chore(deps): update all non-major dependencies - #37
Conversation
6617cd8 to
5c977b4
Compare
dawsontoth
left a comment
dawsontoth
left a comment
There was a problem hiding this comment.
Blocked: npm ci fails — same latent landmine I just hit on agent#141, not these bumps
All four failing jobs (Verify and Integration, Node 24 and 26) die at install before anything runs:
npm error `npm ci` can only install packages when your package.json and package-lock.json ... are in sync.
npm error Missing: react-native-fs@2.20.0 from lock file
npm error Missing: react-native@0.84.1 from lock file
npm error Missing: react@19.2.8 from lock file
... (~66 react-native / jest / metro entries, all under node_modules/harper/node_modules/**)
Cause
harper → alasql, which declares "optionalDependencies": { "react-native-fs": "^2.20.0" }; that in turn has an optional peer on react-native. npm's resolver omits those from the lockfile, but npm ci's validator computes an ideal tree that includes them and then rejects the lock for not having them.
This PR is the only one that bumps harper (5.1.26 → 5.2.1), which forces a re-resolve of harper's nested tree and drops the whole subtree: 1469 → 1195 keys.
Not caused by the bumps — main breaks identically when regenerated
| tree | keys | react-native in lock | npm ci |
|---|---|---|---|
| main, committed lock | 1469 | yes | ✓ exit 0 |
| main, lock regenerated | 1191 | no | ✗ exit 1 |
| this PR | 1195 | no | ✗ exit 1 |
I confirmed the same thing on agent#141 (npm 10.9.8 and npm 11.13.0 both produce a lock their own npm ci rejects, and npm install doesn't repair it). Any lockfile regeneration in a repo with harper as a dependency trips this.
The dependency intent here is clean and small, for the record: 0 major crossings, 4 top-level moves — harper 5.1.26 → 5.2.1, vite 8.2.0 → 8.2.1, semantic-release 25.0.8 → 25.0.9, conventional-commits-parser 7.1.1 → 7.1.2 — plus .nvmrc 24.18.1 → 24.19.0.
Fix belongs on main
Cheapest option is an overrides entry neutralizing alasql's optional dep so it never enters the ideal tree:
"overrides": { "alasql": { "react-native-fs": "npm:empty-npm-package@1.0.0" } }(harper uses alasql for SQL parsing, never its React Native file adapter.) The heavier alternative is declaring the packages as direct devDependencies, the same shape as the argue-cli / conventional-commits-* fix.
vite-specific caution: a full npm install here re-dedupes the nested harper/node_modules/harper/... native-binary trees into a ~12k-line diff. Do this surgically and check the diff size before committing. Validate with both npx -p npm@10.9.8 npm ci and npx -p npm@11.16.0 npm ci from a clean tree.
Once main installs reproducibly, a rebase should clear all four jobs. I've filed this separately since it blocks agent and vite today and will hit any other repo with harper on the next bump.
