Skip to content

deps: upgrade npm to 11.19.0 - #64883

Closed
npm-cli-bot wants to merge 1069 commits into
nodejs:mainfrom
npm:npm-v11.19.0-26
Closed

deps: upgrade npm to 11.19.0#64883
npm-cli-bot wants to merge 1069 commits into
nodejs:mainfrom
npm:npm-v11.19.0-26

Conversation

@npm-cli-bot

@npm-cli-botnpm-cli-bot commented Jul 31, 2026

Copy link
Copy Markdown
Contributor

11.19.0 (2026-07-28)

Features

Bug Fixes

Dependencies

trivikrand others added 30 commits July 3, 2026 16:03
@trivikr@richardlau
test: use one-off agent in http consumed timeout test
24e3209
Disable connection pooling for the client request so server.close()
does not wait on an idle keep-alive socket before retrying the test.
This keeps the test focused on request timeout behavior instead of
HTTP keep-alive teardown timing.
Signed-off-by: Kamat, Trivikram <16024985+trivikr@users.noreply.github.com>
PR-URL: nodejs#64052
Refs: https://github.com/nodejs/reliability/issues?q=%22test-http-server-consumed-timeout%22
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Filip Skokan <panva.ip@gmail.com>
Reviewed-By: Gürgün Dayıoğlu <hey@gurgun.day>
@Rawal27@richardlau
doc: fix callback example import in fs docs
60abc44
Signed-off-by: Rawal27 <obviouslykamal@gmail.com>
PR-URL: nodejs#63912
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Trivikram Kamat <trivikr.dev@gmail.com>
@trivikr@richardlau
test: mark hr-time WPT flaky on macos15-x64
bf080c7
The basic.any.js test compares elapsed performance.now() with elapsed
Date.now(). On macos15-x64 CI, Date.now() can shift relative to the
monotonic clock and exceed the test's 30 ms tolerance.
Convert the status file to .cjs so the flaky expectation is scoped to
macOS 15 on x64.
Signed-off-by: Kamat, Trivikram <16024985+trivikr@users.noreply.github.com>
PR-URL: nodejs#64054
Refs: https://github.com/nodejs/reliability/issues?q=%22wpt%2Ftest-hr-time%22
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
Reviewed-By: Filip Skokan <panva.ip@gmail.com>
Reviewed-By: Daijiro Wachi <daijiro.wachi@gmail.com>
Reviewed-By: Jason Zhang <xzha4350@gmail.com>
@richardlau
doc: update toolchain for official AIX releases
d5f8260
Starting with Node.js 26.0.0, official binaries for AIX are built with
Clang 20.1.
Signed-off-by: Richard Lau <richard.lau@ibm.com>
PR-URL: nodejs#64068
Reviewed-By: Chengzhong Wu <legendecas@gmail.com>
Reviewed-By: Beth Griggs <bethanyngriggs@gmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Stewart X Addison <sxa@redhat.com>
@parkhojeong@richardlau
test: fix typo from funciton to function
4c91090
Signed-off-by: parkhojeong <parkhj062@gmail.com>
PR-URL: nodejs#63403
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Deokjin Kim <deokjin81.kim@gmail.com>
@parkhojeong@richardlau
test: fix typo from overriden to overridden
1b4f213
Signed-off-by: parkhojeong <parkhj062@gmail.com>
PR-URL: nodejs#63403
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Deokjin Kim <deokjin81.kim@gmail.com>
@pabloerhard@richardlau
perf_hooks: sample delay per event loop iteration
39e0c14
Add a samplePerIteration option to monitorEventLoopDelay that records
event loop delay from libuv event loop iterations instead of the timer
interval sampler. The default remains interval-based; existing uses of
monitorEventLoopDelay() keep behaving the same unless the
samplePerIteration option is passed through.
Signed-off-by: Pablo Erhard <pablo.erhardhernandez@datadoghq.com>
PR-URL: nodejs#62935
Reviewed-By: Bryan English <bryan@bryanenglish.com>
Reviewed-By: Ruben Bridgewater <ruben@bridgewater.de>
Reviewed-By: James M Snell <jasnell@gmail.com>
@trivikr@richardlau
test: keep finalization close fixture ref alive
570952d
The close fixture expects the registered object to still be reachable
when the process emits exit. Keep a strong reference outside setup() so
the assertion does not depend on platform-specific GC timing.
