crypto,build: drop OpenSSL 1.x and engine support by panva · Pull Request #64777 · nodejs/node

panva · 2026-07-27T11:01:57Z

Drops support for building against OpenSSL 1.x, and with it a FIPS build path that never worked. #64211 split the native crypto backends so this could be a focused follow-up.

configure now fails when --shared-openssl points at anything older than 3.0.0, instead of failing later at compile or link time. The check skips BoringSSL, whose version macros claim 1.1.1. crypto.fips is removed. It was runtime-deprecated as DEP0093 in v23.0.0 and has an automated migration. crypto.getFips() and crypto.setFips() are unaffected. --openssl-is-fips now requires --shared-openssl, since with the bundled OpenSSL it no longer has anything to configure.

--openssl-is-fips against the bundled OpenSSL never worked. openssl-fipsmodule has no dependency edge from node.gyp, so gyp emitted no rules for it and fipsinstall's input was produced by nothing. The edge was commented out in the commit that introduced the machinery and never restored. Repairing it would not help either, since OpenSSL requires a FIPS provider to be built from a release carrying a FIPS certificate, so a provider built out of the Node.js tree has no validation status regardless.

A note for reviewing the guards. The remaining legacy native paths are live BoringSSL code, not dead OpenSSL 1.x code. BoringSSL-specific paths are explicitly gated by OPENSSL_IS_BORINGSSL or NCRYPTO_USE_BORINGSSL, rather than implied by #else. Genuine OpenSSL feature-version guards remain.

The unreleased DEP0183 Runtime deprecation is reverted before DEP0183 moves directly from Documentation-only to End-of-Life. crypto.setEngine(), crypto.constants.ENGINE_METHOD_*, and the native ENGINE implementation are removed. The former clientCertEngine, privateKeyEngine, and privateKeyIdentifier TLS and HTTPS options remain recognized and throw ERR_CRYPTO_CUSTOM_ENGINE_NOT_SUPPORTED when given a non-nullish value, so engine-dependent configurations cannot be silently ignored.

Fixes: #56733
Refs: #64211
Refs: #63966
Refs: #53329
Refs: #48950
Refs: #45465
Refs: #42827
Refs: #47076
Refs: #62862
Refs: #38512

nodejs-github-bot · 2026-07-27T11:02:02Z

panva · 2026-08-23T10:18:59Z

@nodejs/tsc given the move to OpenSSL 4.x during 27.x alphas (nodejs/TSC#1869) I'd like to request an exception to the deprecation process and accelerate DEP0183 (OpenSSL engine-based APIs) on 27.x from Documentation-only straight to EOL instead of just Runtime (#63966). With OpenSSL 4.x (which drops engine support) we'd only be carrying forward engine support for the sake of shared openssl configurations and deployments that aren't using OpenSSL 4.x yet.

Signed-off-by: Filip Skokan <panva.ip@gmail.com> Assisted-by: Codex

github-actions · 2026-10-25T15:20:11Z

Platform	Number of requisites	Proportion of new derivations
`x86_64-linux`	540 -> 533 => +-7	0 / 533 = 0.0%
`aarch64-linux`	541 -> 534 => +-7	0 / 534 = 0.0%
`x86_64-darwin`	453 -> 448 => +-5	0 / 448 = 0.0%
`aarch64-darwin`	466 -> 461 => +-5	0 / 461 = 0.0%
Total	2000 -> 1976 => +-24	0 / 1976 = 0.0%

