Skip to content

http: document and validate options.path when it's in absolute-form#64108

Merged
nodejs-github-bot merged 1 commit into
nodejs:mainfrom
joyeecheung:check-proxy-path
Jul 1, 2026
Merged

http: document and validate options.path when it's in absolute-form#64108
nodejs-github-bot merged 1 commit into
nodejs:mainfrom
joyeecheung:check-proxy-path

Conversation

@joyeecheung

@joyeecheung joyeecheung commented Jun 24, 2026

Copy link
Copy Markdown
Member

When options.path passed to http.request() contains an absolute URL, http.request has been sending it directly as the request target in the HTTP 1.1 message. If the receiving server is a proxy, the proxy server typically forwards the request to the destination specified in the request target and ignores the Host header. This means eventually the request can be forwarded to a destination that is not consistent with options.host, depending on how the receiving server behaves. Mimatched Host header and request target also violates RFC 9112 Section 3.2, which we have been entirely leaving to the users to verify.

This patch documents this behavior and warns that the user needs to ensure the path, option and headers conform to the RFC. If the receiving server is known to be a proxy server because the request is routed by Node.js' built-in HTTP proxy support, we now do a best-effort check to verify that the authority in options.path (if absolute), Host headers and options.host agree at request construction time. Node.js will give up on the require target rewriting and throw an error when they don't match at request construction.

@nodejs-github-bot

nodejs-github-bot commented Jun 24, 2026

Copy link
Copy Markdown
Collaborator

Review requested:

  • @nodejs/http
  • @nodejs/net

@nodejs-github-bot nodejs-github-bot added http Issues or PRs related to the http subsystem. needs-ci PRs that need a full CI run. labels Jun 24, 2026
mcollina
mcollina approved these changes Jun 24, 2026
View reviewed changes

@mcollina mcollina left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

lgtm

@joyeecheung joyeecheung added the request-ci Add this label to start a Jenkins CI on a PR. label Jun 24, 2026
@github-actions github-actions Bot removed the request-ci Add this label to start a Jenkins CI on a PR. label Jun 24, 2026
@nodejs-github-bot

nodejs-github-bot commented Jun 24, 2026

Copy link
Copy Markdown
Collaborator

CI: https://ci.nodejs.org/job/node-test-pull-request/74405/

@joyeecheung joyeecheung added commit-queue Add this label to land a pull request using GitHub Actions. and removed commit-queue Add this label to land a pull request using GitHub Actions. labels Jun 29, 2026
@joyeecheung
http: document and validate options.path when it's in absolute-form
567dea1 
When `options.path` passed to `http.request()` contains an absolute
URL, `http.request` has been sending it directly as the request target
in the HTTP 1.1 message. If the receiving server is a proxy,
the proxy server typically forwards the request to the destination
specified in the request target and ignores the Host header.
This means eventually the request can be forwarded to a destination
that is not consistent with `options.host`, depending on how the
receiving server behaves. Mimatched Host header and request target
also violates RFC 9112 Section 3.2, which we have been entirely
leaving to the users to verify.

This patch documents this behavior and warns that the user needs
to ensure the `path`, `option` and `headers` conform to the RFC.
If the receiving server is known to be a proxy server because
the request is routed by Node.js' built-in HTTP proxy support,
we now do a best-effort check to verify that the authority in
`options.path` (if absolute), Host headers and `options.host`
agree at request construction time. Node.js will give up on the
require target rewriting and throw an error when they don't match
at request construction.

Signed-off-by: Joyee Cheung <joyeec9h3@gmail.com>
@nodejs-github-bot

nodejs-github-bot commented Jun 29, 2026

Copy link
Copy Markdown
Collaborator

CI: https://ci.nodejs.org/job/node-test-pull-request/74441/

@joyeecheung

joyeecheung commented Jun 29, 2026

Copy link
Copy Markdown
Member Author

Rebased to address the conflict in the docs. @mcollina @pimterry can you review again? Thanks!

@nodejs-github-bot

nodejs-github-bot commented Jun 30, 2026

Copy link
Copy Markdown
Collaborator

CI: https://ci.nodejs.org/job/node-test-pull-request/74445/

@joyeecheung joyeecheung added the request-ci Add this label to start a Jenkins CI on a PR. label Jun 30, 2026
@github-actions github-actions Bot removed the request-ci Add this label to start a Jenkins CI on a PR. label Jun 30, 2026
@nodejs-github-bot

nodejs-github-bot commented Jun 30, 2026

Copy link
Copy Markdown
Collaborator

CI: https://ci.nodejs.org/job/node-test-pull-request/74452/

@joyeecheung joyeecheung added the request-ci Add this label to start a Jenkins CI on a PR. label Jun 30, 2026
@github-actions github-actions Bot removed the request-ci Add this label to start a Jenkins CI on a PR. label Jun 30, 2026
@nodejs-github-bot

