http2: add session tracking and graceful server shutdown of http2 server by pandeykushagra51 · Pull Request #57586 · nodejs/node

pandeykushagra51 · 2025-03-21T22:32:27Z

This change adds proper tracking of HTTP/2 server sessions to ensure they are gracefully closed when the server is shut down. It implements:

A new kSessions symbol for tracking active sessions
Adding/removing sessions from a SafeSet in the server
A closeAllSessions helper function to properly close all active sessions
Updates to Http2Server and Http2SecureServer close methods

Breaking Change: any client trying to create new requests on existing connections will not be able to do so once server close is initiated

Fixes: #57611
Refs: https://datatracker.ietf.org/doc/html/rfc7540#section-9.1
Refs: https://nodejs.org/api/http.html#serverclosecallback

More Details:

Purpose

This PR implements proper tracking and graceful shutdown of HTTP/2 sessions when a server is closed. It addresses the gap between the documented behavior of server.close() and its actual implementation for HTTP/2 servers. Also if server have fired close, we should allow it to close as early as possible to free up system resources quickly. This change ensure that once server wants to close, goaway frame will be sent to every open session(connection) so that client get to know that server started shutdown process and client should not send any new request on existing connection.

Current Issues

Currently, HTTP/2 servers are at the mercy of clients to close connections.
There is no mechanism to notify clients that the server wants to shut down.
Misbehaving/Non-compliant clients can keep connections open indefinitely, preventing proper server shutdown.
Clients can continue to initiate new requests on existing connections even when the server is trying to close.
Start of server shutdown can starve indefinitely, leading to processes that cannot terminate cleanly and causing resource leaks.

Implementation Details

Added a kSessions symbol and SafeSet to track active HTTP/2 sessions.
Implemented session registration when sessions are created.
Created a closeAllSessions helper function to initiate graceful shutdown of all tracked sessions
Updated Http2Server and Http2SecureServer close methods to use this functionality

Behavior Clarification

According to the Node.js documentation for server.close():

server.close stops the server from accepting new connections and closes all connections connected to this server which are not sending a request or waiting for a response.

This PR ensures that HTTP/2 servers follow this behavior by:
Closing existing HTTP/2 sessions gracefully, which means:

When session.close() is called, a GOAWAY frame is sent to notify clients that the server wants to close the session
No new streams (requests) can be initiated on existing connections
Existing streams can continue writing/reading data until completion
In-flight requests will be allowed to complete
Sessions will be terminated after all active streams complete

This implementation aligns with the HTTP/2 protocol specification for connection management as described in RFC 7540 Section 9.1.

API Impact

This is technically a breaking change, as clients attempting to create new requests on existing HTTP/2 connections will be unable to do so once server.close() is called. However, this behavior now correctly matches the documented behavior for HTTP servers.

Testing

This PR includes tests to verify that HTTP/2 sessions are properly tracked and gracefully shut down when the server is closed.

Newly added test files:

test-http2-request-after-server-close.js: Verifies that after server.close() is called, clients cannot initiate new requests while existing requests are allowed to complete. Confirms the server properly terminates once all connections are closed.
test-http2-server-close-client-behavior.js: Validates that idle connections are immediately closed when server.close() is called, while connections with active streams continue processing until completion. Ensures the server terminates after all connections are properly closed.

Modified test files:

test-http2-compat-serverresponse-statusmessage-property-set.js: After server close behavior is updated, this test started to fail. The failure happened because the request from client is under pendingAck state so the session is not yet initiated, as server close is fired during this time and hence client didn't received response which leads to test failure. Now the test is updated to fire server close once the request is complete. As this unit test, test that client should receive http2 status message response, so it is good to close the server only after the request/response cycle is completed. This line tells that pending stream will be cancelled once session close is emitted.
test-http2-compat-serverresponse-statusmessage-property.js: Same as above.
test-http2-capture-rejection.js: Server close should be fired after server have sent push promise frame.

nodejs-github-bot · 2025-03-21T22:32:32Z

Review requested:

@nodejs/http2
@nodejs/net

pandeykushagra51 · 2025-03-22T20:34:34Z

This strategy is adopted in other server like Springboot (Tomcat) and golang as well for gracefull server close

pandeykushagra51 · 2025-03-22T20:39:10Z

Please review the changes, I will be very happy to work on any suggestion and any scope of improvement.

mcollina

lgtm

codecov · 2025-03-27T17:52:16Z

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 90.21%. Comparing base (af75d04) to head (90acf08).
Report is 160 commits behind head on main.

Additional details and impacted files

@@            Coverage Diff             @@
##             main   #57586      +/-   ##
==========================================
- Coverage   90.23%   90.21%   -0.02%     
==========================================
  Files         630      630              
  Lines      185055   185547     +492     
  Branches    36221    36392     +171     
==========================================
+ Hits       166984   167397     +413     
+ Misses      11043    11030      -13     
- Partials     7028     7120      +92

Files with missing lines	Coverage Δ
lib/internal/http2/core.js	`95.67% <100.00%> (+0.06%)`	⬆️

... and 80 files with indirect coverage changes

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

lpinca · 2025-03-27T20:54:32Z

A new kSessions symbol for tracking active sessions

Adding/removing sessions from a SafeSet in the server

A closeAllSessions helper function to properly close all active sessions

Updates to Http2Server and Http2SecureServer close methods

I just took a quick look, but can't all of this be done in userland? What is the advantage of doing this in core and forcing session tracking for everyone?

pandeykushagra51 · 2025-03-28T02:10:55Z

A new kSessions symbol for tracking active sessions

Adding/removing sessions from a SafeSet in the server

A closeAllSessions helper function to properly close all active sessions

Updates to Http2Server and Http2SecureServer close methods

I just took a quick look, but can't all of this be done in userland? What is the advantage of doing this in core and forcing session tracking for everyone?

No doubt that this can be done on user side as well but this feature is surely going to provide convenience to users.
In my opinion, once user call server.close(), it should be responsibility of nodejs to close the server and handle all internal things. It will be a bit unconventional to ask user to first close the server and then manually intercept all session and close session from there. The user should be free once they call server.close() and should rely on server that it can handle everything else.
Regarding tracking for everyone, we follow this approach in net and http module as well where we store data related to connection for each net server.
here is reference:

node/lib/net.js

Line 1800 in 0a91e98

this._connections = 0;

node/lib/_http_server.js

Line 519 in 0a91e98

this[kConnections] ||= new ConnectionsList();

Also this strategy is widely adopted in other server like go and springboot (tomacat).

pandeykushagra51 · 2025-03-28T02:15:27Z

It will be really helpful if someone can tell what could be possible reason for test failure? I have tried running them locally (on mac-os) and all test test passed as expected.

pandeykushagra51 · 2025-03-28T02:20:04Z

A new kSessions symbol for tracking active sessions

Adding/removing sessions from a SafeSet in the server

A closeAllSessions helper function to properly close all active sessions

Updates to Http2Server and Http2SecureServer close methods

I just took a quick look, but can't all of this be done in userland? What is the advantage of doing this in core and forcing session tracking for everyone?