Changelog

@@ -1190,24 +1189,0 @@
-/nix/store/2pcwvmq7ncjwh905895yny10ckwcw3r2-openssl-1.1.1w (aarch64-darwin)
-/nix/store/plhjkmxg70rxd2h8kxlq3bxnvwmqc0ip-openssl-1.1.1w (aarch64-linux)
-/nix/store/676zgmak44d996pv7kh3rvqi03f2iwpn-openssl-1.1.1w (x86_64-darwin)
-/nix/store/l9agx145d89zn30rp0rhckdk3w6szc96-openssl-1.1.1w (x86_64-linux)
-/nix/store/086cqn4n4m71rlkv5y3zgzzh13r45r3a-openssl-1.1.1w-bin (aarch64-darwin)
-/nix/store/h5jijr2lrrqyg9zbvl30xc7006ndhbfw-openssl-1.1.1w-bin (aarch64-linux)
-/nix/store/8zm70jczb2mx441k4614k2zaym8z6cdg-openssl-1.1.1w-bin (x86_64-darwin)
-/nix/store/1p882fsy29dpxzw6dxryvci3s71yj3kd-openssl-1.1.1w-bin (x86_64-linux)
-/nix/store/6ak42ni4smvkwqba9gz9kxmk7rd2iz6a-openssl-1.1.1w-debug (aarch64-linux)
-/nix/store/l8j28jaz36rl7p3353bdrwmm0gqs21n7-openssl-1.1.1w-debug (x86_64-linux)
-/nix/store/gplh2jrz3m8b2czakfnzqdv5fyvicrzd-openssl-1.1.1w-dev (aarch64-darwin)
-/nix/store/4s7zhnfv63lz3kizvafg60dx47s8lj7p-openssl-1.1.1w-dev (aarch64-linux)
-/nix/store/rxqb2hml7zsqwhyyhjbjjqbl6f6y2i4q-openssl-1.1.1w-dev (x86_64-darwin)
-/nix/store/w521vxypims9pqar5s56an8l3ab8qnja-openssl-1.1.1w-dev (x86_64-linux)
-/nix/store/rv96dqrq72may8zlqrbqlpdwy4lyin3d-openssl-1.1.1w-doc (aarch64-darwin)
-/nix/store/91890x9hxv4x0a483ricphjj98gqs63a-openssl-1.1.1w-doc (aarch64-linux)
-/nix/store/r6wbq4gkwz5aaylinl9pki442wvpvza4-openssl-1.1.1w-doc (x86_64-darwin)
-/nix/store/d4ylfi8hym60qxd0d0jvj6wx3mvvnbd7-openssl-1.1.1w-doc (x86_64-linux)
-/nix/store/m1fcygfrg2qk1cngqk2khc45rw85xxps-openssl-1.1.1w-man (aarch64-darwin)
-/nix/store/psrycwnqbwwm9sdv5bwjbjgijxiicr6h-openssl-1.1.1w-man (aarch64-linux)
-/nix/store/b20wkyzpyni4j6iyrhxk2rq3mvqx59rp-openssl-1.1.1w-man (x86_64-darwin)
-/nix/store/i2shy3afinygkdn623ai487pal720bpa-openssl-1.1.1w-man (x86_64-linux)
-/nix/store/y3cl2yrgaf3gjp81blxk35nx8srabngv-openssl-1.1.1w.tar.gz (aarch64-linux)
-/nix/store/y3cl2yrgaf3gjp81blxk35nx8srabngv-openssl-1.1.1w.tar.gz (x86_64-linux)

… (DEP0183)" This reverts commit da51692.

OpenSSL removed support for engines in version 4. Remove the Node.js APIs, constants, native bindings, and implementation that depend on ENGINE. Keep recognizing the former TLS and HTTPS engine options so their use fails explicitly instead of appearing to work while being ignored. Move DEP0183 directly from Documentation-only to End-of-Life after reverting its unreleased Runtime deprecation. Signed-off-by: Filip Skokan <panva.ip@gmail.com> Assisted-by: Codex

nodejs-github-bot · 2026-10-25T16:11:35Z

CI: https://ci.nodejs.org/job/node-test-pull-request/78645/

github-actions · 2026-10-25T16:17:38Z

Platform	Number of requisites	Proportion of new derivations
`x86_64-linux`	540 -> 533 => +-7	0 / 533 = 0.0%
`aarch64-linux`	541 -> 534 => +-7	0 / 534 = 0.0%
`x86_64-darwin`	453 -> 448 => +-5	0 / 448 = 0.0%
`aarch64-darwin`	466 -> 461 => +-5	0 / 461 = 0.0%
Total	2000 -> 1976 => +-24	0 / 1976 = 0.0%