nodejs-github-bot commented Jun 30, 2026

Copy link
Copy Markdown
Collaborator

CI: https://ci.nodejs.org/job/node-test-pull-request/74464/

@joyeecheung joyeecheung added the commit-queue Add this label to land a pull request using GitHub Actions. label Jul 1, 2026
@nodejs-github-bot nodejs-github-bot removed the commit-queue Add this label to land a pull request using GitHub Actions. label Jul 1, 2026
@nodejs-github-bot nodejs-github-bot merged commit fd34191 into nodejs:main Jul 1, 2026
72 checks passed
@nodejs-github-bot

nodejs-github-bot commented Jul 1, 2026

Copy link
Copy Markdown
Collaborator

Landed in fd34191

@Archkon Archkon mentioned this pull request Jul 1, 2026
Merged
alexfernandez pushed a commit to alexfernandez/node that referenced this pull request Jul 1, 2026
@joyeecheung @alexfernandez
http: document and validate options.path when it's in absolute-form
8eceb86 
When `options.path` passed to `http.request()` contains an absolute
URL, `http.request` has been sending it directly as the request target
in the HTTP 1.1 message. If the receiving server is a proxy,
the proxy server typically forwards the request to the destination
specified in the request target and ignores the Host header.
This means eventually the request can be forwarded to a destination
that is not consistent with `options.host`, depending on how the
receiving server behaves. Mimatched Host header and request target
also violates RFC 9112 Section 3.2, which we have been entirely
leaving to the users to verify.

This patch documents this behavior and warns that the user needs
to ensure the `path`, `option` and `headers` conform to the RFC.
If the receiving server is known to be a proxy server because
the request is routed by Node.js' built-in HTTP proxy support,
we now do a best-effort check to verify that the authority in
`options.path` (if absolute), Host headers and `options.host`
agree at request construction time. Node.js will give up on the
require target rewriting and throw an error when they don't match
at request construction.

Signed-off-by: Joyee Cheung <joyeec9h3@gmail.com>
PR-URL: nodejs#64108
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
Reviewed-By: Tim Perry <pimterry@gmail.com>
Reviewed-By: Ulises Gascón <ulisesgascongonzalez@gmail.com>
richardlau pushed a commit that referenced this pull request Jul 3, 2026
@joyeecheung @richardlau
http: document and validate options.path when it's in absolute-form
8e8874b 
When `options.path` passed to `http.request()` contains an absolute
URL, `http.request` has been sending it directly as the request target
in the HTTP 1.1 message. If the receiving server is a proxy,
the proxy server typically forwards the request to the destination
specified in the request target and ignores the Host header.
This means eventually the request can be forwarded to a destination
that is not consistent with `options.host`, depending on how the
receiving server behaves. Mimatched Host header and request target
also violates RFC 9112 Section 3.2, which we have been entirely
leaving to the users to verify.

This patch documents this behavior and warns that the user needs
to ensure the `path`, `option` and `headers` conform to the RFC.
If the receiving server is known to be a proxy server because
the request is routed by Node.js' built-in HTTP proxy support,
we now do a best-effort check to verify that the authority in
`options.path` (if absolute), Host headers and `options.host`
agree at request construction time. Node.js will give up on the
require target rewriting and throw an error when they don't match
at request construction.

Signed-off-by: Joyee Cheung <joyeec9h3@gmail.com>
PR-URL: #64108
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
Reviewed-By: Tim Perry <pimterry@gmail.com>
Reviewed-By: Ulises Gascón <ulisesgascongonzalez@gmail.com>
@github-actions github-actions Bot mentioned this pull request Jul 6, 2026
Merged
tmeijn pushed a commit to tmeijn/dotfiles that referenced this pull request Jul 9, 2026
build(deps): update node.js to v26.5.0
b17b6dc 
This MR contains the following updates:

| Package | Update | Change |
|---|---|---|
| [node](https://nodejs.org) ([source](https://github.com/nodejs/node)) | minor | `26.3.1` → `26.5.0` |

MR created with the help of [el-capitano/tools/renovate-bot](https://gitlab.com/el-capitano/tools/renovate-bot).

**Proposed changes to behavior should be submitted there as MRs.**

---

### Release Notes

<details>
<summary>nodejs/node (node)</summary>

### [`v26.5.0`](https://github.com/nodejs/node/releases/tag/v26.5.0): 2026-07-08, Version 26.5.0 (Current), @&#8203;richardlau

[Compare Source](nodejs/node@v26.3.1...v26.5.0)

##### Notable Changes

##### New release key

Welcome to our newest releaser, [Stewart X Addison](https://github.com/sxa). Future Node.js releases may be signed with his [release key](https://github.com/nodejs/node/blob/main/README.md#release-keys), `655F3B5C1FB3FA8D1A0CA6BDE4A7D232B936D2FD`.

