crypto: avoid copying buffers to UTF-8 strings in `crypto.hash()` #59067

Renegade334 · 2025-07-14T08:30:09Z

Fixes: #59057

Testing in the wild confirms this to fix the associated downstream issue. Not sure a unit test is feasible.

cc: @nodejs/releasers – given the impact on the ecosystem, this would ideally be a candidate for a patch release.

nodejs-github-bot · 2025-07-14T08:30:14Z

Review requested:

@nodejs/crypto

panva · 2025-07-14T09:02:51Z

This likely will have to wait for after the announced security releases.

codecov · 2025-07-14T10:07:42Z

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 90.06%. Comparing base (049664b) to head (2a23cf2).
Report is 20 commits behind head on main.

Additional details and impacted files

@@           Coverage Diff           @@
##             main   #59067   +/-   ##
=======================================
  Coverage   90.06%   90.06%           
=======================================
  Files         645      645           
  Lines      189130   189130           
  Branches    37094    37085    -9     
=======================================
+ Hits       170339   170349   +10     
+ Misses      11511    11507    -4     
+ Partials     7280     7274    -6

Files with missing lines	Coverage Δ
src/crypto/crypto_hash.cc	`70.65% <100.00%> (+0.29%)`	⬆️

... and 29 files with indirect coverage changes

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

joyeecheung

LGTM. On a side note according to #59057 this primarily happens on Linux so is likely attributed to fragmentation in glibc's malloc implementation (#21973), and now it seems to affect sync calls with a lot of buffers as well, which is somewhat concerning as the performance issue can lead to OOM..

Renegade334 · 2025-07-15T16:55:47Z

On a side note according to #59057 this primarily happens on Linux so is likely attributed to fragmentation in glibc's malloc implementation

FWIW, I see exactly the same behaviour on Windows. It doesn't look like this is a fragmentation issue, or even a heap issue per se – it looks like the process of running the equivalent of %TypedArray%.prototype.toString() on the input buffer is producing some intermediate that's hitting kMaxFixedArrayCapacity, if the input buffer is large enough.

Edit: https://issues.chromium.org/issues/432212877, for academic interest.

nodejs-github-bot · 2025-07-15T23:08:43Z

CI: https://ci.nodejs.org/job/node-test-pull-request/67945/

nodejs-github-bot · 2025-07-16T07:51:36Z

CI: https://ci.nodejs.org/job/node-test-pull-request/67962/

nodejs-github-bot · 2025-07-16T15:32:11Z

CI: https://ci.nodejs.org/job/node-test-pull-request/67968/

nodejs-github-bot · 2025-07-18T07:51:07Z

CI: https://ci.nodejs.org/job/node-test-pull-request/68003/

nodejs-github-bot · 2025-07-18T10:23:20Z

CI: https://ci.nodejs.org/job/node-test-pull-request/68006/

Renegade334 · 2025-07-18T10:30:02Z

🎲🎲

PR-URL: #59067 Fixes: #59057 Reviewed-By: Filip Skokan <panva.ip@gmail.com> Reviewed-By: James M Snell <jasnell@gmail.com> Reviewed-By: Joyee Cheung <joyeec9h3@gmail.com> Reviewed-By: Anna Henningsen <anna@addaleax.net>

panva · 2025-07-18T11:03:36Z

Landed in fc4a8af

PR-URL: #59067 Fixes: #59057 Reviewed-By: Filip Skokan <panva.ip@gmail.com> Reviewed-By: James M Snell <jasnell@gmail.com> Reviewed-By: Joyee Cheung <joyeec9h3@gmail.com> Reviewed-By: Anna Henningsen <anna@addaleax.net>

