http: add CONNECT method handling for default Host header when using proxy by Archkon · Pull Request #64114 · nodejs/node

Archkon · 2026-06-24T14:44:48Z

nodejs-github-bot · 2026-06-24T14:44:53Z

Review requested:

@nodejs/http
@nodejs/net

pimterry · 2026-06-26T15:31:05Z

Hi @Archkon! Thanks for this PR. It looks like there's a failing test (which pins the previous incorrect output) and the commit message is failing the linting. You'll need to fix the test, and update the commit message (git commit -s --amend) to fix the issues, and then force push to update this.

Otherwise the code looks good to me. My main concern is whether this is a breaking change: I agree the current behaviour is wrong, but it I'm not sure if changing it is likely to cause issues elsewhere in code that now expects this wrong Host value (even if the RFCs says they shouldn't) e.g. our own test suite.

What do @nodejs/http think? AFAICT the current behaviour has been in place for more than a decade. Tempted to lean semver-major just in case, even though it's fundamentally really a bug fix.

Archkon · 2026-06-26T16:05:35Z

Hi @Archkon! Thanks for this PR. It looks like there's a failing test (which pins the previous incorrect output) and the commit message is failing the linting. You'll need to fix the test, and update the commit message (git commit -s --amend) to fix the issues, and then force push to update this.

Otherwise the code looks good to me. My main concern is whether this is a breaking change: I agree the current behaviour is wrong, but it I'm not sure if changing it is likely to cause issues elsewhere in code that now expects this wrong Host value (even if the RFCs says they shouldn't) e.g. our own test suite.

What do @nodejs/http think? AFAICT the current behaviour has been in place for more than a decade. Tempted to lean semver-major just in case, even though it's fundamentally really a bug fix.

I just feel that many framework developers aren’t aware of this underlying bug, because they assume CONNECT method will ensure RFC-compliant handling.

mcollina · 2026-07-01T06:19:46Z

@pimterry we use the "baking for lts" label and ship, that allows us to asses ecosystem impact.

mcollina

lgtm

nodejs-github-bot · 2026-07-01T06:52:17Z

CI: https://ci.nodejs.org/job/node-test-pull-request/74477/

Signed-off-by: Archkon <180910180+Archkon@users.noreply.github.com>

Archkon · 2026-07-01T12:45:17Z

lgtm

Rebased this PR on the latest nodejs:main and resolved the conflict with #64108
@mcollina Could you please trigger a fresh CI run by applying request-ci? Thanks !

nodejs-github-bot · 2026-07-02T14:58:19Z

CI: https://ci.nodejs.org/job/node-test-pull-request/74517/

Archkon · 2026-07-02T16:27:41Z

@pimterry I can't access to jenkins ci so I don't know what is wrong with ci issue . And should I resolve the these problems?

nodejs-github-bot · 2026-07-03T07:35:39Z

CI: https://ci.nodejs.org/job/node-test-pull-request/74528/

pimterry · 2026-07-03T07:36:37Z

@Archkon It looks like just flaky tests, nothing to worry about there. I've rerun it.

nodejs-github-bot · 2026-07-03T11:54:28Z

Commit Queue failed

- Loading data for nodejs/node/pull/64114 ✔ Done loading data for nodejs/node/pull/64114 ----------------------------------- PR info ------------------------------------ Title http: add CONNECT method handling for default Host header when using proxy (#64114) ⚠ Could not retrieve the email or name of the PR author's from user's GitHub profile! Branch Archkon:main -> nodejs:main Labels http, baking-for-lts, needs-ci Commits 2 - http: add CONNECT method handling for default Host header with proxy - test: update CONNECT Host header expectation Committers 1 - Archkon <180910180+Archkon@users.noreply.github.com> PR-URL: https://github.com/nodejs/node/pull/64114 Fixes: https://github.com/nodejs/node/issues/63945 Reviewed-By: Matteo Collina <matteo.collina@gmail.com> Reviewed-By: Tim Perry <pimterry@gmail.com> ------------------------------ Generated metadata ------------------------------ PR-URL: https://github.com/nodejs/node/pull/64114 Fixes: https://github.com/nodejs/node/issues/63945 Reviewed-By: Matteo Collina <matteo.collina@gmail.com> Reviewed-By: Tim Perry <pimterry@gmail.com> -------------------------------------------------------------------------------- ℹ This PR was created on Wed, 24 Jun 2026 14:44:48 GMT ✔ Approvals: 2 ✔ - Matteo Collina (@mcollina) (TSC): https://github.com/nodejs/node/pull/64114#pullrequestreview-4606267464 ✔ - Tim Perry (@pimterry): https://github.com/nodejs/node/pull/64114#pullrequestreview-4618463647 ✔ Last GitHub CI successful ℹ Last Full PR CI on 2026-07-03T07:35:39Z: https://ci.nodejs.org/job/node-test-pull-request/74528/ - Querying data for job/node-test-pull-request/74528/ ✔ Build data downloaded ✔ Last Jenkins CI successful -------------------------------------------------------------------------------- ✔ No git cherry-pick in progress ✔ No git am in progress ✔ No git rebase in progress -------------------------------------------------------------------------------- - Bringing origin/main up to date... From https://github.com/nodejs/node * branch main -> FETCH_HEAD ✔ origin/main is now up-to-date - Downloading patch for 64114 From https://github.com/nodejs/node * branch refs/pull/64114/merge -> FETCH_HEAD ✔ Fetched commits as 8a35750a45fd..17099b210432 -------------------------------------------------------------------------------- [main 4e24bdeaac] http: add CONNECT method handling for default Host header with proxy Author: Archkon <180910180+Archkon@users.noreply.github.com> Date: Wed Jun 24 22:32:15 2026 +0800 2 files changed, 40 insertions(+), 1 deletion(-) create mode 100644 test/parallel/test-http-connect-default-host-header.js [main 302981e1c2] test: update CONNECT Host header expectation Author: Archkon <180910180+Archkon@users.noreply.github.com> Date: Fri Jun 26 23:32:16 2026 +0800 1 file changed, 1 insertion(+), 1 deletion(-) ✔ Patches applied There are 2 commits in the PR. Attempting autorebase. (node:379) [DEP0190] DeprecationWarning: Passing args to a child process with shell option true can lead to security vulnerabilities, as the arguments are not escaped, only concatenated. (Use `node --trace-deprecation ...` to show where the warning was created) Rebasing (2/4) Executing: git node land --amend --yes --------------------------------- New Message ---------------------------------- http: add CONNECT method handling for default Host header with proxy