Changelog

@@ -1190,24 +1189,0 @@
-/nix/store/2pcwvmq7ncjwh905895yny10ckwcw3r2-openssl-1.1.1w (aarch64-darwin)
-/nix/store/plhjkmxg70rxd2h8kxlq3bxnvwmqc0ip-openssl-1.1.1w (aarch64-linux)
-/nix/store/676zgmak44d996pv7kh3rvqi03f2iwpn-openssl-1.1.1w (x86_64-darwin)
-/nix/store/l9agx145d89zn30rp0rhckdk3w6szc96-openssl-1.1.1w (x86_64-linux)
-/nix/store/086cqn4n4m71rlkv5y3zgzzh13r45r3a-openssl-1.1.1w-bin (aarch64-darwin)
-/nix/store/h5jijr2lrrqyg9zbvl30xc7006ndhbfw-openssl-1.1.1w-bin (aarch64-linux)
-/nix/store/8zm70jczb2mx441k4614k2zaym8z6cdg-openssl-1.1.1w-bin (x86_64-darwin)
-/nix/store/1p882fsy29dpxzw6dxryvci3s71yj3kd-openssl-1.1.1w-bin (x86_64-linux)
-/nix/store/6ak42ni4smvkwqba9gz9kxmk7rd2iz6a-openssl-1.1.1w-debug (aarch64-linux)
-/nix/store/l8j28jaz36rl7p3353bdrwmm0gqs21n7-openssl-1.1.1w-debug (x86_64-linux)
-/nix/store/gplh2jrz3m8b2czakfnzqdv5fyvicrzd-openssl-1.1.1w-dev (aarch64-darwin)
-/nix/store/4s7zhnfv63lz3kizvafg60dx47s8lj7p-openssl-1.1.1w-dev (aarch64-linux)
-/nix/store/rxqb2hml7zsqwhyyhjbjjqbl6f6y2i4q-openssl-1.1.1w-dev (x86_64-darwin)
-/nix/store/w521vxypims9pqar5s56an8l3ab8qnja-openssl-1.1.1w-dev (x86_64-linux)
-/nix/store/rv96dqrq72may8zlqrbqlpdwy4lyin3d-openssl-1.1.1w-doc (aarch64-darwin)
-/nix/store/91890x9hxv4x0a483ricphjj98gqs63a-openssl-1.1.1w-doc (aarch64-linux)
-/nix/store/r6wbq4gkwz5aaylinl9pki442wvpvza4-openssl-1.1.1w-doc (x86_64-darwin)
-/nix/store/d4ylfi8hym60qxd0d0jvj6wx3mvvnbd7-openssl-1.1.1w-doc (x86_64-linux)
-/nix/store/m1fcygfrg2qk1cngqk2khc45rw85xxps-openssl-1.1.1w-man (aarch64-darwin)
-/nix/store/psrycwnqbwwm9sdv5bwjbjgijxiicr6h-openssl-1.1.1w-man (aarch64-linux)
-/nix/store/b20wkyzpyni4j6iyrhxk2rq3mvqx59rp-openssl-1.1.1w-man (x86_64-darwin)
-/nix/store/i2shy3afinygkdn623ai487pal720bpa-openssl-1.1.1w-man (x86_64-linux)
-/nix/store/y3cl2yrgaf3gjp81blxk35nx8srabngv-openssl-1.1.1w.tar.gz (aarch64-linux)
-/nix/store/y3cl2yrgaf3gjp81blxk35nx8srabngv-openssl-1.1.1w.tar.gz (x86_64-linux)

nodejs-github-bot · 2026-10-25T17:36:56Z

CI: https://ci.nodejs.org/job/node-test-pull-request/78646/

gurgunday

lgtm

nit: static analysis showed

node/node.gyp

Lines 970 to 972 in c9879b1

    
           ['openssl_is_fips=="true"', { 
        
             'variables': { 'mkssldef_flags': ['-DOPENSSL_FIPS'] }, 
        
           }],

is now unused and can be removed

configure now fails when --shared-openssl points at OpenSSL 1.x rather than failing later at compile or link time. The check skips BoringSSL, whose version macros claim 1.1.1. Stop setting the OpenSSL 1.1 API compatibility level for bundled builds. ncrypto selects the supported API level directly. Update the assembler capability check, shared-library test matrix, package fallbacks, and internal version-number typing for the new baseline. Signed-off-by: Filip Skokan <panva.ip@gmail.com> Assisted-by: Codex PR-URL: #64777 Fixes: #56733 Refs: #64211 Refs: #63966 Refs: #53329 Refs: #48950 Refs: #45465 Refs: #42827 Refs: #47076 Refs: #62862 Refs: #38512 Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com> Reviewed-By: James M Snell <jasnell@gmail.com> Reviewed-By: Richard Lau <richard.lau@ibm.com> Reviewed-By: Gürgün Dayıoğlu <hey@gurgun.day>