gengjiawen · 2025-07-24T08:20:48Z

ping @nodejs/releasers

aduh95 · 2025-07-24T08:31:10Z

Releases are currently blocked on nodejs/build#4105

This MR contains the following updates: | Package | Update | Change | |---|---|---| | [node](https://nodejs.org) ([source](https://github.com/nodejs/node)) | minor | `24.4.1` -> `24.5.0` | MR created with the help of [el-capitano/tools/renovate-bot](https://gitlab.com/el-capitano/tools/renovate-bot). **Proposed changes to behavior should be submitted there as MRs.** --- ### Release Notes <details> <summary>nodejs/node (node)</summary> ### [`v24.5.0`](https://github.com/nodejs/node/releases/tag/v24.5.0): 2025-07-31, Version 24.5.0 (Current), @aduh95 [Compare Source](nodejs/node@v24.4.1...v24.5.0) ##### Notable Changes ##### Upgrade to OpenSSL 3.5 This release is distributed with OpenSSL 3.5.1, following the announcement that OpenSSL 3.5 will be supported until April 2030, while Node.js 24 will be supported until April 2028. Read more about OpenSSL support in their blog post: <https://openssl-library.org/post/2025-02-20-openssl-3.5-lts/>. Contributed by Richard Lau in [#58100](nodejs/node#58100). ##### Unflag `--experimental-wasm-modules` Node.js supports both source phase imports and instance phase imports to WebAssembly modules and for WASM imports to JavaScript, in line with the current Phase 3 WebAssembly [ESM Integration](https://github.com/webassembly/esm-integration) proposal. The implementation and the specification are still subject to change. Contributed by Guy Bedford in [#57038](nodejs/node#57038). ##### Built-in proxy support in `request()` and `Agent` `node:http` and `node:https` now support proxies. When `NODE_USE_ENV_PROXY` is set to `1`, the default global agent would parse the `http_proxy`/`HTTP_PROXY`, `https_proxy`/`HTTPS_PROXY`, `no_proxy`/`NO_PROXY` settings from the environment variables, and proxy the requests sent through the built-in http/https client accordingly. To use global proxy support from the command line: ```bash NODE_USE_ENV_PROXY=1 HTTP_PROXY=http://proxy.example.com:8080 HTTPS_PROXY=http://proxy.example.com:8080 NO_PROXY=localhost,127.0.0.1 node client.js ``` In addition, `http.Agent` and `https.Agent` now support the custom `proxyEnv` options. ```js const agent = new https.Agent({ proxyEnv: { HTTPS_PROXY: 'http://proxy.example.com:8080' } }); ``` For reference, `fetch()` already supports `NODE_USE_ENV_PROXY` as of Node.js 24.0.0. Contributed by Joyee Cheung in [#58980](nodejs/node#58980). ##### Add `setDefaultCACertificates()` to `node:tls` This API allows dynamically configuring CA certificates that will be used by the Node.js TLS clients by default. Once called, the provided certificates will become the default CA certificate list returned by `tls.getCACertificates('default')` and used by TLS connections that don't specify their own CA certificates. To add system CA certificates to the default bundle (which includes the Mozilla CA certificates): ```js