2026-02-10, Version 25.6.1 (Current)#61739
Open
github-actions[bot] wants to merge 50 commits intov25.xfrom
Open
2026-02-10, Version 25.6.1 (Current)#61739github-actions[bot] wants to merge 50 commits intov25.xfrom
github-actions[bot] wants to merge 50 commits intov25.xfrom
Conversation
PR-URL: #61456 Reviewed-By: Guy Bedford <guybedford@gmail.com> Reviewed-By: Daniel Lemire <daniel@lemire.me> Reviewed-By: Richard Lau <richard.lau@ibm.com>
PR-URL: #61573 Reviewed-By: Moshe Atlow <moshe@atlow.co.il> Reviewed-By: Aviv Keller <me@aviv.sh> Reviewed-By: Pietro Marchini <pietro.marchini94@gmail.com>
Previously the resolve hook can be invoked twice from the synthetic module evaluation step of imported CJS in the extra module._load() call that's invoked on the resolved full path. Add an option to avoid it, since the resolution and loading has already been done before. PR-URL: #61529 Fixes: #57125 Refs: #55808 Refs: #56241 Reviewed-By: Jacob Smith <jacob@frende.me>
Unifes assertSnapshot common patterns like platform specific path separators, line ending, line trailing spaces, Node.js version strings, and pids in warning messages. PR-URL: #61590 Reviewed-By: Moshe Atlow <moshe@atlow.co.il> Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com> Reviewed-By: Gürgün Dayıoğlu <hey@gurgun.day>
PR-URL: #61603 Reviewed-By: Marco Ippolito <marcoippolito54@gmail.com> Reviewed-By: Jacob Smith <jacob@frende.me> Reviewed-By: Colin Ihrig <cjihrig@gmail.com> Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
PR-URL: #61605 Reviewed-By: Darshan Sen <raisinten@gmail.com> Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com> Reviewed-By: Colin Ihrig <cjihrig@gmail.com> Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
PR-URL: #61584 Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com> Reviewed-By: Colin Ihrig <cjihrig@gmail.com> Reviewed-By: Luigi Pinca <luigipinca@gmail.com> Reviewed-By: Ulises Gascón <ulisesgascongonzalez@gmail.com> Reviewed-By: Tim Perry <pimterry@gmail.com>
Use the `skipIfNoWatch()` utility function in `test/parallel/test-fs-promises-watch-iterator.js`. PR-URL: #61531 Reviewed-By: Juan José Arboleda <soyjuanarbol@gmail.com>
PR-URL: #61602 Reviewed-By: Colin Ihrig <cjihrig@gmail.com> Reviewed-By: Luigi Pinca <luigipinca@gmail.com> Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
The watch mode tests using runInBackground() had a race condition where stdout "Failed running" message could arrive before stderr was fully collected, causing assertions on stderr content to fail with empty strings. Fix by waiting for stderr 'data' event if stderr is empty when "Failed running" is detected. This is an event-driven approach rather than timing-based. Refs: nodejs/reliability#1450 PR-URL: #61615 Reviewed-By: Moshe Atlow <moshe@atlow.co.il> Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Bumps [actions/checkout](https://github.com/actions/checkout) from 6.0.1 to 6.0.2. - [Release notes](https://github.com/actions/checkout/releases) - [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md) - [Commits](actions/checkout@8e8c483...de0fac2) --- updated-dependencies: - dependency-name: actions/checkout dependency-version: 6.0.2 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> PR-URL: #61619 Reviewed-By: Luigi Pinca <luigipinca@gmail.com> Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Bumps [actions/stale](https://github.com/actions/stale) from 10.1.0 to 10.1.1. - [Release notes](https://github.com/actions/stale/releases) - [Changelog](https://github.com/actions/stale/blob/main/CHANGELOG.md) - [Commits](actions/stale@5f858e3...9971854) --- updated-dependencies: - dependency-name: actions/stale dependency-version: 10.1.1 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> PR-URL: #61620 Reviewed-By: Luigi Pinca <luigipinca@gmail.com> Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Bumps [peter-evans/create-pull-request](https://github.com/peter-evans/create-pull-request) from 8.0.0 to 8.1.0. - [Release notes](https://github.com/peter-evans/create-pull-request/releases) - [Commits](peter-evans/create-pull-request@98357b1...c0f553f) --- updated-dependencies: - dependency-name: peter-evans/create-pull-request dependency-version: 8.1.