##### Other notable changes

- \[[`55f48446c7`](nodejs/node@55f48446c7)] - **(SEMVER-MINOR)** **buffer**: implement blob.textStream() (Matthew Aitken) [#&#8203;64036](nodejs/node#64036)
- \[[`b373202efc`](nodejs/node@b373202efc)] - **(SEMVER-MINOR)** **esm**: add `--experimental-import-text` flag (Efe) [#&#8203;62300](nodejs/node#62300)
- \[[`39e0c14455`](nodejs/node@39e0c14455)] - **(SEMVER-MINOR)** **perf\_hooks**: sample delay per event loop iteration (Pablo Erhard) [#&#8203;62935](nodejs/node#62935)
- \[[`999a83c937`](nodejs/node@999a83c937)] - **(SEMVER-MINOR)** **stream**: expose ReadableStreamTee (Matteo Collina) [#&#8203;64195](nodejs/node#64195)
- \[[`4e0236dc3d`](nodejs/node@4e0236dc3d)] - **(SEMVER-MINOR)** **tls**: report negotiated TLS groups (Filip Skokan) [#&#8203;64119](nodejs/node#64119)

##### Commits

- \[[`87648c0a6c`](nodejs/node@87648c0a6c)] - **benchmark**: trim down the argon2 sets (Filip Skokan) [#&#8203;64218](nodejs/node#64218)
- \[[`a483bfd3f0`](nodejs/node@a483bfd3f0)] - **buffer**: remove unreachable overflow check in atob (haramjeong) [#&#8203;60161](nodejs/node#60161)
- \[[`6d14279688`](nodejs/node@6d14279688)] - **buffer**: add fast api for isUtf8 and isAscii (Gürgün Dayıoğlu) [#&#8203;64169](nodejs/node#64169)
- \[[`55f48446c7`](nodejs/node@55f48446c7)] - **(SEMVER-MINOR)** **buffer**: implement blob.textStream() (Matthew Aitken) [#&#8203;64036](nodejs/node#64036)
- \[[`a67d9a7a44`](nodejs/node@a67d9a7a44)] - **build**: allow linting node.1 (Aviv Keller) [#&#8203;64157](nodejs/node#64157)
- \[[`06c1fbc25b`](nodejs/node@06c1fbc25b)] - **build**: enable Maglev for riscv64 (Jamie Magee) [#&#8203;62605](nodejs/node#62605)
- \[[`518309c363`](nodejs/node@518309c363)] - **build**: suppress clang errors building libffi on Windows (René) [#&#8203;64222](nodejs/node#64222)
- \[[`6a80ab485c`](nodejs/node@6a80ab485c)] - **build**: add manually-dispatched stress-test workflow (Joyee Cheung) [#&#8203;64118](nodejs/node#64118)
- \[[`f4e7bf1f1c`](nodejs/node@f4e7bf1f1c)] - **build**: pin envinfo versions in github actions (Joyee Cheung) [#&#8203;64117](nodejs/node#64117)
- \[[`66f6ac0d86`](nodejs/node@66f6ac0d86)] - **build**: support setting an emulator from configure script (Ivan Trubach) [#&#8203;53899](nodejs/node#53899)
- \[[`7f26c54aa6`](nodejs/node@7f26c54aa6)] - **child\_process**: fix permission model propagation via NODE\_OPTIONS (Matteo Collina) [#&#8203;63972](nodejs/node#63972)
- \[[`32bb554f5b`](nodejs/node@32bb554f5b)] - **crypto**: fix large DH generator validation (Tobias Nießen) [#&#8203;64092](nodejs/node#64092)
- \[[`0908d76ef6`](nodejs/node@0908d76ef6)] - **crypto**: reject small-order EdDSA points during verify (Filip Skokan) [#&#8203;64026](nodejs/node#64026)
- \[[`7f7e5863c2`](nodejs/node@7f7e5863c2)] - **deps**: update undici to 8.7.0 (Node.js GitHub Bot) [#&#8203;64282](nodejs/node#64282)
- \[[`af91029801`](nodejs/node@af91029801)] - **deps**: update nghttp3 to 1.17.0 (Node.js GitHub Bot) [#&#8203;64182](nodejs/node#64182)
- \[[`2e500ba7b0`](nodejs/node@2e500ba7b0)] - **deps**: update googletest to [`8b53336`](nodejs/node@8b53336) (Node.js GitHub Bot) [#&#8203;64181](nodejs/node#64181)
- \[[`74e3aa24ba`](nodejs/node@74e3aa24ba)] - **deps**: update sqlite to 3.53.3 (Node.js GitHub Bot) [#&#8203;64180](nodejs/node#64180)
- \[[`c7e57f55a7`](nodejs/node@c7e57f55a7)] - **deps**: c-ares: cherry-pick [`8ba37af`](nodejs/node@8ba37af8e3fb) (René) [#&#8203;64110](nodejs/node#64110)
- \[[`879fdc4daf`](nodejs/node@879fdc4daf)] - **deps**: V8: backport [`da20a19`](nodejs/node@da20a197a7f9) (Kevin Gibbons) [#&#8203;64101](nodejs/node#64101)
- \[[`a640543a7c`](nodejs/node@a640543a7c)] - **deps**: V8: cherry-pick [`0cc9eb2`](nodejs/node@0cc9eb22c0b0) (Kevin Gibbons) [#&#8203;64101](nodejs/node#64101)
- \[[`feefd179e5`](nodejs/node@feefd179e5)] - **deps**: V8: cherry-pick [`1a391f9`](nodejs/node@1a391f98cc7a) (Kevin Gibbons) [#&#8203;64101](nodejs/node#64101)
- \[[`8ef643d4b0`](nodejs/node@8ef643d4b0)] - **deps**: update googletest to [`0b1e895`](nodejs/node@0b1e895) (Node.js GitHub Bot) [#&#8203;64039](nodejs/node#64039)