tls.setDefaultCACertificates(tls.getCACertificates('default').concat(tls.getCACertificates('system'))); ``` Contributed by Joyee Cheung in [#58822](nodejs/node#58822). ##### Other notable changes - \[[`d5640ca58a`](nodejs/node@d5640ca58a)] - **(SEMVER-MINOR)** **cli**: support `${pid}` placeholder in `--cpu-prof-name` (Haram Jeong) [#59072](nodejs/node#59072) - \[[`c52aaacfc5`](nodejs/node@c52aaacfc5)] - **(SEMVER-MINOR)** **dns**: support max timeout (theanarkh) [#58440](nodejs/node#58440) - \[[`927742b342`](nodejs/node@927742b342)] - **doc**: update the instruction on how to verify releases (Antoine du Hamel) [#59113](nodejs/node#59113) - \[[`f753645cd8`](nodejs/node@f753645cd8)] - **(SEMVER-MINOR)** **net**: update net.blocklist to allow file save and file management (alphaleadership) [#58087](nodejs/node#58087) - \[[`9791ff3480`](nodejs/node@9791ff3480)] - **(SEMVER-MINOR)** **worker**: add web locks api (ishabi) [#58666](nodejs/node#58666) ##### Commits - \[[`5457c7a8a1`](nodejs/node@5457c7a8a1)] - **benchmark**: adjust configuration for string-decoder bench (Rafael Gonzaga) [#59187](nodejs/node#59187) - \[[`28538f2255`](nodejs/node@28538f2255)] - **benchmark**: add --track to benchmark (Rafael Gonzaga) [#59174](nodejs/node#59174) - \[[`a28d804497`](nodejs/node@a28d804497)] - **benchmark**: small lint fix on \_cli.js (Rafael Gonzaga) [#59172](nodejs/node#59172) - \[[`09717eb68e`](nodejs/node@09717eb68e)] - **benchmark**: drop misc/punycode benchmark (Rafael Gonzaga) [#59171](nodejs/node#59171) - \[[`ad6757ef02`](nodejs/node@ad6757ef02)] - **benchmark**: fix sqlite-is-transaction (Rafael Gonzaga) [#59170](nodejs/node#59170) - \[[`7fc3143f61`](nodejs/node@7fc3143f61)] - **benchmark**: reduce N for diagnostics\_channel subscribe benchmark (Arthur Angelo) [#59116](nodejs/node#59116) - \[[`f2812723a0`](nodejs/node@f2812723a0)] - **buffer**: cache Environment::GetCurrent to avoid repeated calls (Mert Can Altin) [#59043](nodejs/node#59043) - \[[`e3e729ca60`](nodejs/node@e3e729ca60)] - **build**: remove suppressions.supp (Rafael Gonzaga) [#59079](nodejs/node#59079) - \[[`dc66422768`](nodejs/node@dc66422768)] - **build,deps,tools**: prepare to update to OpenSSL 3.5 (Richard Lau) [#58100](nodejs/node#58100) - \[[`f5da4947d9`](nodejs/node@f5da4947d9)] - **cli**: add --use-env-proxy (Joyee Cheung) [#59151](nodejs/node#59151) - \[[`d5640ca58a`](nodejs/node@d5640ca58a)] - **(SEMVER-MINOR)** **cli**: support `${pid}` placeholder in --cpu-prof-name (Haram Jeong) [#59072](nodejs/node#59072) - \[[`eeeb40e95b`](nodejs/node@eeeb40e95b)] - **(SEMVER-MINOR)** **crypto**: add tls.setDefaultCACertificates() (Joyee Cheung) [#58822](nodejs/node#58822) - \[[`135fca5b72`](nodejs/node@135fca5b72)] - **crypto**: avoid copying buffers to UTF-8 strings in `crypto.hash()` (Renegade334) [#59067](nodejs/node#59067) - \[[`998cef10e3`](nodejs/node@998cef10e3)] - **deps**: update archs files for openssl-3.5.1 (Node.js GitHub Bot) [#59234](nodejs/node#59234) - \[[`1f06ca956a`](nodejs/node@1f06ca956a)] - **deps**: upgrade openssl sources to openssl-3.5.1 (Node.js GitHub Bot) [#59234](nodejs/node#59234) - \[[`55a90eed8d`](nodejs/node@55a90eed8d)] - **deps**: upgrade npm to 11.5.1 (npm team) [#59199](nodejs/node#59199) - \[[`2b5d451ae0`](nodejs/node@2b5d451ae0)] - **deps**: update amaro to 1.1.1 (Node.js GitHub Bot) [#59141](nodejs/node#59141) - \[[`af789d9b5c`](nodejs/node@af789d9b5c)] - **deps**: update undici to 7.12.0 (Node.js GitHub Bot) [#59135](nodejs/node#59135) - \[[`a34e44545e`](nodejs/node@a34e44545e)] - **deps**: update sqlite to 3.50.3 (Node.js GitHub Bot) [#59132](nodejs/node#59132) - \[[`bfe4781c7d`](nodejs/node@bfe4781c7d)] - **deps**: update googletest to [`7e17b15`](nodejs/node@7e17b15) (Node.js GitHub Bot) [#59131](nodejs/node#59131) - \[[`72adf52e51`](nodejs/node@72adf52e51)] - **deps**: update ada to 3.2.6 (Node.js GitHub Bot) [#58966](nodejs/node#58966) - \[[`2a5f35b589`](nodejs/node@2a5f35b589)] - **deps**: V8: cherry-pick [`3d750c2`](nodejs/node@3d750c2aa9ef) (Michaël Zasso) [#58750](nodejs/node#58750) - \[[`3f813eaba7`](nodejs/node@3f813eaba7)] - **deps**: update archs files for openssl-3.0.17 (Node.js GitHub Bot) [#59134](nodejs/node#59134) - \[[`fb52d0d8df`](nodejs/node@fb52d0d8df)] - **deps**: upgrade openssl sources to openssl-3.0.17 (Node.js GitHub Bot) [#59134](nodejs/node#59134) - \[[`f122602f9d`](nodejs/node@f122602f9d)] - **deps**: update corepack to 0.34.0 (Node.js GitHub Bot) [#59133](nodejs/node#59133) - \[[`c52aaacfc5`](nodejs/node@c52aaacfc5)] - **(SEMVER-MINOR)** **dns**: support max timeout (theanarkh) [#58440](nodejs/node#58440) - \[[`927742b342`](nodejs/node@927742b342)] - **doc**: update the instruction on how to verify releases (Antoine du Hamel) [#59113](nodejs/node#59113) - \[[`9a8d2020ad`](nodejs/node@9a8d2020ad)] - **doc**: copyedit SECURITY.md (Rich Trott) [#59190](nodejs/node#59190) - \[[`3da5bc0668`](nodejs/node@3da5bc0668)] - **doc**: fix broken sentence in `URL.parse` (Superchupu) [#59164](nodejs/node#59164) - \[[`06cd7461e0`](nodejs/node@06cd7461e0)] - **doc**: improve onboarding instructions (Joyee Cheung) [#59159](nodejs/node#59159) - \[[`dfb72d158b`](nodejs/node@dfb72d158b)] - **doc**: add constraints for mem leak to threat model (Rafael Gonzaga) [#58917](nodejs/node#58917) - \[[`51b8dfd5c6`](nodejs/node@51b8dfd5c6)] - **doc**: add Aditi-1400 to collaborators (Aditi) [#59157](nodejs/node#59157) - \[[`4ffa756ce3`](nodejs/node@4ffa756ce3)] - **doc**: avoid suggesting testing fast api with intense loop (Chengzhong Wu) [#59111](nodejs/node#59111) - \[[`6f81b274f7`](nodejs/node@6f81b274f7)] - **doc**: fix typo in writing-test.md (SeokHun) [#59123](nodejs/node#59123) - \[[`88e434e687`](nodejs/node@88e434e687)] - **doc**: add new environment variables doc page (Dario Piotrowicz) [#59052](nodejs/node#59052) - \[[`b1a318d706`](nodejs/node@b1a318d706)] - **doc**: update release key for aduh95 (Antoine du Hamel) [#58877](nodejs/node#58877) - \[[`34c49000c9`](nodejs/node@34c49000c9)] - **doc**: add