panva · 2026-10-25T21:37:01Z

Landed in e20da72...a2cd8aa

Remove the OpenSSL 1.x backend and its legacy dss1 digest aliases. Rename the provider-backed path switch to NCRYPTO_USE_OPENSSL_PROVIDER and rewrite the remaining version guards as OPENSSL_IS_BORINGSSL checks. Remove version-adapter casts now that supported OpenSSL signatures are uniform. Drop legacy digest-context, raw-key, seed, signature-context, SM2, primality, and RSA2 key-detail fallbacks. Keep name-based key algorithms and capability discovery, with numeric key adapters and low-level key paths only for BoringSSL. Use the same backend split for KDFs, PKCS#1 decoding, key serialization, and provider EC/RSA key details. Gate BoringSSL-only alternatives explicitly instead of leaving them in #else branches. Signed-off-by: Filip Skokan <panva.ip@gmail.com> Assisted-by: Codex PR-URL: #64777 Fixes: #56733 Refs: #64211 Refs: #63966 Refs: #53329 Refs: #48950 Refs: #45465 Refs: #42827 Refs: #47076 Refs: #62862 Refs: #38512 Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com> Reviewed-By: James M Snell <jasnell@gmail.com> Reviewed-By: Richard Lau <richard.lau@ibm.com> Reviewed-By: Gürgün Dayıoğlu <hey@gurgun.day>

Remove the OpenSSL 1.x branches and stale version-specific assumptions from src/. BoringSSL does not define OPENSSL_VERSION_MAJOR, so the remaining version guards were excluding it as well; use OPENSSL_IS_BORINGSSL checks instead, including the shared PKCS12 parser and TLS PFX error handling. Gate BoringSSL-only alternatives explicitly instead of leaving them in #else branches, including the MAC/KMAC and OCB fallbacks. Fix the BoringSSL guard on QUIC's unsupported-backend diagnostic. Make the OpenSSL legacy-provider command-line help version-neutral. Signed-off-by: Filip Skokan <panva.ip@gmail.com> Assisted-by: Codex PR-URL: #64777 Fixes: #56733 Refs: #64211 Refs: #63966 Refs: #53329 Refs: #48950 Refs: #45465 Refs: #42827 Refs: #47076 Refs: #62862 Refs: #38512 Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com> Reviewed-By: James M Snell <jasnell@gmail.com> Reviewed-By: Richard Lau <richard.lau@ibm.com> Reviewed-By: Gürgün Dayıoğlu <hey@gurgun.day>

Delete test-crypto-ecb.js, which can no longer run anywhere: Blowfish is available only from OpenSSL's legacy provider and is absent from BoringSSL. The addon and cctest version guards become OPENSSL_IS_BORINGSSL checks. Remove legacy digest-alias coverage and unreachable OpenSSL 1.x branches. JavaScript test and benchmark gates, skip reasons, and TLS error expectations that distinguished OpenSSL 1.x from provider-backed OpenSSL now distinguish BoringSSL, including PKCS12 parsing, named DH groups, private-key serialization, RSA-PSS parameters, consolidated provider caches, FIPS availability, and empty KMAC output. Keep the CCM alternate finalization error only for BoringSSL. Provider-only test skips use version-neutral terminology or state the actual minimum OpenSSL version. Signed-off-by: Filip Skokan <panva.ip@gmail.com> Assisted-by: Codex PR-URL: #64777 Fixes: #56733 Refs: #64211 Refs: #63966 Refs: #53329 Refs: #48950 Refs: #45465 Refs: #42827 Refs: #47076 Refs: #62862 Refs: #38512 Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com> Reviewed-By: James M Snell <jasnell@gmail.com> Reviewed-By: Richard Lau <richard.lau@ibm.com> Reviewed-By: Gürgün Dayıoğlu <hey@gurgun.day>