5c977b4 to
16064a1
Compare
Renovate updates lockfiles with `npm install --package-lock-only`. That
path prunes the optional `react-native-fs` subtree declared by
`harper > alasql`, while `npm ci`'s validator still computes an ideal tree
containing it, so every CI job died at the install step:
npm error code EUSAGE
npm error Missing: react-native-fs@2.20.0 from lock file
npm error Missing: react-native@0.84.1 from lock file
Regenerating the same branch with a full `npm install` records the subtree
and `npm ci` accepts it. The result is a strict superset of the previous
lockfile: 270 entries added, 0 removed, 0 version changes, and the 1195
pre-existing entries are byte-identical and in the same order. The large
textual diff is a git alignment artifact, not churn.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
`skipInstalls` defaults to true, which is what makes Renovate use `npm install --package-lock-only` and drop the optional react-native subtree, producing a lockfile its own `npm ci` rejects. Renovate documents this switch for exactly this case: "only used in cases where bugs in npm result in incorrect lock files being updated." Without this, the next dependency PR that re-resolves harper regenerates the same broken lockfile. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Took this over — same root cause and fix as agent#141Pushed two commits. The four red jobs were all dying at What was actually wrongRenovate updates lockfiles with Same branch, same npm (11.16.0), only the generation method differs:
58928ed — regenerate the lockfile with a full installPlease don't be alarmed by the 18,817-line diff. It is not churn. The new lockfile is a strict superset of the previous one:
Verified mechanically — deleting exactly the 270 new keys from the new lockfile reproduces Renovate's previous lockfile exactly, order-sensitive: const stripped = {...B, packages: Object.fromEntries(
Object.entries(B.packages).filter(([k]) => k in A.packages))};
JSON.stringify(stripped) === JSON.stringify(A) // trueSo git's diff is aligning re-emitted blocks badly; every deleted line reappears verbatim. 892f79a —
|
Edited/Blocked NotificationRenovate will not automatically rebase this PR, because it does not recognize the last commit author and assumes somebody else may have edited the PR. You can manually request rebase by checking the rebase/retry box above. |
dawsontoth
left a comment
dawsontoth
left a comment
There was a problem hiding this comment.
Approving — the npm ci blocker I filed is fixed on this branch and every check is green: commitlint, Verify on Node 22/24/26, and Integration on Node 22/24/26.
Clearing my earlier CHANGES_REQUESTED. The fix is the regenerated lockfile in 58928ed (strict superset: 270 entries added, 0 removed, 0 version changes) plus skipInstalls: false in 892f79a so it doesn't recur. Full rationale and the superset proof are in the comment above.
Notably the three Integration jobs — which I flagged as unverifiable on macOS — all pass on CI. They had previously been failing at the install step without executing, so this confirms there was no second problem hiding behind the lockfile failure. 🤖
|
🎉 This PR is included in version 1.1.7 🎉 The release is available on: Your semantic-release bot 📦🚀 |
1 participant
This PR contains the following updates:
7.1.1→7.1.25.1.26→5.2.124.18.1→24.19.025.0.8→25.0.98.2.0→8.2.1Release Notes
conventional-changelog/conventional-changelog (conventional-commits-parser)
v7.1.2Compare Source
Bug Fixes
harperfast/harper (harper)
v5.2.1Compare Source
Data integrity
Blob-column decode corruption on read-modify-write, fixed at the root cause (#2119). In 5.2.0, a REST
PATCHthat read a record and wrote it back unchanged — carrying along aBlobcolumn — could corrupt that blob on disk, producingError decoding record: Data read, but end of buffer not reachedon the next read. The inline-blob decode path kept a second reference to the payload (storageBuffer) that pointed directly into the store's reusable read buffer instead of a stable copy; re-encoding a cached/fetched blob could serialize whatever bytes a later, unrelated read had since recycled into that buffer. 5.2.0's new primary-store record cache made this reachable for the first time — the underlying pattern was latent since October 2025 but only 5.1.x's uncached read path avoided it. The fix drops the unstable reference entirely and always re-encodes from the already-copied, stable buffer, with no added read-path cost. Deterministic repro and fix are covered by a new 3-case test matrix (recordCacheStableBuffer.test.js). This supersedes the narrower #2103 mitigation (which forced fresh allocations on every primary read to mask the symptom).Reliability
uncaughtExceptionhandling for EPIPE could re-enter itself in a self-feeding loop when stdout/stderr closed under load. Broken-pipe writes are now caught at the source on both sync and async paths, anddisableStdio()no longer tears down the log-file tee.dropTable()safety — now drains in-flight cache-write commits and re-checks live drop state immediately before dropping column families, closing a window for a concurrent write to land mid-drop, and fails closed (instead of proceeding) if the drain times out.delete_transaction_logs_beforescoped to a single table was purging the entire database's log on RocksDB; it's now rejected outright on RocksDB rather than silently over-purging.Security
bypass_authtrust gaps in MCP token handling and SQL AST checks; request bodies can no longer influence operations authorization.super_userare now rejected, preventing accidental lockout.Storage
storage.compression, applied consistently per column family; upgraded databases correctly retain their existing column families' codec instead of silently adopting a new default. Includes a compression benchmark.rocksdb-jsupdated 2.6.1 → 2.7.1 across several bumps.Deploy & redeploy
Hardened native-addon and app redeploy handling: transactional redeploy preparation, serialized watcher replacement, preserved entry events across deploy scans, and closed several deploy-owner reclaim races so exiting workers no longer strand deploy state.
