2026-10-14, Version 24.22.0 'Krypton' (LTS)

.github/CODEOWNERS

@@ -190,6 +190,7 @@
 # Web Standards
 /lib/internal/bootstrap/web/* @nodejs/web-standards
 /lib/internal/navigator.js @nodejs/web-standards
+/lib/internal/webidl.js @nodejs/web-standards
 /test/fixtures/wpt/ @nodejs/web-standards
 /test/wpt/ @nodejs/web-standards
 

.github/dependabot.yml

@@ -9,6 +9,11 @@ updates:
     commit-message:
       prefix: meta
     open-pull-requests-limit: 10
+    groups:
+      codeql-action:
+        applies-to: version-updates
+        patterns:
+          - github/codeql-action
 
   - package-ecosystem: npm
     directory: /tools/eslint

.github/workflows/author-ready-conflicts.yml

@@ -0,0 +1,48 @@
+name: Unlabel not-ready pull requests
+
+on:
+  schedule:
+    - cron: 15 3 * * *
+
+permissions:
+  contents: read
+
+jobs:
+  remove-label:
+    name: Remove author ready
+    if: github.repository == 'nodejs/node'
+    runs-on: ubuntu-slim
+    permissions:
+      pull-requests: write
+    steps:
+      - name: Remove the label and comment
+        env:
+          GH_TOKEN: ${{ github.token }}
+          MESSAGE: >-
+            This pull request has conflicts with its base branch, removing the
+            `author ready` label.
+
+            Please
+            [rebase](https://github.com/nodejs/node/blob/HEAD/doc/contributing/pull-requests.md#step-5-rebase)
+            your branch onto the latest base branch, resolve the conflicts
+            locally, and force-push.
+
+            Afterwards the pull request needs a fresh collaborator approval,
+            and a collaborator will add the label back once it is
+            [author ready](https://github.com/nodejs/node/blob/HEAD/doc/contributing/collaborator-guide.md#author-ready-pull-requests)
+            again.
+        run: |
+          # Requesting the mergeable field makes GitHub compute the merge state,
+          # pull requests still reported as UNKNOWN are picked up by a later run.
+          gh pr list \
+            --repo "$GITHUB_REPOSITORY" \
+            --label 'author ready' \
+            --state open \
+            --limit 100 \
+            --json number,mergeable \
+            --jq '.[] | select(.mergeable == "CONFLICTING") | .number' |
+            while read -r number; do
+              gh pr edit "$number" --repo "$GITHUB_REPOSITORY" --remove-label 'author ready'
+              printf '%s\n' "$MESSAGE" |
+                gh pr comment "$number" --repo "$GITHUB_REPOSITORY" --body-file -
+            done

.github/workflows/auto-start-ci.yml

@@ -9,7 +9,7 @@ on:
     # optimistic, it can take longer to run.
     # To understand why `schedule` is used instead of other events, refer to
     # ./doc/contributing/commit-queue.md
-    - cron: '*/5 * * * *'
+    - cron: 3/5 * * * *
 
 concurrency: ${{ github.workflow }}
 
@@ -51,7 +51,7 @@ jobs:
     runs-on: ubuntu-slim
     steps:
       - name: Install Node.js
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e  # v6.4.0
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020  # v7.0.0
         with:
           node-version: ${{ env.NODE_VERSION }}
 

.github/workflows/build-tarball.yml

@@ -41,7 +41,7 @@ jobs:
     if: github.event.pull_request.draft == false
     runs-on: ubuntu-slim
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
           persist-credentials: false
       - name: Set up Python ${{ env.PYTHON_VERSION }}
@@ -68,7 +68,7 @@ jobs:
       SCCACHE_GHA_ENABLED: ${{ github.base_ref == 'main' || github.ref_name == 'main' }}
       SCCACHE_IDLE_TIMEOUT: '0'
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
           persist-credentials: false
           sparse-checkout: .github/actions/install-clang