Rename the openssl30 footnote, which marks APIs unavailable on BoringSSL rather than ones requiring OpenSSL. Remove obsolete version qualifiers from the provider and FIPS documentation, drop the "As of OpenSSL 1.1.0" anchor from the PSK size limits, and point the man1.1.1 links at man3.0. Document BoringSSL as the only backend with numeric key adapters. Signed-off-by: Filip Skokan <panva.ip@gmail.com> Assisted-by: Codex PR-URL: #64777 Fixes: #56733 Refs: #64211 Refs: #63966 Refs: #53329 Refs: #48950 Refs: #45465 Refs: #42827 Refs: #47076 Refs: #62862 Refs: #38512 Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com> Reviewed-By: James M Snell <jasnell@gmail.com> Reviewed-By: Richard Lau <richard.lau@ibm.com> Reviewed-By: Gürgün Dayıoğlu <hey@gurgun.day>

The openssl_fips_*.cnf fixtures use OpenSSL 1.x syntax, and their test branches can no longer run. Remove the fixtures and related version gates while keeping the provider-backed FIPS assertions. get_env_type() sniffed for a "-fips" version suffix that can no longer occur, and the crypto-check lint rule listed a helper that no longer exists. Signed-off-by: Filip Skokan <panva.ip@gmail.com> Assisted-by: Codex PR-URL: #64777 Fixes: #56733 Refs: #64211 Refs: #63966 Refs: #53329 Refs: #48950 Refs: #45465 Refs: #42827 Refs: #47076 Refs: #62862 Refs: #38512 Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com> Reviewed-By: James M Snell <jasnell@gmail.com> Reviewed-By: Richard Lau <richard.lau@ibm.com> Reviewed-By: Gürgün Dayıoğlu <hey@gurgun.day>

--openssl-is-fips with bundled OpenSSL never worked: the openssl-fipsmodule target had no dependency edge, so fipsinstall's input was produced by nothing. Repairing it would not help, since a FIPS provider built out of tree has no validation status. Remove the machinery and restrict --openssl-is-fips to --shared-openssl. Signed-off-by: Filip Skokan <panva.ip@gmail.com> Assisted-by: Codex PR-URL: #64777 Fixes: #56733 Refs: #64211 Refs: #63966 Refs: #53329 Refs: #48950 Refs: #45465 Refs: #42827 Refs: #47076 Refs: #62862 Refs: #38512 Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com> Reviewed-By: James M Snell <jasnell@gmail.com> Reviewed-By: Richard Lau <richard.lau@ibm.com> Reviewed-By: Gürgün Dayıoğlu <hey@gurgun.day>

Signed-off-by: Filip Skokan <panva.ip@gmail.com> Assisted-by: Codex PR-URL: #64777 Fixes: #56733 Refs: #64211 Refs: #63966 Refs: #53329 Refs: #48950 Refs: #45465 Refs: #42827 Refs: #47076 Refs: #62862 Refs: #38512 Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com> Reviewed-By: James M Snell <jasnell@gmail.com> Reviewed-By: Richard Lau <richard.lau@ibm.com> Reviewed-By: Gürgün Dayıoğlu <hey@gurgun.day>

… (DEP0183)" This reverts commit da51692. PR-URL: #64777 Fixes: #56733 Refs: #64211 Refs: #63966 Refs: #53329 Refs: #48950 Refs: #45465 Refs: #42827 Refs: #47076 Refs: #62862 Refs: #38512 Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com> Reviewed-By: James M Snell <jasnell@gmail.com> Reviewed-By: Richard Lau <richard.lau@ibm.com> Reviewed-By: Gürgün Dayıoğlu <hey@gurgun.day>

OpenSSL removed support for engines in version 4. Remove the Node.js APIs, constants, native bindings, and implementation that depend on ENGINE. Keep recognizing the former TLS and HTTPS engine options so their use fails explicitly instead of appearing to work while being ignored. Move DEP0183 directly from Documentation-only to End-of-Life after reverting its unreleased Runtime deprecation. Signed-off-by: Filip Skokan <panva.ip@gmail.com> Assisted-by: Codex PR-URL: #64777 Fixes: #56733 Refs: #64211 Refs: #63966 Refs: #53329 Refs: #48950 Refs: #45465 Refs: #42827 Refs: #47076 Refs: #62862 Refs: #38512 Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com> Reviewed-By: James M Snell <jasnell@gmail.com> Reviewed-By: Richard Lau <richard.lau@ibm.com> Reviewed-By: Gürgün Dayıoğlu <hey@gurgun.day>

