Repository navigation
buffer: increase Buffer.poolSize default to 64 KiB - #63597
Conversation
567a29e to
0dd37aa
Compare
|
Yes! |
|
SGTM. I'm wondering how close the performance at 32 KiB is to 64 KiB, and whether larger allocations are actually harmful here. |
There is little to no drawback to increase this up to 256KB on my tests, but 8->256KB seemed jumping over a few too many steps. |
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #63597 +/- ##
==========================================
- Coverage 90.32% 90.32% -0.01%
==========================================
Files 730 730
Lines 234671 234671
Branches 43946 43955 +9
==========================================
- Hits 211965 211960 -5
- Misses 14423 14426 +3
- Partials 8283 8285 +2
🚀 New features to boost your workflow:
|
LiviaMedeiros
left a comment
There was a problem hiding this comment.
64 KiB sounds reasonable.
The value is adjustable so users who know they have enough RAM and benefit from bigger pool can do it on their end. Maybe worth adding example to the docs as followup, i think something like --import 'data:text/javascript,Buffer.poolSize=0x100000;' should do the trick for them?
The 8 KiB default has been unchanged since 2015. With the threshold check `size < (Buffer.poolSize >>> 1)`, this means allocations of 4 KiB or larger bypass the pool entirely — including 4 KiB itself, a common page and HTTP-frame size. Raising the default to 64 KiB extends pool coverage to ~32 KiB allocations, capturing common sizes used by HTTP parsers, stream chunks, and small file reads. Throughput improvements on workers-k=8 fs.readFileSync benchmarks (Linux/glibc) at the affected sizes, with no regressions elsewhere: file size | 8 KiB pool | 64 KiB pool | delta -----------+--------------+---------------+------- 4 KiB | 326k ops/s | 360k ops/s | +10% 8 KiB | 202k ops/s | 254k ops/s | +26% 16 KiB | 148k ops/s | 181k ops/s | +23% 64 KiB | 86k ops/s | 87k ops/s | ~ 1 MiB | 12k ops/s | 13k ops/s | ~ Cost: +56 KiB RSS per realm at startup. Signed-off-by: Matteo Collina <hello@matteocollina.com>
0dd37aa to
3aa77e7
Compare
|
Landed in dbec31c |
|
notable-change
|
Notable changes: buffer: * (SEMVER-MINOR) increase Buffer.poolSize default to 64 KiB (Matteo Collina) #63597 crypto: * update root certificates to NSS 3.123.1 (Node.js GitHub Bot) #63527 * (SEMVER-MINOR) align key argument names in docs and error messages (Filip Skokan) #62527 * (SEMVER-MINOR) accept key data in crypto.diffieHellman() and cleanup DH jobs (Filip Skokan) #62527 * (SEMVER-MINOR) add TurboSHAKE and KangarooTwelve Web Cryptography algorithms (Filip Skokan) #62183 http: * http: avoid stream listeners on idle agent sockets (Matteo Collina) #64004 * (SEMVER-MINOR) add writeInformation to send arbitrary 1xx status codes (Tim Perry) #63155 inspector: * (SEMVER-MINOR) expose precise coverage start to JS runtime (sangwook) #63079 stream: * stream: Revert noop pause/resume on destroyed streams" (Stewart X Addison) #63834 PR-URL: #64062
Notable changes: buffer: * (SEMVER-MINOR) increase Buffer.poolSize default to 64 KiB (Matteo Collina) nodejs#63597 crypto: * update root certificates to NSS 3.123.1 (Node.js GitHub Bot) nodejs#63527 * (SEMVER-MINOR) align key argument names in docs and error messages (Filip Skokan) nodejs#62527 * (SEMVER-MINOR) accept key data in crypto.diffieHellman() and cleanup DH jobs (Filip Skokan) nodejs#62527 * (SEMVER-MINOR) add TurboSHAKE and KangarooTwelve Web Cryptography algorithms (Filip Skokan) nodejs#62183 http: * http: avoid stream listeners on idle agent sockets (Matteo Collina) nodejs#64004 * (SEMVER-MINOR) add writeInformation to send arbitrary 1xx status codes (Tim Perry) nodejs#63155 inspector: * (SEMVER-MINOR) expose precise coverage start to JS runtime (sangwook) nodejs#63079 stream: * stream: Revert noop pause/resume on destroyed streams" (Stewart X Addison) nodejs#63834 PR-URL: nodejs#64062
Notable changes: buffer: * (SEMVER-MINOR) increase Buffer.poolSize default to 64 KiB (Matteo Collina) #63597 crypto: * update root certificates to NSS 3.123.1 (Node.js GitHub Bot) #63527 * (SEMVER-MINOR) align key argument names in docs and error messages (Filip Skokan) #62527 * (SEMVER-MINOR) accept key data in crypto.diffieHellman() and cleanup DH jobs (Filip Skokan) #62527 * (SEMVER-MINOR) add TurboSHAKE and KangarooTwelve Web Cryptography algorithms (Filip Skokan) #62183 http: * http: avoid stream listeners on idle agent sockets (Matteo Collina) #64004 * (SEMVER-MINOR) add writeInformation to send arbitrary 1xx status codes (Tim Perry) #63155 inspector: * (SEMVER-MINOR) expose precise coverage start to JS runtime (sangwook) #63079 stream: * stream: Revert noop pause/resume on destroyed streams" (Stewart X Addison) #63834 PR-URL: #64062
This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | [node](https://github.com/nodejs/node) | stage | minor | `24.16.0-trixie` → `24.18.0-trixie` | --- ### Release Notes <details> <summary>nodejs/node (node)</summary> ### [`v24.18.0`](https://github.com/nodejs/node/releases/tag/v24.18.0): 2026-06-23, Version 24.18.0 'Krypton' (LTS), @​richardlau prepared by @​sxa [Compare Source](nodejs/node@v24.17.0...v24.18.0) ##### Notable Changes - \[[`e07e7a31e1`](nodejs/node@e07e7a31e1)] - **crypto**: update root certificates to NSS 3.123.1 (Node.js GitHub Bot) [#​63527](nodejs/node#63527) - \[[`44c8ebcbd6`](nodejs/node@44c8ebcbd6)] - **http**: avoid stream listeners on idle agent sockets (Matteo Collina) [#​64004](nodejs/node#64004) - \[[`d3ef4122ee`](nodejs/node@d3ef4122ee)] - **(SEMVER-MINOR)** **buffer**: increase Buffer.poolSize default to 64 KiB (Matteo Collina) [#​63597](nodejs/node#63597) - \[[`bb2857b85a`](nodejs/node@bb2857b85a)] - **(SEMVER-MINOR)** **crypto**: align key argument names in docs and error messages (Filip Skokan) [#​62527](nodejs/node#62527) - \[[`b9d5e87880`](nodejs/node@b9d5e87880)] - **(SEMVER-MINOR)** **crypto**: accept key data in crypto.diffieHellman() and cleanup DH jobs (Filip Skokan) [#​62527](nodejs/node#62527) - \[[`ccd756d61e`](nodejs/node@ccd756d61e)] - **(SEMVER-MINOR)** **crypto**: add TurboSHAKE and KangarooTwelve Web Cryptography algorithms (Filip Skokan) [#​62183](nodejs/node#62183) - \[[`4c9251fc09`](nodejs/node@4c9251fc09)] - **(SEMVER-MINOR)** **http**: add writeInformation to send arbitrary 1xx status codes (Tim Perry) [#​63155](nodejs/node#63155) - \[[`8c989ec4a3`](nodejs/node@8c989ec4a3)] - **(SEMVER-MINOR)** **inspector**: expose precise coverage start to JS runtime (sangwook) [#​63079](nodejs/node#63079) - \[[`3f54c8ba32`](nodejs/node@3f54c8ba32)] - ***Revert*** "**stream**: noop pause/resume on destroyed streams" (Stewart X Addison) [#​63834](nodejs/node#63834) ##### Commits - \[[`d3ef4122ee`](nodejs/node@d3ef4122ee)] - **(SEMVER-MINOR)** **buffer**: increase Buffer.poolSize default to 64 KiB (Matteo Collina) [#​63597](nodejs/node#63597) - \[[`9ff36e40f0`](nodejs/node@9ff36e40f0)] - **build**: add --enable-all-experimentals build flag (Paolo Insogna) [#​62755](nodejs/node#62755) - \[[`7c22ee23aa`](nodejs/node@7c22ee23aa)] - **build**: def `NODE_USE_NODE_CODE_CACHE` only used in node\_mksnapshot (Chengzhong Wu) [#​63588](nodejs/node#63588) - \[[`2551abdb4a`](nodejs/node@2551abdb4a)] - **build,win**: enable x64 PGO (Stefan Stojanovic) [#​62761](nodejs/node#62761) - \[[`e8a55ce9b1`](nodejs/node@e8a55ce9b1)] - **crypto**: strengthen argument CHECKs in TurboSHAKE (Tobias Nießen) [#​62763](nodejs/node#62763) - \[[`ae61cd68f3`](nodejs/node@ae61cd68f3)] - **crypto**: harden WebCrypto against prototype pollution (Filip Skokan) [#​63363](nodejs/node#63363) - \[[`3d05a1d396`](nodejs/node@3d05a1d396)] - **crypto**: pass CryptoKey handles to KDF jobs (Filip Skokan) [#​63363](nodejs/node#63363) - \[[`f9d10a3f6b`](nodejs/node@f9d10a3f6b)] - **crypto**: remove async from WebCrypto methods (Filip Skokan) [#​63363](nodejs/node#63363) - \[[`e431d93e9e`](nodejs/node@e431d93e9e)] - **crypto**: add WebCrypto CryptoJob mode (Filip Skokan) [#​63363](nodejs/node#63363) - \[[`56e2505e48`](nodejs/node@56e2505e48)] - **crypto**: wire ML-DSA and ML-KEM for use when using BoringSSL (Filip Skokan) [#​63255](nodejs/node#63255) - \[[`3bac77f2a8`](nodejs/node@3bac77f2a8)] - **crypto**: wire ChaCha20-Poly1305 in Web Cryptography when using BoringSSL (Filip Skokan) [#​63255](nodejs/node#63255) - \[[`1bff901b09`](nodejs/node@1bff901b09)] - **crypto**: wire AES-KW in Web Cryptography when using BoringSSL (Filip Skokan) [#​63255](nodejs/node#63255) - \[[`4433fca3df`](nodejs/node@4433fca3df)] - **crypto**: harden CryptoKey algorithm slots (Filip Skokan) [#​63111](nodejs/node#63111) - \[[`b5cf01217a`](nodejs/node@b5cf01217a)] - **crypto**: harden KeyObject internal slots (Filip Skokan) [#​63111](nodejs/node#63111) - \[[`ce84aef37d`](nodejs/node@ce84aef37d)] - **crypto**: add guards and adjust tests for BoringSSL (Filip Skokan) [#​62883](nodejs/node#62883) - \[[`26781689b0`](nodejs/node@26781689b0)] - **crypto**: reject duplicate ML-KEM JWK key\_ops (Filip Skokan) [#​62905](nodejs/node#62905) - \[[`aeea8f4970`](nodejs/node@aeea8f4970)] - **crypto**: add JWK support for ML-KEM and SLH-DSA key types (Filip Skokan) [#​62706](nodejs/node#62706) - \[[`407cf91656`](nodejs/node@407cf91656)] - **crypto**: guard against size\_t overflow on experimental 32-bit arch (Filip Skokan) [#​62626](nodejs/node#62626) - \[[`bb2857b85a`](nodejs/node@bb2857b85a)] - **(SEMVER-MINOR)** **crypto**: align key argument names in docs and error messages (Filip Skokan) [#​62527](nodejs/node#62527) - \[[`b9d5e87880`](nodejs/node@b9d5e87880)] - **(SEMVER-MINOR)** **crypto**: accept key data in crypto.diffieHellman() and cleanup DH jobs (Filip Skokan) [#​62527](nodejs/node#62527) - \[[`b46d52b283`](nodejs/node@b46d52b283)] - **crypto**: unify asymmetric key import through KeyObjectHandle::Init (Filip Skokan) [#​62499](nodejs/node#62499) - \[[`ccd756d61e`](nodejs/node@ccd756d61e)] - **(SEMVER-MINOR)** **crypto**: add TurboSHAKE and KangarooTwelve Web Cryptography algorithms (Filip Skokan) [#​62183](nodejs/node#62183) - \[[`e07e7a31e1`](nodejs/node@e07e7a31e1)] - **crypto**: update root certificates to NSS 3.123.1 (Node.js GitHub Bot) [#​63527](nodejs/node#63527) - \[[`61826df455`](nodejs/node@61826df455)] - **crypto**: coerce -0 keylen to +0 in pbkdf2 and scrypt (Jordan Harband) [#​63531](nodejs/node#63531) - \[[`16d2fd3c07`](nodejs/node@16d2fd3c07)] - **crypto**: align verifyOneShot accepted types (Anshika Jain) [#​63280](nodejs/node#63280) - \[[`3b8330deda`](nodejs/node@3b8330deda)] - **crypto**: improve system certificate enumeration logic on macOS (Robo) [#​62576](nodejs/node#62576) - \[[`141de35399`](nodejs/node@141de35399)] - **debugger**: add --help to `node inspect` and improve docs (Joyee Cheung) [#​63201](nodejs/node#63201) - \[[`b76bfcd4fa`](nodejs/node@b76bfcd4fa)] - **deps**: upgrade npm to 11.16.0 (npm team) [#​63602](nodejs/node#63602) - \[[`4ec142314c`](nodejs/node@4ec142314c)] - **deps**: SQLite: cherry-pick [`b869ed6`](nodejs/node@b869ed6) (Junsu Han) [#​63525](nodejs/node#63525) - \[[`19e8ce1c36`](nodejs/node@19e8ce1c36)] - **deps**: upgrade npm to 11.15.0 (npm team) [#​63463](nodejs/node#63463) - \[[`8a264260e2`](nodejs/node@8a264260e2)] - **deps**: update sqlite to 3.53.1 (Node.js GitHub Bot) [#​63217](nodejs/node#63217) - \[[`50c8ff3f94`](nodejs/node@50c8ff3f94)] - **deps**: update simdjson to 4.6.4 (Node.js GitHub Bot) [#​62811](nodejs/node#62811) - \[[`6e56f01c4b`](nodejs/node@6e56f01c4b)] - **deps**: V8: cherry-pick [`435a2cd`](nodejs/node@435a2cdf664c) (Matthias Liedtke) [#​63136](nodejs/node#63136) - \[[`3ba813b242`](nodejs/node@3ba813b242)] - **deps**: cherry-pick [libuv/libuv@`a43e543`](libuv/libuv@a43e543) (Ali Hassan) [#​63222](nodejs/node#63222) - \[[`2390e3a5ac`](nodejs/node@2390e3a5ac)] - **doc**: remove duplicated sentences in large-pull-requests.md (Joyee Cheung) [#​63650](nodejs/node#63650) - \[[`52a1c18374`](nodejs/node@52a1c18374)] - **doc**: update `git node land` instructions for security releases (Antoine du Hamel) [#​63586](nodejs/node#63586) - \[[`3e6b4da037`](nodejs/node@3e6b4da037)] - **doc**: drop --experimental from --permission (Rafael Gonzaga) [#​63583](nodejs/node#63583) - \[[`84d05163b9`](nodejs/node@84d05163b9)] - **doc**: explicitly ask for reproducible in JS (Rafael Gonzaga) [#​63479](nodejs/node#63479) - \[[`7da2a4450e`](nodejs/node@7da2a4450e)] - **doc**: fix URL postMessage example in worker\_threads (Kit Dallege) [#​62203](nodejs/node#62203) - \[[`3d79bd8b29`](nodejs/node@3d79bd8b29)] - **doc**: clarify `filter` option of `sqlite.database.applyChangeset` (Antoine du Hamel) [#​63515](nodejs/node#63515) - \[[`4f4174aace`](nodejs/node@4f4174aace)] - **doc**: fix double spaces in ERR\_TLS\_INVALID\_PROTOCOL\_METHOD (Daijiro Wachi) [#​63511](nodejs/node#63511) - \[[`388323ca4b`](nodejs/node@388323ca4b)] - **doc**: fix double space in modules.md (Daijiro Wachi) [#​63512](nodejs/node#63512) - \[[`5258ccc058`](nodejs/node@5258ccc058)] - **doc**: fix "options" to "option" in tls.createServer (Daijiro Wachi) [#​63453](nodejs/node#63453) - \[[`43e83e6507`](nodejs/node@43e83e6507)] - **doc**: fix typo in deprecations (Daijiro Wachi) [#​63434](nodejs/node#63434) - \[[`f05a61d54c`](nodejs/node@f05a61d54c)] - **doc**: remove unsupported template type from v8.md (René) [#​63410](nodejs/node#63410) - \[[`c39d5fc820`](nodejs/node@c39d5fc820)] - **doc**: fix article usage before vowel-sound acronyms (joao-oliveira-softtor) [#​62696](nodejs/node#62696) - \[[`398261f911`](nodejs/node@398261f911)] - **doc**: remove the bi-monthly contributor spotlight section (Claudio Wunder) [#​62734](nodejs/node#62734) - \[[`fd9e14c405`](nodejs/node@fd9e14c405)] - **doc**: update http2's `push` and `trailers` events with `rawHeaders` param (YuSheng Chen) [#​63259](nodejs/node#63259) - \[[`b943ce6933`](nodejs/node@b943ce6933)] - **doc**: remove inactive members from Triagers list (Antoine du Hamel) [#​63329](nodejs/node#63329) - \[[`4b9cdfc022`](nodejs/node@4b9cdfc022)] - **doc**: reference correct function in Module docs (Robin Malfait) [#​63247](nodejs/node#63247) - \[[`bed84b6df2`](nodejs/node@bed84b6df2)] - **doc**: replace Visual Studio 2022 Evergreen version reference with 17.14 (Mike McCready) [#​63211](nodejs/node#63211) - \[[`32ea70569b`](nodejs/node@32ea70569b)] - **doc**: recommend explicitly Tier 1 or 2 for production applications (Mike McCready) [#​63187](nodejs/node#63187) - \[[`4627bcfd82`](nodejs/node@4627bcfd82)] - **doc**: run license-builder (github-actions\[bot]) [#​63232](nodejs/node#63232) - \[[`28eba71845`](nodejs/node@28eba71845)] - **doc**: add large pull requests contributing guide (Matteo Collina) [#​62829](nodejs/node#62829) - \[[`2648efd438`](nodejs/node@2648efd438)] - **doc**: remove unnecessary `<!-- eslint-` magic comments (Antoine du Hamel) [#​63200](nodejs/node#63200) - \[[`a95fc1f8fc`](nodejs/node@a95fc1f8fc)] - **doc**: clarify SEA platform support excludes darwin-x64 (MJSHANG) [#​63181](nodejs/node#63181) - \[[`aaef29e2e1`](nodejs/node@aaef29e2e1)] - **doc**: update release steps when post-release fails (Rafael Gonzaga) [#​63131](nodejs/node#63131) - \[[`7d81419cf2`](nodejs/node@7d81419cf2)] - **doc**: add Hmac.digest() documentation-only deprecation (DEP0206) (Anshika Jain) [#​63121](nodejs/node#63121) - \[[`ececd80d81`](nodejs/node@ececd80d81)] - **doc**: document the latest-vX.x schema (Marco Ippolito) [#​63033](nodejs/node#63033) - \[[`27c1c1d842`](nodejs/node@27c1c1d842)] - **doc**: remove list of versions in `BUILDING.md` (Antoine du Hamel) [#​63113](nodejs/node#63113) - \[[`e369886a65`](nodejs/node@e369886a65)] - **doc,sqlite**: document entryPoint argument for loadExtension (Edy Silva) [#​63152](nodejs/node#63152) - \[[`e4e5137cbd`](nodejs/node@e4e5137cbd)] - **errors**: handle V8 warnings in DisallowJavascriptExecutionScope (Divyanshu Sharma) [#​63491](nodejs/node#63491) - \[[`6d1f6048d2`](nodejs/node@6d1f6048d2)] - **fs**: make `Date` properties on `Stats` enumerable (LiviaMedeiros) [#​63328](nodejs/node#63328) - \[[`44c8ebcbd6`](nodejs/node@44c8ebcbd6)] - **http**: avoid stream listeners on idle agent sockets (Matteo Collina) [#​64004](nodejs/node#64004) - \[[`4c9251fc09`](nodejs/node@4c9251fc09)] - **(SEMVER-MINOR)** **http**: add writeInformation to send arbitrary 1xx status codes (Tim Perry) [#​63155](nodejs/node#63155) - \[[`39f61fb06c`](nodejs/node@39f61fb06c)] - **http2**: emit session close before stream close (Matteo Collina) [#​63414](nodejs/node#63414) - \[[`8a8f2127d1`](nodejs/node@8a8f2127d1)] - **http2**: validate non-link headers in writeEarlyHints (Matteo Collina) [#​62017](nodejs/node#62017) - \[[`8c989ec4a3`](nodejs/node@8c989ec4a3)] - **(SEMVER-MINOR)** **inspector**: expose precise coverage start to JS runtime (sangwook) [#​63079](nodejs/node#63079) - \[[`c05f38229b`](nodejs/node@c05f38229b)] - **lib**: cleanup stateless diffiehellman key handling (Filip Skokan) [#​62645](nodejs/node#62645) - \[[`1c16b45d35`](nodejs/node@1c16b45d35)] - **lib**: refactor internal webidl converters (Filip Skokan) [#​62979](nodejs/node#62979) - \[[`02f35d6dce`](nodejs/node@02f35d6dce)] - **lib**: define `kEnumerableProperty` atomically (Antoine du Hamel) [#​63609](nodejs/node#63609) - \[[`12c51547ba`](nodejs/node@12c51547ba)] - **lib**: fix typos in esm loader comments (RonGamzu) [#​63465](nodejs/node#63465) - \[[`9b03b84262`](nodejs/node@9b03b84262)] - **lib**: fix typo idenity => identity (Daijiro Wachi) [#​63112](nodejs/node#63112) - \[[`a84e6b0567`](nodejs/node@a84e6b0567)] - **lib**: fixes validator message (Daijiro Wachi) [#​62823](nodejs/node#62823) - \[[`11734166a8`](nodejs/node@11734166a8)] - **lib**: narrow ReadableStreamBYOBRequest.view return type to Uint8Array (RoomWithOutRoof) [#​63017](nodejs/node#63017) - \[[`7cead61d21`](nodejs/node@7cead61d21)] - **meta**: flip mcollina emails in .mailmap (Matteo Collina) [#​63621](nodejs/node#63621) - \[[`a08cfcfd35`](nodejs/node@a08cfcfd35)] - **meta**: label "source maps" PRs (Chengzhong Wu) [#​63591](nodejs/node#63591) - \[[`d56e8d2512`](nodejs/node@d56e8d2512)] - **meta**: add `vfs` subsystem label (René) [#​62331](nodejs/node#62331) - \[[`6201cfe488`](nodejs/node@6201cfe488)] - **meta**: skip scheduled workflows on forks (Jamie Magee) [#​63565](nodejs/node#63565) - \[[`f095e2bd31`](nodejs/node@f095e2bd31)] - **meta**: add additional gitignore entries (James M Snell) [#​63267](nodejs/node#63267) - \[[`1ea52c444c`](nodejs/node@1ea52c444c)] - **meta**: move one or more collaborators