Signed-off-by: Archkon <180910180+Archkon@users.noreply.github.com>
PR-URL: #64114
Fixes: #63945
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
Reviewed-By: Tim Perry <pimterry@gmail.com>

[detached HEAD 2f0c0977cc] http: add CONNECT method handling for default Host header with proxy
Author: Archkon <180910180+Archkon@users.noreply.github.com>
Date: Wed Jun 24 22:32:15 2026 +0800
2 files changed, 40 insertions(+), 1 deletion(-)
create mode 100644 test/parallel/test-http-connect-default-host-header.js
Rebasing (3/4)
Rebasing (4/4)
Executing: git node land --amend --yes
--------------------------------- New Message ----------------------------------
test: update CONNECT Host header expectation

Signed-off-by: Archkon <180910180+Archkon@users.noreply.github.com>
PR-URL: #64114
Fixes: #63945
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
Reviewed-By: Tim Perry <pimterry@gmail.com>

[detached HEAD e24e5b4cd0] test: update CONNECT Host header expectation
Author: Archkon <180910180+Archkon@users.noreply.github.com>
Date: Fri Jun 26 23:32:16 2026 +0800
1 file changed, 1 insertion(+), 1 deletion(-)
Successfully rebased and updated refs/heads/main.

ℹ Add commit-queue-squash label to land the PR as one commit, or commit-queue-rebase to land as separate commits.

https://github.com/nodejs/node/actions/runs/28658695913

nodejs-github-bot · 2026-07-03T12:34:29Z

Landed in 0e2126d

Signed-off-by: Archkon <180910180+Archkon@users.noreply.github.com> PR-URL: #64114 Fixes: #63945 Reviewed-By: Matteo Collina <matteo.collina@gmail.com> Reviewed-By: Tim Perry <pimterry@gmail.com>