Also I have seen an issue #55459 which is under triaged state, that can also be done easily once this PR is merged.
As this PR add session tracking, we would only need to iterate the connection list and just destroy the session.

pandeykushagra51 · 2025-03-28T03:16:30Z

update regarding failing test cases:

test-http2-server-close-client-behavior (macOS): The test failed because the server should ideally close once all sessions are terminated. On my local macOS machine, it passes as expected, but it fails on CI—likely due to resource constraints. The failure appears to be caused by a slight delay of around 80ms in the actual server shutdown. This indicates test flakiness rather than an issue with the server itself. To address this, I will update the test to allow some flexibility, ensuring it still passes even if the server takes an additional 200-300ms to close. This accounts for internal processes like the garbage collector, which may introduce slight delays.

test-http2-server-http1-client.js(ubuntu-24.04, ubuntu-24.04-arm): Although these tests passed locally but not sure why failing on CI, will investigate further and keep posted here

lpinca · 2025-03-28T07:24:49Z

In my opinion, once user call server.close(), it should be responsibility of nodejs to close the server and handle all internal things. It will be a bit unconventional to ask user to first close the server and then manually intercept all session and close session from there.

That's not how it works in Node.js. The close method of net.Server and tls.Server does not close active connections by design. It is user responsibility to do that.

The close method of http.Server also worked like this. In version 19.0.0, the behavior was changed to automatically close idle connections, but active connections (those that are sending a request or receiving a response) are kept open. I would be ok to align http2 to this behavior, but is there a way to find idle sessions?

Changing the close method behavior is a breaking change, and for consistency with other servers, it should not be done in my opinion. As written in the previous comment, the desired behavior can easily be achieved in userland (with the exact same code, no core changes are needed).

As for testing, if possible, do not use timers as they make the tests flaky.

pandeykushagra51 · 2025-03-28T08:06:08Z

I would be ok to align http2 to this behavior, but is there a way to find idle sessions?

In my opinion, any session which are not having any open request/stream will be referred as idle session. Please let me know your thoughts on this.

That's not how it works in Node.js. The close method of net.Server and tls.Server does not close active connections by design. It is user responsibility to do that.

Confirming the behavior again, in current changes, active sessions are not closed.

pimterry

Thanks for the contribution @pandeykushagra51!

HTTP servers server.close() nowadays does close idle connections, and personally I'd be happy for HTTP/2 servers to match that behaviour, although as a breaking change. The basic approach seems sensible to me (although note the race condition I've commented on here).

AFAICT it does seem like this PR does actually match that close-idle behaviour already (it calls session.close(), which apparently allows all pending streams to complete before closing the session) so this isn't unreasonable. That said, we do definitely need a test which calls server.close() while a request is still pending and then checks it completes OK and closes afterwards.

The current tests here need some substantial changes though I think. Most importantly: we shouldn't be using setTimeout and timing checks anywhere in here. That will make these tests very flaky (as shown by CI here) and much slower than they need to be. There's also quite complicated, it seems like they're testing a few different things and it's not exactly clear what's going on.

We should avoid depending on specific timing (by instead waiting for events, and then triggering the next step after each previous event, etc), and these tests should be simplified and/or broken into separate tests too I think. With those changes, that will probably fix the CI test failures here. You might find it useful to take a look at the HTTP & net server close tests for some examples.

pimterry · 2025-03-28T13:23:27Z

Same race condition as below. We might also need to do this before httpServerPreClose as well (needs investigation) and we should check this works for any HTTP/1 connections here too.

Hey @pimterry could you please review again

pandeykushagra51 · 2025-03-28T15:11:40Z

Thanks for the contribution @pandeykushagra51!

HTTP servers server.close() nowadays does close idle connections, and personally I'd be happy for HTTP/2 servers to match that behaviour, although as a breaking change. The basic approach seems sensible to me (although note the race condition I've commented on here).

AFAICT it does seem like this PR does actually match that close-idle behaviour already (it calls session.close(), which apparently allows all pending streams to complete before closing the session) so this isn't unreasonable. That said, we do definitely need a test which calls server.close() while a request is still pending and then checks it completes OK and closes afterwards.

The current tests here need some substantial changes though I think. Most importantly: we shouldn't be using setTimeout and timing checks anywhere in here. That will make these tests very flaky (as shown by CI here) and much slower than they need to be. There's also quite complicated, it seems like they're testing a few different things and it's not exactly clear what's going on.

We should avoid depending on specific timing (by instead waiting for events, and then triggering the next step after each previous event, etc), and these tests should be simplified and/or broken into separate tests too I think. With those changes, that will probably fix the CI test failures here. You might find it useful to take a look at the HTTP & net server close tests for some examples.

thanks a lot @pimterry for your input, I will b working on these and will update the PR as requested

lpinca · 2025-03-28T17:32:29Z

In my opinion, any session which are not having any open request/stream will be referred as idle session. Please let me know your thoughts on this.

It makes sense.

lpinca · 2025-03-28T19:37:16Z

@pandeykushagra51 can you please rebase this against main, apply the new changes and force push here instead? In this way we have all the context/comments in the same place.

pandeykushagra51 · 2025-03-28T20:05:31Z

@pandeykushagra51 can you please rebase this against main, apply the new changes and force push here instead? In this way we have all the context/comments in the same place.

done the changes, thanks for informing 🙂

This change adds proper tracking of HTTP / 2 server sessions to ensure they are gracefully closed when the server is shut down.It implements: - A new kSessions symbol for tracking active sessions - Adding/removing sessions from a SafeSet in the server - A closeAllSessions helper function to close active sessions - Updates to Http2Server and Http2SecureServer close methods Breaking Change: any client trying to create new requests on existing connections will not be able to do so once server close is initiated Refs: https://datatracker.ietf.org/doc/html/rfc7540\#section-9.1 Refs: https://nodejs.org/api/http.html\#serverclosecallback

1. Fix server shutdown race condition - Stop listening for new connections before closing existing ones - Ensure server.close() properly completes in all scenarios 2. Improve HTTP/2 tests - Replace setTimeout with event-based flow control - Simplify test logic for better readability - Add clear state tracking for event ordering - Improve assertions to verify correct shutdown sequence This eliminates a race condition where new sessions could connect between the time existing sessions are closed and the server stops listening, potentially preventing the server from fully shutting down.

