[pull] master from DefinitelyTyped:master

types/node/buffer.buffer.d.ts

@@ -316,11 +316,11 @@ declare module "node:buffer" {
              * such `Buffer` instances with zeroes.
              *
              * When using `Buffer.allocUnsafe()` to allocate new `Buffer` instances,
-             * allocations under 4 KiB are sliced from a single pre-allocated `Buffer`. This
-             * allows applications to avoid the garbage collection overhead of creating many
-             * individually allocated `Buffer` instances. This approach improves both
-             * performance and memory usage by eliminating the need to track and clean up as
-             * many individual `ArrayBuffer` objects.
+             * allocations less than `Buffer.poolSize >>> 1` (32KiB when default poolSize is used) are sliced
+             * from a single pre-allocated `Buffer`. This allows applications to avoid the
+             * garbage collection overhead of creating many individually allocated `Buffer`
+             * instances. This approach improves both performance and memory usage by
+             * eliminating the need to track and clean up as many individual `ArrayBuffer` objects.
              *
              * However, in the case where a developer may need to retain a small chunk of
              * memory from a pool for an indeterminate amount of time, it may be appropriate

types/node/crypto.d.ts

@@ -3742,7 +3742,7 @@ declare module "node:crypto" {
                 ciphertext: NodeJS.BufferSource,
                 sharedKeyAlgorithm: AlgorithmIdentifier | HmacImportParams | AesDerivedKeyParams | KmacImportParams,
                 extractable: boolean,
-                usages: KeyUsage[],
+                keyUsages: KeyUsage[],
             ): Promise<CryptoKey>;
             decrypt(
                 algorithm: AlgorithmIdentifier | RsaOaepParams | AesCtrParams | AesCbcParams | AeadParams,
@@ -3774,7 +3774,7 @@ declare module "node:crypto" {
                 encapsulationKey: CryptoKey,
                 sharedKeyAlgorithm: AlgorithmIdentifier | AesDerivedKeyParams | HmacImportParams | KmacImportParams,
                 extractable: boolean,
-                usages: KeyUsage[],
+                keyUsages: KeyUsage[],
             ): Promise<EncapsulatedKey>;
             encrypt(
                 algorithm: AlgorithmIdentifier | RsaOaepParams | AesCtrParams | AesCbcParams | AeadParams,

types/node/http.d.ts

@@ -175,6 +175,7 @@ declare module "node:http" {
         headers?: OutgoingHttpHeaders | readonly string[] | undefined;
         host?: string | null | undefined;
         hostname?: string | null | undefined;
+        httpValidation?: "strict" | "relaxed" | "insecure" | undefined;
         insecureHTTPParser?: boolean | undefined;
         localAddress?: string | undefined;
         localPort?: number | undefined;
@@ -254,6 +255,21 @@ declare module "node:http" {
          * @since v20.1.0
          */
         highWaterMark?: number | undefined;
+        /**
+         * Controls HTTP header value validation strictness
+         * for incoming requests. Accepted values are:
+         * * `'strict'`: Strictest validation; rejects any non-ASCII or control
+         *   characters in header values.
+         * * `'relaxed'`: Allows a limited set of non-ASCII characters in header
+         *   values, aligning with the
+         *   [Fetch specification](https://fetch.spec.whatwg.org/).
+         * * `'insecure'`: Disables all header value validation (equivalent to
+         *   `insecureHTTPParser: true`).
+         *
+         * Cannot be used together with `insecureHTTPParser`. **Default:** `'strict'`.
+         * @since v26.3.0
+         */
+        httpValidation?: "strict" | "relaxed" | "insecure" | undefined;
         /**
          * Use an insecure HTTP parser that accepts invalid HTTP headers when `true`.
          * Using the insecure parser should be avoided.

types/node/http2.d.ts

@@ -840,9 +840,12 @@ declare module "node:http2" {
          * HTTP/2 request to the connected server.
          *
          * When a `ClientHttp2Session` is first created, the socket may not yet be
-         * connected. if `clienthttp2session.request()` is called during this time, the
+         * connected. If `clienthttp2session.request()` is called during this time, the
          * actual request will be deferred until the socket is ready to go.
-         * If the `session` is closed before the actual request be executed, an `ERR_HTTP2_GOAWAY_SESSION` is thrown.
+         *
+         * If the session becomes unavailable before the request can be created, the
+         * returned stream will emit `ERR_HTTP2_GOAWAY_SESSION` or
+         * `ERR_HTTP2_INVALID_SESSION` asynchronously.
          *
          * This method is only available if `http2session.type` is equal to `http2.constants.NGHTTP2_SESSION_CLIENT`.
          *
@@ -1166,6 +1169,11 @@ declare module "node:http2" {
          * @default 128
          */
         maxHeaderListPairs?: number | undefined;
+        /**
+         * Sets the maximum number of uniq origin the sever
+         * can send via ORIGIN frames. **Default:** `128`.
+         */
+        maxOriginSetSize?: number | undefined;
         /**
          * Sets the maximum number of outstanding, unacknowledged pings.
          * @default 10

