Changelog

nodejs/node · · 33 commits

Permissions, streams, zlib, and sqlite get major work

Node adds env permissions, speeds up streams/querystring, and lands notable fixes across zlib, worker, fs, HTTP, and sqlite.

lazerg jasnell anonrig panva dayun6530 xia-chao pimterry inoway46 aduh95 mcollina IlyasShabi MayaLekova christianaurichzm osztenkurden legendecas eliau2005 efekrskl nodejs-github-bot trivikr TrevorBurnham araujogui

Add --allow-env permission model support (jasnellf378cfc)

Node now lets the permission model restrict environment variables at startup, with support for exact names, prefixes, or *. This is a semver-major security and isolation feature: disallowed variables are scrubbed from process.env, native getenv(), child processes, and workers, while a small allowlist of Node/runtime-critical vars remains available.

Rename and broaden node:sqlite’s public API (araujoguif2b698f)

DatabaseSync/StatementSync are now Database/Statement, with the old names kept as deprecated aliases, and the docs/tests were updated accordingly. This is a public API rename with broad surface-area churn across docs, benchmarks, and C++ bindings.

Fix gzip reset semantics and preserve Brotli params in zlib (xia-chaoca0810f, xia-chao1e0167d)

Resetting a gzip stream after it has already emitted part of an incomplete member now fails with ERR_ZLIB_INCOMPLETE_FRAME instead of producing undecodable output. Brotli streams also now preserve their configured parameters and dictionary across reset(), making stream reuse behave more predictably.

Make streams faster on the common flowing-pipe path (anonrig236b53f, anonrig4889fb0, mcollina7ff6267)

Several stream internals were reworked to keep pre-fetched chunks and consumer state in fast paths instead of bouncing through slower buffer/dictionary-style state. The result is a notable throughput improvement for flowing pipes and iter-based stream consumers, with benchmark-backed speedups.

Speed up querystring parsing and unescaping (anonrig6a6e09e)

The default parse path and unescapeBuffer() now avoid extra scanning and state-machine work when inputs don’t contain escapes. This is a performance win on common querystring workloads, especially simple or mostly-unencoded inputs.

Fix fs crash on negative-zero file descriptors (christianaurichzm1e17275)

readFileSync() and writeFileSync() now coerce -0 to 0 before crossing into the binding layer. That closes a crash path where -0 was accepted as an integer in JS but rejected by V8/native handling.

Improve worker and web worker string-tag and TypeScript handling (lazergb456adb, lazergcd908df, osztenkurdendb1e36b)

Worker messaging objects now expose the expected Symbol.toStringTag values, improving inspection/debuggability and aligning with web platform expectations. Separately, file-backed web worker module entries now strip TypeScript when type-stripping is enabled, including coverage for module workers loaded from file: URLs.

Other misc changes