nodejs-github-bot · 2025-04-14T12:54:08Z

Commit Queue failed

- Loading data for nodejs/node/pull/57586
✔  Done loading data for nodejs/node/pull/57586
----------------------------------- PR info ------------------------------------
Title      http2: add session tracking and graceful server shutdown of http2 server (#57586)
   ⚠  Could not retrieve the email or name of the PR author's from user's GitHub profile!
Branch     pandeykushagra51:http2/fix-server-close -> nodejs:main
Labels     semver-major, http2, author ready, needs-ci
Commits    7
 - http2: session tracking and graceful server close
 - fix: improve HTTP/2 server shutdown to prevent race conditions
 - http2: fix cross-platform test timing issues
 - resolved pr comments on test-http2-graceful-close.js
 - resolved pr comments on test-http2-server-close-idle-connection.js an…
 - resolved pr comments: done suggested changes from lpinca
 - resolved pr comment: updated for each loop to for...of loop
Committers 1
 - Kushagra Pandey <pandeykushagra51@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/57586
Fixes: https://github.com/nodejs/node/issues/57611
Refs: https://datatracker.ietf.org/doc/html/rfc7540#section-9.1
Refs: https://nodejs.org/api/http.html#serverclosecallback
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
Reviewed-By: Tim Perry <pimterry@gmail.com>
------------------------------ Generated metadata ------------------------------
PR-URL: https://github.com/nodejs/node/pull/57586
Fixes: https://github.com/nodejs/node/issues/57611
Refs: https://datatracker.ietf.org/doc/html/rfc7540#section-9.1
Refs: https://nodejs.org/api/http.html#serverclosecallback
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
Reviewed-By: Tim Perry <pimterry@gmail.com>
--------------------------------------------------------------------------------
   ℹ  This PR was created on Fri, 21 Mar 2025 22:32:27 GMT
   ✔  Approvals: 2
   ✔  - Matteo Collina (@mcollina) (TSC): https://github.com/nodejs/node/pull/57586#pullrequestreview-2764237901
   ✔  - Tim Perry (@pimterry): https://github.com/nodejs/node/pull/57586#pullrequestreview-2760771387
   ✘  semver-major requires at least 2 TSC approvals
   ✔  Last GitHub CI successful
   ℹ  Last Full PR CI on 2025-04-12T12:30:59Z: https://ci.nodejs.org/job/node-test-pull-request/66213/
- Querying data for job/node-test-pull-request/66213/
   ✔  Last Jenkins CI successful
--------------------------------------------------------------------------------
   ✔  Aborted `git node land` session in /home/runner/work/node/node/.ncu

https://github.com/nodejs/node/actions/runs/14446121543

pandeykushagra51 · 2025-04-14T13:36:10Z

@mcollina @pimterry seems like commit-queue CI failed due to error:
✘ semver-major requires at least 2 TSC approvals.

Please take a look

nodejs-github-bot · 2025-04-14T14:38:20Z

CI: https://ci.nodejs.org/job/node-test-pull-request/66263/ 💛

pandeykushagra51 · 2025-04-19T12:11:38Z

hey guys, could you please take a look at this, it has all CI passed and 3 approval but still not merged

pandeykushagra51 · 2025-04-19T12:11:55Z

please let me know if I need to do something here

This change adds proper tracking of HTTP / 2 server sessions to ensure they are gracefully closed when the server is shut down.It implements: - A new kSessions symbol for tracking active sessions - Adding/removing sessions from a SafeSet in the server - A closeAllSessions helper function to close active sessions - Updates to Http2Server and Http2SecureServer close methods Breaking Change: any client trying to create new requests on existing connections will not be able to do so once server close is initiated Refs: https://datatracker.ietf.org/doc/html/rfc7540\#section-9.1 Refs: https://nodejs.org/api/http.html\#serverclosecallback - improve HTTP/2 server shutdown to prevent race conditions 1. Fix server shutdown race condition - Stop listening for new connections before closing existing ones - Ensure server.close() properly completes in all scenarios 2. Improve HTTP/2 tests - Replace setTimeout with event-based flow control - Simplify test logic for better readability - Add clear state tracking for event ordering - Improve assertions to verify correct shutdown sequence This eliminates a race condition where new sessions could connect between the time existing sessions are closed and the server stops listening, potentially preventing the server from fully shutting down. - fix cross-platform test timing issues Fix test-http2-server-http1-client.js failure on Ubuntu by deferring server.close() to next event loop cycle. The issue only affected Ubuntu where session close occurs before error emission, causing the test to miss errors when HTTP/1 clients connect to HTTP/2 servers. Using setImmediate() ensures error events fire before server close across all platforms while maintaining recent session handling improvements. PR-URL: #57586 Fixes: #57611 Refs: https://datatracker.ietf.org/doc/html/rfc7540#section-9.1 Refs: https://nodejs.org/api/http.html#serverclosecallback Reviewed-By: Matteo Collina <matteo.collina@gmail.com> Reviewed-By: Tim Perry <pimterry@gmail.com> Reviewed-By: James M Snell <jasnell@gmail.com>

jasnell · 2025-04-19T17:17:32Z

Landed in 609df89

pandeykushagra51 · 2025-04-19T17:41:30Z

thanks @mcollina @lpinca @pimterry @jasnell for all your constructive feedback. It was great learning while working on this 😄.

This change adds proper tracking of HTTP / 2 server sessions to ensure they are gracefully closed when the server is shut down.It implements: - A new kSessions symbol for tracking active sessions - Adding/removing sessions from a SafeSet in the server - A closeAllSessions helper function to close active sessions - Updates to Http2Server and Http2SecureServer close methods Breaking Change: any client trying to create new requests on existing connections will not be able to do so once server close is initiated Refs: https://datatracker.ietf.org/doc/html/rfc7540\#section-9.1 Refs: https://nodejs.org/api/http.html\#serverclosecallback - improve HTTP/2 server shutdown to prevent race conditions 1. Fix server shutdown race condition - Stop listening for new connections before closing existing ones - Ensure server.close() properly completes in all scenarios 2. Improve HTTP/2 tests - Replace setTimeout with event-based flow control - Simplify test logic for better readability - Add clear state tracking for event ordering - Improve assertions to verify correct shutdown sequence This eliminates a race condition where new sessions could connect between the time existing sessions are closed and the server stops listening, potentially preventing the server from fully shutting down. - fix cross-platform test timing issues Fix test-http2-server-http1-client.js failure on Ubuntu by deferring server.close() to next event loop cycle. The issue only affected Ubuntu where session close occurs before error emission, causing the test to miss errors when HTTP/1 clients connect to HTTP/2 servers. Using setImmediate() ensures error events fire before server close across all platforms while maintaining recent session handling improvements. PR-URL: #57586 Fixes: #57611 Refs: https://datatracker.ietf.org/doc/html/rfc7540#section-9.1 Refs: https://nodejs.org/api/http.html#serverclosecallback Reviewed-By: Matteo Collina <matteo.collina@gmail.com> Reviewed-By: Tim Perry <pimterry@gmail.com> Reviewed-By: James M Snell <jasnell@gmail.com>

