Changelog

nodejs/node · · 13 commits

LTS, VFS, and crypto shifts land

Node 22.23.3 ships alongside VFS cleanup, crypto FIPS fixes, and two embedder-facing runtime changes.

aduh95 panva codebytere pipobscure mertcanaltin nodejs-github-bot motokaneyuki yunshingng

Node 22.23.3 LTS release includes core dependency updates (aduh95342bf6d)

Node.js published v22.23.3 "Jod" with refreshed root certificates and major dependency bumps, including Corepack, npm, ICU, OpenSSL, and Undici. This is the day’s broadest user-visible maintenance release and can affect TLS, package management, and runtime behavior.

VFS command-line surface is simplified around --vfs-load (pipobscure2899457)

--vfs-mount has been removed in favor of a single load-only flag that mounts source at a reserved Node-assigned mount point and runs from it. This trims an ambiguous CLI API, changes the docs and tests accordingly, and affects how VFS entry points and worker inheritance behave.

Recursive ZIP directory listings now work (pipobscure3d85c94)

ZipProvider.readdir() and readdirSync() now support { recursive: true } instead of throwing ERR_METHOD_NOT_IMPLEMENTED. ZIP archives now enumerate nested paths and implied directories properly, which makes VFS ZIP support more complete and less surprising.

Crypto key availability now tracks current FIPS state (panva18c2b33)

The crypto subsystem now refreshes algorithm availability when FIPS state changes, instead of relying on stale cached assumptions. This affects key generation, WebCrypto support checks, and warmed-worker transitions, so FIPS-enabled behavior should be more correct and consistent.

Freeing one Environment no longer breaks sibling JS execution (codebytere6dfe4eb)

FreeEnvironment() now avoids globally blocking JavaScript in a shared isolate while it drains handles, preventing unrelated sibling Environments from throwing illegal-access errors. This is a real embedder/runtime fix for multi-Environment setups on one thread.

Embedder wasm streaming callbacks can now be preserved (codebytere305cfcd)

Node can now skip installing its own wasm streaming callback when requested, letting embedders keep a custom WebAssembly.compileStreaming() hook across Node setup. This removes a long-standing integration footgun for hosts with their own fetch/network stack.

Other misc changes

  • SecureContext heap snapshot coverage moved to a pummel test (mertcanaltina2c8da5)
  • Watch mode tests were deflaked and timing relaxed (panva381b962)
  • Docs clarified Worker execArgv vs permission grants (yunshingng03fcd8b)
  • Blocklist.isBlocklist docs gained a return type annotation (motokaneyukifd1f3e5)
  • WPT URL fixtures were updated (nodejs-github-bot624b447)
  • Intel macOS support was downgraded to experimental in build docs (aduh95c362db6)
  • Reverted a Makefile fat-binary change (aduh9587a4efb)