missing section for `setReturnArrays` in `sqlite.md` (Edy Silva) [#59074](nodejs/node#59074) - \[[`9b2e965aff`](nodejs/node@9b2e965aff)] - **doc**: add RafaelGSS as steward July 25 (Rafael Gonzaga) [#59078](nodejs/node#59078) - \[[`2d1dcb87e6`](nodejs/node@2d1dcb87e6)] - **doc**: clarify ERR\_FS\_FILE\_TOO\_LARGE to reflect fs.readFile() I/O limit (Haram Jeong) [#59050](nodejs/node#59050) - \[[`999b5e51e7`](nodejs/node@999b5e51e7)] - **doc**: run license-builder (github-actions\[bot]) [#59056](nodejs/node#59056) - \[[`1940a2cb46`](nodejs/node@1940a2cb46)] - **doc**: fix typed list formatting (Aviv Keller) [#59019](nodejs/node#59019) - \[[`6cb5e0d22f`](nodejs/node@6cb5e0d22f)] - **doc**: refine `util.parseArgs` `default` definition (Slayer95) [#58958](nodejs/node#58958) - \[[`d2e7f8e13a`](nodejs/node@d2e7f8e13a)] - **doc**: remove unused import in `zlib.md` (coderaiser) [#59041](nodejs/node#59041) - \[[`9d02960149`](nodejs/node@9d02960149)] - **doc**: add missing environment variables to manpage (amir lavasani) [#58963](nodejs/node#58963) - \[[`45ffdb34fb`](nodejs/node@45ffdb34fb)] - **doc**: add stability index to the `--watch-kill-signal` flag (Dario Piotrowicz) [#58997](nodejs/node#58997) - \[[`3924c43600`](nodejs/node@3924c43600)] - **doc**: add missing `<code>` blocks (Antoine du Hamel) [#58995](nodejs/node#58995) - \[[`cb95e183f3`](nodejs/node@cb95e183f3)] - **doc**: add scroll margin to links (Roman Reiss) [#58982](nodejs/node#58982) - \[[`c9ded6ba15`](nodejs/node@c9ded6ba15)] - **doc**: add sponsorship link to RafaelGSS (Rafael Gonzaga) [#58983](nodejs/node#58983) - \[[`b919fe0447`](nodejs/node@b919fe0447)] - **(SEMVER-MINOR)** **esm**: unflag --experimental-wasm-modules (Guy Bedford) [#57038](nodejs/node#57038) - \[[`71bb6cd077`](nodejs/node@71bb6cd077)] - **esm**: js-string Wasm builtins in ESM Integration (Guy Bedford) [#59020](nodejs/node#59020) - \[[`8d869e6d62`](nodejs/node@8d869e6d62)] - **fs**: fix return value of fs APIs (theanarkh) [#58996](nodejs/node#58996) - \[[`7f654cee9e`](nodejs/node@7f654cee9e)] - **(SEMVER-MINOR)** **http,https**: add built-in proxy support in http/https.request and Agent (Joyee Cheung) [#58980](nodejs/node#58980) - \[[`85d6a28f4f`](nodejs/node@85d6a28f4f)] - **inspector**: initial support for Network.loadNetworkResource (Shima Ryuhei) [#58077](nodejs/node#58077) - \[[`cfaa299f2e`](nodejs/node@cfaa299f2e)] - **lib**: fix incorrect `ArrayBufferPrototypeGetDetached` primordial type (Dario Piotrowicz) [#58978](nodejs/node#58978) - \[[`d555db22ad`](nodejs/node@d555db22ad)] - **lib**: flag to conditionally modify proto on deprecate (Rafael Gonzaga) [#58928](nodejs/node#58928) - \[[`96c9dd79e6`](nodejs/node@96c9dd79e6)] - **meta**: move one or more collaborators to emeritus (Node.js GitHub Bot) [#59140](nodejs/node#59140) - \[[`324d9fc9d4`](nodejs/node@324d9fc9d4)] - **meta**: enable jsdoc/check-tag-names rule (Yagiz Nizipli) [#58521](nodejs/node#58521) - \[[`04c751463b`](nodejs/node@04c751463b)] - **meta**: add