to emeritus (Node.js GitHub Bot) [#​63402](nodejs/node#63402) - \[[`b1b2327611`](nodejs/node@b1b2327611)] - **meta**: move one or more collaborators to emeritus (Node.js GitHub Bot) [#​63235](nodejs/node#63235) - \[[`7d88e130a9`](nodejs/node@7d88e130a9)] - **meta**: ignore AI assistants files (Matteo Collina) [#​62612](nodejs/node#62612) - \[[`a53b51df38`](nodejs/node@a53b51df38)] - **module**: load ESM helpers eagerly in the snapshot (Joyee Cheung) [#​63550](nodejs/node#63550) - \[[`69df688fff`](nodejs/node@69df688fff)] - **module**: fix sync hook short-circuit in require() in imported CJS (Joyee Cheung) [#​62920](nodejs/node#62920) - \[[`75d9a4ed47`](nodejs/node@75d9a4ed47)] - **node-api**: support SharedArrayBuffer in napi\_create\_typedarray (Yilong Li) [#​62710](nodejs/node#62710) - \[[`c20aa4c47b`](nodejs/node@c20aa4c47b)] - **quic**: add reusePort option to QuicEndpoint (James M Snell) [#​63267](nodejs/node#63267) - \[[`26a30d8a7f`](nodejs/node@26a30d8a7f)] - **quic**: implement rate limiting for version nego and immediate close (James M Snell) [#​63267](nodejs/node#63267) - \[[`0b534b5770`](nodejs/node@0b534b5770)] - **quic**: fixup linting issue after other changes (James M Snell) [#​63267](nodejs/node#63267) - \[[`4b367cbe09`](nodejs/node@4b367cbe09)] - **quic**: remove unused binding variable in session.cc (James M Snell) [#​63177](nodejs/node#63177) - \[[`2574bef5a6`](nodejs/node@2574bef5a6)] - **repl**: fix dedup comparing normalized line against raw history (Daijiro Wachi) [#​62886](nodejs/node#62886) - \[[`30e71c7e49`](nodejs/node@30e71c7e49)] - **sqlite**: keep source database alive during backup (Matteo Collina) [#​62673](nodejs/node#62673) - \[[`677ca7e76c`](nodejs/node@677ca7e76c)] - **src**: simplify OpenSSL feature gates (Filip Skokan) [#​63255](nodejs/node#63255) - \[[`c863c75c39`](nodejs/node@c863c75c39)] - **src**: add BoringSSL EVP enumeration fallback (Filip Skokan) [#​63206](nodejs/node#63206) - \[[`f6b2466921`](nodejs/node@f6b2466921)] - **src**: decouple KeyObject and CryptoKey and move CryptoKey to src (Filip Skokan) [#​62924](nodejs/node#62924) - \[[`92d4f07dd2`](nodejs/node@92d4f07dd2)] - **src**: remove license headers for new node\_profiling files (Chengzhong Wu) [#​63066](nodejs/node#63066) - \[[`8ac5d771c8`](nodejs/node@8ac5d771c8)] - **src**: split profiling helpers from util (Ilyas Shabi) [#​63008](nodejs/node#63008) - \[[`85d1639495`](nodejs/node@85d1639495)] - **src**: remove TOCTOU race condition when encoding SAB-backed `Buffer`s (Antoine du Hamel) [#​63517](nodejs/node#63517) - \[[`9473c5f05c`](nodejs/node@9473c5f05c)] - **src**: skip duplicate UTF-8 validation in TextDecoder fatal path (Mert Can Altin) [#​63231](nodejs/node#63231) - \[[`f35c91ee68`](nodejs/node@f35c91ee68)] - **src**: improve token return value check (James M Snell) [#​63483](nodejs/node#63483) - \[[`26f677c1c5`](nodejs/node@26f677c1c5)] - **src**: expose `node::RegisterContext` to make a node managed context (Chengzhong Wu) [#​62322](nodejs/node#62322) - \[[`275cf909b6`](nodejs/node@275cf909b6)] - **src,sqlite**: only pass `xFilter` when user provided a callback (Antoine du Hamel) [#​63516](nodejs/node#63516) - \[[`287e02303f`](nodejs/node@287e02303f)] - **src,sqlite**: remove dead code (Edy Silva) [#​63204](nodejs/node#63204) - \[[`58fa2ee189`](nodejs/node@58fa2ee189)] - **stream**: switch to internal `sleep` binding (Antoine du Hamel) [#​63611](nodejs/node#63611) - \[[`f954ab3f1a`](nodejs/node@f954ab3f1a)] - **stream**: use data listener for compose forwarding (Trivikram Kamat) [#​63593](nodejs/node#63593) - \[[`dc57173003`](nodejs/node@dc57173003)] - **stream**: fix Writable.toWeb() hang on synchronous drain (sangwook) [#​61197](nodejs/node#61197) - \[[`3f54c8ba32`](nodejs/node@3f54c8ba32)] - ***Revert*** "**stream**: noop pause/resume on destroyed streams" (Stewart X Addison) [#​63834](nodejs/node#63834) - \[[`cee279c5d6`](nodejs/node@cee279c5d6)] - **stream**: remove unnecessary check (Antoine du Hamel) [#​63030](nodejs/node#63030) - \[[`61b20f60a3`](nodejs/node@61b20f60a3)] - **test**: update tls/crypto behaviour expectations when using BoringSSL (Filip Skokan) [#​63161](nodejs/node#63161) - \[[`a835363808`](nodejs/node@a835363808)] - **test**: update WPT for WebCryptoAPI to [`97bbc72`](nodejs/node@97bbc7247a) (Node.js GitHub Bot) [#​63417](nodejs/node#63417) - \[[`a00297480b`](nodejs/node@a00297480b)] - **test**: update WPT resources, interfaces and WebCryptoAPI (Node.js GitHub Bot) [#​62389](nodejs/node#62389) - \[[`5a95a2b055`](nodejs/node@5a95a2b055)] - **test**: shorten path in net pipe connect errors (Matteo Collina) [#​63405](nodejs/node#63405) - \[[`5e8ff22d8f`](nodejs/node@5e8ff22d8f)] - **test**: remove test-node-output-v8-warning (Joyee Cheung) [#​63469](nodejs/node#63469) - \[[`ee15380950`](nodejs/node@ee15380950)] - **test**: update test426-fixtures to [`9b9e225`](nodejs/node@9b9e225) (Node.js GitHub Bot) [#​63373](nodejs/node#63373) - \[[`9e063d9bea`](nodejs/node@9e063d9bea)] - **test**: update WPT for url to [`e4a4672`](nodejs/node@e4a4672e9e) (Node.js GitHub Bot) [#​63372](nodejs/node#63372) - \[[`503bee4b43`](nodejs/node@503bee4b43)] - **test**: deflake async-hooks statwatcher test (Trivikram Kamat) [#​63396](nodejs/node#63396) - \[[`cccc7c32d8`](nodejs/node@cccc7c32d8)] - **test**: avoid test\_runner watch restart in spec snapshot (Trivikram Kamat) [#​63392](nodejs/node#63392) - \[[`c89489258c`](nodejs/node@c89489258c)] - **test**: reduce watch mode restart flakiness (Trivikram Kamat) [#​63390](nodejs/node#63390) - \[[`e4d5e2578e`](nodejs/node@e4d5e2578e)] - **test**: isolate rerun-failures state file under tmpdir (Chemi Atlow) [#​63449](nodejs/node#63449) - \[[`362644a9ba`](nodejs/node@362644a9ba)] - **test**: wait for ok before initial break after restart (Yuya Inoue) [#​62807](nodejs/node#62807) - \[[`c4058d0e05`](nodejs/node@c4058d0e05)] - **test**: disable Maglev in near-heap-limit worker test (Trivikram Kamat) [#​63398](nodejs/node#63398) - \[[`214da630a7`](nodejs/node@214da630a7)] - **test**: deflake connection refused proxy tests (Trivikram Kamat) [#​63395](nodejs/node#63395) - \[[`1d61a29876`](nodejs/node@1d61a29876)] - **test**: avoid repeated writes in watch helper (Trivikram Kamat) [#​63386](nodejs/node#63386) - \[[`2004e25387`](nodejs/node@2004e25387)] - **test**: deflake watch mode worker test (Trivikram Kamat) [#​63384](nodejs/node#63384) - \[[`d691cccfc1`](nodejs/node@d691cccfc1)] - **test**: relax test-memory-usage arrayBuffers check (inoway46) [#​63244](nodejs/node#63244) - \[[`0ff6bf853c`](nodejs/node@0ff6bf853c)] - **test**: reduce flakiness of `different-registry-per-thread` (Antoine du Hamel) [#​63244](nodejs/node#63244) - \[[`d9f4e8e503`](nodejs/node@d9f4e8e503)] - **test**: fix flaky test-watch-mode-inspect timeout (Matteo Collina) [#​63361](nodejs/node#63361) - \[[`6d7cd50328`](nodejs/node@6d7cd50328)] - **test**: relax min assertion in test-performance-eventloopdelay (Marco) [#​63100](nodejs/node#63100) - \[[`9dafe1d2d8`](nodejs/node@9dafe1d2d8)] - **test**: avoid flaky restart sync in debugger exceptions test (Yuya Inoue) [#​62055](nodejs/node#62055) - \[[`989b2de973`](nodejs/node@989b2de973)] - **test**: avoid initial-break wait in restart-message (inoway46) [#​62060](nodejs/node#62060) - \[[`a072a25ee7`](nodejs/node@a072a25ee7)] - **test**: move FFI tests to `NATIVE_SUITES` (Antoine du Hamel) [#​63165](nodejs/node#63165) - \[[`64efbfd878`](nodejs/node@64efbfd878)] - **test**: use ERM to destroy sqlite database handles after tests (René) [#​63076](nodejs/node#63076) - \[[`7dee66cd94`](nodejs/node@7dee66cd94)] - **test\_runner**: dont buffer unordered events in process isolation mode (Moshe Atlow) [#​63432](nodejs/node#63432) - \[[`d257eec1e3`](nodejs/node@d257eec1e3)] - **test\_runner**: fix --test-rerun-failures swallowing failures on retry (Chemi Atlow) [#​63431](nodejs/node#63431) - \[[`288c320e2f`](nodejs/node@288c320e2f)] - **test\_runner**: show replayed-from-attempt hint in spec reporter (Moshe Atlow) [#​63429](nodejs/node#63429) - \[[`904bdf5bb4`](nodejs/node@904bdf5bb4)] - **test\_runner**: preserve run duration when using test-rerun (Moshe Atlow) [#​63429](nodejs/node#63429) - \[[`df183d7bfa`](nodejs/node@df183d7bfa)] - **test\_runner**: avoid hanging on incomplete v8 frames (Ali Hassan) [#​62704](nodejs/node#62704) - \[[`ec86c69726`](nodejs/node@ec86c69726)] - **test\_runner**: fix diagnostics channel context tracking (Moshe Atlow) [#​63283](nodejs/node#63283) - \[[`94e5f63b83`](nodejs/node@94e5f63b83)] - **tls**: add unsupported renegotiation error (Filip Skokan) [#​63161](nodejs/node#63161) - \[[`06d308fb61`](nodejs/node@06d308fb61)] - **tools**: prevent lib code from reading KeyObject and CryptoKey accessors (Filip Skokan) [#​63111](nodejs/node#63111) - \[[`2e4a0d0c91`](nodejs/node@2e4a0d0c91)] - **tools**: bump brace-expansion from 5.0.5 to 5.0.6 in /tools/eslint (dependabot\[bot]) [#​63415](nodejs/node#63415) - \[[`4c9666b366`](nodejs/node@4c9666b366)] - **tools**: skip commit-lint on backport pull requests (Marco) [#​63378](nodejs/node#63378) - \[[`67d0c490a8`](nodejs/node@67d0c490a8)] - **tools**: fix skip of `test-internet` on forks (Antoine du Hamel) [#​63492](nodejs/node#63492) - \[[`02f73c7cac`](nodejs/node@02f73c7cac)] - **tools**: bump the eslint group in /tools/eslint with 4 updates (dependabot\[bot]) [#​63075](nodejs/node#63075) - \[[`5d016d3241`](nodejs/node@5d016d3241)] - **tools**: update gyp-next to 0.22.2 (Node.js GitHub Bot) [#​63374](nodejs/node#63374) - \[[`55af0f0edb`](nodejs/node@55af0f0edb)] - **tools**: fix test426 updater (Antoine du Hamel) [#​63271](nodejs/node#63271) - \[[`d8475e167a`](nodejs/node@d8475e167a)] - **tools**: use different branch for tool updates on staging branches (Antoine du Hamel) [#​63110](nodejs/node#63110) - \[[`c605df9e50`](nodejs/node@c605df9e50)] - **util**: remove unused functions (Antoine du Hamel) [#​63612](nodejs/node#63612) - \[[`fe4540ebdb`](nodejs/node@fe4540ebdb)] - **util**: create hex style cache and fast path (Guilherme Araújo) [#​62999](nodejs/node#62999) ### [`v24.17.0`](https://github.com/nodejs/node/releases/tag/v24.17.0): 2026-06-18, Version 24.17.0 'Krypton' (LTS), @​aduh95 [Compare Source](nodejs/node@v24.16.0...v24.17.0) This is a security release. ##### Notable Changes - (CVE-2026-48618) tls: normalize hostname for server identity checks (Matteo Collina) – High - (CVE-2026-48933) crypto: guard WebCrypto cipher output length (Filip Skokan) – High - (CVE-2026-48615) lib,test: redact proxy credentials in tunnel errors (Matteo Collina) – Medium - (CVE-2026-48619) http2: cap originSet size to prevent unbounded memory growth (Matteo Collina) – Medium - (CVE-2026-48928) tls: fix case-sensitive SNI context matching (Matteo Collina) – Medium - (CVE-2026-48930) dns,net: reject hostnames with embedded NUL bytes (Matteo Collina) – Medium - (CVE-2026-48934) tls: bind reusable sessions to authenticated host (Matteo Collina) – Medium - (CVE-2026-48937) deps: fix integration issues with the latest nghttp2 – Medium - (CVE-2026-48617) permission: handle process.chdir on writereport (RafaelGSS) – Low - (CVE-2026-48931) http: fix response queue poisoning in http.Agent (Matteo Collina) – Low - (CVE-2026-48935) permission: disable FileHandle utimes with permission model (RafaelGSS) – Low ##### Commits - \[[`9e4dfc7bba`](nodejs/node@9e4dfc7bba)] - **(CVE-2026-48933)** **crypto**: guard WebCrypto cipher output length (Filip Skokan) [nodejs-private/node-private#878](https://github.com/nodejs-private/node-private/pull/878) - \[[`cb2aed980c`](nodejs/node@cb2aed980c)] - **deps**: update llhttp to 9.4.2 (Antoine du Hamel) [nodejs-private/node-private#890](https://github.com/nodejs-private/node-private/pull/890) - \[[`a8a0d12875`](nodejs/node@a8a0d12875)] - **(CVE-2026-48937)** **deps**: fix integration issues with the latest nghttp2 (Tim Perry) [#​62891](nodejs/node#62891) - \[[`66e6203c1c`](nodejs/node@66e6203c1c)] - **(SEMVER-MAJOR)** **deps**: update nghttp2 to 1.69.0 (Node.js GitHub Bot) [#​62891](nodejs/node#62891) - \[[`dd627ced27`](nodejs/node@dd627ced27)] - **deps**: update archs files for openssl-3.5.7 (Node.js GitHub Bot) [#​63820](nodejs/node#63820) - \[[`684bae568f`](nodejs/node@684bae568f)] - **deps**: upgrade openssl sources to openssl-3.5.7 (Node.js GitHub Bot) [#​63820](nodejs/node#63820) - \[[`3a631e7f83`](nodejs/node@3a631e7f83)] - **deps**: fix aix implicit declaration in OpenSSL (Abdirahim Musse) [#​62656](nodejs/node#62656) - \[[`cf44df3996`](nodejs/node@cf44df3996)] - **deps**: update undici to 7.28.0 (Node.js GitHub Bot) [#​63703](nodejs/node#63703) - \[[`138c70294b`](nodejs/node@138c70294b)] - **(CVE-2026-48930)** **dns,net**: reject hostnames with embedded NUL bytes (Matteo Collina) [nodejs-private/node-private#868](https://github.com/nodejs-private/node-private/pull/868) - \[[`be7e719c3f`](nodejs/node@be7e719c3f)] - **(CVE-2026-48931)** **http**: fix response queue poisoning in http.Agent (Matteo Collina) [nodejs-private/node-private#846](https://github.com/nodejs-private/node-private/pull/846) - \[[`cc7c11b4d1`](nodejs/node@cc7c11b4d1)] - **(CVE-2026-48619)** **http2**: cap originSet size to prevent unbounded memory growth (Matteo Collina) [nodejs-private/node-private#855](https://github.com/nodejs-private/node-private/pull/855) - \[[`9224427b92`](nodejs/node@9224427b92)] - **(CVE-2026-48615)** **lib,test**: redact proxy credentials in tunnel errors (Matteo Collina) [nodejs-private/node-private#867](https://github.com/nodejs-private/node-private/pull/867) - \[[`cf85d54839`](nodejs/node@cf85d54839)] - **(CVE-2026-48935)** **permission**: disable FileHandle utimes with permission model (RafaelGSS) [nodejs-private/node-private#873](https://github.com/nodejs-private/node-private/pull/873) - \[[`a1bbc24f96`](nodejs/node@a1bbc24f96)] - **(CVE-2026-48617)** **permission**: handle process.chdir on writereport (RafaelGSS) [nodejs-private/node-private#870](https://github.com/nodejs-private/node-private/pull/870) - \[[`e3723ff2d6`](nodejs/node@e3723ff2d6)] - **test**: add session reuse host verification regressions (Matteo Collina) [nodejs-private/node-private#854](https://github.com/nodejs-private/node-private/pull/854) - \[[`a77af4867b`](nodejs/node@a77af4867b)] - **(CVE-2026-48934)** **tls**: bind reusable sessions to authenticated host (Matteo Collina) [nodejs-private/node-private#854](https://github.com/nodejs-private/node-private/pull/854) - \[[`31beb4f707`](nodejs/node@31beb4f707)] - **(CVE-2026-48928)** **tls**: fix case-sensitive SNI context matching (Matteo Collina) [nodejs-private/node-private#857](https://github.com/nodejs-private/node-private/pull/857) - \[[`8e75c73f91`](nodejs/node@8e75c73f91)] - **(CVE-2026-48618)** **tls**: normalize hostname for server identity checks (Matteo Collina) [nodejs-private/node-private#869](https://github.com/nodejs-private/node-private/pull/869) </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4xNzAuMTkiLCJ1cGRhdGVkSW5WZXIiOiI0My4xNzAuMTkiLCJ0YXJnZXRCcmFuY2giOiJtYWluIiwibGFiZWxzIjpbXX0=--> Reviewed-on: https://git.walbeck.it/mwalbeck/docker-cyberchef/pulls/488
The 8 KiB default has been unchanged since 2015. With the threshold check `size < (Buffer.poolSize >>> 1)`, this means allocations of 4 KiB or larger bypass the pool entirely — including 4 KiB itself, a common page and HTTP-frame size. Raising the default to 64 KiB extends pool coverage to ~32 KiB allocations, capturing common sizes used by HTTP parsers, stream chunks, and small file reads. Throughput improvements on workers-k=8 fs.readFileSync benchmarks (Linux/glibc) at the affected sizes, with no regressions elsewhere: file size | 8 KiB pool | 64 KiB pool | delta -----------+--------------+---------------+------- 4 KiB | 326k ops/s | 360k ops/s | +10% 8 KiB | 202k ops/s | 254k ops/s | +26% 16 KiB | 148k ops/s | 181k ops/s | +23% 64 KiB | 86k ops/s | 87k ops/s | ~ 1 MiB | 12k ops/s | 13k ops/s | ~ Cost: +56 KiB RSS per realm at startup. Signed-off-by: Matteo Collina <hello@matteocollina.com> PR-URL: nodejs#63597 Reviewed-By: James M Snell <jasnell@gmail.com> Reviewed-By: LiviaMedeiros <livia@cirno.name> Reviewed-By: Ruben Bridgewater <ruben@bridgewater.de> Reviewed-By: Ethan Arrowood <ethan@arrowood.dev> Reviewed-By: Stephen Belanger <admin@stephenbelanger.com> Reviewed-By: Gürgün Dayıoğlu <hey@gurgun.day>
Notable changes: async_hooks: * (SEMVER-MINOR) add trackPromises option to createHook() (Joyee Cheung) #61415 buffer: * (SEMVER-MINOR) increase Buffer.poolSize default to 64 KiB (Matteo Collina) #63597 cli: * (SEMVER-MINOR) add --max-heap-size option (tannal) #58708 console: * (SEMVER-MINOR) allow per-stream `inspectOptions` option (Anna Henningsen) #60082 crypto: * update root certificates to NSS 3.123.1 (Node.js GitHub Bot) #63527 debugger: * (SEMVER-MINOR) add edit-free runtime expression probes to `node inspect` (Joyee Cheung) #62713 fs: * (SEMVER-MINOR) add signal option to fs.stat() (Mert Can Altin) #57775 * (SEMVER-MINOR) expose frsize field in statfs (Jinho Jang) #62277 * (SEMVER-MINOR) add `throwIfNoEntry` option for fs.stat and fs.promises.stat (Juan José) #61178 * (SEMVER-MINOR) add ignore option to fs.watch (Matteo Collina) #61433 http: * (SEMVER-MINOR) add writeInformation to send arbitrary 1xx status codes (Tim Perry) #63155 * (SEMVER-MINOR) add req.signal to IncomingMessage (Akshat) #62541 lib: * (SEMVER-MINOR) remove util.getCallSite (Rafael Gonzaga) #59980 net: * (SEMVER-MINOR) add `setTOS` and `getTOS` to `Socket` (Amol Yadav) #61503 node-api: * (SEMVER-MINOR) support SharedArrayBuffer in napi_create_dataview (Kevin Eady) #60473 * (SEMVER-MINOR) add napi_create_object_with_properties (Miguel Marcondes Filho) #59953 perf_hooks: * (SEMVER-MINOR) move non-standard performance properties to perf_hooks (Chengzhong Wu) #60370 sqlite: * (SEMVER-MINOR) add sqlite prepare options args (Guilherme Araújo) #61311 * (SEMVER-MINOR) create authorization api (Guilherme Araújo) #59928 src: * (CVE-2026-21712) handle url crash on different url formats (RafaelGSS) nodejs-private/node-private#816 src,permission: * (SEMVER-MINOR) add --allow-inspector ability (Rafael Gonzaga) #59711 stream: * (SEMVER-MINOR) add bytes() method to stream/consumers (wantaek) #60426 * (SEMVER-MINOR) do not pass `readable.compose()` output via `Readable.from()` (René) #60907 test_runner: * (SEMVER-MINOR) align mock timeout api (sangwook) #62820 PR-URL: TODO
