crypto: support ML-DSA KeyObject, sign, and verify #59259

panva · 2025-07-28T12:49:47Z

This allows node:crypto to recognize the following asymmetric KeyObject types (keyObject.asymmetricKeyType) when built with or linked to OpenSSL 3.5 (#59234):

'ml-dsa-44', 'ml-dsa-65', 'ml-dsa-87' (https://docs.openssl.org/3.5/man7/EVP_PKEY-ML-DSA/)
key fixtures and makefile targets to re-generate them

And the following functionality for them:

import crypto.createPublicKey() SPKI/JWK
import crypto.createPrivateKey() PKCS#8/JWK
export keyObject.export() SPKI/PKCS#8/JWK
keygen crypto.generateKeyPair(Sync)() into KeyObject, PEM, DER, JWK
ML-DSA signing via crypto.sign() and signature verification via crypto.verify()

notable-change PRs with changes that should be highlighted in changelogs.

ML-DSA support in node:crypto kicks off post-quantum cryptography efforts in Node.js. This is part of a broader effort to support NIST's post-quantum cryptography standards for future-proofing applications against quantum computing threats.

nodejs-github-bot · 2025-07-28T12:49:52Z

Review requested:

@nodejs/crypto
@nodejs/gyp
@nodejs/security-wg

panva · 2025-07-28T12:55:08Z

cc @nodejs/cpp-reviewers 🙏

deps/ncrypto/ncrypto.cc

src/crypto/crypto_ml_dsa.cc

test/parallel/test-crypto-pqc-key-objects.js

github-actions · 2025-07-28T18:39:31Z

The notable-change PRs with changes that should be highlighted in changelogs. label has been added by @panva.

Please suggest a text for the release notes if you'd like to include a more detailed summary, then proceed to update the PR description with the text or a link to the notable change suggested text comment. Otherwise, the commit will be placed in the Other Notable Changes section.

Ethan-Arrowood

Excellent work on this! None of my comments should be considered blocking.

Ethan-Arrowood · 2025-08-06T18:11:31Z

deps/ncrypto/ncrypto.cc

+  if (ctx == nullptr) return {};
+
+  EVP_PKEY* pkey = nullptr;
+  if (ctx == nullptr || EVP_PKEY_fromdata_init(ctx) <= 0 ||


Suggested change

if (ctx == nullptr || EVP_PKEY_fromdata_init(ctx) <= 0 ||

if (EVP_PKEY_fromdata_init(ctx) <= 0 ||

Based on line 1912 this part of the condition will always be false, right?

Yeah, I'll be doing a pass on this in a follow up unless a blocking review comes in.

lib/internal/crypto/keygen.js

src/crypto/crypto_keys.cc

src/crypto/crypto_ml_dsa.cc

Ethan-Arrowood · 2025-08-06T18:31:12Z

test/parallel/test-crypto-pqc-key-objects-ml-dsa.js

+    if (hasSeed) {
+      assert.strictEqual(key.export({ format: 'pem', type: 'pkcs8' }), keys.private);
+    } else {
+      assert.strictEqual(key.export({ format: 'pem', type: 'pkcs8' }), keys.private_priv_only);
+    }
+    if (hasSeed) {


Could combine these

👍 in a followup unless a blocking review comes in.

panva · 2025-08-06T18:44:00Z

@Ethan-Arrowood thank you for the review, i'll include the nit fixes in a followup as I'm happy to have a 💚 CI at the moment.

nodejs-github-bot · 2025-08-06T21:49:32Z

Landed in 24e28c4

PR-URL: nodejs#59259 Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com> Reviewed-By: Ethan Arrowood <ethan@arrowood.dev> Reviewed-By: James M Snell <jasnell@gmail.com>

PR-URL: #59259 Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com> Reviewed-By: Ethan Arrowood <ethan@arrowood.dev> Reviewed-By: James M Snell <jasnell@gmail.com>

PR-URL: nodejs#59259 Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com> Reviewed-By: Ethan Arrowood <ethan@arrowood.dev> Reviewed-By: James M Snell <jasnell@gmail.com>

Notable changes: cli: * (SEMVER-MINOR) add NODE_USE_SYSTEM_CA=1 (Joyee Cheung) #59276 crypto: * (SEMVER-MINOR) support ML-DSA KeyObject, sign, and verify (Filip Skokan) #59259 fs: * (SEMVER-MINOR) port SonicBoom module to fs module as Utf8Stream (James M Snell) #58897 http: * (SEMVER-MINOR) add server.keepAliveTimeoutBuffer option (Haram Jeong) #59243 lib: * docs deprecate _http_* (Sebastian Beltran) #59293 zlib: * (SEMVER-MINOR) add dictionary support to zstdCompress and zstdDecompress (lluisemper) #59240 PR-URL: #59449

PR-URL: #59259 Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com> Reviewed-By: Ethan Arrowood <ethan@arrowood.dev> Reviewed-By: James M Snell <jasnell@gmail.com>

Notable changes: cli: * (SEMVER-MINOR) add NODE_USE_SYSTEM_CA=1 (Joyee Cheung) #59276 * (SEMVER-MINOR) add --use-env-proxy (Joyee Cheung) #59151 * (SEMVER-MINOR) support `${pid}` placeholder in --cpu-prof-name (Haram Jeong) #59072 crypto: * (SEMVER-MINOR) support ML-DSA KeyObject, sign, and verify (Filip Skokan) #59259 * (SEMVER-MINOR) add tls.setDefaultCACertificates() (Joyee Cheung) #58822 deps: * update archs files for openssl-3.5.1 (Node.js GitHub Bot) #59234 * upgrade openssl sources to openssl-3.5.1 (Node.js GitHub Bot) #59234 dns: * (SEMVER-MINOR) support max timeout (theanarkh) #58440 doc: * update the instruction on how to verify releases (Antoine du Hamel) #59113 esm: * (SEMVER-MINOR) unflag --experimental-wasm-modules (Guy Bedford) #57038 fs: * (SEMVER-MINOR) port SonicBoom module to fs module as Utf8Stream (James M Snell) #58897 http: * (SEMVER-MINOR) add server.keepAliveTimeoutBuffer option (Haram Jeong) #59243 http,https: * (SEMVER-MINOR) add built-in proxy support in http/https.request and Agent (Joyee Cheung) #58980 lib: * docs deprecate _http_* (Sebastian Beltran) #59293 net: * (SEMVER-MINOR) update net.blocklist to allow file save and file management (alphaleadership) #58087 test: * (SEMVER-MINOR) move http proxy tests to test/client-proxy (Joyee Cheung) #58980 worker: * (SEMVER-MINOR) add web locks api (ishabi) #58666 zlib: * (SEMVER-MINOR) add dictionary support to zstdCompress and zstdDecompress (lluisemper) #59240 PR-URL: #59449 Signed-off-by: RafaelGSS <rafael.nunu@hotmail.com>

Notable changes: cli: * (SEMVER-MINOR) add NODE_USE_SYSTEM_CA=1 (Joyee Cheung) #59276 crypto: * (SEMVER-MINOR) support ML-DSA KeyObject, sign, and verify (Filip Skokan) #59259 fs: * (SEMVER-MINOR) port SonicBoom module to fs module as Utf8Stream (James M Snell) #58897 http: * (SEMVER-MINOR) add server.keepAliveTimeoutBuffer option (Haram Jeong) #59243 lib: * docs deprecate _http_* (Sebastian Beltran) #59293 zlib: * (SEMVER-MINOR) add dictionary support to zstdCompress and zstdDecompress (lluisemper) #59240 PR-URL: #59449 Signed-off-by: RafaelGSS <rafael.nunu@hotmail.com>