marco-ippolito to security release stewards (Marco Ippolito) [#58944](nodejs/node#58944) - \[[`fe0195fdcc`](nodejs/node@fe0195fdcc)] - **module**: fix conditions override in synchronous resolve hooks (Joyee Cheung) [#59011](nodejs/node#59011) - \[[`515b581d47`](nodejs/node@515b581d47)] - **module**: throw error when re-runing errored module jobs (Joyee Cheung) [#58957](nodejs/node#58957) - \[[`f753645cd8`](nodejs/node@f753645cd8)] - **(SEMVER-MINOR)** **net**: update net.blocklist to allow file save and file management (alphaleadership) [#58087](nodejs/node#58087) - \[[`15e6c28d82`](nodejs/node@15e6c28d82)] - **node-api,doc**: update links to ecma262 with section names (Chengzhong Wu) [#59087](nodejs/node#59087) - \[[`f67b686551`](nodejs/node@f67b686551)] - **perf\_hooks**: do not expose SafeMap via Histogram wrapper (René) [#59094](nodejs/node#59094) - \[[`3d2f919f7c`](nodejs/node@3d2f919f7c)] - **process**: make execve's args argument optional (Allon Murienik) [#58412](nodejs/node#58412) - \[[`1a44265810`](nodejs/node@1a44265810)] - **repl**: handle errors from getters during completion (Shima Ryuhei) [#59044](nodejs/node#59044) - \[[`467dbd31e6`](nodejs/node@467dbd31e6)] - **repl**: fix repl crashing on variable declarations without init (Dario Piotrowicz) [#59032](nodejs/node#59032) - \[[`3a3eb6852d`](nodejs/node@3a3eb6852d)] - **repl**: improve REPL disabling completion on proxies and getters (Dario Piotrowicz) [#58891](nodejs/node#58891) - \[[`55838e79b8`](nodejs/node@55838e79b8)] - **src**: call unmask after install signal handler (theanarkh) [#59059](nodejs/node#59059) - \[[`77649ad93b`](nodejs/node@77649ad93b)] - **src**: use `FastStringKey` for `TrackV8FastApiCall` (Anna Henningsen) [#59148](nodejs/node#59148) - \[[`86babf9c4b`](nodejs/node@86babf9c4b)] - **src**: use C++20 `consteval` for `FastStringKey` (Anna Henningsen) [#59148](nodejs/node#59148) - \[[`88b99eeae1`](nodejs/node@88b99eeae1)] - **src**: remove declarations of removed BaseObject static fns (Anna Henningsen) [#59093](nodejs/node#59093) - \[[`d89390fc8f`](nodejs/node@d89390fc8f)] - **src**: add cache to nearest parent package json (Ilyas Shabi) [#59086](nodejs/node#59086) - \[[`21780075e4`](nodejs/node@21780075e4)] - **src**: check import attributes value types as strings (Chengzhong Wu) [#58986](nodejs/node#58986) - \[[`ef89c2fac9`](nodejs/node@ef89c2fac9)] - **src,test**: fix config file parsing for flags defaulted to true (Edy Silva) [#59110](nodejs/node#59110) - \[[`1e990866e0`](nodejs/node@1e990866e0)] - **test**: mark web lock held test as flaky (Ilyas Shabi) [#59144](nodejs/node#59144) - \[[`ba8e95a785`](nodejs/node@ba8e95a785)] - **test**: use mustSucceed in test-fs-read (Sungwon) [#59204](nodejs/node#59204) - \[[`39978f507f`](nodejs/node@39978f507f)] - **test**: prepare test-crypto-rsa-dsa for newer OpenSSL (Richard Lau) [#58100](nodejs/node#58100) - \[[`1c3aadb9d6`](nodejs/node@1c3aadb9d6)] - **test**: fix flaky test-worker-message-port-transfer-filehandle test (Alex