Semver-Major Commits: assert,util: * (SEMVER-MAJOR) Revert "assert,util: revert recursive breaking change (Ruben Bridgewater) #57622 buffer: * (SEMVER-MAJOR) move SlowBuffer to EOL (James M Snell) #58008 * (SEMVER-MAJOR) make `buflen` in integer range (zhenweijin) #51821 build: * (SEMVER-MAJOR) downgrade armv7 support to experimental (Michaël Zasso) #58071 * (SEMVER-MAJOR) bump supported macOS version to 13.5 (Michaël Zasso) #57115 * (SEMVER-MAJOR) increase minimum Xcode version to 16.1 (Michaël Zasso) #56824 * (SEMVER-MAJOR) link V8 with atomic library (Michaël Zasso) #55014 * (SEMVER-MAJOR) remove support for ppc 32-bit (Michaël Zasso) #55014 * (SEMVER-MAJOR) reset embedder string to "-node.0" (Michaël Zasso) #55014 child_process: * (SEMVER-MAJOR) deprecate passing `args` to `spawn` and `execFile` (Daniel Venable) #57199 deps: * (SEMVER-MAJOR) V8: cherry-pick f915fa4c9f41 (Olivier Flückiger) #55014 * (SEMVER-MAJOR) V8: cherry-pick 0d5d6e71bbb0 (Yagiz Nizipli) #55014 * (SEMVER-MAJOR) V8: cherry-pick 0c11feeeca4a (Michaël Zasso) #55014 * (SEMVER-MAJOR) define V8_PRESERVE_MOST as no-op on Windows (Stefan Stojanovic) #55014 * (SEMVER-MAJOR) always define V8_NODISCARD as no-op (Michaël Zasso) #55014 * (SEMVER-MAJOR) fix FP16 bitcasts.h (Stefan Stojanovic) #55014 * (SEMVER-MAJOR) patch V8 to support compilation with MSVC (StefanStojanovic) #55014 * (SEMVER-MAJOR) patch V8 to avoid duplicated zlib symbol (Michaël Zasso) #55014 * (SEMVER-MAJOR) disable V8 concurrent sparkplug compilation (Michaël Zasso) #55014 * (SEMVER-MAJOR) always define V8_EXPORT_PRIVATE as no-op (Michaël Zasso) #55014 * (SEMVER-MAJOR) update V8 to 13.0.245.25 (Michaël Zasso) #55014 * (SEMVER-MAJOR) upgrade npm to 11.0.0 (npm team) #56274 * (SEMVER-MAJOR) update undici to 7.0.0 (Node.js GitHub Bot) #56070 fs: * (SEMVER-MAJOR) remove ability to call truncate with fd (Yagiz Nizipli) #57567 * (SEMVER-MAJOR) deprecate passing invalid types in `fs.existsSync` (Carlos Espa) #55753 * (SEMVER-MAJOR) runtime deprecate `fs.F_OK`, `fs.R_OK`, `fs.W_OK`, `fs.X_OK` (Livia Medeiros) #49686 * (SEMVER-MAJOR) remove `dirent.path` (Antoine du Hamel) #55548 http: * (SEMVER-MAJOR) remove outgoingmessage _headers and _headersList (Yagiz Nizipli) #57551 http2: * (SEMVER-MAJOR) session tracking and graceful server close (Kushagra Pandey) #57586 lib: * (SEMVER-MAJOR) remove obsolete Cipher export (James M Snell) #57266 * (SEMVER-MAJOR) unexpose six process bindings (Michaël Zasso) #57149 * (SEMVER-MAJOR) make ALS default to AsyncContextFrame (Stephen Belanger) #55552 * (SEMVER-MAJOR) runtime deprecate SlowBuffer (Rafael Gonzaga) #55175 net: * (SEMVER-MAJOR) make _setSimultaneousAccepts() end-of-life deprecated (Yagiz Nizipli) #57550 readline: * (SEMVER-MAJOR) add stricter validation for functions called after closed (Dario Piotrowicz) #57680 * (SEMVER-MAJOR) fix unicode line separators being ignored (Dario Piotrowicz) #57591 repl: * (SEMVER-MAJOR) runtime deprecate instantiating without new (Aviv Keller) #54869 src: * (SEMVER-MAJOR) update GetForegroundTaskRunner override (Etienne Pierre-doray) #55014 * (SEMVER-MAJOR) update NODE_MODULE_VERSION to 134 (Michaël Zasso) #55014 * (SEMVER-MAJOR) drop --experimental-permission in favour of --permission (Rafael Gonzaga) #56240 * (SEMVER-MAJOR) add async context frame to AsyncResource (Gerhard Stöbich) #56082 * (SEMVER-MAJOR) nuke deprecated and un-used enum members in `OptionEnvvarSettings` (Juan José) #53079 stream: * (SEMVER-MAJOR) catch and forward error from dest.write (jakecastelli) #55270 test: * (SEMVER-MAJOR) disable fast API call count checks (Michaël Zasso) #55014 test_runner: * (SEMVER-MAJOR) remove promises returned by t.test() (Colin Ihrig) #56664 * (SEMVER-MAJOR) remove promises returned by test() (Colin Ihrig) #56664 * (SEMVER-MAJOR) automatically wait for subtests to finish (Colin Ihrig) #56664 timers: * (SEMVER-MAJOR) check for immediate instance in clearImmediate (Gürgün Dayıoğlu) #57069 * (SEMVER-MAJOR) set several methods EOL (Yagiz Nizipli) #56966 tls: * (SEMVER-MAJOR) remove deprecated tls.createSecurePair (Jonas) #57361 * (SEMVER-MAJOR) make server.prototype.setOptions end-of-life (Yagiz Nizipli) #57339 tools: * (SEMVER-MAJOR) update V8 gypfiles for 13.0 (Michaël Zasso) #55014 url: * (SEMVER-MAJOR) expose urlpattern as global (Jonas) #56950 * (SEMVER-MAJOR) runtime deprecate url.parse (Yagiz Nizipli) #55017 zlib: * (SEMVER-MAJOR) deprecate classes usage without `new` (Yagiz Nizipli) #55718 PR-URL: #57609 Signed-off-by: RafaelGSS <rafael.nunu@hotmail.com>

This change adds proper tracking of HTTP / 2 server sessions to ensure they are gracefully closed when the server is shut down.It implements: - A new kSessions symbol for tracking active sessions - Adding/removing sessions from a SafeSet in the server - A closeAllSessions helper function to close active sessions - Updates to Http2Server and Http2SecureServer close methods Breaking Change: any client trying to create new requests on existing connections will not be able to do so once server close is initiated Refs: https://datatracker.ietf.org/doc/html/rfc7540\#section-9.1 Refs: https://nodejs.org/api/http.html\#serverclosecallback - improve HTTP/2 server shutdown to prevent race conditions 1. Fix server shutdown race condition - Stop listening for new connections before closing existing ones - Ensure server.close() properly completes in all scenarios 2. Improve HTTP/2 tests - Replace setTimeout with event-based flow control - Simplify test logic for better readability - Add clear state tracking for event ordering - Improve assertions to verify correct shutdown sequence This eliminates a race condition where new sessions could connect between the time existing sessions are closed and the server stops listening, potentially preventing the server from fully shutting down. - fix cross-platform test timing issues Fix test-http2-server-http1-client.js failure on Ubuntu by deferring server.close() to next event loop cycle. The issue only affected Ubuntu where session close occurs before error emission, causing the test to miss errors when HTTP/1 clients connect to HTTP/2 servers. Using setImmediate() ensures error events fire before server close across all platforms while maintaining recent session handling improvements. PR-URL: #57586 Fixes: #57611 Refs: https://datatracker.ietf.org/doc/html/rfc7540#section-9.1 Refs: https://nodejs.org/api/http.html#serverclosecallback Reviewed-By: Matteo Collina <matteo.collina@gmail.com> Reviewed-By: Tim Perry <pimterry@gmail.com> Reviewed-By: James M Snell <jasnell@gmail.com>