CLI & platform
-h/--helpflags with a width-responsive help screen./v1/*gateway, exposed as built-in Resources (Phase 4 of the models initiative — #1616).CONFIRM_DOWNGRADEnow resolves deterministically (and logs the refusal) when no TTY is available to answer the prompt, instead of hanging (#2059).Also in this release
Docker shrinkwrap/pin-canary hardening, storage-quota path/metric fixes, outstanding-write-commit tracking for stuck-commit diagnostics, and routine CI/test/dependency maintenance (Node 26 canary hardening, RocksDB conflict-retry test fix, misc
chore(deps)bumps).Full Changelog: HarperFast/harper@v5.2.0...v5.2.1
v5.2.0Compare Source
Harper 5.2.0 is the first stable release of the 5.2 line. These notes cover everything on the 5.2 line since it branched from 5.1 — roughly 210 merged PRs across two months — not just the changes since the last beta. Fixes that were also cherry-picked onto the 5.1 patch train (5.1.16 through 5.1.26) are included here as well, since they are part of 5.2.0.
Headline work: a new SQL engine built on the Resource API is now the default, secrets get a first-class store and end-to-end custody, row-level read authorization is unified, RocksDB databases gain managed backup/restore, and a large cluster of transaction and storage correctness fixes closes several write-loss paths.
Upgrade notes
legacytoauto(#1285). Queries are now planned by the new Resource-API engine, with automatic fallback to the legacy AlaSQL path for shapes it does not support. Setsql.engine: legacyto restore the previous behavior, ornewto disable fallback and surface unsupported shapes as errors.allowRead/write hooks per record; that is reverted to the pre-5.2 contract. Applications that want row-level narrowing should use the new explicitrowFilter(record, context)andeventFilter(event, context)predicates.@expiresAtnow takes precedence over the table-level expiration default (#1812). Tables that set both will see per-record expiration win.threads.countdefaults to 1 on macOS and Windows (#1605). Neither platform has workingSO_REUSEPORT, so additional HTTP workers could never share the server ports. An explicitthreads.countstill overrides.noDelay/keepAliveoptions were never actually applied to TCP or UDS listeners, and the keep-alive delay was 600 ms rather than the intended 10 minutes (#1859).storage.migrateOnStarton any 5.2 alpha or beta, migrated records were written without their version metadata — see "LMDB to RocksDB migration" below for the verification step.CONFIRM_DOWNGRADE=yes(#2046). Starting 5.2.0 against an existing store createssystem.hdb_secretand records the data version as 5.2.0. The migration is additive and 5.1.x can still run the store, but a 5.1.x binary asks for confirmation before starting against data marked newer — and with no interactive terminal (systemd, containers, CI) that prompt currently blocks with nothing in the log. To downgrade, setCONFIRM_DOWNGRADE=yesin the environment (or pass--CONFIRM_DOWNGRADE yes); take a backup first.SQL engine on the Resource API
sql.engine: autofalls back to legacy automatically for query shapes it does not support. Notable behaviors: a two-sided primary-key range is fused into a single bounded seek;ORDER BY <primary key>with noWHEREis served from index order rather than a full ordered scan;UPDATE col = col ± Nis applied as an atomic addition; null-valued conditions are served only onindexNullsindexes; unindexedWHEREconjuncts are residualized rather than pushed;NOT INuses correct three-valued logic. DISTINCT aggregates andUPDATE SETon the primary key fall back to legacy.Security