Signed-off-by: Kamat, Trivikram <16024985+trivikr@users.noreply.github.com>
Assisted-by: openai:gpt-5.5
PR-URL: nodejs#64085
Refs: https://github.com/nodejs/reliability/issues?q=%22test-process-finalization%22
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Gürgün Dayıoğlu <hey@gurgun.day>
Reviewed-By: Stefan Stojanovic <stefan.stojanovic@janeasystems.com>
@tie@richardlau
build: support setting an emulator from configure script
66f6ac0
V8’s JIT infrastructure requires binaries such as mksnapshot to be run
during the build. However, these binaries must have the same bit-width
as the host platform (e.g. a x86_64 build platform targeting ARMv6 needs
to produce a 32-bit binary).
To work around this issue, allow building the binaries for the host
platform and running them on the build platform with an emulator.
Based on Buildroot’s nodejs-src 0001-add-qemu-wrapper-support.patch.
https://gitlab.com/buildroot.org/buildroot/-/blob/c1d5eada4d4db9eeaa1c44dd1dea95a67c8a70ca/package/nodejs/nodejs-src/0001-add-qemu-wrapper-support.patch
PR-URL: nodejs#53899
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
Reviewed-By: Aviv Keller <me@aviv.sh>
@tniessen@richardlau
crypto: fix large DH generator validation
32bb554
Unfortunately, `std::optional<>` implements `operator<` in such a way
that this check will fail for very large generators. Since `bn_g` is
unsigned, if its value does not fit into a single word, we can be
certain that it is at least 2. By only checking the value if it does
indeed fit into a word, the check correctly ignores very large
generators.
Signed-off-by: Tobias Nießen <tniessen@tnie.de>
PR-URL: nodejs#64092
Reviewed-By: Filip Skokan <panva.ip@gmail.com>
Reviewed-By: Anna Henningsen <anna@addaleax.net>
@tniessen@richardlau
tls: handle large RSA exponents in X.509 cert
3bdd7e2
If the exponent does not fit into a single word, previous versions of
Node.js would report an incorrect value or, recently, return `null`.
Change `GetExponentString()` to handle arbitrarily large RSA public
exponents properly.
Signed-off-by: Tobias Nießen <tniessen@tnie.de>
PR-URL: nodejs#64093
Refs: nodejs#63895
Reviewed-By: Filip Skokan <panva.ip@gmail.com>
Reviewed-By: Anna Henningsen <anna@addaleax.net>
@tniessen@richardlau
src: avoid redundant call to std::get_if<>()
12edf1d
Signed-off-by: Tobias Nießen <tniessen@tnie.de>
PR-URL: nodejs#64094
Reviewed-By: Juan José Arboleda <soyjuanarbol@gmail.com>
Reviewed-By: Filip Skokan <panva.ip@gmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com>
Reviewed-By: Anna Henningsen <anna@addaleax.net>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Edy Silva <edigleyssonsilva@gmail.com>
@aduh95@richardlau
tools: update libffi updater script
7a17c50
Signed-off-by: Antoine du Hamel <duhamelantoine1995@gmail.com>
PR-URL: nodejs#64046
Reviewed-By: Paolo Insogna <paolo@cowtech.it>
Reviewed-By: René <contact.9a5d6388@renegade334.me.uk>
@aduh95@richardlau
tools: update build-shared/action.yml to a reusable workflow
6d11a71
Signed-off-by: Antoine du Hamel <duhamelantoine1995@gmail.com>
PR-URL: nodejs#64059
Reviewed-By: Jithil P Ponnan <jithil@outlook.com>
Reviewed-By: Filip Skokan <panva.ip@gmail.com>
@bakkot@richardlau
deps: V8: cherry-pick 1a391f98cc7a
feefd17
Original commit message:
[api] Deprecate kPromiseRejectAfterResolved and kPromiseResolveAfterResolved
These events will be removed soon.
Bug: 42213031
Change-Id: Ie70474ff33c40c7d9cb0c2d0fbe6b75da3c53a22
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7774767
Commit-Queue: Kevin Gibbons <bakkot@gmail.com>
Reviewed-by: Olivier Flückiger <olivf@chromium.org>
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/main@{#107395}
Refs: v8/v8@1a391f9
PR-URL: nodejs#64101
Reviewed-By: Michaël Zasso <targos@protonmail.com>
Reviewed-By: Richard Lau <richard.lau@ibm.com>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Marco Ippolito <marcoippolito54@gmail.com>
@bakkot@richardlau