- \[[`9e50bb0655`](nodejs/node@9e50bb0655)] - **dgram**: skip dns.lookup() for literal IP addresses (Ruben Bridgewater) [#&#8203;64133](nodejs/node#64133)
- \[[`dc052c095c`](nodejs/node@dc052c095c)] - **diagnostics\_channel**: return original thenable (Stephen Belanger) [#&#8203;62407](nodejs/node#62407)
- \[[`a22a840293`](nodejs/node@a22a840293)] - **doc**: clarify QUIC stream state wording (EduardF1) [#&#8203;63660](nodejs/node#63660)
- \[[`8d4bec2d71`](nodejs/node@8d4bec2d71)] - **doc**: update Http2SecureServer.on("timeout") default value (YuSheng Chen) [#&#8203;64187](nodejs/node#64187)
- \[[`da88f70afa`](nodejs/node@da88f70afa)] - **doc**: add note on visibility of CI failures to new contributor guide (Stewart X Addison) [#&#8203;64256](nodejs/node#64256)
- \[[`20ce359ccb`](nodejs/node@20ce359ccb)] - **doc**: clarify HTTP/1.1 response ordering (Matteo Collina) [#&#8203;64213](nodejs/node#64213)
- \[[`05eae2835c`](nodejs/node@05eae2835c)] - **doc**: recommend node-stress-single-test for flaky tests (Trivikram Kamat) [#&#8203;64223](nodejs/node#64223)
- \[[`3966eb67e7`](nodejs/node@3966eb67e7)] - **doc**: fix typo in examples (Vas Sudanagunta) [#&#8203;64184](nodejs/node#64184)
- \[[`12a2b9daa3`](nodejs/node@12a2b9daa3)] - **doc**: fix typo in node-config-schema.json (Hamid Reza Ghavami) [#&#8203;64188](nodejs/node#64188)
- \[[`0854482671`](nodejs/node@0854482671)] - **doc**: clarify defense-in-depth issues (Matteo Collina) [#&#8203;64215](nodejs/node#64215)
- \[[`ef4915fc3a`](nodejs/node@ef4915fc3a)] - **doc**: fix Fast FFI argument count in ffi.md (Daijiro Wachi) [#&#8203;63960](nodejs/node#63960)
- \[[`bb2eed863c`](nodejs/node@bb2eed863c)] - **doc**: add sxa GPG key ([`ed25519`](nodejs/node@ed25519)) (Stewart X Addison) [#&#8203;64193](nodejs/node#64193)
- \[[`b7bf6e3a06`](nodejs/node@b7bf6e3a06)] - **doc**: add guide and answers to FAQs for first-time contributors (Joyee Cheung) [#&#8203;63685](nodejs/node#63685)
- \[[`ff537ba858`](nodejs/node@ff537ba858)] - **doc**: update `Http2Server.close` & `Http2SecureServer.close` (YuSheng Chen) [#&#8203;63298](nodejs/node#63298)
- \[[`f3db304588`](nodejs/node@f3db304588)] - **doc**: update list of people in `SECURITY.md` (Richard Lau) [#&#8203;64152](nodejs/node#64152)
- \[[`2a126647b0`](nodejs/node@2a126647b0)] - **doc**: clarify vfs is not a sandbox (Matteo Collina) [#&#8203;64143](nodejs/node#64143)
- \[[`85fc79dd9b`](nodejs/node@85fc79dd9b)] - **doc**: fix broken links and duplicate stability label (Antoine du Hamel) [#&#8203;64130](nodejs/node#64130)
- \[[`189e830eb3`](nodejs/node@189e830eb3)] - **doc**: add missing option to man page (Richard Lau) [#&#8203;64156](nodejs/node#64156)
- \[[`7a16ccccd0`](nodejs/node@7a16ccccd0)] - **doc**: announce upcoming end of tier 2 support for macOS x64 (Antoine du Hamel) [#&#8203;63931](nodejs/node#63931)
- \[[`d5f826045f`](nodejs/node@d5f826045f)] - **doc**: update toolchain for official AIX releases (Richard Lau) [#&#8203;64068](nodejs/node#64068)
- \[[`60abc4400f`](nodejs/node@60abc4400f)] - **doc**: fix callback example import in fs docs (Kamal Rawal) [#&#8203;63912](nodejs/node#63912)
- \[[`e470c74a6c`](nodejs/node@e470c74a6c)] - **doc**: fix keepAliveTimeout default in http.createServer options (Jahanzaib iqbal) [#&#8203;63974](nodejs/node#63974)
- \[[`851b460583`](nodejs/node@851b460583)] - **esm**: improve ERR\_REQUIRE\_ASYNC\_MODULE (Joyee Cheung) [#&#8203;64260](nodejs/node#64260)
- \[[`0cd443df39`](nodejs/node@0cd443df39)] - **esm**: print required top-level await locations without evaluating (Joyee Cheung) [#&#8203;64154](nodejs/node#64154)
- \[[`b373202efc`](nodejs/node@b373202efc)] - **(SEMVER-MINOR)** **esm**: add `--experimental-import-text` flag (Efe) [#&#8203;62300](nodejs/node#62300)
- \[[`eacfbd0ca5`](nodejs/node@eacfbd0ca5)] - **http**: add CONNECT method handling for default Host header with proxy (Archkon) [#&#8203;64114](nodejs/node#64114)
- \[[`aeb539a383`](nodejs/node@aeb539a383)] - **http**: fix drain event with cork/uncork (David Evans) [#&#8203;64038](nodejs/node#64038)
