node-bin-darwin-arm64 26.5.1 → 26.7.0

package/share/man/man1/node.1

@@ -222,6 +222,17 @@ Error: connect ERR_ACCESS_DENIED Access to this API has been restricted. Use --a
 }
 .Ed
 .
+.It Fl -allow-openssl-store
+When using the Permission Model, the process will not be able to use
+OpenSSL STORE loaders by default, for example to load a private key from a
+\fB<URL>\fR passed to \fBcrypto.createPrivateKey()\fR. Attempts to do so will throw
+an \fBERR_ACCESS_DENIED\fR unless the user explicitly passes the
+\fB--allow-openssl-store\fR flag. This permission can be dropped at runtime via
+\fBpermission.drop()\fR.
+This flag grants broad authority to configured OpenSSL STORE loaders. A loader
+may access files, devices, tokens, or the network. Access performed by a loader
+is not constrained by the \fBfs.read\fR, \fBfs.write\fR, or \fBnet\fR permission scopes.
+.
 .It Fl -allow-wasi
 When using the Permission Model, the process will not be capable of creating
 any WASI instances by default.
@@ -1065,9 +1076,6 @@ node --max-old-space-size-percentage=50 index.js
 node --max-old-space-size-percentage=75 index.js
 .Ed
 .
-.It Fl -napi-modules
-This option is a no-op. It is kept for compatibility.
-.
 .It Fl -network-family-autoselection-attempt-timeout
 Sets the default value for the network family autoselection attempt timeout.
 For more information, see \fBnet.getDefaultAutoSelectFamilyAttemptTimeout()\fR.
@@ -1168,6 +1176,7 @@ developers may leverage to detect deprecated API usage.
 .It Fl -permission
 Enable the Permission Model for current process. When enabled, the
 following permissions are restricted:
+
 .Bl -bullet
 .It
 File System - manageable through
@@ -1184,12 +1193,24 @@ WASI - manageable through \fB--allow-wasi\fR flag
 Addons - manageable through \fB--allow-addons\fR flag
 .It
 FFI - manageable through \fB--allow-ffi\fR flag
+.It
+OpenSSL STORE loaders - manageable through \fB--allow-openssl-store\fR flag
 .El
 .
 .It Fl -permission-audit
-Enable audit only for the permission model. When enabled, permission checks
-are performed but access is not denied. Instead, a warning is emitted for
-each permission violation via diagnostics channel.
+Enable audit mode for the permission model. When enabled, permission checks
+are performed but access is \fBnot\fR denied — no \fBERR_ACCESS_DENIED\fR error is
+thrown. Instead, each permission violation is published through the
+\fBnode:diagnostics_channel\fR module, and execution continues normally.
+This flag does not require \fB--permission\fR to be specified. The
+\fB--allow-*\fR flags are not needed in audit mode, since no
+access is denied.
+Audit mode is useful for discovering what permissions your application
+requires before deploying with \fB--permission\fR. See the
+Permission Model documentation for the list of diagnostics channel names
+and the message format.
+If both \fB--permission\fR and \fB--permission-audit\fR are specified,
+\fB--permission\fR takes precedence and the Permission Model runs in enforce mode.
 .
 .It Fl -preserve-symlinks
 Instructs the module loader to preserve symbolic links when resolving and
@@ -1402,6 +1423,13 @@ This option may be specified multiple times to include multiple glob patterns.
 If both \fB--test-coverage-exclude\fR and \fB--test-coverage-include\fR are provided,
 files must meet \fBboth\fR criteria to be included in the coverage report.
 .
+.It Fl -test-coverage-include-all
+Includes source files that were never loaded by the test run in the coverage
+report, where they are reported as having zero coverage.
+Candidate files are searched for in the current working directory, and are
+subject to the same \fB--test-coverage-include\fR and \fB--test-coverage-exclude\fR
+filtering as the rest of the report.
+.
 .It Fl -test-coverage-lines Ns = Ns Ar threshold
 Require a minimum percent of covered lines. If code coverage does not reach
 the threshold specified, the process will exit with code \fB1\fR.
@@ -1651,8 +1679,12 @@ See \fBSSL_CERT_DIR\fR and \fBSSL_CERT_FILE\fR.
 .
 .It Fl -use-env-proxy
 When enabled, Node.js parses the \fBHTTP_PROXY\fR, \fBHTTPS_PROXY\fR and \fBNO_PROXY\fR
-environment variables during startup, and tunnels requests over the
+environment variables during startup, and routes requests through the
 specified proxy.
+Use this only with proxies that are trusted and authorized for the deployment.
+Proxy support is intended for reaching external networks through authorized
+proxy servers, for example when a firewall requires one. It is not for hiding
+traffic or evading network policy. See Built-in Proxy Support.
 This is equivalent to setting the \fBNODE_USE_ENV_PROXY=1\fR environment variable.
 When both are set, \fB--use-env-proxy\fR takes precedence.
 .
@@ -1909,6 +1941,8 @@ one is included in the list below.
 .It
 \fB--allow-net\fR
 .It
+\fB--allow-openssl-store\fR
+.It
 \fB--allow-wasi\fR
 .It
 \fB--allow-worker\fR
@@ -2033,8 +2067,6 @@ one is included in the list below.
 .It
 \fB--max-old-space-size-percentage\fR
 .It
-\fB--napi-modules\fR
-.It
 \fB--network-family-autoselection-attempt-timeout\fR
 .It
 \fB--no-addons\fR
@@ -2125,6 +2157,8 @@ one is included in the list below.
 .It
 \fB--test-coverage-functions\fR
 .It
+\fB--test-coverage-include-all\fR
+.It
 \fB--test-coverage-include\fR
 .It
 \fB--test-coverage-lines\fR
@@ -2315,8 +2349,12 @@ variable is strongly discouraged.
 .It Ev NODE_USE_ENV_PROXY Ar 1
 
 When enabled, Node.js parses the \fBHTTP_PROXY\fR, \fBHTTPS_PROXY\fR and \fBNO_PROXY\fR
-environment variables during startup, and tunnels requests over the
+environment variables during startup, and routes requests through the
 specified proxy.
+Use this only with proxies that are trusted and authorized for the deployment.
+Proxy support is intended for reaching external networks through authorized
+proxy servers, for example when a firewall requires one. It is not for hiding
+traffic or evading network policy. See Built-in Proxy Support.
 This can also be enabled using the \fB--use-env-proxy\fR command-line flag.
 When both are set, \fB--use-env-proxy\fR takes precedence.
 .