Yang) [#59158](nodejs/node#59158) - \[[`a0d22e9c51`](nodejs/node@a0d22e9c51)] - **test**: remove timeout in test-https-proxy-request-handshake-failure (Joyee Cheung) [#59165](nodejs/node#59165) - \[[`7e0a0fccc1`](nodejs/node@7e0a0fccc1)] - **test**: expand linting rules around `assert` w literal messages (Anna Henningsen) [#59147](nodejs/node#59147) - \[[`c6070046c3`](nodejs/node@c6070046c3)] - **test**: update WPT for WebCryptoAPI to [`ab08796`](nodejs/node@ab08796857) (Node.js GitHub Bot) [#59129](nodejs/node#59129) - \[[`15d8cc908e`](nodejs/node@15d8cc908e)] - **test**: update WPT for WebCryptoAPI to [`19d82c5`](nodejs/node@19d82c57ab) (Node.js GitHub Bot) [#59129](nodejs/node#59129) - \[[`83023e5144`](nodejs/node@83023e5144)] - **test**: skip tests that cause timeouts on IBM i (Abdirahim Musse) [#59014](nodejs/node#59014) - \[[`82d4175ec3`](nodejs/node@82d4175ec3)] - **test**: update `startCLI` to set `--port=0` by default (Dario Piotrowicz) [#59042](nodejs/node#59042) - \[[`16dc53c143`](nodejs/node@16dc53c143)] - **(SEMVER-MINOR)** **test**: move http proxy tests to test/client-proxy (Joyee Cheung) [#58980](nodejs/node#58980) - \[[`a9511a6066`](nodejs/node@a9511a6066)] - **test**: mark test-inspector-network-fetch as flaky on Windows (Joyee Cheung) [#59091](nodejs/node#59091) - \[[`1cffcc02a3`](nodejs/node@1cffcc02a3)] - **test**: add missing port=0 arg in test-debugger-extract-function-name (Dario Piotrowicz) [#58977](nodejs/node#58977) - \[[`83cdf1701b`](nodejs/node@83cdf1701b)] - **test\_runner**: clean up promisified interval generation (René) [#58824](nodejs/node#58824) - \[[`195d6038dc`](nodejs/node@195d6038dc)] - **tools**: clarify README linter error message (Joyee Cheung) [#59160](nodejs/node#59160) - \[[`51f578a3bf`](nodejs/node@51f578a3bf)] - **tools**: add support for URLs to MR commits in `merge.sh` (Antoine du Hamel) [#59162](nodejs/node#59162) - \[[`20be9012eb`](nodejs/node@20be9012eb)] - **tools**: bump [@eslint/plugin-kit](https://github.com/eslint/plugin-kit) from 0.3.1 to 0.3.3 in /tools/eslint (dependabot\[bot]) [#59119](nodejs/node#59119) - \[[`623e264e93`](nodejs/node@623e264e93)] - **tools**: ignore CVE mention when linting release proposals (Antoine du Hamel) [#59037](nodejs/node#59037) - \[[`0e547e09ab`](nodejs/node@0e547e09ab)] - **tools,test**: enforce best practices to detect never settling promises (Antoine du Hamel) [#58992](nodejs/node#58992) - \[[`075d1968db`](nodejs/node@075d1968db)] - **util**: respect nested formats in styleText (Alex Yang) [#59098](nodejs/node#59098) - \[[`9791ff3480`](nodejs/node@9791ff3480)] - **(SEMVER-MINOR)** **worker**: add web locks api (ishabi) [#58666](nodejs/node#58666) </details> --- ### Configuration 📅 **Schedule**: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever MR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this MR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this MR, check this box --- This MR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate).