.github/workflows/codeql.yml

@@ -24,19 +24,21 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
+        with:
+          persist-credentials: false
 
       # Initializes the CodeQL tools for scanning.
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81  # v4.37.3
+        uses: github/codeql-action/init@b96794f015dfd88f77b49b1c93e0fa7110f94c63  # v4.38.0
         with:
           languages: ${{ matrix.language }}
           config-file: ./.github/codeql-config.yml
 
       - name: Autobuild
-        uses: github/codeql-action/autobuild@e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81  # v4.37.3
+        uses: github/codeql-action/autobuild@b96794f015dfd88f77b49b1c93e0fa7110f94c63  # v4.38.0
 
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81  # v4.37.3
+        uses: github/codeql-action/analyze@b96794f015dfd88f77b49b1c93e0fa7110f94c63  # v4.38.0
         with:
           category: /language:${{matrix.language}}

.github/workflows/commit-lint.yml

@@ -1,35 +1,56 @@
 name: First commit message adheres to guidelines
 
 on:
-  pull_request:
+  pull_request_target:
     branches:
       - main
 
 env:
   NODE_VERSION: lts/*
 
 permissions:
-  contents: read
+  pull-requests: read
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number }}
+  cancel-in-progress: true
 
 jobs:
   lint-commit-message:
+    name: lint-commit-message
     runs-on: ubuntu-slim
     steps:
-      - name: Compute number of commits in the PR
-        id: nb-of-commits
-        run: |
-          echo "plusOne=$((${{ github.event.pull_request.commits }} + 1))" >> $GITHUB_OUTPUT
-          echo "minusOne=$((${{ github.event.pull_request.commits }} - 1))" >> $GITHUB_OUTPUT
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
-        with:
-          fetch-depth: ${{ steps.nb-of-commits.outputs.plusOne }}
-          persist-credentials: false
-      - run: git reset HEAD^2
       - name: Install Node.js
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e  # v6.4.0
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020  # v7.0.0
         with:
           node-version: ${{ env.NODE_VERSION }}
-      - name: Validate commit message
-        run: |
-          echo "::add-matcher::.github/workflows/commit-lint-problem-matcher.json"
-          git rev-parse HEAD~${{ steps.nb-of-commits.outputs.minusOne }} | xargs npx -q core-validate-commit --no-validate-metadata --tap
+      - name: Validate first commit message
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3  # v9.0.0
+        with:
+          script: |
+            const { data: [commit] } = await github.rest.pulls.listCommits({
+              ...context.repo,
+              pull_number: context.issue.number,
+              per_page: 1,
+            });
+            if (!commit) {
+              throw new Error('No commits found in pull request');
+            }
+            const { exitCode, stdout, stderr } = await exec.getExecOutput('npx', [
+              '-q', '--yes', '--ignore-scripts', 'core-validate-commit@6.0.0',
+              '--no-validate-metadata', '--tap', '-',
+            ], {
+              cwd: process.env.RUNNER_TEMP,
+              input: Buffer.from(JSON.stringify([{
+                id: commit.sha,
+                message: commit.commit.message,
+                author: commit.commit.author,
+              }])),
+              silent: true,
+              ignoreReturnCode: true,
+            });
+            if (exitCode !== 0) {
+              core.setFailed(stdout + stderr || 'Commit message validation failed');
+            } else {
+              core.info('First commit message passes validation');
+            }