deps: V8: cherry-pick 0cc9eb22c0b0
a640543
Original commit message:
[api] Remove PromiseResolveAfterResolved and PromiseRejectAfterResolved
These were previously deprecated in https://crrev.com/c/7774767
Bug: 42213031
Change-Id: I07b802b743bf052611f30a61c1132231df22f0bd
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7897881
Commit-Queue: Olivier Flückiger <olivf@chromium.org>
Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Reviewed-by: Olivier Flückiger <olivf@chromium.org>
Cr-Commit-Position: refs/heads/main@{#108040}
Refs: v8/v8@0cc9eb2
PR-URL: nodejs#64101
Reviewed-By: Michaël Zasso <targos@protonmail.com>
Reviewed-By: Richard Lau <richard.lau@ibm.com>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Marco Ippolito <marcoippolito54@gmail.com>
@bakkot@richardlau
deps: V8: backport da20a197a7f9
879fdc4
Original commit message:
[builtins] Make Promise resolvers not keep resolved Promises alive
Currently a Promise's resolve/reject functions unconditionally hold the
Promise, plus a separate bit to track whether the Promise has been
resolved. Instead, hold a single field with Promise|Undefined.
This allows GC'ing a resolved Promise even if its resolvers are still
alive.
R=olivf@chromium.org
Fixed: 42213031
Change-Id: Ice645dbabb79e63dfcac8ae843cad95439d7a1f1
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7646250
Reviewed-by: Darius Mercadier <dmercadier@chromium.org>
Commit-Queue: Kevin Gibbons <bakkot@gmail.com>
Reviewed-by: Olivier Flückiger <olivf@chromium.org>
Cr-Commit-Position: refs/heads/main@{#108183}
Refs: v8/v8@da20a19
Co-authored-by: Kevin Gibbons <bakkot@gmail.com>
PR-URL: nodejs#64101
Reviewed-By: Michaël Zasso <targos@protonmail.com>
Reviewed-By: Richard Lau <richard.lau@ibm.com>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Marco Ippolito <marcoippolito54@gmail.com>
@Qard@richardlau
diagnostics_channel: return original thenable
dc052c0
This makes tracePromise return the original thenable to allow custom
thenable types to retain their methods rather than producing the
chained result type.
Signed-off-by: Stephen Belanger <admin@stephenbelanger.com>
PR-URL: nodejs#62407
Reviewed-By: René <contact.9a5d6388@renegade334.me.uk>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Gerhard Stöbich <deb2001-github@yahoo.de>
@aduh95@richardlau
doc: announce upcoming end of tier 2 support for macOS x64
7a16ccc
Signed-off-by: Antoine du Hamel <duhamelantoine1995@gmail.com>
PR-URL: nodejs#63931
Reviewed-By: Richard Lau <richard.lau@ibm.com>
Reviewed-By: Michaël Zasso <targos@protonmail.com>
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
Reviewed-By: Daijiro Wachi <daijiro.wachi@gmail.com>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: René <contact.9a5d6388@renegade334.me.uk>
Reviewed-By: Rafael Gonzaga <rafael.nunu@hotmail.com>
Reviewed-By: Stewart X Addison <sxa@redhat.com>
@Renegade334@richardlau
deps: c-ares: cherry-pick 8ba37af8e3fb
c7e57f5
Original commit message:
Fixesnodejs#1056
The commit
c-ares/c-ares@1d1b3d4
refactored the function to use wide strings, but didn't touch this
check. Because an empty wide string would now be size 2 and not 1, the
empty string would go on and cause the DNS domain list to be replaced
with nothing.
Signed-off-by: @dankmeme01
Refs: c-ares/c-ares@8ba37af
PR-URL: nodejs#64110Fixes: nodejs#62347
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Tim Perry <pimterry@gmail.com>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
@efekrskl@richardlau
esm: add --experimental-import-text flag
b373202
Signed-off-by: Efe Karasakal <hi@efe.dev>
PR-URL: nodejs#62300
Reviewed-By: Aviv Keller <me@aviv.sh>
Reviewed-By: Ilyas Shabi <ilyasshabi94@gmail.com>
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
@richardlau
doc: add missing option to man page
189e830
Add missing `--experimental-import-text` option to `doc/node.1`.
Signed-off-by: Richard Lau <richard.lau@ibm.com>