Notable changes: async_hooks: * (SEMVER-MAJOR) remove legacy AsyncLocalStorage implementation (Matteo Collina) #63641 benchmark: * (SEMVER-MAJOR) protect against accidental fork bomb (James M Snell) #66132 build: * (SEMVER-MAJOR) remove the bundled FIPS provider build (Filip Skokan) #64777 * (SEMVER-MAJOR) require OpenSSL 3 or later (Filip Skokan) #64777 * (SEMVER-MAJOR) downgrade Intel macOS support to experimental (Antoine du Hamel) #65427 crypto: * (SEMVER-MAJOR) move DEP0093 to End-of-Life (Filip Skokan) #64777 * (SEMVER-MAJOR) remove legacy OpenSSL code paths (Filip Skokan) #64777 * (SEMVER-MAJOR) validate digest output encodings (Filip Skokan) #66247 * (SEMVER-MAJOR) validate update input encodings (Filip Skokan) #66247 * (SEMVER-MAJOR) validate inputEncoding in Cipher/Decipher update (Maruthan G) #66247 * (SEMVER-MAJOR) move DEP0198 to End-of-Life (Filip Skokan) #64000 * (SEMVER-MAJOR) move DEP0203 and DEP0204 to End-of-Life (Filip Skokan) #63188 * (SEMVER-MAJOR) reject resizable backing stores in Web Crypto buffer parameters (Filip Skokan) #63925 * (SEMVER-MAJOR) throw on uninitialized DH computeSecret (Filip Skokan) #63922 * (SEMVER-MAJOR) runtime-deprecate calling Hmac.digest() more than once (Madelyn) #63624 crypto,https,tls: * (SEMVER-MAJOR) end OpenSSL engine support (Filip Skokan) #64777 deps: * (SEMVER-MAJOR) update archs files for openssl-4.1.0 (Node.js GitHub Bot) #66971 * (SEMVER-MAJOR) upgrade openssl sources to openssl-4.1.0 (Node.js GitHub Bot) #66971 * (SEMVER-MAJOR) remove ncrypto legacy OpenSSL backend (Filip Skokan) #64777 * (SEMVER-MAJOR) update V8 to 15.6.75.13 (Joyee Cheung) #66601 * (SEMVER-MAJOR) update V8 to 15.5.35.20 (Joyee Cheung) #66537 * (SEMVER-MAJOR) update V8 to 15.2.124.38 (Joyee Cheung) #65161 * (SEMVER-MAJOR) upgrade npm to 12.1.0 (npm team) #66212 dgram: * (SEMVER-MAJOR) skip the custom lookup for literal IP addresses (Ruben Bridgewater) #64131 dns: * (SEMVER-MAJOR) do not consult hosts file in reverse lookups (Archkon) #64268 * (SEMVER-MAJOR) stop using deprecated functions in `SetServers` (Antoine du Hamel) #64356 doc: * (SEMVER-MAJOR) remove OpenSSL 1.x references (Filip Skokan) #64777 * (SEMVER-MAJOR) update Node.js 27 official binary toolchains (Richard Lau) #66377 domain: * (SEMVER-MAJOR) runtime-deprecate the module (Matteo Collina) #65074 * (SEMVER-MAJOR) port to AsyncLocalStorage (Matteo Collina) #61095 fs: * (SEMVER-MAJOR) implement glob natively (Aviv Keller) #65392 * (SEMVER-MAJOR) return Buffer from mkdtemp when prefix is a Buffer (Hamid Reza Ghavami) #64397 http: * (SEMVER-MAJOR) reject responses exceeding header limit (Matteo Collina) #65010 * (SEMVER-MAJOR) runtime deprecate instantiating without new (Yagiz Nizipli) #64853 * (SEMVER-MAJOR) increase keepAliveTimeout default to 65 seconds (Tim Perry) #62782 * (SEMVER-MAJOR) make req.headers have a null prototype (Matteo Collina) #62900 * (SEMVER-MAJOR) reject addTrailers after finish (Ryuhei Shima) #62832 http2: * (SEMVER-MAJOR) increase default window sizes (Matteo Collina) #64623 lib: * (SEMVER-MAJOR) deprecate _http_* (Sebastian Beltran) #58535 * (SEMVER-MAJOR) insert argv[0] at argv[1] in setDeserializeMainFunction (Daijiro Wachi) #62928 * (SEMVER-MAJOR) use `Object.freeze` to avoid defensive cloning in `SourceMap` (Daijiro Wachi) #62830 * (SEMVER-MAJOR) reject SharedArrayBuffer in Blob constructor per spec (Ali Hassan) #63046 lib,src: * (SEMVER-MAJOR) remove `--no-experimental-websocket` CLI flag (Antoine du Hamel) #65284 net: * (SEMVER-MAJOR) race family autoselection attempts (Matteo Collina) #66229 * (SEMVER-MAJOR) throw on multiple listen calls (Matteo Collina) #64871 * (SEMVER-MAJOR) runtime-deprecate Server.prototype._listen2 (Guilherme Araújo) #64794 * (SEMVER-MAJOR) add experimental net/promises API (Ethan Arrowood) #63965 repl: * (SEMVER-MAJOR) use inspector over vm (Aviv Keller) #64034 src: * (SEMVER-MAJOR) officially deprecate `node::ObjectWrap` (Anna Henningsen) #63756 * (SEMVER-MAJOR) merge `CreateEnvironment()` overloads (Anna Henningsen) #63596 src, test: src,lib: * (SEMVER-MAJOR) add --allow-env permission (James M Snell) #66132 stream: * (SEMVER-MAJOR) destroy source when map iterator closes early (Y1D7NG) #64264 test: * (SEMVER-MAJOR) fix fs write encoding coverage (Filip Skokan) #66247 test,benchmark: * (SEMVER-MAJOR) drop OpenSSL 1.x-only coverage (Filip Skokan) #64777 test,tools: * (SEMVER-MAJOR) drop OpenSSL 1.x-era FIPS leftovers (Filip Skokan) #64777 test_runner: * use AsyncLocalStorage instead of async_hooks (Matteo Collina) #66795 tls: * (SEMVER-MAJOR) move _tls_* to end-of-life (Sebastian Beltran) #60658 zlib: * (SEMVER-MAJOR) convert classes to modern syntax and eol DEP0184 (Yagiz Nizipli) #64849 PR-URL: #67062