- \[[`8e8874b216`](nodejs/node@8e8874b216)] - **http**: document and validate options.path when it's in absolute-form (Joyee Cheung) [#&#8203;64108](nodejs/node#64108)
- \[[`eb2e96bc28`](nodejs/node@eb2e96bc28)] - **inspector**: fix crash when writing to closed inspector socket (ympark2011) [#&#8203;64209](nodejs/node#64209)
- \[[`243b0e4e57`](nodejs/node@243b0e4e57)] - **lib**: reject string "0" in validatePort when allowZero is false (Daijiro Wachi) [#&#8203;64174](nodejs/node#64174)
- \[[`34a537c0ed`](nodejs/node@34a537c0ed)] - **lib**: use `__proto__: null` when calling `ObjectDefineProperty` (Antoine du Hamel) [#&#8203;64239](nodejs/node#64239)
- \[[`1f72393f19`](nodejs/node@1f72393f19)] - **lib**: lazily initialize kEvents and kHandlers maps (Guilherme Araújo) [#&#8203;63702](nodejs/node#63702)
- \[[`92a3dc3191`](nodejs/node@92a3dc3191)] - **lib,permission**: fix addon permission drop (Martin Wagner) [#&#8203;64007](nodejs/node#64007)
- \[[`87b8f2a296`](nodejs/node@87b8f2a296)] - **meta**: fix linter warning in `stale.yml` (Antoine du Hamel) [#&#8203;64281](nodejs/node#64281)
- \[[`829c4a5913`](nodejs/node@829c4a5913)] - **meta**: bump actions/cache from 5.0.5 to 6.1.0 (dependabot\[bot]) [#&#8203;64248](nodejs/node#64248)
- \[[`0808dcd31c`](nodejs/node@0808dcd31c)] - **meta**: bump github/codeql-action/autobuild from 4.36.1 to 4.36.2 (dependabot\[bot]) [#&#8203;64247](nodejs/node#64247)
- \[[`64aa17058f`](nodejs/node@64aa17058f)] - **meta**: bump github/codeql-action/analyze from 4.36.1 to 4.36.2 (dependabot\[bot]) [#&#8203;64246](nodejs/node#64246)
- \[[`873d1e0412`](nodejs/node@873d1e0412)] - **meta**: bump actions/checkout from 6.0.2 to 7.0.0 (dependabot\[bot]) [#&#8203;64245](nodejs/node#64245)
- \[[`fe460ccf0b`](nodejs/node@fe460ccf0b)] - **meta**: bump codecov/codecov-action from 6.0.1 to 7.0.0 (dependabot\[bot]) [#&#8203;64244](nodejs/node#64244)
- \[[`845c63ed50`](nodejs/node@845c63ed50)] - **meta**: bump rtCamp/action-slack-notify from 2.3.3 to 2.4.0 (dependabot\[bot]) [#&#8203;64243](nodejs/node#64243)
- \[[`2cad2d6de5`](nodejs/node@2cad2d6de5)] - **meta**: bump github/codeql-action/init from 4.36.1 to 4.36.2 (dependabot\[bot]) [#&#8203;64242](nodejs/node#64242)
- \[[`0ddde950c7`](nodejs/node@0ddde950c7)] - **meta**: bump actions/setup-python from 6.2.0 to 6.3.0 (dependabot\[bot]) [#&#8203;64241](nodejs/node#64241)
- \[[`c0a8760d2f`](nodejs/node@c0a8760d2f)] - **meta**: bump github/codeql-action/upload-sarif from 4.36.1 to 4.36.2 (dependabot\[bot]) [#&#8203;64240](nodejs/node#64240)
- \[[`f49704b9d0`](nodejs/node@f49704b9d0)] - **meta**: clarify V8 flags are outside threat model (Matteo Collina) [#&#8203;64224](nodejs/node#64224)
- \[[`6b8dc58e6e`](nodejs/node@6b8dc58e6e)] - **meta**: move one or more collaborators to emeritus (Node.js GitHub Bot) [#&#8203;64057](nodejs/node#64057)
- \[[`fe5260cca7`](nodejs/node@fe5260cca7)] - **meta**: update status of past strategic initiatives (Joyee Cheung) [#&#8203;63480](nodejs/node#63480)
- \[[`7b01040008`](nodejs/node@7b01040008)] - **meta**: speed up stale bot (Aviv Keller) [#&#8203;64075](nodejs/node#64075)
- \[[`874c46c24f`](nodejs/node@874c46c24f)] - **meta**: update sccache version in test-linux-quic (René) [#&#8203;64043](nodejs/node#64043)
- \[[`48c5c86363`](nodejs/node@48c5c86363)] - **module**: enable import support for addons by default (Chengzhong Wu) [#&#8203;64221](nodejs/node#64221)
- \[[`39e0c14455`](nodejs/node@39e0c14455)] - **(SEMVER-MINOR)** **perf\_hooks**: sample delay per event loop iteration (Pablo Erhard) [#&#8203;62935](nodejs/node#62935)
- \[[`f90f1bd032`](nodejs/node@f90f1bd032)] - **perf\_hooks**: add NODE\_PERFORMANCE\_GC\_MINOR\_MARK\_SWEEP constant (Attila Szegedi) [#&#8203;63877](nodejs/node#63877)
- \[[`bdf32628c7`](nodejs/node@bdf32628c7)] - **process**: fix finalization cleanup ref tracking (Trivikram Kamat) [#&#8203;64087](nodejs/node#64087)
- \[[`9a65b7fff4`](nodejs/node@9a65b7fff4)] - **quic**: drop version negotiation packets with oversized CIDs (Mohamed Sayed) [#&#8203;64228](nodejs/node#64228)
- \[[`2699fe4706`](nodejs/node@2699fe4706)] - **quic**: fixes undefined handle in QuicStream kInspect (Marten Richter) [#&#8203;64170](nodejs/node#64170)