Semver-Major Commits: assert,util: * (SEMVER-MAJOR) Revert "assert,util: revert recursive breaking change (Ruben Bridgewater) #57622 buffer: * (SEMVER-MAJOR) move SlowBuffer to EOL (James M Snell) #58008 * (SEMVER-MAJOR) make `buflen` in integer range (zhenweijin) #51821 build: * (SEMVER-MAJOR) update list of installed cppgc headers (Michaël Zasso) #58070 * (SEMVER-MAJOR) fix V8 TLS config for shared lib builds (Michaël Zasso) #58070 * (SEMVER-MAJOR) pass `-fPIC` to linker as well for shared builds (Michaël Zasso) #58070 * (SEMVER-MAJOR) add `/bigobj` to compile V8 on Windows (Michaël Zasso) #58070 * (SEMVER-MAJOR) enable shared RO heap with ptr compression (Michaël Zasso) #58070 * (SEMVER-MAJOR) remove support for s390 32-bit (Richard Lau) #58070 * (SEMVER-MAJOR) reset embedder string to "-node.0" (Michaël Zasso) #58070 * (SEMVER-MAJOR) downgrade armv7 support to experimental (Michaël Zasso) #58071 * (SEMVER-MAJOR) bump supported macOS version to 13.5 (Michaël Zasso) #57115 * (SEMVER-MAJOR) increase minimum Xcode version to 16.1 (Michaël Zasso) #56824 * (SEMVER-MAJOR) link V8 with atomic library (Michaël Zasso) #55014 * (SEMVER-MAJOR) remove support for ppc 32-bit (Michaël Zasso) #55014 * (SEMVER-MAJOR) reset embedder string to "-node.0" (Michaël Zasso) #55014 build,src,tools: * (SEMVER-MAJOR) adapt build config for V8 13.3 (Michaël Zasso) #58070 child_process: * (SEMVER-MAJOR) deprecate passing `args` to `spawn` and `execFile` (Daniel Venable) #57199 deps: * (SEMVER-MAJOR) remove deps/simdutf (Michaël Zasso) #58070 * (SEMVER-MAJOR) V8: backport 954187bb1b87 (Joyee Cheung) #58070 * (SEMVER-MAJOR) patch V8 to support compilation with MSVC (StefanStojanovic) #58070 * (SEMVER-MAJOR) always define V8_EXPORT_PRIVATE as no-op (Michaël Zasso) #58070 * (SEMVER-MAJOR) disable V8 concurrent sparkplug compilation (Michaël Zasso) #58070 * (SEMVER-MAJOR) use std::map in MSVC STL for EphemeronRememberedSet (Joyee Cheung) #58070 * (SEMVER-MAJOR) patch V8 for illumos (Dan McDonald) #58070 * (SEMVER-MAJOR) remove problematic comment from v8-internal (Michaël Zasso) #58070 * (SEMVER-MAJOR) define V8_PRESERVE_MOST as no-op on Windows (Stefan Stojanovic) #58070 * (SEMVER-MAJOR) fix FP16 bitcasts.h (Stefan Stojanovic) #58070 * (SEMVER-MAJOR) patch V8 to avoid duplicated zlib symbol (Michaël Zasso) #58070 * (SEMVER-MAJOR) update V8 to 13.6.233.8 (Michaël Zasso) #58070 * (SEMVER-MAJOR) V8: cherry-pick f915fa4c9f41 (Olivier Flückiger) #55014 * (SEMVER-MAJOR) V8: cherry-pick 0d5d6e71bbb0 (Yagiz Nizipli) #55014 * (SEMVER-MAJOR) V8: cherry-pick 0c11feeeca4a (Michaël Zasso) #55014 * (SEMVER-MAJOR) define V8_PRESERVE_MOST as no-op on Windows (Stefan Stojanovic) #55014 * (SEMVER-MAJOR) always define V8_NODISCARD as no-op (Michaël Zasso) #55014 * (SEMVER-MAJOR) fix FP16 bitcasts.h (Stefan Stojanovic) #55014 * (SEMVER-MAJOR) patch V8 to support compilation with MSVC (StefanStojanovic) #55014 * (SEMVER-MAJOR) patch V8 to avoid duplicated zlib symbol (Michaël Zasso) #55014 * (SEMVER-MAJOR) disable V8 concurrent sparkplug compilation (Michaël Zasso) #55014 * (SEMVER-MAJOR) always define V8_EXPORT_PRIVATE as no-op (Michaël Zasso) #55014 * (SEMVER-MAJOR) update V8 to 13.0.245.25 (Michaël Zasso) #55014 * (SEMVER-MAJOR) upgrade npm to 11.0.0 (npm team) #56274 * (SEMVER-MAJOR) update undici to 7.0.0 (Node.js GitHub Bot) #56070 fs: * (SEMVER-MAJOR) remove ability to call truncate with fd (Yagiz Nizipli) #57567 * (SEMVER-MAJOR) deprecate passing invalid types in `fs.existsSync` (Carlos Espa) #55753 * (SEMVER-MAJOR) runtime deprecate `fs.F_OK`, `fs.R_OK`, `fs.W_OK`, `fs.X_OK` (Livia Medeiros) #49686 * (SEMVER-MAJOR) remove `dirent.path` (Antoine du Hamel) #55548 http: * (SEMVER-MAJOR) remove outgoingmessage _headers and _headersList (Yagiz Nizipli) #57551 http2: * (SEMVER-MAJOR) session tracking and graceful server close (Kushagra Pandey) #57586 lib: * (SEMVER-MAJOR) remove obsolete Cipher export (James M Snell) #57266 * (SEMVER-MAJOR) unexpose six process bindings (Michaël Zasso) #57149 * (SEMVER-MAJOR) make ALS default to AsyncContextFrame (Stephen Belanger) #55552 * (SEMVER-MAJOR) runtime deprecate SlowBuffer (Rafael Gonzaga) #55175 net: * (SEMVER-MAJOR) make _setSimultaneousAccepts() end-of-life deprecated (Yagiz Nizipli) #57550 readline: * (SEMVER-MAJOR) add stricter validation for functions called after closed (Dario Piotrowicz) #57680 * (SEMVER-MAJOR) fix unicode line separators being ignored (Dario Piotrowicz) #57591 repl: * (SEMVER-MAJOR) runtime deprecate instantiating without new (Aviv Keller) #54869 src: * (SEMVER-MAJOR) use non-deprecated WriteUtf8V2() method (Yagiz Nizipli) #58070 * (SEMVER-MAJOR) use non-deprecated Utf8LengthV2() method (Yagiz Nizipli) #58070 * (SEMVER-MAJOR) use V8-owned CppHeap (Joyee Cheung) #58070 * (SEMVER-MAJOR) use `v8::ExternalMemoryAccounter` (Michaël Zasso) #58070 * (SEMVER-MAJOR) replace uses of FastApiTypedArray (Michaël Zasso) #58070 * (SEMVER-MAJOR) update NODE_MODULE_VERSION to 137 (Michaël Zasso) #58070 * (SEMVER-MAJOR) update GetForegroundTaskRunner override (Etienne Pierre-doray) #55014 * (SEMVER-MAJOR) update NODE_MODULE_VERSION to 134 (Michaël Zasso) #55014 * (SEMVER-MAJOR) drop --experimental-permission in favour of --permission (Rafael Gonzaga) #56240 * (SEMVER-MAJOR) add async context frame to AsyncResource (Gerhard Stöbich) #56082 * (SEMVER-MAJOR) nuke deprecated and un-used enum members in `OptionEnvvarSettings` (Juan José) #53079 src,test: * (SEMVER-MAJOR) unregister the isolate after disposal and before freeing (Joyee Cheung) #58070 * (SEMVER-MAJOR) add V8 API to test the hash seed (Michaël Zasso) #58070 stream: * (SEMVER-MAJOR) catch and forward error from dest.write (jakecastelli) #55270 test: * (SEMVER-MAJOR) fix test-fs-write for V8 13.6 (Michaël Zasso) #58070 * (SEMVER-MAJOR) handle explicit resource management globals (Michaël Zasso) #58070 * (SEMVER-MAJOR) adapt assert tests to stack trace changes (Michaël Zasso) #58070 * (SEMVER-MAJOR) update test-linux-perf-logger (Michaël Zasso) #58070 * (SEMVER-MAJOR) Revert "test: disable fast API call count checks (Michaël Zasso) #58070 * (SEMVER-MAJOR) disable fast API call count checks (Michaël Zasso) #55014 test_runner: * (SEMVER-MAJOR) remove promises returned by t.test() (Colin Ihrig) #56664 * (SEMVER-MAJOR) remove promises returned by test() (Colin Ihrig) #56664 * (SEMVER-MAJOR) automatically wait for subtests to finish (Colin Ihrig) #56664 timers: * (SEMVER-MAJOR) check for immediate instance in clearImmediate (Gürgün Dayıoğlu) #57069 * (SEMVER-MAJOR) set several methods EOL (Yagiz Nizipli) #56966 tls: * (SEMVER-MAJOR) remove deprecated tls.createSecurePair (Jonas) #57361 * (SEMVER-MAJOR) make server.prototype.setOptions end-of-life (Yagiz Nizipli) #57339 tools: * (SEMVER-MAJOR) update V8 gypfiles for 13.6 (Michaël Zasso) #58070 * (SEMVER-MAJOR) update V8 gypfiles for 13.5 (Michaël Zasso) #58070 * (SEMVER-MAJOR) update license-builder and LICENSE for V8 deps (Michaël Zasso) #58070 * (SEMVER-MAJOR) update V8 gypfiles for 13.4 (Michaël Zasso) #58070 * (SEMVER-MAJOR) update V8 gypfiles for 13.2 (Michaël Zasso) #58070 * (SEMVER-MAJOR) update V8 gypfiles for 13.1 (Michaël Zasso) #58070 * (SEMVER-MAJOR) update V8 gypfiles for 13.0 (Michaël Zasso) #55014 url: * (SEMVER-MAJOR) expose urlpattern as global (Jonas) #56950 * (SEMVER-MAJOR) runtime deprecate url.parse (Yagiz Nizipli) #55017 zlib: * (SEMVER-MAJOR) deprecate classes usage without `new` (Yagiz Nizipli) #55718 PR-URL: #57609 Signed-off-by: RafaelGSS <rafael.nunu@hotmail.com>