Automated mise tool upgrades from local config. Updated tools: - `action-validator` - `actionlint` - `aube` - `editorconfig-checker` - `ghalint` - `node` - `pinact` - `pipx:gh-action-pulse` - `prek` - `rumdl` - `shellcheck` - `shfmt` - `tombi` - `uv` - `yamlfmt` - `yamllint` - `zizmor` Command: `mise upgrade --bump --local action-validator actionlint aube editorconfig-checker ghalint node pinact pipx:gh-action-pulse prek rumdl shellcheck shfmt tombi uv yamlfmt yamllint zizmor` <details> <summary>Version changelog (node)</summary> | Tool | Requested | Installed | |------|-----------|-----------| | `node` | `24` → `26` | `24.18.1` → `26.5.1` | </details> <details> <summary>Release notes (1 tools)</summary> <details> <summary>node: `24.18.1` → `26.5.1` (nodejs/node)</summary> ### v25.8.2 This is a security release. ### Notable Changes * (CVE-2026-21637) wrap `SNICallback` invocation in `try`/`catch` (Matteo Collina) - High * (CVE-2026-21710) use null prototype for `headersDistinct`/`trailersDistinct` (Matteo Collina) - High * (CVE-2026-21711) include permission check to `pipe_wrap.cc` (RafaelGSS) - Medium * (CVE-2026-21712) handle url crash on different url formats (RafaelGSS) - Medium * (CVE-2026-21713) use timing-safe comparison in Web Cryptography HMAC and KMAC (Filip Skokan) - Medium * (CVE-2026-21714) handle `NGHTTP2_ERR_FLOW_CONTROL` error code (RafaelGSS) - Medium * (CVE-2026-21717) test array index hash collision (Joyee Cheung) - Medium * (CVE-2026-21715) add permission check to `realpath.native` (RafaelGSS) - Low * (CVE-2026-21716) include permission check on `lib/fs/promises` (RafaelGSS) - Low ### Commits * \[[`2086b7477b`](nodejs/node@2086b7477b)] - **(CVE-2026-21717)** **build,test**: test array index hash collision (Joyee Cheung) [nodejs-private/node-private#834](https://github.com/nodejs-private/node-private/pull/834) * \[[`0f9332a40a`](nodejs/node@0f9332a40a)] - **(CVE-2026-21713)** **crypto**: use timing-safe comparison in Web Cryptography HMAC and KMAC (Filip Skokan) [nodejs-private/node-private#822](https://github.com/nodejs-private/node-private/pull/822) * \[[`2b6937ddb2`](nodejs/node@2b6937ddb2)] - **deps**: update undici to 7.24.4 (Node.js GitHub Bot) [#62271](nodejs/node#62271) * \[[`bfb8ad5787`](nodejs/node@bfb8ad5787)] - **deps**: update undici to 7.24.3 (Node.js GitHub Bot) [#62233](nodejs/node#62233) * \[[`be6384727f`](nodejs/node@be6384727f)] - **deps**: upgrade npm to 11.11.1 (npm team) [#62216](nodejs/node#62216) * \[[`2feea5bb97`](nodejs/node@2feea5bb97)] - **deps**: V8: override… (truncated) ### v25.9.0 ### Notable Changes #### Test runner module mocking improvements `MockModuleOptions.defaultExport` and `MockModuleOptions.namedExports` have been consolidated into a single option `MockModuleOptions.exports` to align with user expectations and other test runners. A `default` property on `MockModuleOptions.exports` represents the default export, and own enumerable properties are treated as named exports. An automated migration is available to update user code: <https://github.com/nodejs/userland-migrations/tree/main/recipes/mock-module-exports> ```bash npx codemod @nodejs/mock-module-exports ``` Contributed by sangwook in [#61727](nodejs/node#61727). #### Other notable changes * \[[`312476cb84`](nodejs/node@312476cb84)] - **(SEMVER-MINOR)** **async\_hooks**: add using scopes to `AsyncLocalStorage` (Stephen Belanger) [#61674](nodejs/node#61674) * \[[`62d2cd473b`](nodejs/node@62d2cd473b)] - **(SEMVER-MINOR)** **cli**: add `--max-heap-size` option (tannal) [#58708](nodejs/node#58708) * \[[`d0ebf0e44b`](nodejs/node@d0ebf0e44b)] - **(SEMVER-MINOR)** **crypto**: add `TurboSHAKE` and `KangarooTwelve` Web Cryptography algorithms (Filip Skokan) [#62183](nodejs/node#62183) * \[[`f85b9d9fa8`](nodejs/node@f85b9d9fa8)] - **(SEMVER-MINOR)** **repl**: add customizable error handling (Anna Henningsen) [#62188](nodejs/node#62188) * \[[`67b854d407`](nodejs/node@67b854d407)] - **(SEMVER-MINOR)** **repl**: remove dependency on `node:domain` (Matteo Collina) [#61227](nodejs/node#61227) * \[[`966b700623`](nodejs/node@966b700623)] - **(SEMVER-MINOR)** **sea**: support code cache for ESM entrypoint in SEA (Joyee Cheung) [#62158](nodejs/node#62158) *… (truncated) ### v26.0.0 We're excited to announce the release of Node.js 26! Highlights include the Temporal API enabled by default, updates to the V8 JavaScript engine to 14.6, Undici to 8.0, and several important deprecations and removals as we continue to modernize the platform. As a reminder, Node.js 26 will enter long-term support (LTS) in October, but until then, it will be the "Current" release for the next six months. We encourage you to explore the new features and benefits offered by this latest release and evaluate their potential impact on your applications. ### Notable Changes #### Temporal API The Temporal API is now enabled by default in Node.js 26. Temporal is a modern date/time API for JavaScript that provides a more robust and feature-rich alternative to the legacy `Date` object. Contributed by Richard Lau in [#61806](nodejs/node#61806). #### V8 14.6 The V8 engine is updated to version 14.6.202.33, which is part of Chromium 134. This version also includes: * Upsert (<https://github.com/tc39/proposal-upsert>): `[Weak]Map.prototype.getOrInsert()`, `[Weak]Map.prototype.getOrInsertComputed()` * Iterator sequencing (<https://github.com/tc39/proposal-iterator-sequencing>): `Iterator.concat()` Contributed by Michaël Zasso in [#61898](nodejs/node#61898). #### Undici 8 Undici has been updated to version 8.0.2, bringing new features and improvements to Node.js's HTTP client implementation. #### Deprecations and Removals * \[[`dff46c07c3`](nodejs/node@dff46c07c3)] - **(SEMVER-MAJOR)** **crypto**: move DEP0182 to End-of-Life (Tobias Nießen) [#61084](nodejs/node#61084) * \[[`93c25815ee`](nodejs/node@93c25815ee)] - **(SEMVER-MAJOR)** **http**: move writeHeader to end-of-life (Sebastian Beltran) [#60635](nodejs/node#60635) `http.Server.prototype.writeHeader()` is now fully removed. Use `http.Server.prototype.write… (truncated) ### v26.1.0 ### Notable Changes #### Experimental `node:ffi` module Node.js now includes an experimental `node:ffi` module for loading dynamic libraries and calling native symbols from JavaScript. The API is gated behind the `--experimental-ffi` flag and, when the Permission Model is enabled, requires `--allow-ffi`. This API is inherently unsafe. Invalid pointers, incorrect signatures, or accessing memory after it has been freed can crash the process or corrupt memory. Contributed by Paolo Insogna in [#62072](nodejs/node#62072). #### Other Notable Changes * \[[`34a6454fe3`](nodejs/node@34a6454fe3)] - **(SEMVER-MINOR)** **buffer**: add `end` parameter (Robert Nagy) [#62390](nodejs/node#62390) * \[[`073e84d7fe`](nodejs/node@073e84d7fe)] - **(SEMVER-MINOR)** **crypto**: accept key data in `crypto.diffieHellman()` and cleanup DH jobs (Filip Skokan) [#62527](nodejs/node#62527) * \[[`5b9cb10a5f`](nodejs/node@5b9cb10a5f)] - **(SEMVER-MINOR)** **crypto**: implement `randomUUIDv7()` (nabeel378) [#62553](nodejs/node#62553) * \[[`98f9becd16`](nodejs/node@98f9becd16)] - **(SEMVER-MINOR)** **debugger**: add edit-free runtime expression probes to `node inspect` (Joyee Cheung) [#62713](nodejs/node#62713) * \[[`06defaa2ea`](nodejs/node@06defaa2ea)] - **(SEMVER-MINOR)** **fs**: add `signal` option to `fs.stat()` (Mert Can Altin) [#57775](nodejs/node#57775) * \[[`db66a963bf`](nodejs/node@db66a963bf)] - **(SEMVER-MINOR)** **fs**: expose `frsize` field in `statfs` (Jinho Jang) [#62277](nodejs/node#62277) * \[[`87adb3472b`](nodejs/node@87adb3472b)] - **(SEMVER-MINOR)** **http**: harden `ClientRequest` options merge (Matteo Collina) [#6… (truncated) ### v26.2.0 ### Notable Changes * \[[`189d43a193`](nodejs/node@189d43a193)] - **doc**: mark `stream.compose` stable (Matteo Collina) [#62562](nodejs/node#62562) * \[[`f858c6140e`](nodejs/node@f858c6140e)] - **(SEMVER-MINOR)** **fs**: add `Temporal.Instant` support to `Stats` and `BigIntStats` (Livia Medeiros) [#60789](nodejs/node#60789) * \[[`0cbb3895df`](nodejs/node@0cbb3895df)] - **(SEMVER-MINOR)** **http**: add `writeInformation` to send arbitrary 1xx status codes (Tim Perry) [#63155](nodejs/node#63155) ### Commits * \[[`9a394bab84`](nodejs/node@9a394bab84)] - **benchmark**: respect stream/iter broadcast backpressure (Trivikram Kamat) [#63314](nodejs/node#63314) * \[[`ad98b4620b`](nodejs/node@ad98b4620b)] - **crypto**: align verifyOneShot accepted types (Anshika Jain) [#63280](nodejs/node#63280) * \[[`ba0736a847`](nodejs/node@ba0736a847)] - **crypto**: wire ML-DSA and ML-KEM for use when using BoringSSL (Filip Skokan) [#63255](nodejs/node#63255) * \[[`5573a6a4a8`](nodejs/node@5573a6a4a8)] - **crypto**: wire ChaCha20-Poly1305 in Web Cryptography when using BoringSSL (Filip Skokan) [#63255](nodejs/node#63255) * \[[`7dc563b8d6`](nodejs/node@7dc563b8d6)] - **crypto**: wire AES-KW in Web Cryptography when using BoringSSL (Filip Skokan) [#63255](nodejs/node#63255) * \[[`b55e2b1f4d`](nodejs/node@b55e2b1f4d)] - **crypto**: improve system certificate enumeration logic on macOS (Robo) [#62576](nodejs/node#62576) * \[[`fd509a755a`](nodejs/node@fd509a755a)] - **crypto**: harden CryptoKey algorithm slots… (truncated) ### v26.3.0 ### Notable Changes #### Potential changes to macOS Universal Binary availability With Apple and its ecosystem progressively dropping support for Intel-based architectures, it has become apparent that the Node.js project may not be able to maintain the universal binaries we currently distribute for the full lifetime of Node.js 26. This change serves to communicate that risk. At present, our intention remains to continue shipping universal binaries supporting both Apple Silicon and Intel-based Macs for as long as practical. Contributed by Antoine du Hamel in [#63055](nodejs/node#63055). #### Other notable changes * \[[`a2a4b33dd8`](nodejs/node@a2a4b33dd8)] - **(SEMVER-MINOR)** **buffer**: increase `Buffer.poolSize` default to 64 KiB (Matteo Collina) [#63597](nodejs/node#63597) * \[[`051a2152f7`](nodejs/node@051a2152f7)] - **crypto**: update root certificates to NSS 3.123.1 (Node.js GitHub Bot) [#63527](nodejs/node#63527) * \[[`49462eca37`](nodejs/node@49462eca37)] - **(SEMVER-MINOR)** **http**: add `httpValidation` option to configure header value validation (RajeshKumar11) [#61597](nodejs/node#61597) * \[[`97b7ab19bd`](nodejs/node@97b7ab19bd)] - **(SEMVER-MINOR)** **inspector**: expose precise coverage start to JS runtime (sangwook) [#63079](nodejs/node#63079) * \[[`cfb80a2103`](nodejs/node@cfb80a2103)] - **(SEMVER-MINOR)** **lib,permission**: add `permission.drop` (Rafael Gonzaga) [#62672](nodejs/node#62672) ### Commits * \[[`a2a4b33dd8`](nodejs/node@a2a4b33dd8)] - **(SEMVER-MINOR)** **buffer**: increase Buffer.poolSize default to 64 KiB (Matteo Collina) [#63597](nodejs/node#63597) * \[[`0eff3e23b9`](https://github.com/nodejs/n… (truncated) ### v26.3.1 This is a security release. ### Notable Changes * (CVE-2026-48618) tls: normalize hostname for server identity checks (Matteo Collina) – High * (CVE-2026-48933) crypto: guard WebCrypto cipher output length (Filip Skokan) – High * (CVE-2026-48615) lib,test: redact proxy credentials in tunnel errors (Matteo Collina) – Medium * (CVE-2026-48619) http2: cap originSet size to prevent unbounded memory growth (Matteo Collina) – Medium * (CVE-2026-48928) tls: fix case-sensitive SNI context matching (Matteo Collina) – Medium * (CVE-2026-48930) dns,net: reject hostnames with embedded NUL bytes (Matteo Collina) – Medium * (CVE-2026-48934) tls: bind reusable sessions to authenticated host (Matteo Collina) – Medium * (CVE-2026-48617) permission: handle process.chdir on writereport (RafaelGSS) – Low * (CVE-2026-48931) http: fix response queue poisoning in http.Agent (Matteo Collina) – Low * (CVE-2026-48935) permission: disable FileHandle utimes with permission model (RafaelGSS) – Low * (CVE-2026-48936) permission: guard pipe open and chmod with net scope (RafaelGSS) – Low ### Commits * \[[`98fbc89211`](nodejs/node@98fbc89211)] - **(CVE-2026-48933)** **crypto**: guard WebCrypto cipher output length (Filip Skokan) [nodejs-private/node-private#878](https://github.com/nodejs-private/node-private/pull/878) * \[[`110840f2c7`](nodejs/node@110840f2c7)] - **deps**: update llhttp to 9.4.2 (Antoine du Hamel) [nodejs-private/node-private#890](https://github.com/nodejs-private/node-private/pull/890) * \[[`8d36d522b2`](nodejs/node@8d36d522b2)] - **deps**: update undici to 8.5.0 (Node.js GitHub Bot) [#63903](nodejs/node#63903) * \[[`2e6d03993a`](nodejs/node@2e6d03993a)] - **deps**: update undici to 8.4.0 (Node.js GitHub Bot) [#63779](nodejs/node#63779) * \[[`5a17d5b07a`](nodejs/node@5a17d5b07a)] - **deps… (truncated) ### v26.4.0 ### Notable Changes * \[[`cde0daabcc`](nodejs/node@cde0daabcc)] - **(SEMVER-MINOR)** **doc**: update `blockList` stability status to release candidate (alphaleadership) [#63050](nodejs/node#63050) * \[[`b78f5a7537`](nodejs/node@b78f5a7537)] - **(SEMVER-MINOR)** **fs**: support caller-supplied `readFile()` buffers (Matteo Collina) [#63634](nodejs/node#63634) * \[[`417aacbc36`](nodejs/node@417aacbc36)] - **(SEMVER-MINOR)** **http**: close pre-request sockets in `closeIdleConnections` (semimikoh) [#63470](nodejs/node#63470) * \[[`fbb108be7d`](nodejs/node@fbb108be7d)] - **(SEMVER-MINOR)** **loader**: implement package maps (Maël Nison) [#62239](nodejs/node#62239) * \[[`45494d5a8a`](nodejs/node@45494d5a8a)] - **(SEMVER-MINOR)** **net**: support `TCP_KEEPINTVL` and `TCP_KEEPCNT` in `setKeepAlive` (Guy Bedford) [#63825](nodejs/node#63825) * \[[`ee29465e77`](nodejs/node@ee29465e77)] - **(SEMVER-MINOR)** **tls**: add certificateCompression option (Tim Perry) [#62217](nodejs/node#62217) * \[[`b17817eb2b`](nodejs/node@b17817eb2b)] - **(SEMVER-MINOR)** **vfs**: dispatch `node:fs/promises` to mounted VFS instances (Matteo Collina) [#63537](nodejs/node#63537) * \[[`7bc93a6ac5`](nodejs/node@7bc93a6ac5)] - **(SEMVER-MINOR)** **vfs**: add minimal `node:vfs` subsystem (Matteo Collina) [#63115](nodejs/node#63115) ### Commits * \[[`c7eb83b46a`](nodejs/node@c7eb83b46a)] - **benchmark**: add child\_process async path baselines (Yagiz Nizipli) [#63929](nodejs/node#63929) * \[[`066fff17a5`](https://github.com/nodejs/node/commit/066f… (truncated) ### v26.5.0 ### Notable Changes #### New release key Welcome to our newest releaser, [Stewart X Addison](https://github.com/sxa). Future Node.js releases may be signed with his [release key](https://github.com/nodejs/node/blob/main/README.md#release-keys), `655F3B5C1FB3FA8D1A0CA6BDE4A7D232B936D2FD`. #### Other notable changes * \[[`55f48446c7`](nodejs/node@55f48446c7)] - **(SEMVER-MINOR)** **buffer**: implement blob.textStream() (Matthew Aitken) [#64036](nodejs/node#64036) * \[[`b373202efc`](nodejs/node@b373202efc)] - **(SEMVER-MINOR)** **esm**: add `--experimental-import-text` flag (Efe) [#62300](nodejs/node#62300) * \[[`39e0c14455`](nodejs/node@39e0c14455)] - **(SEMVER-MINOR)** **perf\_hooks**: sample delay per event loop iteration (Pablo Erhard) [#62935](nodejs/node#62935) * \[[`999a83c937`](nodejs/node@999a83c937)] - **(SEMVER-MINOR)** **stream**: expose ReadableStreamTee (Matteo Collina) [#64195](nodejs/node#64195) * \[[`4e0236dc3d`](nodejs/node@4e0236dc3d)] - **(SEMVER-MINOR)** **tls**: report negotiated TLS groups (Filip Skokan) [#64119](nodejs/node#64119) ### Commits * \[[`87648c0a6c`](nodejs/node@87648c0a6c)] - **benchmark**: trim down the argon2 sets (Filip Skokan) [#64218](nodejs/node#64218) * \[[`a483bfd3f0`](nodejs/node@a483bfd3f0)] - **buffer**: remove unreachable overflow check in atob (haramjeong) [#60161](nodejs/node#60161) * \[[`6d14279688`](nodejs/node@6d14279688)] - **buffer**: add fast api for isUtf8 and isAscii (Gürgün Dayıoğlu) [#64169](nodejs/node#64169) * \[[`55f48446c7`](nodejs/node@55f48446c7)] -… (truncated) ### v26.5.1 This is a security release. ### Notable Changes * (CVE-2026-56848) http2: defer rst stream while in scope (Matteo Collina) – High * (CVE-2026-58043) permission: avoid granting radix split nodes (RafaelGSS) – High * (CVE-2026-56850) https: distinguish PFX object-array agent keys (RafaelGSS) – Medium * (CVE-2026-58040) https: bind identity checks to session reuse (Matteo Collina) – Medium * (CVE-2026-58041) sqlite: invalidate tag store iterators on statement reset (Matteo Collina) – Medium * (CVE-2026-58042) dns: handle large resolveAny address replies (RafaelGSS) – Medium * (CVE-2026-58045) zlib: throw on out-of-bounds write buffers (RafaelGSS) – Medium * (CVE-2026-56847) permission: enforce fs write permission for trace events (RafaelGSS) – Low * (CVE-2026-58039) permission: check final report output path (RafaelGSS) – Low * (CVE-2026-58044) http: reject requests exceeding max header count (Matteo Collina) – Low * deps: update llhttp to 9.4.3 (Paolo Insogna) * deps: update undici to 8.9.0 (Node.js GitHub Bot) ### Commits * \[[`af0bf96877`](nodejs/node@af0bf96877)] - **deps**: update llhttp to 9.4.3 (Paolo Insogna) [nodejs-private/node-private#935](https://github.com/nodejs-private/node-private/pull/935) * \[[`0354678355`](nodejs/node@0354678355)] - **deps**: update undici to 8.9.0 (Node.js GitHub Bot) [#64712](nodejs/node#64712) * \[[`dbeeaeec13`](nodejs/node@dbeeaeec13)] - **(CVE-2026-58042)** **dns**: handle large resolveAny address replies (RafaelGSS) [nodejs-private/node-private#929](https://github.com/nodejs-private/node-private/pull/929) * \[[`064d339f56`](nodejs/node@064d339f56)] - **(CVE-2026-58044)** **http**: reject requests exceeding max header count (Matteo Collina) [nodejs-private/node-private#922](https://github.com/nodejs-private/node-private/pull/922) * \[[`23b94c843a`](https://github.… (truncated) _Omitted 12 older releases._ </details> </details> Modified files: - `.mise.toml`
Buffer.allocUnsafe(frameMax) returns a slice of Node's shared Buffer pool whenever frameMax <= Buffer.poolSize / 2. Node 24.18.0 / 26.3.0 raised Buffer.poolSize from 8 KiB to 64 KiB (nodejs/node#63597), so the default frameMax of 8192 now yields a pooled buffer whose byteOffset is not 0. parseFrames was called with new AMQPView(this.frameBuffer.buffer, 0, this.frameSize), which reads unrelated pool memory instead of the reassembled frame whenever a frame spans socket reads, failing with 'Frame end out of range, frameSize=<garbage>'. Pass frameBuffer.byteOffset instead of 0 (correct on every Node version; on <= 24.17 byteOffset was 0 because an 8 KiB allocation bypassed the pool).