databaseid; when a statement omitted the schema qualifier that field was empty, nothing was recorded in the affected-attribute map, andhasPermissionsiterating an empty map authorized by vacuous truth — while the engine's binder resolved the same bare name to a concrete database and executed against it. Authorization now runs against the table the engine resolves, per table reference rather than once per statement. The same series recordsGROUP BY/HAVINGcolumns, reports derivedJOINsources that carry nojoin.table, and refusesUNION/EXCEPT/INTERSECT/PIVOT/UNPIVOToutright rather than letting them pass unchecked.allow*hooks now fail closed when they throw or reject (#1489). A hook that threw was previously treated as a pass.Errorobjects are no longer logged from REST (#1737), and logger arguments are auto-wrapped with a diagnostic property allowlist (#1749) — both closed paths where secrets could reachhdb.log.inspectForLog/deepSanitizeErrorsare now realm-safe, bounded in breadth and depth, and fail closed at the cap.cluster_userhandling is completed (#1913).http.securityHeadersconfig added, and the authentication middleware is now named in the chain (#1568).PACKAGE_ROOTis canonicalized so it matches realpath'dallowedPathchecks (#1905), andnpm pack --ignore-scriptsis gated oninstall_allow_scriptsalone (#1819).enableProxyProtocolheader buffering has a stall-timeout guard (#1947), so a peer that opens a connection and never completes the PROXY header cannot hold it open.Secrets management
hdb_secretstore with grant-scoped secret operations (#1554). Secrets are stored in a dedicated table with a pure envelope codec, serialized row mutations, validator caps, and grant-set semantics; secret operations are kept off the MCP default-allow surface..envfiles are protected in the operations API (#1527) and can be written viaset_component_file, with an encryptedenc:v1contract and a dormant decrypt hook (#1528)..envfiles are warned about loudly rather than silently ignored (#1580).Access control
allowRead: unified row-level read access control (#1786, closing the second gap in #1422). Enforcement is consistent across reads, GraphQLcheckPermission, and subscription delivery. Prefix and multi-record scans keep the awaited entry check; per-record enforcement is sync-only.alter_role(#1634).allowReadis enforced on custommcpResourcesreads (#1839), which previously bypassed the check that equivalent REST reads applied.allowReadbinds to a proper resource instance (#1532).rowFilter/eventFilterpredicates (#1915) carry through filtered HNSW traversal, OR/range filtering, source-revalidated reads, subscription snapshots, replay, live events, and reload snapshots.hdb-sessioncookie (#1546).Managed RocksDB backups
create_backup,list_backups,verify_backup,delete_backup,purge_backups,restore_backup, and RocksDB support forget_backup— give incremental, checksum-verified backups understorage.backupPath, one subdirectory per database, including file-backed blobs and the transaction log. Everything is also runnable from the CLI, including offline against a stopped server. Restores serialize against a per-database lock/marker and verify the database is fully closed process-wide before purging and rewriting, so a crash mid-restore recovers cleanly instead of corrupting data.Typed resources and the application model
defineTableplus a per-method request contract, with the six typed-resources exports wired into the component sandbox (#1825).urlPathfrom the root config (#1964). Multiple applications can share a server while routing to distinct hosts or path prefixes. Mounts are enforced only at the routing boundary, fail closed on a wrong-typed config, and REST route registration is keyed on the resolved route rather than its raw parts.@computedscalars surface on default reads, with a guard for cyclic@enumerableserialization (#1601).super.postcreate behavior, normalized before authorization (#1956).Responseobjects and astatusfield are honored for custom-resource HTTP status (#1501).Transactions and storage
The largest cluster of fixes in this release. Several were write-loss paths.