- \[[`00dea28bb3`](nodejs/node@00dea28bb3)] - **repl**: lazy-load acorn and defer vm context creation (Daijiro Wachi) [#&#8203;63879](nodejs/node#63879)
- \[[`ce659a1cf9`](nodejs/node@ce659a1cf9)] - **src**: fix escaping of single quotes in task runner (Antoine du Hamel) [#&#8203;64089](nodejs/node#64089)
- \[[`dbb3126e5c`](nodejs/node@dbb3126e5c)] - **src**: abstract tracing agent for both legacy and perfetto (Chengzhong Wu) [#&#8203;64053](nodejs/node#64053)
- \[[`12edf1d68d`](nodejs/node@12edf1d68d)] - **src**: avoid redundant call to `std::get_if<>()` (Tobias Nießen) [#&#8203;64094](nodejs/node#64094)
- \[[`eda91b6d01`](nodejs/node@eda91b6d01)] - **src**: avoid copying source string in TextEncoder.encode (Yagiz Nizipli) [#&#8203;63897](nodejs/node#63897)
- \[[`efbbb9a03c`](nodejs/node@efbbb9a03c)] - **stream**: preserve half-open duplexes in async iteration (Efe) [#&#8203;64275](nodejs/node#64275)
- \[[`999a83c937`](nodejs/node@999a83c937)] - **(SEMVER-MINOR)** **stream**: expose ReadableStreamTee (Matteo Collina) [#&#8203;64195](nodejs/node#64195)
- \[[`ab5ed72903`](nodejs/node@ab5ed72903)] - **stream**: reject iter consumers on abort (Trivikram Kamat) [#&#8203;64066](nodejs/node#64066)
- \[[`d3fa77c5e2`](nodejs/node@d3fa77c5e2)] - **stream**: fix merge abort for pending sources (Trivikram Kamat) [#&#8203;64013](nodejs/node#64013)
- \[[`38b99140ed`](nodejs/node@38b99140ed)] - **stream**: refactor unnecessary optional chaining away (Antoine du Hamel) [#&#8203;64253](nodejs/node#64253)
- \[[`c81f894ebe`](nodejs/node@c81f894ebe)] - **stream**: cut per-chunk overhead in WHATWG streams (Matteo Collina) [#&#8203;64252](nodejs/node#64252)
- \[[`f162234f24`](nodejs/node@f162234f24)] - **stream**: normalize Broadcast.from() byte inputs (Trivikram Kamat) [#&#8203;64082](nodejs/node#64082)
- \[[`1182ad8f3b`](nodejs/node@1182ad8f3b)] - **stream**: proxy first own method in Readable.wrap() (Daijiro Wachi) [#&#8203;64048](nodejs/node#64048)
- \[[`d0b830b382`](nodejs/node@d0b830b382)] - **stream**: observe abort while awaiting pipeTo source (Trivikram Kamat) [#&#8203;64015](nodejs/node#64015)
- \[[`f7adcd8359`](nodejs/node@f7adcd8359)] - **stream**: respect iter consumer abort signals (Trivikram Kamat) [#&#8203;63997](nodejs/node#63997)
- \[[`b09e624c6f`](nodejs/node@b09e624c6f)] - **test**: make blob desiredSize assertion robust (Trivikram Kamat) [#&#8203;64106](nodejs/node#64106)
- \[[`d0d8f0c774`](nodejs/node@d0d8f0c774)] - **test**: update WPT for urlpattern to [`11a459a`](nodejs/node@11a459a2b1) (Node.js GitHub Bot) [#&#8203;64037](nodejs/node#64037)
- \[[`ff9122c20c`](nodejs/node@ff9122c20c)] - **test**: improve lcov reporter snapshot diagnostics (Trivikram Kamat) [#&#8203;64049](nodejs/node#64049)
- \[[`570952d4f3`](nodejs/node@570952d4f3)] - **test**: keep finalization close fixture ref alive (Trivikram Kamat) [#&#8203;64085](nodejs/node#64085)
- \[[`1b4f213380`](nodejs/node@1b4f213380)] - **test**: fix typo from overriden to overridden (parkhojeong) [#&#8203;63403](nodejs/node#63403)
- \[[`4c91090b8b`](nodejs/node@4c91090b8b)] - **test**: fix typo from funciton to function (parkhojeong) [#&#8203;63403](nodejs/node#63403)
- \[[`bf080c7917`](nodejs/node@bf080c7917)] - **test**: mark hr-time WPT flaky on macos15-x64 (Trivikram Kamat) [#&#8203;64054](nodejs/node#64054)
- \[[`24e32098c5`](nodejs/node@24e32098c5)] - **test**: use one-off agent in http consumed timeout test (Trivikram Kamat) [#&#8203;64052](nodejs/node#64052)
- \[[`3229886de2`](nodejs/node@3229886de2)] - **test**: fix flaky test-runner coverage threshold test (Trivikram Kamat) [#&#8203;64051](nodejs/node#64051)
- \[[`83b91ea6ec`](nodejs/node@83b91ea6ec)] - **test\_runner**: filter execArgv fallback for child tests (Trivikram Kamat) [#&#8203;64056](nodejs/node#64056)
- \[[`269b609a3d`](nodejs/node@269b609a3d)] - **test\_runner**: improve coverage failure diagnostics (Trivikram Kamat) [#&#8203;64050](nodejs/node#64050)
- \[[`0342744c34`](nodejs/node@0342744c34)] - **test\_runner**: add timestamp to JUnit reporter testsuites (sangwook) [#&#8203;64029](nodejs/node#64029)