Semver-Major Commits: assert,util: * (SEMVER-MAJOR) Revert "assert,util: revert recursive breaking change (Ruben Bridgewater) #57622 buffer: * (SEMVER-MAJOR) move SlowBuffer to EOL (James M Snell) #58008 * (SEMVER-MAJOR) make `buflen` in integer range (zhenweijin) #51821 build: * (SEMVER-MAJOR) update list of installed cppgc headers (Michaël Zasso) #58070 * (SEMVER-MAJOR) fix V8 TLS config for shared lib builds (Michaël Zasso) #58070 * (SEMVER-MAJOR) pass `-fPIC` to linker as well for shared builds (Michaël Zasso) #58070 * (SEMVER-MAJOR) add `/bigobj` to compile V8 on Windows (Michaël Zasso) #58070 * (SEMVER-MAJOR) enable shared RO heap with ptr compression (Michaël Zasso) #58070 * (SEMVER-MAJOR) remove support for s390 32-bit (Richard Lau) #58070 * (SEMVER-MAJOR) reset embedder string to "-node.0" (Michaël Zasso) #58070 * (SEMVER-MAJOR) downgrade armv7 support to experimental (Michaël Zasso) #58071 * (SEMVER-MAJOR) bump supported macOS version to 13.5 (Michaël Zasso) #57115 * (SEMVER-MAJOR) increase minimum Xcode version to 16.1 (Michaël Zasso) #56824 * (SEMVER-MAJOR) link V8 with atomic library (Michaël Zasso) #55014 * (SEMVER-MAJOR) remove support for ppc 32-bit (Michaël Zasso) #55014 * (SEMVER-MAJOR) reset embedder string to "-node.0" (Michaël Zasso) #55014 build,src,tools: * (SEMVER-MAJOR) adapt build config for V8 13.3 (Michaël Zasso) #58070 child_process: * (SEMVER-MAJOR) deprecate passing `args` to `spawn` and `execFile` (Daniel Venable) #57199 deps: * (SEMVER-MAJOR) remove deps/simdutf (Michaël Zasso) #58070 * (SEMVER-MAJOR) V8: backport 954187bb1b87 (Joyee Cheung) #58070 * (SEMVER-MAJOR) patch V8 to support compilation with MSVC (StefanStojanovic) #58070 * (SEMVER-MAJOR) always define V8_EXPORT_PRIVATE as no-op (Michaël Zasso) #58070 * (SEMVER-MAJOR) disable V8 concurrent sparkplug compilation (Michaël Zasso) #58070 * (SEMVER-MAJOR) use std::map in MSVC STL for EphemeronRememberedSet (Joyee Cheung) #58070 * (SEMVER-MAJOR) patch V8 for illumos (Dan McDonald) #58070 * (SEMVER-MAJOR) remove problematic comment from v8-internal (Michaël Zasso) #58070 * (SEMVER-MAJOR) define V8_PRESERVE_MOST as no-op on Windows (Stefan Stojanovic) #58070 * (SEMVER-MAJOR) fix FP16 bitcasts.h (Stefan Stojanovic) #58070 * (SEMVER-MAJOR) patch V8 to avoid duplicated zlib symbol (Michaël Zasso) #58070 * (SEMVER-MAJOR) update V8 to 13.6.233.8 (Michaël Zasso) #58070 * (SEMVER-MAJOR) V8: cherry-pick f915fa4c9f41 (Olivier Flückiger) #55014 * (SEMVER-MAJOR) V8: cherry-pick 0d5d6e71bbb0 (Yagiz Nizipli) #55014 * (SEMVER-MAJOR) V8: cherry-pick 0c11feeeca4a (Michaël Zasso) #55014 * (SEMVER-MAJOR) define V8_PRESERVE_MOST as no-op on Windows (Stefan Stojanovic) #55014 * (SEMVER-MAJOR) always define V8_NODISCARD as no-op (Michaël Zasso) #55014 * (SEMVER-MAJOR) fix FP16 bitcasts.h (Stefan Stojanovic) #55014 * (SEMVER-MAJOR) patch V8 to support compilation with MSVC (StefanStojanovic) #55014 * (SEMVER-MAJOR) patch V8 to avoid duplicated zlib symbol (Michaël Zasso) #55014 * (SEMVER-MAJOR) disable V8 concurrent sparkplug compilation (Michaël Zasso) #55014 * (SEMVER-MAJOR) always define V8_EXPORT_PRIVATE as no-op (Michaël Zasso) #55014 * (SEMVER-MAJOR) update V8 to 13.0.245.25 (Michaël Zasso) #55014 * (SEMVER-MAJOR) upgrade npm to 11.0.0 (npm team) #56274 * (SEMVER-MAJOR) update undici to 7.0.0 (Node.js GitHub Bot) #56070 fs: * (SEMVER-MAJOR) remove ability to call truncate with fd (Yagiz Nizipli) #57567 * (SEMVER-MAJOR) deprecate passing invalid types in `fs.existsSync` (Carlos Espa) #55753 * (SEMVER-MAJOR) runtime deprecate `fs.F_OK`, `fs.R_OK`, `fs.W_OK`, `fs.X_OK` (Livia Medeiros) #49686 * (SEMVER-MAJOR) remove `dirent.path` (Antoine du Hamel) #55548 http: * (SEMVER-MAJOR) remove outgoingmessage _headers and _headersList (Yagiz Nizipli) #57551 http2: * (SEMVER-MAJOR) session tracking and graceful server close (Kushagra Pandey) #57586 lib: * (SEMVER-MAJOR) remove obsolete Cipher export (James M Snell) #57266 * (SEMVER-MAJOR) unexpose six process bindings (Michaël Zasso) #57149 * (SEMVER-MAJOR) make ALS default to AsyncContextFrame (Stephen Belanger) #55552 * (SEMVER-MAJOR) runtime deprecate SlowBuffer (Rafael Gonzaga) #55175 net: * (SEMVER-MAJOR) make _setSimultaneousAccepts() end-of-life deprecated (Yagiz Nizipli) #57550 readline: * (SEMVER-MAJOR) add stricter validation for functions called after closed (Dario Piotrowicz) #57680 * (SEMVER-MAJOR) fix unicode line separators being ignored (Dario Piotrowicz) #57591 repl: * (SEMVER-MAJOR) runtime deprecate instantiating without new (Aviv Keller) #54869 src: * (SEMVER-MAJOR) enable `Float16Array` on global object (Michaël Zasso) #58154 * (SEMVER-MAJOR) enable explicit resource management (Michaël Zasso) #58154 * (SEMVER-MAJOR) use non-deprecated WriteUtf8V2() method (Yagiz Nizipli) #58070 * (SEMVER-MAJOR) use non-deprecated Utf8LengthV2() method (Yagiz Nizipli) #58070 * (SEMVER-MAJOR) use V8-owned CppHeap (Joyee Cheung) #58070 * (SEMVER-MAJOR) use `v8::ExternalMemoryAccounter` (Michaël Zasso) #58070 * (SEMVER-MAJOR) replace uses of FastApiTypedArray (Michaël Zasso) #58070 * (SEMVER-MAJOR) update NODE_MODULE_VERSION to 137 (Michaël Zasso) #58070 * (SEMVER-MAJOR) update GetForegroundTaskRunner override (Etienne Pierre-doray) #55014 * (SEMVER-MAJOR) update NODE_MODULE_VERSION to 134 (Michaël Zasso) #55014 * (SEMVER-MAJOR) drop --experimental-permission in favour of --permission (Rafael Gonzaga) #56240 * (SEMVER-MAJOR) add async context frame to AsyncResource (Gerhard Stöbich) #56082 * (SEMVER-MAJOR) nuke deprecated and un-used enum members in `OptionEnvvarSettings` (Juan José) #53079 src,test: * (SEMVER-MAJOR) unregister the isolate after disposal and before freeing (Joyee Cheung) #58070 * (SEMVER-MAJOR) add V8 API to test the hash seed (Michaël Zasso) #58070 stream: * (SEMVER-MAJOR) catch and forward error from dest.write (jakecastelli) #55270 test: * (SEMVER-MAJOR) fix test-fs-write for V8 13.6 (Michaël Zasso) #58070 * (SEMVER-MAJOR) handle explicit resource management globals (Michaël Zasso) #58070 * (SEMVER-MAJOR) adapt assert tests to stack trace changes (Michaël Zasso) #58070 * (SEMVER-MAJOR) update test-linux-perf-logger (Michaël Zasso) #58070 * (SEMVER-MAJOR) Revert "test: disable fast API call count checks (Michaël Zasso) #58070 * (SEMVER-MAJOR) disable fast API call count checks (Michaël Zasso) #55014 test_runner: * (SEMVER-MAJOR) remove promises returned by t.test() (Colin Ihrig) #56664 * (SEMVER-MAJOR) remove promises returned by test() (Colin Ihrig) #56664 * (SEMVER-MAJOR) automatically wait for subtests to finish (Colin Ihrig) #56664 timers: * (SEMVER-MAJOR) check for immediate instance in clearImmediate (Gürgün Dayıoğlu) #57069 * (SEMVER-MAJOR) set several methods EOL (Yagiz Nizipli) #56966 tls: * (SEMVER-MAJOR) remove deprecated tls.createSecurePair (Jonas) #57361 * (SEMVER-MAJOR) make server.prototype.setOptions end-of-life (Yagiz Nizipli) #57339 tools: * (SEMVER-MAJOR) update V8 gypfiles for 13.6 (Michaël Zasso) #58070 * (SEMVER-MAJOR) update V8 gypfiles for 13.5 (Michaël Zasso) #58070 * (SEMVER-MAJOR) update license-builder and LICENSE for V8 deps (Michaël Zasso) #58070 * (SEMVER-MAJOR) update V8 gypfiles for 13.4 (Michaël Zasso) #58070 * (SEMVER-MAJOR) update V8 gypfiles for 13.2 (Michaël Zasso) #58070 * (SEMVER-MAJOR) update V8 gypfiles for 13.1 (Michaël Zasso) #58070 * (SEMVER-MAJOR) update V8 gypfiles for 13.0 (Michaël Zasso) #55014 url: * (SEMVER-MAJOR) expose urlpattern as global (Jonas) #56950 * (SEMVER-MAJOR) runtime deprecate url.parse (Yagiz Nizipli) #55017 zlib: * (SEMVER-MAJOR) deprecate classes usage without `new` (Yagiz Nizipli) #55718 PR-URL: #57609 Signed-off-by: RafaelGSS <rafael.nunu@hotmail.com>