This MR contains the following updates: | Package | Update | Change | |---|---|---| | [node](https://nodejs.org) ([source](https://github.com/nodejs/node)) | minor | `26.3.1` → `26.5.0` | MR created with the help of [el-capitano/tools/renovate-bot](https://gitlab.com/el-capitano/tools/renovate-bot). **Proposed changes to behavior should be submitted there as MRs.** --- ### Release Notes <details> <summary>nodejs/node (node)</summary> ### [`v26.5.0`](https://github.com/nodejs/node/releases/tag/v26.5.0): 2026-07-08, Version 26.5.0 (Current), @richardlau [Compare Source](nodejs/node@v26.3.1...v26.5.0) ##### Notable Changes ##### New release key Welcome to our newest releaser, [Stewart X Addison](https://github.com/sxa). Future Node.js releases may be signed with his [release key](https://github.com/nodejs/node/blob/main/README.md#release-keys), `655F3B5C1FB3FA8D1A0CA6BDE4A7D232B936D2FD`. ##### Other notable changes - \[[`55f48446c7`](nodejs/node@55f48446c7)] - **(SEMVER-MINOR)** **buffer**: implement blob.textStream() (Matthew Aitken) [#64036](nodejs/node#64036) - \[[`b373202efc`](nodejs/node@b373202efc)] - **(SEMVER-MINOR)** **esm**: add `--experimental-import-text` flag (Efe) [#62300](nodejs/node#62300) - \[[`39e0c14455`](nodejs/node@39e0c14455)] - **(SEMVER-MINOR)** **perf\_hooks**: sample delay per event loop iteration (Pablo Erhard) [#62935](nodejs/node#62935) - \[[`999a83c937`](nodejs/node@999a83c937)] - **(SEMVER-MINOR)** **stream**: expose ReadableStreamTee (Matteo Collina) [#64195](nodejs/node#64195) - \[[`4e0236dc3d`](nodejs/node@4e0236dc3d)] - **(SEMVER-MINOR)** **tls**: report negotiated TLS groups (Filip Skokan) [#64119](nodejs/node#64119) ##### Commits - \[[`87648c0a6c`](nodejs/node@87648c0a6c)] - **benchmark**: trim down the argon2 sets (Filip Skokan) [#64218](nodejs/node#64218) - \[[`a483bfd3f0`](nodejs/node@a483bfd3f0)] - **buffer**: remove unreachable overflow check in atob (haramjeong) [#60161](nodejs/node#60161) - \[[`6d14279688`](nodejs/node@6d14279688)] - **buffer**: add fast api for isUtf8 and isAscii (Gürgün Dayıoğlu) [#64169](nodejs/node#64169) - \[[`55f48446c7`](nodejs/node@55f48446c7)] - **(SEMVER-MINOR)** **buffer**: implement blob.textStream() (Matthew Aitken) [#64036](nodejs/node#64036) - \[[`a67d9a7a44`](nodejs/node@a67d9a7a44)] - **build**: allow linting node.1 (Aviv Keller) [#64157](nodejs/node#64157) - \[[`06c1fbc25b`](nodejs/node@06c1fbc25b)] - **build**: enable Maglev for riscv64 (Jamie Magee) [#62605](nodejs/node#62605) - \[[`518309c363`](nodejs/node@518309c363)] - **build**: suppress clang errors building libffi on Windows (René) [#64222](nodejs/node#64222) - \[[`6a80ab485c`](nodejs/node@6a80ab485c)] - **build**: add manually-dispatched stress-test workflow (Joyee Cheung) [#64118](nodejs/node#64118) - \[[`f4e7bf1f1c`](nodejs/node@f4e7bf1f1c)] - **build**: pin envinfo versions in github actions (Joyee Cheung) [#64117](nodejs/node#64117) - \[[`66f6ac0d86`](nodejs/node@66f6ac0d86)] - **build**: support setting an emulator from configure script (Ivan Trubach) [#53899](nodejs/node#53899) - \[[`7f26c54aa6`](nodejs/node@7f26c54aa6)] - **child\_process**: fix permission model propagation via NODE\_OPTIONS (Matteo Collina) [#63972](nodejs/node#63972) - \[[`32bb554f5b`](nodejs/node@32bb554f5b)] - **crypto**: fix large DH generator validation (Tobias Nießen) [#64092](nodejs/node#64092) - \[[`0908d76ef6`](nodejs/node@0908d76ef6)] - **crypto**: reject small-order EdDSA points during verify (Filip Skokan) [#64026](nodejs/node#64026) - \[[`7f7e5863c2`](nodejs/node@7f7e5863c2)] - **deps**: update undici to 8.7.0 (Node.js GitHub Bot) [#64282](nodejs/node#64282) - \[[`af91029801`](nodejs/node@af91029801)] - **deps**: update nghttp3 to 1.17.0 (Node.js GitHub Bot) [#64182](nodejs/node#64182) - \[[`2e500ba7b0`](nodejs/node@2e500ba7b0)] - **deps**: update googletest to [`8b53336`](nodejs/node@8b53336) (Node.js GitHub Bot) [#64181](nodejs/node#64181) - \[[`74e3aa24ba`](nodejs/node@74e3aa24ba)] - **deps**: update sqlite to 3.53.3 (Node.js GitHub Bot) [#64180](nodejs/node#64180) - \[[`c7e57f55a7`](nodejs/node@c7e57f55a7)] - **deps**: c-ares: cherry-pick [`8ba37af`](nodejs/node@8ba37af8e3fb) (René) [#64110](nodejs/node#64110) - \[[`879fdc4daf`](nodejs/node@879fdc4daf)] - **deps**: V8: backport [`da20a19`](nodejs/node@da20a197a7f9) (Kevin Gibbons) [#64101](nodejs/node#64101) - \[[`a640543a7c`](nodejs/node@a640543a7c)] - **deps**: V8: cherry-pick [`0cc9eb2`](nodejs/node@0cc9eb22c0b0) (Kevin Gibbons) [#64101](nodejs/node#64101) - \[[`feefd179e5`](nodejs/node@feefd179e5)] - **deps**: V8: cherry-pick [`1a391f9`](nodejs/node@1a391f98cc7a) (Kevin Gibbons) [#64101](nodejs/node#64101) - \[[`8ef643d4b0`](nodejs/node@8ef643d4b0)] - **deps**: update googletest to [`0b1e895`](nodejs/node@0b1e895) (Node.js GitHub Bot) [#64039](nodejs/node#64039) - \[[`9e50bb0655`](nodejs/node@9e50bb0655)] - **dgram**: skip dns.lookup() for literal IP addresses (Ruben Bridgewater) [#64133](nodejs/node#64133) - \[[`dc052c095c`](nodejs/node@dc052c095c)] - **diagnostics\_channel**: return original thenable (Stephen Belanger) [#62407](nodejs/node#62407) - \[[`a22a840293`](nodejs/node@a22a840293)] - **doc**: clarify QUIC stream state wording (EduardF1) [#63660](nodejs/node#63660) - \[[`8d4bec2d71`](nodejs/node@8d4bec2d71)] - **doc**: update Http2SecureServer.on("timeout") default value (YuSheng Chen) [#64187](nodejs/node#64187) - \[[`da88f70afa`](nodejs/node@da88f70afa)] - **doc**: add note on visibility of CI failures to new contributor guide (Stewart X Addison) [#64256](nodejs/node#64256) - \[[`20ce359ccb`](nodejs/node@20ce359ccb)] - **doc**: clarify HTTP/1.1 response ordering (Matteo Collina) [#64213](nodejs/node#64213) - \[[`05eae2835c`](nodejs/node@05eae2835c)] - **doc**: recommend node-stress-single-test for flaky tests (Trivikram Kamat) [#64223](nodejs/node#64223) - \[[`3966eb67e7`](nodejs/node@3966eb67e7)] - **doc**: fix typo in examples (Vas Sudanagunta) [#64184](nodejs/node#64184) - \[[`12a2b9daa3`](nodejs/node@12a2b9daa3)] - **doc**: fix typo in node-config-schema.json (Hamid Reza Ghavami) [#64188](nodejs/node#64188) - \[[`0854482671`](nodejs/node@0854482671)] - **doc**: clarify defense-in-depth issues (Matteo Collina) [#64215](nodejs/node#64215) - \[[`ef4915fc3a`](nodejs/node@ef4915fc3a)] - **doc**: fix Fast FFI argument count in ffi.md (Daijiro Wachi) [#63960](nodejs/node#63960) - \[[`bb2eed863c`](nodejs/node@bb2eed863c)] - **doc**: add sxa GPG key ([`ed25519`](nodejs/node@ed25519)) (Stewart X Addison) [#64193](nodejs/node#64193) - \[[`b7bf6e3a06`](nodejs/node@b7bf6e3a06)] - **doc**: add guide and answers to FAQs for first-time contributors (Joyee Cheung) [#63685](nodejs/node#63685) - \[[`ff537ba858`](nodejs/node@ff537ba858)] - **doc**: update `Http2Server.close` & `Http2SecureServer.close` (YuSheng Chen) [#63298](nodejs/node#63298) - \[[`f3db304588`](nodejs/node@f3db304588)] - **doc**: update list of people in `SECURITY.md` (Richard Lau) [#64152](nodejs/node#64152) - \[[`2a126647b0`](nodejs/node@2a126647b0)] - **doc**: clarify vfs is not a sandbox (Matteo Collina) [#64143](nodejs/node#64143) - \[[`85fc79dd9b`](nodejs/node@85fc79dd9b)] - **doc**: fix broken links and duplicate stability label (Antoine du Hamel) [#64130](nodejs/node#64130) - \[[`189e830eb3`](nodejs/node@189e830eb3)] - **doc**: add missing option to man page (Richard Lau) [#64156](nodejs/node#64156) - \[[`7a16ccccd0`](nodejs/node@7a16ccccd0)] - **doc**: announce upcoming end of tier 2 support for macOS x64 (Antoine du Hamel) [#63931](nodejs/node#63931) - \[[`d5f826045f`](nodejs/node@d5f826045f)] - **doc**: update toolchain for official AIX releases (Richard Lau) [#64068](nodejs/node#64068) - \[[`60abc4400f`](nodejs/node@60abc4400f)] - **doc**: fix callback example import in fs docs (Kamal Rawal) [#63912](nodejs/node#63912) - \[[`e470c74a6c`](nodejs/node@e470c74a6c)] - **doc**: fix keepAliveTimeout default in http.createServer options (Jahanzaib iqbal) [#63974](nodejs/node#63974) - \[[`851b460583`](nodejs/node@851b460583)] - **esm**: improve ERR\_REQUIRE\_ASYNC\_MODULE (Joyee Cheung) [#64260](nodejs/node#64260) - \[[`0cd443df39`](nodejs/node@0cd443df39)] - **esm**: print required top-level await locations without evaluating (Joyee Cheung) [#64154](nodejs/node#64154) - \[[`b373202efc`](nodejs/node@b373202efc)] - **(SEMVER-MINOR)** **esm**: add `--experimental-import-text` flag (Efe) [#62300](nodejs/node#62300) - \[[`eacfbd0ca5`](nodejs/node@eacfbd0ca5)] - **http**: add CONNECT method handling for default Host header with proxy (Archkon) [#64114](nodejs/node#64114) - \[[`aeb539a383`](nodejs/node@aeb539a383)] - **http**: fix drain event with cork/uncork (David Evans) [#64038](nodejs/node#64038) - \[[`8e8874b216`](nodejs/node@8e8874b216)] - **http**: document and validate options.path when it's in absolute-form (Joyee Cheung) [#64108](nodejs/node#64108) - \[[`eb2e96bc28`](nodejs/node@eb2e96bc28)] - **inspector**: fix crash when writing to closed inspector socket (ympark2011) [#64209](nodejs/node#64209) - \[[`243b0e4e57`](nodejs/node@243b0e4e57)] - **lib**: reject string "0" in validatePort when allowZero is false (Daijiro Wachi) [#64174](nodejs/node#64174) - \[[`34a537c0ed`](nodejs/node@34a537c0ed)] - **lib**: use `__proto__: null` when calling `ObjectDefineProperty` (Antoine du Hamel) [#64239](nodejs/node#64239) - \[[`1f72393f19`](nodejs/node@1f72393f19)] - **lib**: lazily initialize kEvents and kHandlers maps (Guilherme Araújo) [#63702](nodejs/node#63702) - \[[`92a3dc3191`](nodejs/node@92a3dc3191)] - **lib,permission**: fix addon permission drop (Martin Wagner) [#64007](nodejs/node#64007) - \[[`87b8f2a296`](nodejs/node@87b8f2a296)] - **meta**: fix linter warning in `stale.yml` (Antoine du Hamel) [#64281](nodejs/node#64281) - \[[`829c4a5913`](nodejs/node@829c4a5913)] - **meta**: bump actions/cache from 5.0.5 to 6.1.0 (dependabot\[bot]) [#64248](nodejs/node#64248) - \[[`0808dcd31c`](nodejs/node@0808dcd31c)] - **meta**: bump github/codeql-action/autobuild from 4.36.1 to 4.36.2 (dependabot\[bot]) [#64247](nodejs/node#64247) - \[[`64aa17058f`](nodejs/node@64aa17058f)] - **meta**: bump github/codeql-action/analyze from 4.36.1 to 4.36.2 (dependabot\[bot]) [#64246](nodejs/node#64246) - \[[`873d1e0412`](nodejs/node@873d1e0412)] - **meta**: bump actions/checkout from 6.0.2 to 7.0.0 (dependabot\[bot]) [#64245](nodejs/node#64245) - \[[`fe460ccf0b`](nodejs/node@fe460ccf0b)] - **meta**: bump codecov/codecov-action from 6.0.1 to 7.0.0 (dependabot\[bot]) [#64244](nodejs/node#64244) - \[[`845c63ed50`](nodejs/node@845c63ed50)] - **meta**: bump rtCamp/action-slack-notify from 2.3.3 to 2.4.0 (dependabot\[bot]) [#64243](nodejs/node#64243) - \[[`2cad2d6de5`](nodejs/node@2cad2d6de5)] - **meta**: bump github/codeql-action/init from 4.36.1 to 4.36.2 (dependabot\[bot]) [#64242](nodejs/node#64242) - \[[`0ddde950c7`](nodejs/node@0ddde950c7)] - **meta**: bump actions/setup-python from 6.2.0 to 6.3.0 (dependabot\[bot]) [#64241](nodejs/node#64241) - \[[`c0a8760d2f`](nodejs/node@c0a8760d2f)] - **meta**: bump github/codeql-action/upload-sarif from 4.36.1 to 4.36.2 (dependabot\[bot]) [#64240](nodejs/node#64240) - \[[`f49704b9d0`](nodejs/node@f49704b9d0)] - **meta**: clarify V8 flags are outside threat model (Matteo Collina) [#64224](nodejs/node#64224) - \[[`6b8dc58e6e`](nodejs/node@6b8dc58e6e)] - **meta**: move one or more collaborators to emeritus (Node.js GitHub Bot) [#64057](nodejs/node#64057) - \[[`fe5260cca7`](nodejs/node@fe5260cca7)] - **meta**: update status of past strategic initiatives (Joyee Cheung) [#63480](nodejs/node#63480) - \[[`7b01040008`](nodejs/node@7b01040008)] - **meta**: speed up stale bot (Aviv Keller) [#64075](nodejs/node#64075) - \[[`874c46c24f`](nodejs/node@874c46c24f)] - **meta**: update sccache version in test-linux-quic (René) [#64043](nodejs/node#64043) - \[[`48c5c86363`](nodejs/node@48c5c86363)] - **module**: enable import support for addons by default (Chengzhong Wu) [#64221](nodejs/node#64221) - \[[`39e0c14455`](nodejs/node@39e0c14455)] - **(SEMVER-MINOR)** **perf\_hooks**: sample delay per event loop iteration (Pablo Erhard) [#62935](nodejs/node#62935) - \[[`f90f1bd032`](nodejs/node@f90f1bd032)] - **perf\_hooks**: add NODE\_PERFORMANCE\_GC\_MINOR\_MARK\_SWEEP constant (Attila Szegedi) [#63877](nodejs/node#63877) - \[[`bdf32628c7`](nodejs/node@bdf32628c7)] - **process**: fix finalization cleanup ref tracking (Trivikram Kamat) [#64087](nodejs/node#64087) - \[[`9a65b7fff4`](nodejs/node@9a65b7fff4)] - **quic**: