$ the-wire · showcase
OpenSSL 1.x support exits core, diagnostics_channel gets a use-after-free fix
By RepoJournal · Filed · About Node.js · Composed from the cited sources · methodology
nodejs/node spent the day deleting its OpenSSL 1.x legacy stack across deps, crypto, tests, and docs, while a dangling binding pointer in diagnostics_channel was fixed for a bug that node:sqlite made reachable from plain JavaScript.
diagnostics_channel: fix dangling binding pointer nodejs/node
Channel read its subscriber count through a raw BindingData* that was never cleared, and the null check in HasSubscribers() could never fire because the pointer was only assigned in the constructor. node:sqlite holds a strong BaseObjectPtr<Channel> for the lifetime of a Database, which is what made the use-after-free reachable from ordinary JS rather than only from native addons.
deps: remove ncrypto legacy OpenSSL backend nodejs/node
The ncrypto OpenSSL 1.x backend is gone along with its legacy dss1 digest aliases; the provider-backed path switch is renamed to NCRYPTO_USE_OPENSSL_PROVIDER. The remaining version guards are now OPENSSL_IS_BORINGSSL checks, dropping the version-adapter casts and the legacy digest-context, raw-key, seed, SM2, and RSA2 key-detail fallbacks. Anyone building against OpenSSL 1.x should expect this ...
crypto: remove legacy OpenSSL code paths nodejs/node
src/ loses its OpenSSL 1.x branches, and a real BoringSSL bug surfaced on the way out: BoringSSL does not define OPENSSL_VERSION_MAJOR, so the version guards were excluding it too, including in the shared PKCS12 parser and TLS PFX error handling. BoringSSL-only alternatives like the MAC/KMAC and OCB fallbacks are now gated explicitly instead of left in #else branches.
fix(wasm): grow analysis memory on demand (#134) nodejs/cjs-module-lexer
Dense shorthand exports emit a 12-byte result record every two source units, enough to blow past the analysis region the JS wrapper reserved and trap in Wasm. The fix bounds-checks in the Wasm allocator and grows memory on demand, and it also terminates each source at its actual length instead of one code unit past the end.
@node-core/doc-kit-legacy@1.1.1 nodejs/doc-kit
Elsewhere: @node-core/doc-kit-legacy@1.1.1 makes legacy-html builds roughly 30% faster by no longer having Shiki re-parse its themes for every code block, and test-crypto-ecb.js was deleted from core because Blowfish needs OpenSSL's legacy provider and is absent from BoringSSL.