Automated mise tool upgrades from local config. Updated tools: - `action-validator` - `actionlint` - `aube` - `editorconfig-checker` - `ghalint` - `node` - `pinact` - `pipx:gh-action-pulse` - `prek` - `rumdl` - `shellcheck` - `shfmt` - `tombi` - `uv` - `yamlfmt` - `yamllint` - `zizmor` Command: `mise upgrade --bump --local action-validator actionlint aube editorconfig-checker ghalint node pinact pipx:gh-action-pulse prek rumdl shellcheck shfmt tombi uv yamlfmt yamllint zizmor` <details> <summary>Version changelog (6 tools)</summary> | Tool | Requested | Installed | |------|-----------|-----------| | `editorconfig-checker` | `3.8.0` → `3.11.1` | `3.8.0` → `3.11.1` | | `node` | `24` → `26` | `24.19.0` → `26.7.0` | | `prek` | `0.4.11` → `0.4.12` | `0.4.11` → `0.4.12` | | `rumdl` | `0.2.49` → `0.2.52` | `0.2.49` → `0.2.52` | | `tombi` | `1.2.6` → `1.2.7` | `1.2.6` → `1.2.7` | | `uv` | `0.12.1` → `0.12.3` | `0.12.1` → `0.12.3` | </details> <details> <summary>Release notes (6 tools)</summary> <details> <summary>editorconfig-checker: `3.8.0` → `3.11.1` (editorconfig-checker/editorconfig-checker)</summary> ### v3.9.0 ## [3.9.0](editorconfig-checker/editorconfig-checker@v3.8.0...v3.9.0) (2026-07-31) ### Features * enable immutable releases ([6865c06](editorconfig-checker/editorconfig-checker@6865c06)) ### v3.10.0 ## editorconfig-checker v3.10.0 (2026-08-07T23:27:59Z) Welcome to this new release of editorconfig-checker! ## Changelog ### Others * 77a3415d6127cc892376837b85fd2a4b5c98d40d: Revert "feat(immutable-releases): set release-please to create draft releases" (@klaernie) * a85cd6ab82397f19bdd9bfa30730a487ead1ec74: chore(deps): bump docker/login-action from 4.5.2 to 4.6.0 (#590) (@dependabot[bot]) * 74cd03a2e91c1c42deff2bec2d120c06ff1be3e8: chore(main): release 3.10.0 (#588) (@editorconfig-checker-bot) * 8d4f96e7a838bfb0d8b98a40e66ce8cbd8c1e075: chore: allow triggering release-please manually (@klaernie) * a685b542509d0349ce6215adf6088a242fa93d84: feat(immutable-release): tell release-please to create draft releases (@klaernie) * 912f4a986b7da0b22cfa3a055cc24a355dee7cbc: feat(immutable-releases): ensure that despite the release being a draft the tag is created (@klaernie) * 2d48c2ecae1743614cefa660c2796e14cefd7520: feat(immutable-releases): set release-please to create draft releases (@klaernie) ## Thanks! Those were the changes on v3.10.0! ### v3.11.0 ## editorconfig-checker v3.11.0 (2026-08-08T10:40:38Z) Welcome to this new release of editorconfig-checker! ## Changelog ### Others * 174c5809baf06f2d8e82c1d2de1f6433cc569a1d: chore(main): release 3.11.0 (#592) (@editorconfig-checker-bot) * e9f143bc9d6cc5bb29030843ec42eae2a94b4dda: chore: replace deprecated goreleaser option with its current form (@klaernie) * 4c08f2ccd339734ff92f2f04d146cd91af02d225: feat(immutable-release): goreleaser should publish its release (@klaernie) ## Thanks! Those were the changes on v3.11.0! ### v3.11.1 ## [3.11.1](editorconfig-checker/editorconfig-checker@v3.11.0...v3.11.1) (2026-08-08) ### Features * **immutable-release:** tell goreleaser to use the existing draft release ([a8e6136](editorconfig-checker/editorconfig-checker@a8e6136)) </details> <details> <summary>node: `24.19.0` → `26.7.0` (nodejs/node)</summary> ### v26.0.0 We're excited to announce the release of Node.js 26! Highlights include the Temporal API enabled by default, updates to the V8 JavaScript engine to 14.6, Undici to 8.0, and several important deprecations and removals as we continue to modernize the platform. As a reminder, Node.js 26 will enter long-term support (LTS) in October, but until then, it will be the "Current" release for the next six months. We encourage you to explore the new features and benefits offered by this latest release and evaluate their potential impact on your applications. ### Notable Changes #### Temporal API The Temporal API is now enabled by default in Node.js 26. Temporal is a modern date/time API for JavaScript that provides a more robust and feature-rich alternative to the legacy `Date` object. Contributed by Richard Lau in [#61806](nodejs/node#61806). #### V8 14.6 The V8 engine is updated to version 14.6.202.33, which is part of Chromium 134. This version also includes: * Upsert (<https://github.com/tc39/proposal-upsert>): `[Weak]Map.prototype.getOrInsert()`, `[Weak]Map.prototype.getOrInsertComputed()` * Iterator sequencing (<https://github.com/tc39/proposal-iterator-sequencing>): `Iterator.concat()` Contributed by Michaël Zasso in [#61898](nodejs/node#61898). #### Undici 8 Undici has been updated to version 8.0.2, bringing new features and improvements to Node.js's HTTP client implementation. #### Deprecations and Removals * \[[`dff46c07c3`](nodejs/node@dff46c07c3)] - **(SEMVER-MAJOR)** **crypto**: move DEP0182 to End-of-Life (Tobias Nießen) [#61084](nodejs/node#61084) * \[[`93c25815ee`](nodejs/node@93c25815ee)] - **(SEMVER-MAJOR)** **http**: move writeHeader to end-of-life (Sebastian Beltran) [#60635](nodejs/node#60635) `http.Server.prototype.writeHeader()` is now fully removed. Use `http.Server.prototype.write… (truncated) ### v26.1.0 ### Notable Changes #### Experimental `node:ffi` module Node.js now includes an experimental `node:ffi` module for loading dynamic libraries and calling native symbols from JavaScript. The API is gated behind the `--experimental-ffi` flag and, when the Permission Model is enabled, requires `--allow-ffi`. This API is inherently unsafe. Invalid pointers, incorrect signatures, or accessing memory after it has been freed can crash the process or corrupt memory. Contributed by Paolo Insogna in [#62072](nodejs/node#62072). #### Other Notable Changes * \[[`34a6454fe3`](nodejs/node@34a6454fe3)] - **(SEMVER-MINOR)** **buffer**: add `end` parameter (Robert Nagy) [#62390](nodejs/node#62390) * \[[`073e84d7fe`](nodejs/node@073e84d7fe)] - **(SEMVER-MINOR)** **crypto**: accept key data in `crypto.diffieHellman()` and cleanup DH jobs (Filip Skokan) [#62527](nodejs/node#62527) * \[[`5b9cb10a5f`](nodejs/node@5b9cb10a5f)] - **(SEMVER-MINOR)** **crypto**: implement `randomUUIDv7()` (nabeel378) [#62553](nodejs/node#62553) * \[[`98f9becd16`](nodejs/node@98f9becd16)] - **(SEMVER-MINOR)** **debugger**: add edit-free runtime expression probes to `node inspect` (Joyee Cheung) [#62713](nodejs/node#62713) * \[[`06defaa2ea`](nodejs/node@06defaa2ea)] - **(SEMVER-MINOR)** **fs**: add `signal` option to `fs.stat()` (Mert Can Altin) [#57775](nodejs/node#57775) * \[[`db66a963bf`](nodejs/node@db66a963bf)] - **(SEMVER-MINOR)** **fs**: expose `frsize` field in `statfs` (Jinho Jang) [#62277](nodejs/node#62277) * \[[`87adb3472b`](nodejs/node@87adb3472b)] - **(SEMVER-MINOR)** **http**: harden `ClientRequest` options merge (Matteo Collina) [#6… (truncated) ### v26.2.0 ### Notable Changes * \[[`189d43a193`](nodejs/node@189d43a193)] - **doc**: mark `stream.compose` stable (Matteo Collina) [#62562](nodejs/node#62562) * \[[`f858c6140e`](nodejs/node@f858c6140e)] - **(SEMVER-MINOR)** **fs**: add `Temporal.Instant` support to `Stats` and `BigIntStats` (Livia Medeiros) [#60789](nodejs/node#60789) * \[[`0cbb3895df`](nodejs/node@0cbb3895df)] - **(SEMVER-MINOR)** **http**: add `writeInformation` to send arbitrary 1xx status codes (Tim Perry) [#63155](nodejs/node#63155) ### Commits * \[[`9a394bab84`](nodejs/node@9a394bab84)] - **benchmark**: respect stream/iter broadcast backpressure (Trivikram Kamat) [#63314](nodejs/node#63314) * \[[`ad98b4620b`](nodejs/node@ad98b4620b)] - **crypto**: align verifyOneShot accepted types (Anshika Jain) [#63280](nodejs/node#63280) * \[[`ba0736a847`](nodejs/node@ba0736a847)] - **crypto**: wire ML-DSA and ML-KEM for use when using BoringSSL (Filip Skokan) [#63255](nodejs/node#63255) * \[[`5573a6a4a8`](nodejs/node@5573a6a4a8)] - **crypto**: wire ChaCha20-Poly1305 in Web Cryptography when using BoringSSL (Filip Skokan) [#63255](nodejs/node#63255) * \[[`7dc563b8d6`](nodejs/node@7dc563b8d6)] - **crypto**: wire AES-KW in Web Cryptography when using BoringSSL (Filip Skokan) [#63255](nodejs/node#63255) * \[[`b55e2b1f4d`](nodejs/node@b55e2b1f4d)] - **crypto**: improve system certificate enumeration logic on macOS (Robo) [#62576](nodejs/node#62576) * \[[`fd509a755a`](nodejs/node@fd509a755a)] - **crypto**: harden CryptoKey algorithm slots… (truncated) ### v26.3.0 ### Notable Changes #### Potential changes to macOS Universal Binary availability With Apple and its ecosystem progressively dropping support for Intel-based architectures, it has become apparent that the Node.js project may not be able to maintain the universal binaries we currently distribute for the full lifetime of Node.js 26. This change serves to communicate that risk. At present, our intention remains to continue shipping universal binaries supporting both Apple Silicon and Intel-based Macs for as long as practical. Contributed by Antoine du Hamel in [#63055](nodejs/node#63055). #### Other notable changes * \[[`a2a4b33dd8`](nodejs/node@a2a4b33dd8)] - **(SEMVER-MINOR)** **buffer**: increase `Buffer.poolSize` default to 64 KiB (Matteo Collina) [#63597](nodejs/node#63597) * \[[`051a2152f7`](nodejs/node@051a2152f7)] - **crypto**: update root certificates to NSS 3.123.1 (Node.js GitHub Bot) [#63527](nodejs/node#63527) * \[[`49462eca37`](nodejs/node@49462eca37)] - **(SEMVER-MINOR)** **http**: add `httpValidation` option to configure header value validation (RajeshKumar11) [#61597](nodejs/node#61597) * \[[`97b7ab19bd`](nodejs/node@97b7ab19bd)] - **(SEMVER-MINOR)** **inspector**: expose precise coverage start to JS runtime (sangwook) [#63079](nodejs/node#63079) * \[[`cfb80a2103`](nodejs/node@cfb80a2103)] - **(SEMVER-MINOR)** **lib,permission**: add `permission.drop` (Rafael Gonzaga) [#62672](nodejs/node#62672) ### Commits * \[[`a2a4b33dd8`](nodejs/node@a2a4b33dd8)] - **(SEMVER-MINOR)** **buffer**: increase Buffer.poolSize default to 64 KiB (Matteo Collina) [#63597](nodejs/node#63597) * \[[`0eff3e23b9`](https://github.com/nodejs/n… (truncated) ### v26.3.1 This is a security release. ### Notable Changes * (CVE-2026-48618) tls: normalize hostname for server identity checks (Matteo Collina) – High * (CVE-2026-48933) crypto: guard WebCrypto cipher output length (Filip Skokan) – High * (CVE-2026-48615) lib,test: redact proxy credentials in tunnel errors (Matteo Collina) – Medium * (CVE-2026-48619) http2: cap originSet size to prevent unbounded memory growth (Matteo Collina) – Medium * (CVE-2026-48928) tls: fix case-sensitive SNI context matching (Matteo Collina) – Medium * (CVE-2026-48930) dns,net: reject hostnames with embedded NUL bytes (Matteo Collina) – Medium * (CVE-2026-48934) tls: bind reusable sessions to authenticated host (Matteo Collina) – Medium * (CVE-2026-48617) permission: handle process.chdir on writereport (RafaelGSS) – Low * (CVE-2026-48931) http: fix response queue poisoning in http.Agent (Matteo Collina) – Low * (CVE-2026-48935) permission: disable FileHandle utimes with permission model (RafaelGSS) – Low * (CVE-2026-48936) permission: guard pipe open and chmod with net scope (RafaelGSS) – Low ### Commits * \[[`98fbc89211`](nodejs/node@98fbc89211)] - **(CVE-2026-48933)** **crypto**: guard WebCrypto cipher output length (Filip Skokan) [nodejs-private/node-private#878](https://github.com/nodejs-private/node-private/pull/878) * \[[`110840f2c7`](nodejs/node@110840f2c7)] - **deps**: update llhttp to 9.4.2 (Antoine du Hamel) [nodejs-private/node-private#890](https://github.com/nodejs-private/node-private/pull/890) * \[[`8d36d522b2`](nodejs/node@8d36d522b2)] - **deps**: update undici to 8.5.0 (Node.js GitHub Bot) [#63903](nodejs/node#63903) * \[[`2e6d03993a`](nodejs/node@2e6d03993a)] - **deps**: update undici to 8.4.0 (Node.js GitHub Bot) [#63779](nodejs/node#63779) * \[[`5a17d5b07a`](nodejs/node@5a17d5b07a)] - **deps… (truncated) ### v26.4.0 ### Notable Changes * \[[`cde0daabcc`](nodejs/node@cde0daabcc)] - **(SEMVER-MINOR)** **doc**: update `blockList` stability status to release candidate (alphaleadership) [#63050](nodejs/node#63050) * \[[`b78f5a7537`](nodejs/node@b78f5a7537)] - **(SEMVER-MINOR)** **fs**: support caller-supplied `readFile()` buffers (Matteo Collina) [#63634](nodejs/node#63634) * \[[`417aacbc36`](nodejs/node@417aacbc36)] - **(SEMVER-MINOR)** **http**: close pre-request sockets in `closeIdleConnections` (semimikoh) [#63470](nodejs/node#63470) * \[[`fbb108be7d`](nodejs/node@fbb108be7d)] - **(SEMVER-MINOR)** **loader**: implement package maps (Maël Nison) [#62239](nodejs/node#62239) * \[[`45494d5a8a`](nodejs/node@45494d5a8a)] - **(SEMVER-MINOR)** **net**: support `TCP_KEEPINTVL` and `TCP_KEEPCNT` in `setKeepAlive` (Guy Bedford) [#63825](nodejs/node#63825) * \[[`ee29465e77`](nodejs/node@ee29465e77)] - **(SEMVER-MINOR)** **tls**: add certificateCompression option (Tim Perry) [#62217](nodejs/node#62217) * \[[`b17817eb2b`](nodejs/node@b17817eb2b)] - **(SEMVER-MINOR)** **vfs**: dispatch `node:fs/promises` to mounted VFS instances (Matteo Collina) [#63537](nodejs/node#63537) * \[[`7bc93a6ac5`](nodejs/node@7bc93a6ac5)] - **(SEMVER-MINOR)** **vfs**: add minimal `node:vfs` subsystem (Matteo Collina) [#63115](nodejs/node#63115) ### Commits * \[[`c7eb83b46a`](nodejs/node@c7eb83b46a)] - **benchmark**: add child\_process async path baselines (Yagiz Nizipli) [#63929](nodejs/node#63929) * \[[`066fff17a5`](https://github.com/nodejs/node/commit/066f… (truncated) ### v26.5.0 ### Notable Changes #### New release key Welcome to our newest releaser, [Stewart X Addison](https://github.com/sxa). Future Node.js releases may be signed with his [release key](https://github.com/nodejs/node/blob/main/README.md#release-keys), `655F3B5C1FB3FA8D1A0CA6BDE4A7D232B936D2FD`. #### Other notable changes * \[[`55f48446c7`](nodejs/node@55f48446c7)] - **(SEMVER-MINOR)** **buffer**: implement blob.textStream() (Matthew Aitken) [#64036](nodejs/node#64036) * \[[`b373202efc`](nodejs/node@b373202efc)] - **(SEMVER-MINOR)** **esm**: add `--experimental-import-text` flag (Efe) [#62300](nodejs/node#62300) * \[[`39e0c14455`](nodejs/node@39e0c14455)] - **(SEMVER-MINOR)** **perf\_hooks**: sample delay per event loop iteration (Pablo Erhard) [#62935](nodejs/node#62935) * \[[`999a83c937`](nodejs/node@999a83c937)] - **(SEMVER-MINOR)** **stream**: expose ReadableStreamTee (Matteo Collina) [#64195](nodejs/node#64195) * \[[`4e0236dc3d`](nodejs/node@4e0236dc3d)] - **(SEMVER-MINOR)** **tls**: report negotiated TLS groups (Filip Skokan) [#64119](nodejs/node#64119) ### Commits * \[[`87648c0a6c`](nodejs/node@87648c0a6c)] - **benchmark**: trim down the argon2 sets (Filip Skokan) [#64218](nodejs/node#64218) * \[[`a483bfd3f0`](nodejs/node@a483bfd3f0)] - **buffer**: remove unreachable overflow check in atob (haramjeong) [#60161](nodejs/node#60161) * \[[`6d14279688`](nodejs/node@6d14279688)] - **buffer**: add fast api for isUtf8 and isAscii (Gürgün Dayıoğlu) [#64169](nodejs/node#64169) * \[[`55f48446c7`](nodejs/node@55f48446c7)] -… (truncated) ### v26.5.1 This is a security release. ### Notable Changes * (CVE-2026-56848) http2: defer rst stream while in scope (Matteo Collina) – High * (CVE-2026-58043) permission: avoid granting radix split nodes (RafaelGSS) – High * (CVE-2026-56850) https: distinguish PFX object-array agent keys (RafaelGSS) – Medium * (CVE-2026-58040) https: bind identity checks to session reuse (Matteo Collina) – Medium * (CVE-2026-58041) sqlite: invalidate tag store iterators on statement reset (Matteo Collina) – Medium * (CVE-2026-58042) dns: handle large resolveAny address replies (RafaelGSS) – Medium * (CVE-2026-58045) zlib: throw on out-of-bounds write buffers (RafaelGSS) – Medium * (CVE-2026-56847) permission: enforce fs write permission for trace events (RafaelGSS) – Low * (CVE-2026-58039) permission: check final report output path (RafaelGSS) – Low * (CVE-2026-58044) http: reject requests exceeding max header count (Matteo Collina) – Low * deps: update llhttp to 9.4.3 (Paolo Insogna) * deps: update undici to 8.9.0 (Node.js GitHub Bot) ### Commits * \[[`af0bf96877`](nodejs/node@af0bf96877)] - **deps**: update llhttp to 9.4.3 (Paolo Insogna) [nodejs-private/node-private#935](https://github.com/nodejs-private/node-private/pull/935) * \[[`0354678355`](nodejs/node@0354678355)] - **deps**: update undici to 8.9.0 (Node.js GitHub Bot) [#64712](nodejs/node#64712) * \[[`dbeeaeec13`](nodejs/node@dbeeaeec13)] - **(CVE-2026-58042)** **dns**: handle large resolveAny address replies (RafaelGSS) [nodejs-private/node-private#929](https://github.com/nodejs-private/node-private/pull/929) * \[[`064d339f56`](nodejs/node@064d339f56)] - **(CVE-2026-58044)** **http**: reject requests exceeding max header count (Matteo Collina) [nodejs-private/node-private#922](https://github.com/nodejs-private/node-private/pull/922) * \[[`23b94c843a`](https://github.