panva requested a review from richardlau July 27, 2026 11:01

panva added the semver-major PRs that contain breaking changes and should be released in the next major version. label Jul 27, 2026

nodejs-github-bot added lib / src Issues and PRs involving general changes in the lib/ or src/ directories. needs-ci PRs that need a full CI run. labels Jul 27, 2026

panva added the commit-queue-rebase PRs the Commit Queue should land as multiple self-contained commits. label Jul 27, 2026

panva removed the request for review from richardlau July 27, 2026 11:04

panva added crypto Issues and PRs related to the crypto subsystem. tls Issues and PRs related to the tls subsystem. labels Jul 27, 2026

panva mentioned this pull request Jul 27, 2026

jenkins: adjust OpenSSL exclusions for v27.x nodejs/build#4409

Merged

panva force-pushed the drop-openssl1 branch from d072892 to 1e2b712 Compare July 27, 2026 11:32

This comment was marked as outdated.

Sign in to view

sxa mentioned this pull request Jul 27, 2026

node-test-commit-linux on 'ubuntu2404-x64' is failing since 2026-07-20 nodejs/build#4401

Closed

panva changed the title ~~crypto,build: require OpenSSL 3, remove runtime FIPS API~~ crypto,build: require OpenSSL 3, updates to runtime FIPS APIs Aug 1, 2026

panva mentioned this pull request Aug 3, 2026

src,doc: clarify OpenSSL FIPS configuration and fix crypto.setFips(0) throw #64982