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> PR-URL: #61623 Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com> Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Bumps [actions/cache](https://github.com/actions/cache) from 5.0.1 to 5.0.3. - [Release notes](https://github.com/actions/cache/releases) - [Changelog](https://github.com/actions/cache/blob/main/RELEASES.md) - [Commits](actions/cache@9255dc7...cdf6c1f) --- updated-dependencies: - dependency-name: actions/cache dependency-version: 5.0.3 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> PR-URL: #61624 Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com> Reviewed-By: Michaël Zasso <targos@protonmail.com> Reviewed-By: Colin Ihrig <cjihrig@gmail.com> Reviewed-By: Rafael Gonzaga <rafael.nunu@hotmail.com> Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Bumps [actions/setup-node](https://github.com/actions/setup-node) from 6.1.0 to 6.2.0. - [Release notes](https://github.com/actions/setup-node/releases) - [Commits](actions/setup-node@395ad32...6044e13) --- updated-dependencies: - dependency-name: actions/setup-node dependency-version: 6.2.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> PR-URL: #61625 Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com> Reviewed-By: Colin Ihrig <cjihrig@gmail.com> Reviewed-By: Rafael Gonzaga <rafael.nunu@hotmail.com> Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Bumps [cachix/cachix-action](https://github.com/cachix/cachix-action) from 0fc020193b5a1fa3ac4575aa3a7d3aa6a35435ad to 3ba601ff5bbb07c7220846facfa2cd81eeee15a1. - [Release notes](https://github.com/cachix/cachix-action/releases) - [Commits](cachix/cachix-action@0fc0201...3ba601f) --- updated-dependencies: - dependency-name: cachix/cachix-action dependency-version: 3ba601ff5bbb07c7220846facfa2cd81eeee15a1 dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com> PR-URL: #61626 Refs: cachix/cachix-action@3ba601f Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com> Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Bumps [actions/setup-python](https://github.com/actions/setup-python) from 6.1.0 to 6.2.0. - [Release notes](https://github.com/actions/setup-python/releases) - [Commits](actions/setup-python@83679a8...a309ff8) --- updated-dependencies: - dependency-name: actions/setup-python dependency-version: 6.2.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> PR-URL: #61627 Reviewed-By: Colin Ihrig <cjihrig@gmail.com> Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
PR-URL: #61551 Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Bumps [step-security/harden-runner](https://github.com/step-security/harden-runner) from 2.14.0 to 2.14.1. - [Release notes](https://github.com/step-security/harden-runner/releases) - [Commits](step-security/harden-runner@20cf305...e3f713f) --- updated-dependencies: - dependency-name: step-security/harden-runner dependency-version: 2.14.1 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> PR-URL: #61621 Reviewed-By: Colin Ihrig <cjihrig@gmail.com> Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Bumps [github/codeql-action](https://github.com/github/codeql-action) from 4.31.9 to 4.32.0. - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](github/codeql-action@5d4e8d1...b20883b) --- updated-dependencies: - dependency-name: github/codeql-action dependency-version: 4.32.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> PR-URL: #61622 Reviewed-By: Colin Ihrig <cjihrig@gmail.com> Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
PR-URL: #61375 Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com> Reviewed-By: Anna Henningsen <anna@addaleax.net> Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