Notable changes: cli: * (SEMVER-MINOR) add NODE_USE_SYSTEM_CA=1 (Joyee Cheung) nodejs#59276 crypto: * (SEMVER-MINOR) support ML-DSA KeyObject, sign, and verify (Filip Skokan) nodejs#59259 fs: * (SEMVER-MINOR) port SonicBoom module to fs module as Utf8Stream (James M Snell) nodejs#58897 http: * (SEMVER-MINOR) add server.keepAliveTimeoutBuffer option (Haram Jeong) nodejs#59243 lib: * docs deprecate _http_* (Sebastian Beltran) nodejs#59293 zlib: * (SEMVER-MINOR) add dictionary support to zstdCompress and zstdDecompress (lluisemper) nodejs#59240 PR-URL: nodejs#59449 Signed-off-by: RafaelGSS <rafael.nunu@hotmail.com>

This MR contains the following updates: | Package | Update | Change | |---|---|---| | [node](https://nodejs.org) ([source](https://github.com/nodejs/node)) | minor | `24.5.0` -> `24.6.0` | MR created with the help of [el-capitano/tools/renovate-bot](https://gitlab.com/el-capitano/tools/renovate-bot). **Proposed changes to behavior should be submitted there as MRs.** --- ### Release Notes <details> <summary>nodejs/node (node)</summary> ### [`v24.6.0`](https://github.com/nodejs/node/releases/tag/v24.6.0): 2025-08-14, Version 24.6.0 (Current), @RafaelGSS [Compare Source](nodejs/node@v24.5.0...v24.6.0) ##### Notable Changes - \[[`471fe712b3`](nodejs/node@471fe712b3)] - **(SEMVER-MINOR)** **cli**: add NODE\_USE\_SYSTEM\_CA=1 (Joyee Cheung) [#59276](nodejs/node#59276) - \[[`38aedfbf73`](nodejs/node@38aedfbf73)] - **(SEMVER-MINOR)** **crypto**: support ML-DSA KeyObject, sign, and verify (Filip Skokan) [#59259](nodejs/node#59259) - \[[`201304537e`](nodejs/node@201304537e)] - **(SEMVER-MINOR)** **zlib**: add dictionary support to zstdCompress and zstdDecompress (lluisemper) [#59240](nodejs/node#59240) - \[[`e79c93a5d0`](nodejs/node@e79c93a5d0)] - **(SEMVER-MINOR)** **http**: add server.keepAliveTimeoutBuffer option (Haram Jeong) [#59243](nodejs/node#59243) - \[[`c144d69efc`](nodejs/node@c144d69efc)] - **lib**: docs deprecate \_http\_\* (Sebastian Beltran) [#59293](nodejs/node#59293) - \[[`aeb4de55a7`](nodejs/node@aeb4de55a7)] - **(SEMVER-MINOR)** **fs**: port SonicBoom module to fs module as Utf8Stream (James M Snell) [#58897](nodejs/node#58897) ##### Commits - \[[`f7484575ff`](nodejs/node@f7484575ff)] - **assert**: change utils to use index instead of for...of (방진혁) [#59278](nodejs/node#59278) - \[[`269cd16185`](nodejs/node@269cd16185)] - **benchmark**: remove deprecated \_extend from benchmark (Rafael Gonzaga) [#59228](nodejs/node#59228) - \[[`848e49c20b`](nodejs/node@848e49c20b)] - **benchmark**: add fs warmup to writefile-promises (Bruno Rodrigues) [#59215](nodejs/node#59215) - \[[`8c609be1b1`](nodejs/node@8c609be1b1)] - **benchmark**: add calibrate-n script (Rafael Gonzaga) [#59186](nodejs/node#59186) - \[[`6a3bf772d8`](nodejs/node@6a3bf772d8)] - **build**: fix node\_use\_sqlite for GN builds (Shelley Vohr) [#59017](nodejs/node#59017) - \[[`471fe712b3`](nodejs/node@471fe712b3)] - **(SEMVER-MINOR)** **cli**: add NODE\_USE\_SYSTEM\_CA=1 (Joyee Cheung) [#59276](nodejs/node#59276) - \[[`38aedfbf73`](nodejs/node@38aedfbf73)] - **(SEMVER-MINOR)** **crypto**: support ML-DSA KeyObject, sign, and verify (Filip Skokan) [#59259](nodejs/node#59259) - \[[`a312e706cf`](nodejs/node@a312e706cf)] - **crypto**: prepare webcrypto key import/export for modern algorithms (Filip Skokan) [#59284](nodejs/node#59284) - \[[`3a7c2c3a47`](nodejs/node@3a7c2c3a47)] - **deps**: update ada to 3.2.7 (Node.js GitHub Bot) [#59336](nodejs/node#59336) - \[[`8d9ceeaf6a`](nodejs/node@8d9ceeaf6a)] - **deps**: update archs files for openssl-3.5.2 (Node.js GitHub Bot) [#59371](nodejs/node#59371) - \[[`33b06df354`](nodejs/node@33b06df354)] - **deps**: upgrade openssl sources to openssl-3.5.2 (Node.js GitHub Bot) [#59371](nodejs/node#59371) - \[[`fa70f1af77`](nodejs/node@fa70f1af77)] - **deps**: support madvise(3C) across ALL illumos revisions (Dan McDonald) [#58237](nodejs/node#58237) - \[[`f834a6be59`](nodejs/node@f834a6be59)] - **deps**: update undici to 7.13.0 (Node.js GitHub Bot) [#59338](nodejs/node#59338) - \[[`db2417487e`](nodejs/node@db2417487e)] - **deps**: update sqlite to 3.50.4 (Node.js GitHub Bot) [#59337](nodejs/node#59337) - \[[`41978adb08`](nodejs/node@41978adb08)] - **deps**: V8: backport [`493cb53`](nodejs/node@493cb53691be) (Chengzhong Wu) [#59238](nodejs/node#59238) - \[[`05667991ca`](nodejs/node@05667991ca)] - **deps**: V8: backport [`1c3e018`](nodejs/node@1c3e018e7d48) (Renegade334) [#58818](nodejs/node#58818) - \[[`fd61588bb4`](nodejs/node@fd61588bb4)] - **doc**: rename x509.extKeyUsage to x509.keyUsage (Filip Skokan) [#59332](nodejs/node#59332) - \[[`a271ae4360`](nodejs/node@a271ae4360)] - **doc**: fix Pbkdf2Params hash attribute heading (Filip Skokan) [#59395](nodejs/node#59395) - \[[`72cfff165b`](nodejs/node@72cfff165b)] - **doc**: fix missing reference links for server.keepAliveTimeoutBuffer (Lee Jiho) [#59356](nodejs/node#59356) - \[[`8341916772`](nodejs/node@8341916772)] - **doc**: fix grammar in global dispatcher usage (Eng Zer Jun) [#59344](nodejs/node#59344) - \[[`e3e489706b`](nodejs/node@e3e489706b)] - **doc**: run license-builder (github-actions\[bot]) [#59343](nodejs/node#59343) - \[[`46527e8cea`](nodejs/node@46527e8cea)] - **doc**: correct orthography `eg.` → `e.g.` (Jacob Smith) [#59329](nodejs/node#59329) - \[[`d140c3713e`](nodejs/node@d140c3713e)] - **doc**: clarify the need of compiler compatible with c++20 (Rafael Gonzaga) [#59297](nodejs/node#59297) - \[[`95e9cabf9d`](nodejs/node@95e9cabf9d)] - **doc**: clarify release candidate stability index (Filip Skokan) [#59295](nodejs/node#59295) - \[[`a056dd36d2`](nodejs/node@a056dd36d2)] - **doc**: add WDYT to glossary (btea) [#59280](nodejs/node#59280) - \[[`1e2c52f5c4`](nodejs/node@1e2c52f5c4)] - **doc**: add manpage entry for --use-system-ca (Joyee Cheung) [#59273](nodejs/node#59273) - \[[`31a46fdeb4`](nodejs/node@31a46fdeb4)] - **doc**: add path.join and path.normalize clarification (Rafael Gonzaga) [#59262](nodejs/node#59262) - \[[`cff3725ff9`](nodejs/node@cff3725ff9)] - **doc**: fix typo in `test/common/README.md` (Yoo) [#59180](nodejs/node#59180) - \[[`31a9283591`](nodejs/node@31a9283591)] - **doc**: add note on process memoryUsage (fengmk2) [#59026](nodejs/node#59026) - \[[`5a98bff6b8`](nodejs/node@5a98bff6b8)] - **doc**: format safely for `doc-kit` (Aviv Keller) [#59229](nodejs/node#59229) - \[[`95b8b7ea5c`](nodejs/node@95b8b7ea5c)] - **domain**: remove deprecated API call (Alex Yang) [#59339](nodejs/node#59339) - \[[`2990f178bd`](nodejs/node@2990f178bd)] - **fs**: fix glob TypeError on restricted dirs (Sylphy-0xd3ac) [#58674](nodejs/node#58674) - \[[`e2fb4caf9c`](nodejs/node@e2fb4caf9c)] - **fs**: correct error message when FileHandle is transferred (Alex