$ the-wire · showcase
NODE CORE TIGHTENS CRYPTO IN FIPS MODE, FIXES SQLITE STATEMENT LEAKS
By RepoJournal · Filed · About Node.js · Composed from the cited sources · methodology
WebCrypto's experimental XOF digests are now disabled when FIPS mode is enabled, closing a cryptographic gap, while a critical SQLite fix plugs statement lifetime management bugs that could leak resources.
The crypto team shipped a breaking change for FIPS deployments [1], disabling hand-rolled XOF digests and rejecting cSHAKE and KMAC parameters that bypass OpenSSL's FIPS provider constraints. This hardens compliance but requires applications relying on experimental crypto features to audit their code. Simultaneously, core landed a SQLite patch that replaces raw pointer management with RAII-style statement tracking [2], fixing two critical bugs: a leaked statement on `StatementSync::Create()` failure that inserted null pointers into the statements list, and tag store statements that were never tracked at all, leaving them open after `db.close()`. The test runner got a precision fix [3] that prevented tag filters from accidentally filtering out test file wrappers under process isolation, which meant no child processes ever spawned. On process infrastructure, the commit queue got a cleanup [4] removing legacy skip logic, and release tooling gained alpha prerelease tag support [5] to formalize pre-release workflows. Dependency bumps across the meeting agenda repo address a js-yaml security fix for quadratic complexity in omap duplicate key detection [6] and a brace-expansion patch [7].
Action items
- → Audit WebCrypto usage if FIPS mode is enabled and you use cSHAKE, KMAC, or experimental XOF digests nodejs/node [plan]
- → Update SQLite bindings if using statements at all, especially with process isolation or long-running databases nodejs/node [plan]
- → Verify test runner tag filtering if you use testTagFilters with process isolation nodejs/node [monitor]
References
- [1] crypto: disable non-FIPS WebCrypto paths in FIPS mode ↗ nodejs/node
- [2] sqlite: manage sqlite3_stmt lifetime with RAII ↗ nodejs/node
- [3] test_runner: do not tag-filter test file wrappers ↗ nodejs/node
- [4] tools: remove skip logic in `commit-queue.sh` ↗ nodejs/node
- [5] meta: add support for alpha prerelease tag ↗ nodejs/node
- [6] chore(deps-dev): bump js-yaml from 4.3.0 to 4.3.1 ↗ nodejs/node-meeting-agenda
- [7] chore(deps-dev): bump brace-expansion from 1.1.11 to 1.1.18 ↗ nodejs/node-meeting-agenda