drop version negotiation packets with oversized CIDs (Mohamed Sayed) [#64228](nodejs/node#64228) - \[[`2699fe4706`](nodejs/node@2699fe4706)] - **quic**: fixes undefined handle in QuicStream kInspect (Marten Richter) [#64170](nodejs/node#64170) - \[[`00dea28bb3`](nodejs/node@00dea28bb3)] - **repl**: lazy-load acorn and defer vm context creation (Daijiro Wachi) [#63879](nodejs/node#63879) - \[[`ce659a1cf9`](nodejs/node@ce659a1cf9)] - **src**: fix escaping of single quotes in task runner (Antoine du Hamel) [#64089](nodejs/node#64089) - \[[`dbb3126e5c`](nodejs/node@dbb3126e5c)] - **src**: abstract tracing agent for both legacy and perfetto (Chengzhong Wu) [#64053](nodejs/node#64053) - \[[`12edf1d68d`](nodejs/node@12edf1d68d)] - **src**: avoid redundant call to `std::get_if<>()` (Tobias Nießen) [#64094](nodejs/node#64094) - \[[`eda91b6d01`](nodejs/node@eda91b6d01)] - **src**: avoid copying source string in TextEncoder.encode (Yagiz Nizipli) [#63897](nodejs/node#63897) - \[[`efbbb9a03c`](nodejs/node@efbbb9a03c)] - **stream**: preserve half-open duplexes in async iteration (Efe) [#64275](nodejs/node#64275) - \[[`999a83c937`](nodejs/node@999a83c937)] - **(SEMVER-MINOR)** **stream**: expose ReadableStreamTee (Matteo Collina) [#64195](nodejs/node#64195) - \[[`ab5ed72903`](nodejs/node@ab5ed72903)] - **stream**: reject iter consumers on abort (Trivikram Kamat) [#64066](nodejs/node#64066) - \[[`d3fa77c5e2`](nodejs/node@d3fa77c5e2)] - **stream**: fix merge abort for pending sources (Trivikram Kamat) [#64013](nodejs/node#64013) - \[[`38b99140ed`](nodejs/node@38b99140ed)] - **stream**: refactor unnecessary optional chaining away (Antoine du Hamel) [#64253](nodejs/node#64253) - \[[`c81f894ebe`](nodejs/node@c81f894ebe)] - **stream**: cut per-chunk overhead in WHATWG streams (Matteo Collina) [#64252](nodejs/node#64252) - \[[`f162234f24`](nodejs/node@f162234f24)] - **stream**: normalize Broadcast.from() byte inputs (Trivikram Kamat) [#64082](nodejs/node#64082) - \[[`1182ad8f3b`](nodejs/node@1182ad8f3b)] - **stream**: proxy first own method in Readable.wrap() (Daijiro Wachi) [#64048](nodejs/node#64048) - \[[`d0b830b382`](nodejs/node@d0b830b382)] - **stream**: observe abort while awaiting pipeTo source (Trivikram Kamat) [#64015](nodejs/node#64015) - \[[`f7adcd8359`](nodejs/node@f7adcd8359)] - **stream**: respect iter consumer abort signals (Trivikram Kamat) [#63997](nodejs/node#63997) - \[[`b09e624c6f`](nodejs/node@b09e624c6f)] - **test**: make blob desiredSize assertion robust (Trivikram Kamat) [#64106](nodejs/node#64106) - \[[`d0d8f0c774`](nodejs/node@d0d8f0c774)] - **test**: update WPT for urlpattern to [`11a459a`](nodejs/node@11a459a2b1) (Node.js GitHub Bot) [#64037](nodejs/node#64037) - \[[`ff9122c20c`](nodejs/node@ff9122c20c)] - **test**: improve lcov reporter snapshot diagnostics (Trivikram Kamat) [#64049](nodejs/node#64049) - \[[`570952d4f3`](nodejs/node@570952d4f3)] - **test**: keep finalization close fixture ref alive (Trivikram Kamat) [#64085](nodejs/node#64085) - \[[`1b4f213380`](nodejs/node@1b4f213380)] - **test**: fix typo from overriden to overridden (parkhojeong) [#63403](nodejs/node#63403) - \[[`4c91090b8b`](nodejs/node@4c91090b8b)] - **test**: fix typo from funciton to function (parkhojeong) [#63403](nodejs/node#63403) - \[[`bf080c7917`](nodejs/node@bf080c7917)] - **test**: mark hr-time WPT flaky on macos15-x64 (Trivikram Kamat) [#64054](nodejs/node#64054) - \[[`24e32098c5`](nodejs/node@24e32098c5)] - **test**: use one-off agent in http consumed timeout test (Trivikram Kamat) [#64052](nodejs/node#64052) - \[[`3229886de2`](nodejs/node@3229886de2)] - **test**: fix flaky test-runner coverage threshold test (Trivikram Kamat) [#64051](nodejs/node#64051) - \[[`83b91ea6ec`](nodejs/node@83b91ea6ec)] - **test\_runner**: filter execArgv fallback for child tests (Trivikram Kamat) [#64056](nodejs/node#64056) - \[[`269b609a3d`](nodejs/node@269b609a3d)] - **test\_runner**: improve coverage failure diagnostics (Trivikram Kamat) [#64050](nodejs/node#64050) - \[[`0342744c34`](nodejs/node@0342744c34)] - **test\_runner**: add timestamp to JUnit reporter testsuites (sangwook) [#64029](nodejs/node#64029) - \[[`086741d121`](nodejs/node@086741d121)] - **timers**: reuse Timeout objects in setStreamTimeout (Matteo Collina) [#64254](nodejs/node#64254) - \[[`4e0236dc3d`](nodejs/node@4e0236dc3d)] - **(SEMVER-MINOR)** **tls**: report negotiated TLS groups (Filip Skokan) [#64119](nodejs/node#64119) - \[[`3bdd7e20be`](nodejs/node@3bdd7e20be)] - **tls**: handle large RSA exponents in X.509 cert (Tobias Nießen) [#64093](nodejs/node#64093) - \[[`c96c838977`](nodejs/node@c96c838977)] - **tools**: update RUSTC\_VERSION for remaining GHA workflows (René) [#64325](nodejs/node#64325) - \[[`ee873b7aaf`](nodejs/node@ee873b7aaf)] - **tools**: bump `temporal_rs` version (Antoine du Hamel) [#63281](nodejs/node#63281) - \[[`ea3b870155`](nodejs/node@ea3b870155)] - **tools**: remove `envinfo` from our workflows (Antoine du Hamel) [#64259](nodejs/node#64259) - \[[`d940f02e8b`](nodejs/node@d940f02e8b)] - **tools**: bump the eslint group in /tools/eslint with 8 updates (dependabot\[bot]) [#64249](nodejs/node#64249) - \[[`fe0ea2bb5d`](nodejs/node@fe0ea2bb5d)] - **tools**: bump [@node-core/doc-kit](https://github.com/node-core/doc-kit) (dependabot\[bot]) [#64010](nodejs/node#64010) - \[[`4dceefde1e`](nodejs/node@4dceefde1e)] - **tools**: bump undici from 6.24.1 to 6.27.0 in /tools/doc (dependabot\[bot]) [#64031](nodejs/node#64031) - \[[`6e187db7d7`](nodejs/node@6e187db7d7)] - **tools**: update c-ares updater script (Antoine du Hamel) [#64194](nodejs/node#64194) - \[[`657a35f5a2`](nodejs/node@657a35f5a2)] - **tools**: validate version number in release proposal commit message lint (Antoine du Hamel) [#64070](nodejs/node#64070) - \[[`17228a861c`](nodejs/node@17228a861c)] - **tools**: add GHA benchmark runner (Antoine du Hamel) [#60293](nodejs/node#60293) - \[[`6d11a71d91`](nodejs/node@6d11a71d91)] - **tools**: update `build-shared/action.yml` to a reusable workflow (Antoine du Hamel) [#64059](nodejs/node#64059) - \[[`7a17c50b7f`](nodejs/node@7a17c50b7f)] - **tools**: update libffi updater script (Antoine du Hamel) [#64046](nodejs/node#64046) - \[[`28047a3e71`](nodejs/node@28047a3e71)] - **tools**: exclude `libffi` changes from `test-shared` GHA CI (Antoine du Hamel) [#64047](nodejs/node#64047) - \[[`58d9685acc`](nodejs/node@58d9685acc)] - **typings**: add typing for crypto (Filip Skokan) [#64122](nodejs/node#64122) - \[[`7a9dcad44d`](nodejs/node@7a9dcad44d)] - **util**: fix OOM in inspect color stack formatting (Ijtihed Kilani) [#64022](nodejs/node#64022) - \[[`d5f01bbbde`](nodejs/node@d5f01bbbde)] - **vfs**: reject rename into descendant directory (Trivikram Kamat) [#64285](nodejs/node#64285) - \[[`0b6af91081`](nodejs/node@0b6af91081)] - **vfs**: handle current-position sentinel in memory files (Trivikram Kamat) [#64163](nodejs/node#64163) - \[[`322230d641`](nodejs/node@322230d641)] - **vfs**: support writeFileSync with virtual fds (Trivikram Kamat) [#64165](nodejs/node#64165) - \[[`9395d209c7`](nodejs/node@9395d209c7)] - **vfs**: avoid recursive readdir symlink cycles (Matteo Collina) [#64168](nodejs/node#64168) - \[[`bbdd7643b6`](nodejs/node@bbdd7643b6)] - **vfs**: read RealFSProvider files from open fd (Trivikram Kamat) [#64104](nodejs/node#64104) - \[[`92859b8097`](nodejs/node@92859b8097)] - **vm**: fix copying PropertyDescriptor (Chengzhong Wu) [#64073](nodejs/node#64073) - \[[`9046035475`](nodejs/node@9046035475)] - **zlib**: validate flush king for all streams (Ic3b3rg) [#63746](nodejs/node#63746) - \[[`98be4304a3`](nodejs/node@98be4304a3)] - **zlib**: validate flush kind for brotli streams (Ic3b3rg) [#63746](nodejs/node#63746) - \[[`90007a59a9`](nodejs/node@90007a59a9)] - **zlib**: expose rejectGarbageAfterEnd option (Filip Skokan) [#64023](nodejs/node#64023) - \[[`5933516066`](nodejs/node@5933516066)] - **zlib**: reject trailing gzip members in web streams (Filip Skokan) [#64023](nodejs/node#64023) </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever MR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this MR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this MR, check this box --- This MR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate).