ERR_TRY_AGAINretries on the same transaction using a native in-place reset (#1823); the earlier fix retried on a fresh transaction (#1696).Table.clear()clears secondary-index DBIs as well as the primary store (#1906).localTimerather than its origin version (#1988).audit: falsetables thread the transaction intoremoveEntry(#1869).starts_withreturns complete results for astral-plane Unicode values (#1887).checkOverloaded()logs once when it first starts rejecting writes (#2007), so a shedding node is visible in the log.Promise<number | void>type for the commit-latency recorder (#1853, #1899).LMDB to RocksDB migration
Migrated records lost their version and record prototype (#2014). Every record written by
storage.migrateOnStartsince #1307 was stored without its[8-byte version][flags word]metadata prefix:copyDbgraftsRecordEncoder's encode hook onto the migration target's plain msgpackr encoder, and the hook'sif (!this.useVersions)opt-out readuseVersionsoff that foreign encoder —undefined— so every migrated record took the non-versioned plain-encode path. Downstream, prefix-less records decode without the metadata wrapper, soPrimaryRocksDatabase.getEntryskipped thestructPrototyperepair and point reads returned prototype-less plain objects: relationship getters,toJSONandgetUpdatedTimewere all unreachable. Record versions were silently dropped, which also affects cache admission,ifVersion/CAS, and replication version comparison.The fix writes the prefix correctly, adds a read-side repair for already-migrated databases, stages the migration and renames it into place only after verification, and exports
verifyMigratedDatabase(databasePath)so an existing installation can be checked. Verification sweeps every generation and exempts genuinely version-less records by key rather than by sniffing bytes. If you have runmigrateOnStarton any 5.2 alpha or beta, runverifyMigratedDatabasebefore relying on versions; a no-op rewrite pass is required to restore versions on already-migrated records.Legacy
storage.compressionmetadata is tolerated when opening RocksDB databases (#2037), mapping to a valid rocksdb-js compression option instead of erroring on open.New built-in components are activated on in-place-upgraded configs (#1814), and WAF is activated on upgraded instances (#1910).
Performance
PrimaryRocksDatabasebacks primary stores with aWeakLRUCachevalidated against the Verification Table, so a cache hit does not require a store read. Caching is opt-in per primary store, and the coordinated-retry loop is capped with options preserved across retries.HTTP, TLS and networking
tls.unixDomainSocketsenabled, the per-worker UDS mirror is a separatehttp.Serverthat never received the'upgrade'listeneronWebSocket()attaches to the port-keyed server, so Node destroyed every WebSocket handshake on it with a zero-byte close — no response, no log. The same fix stopsenableProxyProtocol()'s data interception from outliving the PROXY header decision, where it was forwarding post-upgrade frames to a freed HTTP parser the pool can reissue to another connection.request.connectionInfo(#1985).ciphers/SECLEVELare honored from every configured source when building listeners (#1841).listenOnPorts()previously swallowed everyEADDRINUSE, so an unrelated process squatting a Harper port silently received Harper's traffic.Static serving and caching
urlPathwas configured, andurlPath: '/'matched only the exact path/.maxAge,immutable,cacheControl(#1748) — and Cache-Control/Vary hardening with shared-cache defaults (#1746).afterordering for the static plugin, with a warning whenfallthrough: falseblocks REST (#1574).target.loadedFromSourceis the sole cache-disposition signal (#1626).allowStaleWhileRevalidateis consulted for query-driven revalidation (#1581).finalizeResponse(#1709), which corrupted persisted headers.MCP and AI
