$ the-wire · showcase
Undici caps EventSource buffering, node:ffi takes plain integers
By RepoJournal · Filed · About Node.js · Composed from the cited sources · methodology
A denial-of-service hole in Undici's EventSource parser gets closed while Node's experimental FFI drops the BigInt ceremony for 64-bit arguments, and the WPT suite stops skipping tests it can now run.
fix(eventsource): enforce maxEventSize on unterminated lines (#5814) nodejs/undici
The eventSource.maxEventSize cap was only checked inside parseLine(), which runs when a line terminator arrives, so a server streaming a data: field with no CR or LF left the check unrun and consumed chunks unreclaimed. In-progress line length is now tracked during byte accumulation, closing an unbounded-buffer path toward memory exhaustion.
ffi: accept safe integer numbers for 64-bit arguments nodejs/node
int64 and uint64 arguments now accept safe integer numbers alongside bigint, so passing a buffer length no longer requires an explicit BigInt() conversion. Validation and conversion were extended across the Fast API, SharedBuffer, and generic C++ paths; uint64 accepts non-negative safe integers only.
test: run instantiateStreaming-bad-imports WPT nodejs/node
The instantiateStreaming-bad-imports WPT test was skipped after hangs with V8 11.2, caused by a compiler shutdown deadlock in NodePlatform::DrainTasks waiting on worker tasks that needed GC on the blocked main thread. Since DrainTasks now waits only for user-blocking tasks, the obsolete skip is gone.
test: honor allowed WPT promise rejections nodejs/node
Unhandled promise rejections in WPT worker paths now honor allow_uncaught_exception, with setup settings applied before nested callbacks and promise_setup settings applied when its callback runs. The deliberately-rejecting Web Locks test loses its flaky expectation, while rejection failures stay enforced in single_test mode.
feat: add Vite+ installation method nodejs/nodejs.org
The site adds Vite+ as a community installation method for Node.js, covering Windows, version selection, and shell initialization. Routine dependency and translation syncs round out the day.
