Node.js 24.4.0 has been released. Significant updates encompass the inclusion of outputLength support in crypto.hash for XOF functions, the introduction of watch-mode related flags in node.1, the implementation of disposable mkdtempSync in fs, the propagation of permission model flags during spawn, the support for readBigInts option at the database connection level, and the addition of the --watch-kill-signal flag in watch.

Commitments to Node.js involve the elimination of obsolete code, the incorporation of source maps and caches, the initialization of the HTTP proxy following the user module loader setup, and the deactivation of v8_enable_pointer_compression_shared_cage on non-64bit systems. Furthermore, updates have been made to sqlite, undici, googletest, minimatch, and various other dependencies.

Node.js — Node v24.4.0 (Current)

2025-07-09, Version 24.4.0 (Current), @RafaelGSS

Notable Changes

• [ 22b60e8a57] - (SEMVER-MINOR) crypto: support outputLength option in crypto.hash for XOF functions (Aditi)  #58121
• [ 80dec9849d] - (SEMVER-MINOR) doc: add all watch-mode related flags to node.1 (Dario Piotrowicz)  #58719
• [ 87f4d078b3] - (SEMVER-MINOR) fs: add disposable mkdtempSync (Kevin Gibbons)  #58516
• [ 9623c50b53] - (SEMVER-MINOR) permission: propagate permission model flags on spawn (Rafael Gonzaga)  #58853
• [ 797ec4da04] - (SEMVER-MINOR) sqlite: add support for readBigInts option in db connection level (Miguel Marcondes Filho)  #58697
• [ ed966a0215] - (SEMVER-MINOR) src,permission: add support to permission.has(addon) (Rafael Gonzaga)  #58951
• [ fe17f5d285] - (SEMVER-MINOR) watch: add --watch-kill-signal flag (Dario Piotrowicz)  #58719