Closed

panva changed the title ~~crypto,build: require OpenSSL 3, updates to runtime FIPS APIs~~ crypto,build: require OpenSSL 3, drop the bundled FIPS provider build Aug 5, 2026

panva force-pushed the drop-openssl1 branch 2 times, most recently from 92fef82 to 518c70f Compare August 5, 2026 20:11

aduh95 reviewed Aug 7, 2026

View reviewed changes

Comment thread tools/dep_updaters/update-nixpkgs-pin.sh Outdated

panva force-pushed the drop-openssl1 branch from 518c70f to fc9467a Compare August 7, 2026 08:29

panva force-pushed the drop-openssl1 branch 2 times, most recently from b9cbc63 to f8a4830 Compare August 22, 2026 11:07

anonrig approved these changes Aug 22, 2026

View reviewed changes

panva added the tsc-agenda Issues and PRs to discuss during Technical Steering Committee meetings. label Aug 23, 2026

This was referenced Aug 23, 2026

crypto: discover hashes and ciphers from providers #65484

Closed

crypto: evict getCiphers/getHashes cache on setFips/setEngine #62985

Closed

anonrig approved these changes Aug 23, 2026

View reviewed changes

openjs-meetings-bot Bot mentioned this pull request Aug 24, 2026

Node.js Technical Steering Committee (TSC) Meeting 2026-08-26 nodejs/TSC#1887

Closed

crypto: move DEP0093 to End-of-Life

6dc99e1

Signed-off-by: Filip Skokan <panva.ip@gmail.com> Assisted-by: Codex

panva force-pushed the drop-openssl1 branch from 20340ef to 9548303 Compare October 25, 2026 15:15

panva added 2 commits October 25, 2026 17:03

Revert "crypto,https,tls: runtime-deprecate OpenSSL engine-based APIs…

657ae1e

… (DEP0183)" This reverts commit da51692.

panva force-pushed the drop-openssl1 branch from 9548303 to c9879b1 Compare October 25, 2026 16:07

panva removed the blocked PRs that are blocked by other issues or PRs. label Oct 25, 2026

gurgunday approved these changes Oct 25, 2026

View reviewed changes

bjohansebas approved these changes Oct 25, 2026

View reviewed changes

anonrig approved these changes Oct 25, 2026

View reviewed changes

panva added the author ready PRs with CI started, the required approvals, and no outstanding review comments. label Oct 25, 2026

panva closed this Oct 25, 2026

panva deleted the drop-openssl1 branch October 25, 2026 21:37

panva mentioned this pull request Oct 25, 2026

build: remove unused FIPS export condition #67005

Open

RafaelGSS mentioned this pull request Oct 27, 2026

2026-10-28, Version 27.0.0-alpha.0.0.0 (Alpha) #67062

Open

Navigation Menu

Repository navigation

crypto,build: drop OpenSSL 1.x and engine support - #64777

crypto,build: drop OpenSSL 1.x and engine support#64777
panva wants to merge 10 commits into
nodejs:mainfrom
panva:drop-openssl1

panva commented Jul 27, 2026 •

edited

Loading

Uh oh!

nodejs-github-bot commented Jul 27, 2026

Uh oh!

This comment was marked as outdated.

This comment was marked as outdated.

Uh oh!

panva commented Aug 23, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Oct 25, 2026

Uh oh!

nodejs-github-bot commented Oct 25, 2026

Uh oh!

github-actions Bot commented Oct 25, 2026

Uh oh!

nodejs-github-bot commented Oct 25, 2026

Uh oh!

gurgunday left a comment

Uh oh!

panva commented Oct 25, 2026

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

9 participants

	['openssl_is_fips=="true"', {
	'variables': { 'mkssldef_flags': ['-DOPENSSL_FIPS'] },
	}],

Conversation

panva commented Jul 27, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

nodejs-github-bot commented Jul 27, 2026

Uh oh!

This comment was marked as outdated.

This comment was marked as outdated.

Uh oh!

panva commented Aug 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Oct 25, 2026

Uh oh!

nodejs-github-bot commented Oct 25, 2026

Uh oh!

github-actions Bot commented Oct 25, 2026

Uh oh!

nodejs-github-bot commented Oct 25, 2026

Uh oh!

gurgunday left a comment

Choose a reason for hiding this comment

Uh oh!

panva commented Oct 25, 2026

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

9 participants

panva commented Jul 27, 2026 •

edited

Loading

panva commented Aug 23, 2026 •

edited

Loading