nodejs-github-bot added http Issues or PRs related to the http subsystem. needs-ci PRs that need a full CI run. labels Jun 24, 2026

metcoder95 approved these changes Jun 25, 2026

View reviewed changes

Archkon force-pushed the main branch from bb0c9e8 to ffa487e Compare June 26, 2026 15:51

Archkon force-pushed the main branch from ffa487e to 13d7ccb Compare July 1, 2026 05:49

mcollina added the baking-for-lts PRs that need to wait before landing in a LTS release. label Jul 1, 2026

mcollina approved these changes Jul 1, 2026

View reviewed changes

mcollina added the request-ci Add this label to start a Jenkins CI on a PR. label Jul 1, 2026

github-actions Bot removed the request-ci Add this label to start a Jenkins CI on a PR. label Jul 1, 2026

Archkon added 2 commits July 1, 2026 20:15

http: add CONNECT method handling for default Host header with proxy

a724369

Signed-off-by: Archkon <180910180+Archkon@users.noreply.github.com>

test: update CONNECT Host header expectation

17099b2

Signed-off-by: Archkon <180910180+Archkon@users.noreply.github.com>

Archkon force-pushed the main branch from 13d7ccb to 17099b2 Compare July 1, 2026 12:38

pimterry added the request-ci Add this label to start a Jenkins CI on a PR. label Jul 2, 2026

pimterry approved these changes Jul 2, 2026

View reviewed changes

github-actions Bot removed the request-ci Add this label to start a Jenkins CI on a PR. label Jul 2, 2026

Archkon mentioned this pull request Jul 3, 2026

dns: do not consult hosts file in reverse lookups #64268

Open

pimterry added the commit-queue Add this label to land a pull request using GitHub Actions. label Jul 3, 2026

nodejs-github-bot added commit-queue-failed An error occurred while landing this pull request using GitHub Actions. and removed commit-queue Add this label to land a pull request using GitHub Actions. labels Jul 3, 2026

nodejs-github-bot removed the commit-queue Add this label to land a pull request using GitHub Actions. label Jul 3, 2026

nodejs-github-bot merged commit 0e2126d into nodejs:main Jul 3, 2026
82 of 83 checks passed

github-actions Bot mentioned this pull request Jul 6, 2026

2026-07-08, Version 26.5.0 (Current) #64329

Merged

Uh oh!

Uh oh!

Conversation

Archkon commented Jun 24, 2026

Uh oh!

nodejs-github-bot commented Jun 24, 2026

Uh oh!

pimterry commented Jun 26, 2026

Uh oh!

Archkon commented Jun 26, 2026

Uh oh!

mcollina commented Jul 1, 2026

Uh oh!

mcollina left a comment

Choose a reason for hiding this comment

Uh oh!

nodejs-github-bot commented Jul 1, 2026

Uh oh!

Archkon commented Jul 1, 2026

Uh oh!

nodejs-github-bot commented Jul 2, 2026

Uh oh!

Archkon commented Jul 2, 2026

Uh oh!

nodejs-github-bot commented Jul 3, 2026

Uh oh!

pimterry commented Jul 3, 2026

Uh oh!

nodejs-github-bot commented Jul 3, 2026

Signed-off-by: Archkon <180910180+Archkon@users.noreply.github.com> PR-URL: #64114 Fixes: #63945 Reviewed-By: Matteo Collina <matteo.collina@gmail.com> Reviewed-By: Tim Perry <pimterry@gmail.com>

Signed-off-by: Archkon <180910180+Archkon@users.noreply.github.com> PR-URL: #64114 Fixes: #63945 Reviewed-By: Matteo Collina <matteo.collina@gmail.com> Reviewed-By: Tim Perry <pimterry@gmail.com>

[detached HEAD e24e5b4cd0] test: update CONNECT Host header expectation Author: Archkon <180910180+Archkon@users.noreply.github.com> Date: Fri Jun 26 23:32:16 2026 +0800 1 file changed, 1 insertion(+), 1 deletion(-) Successfully rebased and updated refs/heads/main.

Uh oh!

Uh oh!

nodejs-github-bot commented Jul 3, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

Signed-off-by: Archkon <180910180+Archkon@users.noreply.github.com>
PR-URL: #64114
Fixes: #63945
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
Reviewed-By: Tim Perry <pimterry@gmail.com>

Signed-off-by: Archkon <180910180+Archkon@users.noreply.github.com>
PR-URL: #64114
Fixes: #63945
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
Reviewed-By: Tim Perry <pimterry@gmail.com>

[detached HEAD e24e5b4cd0] test: update CONNECT Host header expectation
Author: Archkon <180910180+Archkon@users.noreply.github.com>
Date: Fri Jun 26 23:32:16 2026 +0800
1 file changed, 1 insertion(+), 1 deletion(-)
Successfully rebased and updated refs/heads/main.