Commits

• [ a118bfc536] - assert: remove dead code (Yoshiya Hinosawa)  #58760
• [ 31252b9af1] - benchmark: add source map and source map cache (Miguel Marcondes Filho)  #58125
• [ 4170359bcd] - bootstrap: initialize http proxy after user module loader setup (Joyee Cheung)  #58938
• [ c76585d10e] - build: disable v8_enable_pointer_compression_shared_cage on non-64bit (Shelley Vohr)  #58867
• [ 049c838609] - build: option to use custom inspector_protocol path (Shelley Vohr)  #58839
• [ 22b60e8a57] - (SEMVER-MINOR) crypto: support outputLength option in crypto.hash for XOF functions (Aditi)  #58121
• [ 77712ae2a1] - crypto: fix SHAKE128/256 breaking change introduced with OpenSSL 3.4 (Filip Skokan)  #58942
• [ 93e1a33b81] - crypto: fix inclusion of OPENSSL_IS_BORINGSSL define (Shelley Vohr)  #58845
• [ 573171deb0] - deps: V8: cherry-pick 0ce2edb7adfd (Levi Zim)  #58773
• [ bf66291382] - deps: V8: cherry-pick 1d7159580156 (Michaël Zasso)  #58749
• [ f735b8b8d0] - deps: update sqlite to 3.50.2 (Node.js GitHub Bot)  #58882
• [ 8e9622e494] - deps: update undici to 7.11.0 (Node.js GitHub Bot)  #58859
• [ 8741da81c7] - deps: update googletest to 35b75a2 (Node.js GitHub Bot)  #58710
• [ 028ce40e25] - deps: update minimatch to 10.0.3 (Node.js GitHub Bot)  #58712
• [ 3afb15b715] - dns: fix parse memory leaky (theanarkh)  #58973
• [ f40ac32f3e] - dns: set timeout to 1000ms when timeout < 0 (theanarkh)  #58441
• [ 921b563999] - doc: remove broken link to permission model source code (Juan José)  #58972
• [ 78628d6158] - doc: clarify details of TSC public and private meetings (James M Snell)  #58925
• [ ab834a8b94] - doc: mark stability markers consistent in globals.md (Antoine du Hamel)  #58932
• [ 8d4f6a0016] - doc: move "Core Promise APIs" to "Completed initiatives" (Antoine du Hamel)  #58934
• [ 94725fced5] - doc: fix fetch subsections in globals.md (Antoine du Hamel)  #58933
• [ a7a4870014] - doc: add missing Class: mentions (Antoine du Hamel)  #58931
• [ 98f29fa2fd] - doc: remove myself from security steward rotation (Michael Dawson)  #58927
• [ 710e13d436] - doc: add ovflowd back to core collaborators (Claudio W.)  #58911
• [ 8b93008dc0] - doc: update email address for Richard Lau (Richard Lau)  #58910
• [ 9ff81d21ed] - doc: update vm doc links (Chengzhong Wu)  #58885
• [ ff2efd266d] - doc: fix links in test.md (Vas Sudanagunta)  #58876
• [ 5e854e1f61] - doc: add missing comma in child_process.md (ronijames008)  #58862
• [ 48f5d6d686] - doc: add guidelines for introduction of ERM support (James M Snell)  #58526
• [ 80dec9849d] - (SEMVER-MINOR) doc: add all watch-mode related flags to node.1 (Dario Piotrowicz)  #58719
• [ b36fa0fda1] - doc: fix jsdoc definition of assert.ifError() fn in lib/assert.js (jesh)  #58573
• [ cebb93ea12] - doc: add array type in http request headers (Michael Henrique)  #58049
• [ 6e6b373da1] - doc: add missing colon to headers in globals.md (Aviv Keller)  #58825
• [ 1519b75191] - doc: fix stream.md section order (Antoine du Hamel)  #58811
• [ 87f4d078b3] - (SEMVER-MINOR) fs: add disposable mkdtempSync (Kevin Gibbons)  #58516
• [ b378fc3ac0] - fs: close dir before throwing if options.bufferSize is invalid (Livia Medeiros)  #58856
• [ 23bd4d1867] - fs: special input -1 on chown, lchown and fchown (Alex Yang)  #58836
• [ d07ce8e90c] - fs: throw ERR_INVALID_THIS on illegal invocations (Livia Medeiros)  #58848
• [ 0d969a66dc] - inspector: support undici traffic data inspection (Chengzhong Wu)  #58953
• [ 839b25e371] - lib: expose setupInstance method on WASI class (toyobayashi)  #57214
• [ d8f3f649c2] - lib: fix getTypeScriptParsingMode jsdoc (沈鸿飞)  #58681
• [ d534706211] - meta: bump step-security/harden-runner from 2.12.0 to 2.12.2 (dependabot[bot])  #58923
• [ 3ec5fe04d0] - meta: bump github/codeql-action from 3.28.18 to 3.29.2 (dependabot[bot])  #58922
• [ bd4a1a5b06] - meta: add IlyasShabi to collaborators (Ilyas Shabi)  #58916
