From 75c198240026aaee2721135cca6df3e9d2df3de1 Mon Sep 17 00:00:00 2001 From: Filip Skokan Date: Tue, 26 May 2026 22:36:56 +0200 Subject: [PATCH 1/5] test: deflake test-webcrypto-crypto-job-mode Signed-off-by: Filip Skokan PR-URL: https://github.com/nodejs/node/pull/63543 Reviewed-By: Antoine du Hamel Reviewed-By: Luigi Pinca --- test/parallel/test-webcrypto-crypto-job-mode.js | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/test/parallel/test-webcrypto-crypto-job-mode.js b/test/parallel/test-webcrypto-crypto-job-mode.js index 7fd50de44f39b6..327c6a6f154cc4 100644 --- a/test/parallel/test-webcrypto-crypto-job-mode.js +++ b/test/parallel/test-webcrypto-crypto-job-mode.js @@ -163,7 +163,7 @@ async function withObjectPrototypeSetters(names, fn) { { name: 'AES-CBC', iv }, key, Buffer.alloc(16))); - ciphertext[ciphertext.length - 1] ^= 0xff; + ciphertext[0] ^= 0xff; await assert.rejects( subtle.decrypt({ name: 'AES-CBC', iv }, key, ciphertext), From 2d26bf48979c4b41c14d9b71a6740ccb68c8090e Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Tue, 26 May 2026 23:00:06 +0000 Subject: [PATCH 2/5] tools: bump brace-expansion from 5.0.5 to 5.0.6 in /tools/eslint Bumps [brace-expansion](https://github.com/juliangruber/brace-expansion) from 5.0.5 to 5.0.6. - [Release notes](https://github.com/juliangruber/brace-expansion/releases) - [Commits](https://github.com/juliangruber/brace-expansion/compare/v5.0.5...v5.0.6) --- updated-dependencies: - dependency-name: brace-expansion dependency-version: 5.0.6 dependency-type: indirect ... Signed-off-by: dependabot[bot] PR-URL: https://github.com/nodejs/node/pull/63415 Reviewed-By: Antoine du Hamel Reviewed-By: Colin Ihrig --- tools/eslint/package-lock.json | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/tools/eslint/package-lock.json b/tools/eslint/package-lock.json index 5855e2e04ac1f5..6ef33489e6b899 100644 --- a/tools/eslint/package-lock.json +++ b/tools/eslint/package-lock.json @@ -726,9 +726,9 @@ } }, "node_modules/brace-expansion": { - "version": "5.0.5", - "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.5.tgz", - "integrity": "sha512-VZznLgtwhn+Mact9tfiwx64fA9erHH/MCXEUfB/0bX/6Fz6ny5EGTXYltMocqg4xFAQZtnO3DHWWXi8RiuN7cQ==", + "version": "5.0.6", + "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.6.tgz", + "integrity": "sha512-kLpxurY4Z4r9sgMsyG0Z9uzsBlgiU/EFKhj/h91/8yHu0edo7XuixOIH3VcJ8kkxs6/jPzoI6U9Vj3WqbMQ94g==", "license": "MIT", "dependencies": { "balanced-match": "^4.0.2" From 424b9c339a8ea200d8de56c44a90cb7a08d4843d Mon Sep 17 00:00:00 2001 From: Kit Dallege Date: Wed, 27 May 2026 01:32:14 +0200 Subject: [PATCH 3/5] doc: fix URL postMessage example in worker_threads The example claimed that posting a URL object via MessageChannel would print an empty object, but since v21.0.0 (commit d920b7c94b8) it throws a DataCloneError. Update the example and surrounding text to reflect the current behavior. Fixes: https://github.com/nodejs/node/issues/60504 Co-Authored-By: Claude Opus 4.6 Signed-off-by: Kit Dallege PR-URL: https://github.com/nodejs/node/pull/62203 Fixes: https://github.com/nodejs/node/issues/60504 Reviewed-By: Luigi Pinca --- doc/api/worker_threads.md | 9 +++------ 1 file changed, 3 insertions(+), 6 deletions(-) diff --git a/doc/api/worker_threads.md b/doc/api/worker_threads.md index 8f4b152bc26a68..720c5640d2065a 100644 --- a/doc/api/worker_threads.md +++ b/doc/api/worker_threads.md @@ -1369,17 +1369,14 @@ port2.postMessage(new Foo()); // Prints: { c: 3 } ``` -This limitation extends to many built-in objects, such as the global `URL` -object: +Some built-in objects cannot be cloned at all. For example, posting a +`URL` object throws a `DataCloneError`: ```js const { port1, port2 } = new MessageChannel(); -port1.onmessage = ({ data }) => console.log(data); - port2.postMessage(new URL('https://example.org')); - -// Prints: { } +// Throws DataCloneError: Cannot clone object of unsupported type. ``` ### `port.hasRef()` From cd58afc73207f35eda497b16f82eb3d04c84efc2 Mon Sep 17 00:00:00 2001 From: Rafael Gonzaga Date: Tue, 26 May 2026 20:32:24 -0300 Subject: [PATCH 4/5] doc: explicitly ask for reproducible in JS MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Signed-off-by: RafaelGSS PR-URL: https://github.com/nodejs/node/pull/63479 Reviewed-By: Marco Ippolito Reviewed-By: Antoine du Hamel Reviewed-By: Richard Lau Reviewed-By: Yagiz Nizipli Reviewed-By: Ulises Gascón Reviewed-By: Matteo Collina Reviewed-By: James M Snell --- SECURITY.md | 1 + 1 file changed, 1 insertion(+) diff --git a/SECURITY.md b/SECURITY.md index 0e88d7b50702fa..ef2509102fe6a3 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -85,6 +85,7 @@ When reporting security vulnerabilities, reporters must adhere to the following 4. **Report Quality** * Provide clear, detailed steps to reproduce the vulnerability. + * Include reproducible code written in JavaScript. * Include only the minimum proof of concept required to demonstrate the issue. * Remove any malicious payloads or components that could cause harm. From 13feb34fb16fa741d818082523c2584612f89cb2 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Guilherme=20Ara=C3=BAjo?= Date: Tue, 26 May 2026 20:57:44 -0300 Subject: [PATCH 5/5] doc: generate llms.txt MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Signed-off-by: Guilherme Araújo PR-URL: https://github.com/nodejs/node/pull/62027 Reviewed-By: Aviv Keller --- Makefile | 18 +++++++++++++++++- 1 file changed, 17 insertions(+), 1 deletion(-) diff --git a/Makefile b/Makefile index 1e1264619d24bb..961682e607272c 100644 --- a/Makefile +++ b/Makefile @@ -856,7 +856,7 @@ VERSION=v$(RAWVER) .PHONY: doc-only .NOTPARALLEL: doc-only -doc-only: $(apidoc_dirs) $(apidocs_html) $(apidocs_json) out/doc/api/all.html out/doc/api/all.json out/doc/apilinks.json ## Builds the docs with the local or the global Node.js binary. +doc-only: $(apidoc_dirs) $(apidocs_html) $(apidocs_json) out/doc/api/all.html out/doc/api/all.json out/doc/llms.txt out/doc/apilinks.json ## Builds the docs with the local or the global Node.js binary. .PHONY: doc doc: $(NODE_EXE) doc-only ## Build Node.js, and then build the documentation with the new binary. @@ -901,6 +901,22 @@ $(apidocs_html) $(apidocs_json) out/doc/api/all.html out/doc/api/all.json &: $(a fi endif +out/doc/llms.txt: $(apidoc_sources) tools/doc/node_modules | out/doc + @if [ "$(shell $(node_use_openssl_and_icu))" != "true" ]; then \ + echo "Skipping $@ (no crypto and/or no ICU)"; \ + else \ + $(call available-node, \ + $(DOC_KIT) generate \ + -t llms-txt \ + -i doc/api/*.md \ + --ignore $(skip_apidoc_files) \ + -o $(@D) \ + -c ./CHANGELOG.md \ + -v $(VERSION) \ + --type-map doc/type-map.json \ + ) \ + fi + out/doc/apilinks.json: $(wildcard lib/*.js) tools/doc/node_modules | out/doc @if [ "$(shell $(node_use_openssl_and_icu))" != "true" ]; then \ echo "Skipping $@ (no crypto and/or no ICU)"; \