## Summary `shutdown.forceCloseOnTimeout` (default `true`) is documented to make `server.stop()` finish within `shutdown.timeout` "even if clients hold connections open", but it only destroyed HTTP/2 sessions. The following cases were measured in Docker on Node 22.13.0, 24.21.0 and 26.10.0 with a 2 s timeout. In each of them a client kept the server — and the process — alive **forever**: - **Default transport** (plaintext, `allowHTTP1: true`), which is `http.createServer` and therefore HTTP/1.1 only. There are no sessions, so force-close did nothing against a long, unfinished or idle request. - **TLS**: a connection that never completed the handshake or sent an unfinished request. - **h2c with a client ignoring GOAWAY** on Node 24+. The session is already destroyed and its half-closed socket waits for the peer's FIN. Two more gaps: - **Node 22** `server.close()` sends no GOAWAY (added in Node 24, nodejs/node#57586), so every idle HTTP/2 client stretched `stop()` to the full timeout. - A **TLS session completing its handshake after `close()`** got no GOAWAY on any version. What changes in `TransportManager`: - It tracks every accepted TCP connection (`'connection'`, all modes) and destroys them on the force-close path. For TLS the raw socket also covers pre-handshake connections. - `close()` sends GOAWAY (`session.close()`) to every HTTP/2 session itself, and closes sessions created while it is closing. - `forceCloseOnTimeout: false` still destroys nothing. Its JSDoc now says precisely what happens. - Connectum never calls `process.exit()`. Alternatives measured and rejected: `http.Server#closeAllConnections` (does not exist on `Http2Server`/`Http2SecureServer`), destroying via `session.socket` (throws on Node 22, no-op on 24/26), `unref`, and `process.exit`. ## Type of change - [x] Bug fix (non-breaking) - [ ] New feature (non-breaking) - [ ] Breaking change (documented in migration guide) - [ ] Documentation / chore / internal Observable change with the default config: connections that outlive the shutdown timeout are now actually terminated on HTTP/1.1 and TLS, as the docs promised. ## Test plan - [x] `pnpm build && pnpm typecheck && pnpm test` pass locally (33/33 turbo tasks) - [x] `pnpm lint` passes locally. The only warning, `packages/events/src/broadcast.ts:18`, pre-exists on `main`. - [x] New `packages/core/tests/unit/TransportManager.forceClose.test.ts`, 5 scenarios: - three transports × a raw half-open client that never closes: the graceful phase keeps it, the force path closes it; - an idle HTTP/2 client drains without the force path; - a late TLS session receives GOAWAY. Results: 5/5 under node, bun and esbuild. On Docker `node:22.13.0` (esbuild) it also passes 5/5. The same test on `main` code gives 1/5. - [x] The TLS pair is generated per run with `openssl`, so no key material is committed (the repo ignores `*.key`/`*.crt`). - [x] Consumer floor: two shutdown checks were added to the release-gate behavioral smoke. It runs on Node 22.13.0 against the packed artifacts, as the runtime-matrix spec requires. On `node:22.13.0`, `main` fails both (`stop()` took 5004 ms; the connection outlived the timeout); with this PR the smoke is 34/34. Local `pnpm release:gate`: PASS. - [x] End-to-end: the healthcheck suite with the old non-draining client helper (the Node 24.21 trigger) completes in 31 s on `node:24.21.0` via the force path, instead of hanging. - [x] `test:bun` (14 suites) and `test:esbuild` (226/226) for core. ## Parity coverage - [ ] Parity coverage added - [x] Parity N/A: server shutdown and transport connection lifecycle only. RPC semantics over HTTP and in-process are unchanged, and `scripts/parity-suite.sh` is unaffected. ## Related issues / changes - Follows #267, which fixed the Node 24.21 CI hang from the test side; this PR fixes the framework-side gap. - Companion docs PR: graceful-shutdown guide (options table, shutdown sequence, force-close section). - Out of scope, measured: - HTTP/1.1 keep-alive idling after the last in-flight response (bounded by `keepAliveTimeout` or the timeout); - Bun's `http.Server#close()` callback firing before connections close. 🤖 Generated with [Claude Code](https://claude.com/claude-code)  ## Summary by CodeRabbit * **Improvements** * Server shutdown now sends GOAWAY to idle HTTP/2 clients when draining begins. * By default, connections still open when the shutdown timeout expires are closed across HTTP/1.1, HTTP/2, and TLS transports, including connections with unfinished requests. * With `forceCloseOnTimeout` set to `false`, shutdown completes after the timeout without forcibly closing open connections.  --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>