- \[[`086741d121`](nodejs/node@086741d121)] - **timers**: reuse Timeout objects in setStreamTimeout (Matteo Collina) [#&#8203;64254](nodejs/node#64254)
- \[[`4e0236dc3d`](nodejs/node@4e0236dc3d)] - **(SEMVER-MINOR)** **tls**: report negotiated TLS groups (Filip Skokan) [#&#8203;64119](nodejs/node#64119)
- \[[`3bdd7e20be`](nodejs/node@3bdd7e20be)] - **tls**: handle large RSA exponents in X.509 cert (Tobias Nießen) [#&#8203;64093](nodejs/node#64093)
- \[[`c96c838977`](nodejs/node@c96c838977)] - **tools**: update RUSTC\_VERSION for remaining GHA workflows (René) [#&#8203;64325](nodejs/node#64325)
- \[[`ee873b7aaf`](nodejs/node@ee873b7aaf)] - **tools**: bump `temporal_rs` version (Antoine du Hamel) [#&#8203;63281](nodejs/node#63281)
- \[[`ea3b870155`](nodejs/node@ea3b870155)] - **tools**: remove `envinfo` from our workflows (Antoine du Hamel) [#&#8203;64259](nodejs/node#64259)
- \[[`d940f02e8b`](nodejs/node@d940f02e8b)] - **tools**: bump the eslint group in /tools/eslint with 8 updates (dependabot\[bot]) [#&#8203;64249](nodejs/node#64249)
- \[[`fe0ea2bb5d`](nodejs/node@fe0ea2bb5d)] - **tools**: bump [@&#8203;node-core/doc-kit](https://github.com/node-core/doc-kit) (dependabot\[bot]) [#&#8203;64010](nodejs/node#64010)
- \[[`4dceefde1e`](nodejs/node@4dceefde1e)] - **tools**: bump undici from 6.24.1 to 6.27.0 in /tools/doc (dependabot\[bot]) [#&#8203;64031](nodejs/node#64031)
- \[[`6e187db7d7`](nodejs/node@6e187db7d7)] - **tools**: update c-ares updater script (Antoine du Hamel) [#&#8203;64194](nodejs/node#64194)
- \[[`657a35f5a2`](nodejs/node@657a35f5a2)] - **tools**: validate version number in release proposal commit message lint (Antoine du Hamel) [#&#8203;64070](nodejs/node#64070)
- \[[`17228a861c`](nodejs/node@17228a861c)] - **tools**: add GHA benchmark runner (Antoine du Hamel) [#&#8203;60293](nodejs/node#60293)
- \[[`6d11a71d91`](nodejs/node@6d11a71d91)] - **tools**: update `build-shared/action.yml` to a reusable workflow (Antoine du Hamel) [#&#8203;64059](nodejs/node#64059)
- \[[`7a17c50b7f`](nodejs/node@7a17c50b7f)] - **tools**: update libffi updater script (Antoine du Hamel) [#&#8203;64046](nodejs/node#64046)
- \[[`28047a3e71`](nodejs/node@28047a3e71)] - **tools**: exclude `libffi` changes from `test-shared` GHA CI (Antoine du Hamel) [#&#8203;64047](nodejs/node#64047)
- \[[`58d9685acc`](nodejs/node@58d9685acc)] - **typings**: add typing for crypto (Filip Skokan) [#&#8203;64122](nodejs/node#64122)
- \[[`7a9dcad44d`](nodejs/node@7a9dcad44d)] - **util**: fix OOM in inspect color stack formatting (Ijtihed Kilani) [#&#8203;64022](nodejs/node#64022)
- \[[`d5f01bbbde`](nodejs/node@d5f01bbbde)] - **vfs**: reject rename into descendant directory (Trivikram Kamat) [#&#8203;64285](nodejs/node#64285)
- \[[`0b6af91081`](nodejs/node@0b6af91081)] - **vfs**: handle current-position sentinel in memory files (Trivikram Kamat) [#&#8203;64163](nodejs/node#64163)
- \[[`322230d641`](nodejs/node@322230d641)] - **vfs**: support writeFileSync with virtual fds (Trivikram Kamat) [#&#8203;64165](nodejs/node#64165)
- \[[`9395d209c7`](nodejs/node@9395d209c7)] - **vfs**: avoid recursive readdir symlink cycles (Matteo Collina) [#&#8203;64168](nodejs/node#64168)
- \[[`bbdd7643b6`](nodejs/node@bbdd7643b6)] - **vfs**: read RealFSProvider files from open fd (Trivikram Kamat) [#&#8203;64104](nodejs/node#64104)
- \[[`92859b8097`](nodejs/node@92859b8097)] - **vm**: fix copying PropertyDescriptor (Chengzhong Wu) [#&#8203;64073](nodejs/node#64073)
- \[[`9046035475`](nodejs/node@9046035475)] - **zlib**: validate flush king for all streams (Ic3b3rg) [#&#8203;63746](nodejs/node#63746)
- \[[`98be4304a3`](nodejs/node@98be4304a3)] - **zlib**: validate flush kind for brotli streams (Ic3b3rg) [#&#8203;63746](nodejs/node#63746)
- \[[`90007a59a9`](nodejs/node@90007a59a9)] - **zlib**: expose rejectGarbageAfterEnd option (Filip Skokan) [#&#8203;64023](nodejs/node#64023)
- \[[`5933516066`](nodejs/node@5933516066)] - **zlib**: reject trailing gzip members in web streams (Filip Skokan) [#&#8203;64023](nodejs/node#64023)

