKang01efbc6)