… (truncated) ### v26.6.0 ### Notable Changes * \[[`5a36018abc`](nodejs/node@5a36018abc)] - **doc**: add MikeMcC399 as collaborator (Mike McCready) [#64656](nodejs/node#64656) * \[[`9b04f82d7b`](nodejs/node@9b04f82d7b)] - **(SEMVER-MINOR)** **ffi**: add `getCurrentEventLoop` (Paolo Insogna) [#64323](nodejs/node#64323) * \[[`bb51f2c960`](nodejs/node@bb51f2c960)] - **(SEMVER-MINOR)** **test\_runner**: add `context.log()` and `test:log` event (Moshe Atlow) [#64389](nodejs/node#64389) * \[[`56ce83b3ee`](nodejs/node@56ce83b3ee)] - **(SEMVER-MINOR)** **test\_runner**: report `entryFile` in `TestStream` events (Moshe Atlow) [#64309](nodejs/node#64309) ### Commits * \[[`248ff9fa5c`](nodejs/node@248ff9fa5c)] - **assert,util**: fix TypeError on Maps with null keys (Paul Bouchon) [#64441](nodejs/node#64441) * \[[`3b5baceafe`](nodejs/node@3b5baceafe)] - **benchmark**: add bytes variant to webstreams async-iterator (Matteo Collina) [#64291](nodejs/node#64291) * \[[`0a46d1ef66`](nodejs/node@0a46d1ef66)] - **buffer**: normalize lone "\r" in Blob native line endings (Daijiro Wachi) [#64115](nodejs/node#64115) * \[[`d9ada18b70`](nodejs/node@d9ada18b70)] - **buffer**: fix Blob.stream() leaking source buffer (semimikoh) [#63577](nodejs/node#63577) * \[[`d05993bcf6`](nodejs/node@d05993bcf6)] - **build**: merge multiple on download artifact (Chengzhong Wu) [#64633](nodejs/node#64633) * \[[`6c25ac909a`](nodejs/node@6c25ac909a)] - **build**: extract temporal\_capi crate directory name into gyp variable (René) [#64482](https://githu… (truncated) ### v26.7.0 ### Notable Changes * \[[`58717685a1`](nodejs/node@58717685a1)] - **(SEMVER-MINOR)** **crypto**: support loading private keys through STORE loaders (Filip Skokan) [#63949](nodejs/node#63949) * \[[`44b940ee8c`](nodejs/node@44b940ee8c)] - **crypto**: update root certificates to NSS 3.125 (Node.js GitHub Bot) [#64746](nodejs/node#64746) * \[[`c1e4f7365e`](nodejs/node@c1e4f7365e)] - **(SEMVER-MINOR)** **lib**: add perfetto support (Chengzhong Wu) [#64565](nodejs/node#64565) * \[[`11c2f9c642`](nodejs/node@11c2f9c642)] - **(SEMVER-MINOR)** **module**: implement `Symbol.dispose` in `ModuleHooks` (Remco Haszing) [#63928](nodejs/node#63928) * \[[`a646319f61`](nodejs/node@a646319f61)] - **(SEMVER-MINOR)** **test\_runner**: add support for `--test-coverage-include-all` (avivkeller) [#64830](nodejs/node#64830) ### Commits * \[[`a2d3f891d3`](nodejs/node@a2d3f891d3)] - **async\_hooks**: use validateBoolean for trackPromises (Soul Lee) [#64731](nodejs/node#64731) * \[[`d7266cdd99`](nodejs/node@d7266cdd99)] - **benchmark**: fix calibrate-n option handling (Luan Muniz) [#64146](nodejs/node#64146) * \[[`2e64293e3f`](nodejs/node@2e64293e3f)] - **buffer**: use Clamp conversion in Blob slice (Donghoon Kang) [#64739](nodejs/node#64739) * \[[`5fda0958bd`](nodejs/node@5fda0958bd)] - **buffer**: validate copyArrayBuffer offsets against buffer length (Ilia Alshanetsky) [#63904](nodejs/node#63904) * \[[`5298db40f9`](nodejs/node@5298db40f9)] - **build**: run perfetto build and test on GHA (Chengzhong Wu) [#6472… (truncated) _Omitted 14 older releases._ </details> <details> <summary>prek: `0.4.11` → `0.4.12` (j178/prek)</summary> ### v0.4.12 ## Release Notes Released on 2026-08-03. ### Enhancements - Add `--require-group` for hook group intersections ([#2472](j178/prek#2472)) - Align fast-path and builtin pre-commit hooks ([#2433](j178/prek#2433)) - Do not shuffle file list for verbose output ([#2431](j178/prek#2431)) - Improve top-level command descriptions ([#2429](j178/prek#2429)) - Install `uv` from Astral CDN and drop source racing ([#2455](j178/prek#2455)) - Make `prek install --force` bypass external hooks paths ([#2437](j178/prek#2437)) - Show builtin hook flags in verbose list output ([#2427](j178/prek#2427)) - Verify uv release archive checksums ([#2456](j178/prek#2456)) ### Performance - Precompute file tags in parallel ([#2440](j178/prek#2440)) - Skip diffs after known hook modifications ([#2447](j178/prek#2447)) - Skip worktree diffs for read-only languages ([#2432](j178/prek#2432)) - Track builtin hook file changes directly ([#2404](j178/prek#2404)) ### Bug fixes - Use full object IDs in diff snapshots ([#2448](j178/prek#2448)) ### Documentation - Add a multi-repository configuration example ([#2434](j178/prek#2434)) - Rewrite benchmark documentation ([#2469](j178/prek#2469)) ### Contributors - @j178 - @BitWeaverDev - @allanlewis ## Install prek 0.4.12 ### Install prebuilt binaries via shell script ```sh curl --proto '=https' --tlsv1.2 -LsSf https://github.com/j178/prek/releases/download/v0.4.12/prek-installer.sh | sh ``` ### Install prebuilt binaries via powershell script ```sh powershell -ExecutionPolicy Bypass -c "irm https://github.com/j178/prek/releases/download/v0.4.12/prek-installer.ps1 | iex" ```… (truncated) </details> <details> <summary>rumdl: `0.2.49` → `0.2.52` (rvben/rumdl)</summary> ### v0.2.50 ### Added - **md077**: support fixed continuation indent config (#786) ([fea6322](rvben/rumdl@fea6322)) ### Fixed - **md065**: leave markers alone inside a block that hides its content ([2654364](rvben/rumdl@2654364)) - **md065**: report thematic breaks written with spaces between markers ([1d29236](rvben/rumdl@1d29236)) - **md076**: ask the parser whether a list item's block is really fenced ([fd616c2](rvben/rumdl@fd616c2)) - **md022**: require a blank line below a heading above a spaced thematic break ([27120f2](rvben/rumdl@27120f2)) - **MD076**: preserve fenced list item spacing (#788) ([2d60067](rvben/rumdl@2d60067)) - **md022**: use the same list test below a heading in check and fix (#790) ([ef926b7](rvben/rumdl@ef926b7)) - **md040**: locate the fence a list marker holds instead of assuming the indent ([6099a6c](rvben/rumdl@6099a6c)) - **md077**: keep the strict-flavor minimum as a floor under a configured indent ([cfaad2e](rvben/rumdl@cfaad2e)) - **md077**: reject a configured indent of 0 ([1ac97a3](rvben/rumdl@1ac97a3)) - **md077**: accept the indent option instead of reporting it as unknown ([cba175c](rvben/rumdl@cba175c)) - **md013**: stop exempting a complete link followed by a parenthesized aside ([722fad6](rvben/rumdl@722fad6)) - **md013**: ke… (truncated) ### v0.2.51 ### Added - **md088**: normalize quotes and dashes to ASCII (#763) ([52e9844](rvben/rumdl@52e9844)) ### Fixed - **config**: keep a file's per-file-ignores out of the workspace index it feeds ([2bb0ce7](rvben/rumdl@2bb0ce7)) - **md051**: validate cross-file link fragments for a document read from stdin ([e215c65](rvben/rumdl@e215c65)) - **md051**: report a broken fragment on a query-string destination once ([7c8390f](rvben/rumdl@7c8390f)) - **md088**: leave modifier letters and math notation alone ([56dbf0f](rvben/rumdl@56dbf0f)) - **config**: report the effective rule lists from `config get global.*` ([5db8f0c](rvben/rumdl@5db8f0c)) - **config**: answer `config get` for every key rumdl accepts ([ecce820](rvben/rumdl@ecce820)) - **md035**: publish the horizontal rule style the rule enforces ([77c8c65](rvben/rumdl@77c8c65)) - **config**: accept every config key a rule actually reads ([8ec7bba](rvben/rumdl@8ec7bba)) - **lsp**: identify documents by the same resolved path as the index ([78f4aa0](rvben/rumdl@78f4aa0)) - **lsp**: keep frontmatter values out of find-references results ([499b005](rvben/rumdl@499b005)) - **md051**: index cross-file links independently of frontmatter config ([ca7b93e](rvben/rumdl@ca7b93e)) - **lsp**: build the workspace index from t… (truncated) ### v0.2.52 ### Fixed - **md012**: report blank lines before a code block that ends the document (#791) ([e897556](rvben/rumdl@e897556)) - **rules**: treat a template shortcode tag as opaque markup ([6962184](rvben/rumdl@6962184)) - **cli**: report a piped document's findings on stdout like every other run ([47f8a50](rvben/rumdl@47f8a50)) ## Downloads | File | Platform | Checksum | |------|----------|----------| | [rumdl-v0.2.52-x86_64-unknown-linux-gnu.tar.gz](https://github.com/rvben/rumdl/releases/download/v0.2.52/rumdl-v0.2.52-x86_64-unknown-linux-gnu.tar.gz) | Linux x86_64 | [checksum](https://github.com/rvben/rumdl/releases/download/v0.2.52/rumdl-v0.2.52-x86_64-unknown-linux-gnu.tar.gz.sha256) | | [rumdl-v0.2.52-x86_64-unknown-linux-musl.tar.gz](https://github.com/rvben/rumdl/releases/download/v0.2.52/rumdl-v0.2.52-x86_64-unknown-linux-musl.tar.gz) | Linux x86_64 (musl) | [checksum](https://github.com/rvben/rumdl/releases/download/v0.2.52/rumdl-v0.2.52-x86_64-unknown-linux-musl.tar.gz.sha256) | | [rumdl-v0.2.52-aarch64-unknown-linux-gnu.tar.gz](https://github.com/rvben/rumdl/releases/download/v0.2.52/rumdl-v0.2.52-aarch64-unknown-linux-gnu.tar.gz) | Linux ARM64 | [checksum](https://github.com/rvben/rumdl/releases/download/v0.2.52/rumdl-v0.2.52-aarch64-unknown-linux-gnu.tar.gz.sha256) | | [rumdl-v0.2.52-aarch64-unknown-linux-musl.tar.gz](https://github.com/rvben/rumdl/releases/download/v0.2.52/rumdl-v0.2.52-aarch64-unknown-linux-musl.tar.gz) | Linux ARM64 (musl) | [checksum](https://github.com/rvben/rumdl/releases/download/v0.2.52/rumdl-v0.2.52-aarch64-unknown-linux-musl.tar.gz.sha256) | | [rumdl-v0.2.52-x86_64-apple-darwin.tar.gz](https://github.com/rvben/rumdl/releases/download/v0.2.52/rumdl-v0.2.52-x86_64-apple-darwin.tar.gz) | macOS x86_64 | [checksum](https://github.com/rvben/r… (truncated) </details> <details> <summary>tombi: `1.2.6` → `1.2.7` (tombi-toml/tombi)</summary> ### v1.2.7 <!-- Release notes generated using configuration in .github/release.yml at v1.2.7 --> ## What's Changed ### 🦅 New Features * feat(config): support per-schema strict mode by @ya7010 in tombi-toml/tombi#2061 ### 🛠️ Other Changes * fix: improve config file load error reporting by @ya7010 in tombi-toml/tombi#2062 **Full Changelog**: tombi-toml/tombi@v1.2.6...v1.2.7 </details> <details> <summary>uv: `0.12.1` → `0.12.3` (astral-sh/uv)</summary> ### 0.12.2 ## Release Notes Released on 2026-08-05. ### Python - Add CPython 3.15.0rc1 ([#20948](astral-sh/uv#20948)) - Add CPython 3.14.7 ([#20971](astral-sh/uv#20971)) ### Enhancements - Ensure diagnostic hints end with a newline to prevent malformed terminal output ([#20959](astral-sh/uv#20959)) ### Preview features - Audit one or all installed tools with `uv tool audit` ([#20921](astral-sh/uv#20921)) - Report physically reclaimed disk space during cache cleanup with the `cache-physical-space` preview feature ([#20925](astral-sh/uv#20925)) ### Configuration - Add `UV_RUN_RLIMIT_NOFILE` to set the open-file limit for commands launched by `uv run` ([#20926](astral-sh/uv#20926)) ### Performance - Speed up `uv.lock` parsing for wheel entries ([#20881](astral-sh/uv#20881)) - Speed up `uv.lock` parsing for source distribution entries ([#20882](astral-sh/uv#20882)) - Speed up filename extraction from distribution URLs ([#20879](astral-sh/uv#20879)) - Reduce filesystem metadata lookups during bytecode compilation ([#20928](astral-sh/uv#20928)) - Reuse file metadata when building source distributions ([#20927](astral-sh/uv#20927)) ### Bug fixes - Preserve compatibility with older uv versions when recording artifact sizes in cached wheels and source distributions ([#20963](astral-sh/uv#20963)) - Avoid including workspace-root default dependency groups when syncing or exporting a selected workspace member unless explicitly requested ([#20930](astral-sh/uv#20930)) ### Documentation - Separate build and publish jobs in the GitHub Actions publishing guide ([#20946](astral-sh/uv#20946)) - Ensure the GitHub Actions publishing exampl… (truncated) ### 0.12.3 ## Release Notes Released on 2026-08-07. ### Python - Add CPython 3.13.15 ([#20997](astral-sh/uv#20997)) ### Preview features - Add `--output-format` to select automatic, human-readable, or raw-byte output for `uv cache size` ([#20992](astral-sh/uv#20992)) - Preserve JSON output from `uv workspace metadata --quiet` while suppressing diagnostics ([#20991](astral-sh/uv#20991)) - Reduce memory usage for large workspaces by streaming `uv workspace metadata` JSON output ([#20990](astral-sh/uv#20990)) ### Performance - Reduce Linux startup latency by initializing the workspace cache before spawning another thread ([#20989](astral-sh/uv#20989)) - Reuse compiled workspace exclusion patterns during workspace discovery ([#20988](astral-sh/uv#20988)) - Speed up conflict-heavy resolutions by avoiding materialized range complements ([#20982](astral-sh/uv#20982)) - Avoid slow procfs reads during Python interpreter discovery on Linux ([#20987](astral-sh/uv#20987)) ### Documentation - Add PEP 740 attestations to the GitHub Actions publishing example ([#20986](astral-sh/uv#20986)) - Restrict the GitHub Actions publishing example to Python version tags ([#20973](astral-sh/uv#20973)) - Correct `--python-pin` to `--pin-python` in the `uv init --bare` example ([#20876](astral-sh/uv#20876)) ## Install uv 0.12.3 ### Install prebuilt binaries via shell script ```sh curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/uv/releases/download/0.12.3/uv-installer.sh | sh ``` ### Install prebuilt binaries via powershell script ```sh powershell -ExecutionPolicy Bypass -c "irm https://releases.astral.sh/github/uv/releases/download/0.12.3/uv-installer.ps1 | iex" ``` ## Download uv 0.12.3 | Fi… (truncated) </details> </details> Modified files: - `.mise.toml`
## Description Fixes compact snapshot parsing when the input is a valid `Uint8Array` view with a non-zero `byteOffset`. The ODSP compact snapshot parser asserted that its input must begin at offset zero: ```ts assert(input.byteOffset === 0, 0x3e8 /* code below assumes no offset */); ``` The affected snapshots were valid, but their binary data was represented by a view into a larger backing buffer. The assertion closed the Fluid container during loading and caused eight of the 29 Office eDiscovery fixtures to fail with assertion `0x3e8`. ### Update: Why this started failing now The assertion has existed since 2022, but the relevant inputs previously happened to have a zero `byteOffset`, leaving the invalid assumption hidden. The failure started after [Node.js 24.18.0 increased the default `Buffer.poolSize` from 8 KiB to 64 KiB](nodejs/node#63597). Node uses this pool for `Buffer.allocUnsafe()` allocations smaller than half the pool size. This increased the pooling threshold from approximately 4 KiB to 32 KiB. The Office eDiscovery export path reads binary snapshots using: ```ts fs.readFileSync(filePath) ``` Node's `fs.readFileSync()` allocates the returned `Buffer` using `Buffer.allocUnsafe(fileSize)`. A Node `Buffer` is also a `Uint8Array` view. Before Node 24.18: - The default buffer pool was 8 KiB. - Allocations of approximately 4 KiB or larger bypassed the pool. - Relevant snapshot reads therefore received dedicated backing buffers, normally with `byteOffset === 0`. Beginning with Node 24.18: - The default buffer pool is 64 KiB. - Allocations smaller than approximately 32 KiB can come from the shared pool. - Those buffers can be slices of the shared backing allocation and therefore have a valid non-zero `byteOffset`. Node 24.20 and 24.21 inherited this behavior. This explains why the failure appeared when the Office External Partner pipeline moved from Node 24.11 to newer Node 24 releases. The Office External Partner integration pipeline selected Node using this floating range: ```yaml - task: UseNode@1 inputs: version: ">=24.11.0 <25.0.0" ``` The range selects the newest available matching Node 24 release, not the lowest version in the range. Normal Office CI did not initially reproduce the issue because its managed build image still provided Node 24.11.0. Controlled runs confirmed the Node version as the differentiating variable: - Node 24.21.0 with Fluid build 422789: eight eDiscovery failures. - Node 24.11.0 with the same Fluid build and Office test code: all 29 eDiscovery tests passed. Node did not introduce malformed snapshot data or change the `Uint8Array` contract. The larger buffer pool caused more file reads to use valid offset views, exposing Fluid's existing assumption about the backing-buffer layout. Pinning Node 24.11 would avoid the expanded pooling threshold and can serve as a temporary mitigation. However, it would leave Fluid dependent on an allocation detail that Node does not guarantee. Other consumers can also provide valid non-zero-offset `Uint8Array` views independently of Node's file-reading behavior. ### Root cause The assertion was originally added by Vlad Sudzilouski in #12058 as part of a string-parsing performance optimization. The PR discusses null-character handling and differences between browser and Node string decoding, but it does not document why a zero byte offset was required. The parser does not require a zero-offset backing buffer: - `Uint8Array` indexing is relative to the view. - `Uint8Array.subarray()` is relative to the view. - `ReadBuffer` positions and reads are relative to the supplied `Uint8Array`. - Existing `BlobShallowCopy` handling explicitly accounts for `data.byteOffset`. For example, if a view begins at offset 100 in its backing buffer, `input[0]` still reads the first byte of that view, not byte zero of the backing buffer. The string positions recorded by the parser are also relative to that same view. A non-zero offset is therefore a supported memory layout rather than evidence of a malformed or corrupted snapshot. The assertion rejected valid input without providing additional snapshot-integrity protection. This change removes that assertion. It does not remove validation of snapshot structure, string lengths, tree markers, skipped ranges, or unexpected end-of-file conditions. Copying the input into a new zero-offset buffer would also avoid the assertion, but it would introduce an unnecessary full-snapshot allocation and preserve the incorrect parser restriction. ### Changes - Remove the `byteOffset === 0` assertion from compact snapshot string loading. - Add a regression test that: - Serializes a compact snapshot. - Embeds it inside a larger backing buffer. - Passes a non-zero-offset `subarray()` to `TreeBuilder.load()`. - Confirms that the test input actually has a non-zero `byteOffset`. - Verifies that the resulting strings, blobs, and tree match the original snapshot. ### Reproduction and integration validation The issue was isolated using controlled Office External Partner pipeline runs: | Office build | Node | Fluid build | eDiscovery result | | --- | --- | --- | --- | | [55007732](https://office.visualstudio.com/OC/_build/results?buildId=55007732&view=results) | 24.21.0 | 422789 | 21 passed, 8 failed with `0x3e8` | | [55015480](https://office.visualstudio.com/OC/_build/results?buildId=55015480&view=results) | 24.11.0 | 422789 | 29/29 passed | | [55069760](https://office.visualstudio.com/OC/_build/results?buildId=55069760&view=results) | 24.21.0 | 422948 with this fix | 29/29 passed; pipeline succeeded | The first two runs used the same Fluid build and Office test code, with only the Node version changed. This confirmed that the larger buffer pool in newer Node versions exposes the existing parser assumption. The final run restored the triggering Node 24.21.0 environment and used Fluid build 422948 containing this change. All 29 eDiscovery tests passed, including the eight fixtures that previously failed. The overall integration pipeline also succeeded. The ODSP driver build completed successfully, including compilation, linting, API checks, and test compilation. The Tree Representation test suite passed in both ESM and CommonJS configurations. A Fluid Real Service End to End Tests run was also queued using client build 422948 to exercise the change against an actual ODSP tenant: - [Fluid Real Service E2E build 423091](https://dev.azure.com/fluidframework/internal/_build/results?buildId=423091&view=results) ## Reviewer Guidance Please focus on whether any compact snapshot parsing operation depends on the backing buffer starting at offset zero. The relevant string positions are relative to the supplied `Uint8Array` view, and the added regression test exercises the parser using a non-zero-offset view and compares the fully parsed result with the original tree. The original assertion author was Vlad Sudzilouski (`vladsud`) in #12058. The original PR does not contain an explanation of a required zero-offset invariant.