PR-URL: #61638 Reviewed-By: Colin Ihrig <cjihrig@gmail.com> Reviewed-By: Aviv Keller <me@aviv.sh>
PR-URL: #61639 Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com> Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com> Reviewed-By: Matteo Collina <matteo.collina@gmail.com> Reviewed-By: Gürgün Dayıoğlu <hey@gurgun.day> Reviewed-By: Colin Ihrig <cjihrig@gmail.com> Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Newer c-ares versions set tcp_port/udp_port to 53 instead of 0, which caused the loopback detection to fail. This fix: - Removes the port check from loopback detection - Adds IPv6 loopback (::1) support - Calls EnsureServers() before each DNS query PR-URL: #61453 Reviewed-By: Anna Henningsen <anna@addaleax.net>
The test was flaky because the histogram sampling might not have completed before the assertions ran. By using setImmediate before disabling the histogram and checking values, we give the event loop a chance to record final samples on slower systems. Also added an explicit check for histogram.count > 0 to provide a clearer error message if no samples are recorded. Refs: nodejs/reliability#1450 PR-URL: #61629 Reviewed-By: Chengzhong Wu <legendecas@gmail.com> Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com>
PR-URL: #61649 Reviewed-By: Colin Ihrig <cjihrig@gmail.com> Reviewed-By: Chengzhong Wu <legendecas@gmail.com>
Corrected wording for clarity in README. PR-URL: #61653 Reviewed-By: Colin Ihrig <cjihrig@gmail.com> Reviewed-By: René <contact.9a5d6388@renegade334.me.uk> Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
PR-URL: #61432 Reviewed-By: Aviv Keller <me@aviv.sh> Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com> Reviewed-By: Edy Silva <edigleyssonsilva@gmail.com>
PR-URL: #61562 Reviewed-By: Colin Ihrig <cjihrig@gmail.com> Reviewed-By: Stefan Stojanovic <stefan.stojanovic@janeasystems.com>
Defer socket.destroy() calls in internalConnect and internalConnectMultiple to the next tick. This ensures that error handlers have a chance to be set up before errors are emitted, particularly important when using http.request with a custom lookup function that returns synchronously. Previously, if a synchronous lookup function returned an IP that triggered an immediate error (e.g., via blockList), the error would be emitted before the HTTP client had set up its error handler (which happens via process.nextTick in onSocket). This caused unhandled 'error' events. Fixes: #48771 PR-URL: #61658 Refs: #51038 Reviewed-By: Tim Perry <pimterry@gmail.com> Reviewed-By: Jason Zhang <xzha4350@gmail.com>
On Windows, file paths are case-insensitive but string comparison is case-sensitive. When the drive letter case differs between the computed project root and the actual output (e.g., 'C:/' vs 'c:/'), the path replacement in transformProjectRoot() would fail. This fix uses case-insensitive regex replacement on Windows to ensure paths are correctly normalized in snapshot tests regardless of drive letter casing. Refs: nodejs/reliability#1453 PR-URL: #61682 Reviewed-By: Chengzhong Wu <legendecas@gmail.com> Reviewed-By: Stefan Stojanovic <stefan.stojanovic@janeasystems.com> Reviewed-By: Daijiro Wachi <daijiro.wachi@gmail.com>
PR-URL: #61683 Reviewed-By: Colin Ihrig <cjihrig@gmail.com> Reviewed-By: Matteo Collina <matteo.collina@gmail.com> Reviewed-By: Filip Skokan <panva.ip@gmail.com> Reviewed-By: Rafael Gonzaga <rafael.nunu@hotmail.com> Reviewed-By: Matthew Aitken <maitken033380023@gmail.com>
PR-URL: #61675 Reviewed-By: Colin Ihrig <cjihrig@gmail.com> Reviewed-By: Chengzhong Wu <legendecas@gmail.com> Reviewed-By: Tierney Cyren <hello@bnb.im> Reviewed-By: Ulises Gascón <ulisesgascongonzalez@gmail.com>