PR-URL: nodejs#64156
Refs: nodejs#62300
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Chengzhong Wu <legendecas@gmail.com>
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
@joyeecheung@richardlau
build: pin envinfo versions in github actions
f4e7bf1
Currently they all run `npx envinfo` without pinning the version.
This can be a supply-chain risk.
Signed-off-by: Joyee Cheung <joyeec9h3@gmail.com>
PR-URL: nodejs#64117
Reviewed-By: Rafael Gonzaga <rafael.nunu@hotmail.com>
Reviewed-By: Michaël Zasso <targos@protonmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Marco Ippolito <marcoippolito54@gmail.com>
Reviewed-By: Filip Skokan <panva.ip@gmail.com>
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
Reviewed-By: Gürgün Dayıoğlu <hey@gurgun.day>
@trivikr@richardlau
vfs: read RealFSProvider files from open fd
bbdd764
Read RealFileHandle contents through the open file descriptor instead
of reopening the original real path. This keeps already-open VFS file
descriptors usable after the backing file is renamed.
Use positioned reads so readFileSync() and readFile() preserve the
handle's current offset.
Signed-off-by: Kamat, Trivikram <16024985+trivikr@users.noreply.github.com>
Assisted-by: openai:gpt-5.5
PR-URL: nodejs#64104Fixes: nodejs#64103
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
@panva@richardlau
typings: add typing for crypto
58d9685
Signed-off-by: Filip Skokan <panva.ip@gmail.com>
PR-URL: nodejs#64122
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com>
@panva@richardlau
zlib: reject trailing gzip members in web streams
5933516
Pass the existing rejectGarbageAfterEnd option through to the native
zlib context and skip gunzip's concatenated-member loop when it is set.
This lets DecompressionStream reject a second gzip member as trailing
input while preserving default zlib gunzip behavior.
Also make the sync zlib path honor rejectGarbageAfterEnd when native
decompression leaves unused input, covering Brotli as well.
Fixes: nodejs#58247
Signed-off-by: Filip Skokan <panva.ip@gmail.com>
PR-URL: nodejs#64023Fixes: nodejs#58247
Reviewed-By: Anna Henningsen <anna@addaleax.net>
@panva@richardlau
zlib: expose rejectGarbageAfterEnd option
90007a5
Document rejectGarbageAfterEnd as a public decompression option and
validate it as a boolean.
Add coverage for stream, async convenience, and sync convenience APIs
across zlib, gzip, Brotli, and Zstd-backed decompression.
Signed-off-by: Filip Skokan <panva.ip@gmail.com>
PR-URL: nodejs#64023Fixes: nodejs#58247
Reviewed-By: Anna Henningsen <anna@addaleax.net>
@aduh95@richardlau
doc: fix broken links and duplicate stability label
85fc79d
Signed-off-by: Antoine du Hamel <duhamelantoine1995@gmail.com>
PR-URL: nodejs#64130
Reviewed-By: Jacob Smith <jacob@frende.me>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
@avivkeller@richardlau
meta: speed up stale bot
7b01040
Signed-off-by: Aviv Keller <me@aviv.sh>
PR-URL: nodejs#64075
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
Reviewed-By: Gürgün Dayıoğlu <hey@gurgun.day>
@mcollina@richardlau
doc: clarify vfs is not a sandbox
2a12664
Signed-off-by: Matteo Collina <hello@matteocollina.com>
PR-URL: nodejs#64143
Reviewed-By: René <contact.9a5d6388@renegade334.me.uk>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Tobias Nießen <tniessen@tnie.de>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Rafael Gonzaga <rafael.nunu@hotmail.com>
ljharb
ljharb previously approved these changes Jul 31, 2026
View reviewed changes
avivkeller
avivkeller previously approved these changes Jul 31, 2026
View reviewed changes
@MikeMcC399MikeMcC399 added the request-ci Add this label to start a Jenkins CI on a PR. label Aug 1, 2026
@MikeMcC399MikeMcC399 mentioned this pull request Aug 1, 2026
Merged
@github-actionsgithub-actionsBot removed the request-ci Add this label to start a Jenkins CI on a PR. label Aug 1, 2026
@nodejs-github-bot