.github/workflows/commit-queue.yml

@@ -11,7 +11,7 @@ on:
   # be read-only, and the Action won't have access to any other repository
   # secrets, which it needs to access Jenkins API.
   schedule:
-    - cron: '*/5 * * * *'
+    - cron: 3/5 * * * *
 
 concurrency: ${{ github.workflow }}
 
@@ -28,6 +28,7 @@ jobs:
     if: github.repository == 'nodejs/node'
     runs-on: ubuntu-slim
     outputs:
+      aged_prs: ${{ steps.get_candidate_prs.outputs.aged_prs }}
       candidates: ${{ steps.get_candidate_prs.outputs.candidates }}
     steps:
       - name: Get Pull Request Candidates
@@ -50,6 +51,7 @@ jobs:
                   --search "-label:blocked")
           candidates=$(printf '%s %s\n' "$fast_track_prs" "$aged_prs" |
                   jq -r -s 'reduce .[] as $pr ([]; if index($pr) then . else . + [$pr] end) | join(" ")')
+          echo "aged_prs=$aged_prs" >> "$GITHUB_OUTPUT"
           echo "candidates=$candidates" >> "$GITHUB_OUTPUT"
         env:
           GH_TOKEN: ${{ github.token }}
@@ -64,7 +66,7 @@ jobs:
     runs-on: ubuntu-slim
     steps:
       - name: Install Node.js
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e  # v6.4.0
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020  # v7.0.0
         with:
           node-version: ${{ env.NODE_VERSION }}
 
@@ -93,6 +95,7 @@ jobs:
           curl -fsSLo "$readme" "https://github.com/${GITHUB_REPOSITORY}/raw/${GITHUB_SHA}/README.md"
 
           numbers=
+          lacks_second_approval_prs=
           # shellcheck disable=SC2086
           for pr in $CANDIDATES; do
             metadata="${RUNNER_TEMP}/metadata-${pr}.json"
@@ -139,6 +142,14 @@ jobs:
             if [ "$metadata_status" -ge 20 ] && [ "$metadata_status" -le 29 ]; then
               echo "pr ${pr} skipped, not ready to land"
               echo "reason codes: ${metadata_reason_codes}"
+              if jq -e '
+                    (.reasonCodes | index("wait-time")) and
+                    (.pullRequest.labels | index("lacks-second-approval") | not)
+                  ' "$metadata" > /dev/null; then
+                case " $AGED_PRS " in
+                  *" $pr "*) lacks_second_approval_prs="$lacks_second_approval_prs $pr" ;;
+                esac
+              fi
               continue
             fi
 
@@ -148,19 +159,36 @@ jobs:
           done
 
           numbers=$(echo "$numbers" | xargs)
+          lacks_second_approval_prs=$(echo "$lacks_second_approval_prs" | xargs)
           echo "numbers=$numbers" >> "$GITHUB_OUTPUT"
+          echo "lacks_second_approval_prs=$lacks_second_approval_prs" >> "$GITHUB_OUTPUT"
         env:
+          AGED_PRS: ${{ needs.get_candidate_prs.outputs.aged_prs }}
           CANDIDATES: ${{ needs.get_candidate_prs.outputs.candidates }}
           GH_TOKEN: ${{ github.token }}
 
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+      - name: Label Pull Requests Lacking a Second Approval
+        if: steps.get_mergeable_prs.outputs.lacks_second_approval_prs != ''
+        run: |
+          # shellcheck disable=SC2086
+          for pr in $PULL_REQUESTS; do
+            if ! gh -R "$GITHUB_REPOSITORY" pr edit "$pr" --add-label 'lacks-second-approval'; then
+              echo "::warning::Failed to add lacks-second-approval to PR ${pr}"
+            fi
+          done
+        env:
+          GH_TOKEN: ${{ secrets.GH_USER_TOKEN }}
+          PULL_REQUESTS: ${{ steps.get_mergeable_prs.outputs.lacks_second_approval_prs }}
+
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         if: steps.get_mergeable_prs.outputs.numbers != ''
         with:
           # A personal token is required because pushing with GITHUB_TOKEN will
           # prevent commits from running CI after they land. It needs
           # to be set here because `checkout` configures GitHub authentication
           # for push as well.
           token: ${{ secrets.GH_USER_TOKEN }}
+          persist-credentials: true
 
       - name: Start the Commit Queue
         if: steps.get_mergeable_prs.outputs.numbers != ''