This patch moves `ReadFileSync` and `WriteFileSync` from `src/util.cc` to `src/node_file_utils.cc`, consolidates the implementation to reuse code, and adds a few more enhancements: For `ReadFileSync`: - Use fstat-based pre-allocation to minimize buffer resizing and repeated reads for bigger files. - Handle various potential overflows in size conversions. - Handle fallback for 0-byte special files. For `WriteFileSync`: - Handle potential partial writes for big enough files and support non-seekable files (with -1 as offset). - Handle 0-byte writes correctly. In both cases, this now avoids hard aborts and return error code for the caller to handle as much as possible, except `std::vector<char> ReadFileSync(FILE* fp)` which is part of the embedder API. This patch uses the new `ReadFileSync` to address a TODO in node_sea.bin.cc. PR-URL: #61662 Reviewed-By: Rafael Gonzaga <rafael.nunu@hotmail.com> Reviewed-By: Stephen Belanger <admin@stephenbelanger.com> Reviewed-By: Anna Henningsen <anna@addaleax.net> Reviewed-By: James M Snell <jasnell@gmail.com>
When binding UTF-8 strings to prepared statements, transfer ownership of malloc-backed Utf8Value buffers to SQLite to avoid an extra copy for large strings. Use sqlite3_bind_blob64() when binding BLOB parameters. PR-URL: #61580 Reviewed-By: Matteo Collina <matteo.collina@gmail.com> Reviewed-By: Edy Silva <edigleyssonsilva@gmail.com> Reviewed-By: René <contact.9a5d6388@renegade334.me.uk> Reviewed-By: Zeyu "Alex" Yang <himself65@outlook.com>
PR-URL: #61696 Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com> Reviewed-By: Stephen Belanger <admin@stephenbelanger.com> Reviewed-By: Daniel Lemire <daniel@lemire.me> Reviewed-By: Vinícius Lourenço Claro Cardoso <contact@viniciusl.com.br> Reviewed-By: Сковорода Никита Андреевич <chalkerx@gmail.com> Reviewed-By: Gürgün Dayıoğlu <hey@gurgun.day> Reviewed-By: Anna Henningsen <anna@addaleax.net> Reviewed-By: René <contact.9a5d6388@renegade334.me.uk>
PR-URL: #61659 Reviewed-By: Ethan Arrowood <ethan@arrowood.dev> Reviewed-By: Jacob Smith <jacob@frende.me> Reviewed-By: Moshe Atlow <moshe@atlow.co.il> Reviewed-By: Pietro Marchini <pietro.marchini94@gmail.com> Reviewed-By: Chemi Atlow <chemi@atlow.co.il> Reviewed-By: Colin Ihrig <cjihrig@gmail.com> Reviewed-By: Tierney Cyren <hello@bnb.im> Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
`require(mod)` does not keep the mod in require cache if mod throws synchronously. This fixes the tests to print the stack immediately in case that source map cache could be cleaned up when the CJS module is reclaimed by GC in the next event loop tick. PR-URL: #61699 Reviewed-By: Anna Henningsen <anna@addaleax.net> Reviewed-By: Michaël Zasso <targos@protonmail.com> Reviewed-By: Colin Ihrig <cjihrig@gmail.com> Reviewed-By: Minwoo Jung <nodecorelab@gmail.com> Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Add documentation explaining that applications are expected to attach 'error' event handlers to EventEmitters that can emit errors, including HTTP streams. Crashes resulting from missing error handlers are not considered denial-of-service vulnerabilities in Node.js. PR-URL: #61701 Reviewed-By: Luigi Pinca <luigipinca@gmail.com> Reviewed-By: Anna Henningsen <anna@addaleax.net> Reviewed-By: Colin Ihrig <cjihrig@gmail.com> Reviewed-By: Rafael Gonzaga <rafael.nunu@hotmail.com> Reviewed-By: Chengzhong Wu <legendecas@gmail.com> Reviewed-By: Ulises Gascón <ulisesgascongonzalez@gmail.com> Reviewed-By: James M Snell <jasnell@gmail.com> Reviewed-By: Benjamin Gruenbaum <benjamingr@gmail.com>
Small perf improvement:
$ node benchmark/compare.js --runs 100 \
> --old ./node-0da120f879 --new ./node \
> --filter structured-clone misc > comparison.csv && \
> npx node-benchmark-compare comparison.csv
[00:02:15|% 100| 1/1 files | 200/200 runs | 3/3 configs]: Done
confidence improvement accuracy (*) (**) (***)
misc/structured-clone.js n=10000 type='arraybuffer' ** 1.81 % ±1.28% ±1.68% ±2.16%
misc/structured-clone.js n=10000 type='object' * 0.62 % ±0.55% ±0.73% ±0.93%
misc/structured-clone.js n=10000 type='string' *** 8.30 % ±1.46% ±1.92% ±2.47%
Be aware that when doing many comparisons the risk of a false-positive result increases.