nodejs-github-bot commented Aug 1, 2026

Copy link
Copy Markdown
Collaborator

CI: https://ci.nodejs.org/job/node-test-pull-request/75360/

@nodejs-github-bot

nodejs-github-bot commented Aug 1, 2026

Copy link
Copy Markdown
Collaborator

CI: https://ci.nodejs.org/job/node-test-pull-request/75368/

lpinca
lpinca previously approved these changes Aug 1, 2026
View reviewed changes
@nodejs-github-bot

nodejs-github-bot commented Aug 1, 2026

Copy link
Copy Markdown
Collaborator

CI: https://ci.nodejs.org/job/node-test-pull-request/75373/

MikeMcC399
MikeMcC399 previously approved these changes Aug 1, 2026
View reviewed changes
trivikr
trivikr previously approved these changes Aug 2, 2026
View reviewed changes
@richardlaurichardlau mentioned this pull request Aug 3, 2026
Closed
@aduh95
aduh95force-pushed the v26.x-staging branch 2 times, most recently from 6396dbb to c03c909CompareAugust 4, 2026 16:41
@aduh95
aduh95 changed the base branch from v26.x-staging to mainAugust 4, 2026 19:21
@aduh95
aduh95 dismissed stale reviews from trivikr, MikeMcC399, lpinca, avivkeller, and ljharbAugust 4, 2026 19:21

The base branch was changed.

@aduh95
aduh95 requested a review from a team as a code ownerAugust 4, 2026 19:21
aduh95 pushed a commit that referenced this pull request Aug 4, 2026
@npm-cli-bot@aduh95
deps: upgrade npm to 11.19.0
c8fa0b1
PR-URL: #64883
Reviewed-By: Jordan Harband <ljharb@gmail.com>
Reviewed-By: Aviv Keller <me@aviv.sh>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Mike McCready <66998419+MikeMcC399@users.noreply.github.com>
Reviewed-By: Trivikram Kamat <trivikr.dev@gmail.com>
@aduh95

aduh95 commented Aug 4, 2026

Copy link
Copy Markdown
Contributor

Landed in c8fa0b1

@aduh95aduh95 closed this Aug 4, 2026
aduh95 pushed a commit that referenced this pull request Aug 4, 2026
@npm-cli-bot@aduh95
deps: upgrade npm to 11.19.0
95d27e2
PR-URL: #64883
Reviewed-By: Jordan Harband <ljharb@gmail.com>
Reviewed-By: Aviv Keller <me@aviv.sh>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Mike McCready <66998419+MikeMcC399@users.noreply.github.com>
Reviewed-By: Trivikram Kamat <trivikr.dev@gmail.com>
@aduh95aduh95 added author ready PRs that have at least one approval, no pending requests for changes, and a CI started. and removed v26.x Issues that can be reproduced on v26.x or PRs targeting the v26.x-staging branch. labels Aug 4, 2026
@github-actionsgithub-actionsBot mentioned this pull request Aug 4, 2026
Merged
@Renegade334Renegade334 added the dont-land-on-v22.x PRs that should not land on the v22.x-staging branch and should not be released in v22.x. label Aug 4, 2026
aduh95 pushed a commit that referenced this pull request Aug 5, 2026
@npm-cli-bot@aduh95
deps: upgrade npm to 11.19.0
718cbe9
PR-URL: #64883
Reviewed-By: Jordan Harband <ljharb@gmail.com>
Reviewed-By: Aviv Keller <me@aviv.sh>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Mike McCready <66998419+MikeMcC399@users.noreply.github.com>
Reviewed-By: Trivikram Kamat <trivikr.dev@gmail.com>
Sign up for freeto join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@ljharbljharbljharb left review comments
@lpincalpincalpinca left review comments
@trivikrtrivikrtrivikr left review comments
@avivkelleravivkelleravivkeller left review comments
@MikeMcC399MikeMcC399MikeMcC399 left review comments

Assignees

No one assigned

Labels

author readyPRs that have at least one approval, no pending requests for changes, and a CI started.dont-land-on-v22.xPRs that should not land on the v22.x-staging branch and should not be released in v22.x.needs-ciPRs that need a full CI run.npmIssues and PRs related to the npm client dependency or the npm registry.

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

20 participants

@npm-cli-bot@nodejs-github-bot@aduh95@ljharb@lpinca@trivikr@avivkeller@MikeMcC399@Renegade334@Rawal27@richardlau@parkhojeong@pabloerhard@tie@tniessen@bakkot@Qard@efekrskl@joyeecheung@panva