nodejs-github-bot added c++ Issues and PRs that require attention from people who are familiar with C++. crypto Issues and PRs related to the crypto subsystem. needs-ci PRs that need a full CI run. labels Jul 14, 2025

panva approved these changes Jul 14, 2025

View reviewed changes

panva added request-ci Add this label to start a Jenkins CI on a PR. and removed request-ci Add this label to start a Jenkins CI on a PR. labels Jul 14, 2025

panva self-requested a review July 14, 2025 09:02

crypto: avoid copying buffers to UTF-8 strings in crypto.hash()

2a23cf2

Renegade334 force-pushed the crypto-oneshotdigest-no-stringify-buffers branch from c631a71 to 2a23cf2 Compare July 14, 2025 09:17

panva approved these changes Jul 14, 2025

View reviewed changes

panva added author ready PRs that have at least one approval, no pending requests for changes, and a CI started. request-ci Add this label to start a Jenkins CI on a PR. labels Jul 14, 2025

jasnell approved these changes Jul 14, 2025

View reviewed changes

joyeecheung approved these changes Jul 14, 2025

View reviewed changes

addaleax approved these changes Jul 15, 2025

View reviewed changes

github-actions bot removed the request-ci Add this label to start a Jenkins CI on a PR. label Jul 15, 2025

panva added the request-ci Add this label to start a Jenkins CI on a PR. label Jul 18, 2025

github-actions bot removed the request-ci Add this label to start a Jenkins CI on a PR. label Jul 18, 2025

panva closed this Jul 18, 2025

Aditi-1400 mentioned this pull request Jul 18, 2025

Node 24.4.0 OOMs with pnpm #59057

Closed

Renegade334 deleted the crypto-oneshotdigest-no-stringify-buffers branch July 18, 2025 11:06

github-actions bot mentioned this pull request Jul 28, 2025

2025-07-29, Version 24.5.0 (Current) #59257

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Uh oh!

crypto: avoid copying buffers to UTF-8 strings in `crypto.hash()` #59067

crypto: avoid copying buffers to UTF-8 strings in `crypto.hash()` #59067

Renegade334 commented Jul 14, 2025

Uh oh!

nodejs-github-bot commented Jul 14, 2025

Uh oh!

panva commented Jul 14, 2025 •

edited

Loading

Uh oh!

codecov bot commented Jul 14, 2025 •

edited

Loading

Uh oh!

joyeecheung left a comment •

edited

Loading

Uh oh!

Renegade334 commented Jul 15, 2025 •

edited

Loading

Uh oh!

nodejs-github-bot commented Jul 15, 2025

Uh oh!

nodejs-github-bot commented Jul 16, 2025

Uh oh!

nodejs-github-bot commented Jul 16, 2025

Uh oh!

nodejs-github-bot commented Jul 18, 2025

Uh oh!

nodejs-github-bot commented Jul 18, 2025

Uh oh!

Renegade334 commented Jul 18, 2025

Uh oh!

panva commented Jul 18, 2025

Uh oh!

gengjiawen commented Jul 24, 2025

Uh oh!

aduh95 commented Jul 24, 2025

Uh oh!

Uh oh!

Uh oh!

crypto: avoid copying buffers to UTF-8 strings in crypto.hash() #59067

crypto: avoid copying buffers to UTF-8 strings in crypto.hash() #59067

Conversation

Renegade334 commented Jul 14, 2025

Uh oh!

nodejs-github-bot commented Jul 14, 2025

Uh oh!

panva commented Jul 14, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

codecov bot commented Jul 14, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

joyeecheung left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Renegade334 commented Jul 15, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

nodejs-github-bot commented Jul 15, 2025

Uh oh!

nodejs-github-bot commented Jul 16, 2025

Uh oh!

nodejs-github-bot commented Jul 16, 2025

Uh oh!

nodejs-github-bot commented Jul 18, 2025

Uh oh!

nodejs-github-bot commented Jul 18, 2025

Uh oh!

Renegade334 commented Jul 18, 2025

Uh oh!

panva commented Jul 18, 2025

Uh oh!

gengjiawen commented Jul 24, 2025

Uh oh!

aduh95 commented Jul 24, 2025

Uh oh!

Uh oh!

crypto: avoid copying buffers to UTF-8 strings in `crypto.hash()` #59067

crypto: avoid copying buffers to UTF-8 strings in `crypto.hash()` #59067

panva commented Jul 14, 2025 •

edited

Loading

codecov bot commented Jul 14, 2025 •

edited

Loading

joyeecheung left a comment •

edited

Loading

Renegade334 commented Jul 15, 2025 •

edited

Loading