In this case, there are 3 comparisons, you can thus expect the following amount of false-positive results:
0.15 false positives, when considering a 5% risk acceptance (*, **, ***),
0.03 false positives, when considering a 1% risk acceptance (**, ***),
0.00 false positives, when considering a 0.1% risk acceptance (***)
PR-URL: #61703
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com>
PR-URL: #61732 Reviewed-By: Moshe Atlow <moshe@atlow.co.il> Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com> Reviewed-By: Michaël Zasso <targos@protonmail.com>
PR-URL: #61730 Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com> Reviewed-By: Ulises Gascón <ulisesgascongonzalez@gmail.com> Reviewed-By: Michaël Zasso <targos@protonmail.com> Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Collaborator
|
Review requested:
|
aduh95
approved these changes
Feb 8, 2026
Collaborator
panva
approved these changes
Feb 8, 2026
Codecov Report❌ Patch coverage is Additional details and impacted files@@ Coverage Diff @@
## v25.x #61739 +/- ##
==========================================
+ Coverage 88.80% 89.70% +0.89%
==========================================
Files 679 681 +2
Lines 204193 204388 +195
Branches 39151 39276 +125
==========================================
+ Hits 181328 183339 +2011
+ Misses 15113 13350 -1763
+ Partials 7752 7699 -53
🚀 New features to boost your workflow:
|
RafaelGSS
approved these changes
Feb 8, 2026
Contributor
|
@legendecas I'm suspecting b064ddc to be the cause of the failures, could you take a look? |
Member
|
#61748 could be a fix |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Small release to address #61679
Commits
47df4328d7] - build,deps: replace cjs-module-lexer with merve (Yagiz Nizipli) #61456c78c49ed6b] - deps: update amaro to 1.1.7 (Node.js GitHub Bot) #617304790816d9b] - deps: update minimatch to 10.1.2 (Node.js GitHub Bot) #617328c71740e8a] - deps: update undici to 7.21.0 (Node.js GitHub Bot) #61683e559ef6ab1] - deps: update googletest to 56efe3983185e3f37e43415d1afa97e3860f187f (Node.js GitHub Bot) #61605300de2bb5a] - deps: update amaro to 1.1.6 (Node.js GitHub Bot) #61603e71e9505ef] - dns: fix Windows SRV ECONNREFUSED by adjusting c-ares fallback detection (notvivek12) #61453439b816bc7] - doc: clarify EventEmitter error handling in threat model (Matteo Collina) #61701c1c6641f23] - doc: mention default option for test runner env (Steven) #6165941ec451f98] - doc: fix --inspect security warning section (Tim Perry) #61675bb90ef2356] - doc: documenturl.format(urlString)as deprecated under DEP0169 (René) #61644513df82e6f] - doc: update to Visual Studio 2026 manual install (Mike McCready) #616559409d30736] - doc: deprecation add more codemod (Augustin Mauroy) #6164275a7a67151] - doc: fix grammatical error in README.md (ayj8201) #61653821e59e884] - doc: correct tools README Boxstarter link (Mike McCready) #616384998f539a0] - doc: updateserver.dropMaxConnectionlink (YuSheng Chen) #615849383ac4ab7] - http: implement slab allocation for HTTP header parsing (Mert Can Altin) #61375e90eb1d561] - meta: persist sccache daemon until end of build workflows (René) #61639ade36ac367] - meta: bump github/codeql-action from 4.31.9 to 4.32.0 (dependabot[bot]) #6162226638bd67f] - meta: bump step-security/harden-runner from 2.14.0 to 2.14.1 (dependabot[bot]) #61621eaa9a96cb6] - meta: bump actions/setup-python from 6.1.0 to 6.2.0 (dependabot[bot]) #61627fd98187828] - meta: bump cachix/cachix-action (dependabot[bot]) #61626820c1d021c] - meta: bump actions/setup-node from 6.1.0 to 6.2.0 (dependabot[bot]) #6162572a4136bd5] - meta: bump actions/cache from 5.0.1 to 5.0.3 (dependabot[bot]) #61624e3ef6cb3bc] - meta: bump peter-evans/create-pull-request from 8.0.0 to 8.1.0 (dependabot[bot]) #61623020a836202] - meta: bump actions/stale from 10.1.0 to 10.1.1 (dependabot[bot]) #616200df72f07c8] - meta: bump actions/checkout from 6.0.1 to 6.0.2 (dependabot[bot]) #61619d147c08b83] - module: do not invoke resolve hooks twice for imported cjs (Joyee Cheung) #61529a2843f8556] - net: defer synchronous destroy calls in internalConnect (RajeshKumar11) #616587fb7030781] - repl: fix flaky test-repl-programmatic-history (Matteo Collina) #61614d4c9b5cf5b] - sqlite: avoid extra copy for large text binds (Ali Hassan) #61580aa1b3661d9] - sqlite: use DictionaryTemplate for run() result (Mert Can Altin) #614329c8ad7e881] - src: elide heap allocation in structured clone implementation (Anna Henningsen) #61703c4ecfef93d] - src: use simdutf for one-byte string UTF-8 write in stringBytes (Mert Can Altin) #6169628905b9734] - src: consolidate C++ ReadFileSync/WriteFileSync utilities (Joyee Cheung) #61662adce20c0a1] - test: print stack immediately avoiding GC interleaving (Chengzhong Wu) #616997643bc8999] - test: fix case-insensitive path matching on Windows (Matteo Collina) #6168223d1ecf66f] - test: fix flaky test-performance-eventloopdelay (Matteo Collina) #6162999012a88ed] - test: remove duplicate wpt tests (Filip Skokan) #61617a8b32b8ce1] - test: fix race condition in watch mode tests (Matteo Collina) #61615086a5a5a25] - test: update WPT for url to e3c46fdf55 (Node.js GitHub Bot) #61602f0574fd419] - test: use the skipIfNoWatch() utility function (Luigi Pinca) #61531b064ddc221] - test: unify assertSnapshot common patterns (Chengzhong Wu) #6159017122e521b] - test_runner: fix test enqueue when test file has syntax error (Edy Silva) #61573bad3f02dd9] - tools: enforce removal oflts-watch-*labels on release proposals (Antoine du Hamel) #61672a8f33fd6bd] - tools: use ubuntu-slim runner in meta GitHub Actions (Tierney Cyren) #61663c843e447ca] - tools: test--shared-merveintest-sharedworkflow (Antoine du Hamel) #616492fedc03f96] - tools: update OpenSSL to 3.5.5 intest-shared(Antoine du Hamel) #615511c1db94670] - tools,win: upgrade install additional tools to Visual Studio 2026 (Mike McCready) #61562