mcpTools/mcpPromptsare registered at runtime (#1526), parameterized custom resources surface as MCP tools (#1602), and operations-profile tools are computed lazily so late-registered operations appear (#1579).MCP-Protocol-Versionheader is accepted as the session's negotiated version (#1694).harper agentCLI (#1553): a command-line client for the built-in agent, withharper chatas an alias, automatic refresh of expired agent tokens, and the--onceapproval hang fixed. The built-in agent itself is now runnable end to end (#1549) and drains operations tools from the lazy provider (#1847).@embed/models.embedno longer forwards the logical model name as the provider wire model id (#1596).openaiStream()— an OpenAI-compatible SSE formatter (#1106).Logging, analytics and observability
read_logstreams over SSE as a live tail (#1693), with backpressure detection, bounded backlog reads, and resilient delta reads.logging.rotation.retentionis exposed (#1687).get_analyticsis driven off the bounded time window rather than the metric index (#1798).get_status(#1587).threads.preloadconfig preloads modules such as APM agents on worker threads (#1569).Deployment and components
deploy_componentregistryAuthis reshaped into a general-purpose credentials array (#1797).get_deployment_payloadanddelete_deployment_payloadoperations implemented (#1898), and peer-sidepayload_blobreads retry on a transient 503 stall (#1838).jsResourcecomponent flags a restart (#1820).deployLifecyclelistener leak (#1465).server.registerOperation()from components is reachable via the operations API (#1743).set_configurationsupportsreplicated: true(#1556).waitForDrainpoll fallback for drains that never emit (#1643).Replication (core side)
copyApplyreload marker (#1530).FileBackedBlob.stream()cancel/cleanup paths hardened (#1542).CLI
harper login --for-cito print CI credentials on stdout, gated on a remote target with userinfo stripped (#1876).add_user/alter_user(#1873).~/...install destinations are expanded to an absolute path immediately (#1803).Packaging and build
npm-shrinkwrap.jsonships in the published package (#1622), with devDependencies pruned before shrinkwrapping (#1781, #1783) and the react-native tree stripped (#1959).github:git spec (#1756).RUNheredoc redirect (#1619).@harperfast/code-guidelines(#1992).tsgois available as an opt-in fast type-checker (#1738).Also in this release
Broad QA regression-anchor promotions across concurrency and data integrity, static serving, deploy, shutdown drain, secrets, subscription paths, read consistency, secondary-index integrity, cross-version upgrade read visibility, and transaction commit behavior (#1517, #1418, #1791, #1802, #1833, #1886, #1884, #1870, #1900, #1345, #1861); a packaged-application E2E workflow (#1908); a downstream Next.js adapter integration gate on harper PRs (#1385); CI shard rebalancing and single-Node integration runs on PR pushes (#1883); rocksdb-js updated to 2.5.0 (#1892); assorted dependency updates, deflaking, lint migration to plain
node:assert(#1558), and removal of vestigialresourceCacheplumbing (#1980).Full Changelog: HarperFast/harper@v5.1.15...v5.2.0
nodejs/node (node)
v24.19.0: 2026-08-03, Version 24.19.0 'Krypton' (LTS), @aduh95Compare Source
Notable Changes
d08872b530] - (SEMVER-MINOR) buffer: implementblob.textStream()(Matthew Aitken) #6403635222948be] - (SEMVER-MINOR) deps: update OpenSSL build config to support compression (Tim Perry) #62217d6ab039f24] - (SEMVER-MINOR) doc: updateblockListstability status to release candidate (alphaleadership) #630501da05fb79d] - doc: markstream.composestable (Matteo Collina) #625623c1636dabf] - (SEMVER-MINOR) esm: add--experimental-import-textflag (Efe) #62300e323e877be] - (SEMVER-MINOR) fs: support caller-suppliedreadFile()buffers (Matteo Collina) #63634c1248c9544] - (SEMVER-MINOR) http: addhttpValidationoption to configure header value validation (RajeshKumar11) #61597a534b65815] - (SEMVER-MINOR) net: supportTCP_KEEPINTVLandTCP_KEEPCNTinsetKeepAlive(Guy Bedford) #63825a23cdec683] - (SEMVER-MINOR) perf_hooks: sample delay per event loop iteration (Pablo Erhard) #629357428b57a37] - (SEMVER-MINOR) src: allow empty--experimental-config-file(Marco Ippolito) #61610e57597173c] - (SEMVER-MINOR) stream: exposeReadableStreamTee(Matteo Collina) #641955396235993] - (SEMVER-MINOR) tls: report negotiated TLS groups (Filip Skokan) #641195e901b5cd9] - (SEMVER-MINOR) tls: addcertificateCompressionoption (Tim Perry) #62217Commits