…oolSize (langfuse#17812) The "non-final parts are their own allocation" test asserted `parts[0].data.buffer.byteLength === partSizeBytes` as a proxy for "copied, not a subarray view". That proxy only held while an 8 KiB `Buffer.from` copy got a dedicated ArrayBuffer, i.e. while 8192 was above Node's buffer-pool half-threshold (poolSize 8192 -> 4096). Node v24.18.0 raised the default `Buffer.poolSize` from 8 KiB to 64 KiB (nodejs/node#63597). An 8 KiB copy is now served from the shared 64 KiB pool, so `.buffer.byteLength` is 65536 and the assertion fails with `expected 65536 to be 8192` — even though the code under test is unchanged and still copies correctly. The daily full-suite CI (Node 24.20.0) surfaced this; it is a Node runtime change, unrelated to anything the suite talks to. Assert the property behaviorally instead: feed a Buffer chunk, overwrite the source after upload, and require the non-final parts to be unchanged. That proves the parts are independent copies regardless of poolSize, and still fails if a part is ever returned as a zero-copy view into the source. Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
* chore: Disable storybook color-contrast checking (#17730)
* feat: encode v4 native blocks and event bytes in Rust (#17563)
* Run native codec tests against ClickHouse in CI
* style: format native fixture exporter
* chore: refactor implementation to simplify code paths
* feat(automations): filter prompt events by tags (#17727)
* refactor(tests): move feature flags into factory (#17735)
* refactor(web): reroute rbac deep imports through index.ts (#17734)
* refactor(web): reroute rbac deep imports through index.ts
Extend the rbac client door with the remaining externally-used symbols
and point other features at that surface. Auth policy types and
apiKeyAccessRights stay on the deep path so the React access helpers
do not enter the policy graph.
* fix(web): keep rbac member tables off the client door
Re-exporting those tables from index.ts pulled CreateProjectMemberDialog
and react-hook-form into server instrumentation and API routes via the
access-helper barrel. Settings pages import the tables by file path.
---------
Co-authored-by: Cursor Agent <cursoragent@cursor.com>
* fix(shared): preserve small JSON siblings of oversized fields (#17717)
* fix(shared): preserve small JSON siblings of oversized fields
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* test(shared): cover nested object parsing size accounting
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* fix(web): group trace graph steps without recursive stack overflow (#17566)
Long sequential traces created one step group per observation and
recursed until the browser stack overflowed. Group iteratively so
timing-based steps still match, without depending on call depth.
Co-authored-by: Cursor Agent <cursoragent@cursor.com>
Co-authored-by: nikita.kabardin <nikita.kabardin@clickhouse.com>
* fix(web): drop getter-only window.__NEXT_DATA__ TypeError from Sentry (#17514)
Next.js Pages Router initialize assigns window.__NEXT_DATA__ and Chromium
throws when that property is getter-only. Drop only the console-captured
shape so an uncaught hydration crash still surfaces.
Co-authored-by: Cursor Agent <cursoragent@cursor.com>
* fix(web): stop IME composition from duplicating tracing search text (#17706)
Korean and other IMEs insert a text node React does not own inside the
contenteditable search composer. Reprojecting the draft then renders a
token next to that leftover node, so syllables double and Backspace
cannot delete them.
Wrap plain-text gaps in spans, strip unmanaged root children after
composition, and remount tokens so the projection matches the draft.
Co-authored-by: Cursor Agent <cursoragent@cursor.com>
* fix(web): wait for widget route params before project-scoped queries (#17393)
Pages Router leaves query empty on the first render of a statically
optimized dynamic route. New-widget was only waiting for the session
read path, so WidgetForm mounted with an undefined projectId and fired
protected queries.
Co-authored-by: Cursor Agent <cursoragent@cursor.com>
Co-authored-by: nikita.kabardin <nikita.kabardin@clickhouse.com>
* fix(web): recover and group stale Next.js chunk load failures (#17441)
* fix(web): group first-party Next.js chunk load failures in Sentry
Hashed /_next/static chunk URLs were minting a new issue per file when
route-loader script.onerror or a first-party dynamic import() failed.
Fingerprint those load errors together; do not drop them so a broken
CDN or deploy still spikes on one issue.
Co-authored-by: nikita.kabardin <nikita.kabardin@clickhouse.com>
* fix(web): recover stale-tab Next.js chunk 404s with a one-shot reload
When a superseded bundle's script tag 404s, Next.js fails to render the
error page and the tab stays broken. Reload once per session on that
script error, and offer Reload on the client crash modal if the first
attempt already ran.
Co-authored-by: nikita.kabardin <nikita.kabardin@clickhouse.com>
* fix(web): gate stale-chunk reload on observed version mismatch
Only hard-reload a Next.js chunk 404 after this tab has seen a newer
build id, so a transient CDN or lazy-chunk blip on a current bundle
does not wipe in-progress state. Strip internal Sentry issue ids from
comments an OSS reader meets.
Co-authored-by: Nikita Kabardin <nikita@kabardin.com>
---------
Co-authored-by: Cursor Agent <cursoragent@cursor.com>
Co-authored-by: nikita.kabardin <nikita.kabardin@clickhouse.com>
Co-authored-by: Nikita Kabardin <nikita@kabardin.com>
* fix(web): drop Safari password-manager addMore.click from Sentry (#17263)
Fixes LANGFUSE-619
Co-authored-by: Cursor Agent <cursoragent@cursor.com>
Co-authored-by: nikita.kabardin <nikita.kabardin@clickhouse.com>
* fix(web): stop dialogs hopping through document.body on open (#17264)
fix(web): resolve overlay layer containers on first client render
Creating the overlay root in an effect left Radix portals on document.body
for one paint, which tripped aria-hidden hideOthers. Build the containers
during the first client render instead.
Co-authored-by: Cursor Agent <cursoragent@cursor.com>
* chore(deps): bump html-to-text to 10.0.1 (#17746)
* refactor(web): reroute remaining feature deep imports through index.ts (#17738)
* refactor(web): reroute remaining feature deep imports through index.ts
Route leftover client imports for scores, navigate-detail-pages, table,
organizations, and posthog-analytics through feature index.ts. Add
table/server and organizations/server doors for server-only helpers.
Leave tRPC routers, ServerPosthog, dual-use modules imported by server,
and ScoreConfigDetails on the deep path so client barrels do not pull
React UI into instrumentation.
* refactor(web): keep organization forms off the client door
CommandMenu already imports the settings-pages hook from the organizations
barrel. Re-exporting the new-org form and project overview through that
door pulled organizationNameSchema into every hook consumer.
* fix(web): keep the organizations door off the filters barrel
filter-builder importing the organizations index loaded
OrganizationSettingsPage, which pulls ai-gateway and search-bar and
closes a cycle through ComposerTokens. Keep filter-builder on the
file path. Drop unused useScoreCache and openAIFeaturesSettings
re-exports that knip flagged.
* fix(web): keep organization settings pages off the client door
projects/hooks imports the organizations door, and that hook sits in
filter-builder on the filters door that ComposerTokens already imports.
Re-exporting useOrganizationSettingsPages pulled ai-gateway and
search-bar into that graph (WORD_JOINER TDZ in Storybook).
---------
Co-authored-by: Cursor Agent <cursoragent@cursor.com>
* chore: release v4.41.0
* refactor(web): reroute leftover feature deep imports through index.ts (#17749)
* refactor(web): reroute leftover feature deep imports through index.ts
Route leftover cross-feature imports through feature index.ts for
notifications, projects, events, dashboard, chart-view, experiments,
annotation-queues, and entitlements. Add annotation-queues/server/index.ts
for the public annotation-queue service. Keep project settings pages,
home-chart registry, and experiment filter configs off the client doors
so shared hooks do not pull those graphs.
* fix(web): keep dashboard preset export off the feature door
dashboard-import-export already loads the widgets door, so re-exporting
buildPresetExport from dashboard/index.ts would close a widgets/dashboard
cycle. The one consumer goes back to the deep path.
---------
Co-authored-by: Cursor Agent <cursoragent@cursor.com>
* fix(web): trace page panels fill the window width (#17714)
Co-authored-by: Claude Fable 5.1 <noreply@anthropic.com>
* refactor(web): reroute remaining feature deep imports through index.ts (#17753)
Route leftover cross-feature imports through feature index.ts and
server/index.ts for navigation, media, comments, billing, analytics
integrations, public-api server helpers, column-visibility, orderBy,
feature-flags, in-app-agent, folders, tags, and automations.
Co-authored-by: Cursor Agent <cursoragent@cursor.com>
* feat: trace messages internal preview (#17648)
* feat(transcript): enhance transcript structure with conversation history and current turn
* docs(transcript): update README to clarify conversation history and current turn structure
* Lfe 16397 feat deliver wrapper method with correlation id to fetch (#17638)
* refactor(transcript): streamline README and fixture structure for clarity
* feat(feature-flags): add internal flags for Langfuse-internal surfaces
Internal flags are on for Langfuse admins and for deployments with
experimental features enabled, and for nobody else: they are not feature
previews, cannot be granted, and are never persisted. `hasInternalAccess`
holds that rule for client and server. First flag: `traceMessages`.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
* feat(events): add transcriptByTraceId procedure for internal users
`loadTraceTranscript` reads the trace's structure and its generations and
tools with I/O from the events table, orders them like the trace tree, and
assembles the transcript. The repository function gains an optional
observation type filter for the second read.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
* feat(traces): add Messages view behind the traceMessages internal flag
A fourth segment next to Tree, Timeline and Graph renders the trace as a
transcript with the formatted IO components: replayed conversation history
first, then the current turn with links to its observations. Selecting it
collapses the detail panel. Desktop only.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
* feat(traces): add toggle for conversation history in TraceMessagesView
* refactor(events): enhance event observation limits and transcript handling
* refactor(transcript): change export to const for MAX_TRANSCRIPT_OBSERVATIONS and internalFlags
* refactor(trace-messages): simplify toIOPreview call in MessageList component
---------
Co-authored-by: Claude Fable 5.1 <noreply@anthropic.com>
* fix(web): antialiased body text (#17756)
Co-authored-by: Claude Fable 5.1 <noreply@anthropic.com>
* refactor(web): reroute leftover feature deep imports through index.ts (#17760)
Co-authored-by: Cursor Agent <cursoragent@cursor.com>
* fix(web): remove unused surveys.create tRPC route (#17768)
The surveys.create mutation was an authenticatedProcedure (session-only,
no org-membership middleware) that persisted a Survey row with an orgId
taken verbatim from the request body. Any logged-in user could therefore
write a survey row attributed to an arbitrary organization id they are
not a member of — a cross-tenant write mis-attribution / data-pollution
bug of the same trusted-orgId class as CVE-2025-64504.
The route has no callers anywhere in the codebase (no api.surveys /
trpc.surveys usage, no e2e/HTTP caller). Survey rows are still written by
the onboarding path (onboardingService completeUserOnboarding), which
derives orgId server-side rather than from client input, and the read
paths (onboarding lookup, S3 core-data export) are unaffected.
Removing the dead endpoint eliminates the attack surface entirely rather
than guarding it.
Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
* chore: bump clickhouse test version to 26.9 (#17769)
* refactor(web): Migrate llm connections table to design-system components (#17732)
refactor: Migrate api-key settings table to design-system components
* feat(ai-gateway): accept Anthropic connections in the resolution contract (#17754)
* feat(ai-gateway): accept Anthropic connections in the resolution contract
The resolver contract now models the Web provider registry instead of a
single OpenAI Responses pairing: ApiFormat gains anthropic.messages,
Provider gains anthropic, and the connection credential is either a
Bearer token or an x-api-key value. Decoding rejects any connection whose
provider, API format, official origin and credential scheme disagree.
Routes pass their API format into resolution; the OpenAI transport reads
the credential through the new enum. No Anthropic route exists yet.
Co-authored-by: Hassieb Pakzad <hassiebp@users.noreply.github.com>
* push
---------
Co-authored-by: Cursor Agent <cursoragent@cursor.com>
Co-authored-by: Hassieb Pakzad <hassiebp@users.noreply.github.com>
* chore(worker): extract OTEL event processing (#17736)
* fix(ui): clarify selected controls and suspend inactive menus (#17739)
* fix(ui): clarify selected controls and suspend inactive menus
Co-Authored-By: Codex (gpt-6-astra) <noreply@openai.com>
* fix(ui): show multi-select checkboxes beside option labels
Co-Authored-By: Codex (gpt-6-astra) <noreply@openai.com>
* refactor(ui): keep selector indicators inside option content
Co-Authored-By: Codex (gpt-6-astra) <noreply@openai.com>
* refactor(ui): constrain selector metadata to text labels
Co-Authored-By: Codex (gpt-6-astra) <noreply@openai.com>
---------
Co-authored-by: Codex (gpt-6-astra) <noreply@openai.com>
* refactor(web): reroute leftover long-tail feature deep imports through index.ts (#17762)
* refactor(web): reroute leftover long-tail feature deep imports through index.ts
* test(web): keep entitlements server barrel exports when mocking hasEntitlement
* test(web): avoid import() type annotations in entitlements mocks
---------
Co-authored-by: Cursor Agent <cursoragent@cursor.com>
* refactor(web): reroute leftover dual-use feature deep imports through server doors (#17770)
Extract the cloud-billing env check from the client hook so server callers can import it through billing/server without loading React, and route dashboard mapping helpers through dashboard/server for the same reason.
Co-authored-by: Cursor Agent <cursoragent@cursor.com>
* feat(trace): Simplify trace and observation actions (#17737)
* feat(trace): Simplify trace and observation actions
* Address PR comments
* feat(evals): decision-model evaluators with TypeSafe Jev (experimental) (#17733)
* fix(ui): keep nested dropdowns inside narrow viewports (#17776)
fix(ui): keep nested dropdown menus inside narrow viewports
Co-authored-by: Codex (gpt-6-astra) <noreply@openai.com>
* fix(ai-gateway): update container bases to Debian Trixie (#17773)
* feat(annotations): unify score editing and review state (#17740)
* fix(ui): clarify selected controls and suspend inactive menus
Co-Authored-By: Codex (gpt-6-astra) <noreply@openai.com>
* feat(annotations): unify score editing and review state
Co-Authored-By: Codex (gpt-6-astra) <noreply@openai.com>
* fix(annotations): retain save and queue recovery state
Co-Authored-By: Codex (gpt-6-astra) <noreply@openai.com>
* fix(annotations): guard removal of the reviewed comparison run
Co-Authored-By: Codex (gpt-6-astra) <noreply@openai.com>
* fix(scores): clarify annotation targets and preserve selector uniqueness
Co-Authored-By: Codex (gpt-6-astra) <noreply@openai.com>
* fix(ui): show multi-select checkboxes beside option labels
Co-Authored-By: Codex (gpt-6-astra) <noreply@openai.com>
* refactor(ui): keep selector indicators inside option content
Co-Authored-By: Codex (gpt-6-astra) <noreply@openai.com>
* refactor(ui): constrain selector metadata to text labels
Co-Authored-By: Codex (gpt-6-astra) <noreply@openai.com>
* feat(annotations): add scores from the field list
Keep saved values behind Clear score and remove only empty rows. Return keyboard focus to Add score after removing a row.
Co-Authored-By: Codex (gpt-6-astra) <noreply@openai.com>
* fix(annotation): preserve read-path flag in desktop editor
Co-Authored-By: Codex (gpt-6-astra) <noreply@openai.com>
---------
Co-authored-by: Codex (gpt-6-astra) <noreply@openai.com>
* feat(comments): refresh conversations and stabilize overlay state (#17744)
* feat(comments): refresh conversations and stabilize overlay state
Co-Authored-By: Codex (gpt-6-astra) <noreply@openai.com>
* fix(comments): remove nested conversation border
Co-Authored-By: Codex (gpt-6-astra) <noreply@openai.com>
* fix(comments): keep the empty editor caret visible
Co-Authored-By: Codex (gpt-6-astra) <noreply@openai.com>
* test(ui): finish drawer focus cleanup before teardown
Co-Authored-By: Codex (gpt-6-astra) <noreply@openai.com>
---------
Co-authored-by: Codex (gpt-6-astra) <noreply@openai.com>
* feat(normalize-io): use normalized parser in GA for single trace UI (#17729)
* feat(normalize-io): use normalized parser in GA for single trace UI
* refactor: enhance error reporting in useIOPreviewParser
* delete: remove unused test file for IOPreviewParser
* feat(review): embed comments and annotation beside traces and sessions (#17745)
* fix(ui): clarify selected controls and suspend inactive menus
Co-Authored-By: Codex (gpt-6-astra) <noreply@openai.com>
* feat(annotations): unify score editing and review state
Co-Authored-By: Codex (gpt-6-astra) <noreply@openai.com>
* feat(comments): refresh conversations and stabilize overlay state
Co-Authored-By: Codex (gpt-6-astra) <noreply@openai.com>
* feat(traces): embed comments and annotation beside trace content
Co-Authored-By: Codex (gpt-6-astra) <noreply@openai.com>
* fix(annotations): retain save and queue recovery state
Co-Authored-By: Codex (gpt-6-astra) <noreply@openai.com>
* fix(traces): refresh clean annotation fields when reopening
Co-Authored-By: Codex (gpt-6-astra) <noreply@openai.com>
* fix(annotations): guard removal of the reviewed comparison run
Co-Authored-By: Codex (gpt-6-astra) <noreply@openai.com>
* fix(comments): remove nested conversation border
Co-Authored-By: Codex (gpt-6-astra) <noreply@openai.com>
* fix(scores): clarify annotation targets and preserve selector uniqueness
Co-Authored-By: Codex (gpt-6-astra) <noreply@openai.com>
* fix(traces): adapt review panels to available space
Co-Authored-By: Codex (gpt-6-astra) <noreply@openai.com>
* fix(traces): keep mobile action overlays accessible and stable
Co-Authored-By: Codex (gpt-6-astra) <noreply@openai.com>
* fix(traces): fill the available full-page workspace
Co-Authored-By: Codex (gpt-6-astra) <noreply@openai.com>
* fix(traces): keep review controls reachable in short layouts
Co-Authored-By: Codex (gpt-6-astra) <noreply@openai.com>
* fix(ui): show multi-select checkboxes beside option labels
Co-Authored-By: Codex (gpt-6-astra) <noreply@openai.com>
* refactor(ui): keep selector indicators inside option content
Co-Authored-By: Codex (gpt-6-astra) <noreply@openai.com>
* refactor(ui): constrain selector metadata to text labels
Co-Authored-By: Codex (gpt-6-astra) <noreply@openai.com>
* feat(annotations): add scores from the field list
Keep saved values behind Clear score and remove only empty rows. Return keyboard focus to Add score after removing a row.