Yang) [#59156](nodejs/node#59156) - \[[`aeb4de55a7`](nodejs/node@aeb4de55a7)] - **(SEMVER-MINOR)** **fs**: port SonicBoom module to fs module as Utf8Stream (James M Snell) [#58897](nodejs/node#58897) - \[[`e79c93a5d0`](nodejs/node@e79c93a5d0)] - **(SEMVER-MINOR)** **http**: add server.keepAliveTimeoutBuffer option (Haram Jeong) [#59243](nodejs/node#59243) - \[[`0fb005a53f`](nodejs/node@0fb005a53f)] - **http2**: set Http2Stream#sentHeaders for raw headers (Darshan Sen) [#59244](nodejs/node#59244) - \[[`e055539604`](nodejs/node@e055539604)] - **lib**: add trace-sigint APIs (theanarkh) [#59040](nodejs/node#59040) - \[[`d2183d860a`](nodejs/node@d2183d860a)] - **lib**: optimize writable stream buffer clearing (Yoo) [#59406](nodejs/node#59406) - \[[`47543a7e17`](nodejs/node@47543a7e17)] - **lib**: handle windows reserved device names on UNC (Rafael Gonzaga) [#59286](nodejs/node#59286) - \[[`c6911f0717`](nodejs/node@c6911f0717)] - **lib**: do not modify prototype deprecated asyncResource (RafaelGSS) [#59195](nodejs/node#59195) - \[[`3c88b769bb`](nodejs/node@3c88b769bb)] - **lib**: restructure assert to become a class (Miguel Marcondes Filho) [#58253](nodejs/node#58253) - \[[`e91b54df59`](nodejs/node@e91b54df59)] - **lib**: handle superscript variants on windows device (Rafael Gonzaga) [#59261](nodejs/node#59261) - \[[`4ee467905d`](nodejs/node@4ee467905d)] - **lib**: use validateString (hotpineapple) [#59296](nodejs/node#59296) - \[[`c144d69efc`](nodejs/node@c144d69efc)] - **lib**: docs deprecate \_http\_\* (Sebastian Beltran) [#59293](nodejs/node#59293) - \[[`c89b67e681`](nodejs/node@c89b67e681)] - **lib**: add type names in source mapped stack traces (Chengzhong Wu) [#58976](nodejs/node#58976) - \[[`5b2363be8d`](nodejs/node@5b2363be8d)] - **lib**: prefer AsyncIteratorPrototype primordial (René) [#59097](nodejs/node#59097) - \[[`41b4f4d694`](nodejs/node@41b4f4d694)] - **meta**: clarify pr objection process further (James M Snell) [#59096](nodejs/node#59096) - \[[`0eb5962f1e`](nodejs/node@0eb5962f1e)] - **meta**: add mailmap entry for aditi-1400 (Aditi) [#59316](nodejs/node#59316) - \[[`a2b72c2304`](nodejs/node@a2b72c2304)] - **meta**: add tsc and build team as codeowners building.md (Rafael Gonzaga) [#59298](nodejs/node#59298) - \[[`d69f3ee1e0`](nodejs/node@d69f3ee1e0)] - **meta**: add nodejs/path to path files (Rafael Gonzaga) [#59289](nodejs/node#59289) - \[[`1e37eab865`](nodejs/node@1e37eab865)] - **node-api**: reword "implementation in an alternative VM" as implementable (Chengzhong Wu) [#59036](nodejs/node#59036) - \[[`64add6302a`](nodejs/node@64add6302a)] - **src**: use simdjson to parse SEA configuration (Joyee Cheung) [#59323](nodejs/node#59323) - \[[`e9c6636585`](nodejs/node@e9c6636585)] - **src**: mark realm leaf classes final (Anna Henningsen) [#59355](nodejs/node#59355) - \[[`42ef8147d1`](nodejs/node@42ef8147d1)] - **src**: warn about FastOneByteString invalidation (James M Snell) [#59275](nodejs/node#59275) - \[[`8686b8037a`](nodejs/node@8686b8037a)] - **src**: remove unused DSAKeyExportJob (Filip Skokan) [#59291](nodejs/node#59291) - \[[`1e5f632666`](nodejs/node@1e5f632666)] - **src**: use C++20 `contains()` method (iknoom) [#59304](nodejs/node#59304) - \[[`22d4683cfe`](nodejs/node@22d4683cfe)] - **src**: added CHECK\_NOT\_NULL check for multiple eq\_wrap\_async (F3lixTheCat) [#59267](nodejs/node#59267) - \[[`6a47ff4943`](nodejs/node@6a47ff4943)] - **src**: clear all linked module caches once instantiated (Chengzhong Wu) [#59117](nodejs/node#59117) - \[[`33728cb4ca`](nodejs/node@33728cb4ca)] - **src**: add nullptr checks in `StreamPipe::New` (Burkov Egor) [#57613](nodejs/node#57613) - \[[`4a907bdad1`](nodejs/node@4a907bdad1)] - **src**: add percentage support to --max-old-space-size (Asaf Federman) [#59082](nodejs/node#59082) - \[[`7c189d4f55`](nodejs/node@7c189d4f55)] - **test**: deflake sequential/test-tls-session-timeout (Joyee Cheung) [#59423](nodejs/node#59423) - \[[`fb0a6fb57f`](nodejs/node@fb0a6fb57f)] - **test**: exclude mock from coverage (Shima Ryuhei) [#59348](nodejs/node#59348) - \[[`7e10f95f13`](nodejs/node@7e10f95f13)] - **test**: split test-fs-cp.js (Joyee Cheung) [#59408](nodejs/node#59408) - \[[`41bcf5f659`](nodejs/node@41bcf5f659)] - **test**: update WPT resources,WebCryptoAPI,webstorage (Filip Skokan) [#59311](nodejs/node#59311) - \[[`f9f3dc94cb`](nodejs/node@f9f3dc94cb)] - **test**: add known issue test for fs.cpSync dereference bug (James M Snell) [#58941](nodejs/node#58941) - \[[`244d0c38a8`](nodejs/node@244d0c38a8)] - **test**: deflake stream-readable-to-web test (Ethan Arrowood) [#58948](nodejs/node#58948) - \[[`564e604a1a`](nodejs/node@564e604a1a)] - **test**: make test-inspector-network-resource sequential (Shima Ryuhei) [#59104](nodejs/node#59104) - \[[`7ab13b7477`](nodejs/node@7ab13b7477)] - **test**: don't use expose internals in test-http-outgoing-buffer.js (Meghan Denny) [#59219](nodejs/node#59219) - \[[`319df3859a`](nodejs/node@319df3859a)] - **test,crypto**: skip unsupported ciphers (Shelley Vohr) [#59388](nodejs/node#59388) - \[[`713c70c32a`](nodejs/node@713c70c32a)] - **test\_runner**: remove unused callee convertion (Alex Yang) [#59221](nodejs/node#59221) - \[[`e4ca30e115`](nodejs/node@e4ca30e115)] - **tools**: disable nullability-completeness warnings (Michaël Zasso) [#59392](nodejs/node#59392) - \[[`dab7f6b542`](nodejs/node@dab7f6b542)] - **tools**: check for std::vector\<v8::Local> in lint (Aditi) [#58497](nodejs/node#58497) - \[[`7b94982eb0`](nodejs/node@7b94982eb0)] - **tools**: allow selecting test subsystems with numbers in their names (Darshan Sen) [#59242](nodejs/node#59242) - \[[`16bbcd8881`](nodejs/node@16bbcd8881)] - **typings**: improve internal binding types (Nam Yooseong) [#59351](nodejs/node#59351) - \[[`76bc4d659b`](nodejs/node@76bc4d659b)] - **typings**: improve internal binding types (Michaël Zasso) [#59176](nodejs/node#59176) - \[[`eecd3272a6`](nodejs/node@eecd3272a6)] - **worker**: add name for worker (theanarkh) [#59213](nodejs/node#59213) - \[[`84c3513ce2`](nodejs/node@84c3513ce2)] - **worker**: implements nits in Web Locks code (Antoine du Hamel) [#59270](nodejs/node#59270) - \[[`bd68fbd753`](nodejs/node@bd68fbd753)] - **worker**: add cpuUsage for worker (theanarkh) [#59177](nodejs/node#59177) - \[[`201304537e`](nodejs/node@201304537e)] - **(SEMVER-MINOR)** **zlib**: add dictionary support to zstdCompress and zstdDecompress (lluisemper) [#59240](nodejs/node#59240) </details> --- ### Configuration 📅 **Schedule**: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever MR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this MR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this MR, check this box --- This MR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate).