</details>

---

### Configuration

📅 **Schedule**: (UTC)

- Branch creation
  - At any time (no schedule defined)
- Automerge
  - At any time (no schedule defined)

🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied.

♻ **Rebasing**: Whenever MR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 **Ignore**: Close this MR and you won't be reminded about this update again.

---

 - [ ] <!-- rebase-check -->If you want to rebase/retry this MR, check this box

---

This MR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4yNTYuMCIsInVwZGF0ZWRJblZlciI6IjQzLjI1Ni4wIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJSZW5vdmF0ZSBCb3QiLCJhdXRvbWF0aW9uOmJvdC1hdXRob3JlZCIsImRlcGVuZGVuY3ktdHlwZTo6bWlub3IiXX0=-->
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@mcollina mcollina mcollina approved these changes
@pimterry pimterry pimterry approved these changes
@UlisesGascon UlisesGascon UlisesGascon approved these changes
+1 more reviewer
@metcoder95 metcoder95 metcoder95 approved these changes
Reviewers whose approvals may not affect merge requirements

Assignees

No one assigned

Labels

http Issues or PRs related to the http subsystem. needs-ci PRs that need a full CI run.

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

6 participants

@joyeecheung @nodejs-github-bot @mcollina @pimterry @UlisesGascon @metcoder95