Co-Authored-By: Codex (gpt-6-astra) <noreply@openai.com>
* fix(comments): keep the empty editor caret visible
Co-Authored-By: Codex (gpt-6-astra) <noreply@openai.com>
* fix(annotation): preserve read-path flag in desktop editor
Co-Authored-By: Codex (gpt-6-astra) <noreply@openai.com>
* feat(sessions): embed comments and annotation alongside session content
Preserve review drafts across responsive layout changes and align session actions with the shared Add to menu.
Co-Authored-By: Codex (gpt-6-astra) <noreply@openai.com>
* fix(annotation): focus the score editor when opening review
Co-Authored-By: Codex (gpt-6-astra) <noreply@openai.com>
* fix(traces): consolidate mobile detail actions into one menu
Co-Authored-By: Codex (gpt-6-astra) <noreply@openai.com>
* fix(ui): keep nested dropdown menus inside narrow viewports
Co-Authored-By: Codex (gpt-6-astra) <noreply@openai.com>
* fix(comments): restore the opening action after closing review
Co-Authored-By: Codex (gpt-6-astra) <noreply@openai.com>
---------
Co-authored-by: Codex (gpt-6-astra) <noreply@openai.com>
* feat(web): add regional demo redirect (#15483)
* feat(web): add regional demo redirect
* fix(web): scope demo target to setup password
* fix(web): ensure demo access before redirect
* feat(web): add regional demo trace redirect
* fix(web): address demo redirect review comments
* fix(web): scope demo redirect to v1
* fix(web): keep demo redirect read-only
* test(web): trim demo redirect client tests
* fix(web): configure demo route in previews
* fix(web): simplify demo project access helper
* fix(web): preserve demo callback after oauth onboarding
* fix(web): limit setup password redirect to demo
* fix(web): simplify demo redirect scope
* feat(web): add region-aware host bounce for demo route
* fix(web): address demo redirect review feedback
* fix(web): remove demo onboarding client test
* fix(web): support deep demo redirects
* refactor(web): use optional catch-all demo route
* fix(web): require cloud org for demo redirect
* fix(web): ignore deleted demo projects
* fix(web): guard demo lookup by cloud region
* fix(web): preserve default sso sign-in call
* fix(web): guard demo redirect access
* fix(web): isolate demo callback helper
* fix(web): remove stale demo redirect mock assertion
* test(web): remove demo onboarding client test
* fix(web): preserve demo redirects through signup
* test(web): stabilize setup password redirect test
* test(web): trim setup password redirect coverage
* fix(web): handle invalid demo redirect sessions
* fix(auth): route demo signups through onboarding
* test(auth): remove signup client test
---------
Co-authored-by: Cursor Agent <cursoragent@cursor.com>
* feat(datasets): unify item editors and preserve batch selection (#17747)
* fix(ui): clarify selected controls and suspend inactive menus
Co-Authored-By: Codex (gpt-6-astra) <noreply@openai.com>
* feat(annotations): unify score editing and review state
Co-Authored-By: Codex (gpt-6-astra) <noreply@openai.com>
* feat(comments): refresh conversations and stabilize overlay state
Co-Authored-By: Codex (gpt-6-astra) <noreply@openai.com>
* feat(traces): embed comments and annotation beside trace content
Co-Authored-By: Codex (gpt-6-astra) <noreply@openai.com>
* feat(datasets): unify dataset editors and preserve batch selection
Co-Authored-By: Codex (gpt-6-astra) <noreply@openai.com>
* fix(annotations): retain save and queue recovery state
Co-Authored-By: Codex (gpt-6-astra) <noreply@openai.com>
* fix(traces): refresh clean annotation fields when reopening
Co-Authored-By: Codex (gpt-6-astra) <noreply@openai.com>
* fix(datasets): preserve edited mappings when choosing a target
Co-Authored-By: Codex (gpt-6-astra) <noreply@openai.com>
* fix(annotations): guard removal of the reviewed comparison run
Co-Authored-By: Codex (gpt-6-astra) <noreply@openai.com>
* fix(comments): remove nested conversation border
Co-Authored-By: Codex (gpt-6-astra) <noreply@openai.com>
* fix(scores): clarify annotation targets and preserve selector uniqueness
Co-Authored-By: Codex (gpt-6-astra) <noreply@openai.com>
* fix(traces): adapt review panels to available space
Co-Authored-By: Codex (gpt-6-astra) <noreply@openai.com>
* fix(datasets): simplify single-item editing layout
Co-Authored-By: Codex (gpt-6-astra) <noreply@openai.com>
* fix(traces): keep mobile action overlays accessible and stable
Co-Authored-By: Codex (gpt-6-astra) <noreply@openai.com>
* fix(scores): clarify annotation targets and preserve selector uniqueness
Co-Authored-By: Codex (gpt-6-astra) <noreply@openai.com>
* fix(traces): adapt review panels to available space
Co-Authored-By: Codex (gpt-6-astra) <noreply@openai.com>
* fix(traces): keep mobile action overlays accessible and stable
Co-Authored-By: Codex (gpt-6-astra) <noreply@openai.com>
* fix(traces): fill the available full-page workspace
Co-Authored-By: Codex (gpt-6-astra) <noreply@openai.com>
* fix(traces): keep review controls reachable in short layouts
Co-Authored-By: Codex (gpt-6-astra) <noreply@openai.com>
* fix(ui): show multi-select checkboxes beside option labels
Co-Authored-By: Codex (gpt-6-astra) <noreply@openai.com>
* refactor(ui): keep selector indicators inside option content
Co-Authored-By: Codex (gpt-6-astra) <noreply@openai.com>
* refactor(ui): constrain selector metadata to text labels
Co-Authored-By: Codex (gpt-6-astra) <noreply@openai.com>
* feat(annotations): add scores from the field list
Keep saved values behind Clear score and remove only empty rows. Return keyboard focus to Add score after removing a row.
Co-Authored-By: Codex (gpt-6-astra) <noreply@openai.com>
* fix(comments): keep the empty editor caret visible
Co-Authored-By: Codex (gpt-6-astra) <noreply@openai.com>
* fix(datasets): use the shared create dataset button
Co-Authored-By: Codex (gpt-6-astra) <noreply@openai.com>
* fix(annotation): preserve read-path flag in desktop editor
Co-Authored-By: Codex (gpt-6-astra) <noreply@openai.com>
* feat(sessions): embed comments and annotation alongside session content
Preserve review drafts across responsive layout changes and align session actions with the shared Add to menu.
Co-Authored-By: Codex (gpt-6-astra) <noreply@openai.com>
* fix(annotation): focus the score editor when opening review
Co-Authored-By: Codex (gpt-6-astra) <noreply@openai.com>
* fix(traces): consolidate mobile detail actions into one menu
Co-Authored-By: Codex (gpt-6-astra) <noreply@openai.com>
* fix(ui): keep nested dropdown menus inside narrow viewports
Co-Authored-By: Codex (gpt-6-astra) <noreply@openai.com>
* fix(comments): restore the opening action after closing review
Co-Authored-By: Codex (gpt-6-astra) <noreply@openai.com>
---------
Co-authored-by: Codex (gpt-6-astra) <noreply@openai.com>
* fix(evals): validate decision model batch mappings (#17785)
* fix(evals): validate decision model batch mappings
Co-authored-by: Hassieb Pakzad <hassiebp@users.noreply.github.com>
* test(evals): satisfy batch mapping lint
Co-authored-by: Hassieb Pakzad <hassiebp@users.noreply.github.com>
---------
Co-authored-by: Cursor Agent <cursoragent@cursor.com>
Co-authored-by: Hassieb Pakzad <hassiebp@users.noreply.github.com>
* chore(assistant): refresh embedded Langfuse skills (#17766)
Co-authored-by: github-merge-queue <118344674+github-merge-queue@users.noreply.github.com>
* feat(evals): surface decision-model evaluators in the template gallery (#17778)
* feat(web): storybook options for surfacing decision-model evaluators in the gallery
Adds decision-model templates to the managed template shape (questions
plus state keys, no pinned connection; excluded from the legacy editor),
a tag on the gallery method badge, and two optional discoverability
props on the gallery view: a header button with a pill and a dismissible
launch banner. Stories show each option for review.
* feat(evals): surface decision-model evaluators in the template gallery
Adds a New decision model header action, a dismissible launch banner, and
three Jev-based managed templates (topic assignment, out-of-scope flag,
frustration rating) behind the decisionModelEvaluators flag. The decision
model topic template takes the LLM judge's recommended slot when enabled.
* psuh
* fix(web): align gallery badge config and catalog count with removed New tag
---------
Co-authored-by: Cursor Agent <cursoragent@cursor.com>
* refactor(web): Migrate score configs table to design-system components (#17789)
* refactor(web): Create design-system LineChart (#17782)
* refactor(web): Create design-system LineChart
* Address PR comments
* fix(ui): polish embedded review controls (#17794)
* fix(ui): polish embedded review controls
Align annotation content, improve the empty state, and keep compact review actions readable and keyboard focused.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* fix(ui): stabilize annotation save feedback
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* fix(ui): keep mobile comment labels singular at zero
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* fix(experiments): read non-propagated experiment attribute from experiment root span (#17473)
* fix(experiments): preserve summary attributes (#15922)
Co-authored-by: marliessophie <74332854+marliessophie@users.noreply.github.com>
* fix(experiments): update experiment metadata handling in queries and tests
---------
Co-authored-by: stutimohindra <stuti.mohindra@gmail.com>
* fix(evals): refine decision model evaluator UI (#17795)
* fix(evals): refine decision model evaluator UI
Co-authored-by: Hassieb Pakzad <hassiebp@users.noreply.github.com>
* fix(evals): clarify decision score calculation
Co-authored-by: Hassieb Pakzad <hassiebp@users.noreply.github.com>
* test(evals): cover decision model naming copy
Co-authored-by: Hassieb Pakzad <hassiebp@users.noreply.github.com>
* fix(evals): address decision model review findings
Co-authored-by: Hassieb Pakzad <hassiebp@users.noreply.github.com>
* test(evals): mark keyboard tooltip story
Co-authored-by: Hassieb Pakzad <hassiebp@users.noreply.github.com>
---------
Co-authored-by: Cursor Agent <cursoragent@cursor.com>
Co-authored-by: Hassieb Pakzad <hassiebp@users.noreply.github.com>
* fix(ui): make trace navigation responsive (#17796)
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* chore(evals): remove decisionModelEvaluators feature flag (#17797)
* chore(pricing): add Claude Opus 5.5 and GPT-6 Sol/Luna default pricing (#17802)
* feat(api): add prompt name prefix filtering (#17779)
* feat(api): add prompt name prefix filtering
* feat(api): add structured filters to prompt listing
* fix(ui): polish trace review responsiveness (#17801)
* fix(ui): polish trace review responsiveness
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* fix(ui): refine trace review spacing
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* fix(ui): align compact trace review controls
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* fix(ui): balance compact trace toolbar spacing
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* fix(ui): align annotation panel actions
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* fix(ui): preserve responsive keyboard order
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* chore: release v4.42.0
* refactor(web): Migrate api key table to design-system components (#17791)
* fix(web): Formatted / Raw toggle on the observation Attributes tab (#17712)
* fix(web): Formatted / JSON toggle shows on the observation Attributes tab
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
* fix(web): Formatted / Raw toggle, JSON label renamed
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
* fix(web): Beta JSON switch stays off the Attributes tab
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
---------
Co-authored-by: Claude Fable 5.1 <noreply@anthropic.com>
* refactor(web): Replace some legacy dropdowns with `DropdownMenu` (#17790)
* Migrate annotation queue actions menu
* Migrate evaluator remap action menu
* Migrate evaluator actions menu
* Migrate rule actions menu
* Migrate prompt export menu
* Migrate dataset run actions menu
* Migrate preset widget actions menu
* Migrate monitor automation menu
* Migrate dashboard widget actions menu
* perf(fts): decide the token prefilter at build time, not with an OR (#17724)
Full-text search prefiltered input/output and metadata equality with
`(empty(tokens(value)) OR hasAllTokens(...))`. That runtime disjunction
blocks ClickHouse skip-index pruning on the surrounding OR, even though
whether the value tokenizes is knowable before the query runs.
Decide it at build time with hasFtsSearchToken, which mirrors tokens()
emptiness: emit the bare hasAllTokens prefilter when the value has tokens,
omit it otherwise. hasAllTokens is a superset of the exact / ILIKE /
position predicate it is ANDed with, so the result set is unchanged while
the OR arity in the search WHERE clause drops.
Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
* feat(members): filter project and organization members by role (#17810)
* feat(members): filter project and organization members by role
Members settings tables gain a role multi-select next to the name/email
search. On project pages the filter matches the effective project role:
the project-level role when set, otherwise the organization role.
Co-authored-by: Hassieb Pakzad <hassiebp@users.noreply.github.com>
* fix(settings-table): wrap toolbar when filters are present on narrow screens
Co-authored-by: Hassieb Pakzad <hassiebp@users.noreply.github.com>
* push
* style(members): format org id guard
Co-authored-by: Hassieb Pakzad <hassiebp@users.noreply.github.com>
* refactor(settings-table): take typed filter config instead of arbitrary nodes
Co-authored-by: Hassieb Pakzad <hassiebp@users.noreply.github.com>
* fix(members): reset pagination when the role filter changes via URL or history
Co-authored-by: Hassieb Pakzad <hassiebp@users.noreply.github.com>
---------
Co-authored-by: Cursor Agent <cursoragent@cursor.com>
Co-authored-by: Hassieb Pakzad <hassiebp@users.noreply.github.com>
* fix(settings): Add small gap between nav items (#17814)
* fix(web): type scale carries line-height, whole-pixel sizes (#17658)
* fix(web): type scale carries line-height, whole-pixel sizes, antialiased
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
* fix(web): drop leading overrides the type scale now covers
Removes 27 leading-4/5/6 overrides that only approximated the body
leading the text-xs/sm/base/lg tokens now carry. Overrides on inputs,
textareas, code blocks, chart labels, tree rows and fixed-height chrome
stay.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
* docs(storybook): type scale page shows each size's line-height
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
* fix(web): raise count badge fill so its label meets 4.5:1 contrast
The default badge fill (primary at 50%) put #f8fafc on #878b95, a 3.25:1
ratio that axe only surfaced once the xs size moved to a whole pixel.
Primary at 65% gives 5.3:1 in light mode and 7.1:1 in dark mode.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
* fix(web): text sizes xs, sm and base share a 1.5 line-height
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
* docs(storybook): typography page states the line-height rule
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
* fix(web): antialiasing moves to its own change
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
---------
Co-authored-by: Claude Fable 5.1 <noreply@anthropic.com>
* fix(web): trace page title is the trace id (#17710)
* fix(web): trace page title is the trace id
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
* fix(web): format peek observation detail
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
---------
Co-authored-by: Claude Fable 5.1 <noreply@anthropic.com>
* fix(web): no usage badge on observations without usage (#17708)
* fix(web): no usage badge on observations without usage
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
* fix(web): trace header hides the usage badge when every usage entry is zero
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
---------
Co-authored-by: Claude Fable 5.1 <noreply@anthropic.com>
* fix(web): system message keeps one expand control (#17623)
* fix(web): system message keeps one expand control
The collapsed system message offered a header chevron, a top-right Expand
button and an inline "Expand system prompt" link. The inline link stays;
the header's collapse control goes, along with the JSON view's unused
copy of the collapse state.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
* fix(web): pin the single system-prompt expand control in tests
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
* fix(web): drop the unused nested-ternary directive after merging main
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
---------
Co-authored-by: Claude Fable 5.1 <noreply@anthropic.com>
* fix(web): tree metrics heatmap update (#17619)
* fix(web): tree metrics read in bold at half the trace, colour-code toggle goes
Duration and cost in the observation tree turned amber at 50% and red at
75% of the trace total, the app's warning and error colours. A row at or
above half of the trace's duration or cost now reads in foreground bold;
the trace root and a lone top-level span are never emphasised, they are
the whole trace. The "Show Color Code Metrics" toggle and its preference
go. The search list applies the same rule.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
* fix(web): compute trace emphasis totals once per trace
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
* fix(web): tree metric emphasis at three quarters of the trace
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
* fix(web): emphasised tree metrics use colour only, no bold
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
---------
Co-authored-by: Claude Fable 5.1 <noreply@anthropic.com>
* fix(web): one compact badge, primary and outline, sharper corners (#17609)
* fix(web): one compact badge, primary and outline, sharper corners
Both badge components lose their size variant and settle on one compact
pill: 6px side padding, no vertical padding, tight leading, 2px corners,
regular weight, text on foreground-secondary. The design-system Badge's
primary colour is the grey pill and gains an outline variant; neutral goes.
Tag chips render as badges so they match the empty-tag placeholder.
Light-mode foreground-secondary moves from slate-700 to slate-600.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
* fix(web): labelled item badge reads as an outline badge, icon muted
Drops the white fill and 2px border; beside a label the type icon takes
the muted text colour instead of its type hue.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
* fix(web): outline badge border paints
The transparent border moved from the badge base onto the filled variants
so the outline variant's border colour is not overridden.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
* fix(web): labelled item badge shows the word only
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
* fix(web): outline badge styling, icon-only item badges borderless
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
* fix(web): outline badge uses the contrast border and muted text
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
* fix(web): header type as plain text, lighter badge fill
The peek header shows the item type as a muted word when it fits and the
icon badge when it does not. Grey badges fill at 60% tertiary so they sit
lighter on the page.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
* fix(web): header type word in mono xs, baseline-aligned with the title
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
* fix(web): header type word back to sans
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
* fix(web): page header shows the item type as muted text, not a chip
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
* fix(web): badges go mono with a muted key, default is bordered, emphasis is filled
Default badge: 20px tall, 1px contrast border, no fill, mono text with the
key in muted and the value in secondary. Emphasis: filled, used for tags.
Link badges point with a blue arrow. Strip badges pass key and value
separately.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
* fix(web): badges match the session header pills
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
* fix(web): badges back to sans
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
* fix(web): tag chips keep focus, hover and disabled affordances
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
* fix(web): header type label at text-sm
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
* fix(web): session header pills use the Badge component
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
* fix(web): header type word back on the Badge, text only
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
* fix(web): score chips carry a marker, name without colon
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
* fix(web): badge padding 8/6, optical nudge, wider gap in the trace header
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
* fix(web): session header scores render through ScoreBadge
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
* fix(web): badge keys and values share one colour, icons muted, tags outlined, unused emphasis colour dropped
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
* fix(web): badges set in mono
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
* fix(web): session tokens pill shows in, out and total; trace header shows total tokens and the word session
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
* fix(web): session badge test matches the id in the title
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
* fix(web): badges back to sans
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
* fix(web): session tokens story matches the in, out, total pill; format breadcrumb
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
* fix(web): small badge size for tree-row score and level badges
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
* fix(web): small badge is 16px tall with 4px side padding
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
* fix(web): badge size variant owns height and padding so the small size applies
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
* fix(web): small badge is 18px tall with 6px side padding
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
* fix(web): badges from main use the default size
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
* fix(web): format
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
---------
Co-authored-by: Claude Fable 5.1 <noreply@anthropic.com>
* fix(normalized-io): langfuse plugin rendering (#17820)
* fix(normalized-io): support ChatML thinking content in Anthropic blocks (#17610)
* fix(normalized-io): support ChatML thinking content in Anthropic blocks
* refactor(normalized-io): give Langfuse ChatML thinking parts their own convention
* test(normalized-io): move the ChatML thinking fixtures to their own convention
* test(web): assert the preview renders a Thinking block for plugin reasoning
* fix(normalized-io): handle null values in Anthropic thinking normalization
* Update packages/shared/src/utils/normalized-io/conventions/providers/langfuse-agent-plugins/index.ts
Co-authored-by: greptile-apps[bot] <165735046+greptile-apps[bot]@users.noreply.github.com>
* fix(useChatMLParser): remove undefined value from test case
---------
Co-authored-by: Milana Gurbanova <121519865+milanagm@users.noreply.github.com>
Co-authored-by: greptile-apps[bot] <165735046+greptile-apps[bot]@users.noreply.github.com>
* refactor(web): Migrate verified domains settings table to design system (#17823)
* refactor(web): Migrate verified domains settings table to design system
* Address PR comments
* feat(scores): Allow creating scores from annotation sidebar (#17815)
* feat(feature-flags): introduce internal view mode and related components (#17816)
* feat(feature-flags): introduce internal view mode and related components
* refactor(feature-flags): update InternalViewModeDialog props and usage in AuthenticatedLayout
* refactor(feature-flags): remove export of INTERNAL_FEATURE_FLAG from index
* fix(feature-flags): ensure safe access to user admin status and update test environment handling
* test(userAccount): mock environment variables for experimental features in tests
* refactor(tests): streamline user account tests and update experimental feature handling
* refactor(trace-layout): simplify layout change condition in TraceNavigationDetailLayout
* feat(trace-detail): add messages tab and internal feature handling in TraceDetailView
* feat(trace-detail): implement TraceDetailTabMenu for improved tab navigation and integrate internal feature badge
* feat(userAccount): enhance internal view mode validation with feature preview checks
* fix(userAccount): update error code for setViewMode to reflect precondition failure
* fix(settings): Use badge for project role in invites table (#17825)
* feat(evals): route TypeSafe decision-model connections through OpenRouter or Vercel AI Gateway (#17798)
* fix(scim): scope Users/{id} reads and mutations to the caller's org (#17828)
* fix(scim): scope Users/{id} reads and mutations to the caller's org
The SCIM Users/{id} route resolves the target user globally by internal
id, and only handleGet re-scoped that lookup to the caller's
organization. handlePut echoed the user's email and account timestamps
for any request that did not carry active:true — active omitted, or
active:false against a non-member — disclosing another organization's
user by id, and the two distinct 404 detail strings formed an
instance-wide user-existence oracle. handleDelete silently no-op'd
against a non-member.