Notable changes: cli: * (SEMVER-MINOR) add NODE_USE_SYSTEM_CA=1 (Joyee Cheung) nodejs#59276 crypto: * (SEMVER-MINOR) support ML-DSA KeyObject, sign, and verify (Filip Skokan) nodejs#59259 fs: * (SEMVER-MINOR) port SonicBoom module to fs module as Utf8Stream (James M Snell) nodejs#58897 http: * (SEMVER-MINOR) add server.keepAliveTimeoutBuffer option (Haram Jeong) nodejs#59243 lib: * docs deprecate _http_* (Sebastian Beltran) nodejs#59293 zlib: * (SEMVER-MINOR) add dictionary support to zstdCompress and zstdDecompress (lluisemper) nodejs#59240 PR-URL: nodejs#59449 Signed-off-by: RafaelGSS <rafael.nunu@hotmail.com>

This MR contains the following updates: | Package | Update | Change | |---|---|---| | [node](https://nodejs.org) ([source](https://github.com/nodejs/node)) | minor | `24.6.0` -> `24.7.0` | MR created with the help of [el-capitano/tools/renovate-bot](https://gitlab.com/el-capitano/tools/renovate-bot). **Proposed changes to behavior should be submitted there as MRs.** --- ### Release Notes <details> <summary>nodejs/node (node)</summary> ### [`v24.7.0`](https://github.com/nodejs/node/releases/tag/v24.7.0): 2025-08-27, Version 24.7.0 (Current), @targos [Compare Source](nodejs/node@v24.6.0...v24.7.0) ##### Notable Changes ##### Post-Quantum Cryptography in `node:crypto` OpenSSL 3.5 on 24.x kicked off post-quantum cryptography efforts in Node.js by allowing use of NIST's post-quantum cryptography standards for future-proofing applications against quantum computing threats. The following post-quantum algorithms are now available in `node:crypto`: - ML-KEM (FIPS 203, Module-Lattice-Based Key-Encapsulation Mechanism Standard) through new `crypto.encapsulate()` and `crypto.decapsulate()` methods. - ML-DSA (FIPS 204, Module-Lattice-Based Digital Signature Standard) in the existing `crypto.sign()` and `crypto.verify()` methods. Contributed by Filip Skokan in [#59259](nodejs/node#59259) and [#59491](nodejs/node#59491). ##### Modern Algorithms in Web Cryptography API The second substantial [extension to the Web Cryptography API](https://wicg.github.io/webcrypto-modern-algos/) (`globalThis.crypto.subtle`) was recently accepted for incubation by WICG. The following algorithms and methods from this extension are now available in the Node.js Web Cryptography API implementation: - AES-OCB - ChaCha20-Poly1305 - ML-DSA - ML-KEM - SHA-3 - SHAKE - `subtle.getPublicKey()` - `SubtleCrypto.supports()` - ... with more coming in future releases. Contributed by Filip Skokan in [#59365](nodejs/node#59365), [#59569](nodejs/node#59569), [#59461](nodejs/node#59461), and [#59539](nodejs/node#59539). ##### Node.js execution argument support in single executable applications The single executable application configuration now supports additional fields to specify Node.js execution arguments and control how they can be extended when the application is run. - `execArgv` takes an array of strings for the execution arguments to be used. - `execArgvExtension` takes one of the following values: - `"none"`: No additional execution arguments are allowed. - `"cli"`: Additional execution arguments can be provided via a special command-line flag `--node-options="--flag1 --flag2=value"` at run time. - `"env"` (default): Additional execution arguments can be provided via the `NODE_OPTIONS` environment variable at run time. For example, with the following configuration: ```json { "main": "/path/to/bundled/script.js", "output": "/path/to/write/the/generated/blob.blob", "execArgv": ["--no-warnings"], "execArgvExtension": "cli", } ``` If the generated single executable application is named `sea`, then running: ```console sea --node-options="--max-old-space-size=4096" user-arg1 user-arg2 ``` Would be equivalent to running: ```console node --no-warnings --max-old-space-size=4096 /path/to/bundled/script.js user-arg1 user-arg2 ``` Contributed by Joyee Cheung in [#59314](nodejs/node#59314) and [#59560](nodejs/node#59560). ##### Root certificates updated to NSS 3.114 Certificates added: - TrustAsia TLS ECC Root CA - TrustAsia TLS RSA Root CA - SwissSign RSA TLS Root CA 2022 - 1 Certificates removed: - GlobalSign Root CA - Entrust.net Premium 2048 Secure Server CA - Baltimore CyberTrust Root - Comodo AAA Services root - XRamp Global CA Root - Go Daddy Class 2 CA - Starfield Class 2 CA ##### Other Notable Changes - \[[`d3afc63c44`](nodejs/node@d3afc63c44)] - **(SEMVER-MINOR)** **crypto**: add argon2() and argon2Sync() methods (Ranieri Althoff) [#50353](nodejs/node#50353) - \[[`6ae202fcdf`](nodejs/node@6ae202fcdf)] - **(SEMVER-MINOR)** **http**: add Agent.agentKeepAliveTimeoutBuffer option (Haram Jeong) [#59315](nodejs/node#59315) - \[[`dafee05358`](nodejs/node@dafee05358)] - **(SEMVER-MINOR)** **http2**: add support for raw header arrays in h2Stream.respond() (Tim Perry) [#59455](nodejs/node#59455) - \[[`8dc6f5b696`](nodejs/node@8dc6f5b696)] - **(SEMVER-MINOR)** **stream**: add brotli support to CompressionStream and DecompressionStream (Matthew Aitken) [#59464](nodejs/node#59464) ##### Commits - \[[`0fa22cbf7c`](nodejs/node@0fa22cbf7c)] - **benchmark**: calibrate config v8/serialize.js (Rafael Gonzaga) [#59586](nodejs/node#59586) - \[[`f5ece45b45`](nodejs/node@f5ece45b45)] - **benchmark**: reduce readfile-permission-enabled config (Rafael Gonzaga) [#59589](nodejs/node#59589) - \[[`8ebd4f4434`](nodejs/node@8ebd4f4434)] - **benchmark**: calibrate length of util.diff (Rafael Gonzaga) [#59588](nodejs/node#59588) - \[[`7dee3ffd14`](nodejs/node@7dee3ffd14)] - **benchmark**: reflect current OpenSSL in crypto key benchmarks (Filip Skokan) [#59459](nodejs/node#59459) - \[[`027b861ca1`](nodejs/node@027b861ca1)] - **benchmark, test**: replace CRLF variable with string literal (Lee Jiho) [#59466](nodejs/node#59466) - \[[`89dd770889`](nodejs/node@89dd770889)] - **build**: do not set `-mminimal-toc` with `clang` (Richard Lau) [#59484](nodejs/node#59484) - \[[`e13de4542f`](nodejs/node@e13de4542f)] - **child\_process**: remove unsafe array iteration (hotpineapple) [#59347](nodejs/node#59347) - \[[`89fe63551e`](nodejs/node@89fe63551e)] - **crypto**: load system CA certificates off thread (Joyee Cheung) [#59550](nodejs/node#59550) - \[[`152c5ef518`](nodejs/node@152c5ef518)] - **(SEMVER-MINOR)** **crypto**: add AES-OCB Web Cryptography algorithm (Filip Skokan) [#59539](nodejs/node#59539) - \[[`c6c418343d`](nodejs/node@c6c418343d)] - **crypto**: update root certificates to NSS 3.114 (Node.js GitHub Bot) [#59571](nodejs/node#59571) - \[[`18a2ee5b6c`](nodejs/node@18a2ee5b6c)] - **(SEMVER-MINOR)** **crypto**: support ML-KEM in Web Cryptography (Filip Skokan) [#59569](nodejs/node#59569) - \[[`72937e5144`](nodejs/node@72937e5144)] - **crypto**: require HMAC key length with SHA-3 hashes in Web Cryptography (Filip Skokan) [#59567](nodejs/node#59567) - \[[`b7383186c7`](nodejs/node@b7383186c7)] - **crypto**: fix subtle.getPublicKey error for secret type key inputs (Filip Skokan) [#59558](nodejs/node#59558) - \[[`2d05c046db`](nodejs/node@2d05c046db)] - **crypto**: return cached copies from CryptoKey algorithm and usages getters (Filip Skokan) [#59538](nodejs/node#59538) - \[[`207ffbeb07`](nodejs/node@207ffbeb07)] - **crypto**: use CryptoKey internal slots in Web Cryptography (Filip Skokan) [#59538](nodejs/node#59538) - \[[`4276516781`](nodejs/node@4276516781)] - **crypto**: normalize RsaHashedKeyParams publicExponent (Filip Skokan) [#59538](nodejs/node#59538) - \[[`14741539a7`](nodejs/node@14741539a7)] - **(SEMVER-MINOR)** **crypto**: support ML-KEM, DHKEM, and RSASVE key encapsulation mechanisms (Filip Skokan) [#59491](nodejs/node#59491) - \[[`d3afc63c44`](nodejs/node@d3afc63c44)] - **(SEMVER-MINOR)** **crypto**: add argon2() and argon2Sync() methods (Ranieri Althoff) [#50353](nodejs/node#50353) - \[[`4fe383e45a`](nodejs/node@4fe383e45a)] - **(SEMVER-MINOR)** **crypto**: support ML-DSA spki/pkcs8 key formats in Web Cryptography (Filip Skokan) [#59365](nodejs/node#59365) - \[[`a95386fbf9`](nodejs/node@a95386fbf9)] - **(SEMVER-MINOR)** **crypto**: subject some algorithms in Web Cryptography on BoringSSL absence (Filip Skokan) [#59365](nodejs/node#59365) - \[[`3f47a2fb63`](nodejs/node@3f47a2fb63)] - **(SEMVER-MINOR)** **crypto**: add ChaCha20-Poly1305 Web Cryptography algorithm (Filip Skokan) [#59365](nodejs/node#59365) - \[[`6fcce9058a`](nodejs/node@6fcce9058a)] - **(SEMVER-MINOR)** **crypto**: add subtle.getPublicKey() utility function in Web Cryptography (Filip Skokan) [#59365](nodejs/node#59365) - \[[`76cde76429`](nodejs/node@76cde76429)] - **(SEMVER-MINOR)** **crypto**: add SHA-3 Web Cryptography digest algorithms (Filip Skokan) [#59365](nodejs/node#59365) - \[[`247d017501`](nodejs/node@247d017501)] - **(SEMVER-MINOR)** **crypto**: add SHAKE Web Cryptography digest algorithms (Filip Skokan) [#59365](nodejs/node#59365) - \[[`f4fbcca5ce`](nodejs/node@f4fbcca5ce)] - **(SEMVER-MINOR)** **crypto**: add SubtleCrypto.supports feature detection in Web Cryptography (Filip Skokan) [#59365](nodejs/node#59365) - \[[`a55382214f`](nodejs/node@a55382214f)] - **(SEMVER-MINOR)** **crypto**: support ML-DSA in Web Cryptography (Filip Skokan) [#59365](nodejs/node#59365) - \[[`c38988c860`](nodejs/node@c38988c860)] - **crypto**: fix EVPKeyCtxPointer::publicCheck() (Tobias Nießen) [#59471](nodejs/node#59471) - \[[`61c3bcdc56`](nodejs/node@61c3bcdc56)] - **(SEMVER-MINOR)** **crypto**: support ML-KEM KeyObject (Filip Skokan) [#59461](nodejs/node#59461) - \[[`0821b446fb`](nodejs/node@0821b446fb)] - **deps**: update undici to 7.14.0 (Node.js GitHub Bot) [#59507](nodejs/node#59507) - \[[`b3af17c065`](nodejs/node@b3af17c065)] - **deps**: V8: cherry-pick [`7b91e3e`](nodejs/node@7b91e3e2cbaf) (Milad Fa) [#59485](nodejs/node#59485) - \[[`9b69baf146`](nodejs/node@9b69baf146)] - **deps**: V8: cherry-pick [`59d52e3`](nodejs/node@59d52e311bb1) (Milad Fa) [#59485](nodejs/node#59485) - \[[`b4f202c2f1`](nodejs/node@b4f202c2f1)] - **doc**: improve `sqlite.backup()` progress/fulfillment documentation (René) [#59598](nodejs/node#59598) - \[[`40b217a2f9`](nodejs/node@40b217a2f9)] - **doc**: clarify experimental platform vulnerability policy (Matteo Collina) [#59591](nodejs/node#59591) - \[[`cf84fffea5`](nodejs/node@cf84fffea5)] - **doc**: link to `TypedArray.from()` in signature (Aviv Keller) [#59226](nodejs/node#59226) - \[[`4bf6ed0bf5`](nodejs/node@4bf6ed0bf5)] - **doc**: fix typos in `environment_variables.md` (PhistucK) [#59536](nodejs/node#59536) - \[[`1784c35a49`](nodejs/node@1784c35a49)] - **doc**: add security incident reponse plan (Rafael Gonzaga) [#59470](nodejs/node#59470) - \[[`b962560240`](nodejs/node@b962560240)] - **doc**: clarify maxRSS unit in `process.resourceUsage()` (Alex Yang) [#59511](nodejs/node#59511) - \[[`e6a6cdb9df`](nodejs/node@e6a6cdb9df)] - **doc**: add missing Zstd strategy constants (RANDRIAMANANTENA Narindra