• [ d29b195b51] - module: link module with a module request record (Chengzhong Wu)  #58886
• [ a78385c4bd] - module: convert schema-only core module on convertCJSFilenameToURL (Alex Yang)  #58612
• [ e0de362319] - module: update tests for combined ambiguous module syntax error (Mert Can Altin)  #55874
• [ 7f7a833e82] - os: fix GetInterfaceAddresses memory lieaky (theanarkh)  #58940
• [ 9623c50b53] - (SEMVER-MINOR) permission: propagate permission model flags on spawn (Rafael Gonzaga)  #58853
• [ efe19b50b6] - repl: fix eval errors thrown after close throwing ERR_USE_AFTER_CLOSE (Dario Piotrowicz)  #58791
• [ c891db1c05] - repl: improve tab completion on computed properties (Dario Piotrowicz)  #58775
• [ 797ec4da04] - (SEMVER-MINOR) sqlite: add support for readBigInts option in db connection level (Miguel Marcondes Filho)  #58697
• [ 8eecaa264d] - src: -Wunreachable-code-break in node_config_file.cc (Shelley Vohr)  #58901
• [ 143379df56] - src: -Wunreachable-code error in crypto_context.cc (Shelley Vohr)  #58901
• [ 056a1af197] - src: fix -Wunreachable-code-return in src/node_contextify.cc (Shelley Vohr)  #58901
• [ ba661459f5] - src: fix -Wunreachable-code in src/node_api.cc (Shelley Vohr)  #58901
• [ 6af0163dda] - src: simplify adding fast APIs to ExternalReferenceRegistry (René)  #58896
• [ 210e608938] - src: cleanup uv_fs_req before uv_fs_stat on existSync (RafaelGSS)  #58915
• [ 2445f86dc9] - src: -Wmismatched-new-delete in debug_utils.cc (Shelley Vohr)  #58844
• [ 12286c9f64] - src: use ranges library (C++20) more systematically (Daniel Lemire)  #58028
• [ ed966a0215] - (SEMVER-MINOR) src,permission: add support to permission.has(addon) (Rafael Gonzaga)  #58951
• [ dd54910ab1] - src,permission: enhance permission model debug (Rafael Gonzaga)  #58898
• [ 94f9424d78] - test: deflake test-runner-watch-mode-kill-signal (Dario Piotrowicz)  #58952
• [ b6ff6c8d20] - test: add known issue tests for recursive readdir calls with Buffer path (Dario Piotrowicz)  #58893
• [ c300f107ac] - test: add known issue tests for fs.cp (James M Snell)  #58883
• [ d8a86a622e] - test: add tests to ensure that node.1 is kept in sync with cli.md (Dario Piotrowicz)  #58878
• [ 57c69acb78] - test: replace .filter()[0] with .find() (Livia Medeiros)  #58872
• [ 67b3f4fbee] - test: remove reliance on in-tree deps/undici (Richard Lau)  #58866
• [ df85b02a00] - test: close dirs in fs-opendir test (Livia Medeiros)  #58855
• [ 692f1aebf0] - test: update WPT for urlpattern to 84b75f0880 (Node.js GitHub Bot)  #58785
• [ 3a119be362] - test: save the config file in a temporary directory (Luigi Pinca)  #58799
• [ 924cf1ef25] - test: deflake test-config-file (Luigi Pinca)  #58799
• [ b5c7e645c9] - test_runner: correctly filter --experimental-config-file (Pietro Marchini)  #58833
• [ d0faf723c7] - test_runner: fix timeout not propagated to the child process in run (jakecastelli)  #58831
• [ 6052d8c1ac] - test_runner: correct "already mocked" error punctuation placement (Jacob Smith)  #58840
• [ e8dd1897d5] - tools: compile maglev files into v8_compiler if maglev is disabled (Yao Zi)  #58861
• [ 191396260c] - tools: bump the eslint group in /tools/eslint with 6 updates (dependabot[bot])  #58921
• [ 1e423e0680] - tools: update inspector_protocol to 69d69dd (Shelley Vohr)  #58900
• [ 0def4e23b1] - tools: update gyp-next to 0.20.2 (Node.js GitHub Bot)  #58788
• [ adb950cde2] - tools,doc: move more MDN links to types (Antoine du Hamel)  #58930
• [ 1ee539a3aa] - tty: treat empty NO_COLOR same as absent NO_COLOR (Antoine du Hamel)  #58074
• [ 2b34867ba9] - v8: fix missing callback in heap utils destroy (Ruben Bridgewater)  #58846
• [ a1f4333695] - vm: expose import phase on SourceTextModule.moduleRequests (Chengzhong Wu)  #58829
• [ fe17f5d285] - (SEMVER-MINOR) watch: add --watch-kill-signal flag (Dario Piotrowicz)  #58719

Node.js — Node v24.4.0 (Current)