nodejs-github-bot added http2 Issues and PRs related to the http2 subsystem. needs-ci PRs that need a full CI run. labels Mar 21, 2025

pandeykushagra51 changed the title ~~http2: add session tracking and graceful shutdown of http2 server~~ http2: add session tracking and graceful server shutdown of http2 server Mar 23, 2025

mcollina requested review from atlowChemi and jasnell March 27, 2025 16:41

mcollina assigned ronag Mar 27, 2025

mcollina approved these changes Mar 27, 2025

View reviewed changes

mcollina requested a review from pimterry March 27, 2025 16:42

mcollina added the semver-major PRs that contain breaking changes and should be released in the next major version. label Mar 27, 2025

pimterry requested changes Mar 28, 2025

View reviewed changes

pandeykushagra51 mentioned this pull request Mar 28, 2025

http2: add session tracking and graceful server close #57668

Closed

pandeykushagra51 requested a review from pimterry March 28, 2025 19:41

pandeykushagra51 force-pushed the http2/fix-server-close branch from f2a480c to da31e96 Compare March 28, 2025 19:53

pandeykushagra51 added 2 commits March 29, 2025 16:23

mcollina added the commit-queue PRs queued for automated landing through the Commit Queue. label Apr 14, 2025

mcollina unassigned ronag Apr 14, 2025

nodejs-github-bot added commit-queue-failed PRs whose Commit Queue landing failed and need manual intervention before retrying. and removed commit-queue PRs queued for automated landing through the Commit Queue. labels Apr 14, 2025

jasnell approved these changes Apr 14, 2025

View reviewed changes

pandeykushagra51 mentioned this pull request Apr 19, 2025

http2: fix graceful session close #57808

Merged

jasnell approved these changes Apr 19, 2025

View reviewed changes

jasnell closed this Apr 19, 2025

hildjj mentioned this pull request Apr 24, 2025

closeAllConnections on http2.Http2Server and http2.Http2SecureServer #55459

Closed

RafaelGSS mentioned this pull request May 1, 2025

2025-05-06, Version 24.0.0 (Current) #57609

Merged

samuel871211 mentioned this pull request May 14, 2026

doc: update Http2Server.close & Http2SecureServer.close #63298

Merged

intech mentioned this pull request Sep 28, 2026

fix(core): force-close every connection on the shutdown timeout Connectum-Framework/connectum#268

Merged

13 tasks

Uh oh!

Conversation

pandeykushagra51 commented Mar 21, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Purpose

Current Issues

Implementation Details

Behavior Clarification

API Impact

Testing

Uh oh!

nodejs-github-bot commented Mar 21, 2025

Uh oh!

pandeykushagra51 commented Mar 22, 2025

Uh oh!

pandeykushagra51 commented Mar 22, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

mcollina left a comment

Choose a reason for hiding this comment

Uh oh!

codecov Bot commented Mar 27, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

lpinca commented Mar 27, 2025

Uh oh!

pandeykushagra51 commented Mar 28, 2025

Uh oh!

pandeykushagra51 commented Mar 28, 2025

Uh oh!

pandeykushagra51 commented Mar 28, 2025

Uh oh!

pandeykushagra51 commented Mar 28, 2025

Uh oh!

lpinca commented Mar 28, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

pandeykushagra51 commented Mar 28, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

pimterry left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

pimterry Mar 28, 2025

Choose a reason for hiding this comment

Uh oh!

pandeykushagra51 Apr 2, 2025

Choose a reason for hiding this comment

Uh oh!

pandeykushagra51 commented Mar 28, 2025

Uh oh!

lpinca commented Mar 28, 2025

Uh oh!

lpinca commented Mar 28, 2025

Uh oh!

pandeykushagra51 commented Mar 28, 2025

Uh oh!

nodejs-github-bot commented Apr 14, 2025

Uh oh!

pandeykushagra51 commented Apr 14, 2025

Uh oh!

nodejs-github-bot commented Apr 14, 2025 • edited by jasnell Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

pandeykushagra51 commented Apr 19, 2025

Uh oh!

pandeykushagra51 commented Apr 19, 2025

Uh oh!

jasnell commented Apr 19, 2025

Uh oh!

pandeykushagra51 commented Apr 19, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

pandeykushagra51 commented Mar 21, 2025 •

edited

Loading

pandeykushagra51 commented Mar 22, 2025 •

edited

Loading

codecov Bot commented Mar 27, 2025 •

edited

Loading

lpinca commented Mar 28, 2025 •

edited

Loading

pandeykushagra51 commented Mar 28, 2025 •

edited

Loading

nodejs-github-bot commented Apr 14, 2025 •

edited by jasnell

Loading