Tiana Annaick) [#59312](nodejs/node#59312) - \[[`a6a31cb467`](nodejs/node@a6a31cb467)] - **(SEMVER-MINOR)** **doc**: compress Web Cryptography Algorithm matrix (Filip Skokan) [#59365](nodejs/node#59365) - \[[`8f8960cfcb`](nodejs/node@8f8960cfcb)] - **doc**: fix the version tls.DEFAULT\_CIPHERS was added (Allon Murienik) [#59247](nodejs/node#59247) - \[[`9e76089f1a`](nodejs/node@9e76089f1a)] - **doc**: clarify glob's exclude option behavior (hotpineapple) [#59245](nodejs/node#59245) - \[[`dd5f835af7`](nodejs/node@dd5f835af7)] - **doc**: add RafaelGSS as performance strategic lead (Rafael Gonzaga) [#59445](nodejs/node#59445) - \[[`2b7a7a525e`](nodejs/node@2b7a7a525e)] - **doc,crypto**: add supported asymmetric key types section (Filip Skokan) [#59492](nodejs/node#59492) - \[[`2fafe4c3bb`](nodejs/node@2fafe4c3bb)] - **esm**: link modules synchronously when no async loader hooks are used (Joyee Cheung) [#59519](nodejs/node#59519) - \[[`5347c4997a`](nodejs/node@5347c4997a)] - **esm**: show race error message for inner module job race (Joyee Cheung) [#59519](nodejs/node#59519) - \[[`b56d8af2fe`](nodejs/node@b56d8af2fe)] - **esm**: sync-ify module translation (Joyee Cheung) [#59453](nodejs/node#59453) - \[[`b4a23d6a69`](nodejs/node@b4a23d6a69)] - **http**: trim off brackets from IPv6 addresses with string operations (Krishnadas PC) [#59420](nodejs/node#59420) - \[[`6ae202fcdf`](nodejs/node@6ae202fcdf)] - **(SEMVER-MINOR)** **http**: add Agent.agentKeepAliveTimeoutBuffer option (Haram Jeong) [#59315](nodejs/node#59315) - \[[`dafee05358`](nodejs/node@dafee05358)] - **(SEMVER-MINOR)** **http2**: add support for raw header arrays in h2Stream.respond() (Tim Perry) [#59455](nodejs/node#59455) - \[[`b7ea39d860`](nodejs/node@b7ea39d860)] - **http2**: report sent headers object in client stream dcs (Darshan Sen) [#59419](nodejs/node#59419) - \[[`ebe9272dae`](nodejs/node@ebe9272dae)] - **inspector**: initial support websocket inspection (Shima Ryuhei) [#59404](nodejs/node#59404) - \[[`b35041c7dc`](nodejs/node@b35041c7dc)] - **inspector**: prevent propagation of promise hooks to noPromise hooks (Shima Ryuhei) [#58841](nodejs/node#58841) - \[[`fe7176d7c6`](nodejs/node@fe7176d7c6)] - **lib**: do not modify prototype deprecated asyncResource (encore) (Szymon Łągiewka) [#59518](nodejs/node#59518) - \[[`93fc80a1e2`](nodejs/node@93fc80a1e2)] - **(SEMVER-MINOR)** **lib**: refactor kSupportedAlgorithms (Filip Skokan) [#59365](nodejs/node#59365) - \[[`9a12f71ad9`](nodejs/node@9a12f71ad9)] - **lib**: simplify IPv6 checks in isLoopback() (Krishnadas) [#59375](nodejs/node#59375) - \[[`566fb04c82`](nodejs/node@566fb04c82)] - **meta**: update devcontainer to the latest schema (Aviv Keller) [#54347](nodejs/node#54347) - \[[`389a24bbff`](nodejs/node@389a24bbff)] - **module**: allow overriding linked requests for a ModuleWrap (Chengzhong Wu) [#59527](nodejs/node#59527) - \[[`7880978fe3`](nodejs/node@7880978fe3)] - **module**: correctly detect top-level await in ambiguous contexts (Shima Ryuhei) [#58646](nodejs/node#58646) - \[[`99128d9244`](nodejs/node@99128d9244)] - **node-api**: link to other programming language bindings (Chengzhong Wu) [#59516](nodejs/node#59516) - \[[`65c870e6cb`](nodejs/node@65c870e6cb)] - **node-api**: clarify enum value ABI stability (Chengzhong Wu) [#59085](nodejs/node#59085) - \[[`352d63541a`](nodejs/node@352d63541a)] - **sea**: implement execArgvExtension (Joyee Cheung) [#59560](nodejs/node#59560) - \[[`c6e3d5d98d`](nodejs/node@c6e3d5d98d)] - **(SEMVER-MINOR)** **sea**: support execArgv in sea config (Joyee Cheung) [#59314](nodejs/node#59314) - \[[`e7084df4db`](nodejs/node@e7084df4db)] - **sqlite**: add sqlite-type symbol for DatabaseSync (Alex Yang) [#59405](nodejs/node#59405) - \[[`e2b6bdc640`](nodejs/node@e2b6bdc640)] - **sqlite**: handle ?NNN parameters as positional (Edy Silva) [#59350](nodejs/node#59350) - \[[`99e4a12731`](nodejs/node@99e4a12731)] - **sqlite**: avoid useless call to FromMaybe() (Tobias Nießen) [#59490](nodejs/node#59490) - \[[`dfd4962e5f`](nodejs/node@dfd4962e5f)] - **src**: enforce assumptions in FIXED\_ONE\_BYTE\_STRING (Tobias Nießen) [#58155](nodejs/node#58155) - \[[`93a368df04`](nodejs/node@93a368df04)] - **src**: use simdjson to parse --snapshot-config (Joyee Cheung) [#59473](nodejs/node#59473) - \[[`716750fcf8`](nodejs/node@716750fcf8)] - **src**: fix order of CHECK\_NOT\_NULL/dereference (Tobias Nießen) [#59487](nodejs/node#59487) - \[[`44a8ecf8d4`](nodejs/node@44a8ecf8d4)] - **src**: assert memory calc for max-old-space-size-percentage (Asaf Federman) [#59460](nodejs/node#59460) - \[[`3462b46fca`](nodejs/node@3462b46fca)] - **src**: use simdjson::pad (0hm☘️) [#59391](nodejs/node#59391) - \[[`3e1551d845`](nodejs/node@3e1551d845)] - **src**: move shared\_ptr objects in KeyObjectData (Tobias Nießen) [#59472](nodejs/node#59472) - \[[`c022c1f85a`](nodejs/node@c022c1f85a)] - **src**: add internal GetOptionsAsFlags (Pietro Marchini) [#59138](nodejs/node#59138) - \[[`c0f08454a3`](nodejs/node@c0f08454a3)] - **src**: iterate metadata version entries with std::array (Chengzhong Wu) [#57866](nodejs/node#57866) - \[[`f87836f3ae`](nodejs/node@f87836f3ae)] - **src**: internalize `v8::ConvertableToTraceFormat` in traces (Chengzhong Wu) [#57866](nodejs/node#57866) - \[[`852b8e46d8`](nodejs/node@852b8e46d8)] - **src**: remove duplicate assignment of `O_EXCL` in node\_constants.cc (Daniel Osvaldo