types/node/node-tests/http.ts

@@ -33,6 +33,7 @@ import * as url from "node:url";
     server = http.createServer({ ServerResponse: MyServerResponse }, reqListener);
     // TODO: add test for all remaining options
     server = http.createServer({
+        httpValidation: "insecure",
         insecureHTTPParser: true,
         keepAlive: true,
         keepAliveInitialDelay: 1000,

types/node/node-tests/http2.ts

@@ -270,6 +270,7 @@ import { URL } from "node:url";
         maxDeflateDynamicTableSize: 0,
         maxSettings: 32,
         maxSessionMemory: 10,
+        maxOriginSetSize: 128,
         maxHeaderListPairs: 128,
         maxOutstandingPings: 10,
         maxSendHeaderBlockLength: 0,

types/node/node-tests/process.ts

@@ -177,6 +177,8 @@ process.env.TZ = "test";
 {
     process.permission.has("fs.read"); // $ExpectType boolean
     process.permission.has("fs.read", "./README.md"); // $ExpectType boolean
+    process.permission.drop("fs.read");
+    process.permission.drop("fs.read", "./README.md");
 }
 
 {

types/node/package.json

@@ -1,7 +1,7 @@
 {
     "private": true,
     "name": "@types/node",
-    "version": "26.2.9999",
+    "version": "26.3.9999",
     "nonNpm": "conflict",
     "nonNpmDescription": "Node.js",
     "projects": [

types/node/process.d.ts

@@ -549,6 +549,58 @@ declare module "node:process" {
                  * @since v20.0.0
                  */
                 has(scope: string, reference?: string): boolean;
+                /**
+                 * Drops the specified permission from the current process. This operation is
+                 * **irreversible** — once a permission is dropped, it cannot be restored through
+                 * any Node.js API.
+                 *
+                 * If no reference is provided, the entire scope is dropped. For example,
+                 * `process.permission.drop('fs.read')` will revoke ALL file system read
+                 * permissions.
+                 *
+                 * When a reference is provided, only the permission for that specific resource
+                 * is dropped. For example, `process.permission.drop('fs.read', '/etc/myapp')`
+                 * will revoke read access to that directory while keeping other read
+                 * permissions intact.
+                 *
+                 * **Important:** You can only drop the exact resource that was explicitly
+                 * granted. The reference passed to `drop()` must match the original grant:
+                 *
+                 * * If a permission was granted using a wildcard (`*`), such as
+                 *   `--allow-fs-read=*`, individual paths cannot be dropped - only the entire
+                 *   scope can be dropped (by calling `drop()` without a reference).
+                 * * If a directory was granted (e.g. `--allow-fs-read=/my/folder`), you cannot
+                 *   drop access to individual files inside it. You must drop the same directory
+                 *   that was granted. Any remaining grants continue to apply.
+                 *
+                 * The available scopes are the same as [`process.permission.has()`][]:
+                 *
+                 *  `fs` - All File System (drops both read and write)
+                 * * `fs.read` - File System read operations
+                 * * `fs.write` - File System write operations
+                 * * `child` - Child process spawning operations
+                 * * `worker` - Worker thread spawning operation
+                 * * `net` - Network operations
+                 * * `inspector` - Inspector operations
+                 * * `wasi` - WASI operations
+                 * * `addon` - Native addon operations
+                 *
+                 * ```js
+                 * const fs = require('node:fs');
+                 *
+                 * // Read configuration during startup
+                 * const config = fs.readFileSync('/etc/myapp/config.json', 'utf8');
+                 *
+                 * // Drop read access to the config directory after initialization
+                 * process.permission.drop('fs.read', '/etc/myapp');
+                 *
+                 * // This will now throw ERR_ACCESS_DENIED
+                 * fs.readFileSync('/etc/myapp/config.json');
+                 * ```
+                 * @since v26.3.0
+                 * @experimental
+                 */
+                drop(scope: string, reference?: string): void;
             }
             interface ProcessReport {
                 /**