Add a shared requireOrgMembership gate used by GET, the non-provisioning
PUT paths, and DELETE, and unify the two 404 bodies so a user in another
organization is indistinguishable from one that does not exist.
Provisioning (active:true) intentionally remains able to reference a
not-yet-member user in order to add them.
Adds cross-organization regression tests for GET/PUT/DELETE.
Reported privately by Feldspar (autonomous AI agent, L3Digital LLC);
sibling of GHSA-94hf-6gqq-pj69 on a code path that fix did not cover.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
* fix(scim): keep "in organization" 404 wording for non-members
Address review: revert the shared requireOrgMembership 404 from the
generic "User not found" back to "User not found in organization". The
cross-organization disclosure fix does not depend on collapsing the two
404 bodies — the gate already refuses to echo any user attribute — so
this only affects the residual existence signal, which is existence-only
for an already-known opaque cuid and unavoidable while active:true
provisioning by id exists. Keeping the specific wording lets a legitimate
SCIM client tell "provision this account into your org" apart from a
wrong id.
Update the GET cross-org test to assert no user attributes leak (rather
than 404-body equality with the nonexistent case).
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
* cleanup
---------
Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
* chore(assistant): switch to opus 5.5 (#17819)
* chore: release v4.43.0
* feat(llm-connections): send extra headers on Vertex AI Gemini requests (#17831)
Co-authored-by: Cursor Agent <cursoragent@cursor.com>
* refactor(web): Create design-system BarChart (#17829)
* refactor(web): Create design-system BarChart
* Address PR comments
* fix(sessions): show tool rows with nested observations (#17826)
* fix(sessions): show tool rows with nested observations
* Add subagent nested inside tool example
* fix(worker): await in-flight ClickHouse writes during shutdown (#17836)
* refactor(web): Create design-system HistogramChart (#17833)
* refactor(web): Create design-system HistogramChart
* Address PR comments
* refactor(web): Migrate batch actions settings table to design system (#17832)
* refactor(web): Migrate batch actions settings table to design system
* Address PR comments
* Address PR comments
* refactor(web): Migrate audit log settings table to design system (#17822)
* refactor(web): Migrate audit log settings table to design system
* Address PR comments
* Address PR comments
* Fix buttons
* Fix export button size
* chore(worker): simplify Native codec parity writer setup (#17843)
chore(worker): use regular singleton in Native codec parity tests
* chore: improve project deletion warning text (#17846)
* feat(worker): add isolated OTEL replay integration harness (#17741)
* feat(worker): add isolated OTEL replay integration harness
* fix(worker): harden OTEL replay failure handling
* chore(worker): focus replay tests on persisted outcomes
* chore(worker): keep replay client routing minimal
* feat(evals): add conversation-signals decision-model gallery template (#17845)
* feat(evals): add conversation-signals decision-model gallery template
Ships a seven-question noul template for user-side conversation signals
(rephrase, correction, human handoff, retry, quoted error, frustration,
success) so teams can start from the gallery instead of rebuilding it.
Co-authored-by: annabellscha <annabellscha@users.noreply.github.com>
* test(evals): expect conversation-signals in gallery conversation section
Co-authored-by: annabellscha <annabellscha@users.noreply.github.com>
---------
Co-authored-by: Cursor Agent <cursoragent@cursor.com>
Co-authored-by: annabellscha <annabellscha@users.noreply.github.com>
* feat(trace-batching): enhance transcript assembly with timing metrics and token estimates (#17839)
* feat(trace-batching): enhance transcript assembly with timing metrics and token estimates
* refactor(trace-batching): update token metrics and character counts for transcript processing
* fix(dashboard,widgets): correct silent aggregation errors in score histogram and pivot averages (#15208) (#15209)
* fix(dashboard,widgets): correct silent aggregation errors in score histogram and pivot averages
Two client-side analytics functions returned wrong numbers with no error:
- createHistogramData rounded each score to 2 decimals before computing its bin
index, while bin edges were not rounded, so values were counted in the wrong
bucket (e.g. a score of 0.857 in the "[0.86, 1]" bucket) and narrow ranges
produced degenerate labels like "[0.85, 0.85]". Bin on the raw value and round
only the display labels; the output now matches numpy.histogram exactly.
- calculateSubtotals computed subtotal/grand-total averages as an unweighted
average of per-row averages ("average of averages"), which over/understates
metrics like avg cost when groups differ in size. Weight each row's value by
its count when a count metric is present, falling back to the prior behavior
otherwise.
Adds unit tests for both.
* fix(widgets): update pivot-table expectations to the weighted averages
Fixes the two red checks on this PR.
prettier-check: one added test in score-analytics-utils.clienttest.ts wrapped a
call across lines that fits on one. Reformatted with the repo's prettier
(3.8.3); no behaviour change.
tests-web: three assertions in pivot-table-utils.servertest.ts still encoded
the average-of-averages this PR removes, so they failed against the corrected
aggregation. Each asserted an unweighted mean of per-group values, which only
equals the true overall average when every group is the same size -- the bug
itself. The fixture has counts 100/200/50, so it never was:
grand total avg_latency (120*100 + 80*200 + 140*50)/350 113.33 -> 100
grand total p95_duration (250*100 + 150*200 + 300*50)/350 233.33 -> 200
mixed-types avg_latency (120.5*100 + 80.2*200)/300 100.35 -> 93.6333
production avg_latency (120*100 + 80*200)/300 100 -> 93.3333
Verified by running transformToPivotTable over the same fixtures rather than
by arithmetic alone; it returns 100, 200, 93.6333333333 and 93.3333333333.
Percentiles cannot be recombined exactly from per-group percentiles, so that
one stays an approximation -- but weighting by count is strictly closer than
an unweighted mean, and the comment now says so instead of claiming the old
behaviour was correct.
* fix(widgets): weight each average by its own count column
findWeightMetric picked the first count-type metric in the widget and used
it to weight every average and percentile. A widget can hold several count
columns on different measures (count_traces, count_observations), so a
subtotal could change with nothing but the order of its metrics.
Each average is now weighted by its own count_<measure>, then by the row
count (count_count), then by the only count column present. When several
unrelated count columns leave no safe choice, the unweighted mean is used
rather than a guess.
Replaces the duplicate weighting test with one that pins the rule in both
metric orders and in the ambiguous case.
---------
Co-authored-by: Nimar <l.nimar.b@gmail.com>
* chore(deps): bump pnpm to 12.6.0, Next.js to 16.3.6 and Turbo to 2.11.3 (#17847)
* chore(deps): bump pnpm to 12.6.0, Next.js to 16.3.6 and Turbo to 2.11.3
* limit max cache size
* ci: Archive Storybook deployment uploads (#17849)
* test(worker): decouple buffered-uploader part-copy test from Buffer.poolSize (#17812)
The "non-final parts are their own allocation" test asserted
`parts[0].data.buffer.byteLength === partSizeBytes` as a proxy for "copied,
not a subarray view". That proxy only held while an 8 KiB `Buffer.from` copy
got a dedicated ArrayBuffer, i.e. while 8192 was above Node's buffer-pool
half-threshold (poolSize 8192 -> 4096).
Node v24.18.0 raised the default `Buffer.poolSize` from 8 KiB to 64 KiB
(nodejs/node#63597). An 8 KiB copy is now served from the shared 64 KiB pool,
so `.buffer.byteLength` is 65536 and the assertion fails with
`expected 65536 to be 8192` — even though the code under test is unchanged and
still copies correctly. The daily full-suite CI (Node 24.20.0) surfaced this;
it is a Node runtime change, unrelated to anything the suite talks to.
Assert the property behaviorally instead: feed a Buffer chunk, overwrite the
source after upload, and require the non-final parts to be unchanged. That
proves the parts are independent copies regardless of poolSize, and still
fails if a part is ever returned as a zero-copy view into the source.
Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
* refactor(web): Create design-system HorizontalBarChart (#17848)
* refactor(web): Create design-system HorizontalBarChart
* Address PR comments and fix CI issues
* fix(billing): clear a pending ClickHouse Billing scheduled change before setting a new one (#17811)
* fix(billing): clear a pending CHB scheduled change before setting a new one
ClickHouse Billing rejects PUT attachedplan/scheduled while a scheduled
change is already pending, so a plan change, a scheduled cancellation, or
an immediate cancel would error whenever the organization already had a
pending scheduled action (e.g. a scheduled downgrade).
Mirror the Stripe path's release-then-write: read the attached plan and,
when a change is pending, DELETE it (via the client's existing
clearScheduledChange) before scheduling the new one. The read gates the
DELETE so the common no-pending path never issues one, and the clear
carries its own idempotency key. Wired into all three setScheduledChange
call sites: changePlan, setCancellation, and cancelImmediatelyAndInvoice.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
* cleanup
---------
Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
* feat(ai-gateway): relay Anthropic Messages with usage telemetry (#17781)
* feat(ai-gateway): capture Anthropic Messages content in full mode (#17854)
* chore(redis): expire failed export jobs by age instead of count cap (#17827)
* chore(redis): expire failed export jobs by age instead of count cap
Switch removeOnFail on the batch-export and blob-storage-integration
queues to the age/count object form so terminally-failed jobs self-prune
on every settle instead of pinning the failed set indefinitely.
A bare count cap only trims once exceeded, which never happens at current
volumes, so a single terminal failure lingered forever. These queues lose
nothing by dropping old failures: batch export records status=FAILED on
the Postgres row, the blob scheduler retries on the next cron tick, and
neither queue feeds the dead-letter retry queue.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
* fix(redis): keep processing queue drop-on-fail; update options test
Revert the blob-storage processing queue back to removeOnFail: true. Its
jobs are deduplicated by a stable projectId+lastSyncAt jobId that does not
advance on failure, so a retained failed job would block re-queuing of the
same project until it expired. Immediate drop (plus the existing failed-job
cleaner) is deliberate there and must stay.
Update bullmqVersionCheckOptions to assert the batch-export queue's new
removeOnFail object form.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
* perf(scores): add selective-seek path for scores dedup reads (#17842)
* perf(scores): add selective-seek path for scores dedup reads
Scores list/count reads dedup a ReplacingMergeTree without FINAL by
scanning every version in project scope and reconstructing the latest per
key. For highly selective filters (single trace_id/observation_id/id, or a
name) this reads the whole project before discarding almost everything.
Add a seek phase that first collects matching dedup keys via the bloom /
primary indexes, then reconstructs and dedups only those keys via a
group-key tuple IN. Falls back to the current single-pass path when no
index-eligible (=/IN on id/trace_id/observation_id/name) conjunct is
present. Pure performance change: identical result rows, still
FINAL-equivalent (seek is a superset collection; the predicate is
re-applied post-dedup in the outer WHERE).
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
* test(scores): tighten seek-eligibility tests, trim golden snapshot matrix
- assert = on name in the eligible-= test (title previously untested)
- replace dangling R2/R3/R4 requirement labels with descriptive text
- snapshot one eligible + one ineligible SQL shape instead of all 12;
per-filter routing stays asserted structurally, eligibility is unit-tested
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
* perf(scores): extend seek eligibility to newly-indexed bloom columns
session_id, dataset_run_id, evaluator_id, evaluation_rule_id gained
bloom_filter skip indexes; a =/IN predicate on them is now index-prunable,
so add them as seek drivers. created_at (minmax, range-only) is excluded.
Golden fixture DDL updated to carry the current index set.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
* feat(billing): show only Total in invoice history for ClickHouse Billing orgs (#17851)
feat(billing): show only the Total column in invoice history for ClickHouse Billing orgs
ClickHouse Billing reports a single total per invoice, so the Subscription,
Usage, Discounts and Tax columns always rendered $0.00. Hide them for orgs
billed through ClickHouse Billing; Stripe orgs keep the full breakdown.
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
* refactor(web): Migrate sso settings table to design system (#17863)
* chore: release v4.44.0
* fix(web): use tuple key for confusion matrix lookup to avoid delimiter collisions (#17196)
* fix(web): use tuple key for confusion matrix lookup to avoid category delimiter collisions
Categories containing the '-' delimiter (e.g. 'a-b' vs 'a' + 'b-c') produced
identical dataMap keys, causing cells to show the wrong count in the score
comparison confusion matrix.
Key the lookup map on JSON.stringify([row_category, col_category]) instead of
string concatenation, and add a regression test.
* fix(web): avoid key collisions in score comparison confusion matrix (#17154)
* chore: release v4.31.0
* feat(preview): alert when a labeled preview is not serving (#17136)
* feat(preview): alert when a labeled preview is not serving
Argo CD notifications cover a preview whose sync failed, but they cannot
see a preview that exists and returns 503: a Deployment scaled to zero is
Healthy to Argo, and /spec/replicas is in the ApplicationSet's
ignoreDifferences for the downscaler. Until now the only detector was
someone opening the URL.
Poll /api/public/health on every open labeled PR's preview host every two
hours and post to Slack when one is not serving. Probing at 07:00-17:00
UTC keeps every run inside 08:00-20:00 Europe/Berlin whichever side of
DST we are on, well within the window where previews are up at all, so a
sleeping preview is never mistaken for a broken one.
Two deliberate quiet cases: a 404 is the shared ALB's wildcard catch-all,
meaning the PR is labeled but nothing is deployed (author off the deploy
allowlist, or a teardown in flight), and a single failure is re-probed
after 30s so a rollout in progress does not cry wolf.
* fix(preview): report one status code and re-check 404 after the retry
curl already prints 000 when it cannot reach the host at all, so the
`|| echo 000` fallback produced "HTTP 000000" for every timeout, DNS
failure and refused connection.
Move the 404 exemption after the re-probe as well. A teardown that
completed during the 30s wait previously read as unhealthy and alerted,
which is the noise the exemption exists to prevent. A first-probe 404
now also skips the wait, since there is nothing to roll out.
* feat(preview): post health alerts to a dedicated channel, bounded at fleet scale
Route the alert to #lf-preview-alerts through an incoming webhook rather
than a bot token: the channel is dedicated, so it does not compete with
CI failures, and a webhook needs no app scopes or channel invite. No
Slack credential existed to reuse in either the repo secrets or the
preview account's Secrets Manager.
Keep the alert volume set by the schedule rather than the fleet size,
which matters at 20-50 concurrent previews:
- Still exactly one message per run, listing every offender, capped at
ten names plus a "+N more" count so a broken ALB cannot paste fifty
hostnames into the channel.
- The 30s re-probe wait is now shared across all suspects instead of paid
per preview. Fifty previews with fifteen broken costs one wait, not
fifteen; measured 45s end to end against the live fleet of eighteen.
- Unhealthy entries carry no spaces, so the count and the truncation
cannot miscount them.
* chore(preview): name the workflow Preview deployment health check
* fix(datasets): read v4 dataset metrics when preview is enabled (#17171)
* fix(datasets): read v4 dataset metrics when preview is enabled
Cloud dual-write still serves the v4 experience via the session preview
flag, so dataset run count and last-run time must follow that flag rather
than events_only write mode.
Co-authored-by: Tobias Wochinger <wochinge@users.noreply.github.com>
* test(datasets): keep events-only suite on its write-mode override
The production fix is the preview-flag gate. The events-only test file
does not need to stop forcing write mode.
Co-authored-by: Tobias Wochinger <wochinge@users.noreply.github.com>
---------
Co-authored-by: Cursor Agent <cursoragent@cursor.com>
Co-authored-by: Tobias Wochinger <wochinge@users.noreply.github.com>
* chore(deps): bump undici to 7.29.1 (#17159)
* chore(deps): bump undici to 7.29.1
* ci: trigger checks
---------
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: langfuse-bot <accounts+githubbot@langfuse.com>
Co-authored-by: Nimar <l.nimar.b@gmail.com>
* feat(worker): emit export data-freshness lag distribution (#17177)
* feat(worker): emit export data-freshness lag distribution
Record runStart minus the export watermark at each scheduled blob,
PostHog, and Mixpanel run so P95 lag can be baselined before an SLO.
Failing runs use the unchanged lastSyncAt so a stall shows as rising lag.
Co-authored-by: Niklas Semmler <niklassemmler@users.noreply.github.com>
* fix(worker): do not mark a successful export as stale on catch-up enqueue failure
Record blob freshness success once lastSyncAt advances, so a later Redis
error while re-queuing the next chunk cannot emit a failure against the
pre-run watermark. Also emit Mixpanel failure samples when decrypt throws
before the export try.
Co-authored-by: Niklas Semmler <niklassemmler@users.noreply.github.com>
---------
Co-authored-by: Cursor Agent <cursoragent@cursor.com>
Co-authored-by: Niklas Semmler <niklassemmler@users.noreply.github.com>
* chore(agents): mark Cursor PRs with the cursor label (#17164)
* chore(agents): mark Cursor PRs with the cursor label
Require Cursor agents to apply the existing-style agent tag on every PR they
open, and auto-apply it from CI when the author, branch, or PR body is a
Cursor Cloud session.
Co-authored-by: Nikita Kabardin <nikita@kabardin.com>
* fix(ci): tolerate concurrent cursor label creation
If two Cursor PRs race while the label is missing, treat the second
create as already-exists and still apply the label.
Co-authored-by: Nikita Kabardin <nikita@kabar…
The
Buffer.poolSizedefault of 8 KiB has been unchanged since May 2015. Two issues with it today:The 4 KiB cliff. The pool check is
size < (Buffer.poolSize >>> 1), so with the 8 KiB default the threshold is 4 KiB and the strict inequality means a 4 KiB allocation itself bypasses the pool. The current default helps allocations from 1 B to 3999 B and abruptly stops at the page-aligned and HTTP-frame-sized boundary where many real allocations land.Stale in 2025. Predates HTTP/2 (16 KiB-1 MiB frame sizes), modern stream chunk sizes, and ~10× growth in typical RAM. Many
Buffer.allocUnsafecalls in core (fs.readFileSyncfor non-utf8 reads, HTTP parser, stream chunkers) sit in the 4-64 KiB range and miss the pool.This PR raises the default to 64 KiB, extending pool coverage to allocations up to ~32 KiB.
Evidence
Benchmark setup: 8 Worker threads in one process, each looping
fs.readFileSync(file)on files of various sizes, measuring throughput. Linux 6.8, glibc 2.39, i7-7700, Node main (built locally).Wins where it matters (4-32 KiB), no regressions at small or large sizes.
Why workers benefit more than single-threaded
Buffer.allocUnsafe(size)forsize ≥ Buffer.poolSize/2falls through to fresh V8 ArrayBuffer allocations, which land on glibcmalloc. When multiple Worker threads do this concurrently they contend on the per-mm_structmmap_lockwrite lock (every arena growth takes it). Confirmed bybpftrace: workers wait ~17× longer permmap_lockacquisition than equivalent child processes on the same workload, with cumulative wait dropping ~2.5× when the pool covers the allocation size. Full investigation: https://github.com/platformatic/node-worker-mmap-lock-contention.Single-threaded apps benefit too, just less dramatically — fewer allocator round-trips for medium-sized buffers.
Cost
+56 KiB RSS per realm at startup (one 64 KiB pool per realm; main thread + each Worker thread). On a typical app with 1 main + 4 Workers that's +280 KiB, trivial on modern hardware. The pool occupies RSS for the lifetime of any sliced Buffer that's still referenced, so peak RSS may grow modestly in apps that hold many small Buffers; same shape as today, just larger granularity.
Why 64 KiB and not larger
Tested 32 / 64 / 128 / 256 KiB; 64 KiB is the smallest pool that captures the 4-16 KiB hot zone where the current default fails. 128/256 KiB give additional wins on 16-64 KiB allocations (+64% at 16 KiB with a 256 KiB pool) but the marginal RSS cost is harder to justify as a default. Easy follow-up if there's appetite.
Pool refills at 64 KiB stay under glibc's
M_MMAP_THRESHOLD(128 KiB default), so each refill uses the heap rather than triggering a freshmmap— that boundary is part of why 64 KiB is the right ceiling for a default.Notes
doc/api/buffer.md(default value + the "4 KiB" example reference).Buffer.poolSizesetter machinery is unchanged.cc @nodejs/buffer @nodejs/performance