R) [#59049](nodejs/node#59049) - \[[`64ffde608f`](nodejs/node@64ffde608f)] - **src**: add Intel CET properties to large\_pages.S (tjuhaszrh) [#59363](nodejs/node#59363) - \[[`823dce32ec`](nodejs/node@823dce32ec)] - **src**: update OpenSSL pqc checks (Filip Skokan) [#59436](nodejs/node#59436) - \[[`8dc6f5b696`](nodejs/node@8dc6f5b696)] - **(SEMVER-MINOR)** **stream**: add brotli support to CompressionStream and DecompressionStream (Matthew Aitken) [#59464](nodejs/node#59464) - \[[`b2b8383755`](nodejs/node@b2b8383755)] - **test**: use mustSucceed in test-repl-tab-complete-import (Sohyeon Kim) [#59368](nodejs/node#59368) - \[[`e3ad5cc2c6`](nodejs/node@e3ad5cc2c6)] - **test**: skip sea tests on Linux ppc64le (Richard Lau) [#59563](nodejs/node#59563) - \[[`f78f47ca5a`](nodejs/node@f78f47ca5a)] - **test**: support standalone env comment in tests (Pietro Marchini) [#59546](nodejs/node#59546) - \[[`0e8bc2c7ac`](nodejs/node@0e8bc2c7ac)] - **test**: rename test-net-server-drop-connections-in-cluster.js to -http- (Meghan Denny) [#59532](nodejs/node#59532) - \[[`ed339580af`](nodejs/node@ed339580af)] - **test**: lazy-load internalTTy (Pietro Marchini) [#59517](nodejs/node#59517) - \[[`fe86bc6da8`](nodejs/node@fe86bc6da8)] - **test**: fix `test-setproctitle` status when `ps` is not available (Antoine du Hamel) [#59523](nodejs/node#59523) - \[[`e517792973`](nodejs/node@e517792973)] - **test**: add parseTestMetadata support (Pietro Marchini) [#59503](nodejs/node#59503) - \[[`31092972d6`](nodejs/node@31092972d6)] - **test**: update WPT for WebCryptoAPI to [`ff26d9b`](nodejs/node@ff26d9b307) (Node.js GitHub Bot) [#59497](nodejs/node#59497) - \[[`16afd103cc`](nodejs/node@16afd103cc)] - **(SEMVER-MINOR)** **test**: add Web Cryptography wrap/unwrap vectors (Filip Skokan) [#59365](nodejs/node#59365) - \[[`5598baf34e`](nodejs/node@5598baf34e)] - **(SEMVER-MINOR)** **test**: cleanup test-webcrypto-supports (Filip Skokan) [#59365](nodejs/node#59365) - \[[`e7809d6ddb`](nodejs/node@e7809d6ddb)] - **test**: make test-debug-process locale-independent (BCD1me) [#59254](nodejs/node#59254) - \[[`ca7856e73c`](nodejs/node@ca7856e73c)] - **test**: mark test-wasi-pthread as flaky (Joyee Cheung) [#59488](nodejs/node#59488) - \[[`0ecd82197f`](nodejs/node@0ecd82197f)] - **test**: split test-wasi.js (Joyee Cheung) [#59488](nodejs/node#59488) - \[[`0930c218d6`](nodejs/node@0930c218d6)] - **test**: deflake connection refused proxy tests (Joyee Cheung) [#59476](nodejs/node#59476) - \[[`7f457f886a`](nodejs/node@7f457f886a)] - **test**: use case-insensitive path checking on Windows in fs.cpSync tests (Joyee Cheung) [#59475](nodejs/node#59475) - \[[`37809115f9`](nodejs/node@37809115f9)] - **test**: add missing hasPostData in test-inspector-emit-protocol-event (Shima Ryuhei) [#59412](nodejs/node#59412) - \[[`f4722b1672`](nodejs/node@f4722b1672)] - **test**: refactor error checks to use assert.ifError/mustSucceed (Sohyeon Kim) [#59424](nodejs/node#59424) - \[[`9ff71a672d`](nodejs/node@9ff71a672d)] - **test**: fix typos (Lee Jiho) [#59330](nodejs/node#59330) - \[[`9a7700da62`](nodejs/node@9a7700da62)] - **test**: skip test-watch-mode inspect when no inspector (James M Snell) [#59440](nodejs/node#59440) - \[[`e964c4334e`](nodejs/node@e964c4334e)] - **test\_runner**: do not error when getting `fullName` of root context (René) [#59377](nodejs/node#59377) - \[[`e076f7857c`](nodejs/node@e076f7857c)] - **test\_runner**: add option to rerun only failed tests (Moshe Atlow) [#59443](nodejs/node#59443) - \[[`eb8b1939a4`](nodejs/node@eb8b1939a4)] - **test\_runner**: fix isSkipped check in junit (Sungwon) [#59414](nodejs/node#59414) - \[[`4e02ea1c52`](nodejs/node@4e02ea1c52)] - **tools**: update gyp-next to 0.20.3 (Node.js GitHub Bot) [#59603](nodejs/node#59603) - \[[`99da7fbe11`](nodejs/node@99da7fbe11)] - **tools**: avoid parsing test files twice (Pietro Marchini) [#59526](nodejs/node#59526) - \[[`9a6a8e319b`](nodejs/node@9a6a8e319b)] - **tools**: update coverage GitHub Actions to fixed version (Rich Trott) [#59512](nodejs/node#59512) - \[[`8d28236aff`](nodejs/node@8d28236aff)] - **tools**: fix return value of try\_check\_compiler (theanarkh) [#59434](nodejs/node#59434) - \[[`52ab64ec3a`](nodejs/node@52ab64ec3a)] - **tools**: bump [@eslint/plugin-kit](https://github.com/eslint/plugin-kit) from 0.3.3 to 0.3.4 in /tools/eslint (dependabot\[bot]) [#59271](nodejs/node#59271) - \[[`baa22893bb`](nodejs/node@baa22893bb)] - **typings**: add missing URLBinding methods (성우현 | Woohyun Sung) [#59468](nodejs/node#59468) - \[[`b68e0d1eca`](nodejs/node@b68e0d1eca)] - **util**: fix error's namespaced node\_modules highlighting using inspect (Ruben Bridgewater) [#59446](nodejs/node#59446) - \[[`15ae21b88a`](nodejs/node@15ae21b88a)] - **util**: add some additional error classes to `wellKnownPrototypes` (Mark S. Miller) [#59456](nodejs/node#59456) - \[[`c38b7cfa35`](nodejs/node@c38b7cfa35)] - **worker**: fix worker name with \0 (theanarkh) [#59214](nodejs/node#59214) - \[[`f54ace694a`](nodejs/node@f54ace694a)] - **worker**: add worker name to report (theanarkh) [#58935](nodejs/node#58935) </details> --- ### Configuration 📅 **Schedule**: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever MR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this MR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this MR, check this box --- This MR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate).