676467fa9f] - benchmark: trim down the argon2 sets (Filip Skokan) #64218a77a2000b7] - benchmark: add child_process async path baselines (Yagiz Nizipli) #63929dd4482e915] - buffer: remove unreachable overflow check in atob (haramjeong) #60161081c41eb86] - buffer: add fast api for isUtf8 and isAscii (Gürgün Dayıoğlu) #64169d08872b530] - (SEMVER-MINOR) buffer: implement blob.textStream() (Matthew Aitken) #640366e2f7e6013] - build: remove redundant intermediate node_aix_shared (Chengzhong Wu) #6374787e0675f51] - build: build codecache and snapshot with libnode (Chengzhong Wu) #6362632174a7bae] - build: support setting an emulator from configure script (Ivan Trubach) #5389969cfb2f240] - build: remove duplicated node_use_sqlite and node_use_ffi conditions (Chengzhong Wu) #6362937ac6e8cb5] - build: add manually-dispatched stress-test workflow (Joyee Cheung) #641182424207191] - build: suppress compiler warnings for histogram (Richard Lau) #6398063502b7404] - build,win: fix VS2022 arm64 PGO build (Stefan Stojanovic) #63413fe4e4055d0] - child_process: fix permission model propagation via NODE_OPTIONS (Matteo Collina) #63972aa2f3c066e] - child_process: pass spawn options to the binding positionally (Yagiz Nizipli) #63930fcf32cf77a] - child_process: serialize advanced IPC messages natively (Yagiz Nizipli) #639337907134734] - crypto: reject small-order EdDSA points during verify (Filip Skokan) #64026b505cd5465] - crypto: support non-byte WebCrypto lengths and cSHAKE (Filip Skokan) #639880f54a872e2] - crypto: share WebCrypto method and usage helpers (Filip Skokan) #63975824ec11c05] - crypto: refactor keyObject.toCryptoKey() and SubtleCrypto.getPublicKey() (Filip Skokan) #6362273aba92689] - crypto: coerce -0 to +0 before native calls (Filip Skokan) #63556c83b79874e] - crypto: reject invalid raw key imports (Filip Skokan) #63134934fda64b9] - crypto: improve accuracy of SubtleCrypto.supports (Filip Skokan) #63104e392e1f791] - crypto: fix large DH generator validation (Tobias Nießen) #64092e75a363e70] - crypto: use EVP_MAC for HMAC on OpenSSL >=3 (Filip Skokan) #63942adbaf7af9b] - crypto: make webcrypto aliasKeyFormat directional (Filip Skokan) #63910bb1aea8897] - crypto: fix unhandled error in Hash._transform (Haram Jeong) #6326112c87732c1] - crypto: handle cipher context allocation failures (Tian Teng) #63542858496b453] - crypto: deduplicate X509 subject matching logic (Tobias Nießen) #636449a29cb0964] - crypto: fix warnings in test_node_crypto.cc (Maya Lekova) #634908bb536066d] - crypto: optimize normalizeAlgorithm dispatch hot path (Filip Skokan) #62756329e5496ff] - crypto,tls: do not ignore BN_get_word error (Tobias Nießen) #6389597b7a3f9c7] - debugger: add --max-hit option to probe mode (Joyee Cheung) #637049098585c5e] - debugger: add more logs to probe mode (Joyee Cheung) #6366359cca26cd5] - debugger: surface inspector failures in probe mode (Joyee Cheung) #634372922290eae] - debugger: disambiguate probe location binding (Joyee Cheung) #632866fb2c2c7e2] - debugger: lazily wait for initial break output (Trivikram Kamat) #63969688e792551] - debugger: defer probe pause handling until startup (Trivikram Kamat) #636081ac93cc05a] - debugger: await initialization after run and restart (Trivikram Kamat) #63607Configuration
📅 Schedule: (in timezone America/New_York)
🚦 Automerge: Enabled.
♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.
This PR was generated by Mend Renovate. View the repository job log.