panva requested review from jasnell and tniessen July 28, 2025 12:49

nodejs-github-bot added the needs-ci PRs that need a full CI run. label Jul 28, 2025

panva force-pushed the crypto-pqc-keyobjects branch from 18133e1 to 2f37933 Compare July 28, 2025 12:53

This comment was marked as outdated.

Sign in to view

panva added the semver-minor PRs that contain new features and should be released in the next minor version. label Jul 28, 2025

panva force-pushed the crypto-pqc-keyobjects branch from 521deae to 7a6c57c Compare July 28, 2025 14:01

This comment was marked as outdated.

Sign in to view

panva commented Jul 28, 2025

View reviewed changes

deps/ncrypto/ncrypto.cc Outdated Show resolved Hide resolved

panva commented Jul 28, 2025

View reviewed changes

src/crypto/crypto_ml_dsa.cc Show resolved Hide resolved

panva commented Jul 28, 2025

View reviewed changes

test/parallel/test-crypto-pqc-key-objects.js Outdated Show resolved Hide resolved

panva changed the title ~~crypto: add ML-DSA and ML-KEM KeyObject support~~ crypto: add ML-DSA and ML-KEM KeyObject support, ML-DSA sign and verify Jul 28, 2025

panva force-pushed the crypto-pqc-keyobjects branch 3 times, most recently from 7c37a1c to 3c220b4 Compare July 28, 2025 18:23

panva changed the title ~~crypto: add ML-DSA and ML-KEM KeyObject support, ML-DSA sign and verify~~ crypto: support ML-DSA KeyObject, sign, and verify Jul 28, 2025

panva force-pushed the crypto-pqc-keyobjects branch from 3c220b4 to 7bd6d1e Compare July 28, 2025 18:26

panva added commit-queue-squash Add this label to instruct the Commit Queue to squash all the PR commits into the first one. and removed commit-queue-rebase Add this label to allow the Commit Queue to land a PR in several commits. labels Jul 28, 2025

panva force-pushed the crypto-pqc-keyobjects branch from 7bd6d1e to a08d556 Compare July 28, 2025 18:32

panva added the notable-change PRs with changes that should be highlighted in changelogs. label Jul 28, 2025

panva requested a review from jasnell August 3, 2025 21:36

Ethan-Arrowood approved these changes Aug 6, 2025

View reviewed changes

jasnell approved these changes Aug 6, 2025

View reviewed changes

panva added the commit-queue Add this label to land a pull request using GitHub Actions. label Aug 6, 2025

nodejs-github-bot removed the commit-queue Add this label to land a pull request using GitHub Actions. label Aug 6, 2025

nodejs-github-bot merged commit 24e28c4 into nodejs:main Aug 6, 2025
60 checks passed

panva deleted the crypto-pqc-keyobjects branch August 6, 2025 21:49

targos pushed a commit that referenced this pull request Aug 8, 2025

crypto: support ML-DSA KeyObject, sign, and verify

bb473f1

PR-URL: #59259 Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com> Reviewed-By: Ethan Arrowood <ethan@arrowood.dev> Reviewed-By: James M Snell <jasnell@gmail.com>

github-actions bot mentioned this pull request Aug 11, 2025

2025-08-12, Version 24.6.0 (Current) #59449

Merged

RafaelGSS pushed a commit that referenced this pull request Aug 12, 2025

crypto: support ML-DSA KeyObject, sign, and verify

38aedfb

PR-URL: #59259 Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com> Reviewed-By: Ethan Arrowood <ethan@arrowood.dev> Reviewed-By: James M Snell <jasnell@gmail.com>

This was referenced Aug 16, 2025

[FEATURE]: Support for post-quantum ML-DSA algorithms in JSF CycloneDX/specification#674

Open

Adds support for post-quantum ML-DSA & ML-KEM algorithms CycloneDX/specification#675

Open

panva removed the notable-change PRs with changes that should be highlighted in changelogs. label Aug 21, 2025

panva mentioned this pull request Aug 27, 2025

2025-08-27, Version 24.7.0 (Current) #59629

Merged

This comment was marked as off-topic.

Sign in to view

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Uh oh!

crypto: support ML-DSA KeyObject, sign, and verify #59259

crypto: support ML-DSA KeyObject, sign, and verify #59259

panva commented Jul 28, 2025 •

edited

Loading

Uh oh!

nodejs-github-bot commented Jul 28, 2025

Uh oh!

This comment was marked as outdated.

panva commented Jul 28, 2025

Uh oh!

This comment was marked as outdated.

Uh oh!

Uh oh!

Uh oh!

github-actions bot commented Jul 28, 2025

Uh oh!

Ethan-Arrowood left a comment

Uh oh!

Ethan-Arrowood Aug 6, 2025

Uh oh!

panva Aug 6, 2025

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Ethan-Arrowood Aug 6, 2025

Uh oh!

panva Aug 6, 2025 •

edited

Loading

Uh oh!

panva commented Aug 6, 2025

Uh oh!

Uh oh!

nodejs-github-bot commented Aug 6, 2025

Uh oh!

This comment was marked as off-topic.

Uh oh!

	if (ctx == nullptr \|\| EVP_PKEY_fromdata_init(ctx) <= 0 \|\|
	if (EVP_PKEY_fromdata_init(ctx) <= 0 \|\|

Uh oh!

crypto: support ML-DSA KeyObject, sign, and verify #59259

crypto: support ML-DSA KeyObject, sign, and verify #59259

Conversation

panva commented Jul 28, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

nodejs-github-bot commented Jul 28, 2025

Uh oh!

This comment was marked as outdated.

panva commented Jul 28, 2025

Uh oh!

This comment was marked as outdated.

Uh oh!

Uh oh!

Uh oh!

github-actions bot commented Jul 28, 2025

Uh oh!

Ethan-Arrowood left a comment

Choose a reason for hiding this comment

Uh oh!

Ethan-Arrowood Aug 6, 2025

Choose a reason for hiding this comment

Uh oh!

panva Aug 6, 2025

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Ethan-Arrowood Aug 6, 2025

Choose a reason for hiding this comment

Uh oh!

panva Aug 6, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

panva commented Aug 6, 2025

Uh oh!

Uh oh!

nodejs-github-bot commented Aug 6, 2025

Uh oh!

This comment was marked as off-topic.

Uh oh!

panva commented Jul 28, 2025 •

edited

Loading

panva Aug 6, 2025 •

edited

Loading