spec(`v24-to-v26`): what we have to do

Start by reviewing the listed Node.js 25 and 26 deprecations, the existing recipes, and the linked migration issues to determine which gaps are in scope for this codemod. The issue names no files or tests, so first locate the repository's recipe and test conventions. Done means the agreed migration coverage is implemented and verified; the issue does not specify that coverage.

To furnish a codemod that handles migrations between node v22 to v24, we have some task to do.

EoL DEP

Removed in Node.js 25

• 1. DEP0030 — SlowBuffer removed (25.0.0). Use Buffer.allocUnsafeSlow(); review initialization assumptions.
  Existing: slow-buffer-to-buffer-alloc-unsafe-slow; #125

• 2. DEP0077 — Module._debug() removed (25.0.0). Replace private debug plumbing with an application-owned logger or supported debugging API.
  Manual: No dedicated migration issue found.

• 3. DEP0094 — Multiple arguments to assert.fail() removed (25.0.0). Preserve unconditional failure and any actual/expected/operator metadata. A conditional assertion is not generally equivalent.
  Partial: No dedicated migration issue found.

• 4. DEP0112 — Private dgram APIs removed (25.0.0). Audit _handle, _receiving, _bindState, _queue, _reuseAddr, _healthCheck(), _stopReceiving() and _createSocketHandle(). There is no universal public replacement.
  Manual: No dedicated migration issue found.

• 5. DEP0118 — Falsy host names in dns.lookup() removed (25.0.0). Fix the producer or handle the absent-host branch explicitly; do not invent a hostname through coercion.
  Partial: No dedicated migration issue found. dns-lookup-options-coercion concerns options, not this hostname change.

• 6. DEP0123 — IP addresses as TLS servername no longer supported (25.0.0). Use a valid DNS name when SNI is required. Review routing and certificate verification before changing configuration.
  Manual: No dedicated migration issue found.

• 7. DEP0129 — ChildProcess._channel removed (25.0.0). Replace it with ChildProcess.channel when the receiver is known to be a child process.
  Missing: No dedicated migration issue found.

• 8. DEP0132 — Callback argument to worker.terminate() removed (25.0.0). Consume the returned promise or use the worker's exit event. Preserve callback arguments, ordering and error handling.
  Partial: No dedicated migration issue found.

• 9. DEP0135 — Internal ReadStream.open() / WriteStream.open() removed (25.0.0). Use fs.createReadStream() / fs.createWriteStream() or pass an already opened file descriptor; review resource ownership.
  Manual: No dedicated migration issue found.

• 10. DEP0137 — Closing a FileHandle through garbage collection no longer allowed (25.0.0). Close explicitly with try/finally or an appropriate await using scope. Preserve handle lifetime, including returned or shared handles.
  Partial: No dedicated migration issue found.

• 11. DEP0147 — Recursive fs.rmdir() support removed (25.0.0). Migrate callback, sync and promise variants to fs.rm() equivalents, preserving the intended options and error behavior.
  Existing: rmdir; #104

• 12. DEP0152 — Extra PerformanceEntry accessors removed (25.0.0). Read the extra GC, HTTP and HTTP/2 information from entry.detail. Do not rewrite standard fields such as name, duration or startTime.
  Partial: No dedicated migration issue found.

• 13. DEP0154 — RSA-PSS hash / mgf1Hash options removed (25.0.0). Use hashAlgorithm / mgf1HashAlgorithm in the corresponding key-generation options.
  Existing: crypto-rsa-pss-update; #144

• 14. DEP0160 — process event multipleResolves removed (25.0.0). Review monitoring that depends on the event. No event offers a drop-in replacement for the same signal.
  Manual: No dedicated migration issue found.

• 15. DEP0170 — Invalid ports accepted by legacy url.parse() now rejected (25.0.0). Correct or reject invalid URL input. WHATWG URL migration alone cannot make invalid ports valid.
  Partial: node-url-to-whatwg-url is related; #92 (closed). Review open gaps #249 and #515 before composing it.

• 16. DEP0172 — .asyncResource on AsyncResource-bound functions removed (25.0.0). Retain an explicit resource reference where possible. Static AsyncResource.bind() users may need to create and manage a resource explicitly.
  Partial: No dedicated migration issue found.

• 17. DEP0173 — assert.CallTracker removed (25.0.0). Evaluate node:test mocks plus explicit call-count assertions. Preserve when verification runs and what counts as a failure.
  Partial: No dedicated migration issue found; removal: nodejs/node#58006.

• 18. DEP0176 — fs.F_OK, fs.R_OK, fs.W_OK, fs.X_OK removed (25.0.0). Read the constants from fs.constants or fs.promises.constants.
  Existing: fs-access-mode-constants; #130

• 19. DEP0185 — Calling REPL constructors without new removed (25.0.0). Add new to the applicable REPLServer and Recoverable calls.
  Existing: repl-classes-with-new; #240 and PR #242. The issue title has the wrong DEP number; DEP0185 is the correct one.

Removed in Node.js 26

• 20. DEP0063 — ServerResponse.writeHeader() removed (26.0.0). Replace the undocumented alias with writeHead() on known HTTP server responses. It became a runtime deprecation in 25.0.0.
  Missing: No dedicated migration issue found.

• 21. DEP0125 — Internal _stream_wrap module removed (26.0.0). Audit its use separately from public stream class aliases; it has no general one-to-one public replacement.
  Manual: No dedicated migration issue found; overlaps the module removal in DEP0193.

• 22. DEP0182 — Short GCM authentication tags require explicit configuration (26.0.0). Set the expected authTagLength on createDecipheriv() for protocols using a tag shorter than 16 bytes. Infer only statically proven lengths; never trust an attacker-controlled tag length as policy.
  Partial: No dedicated migration issue found.

• 23. DEP0193 — Internal _stream_* modules removed (26.0.0). Map _stream_readable, _stream_writable, _stream_duplex, _stream_transform and _stream_passthrough to the matching node:stream exports. Handle _stream_wrap manually under DEP0125.
  Partial: No dedicated migration issue found. #471 concerns the separate readable-stream package migration.

Runtime deprecations

These APIs still exist in the target release, but their deprecated uses can emit warnings. They can also fail under --throw-deprecation.

• 24. DEP0031 — ecdh.setPublicKey() (25.0.0). Audit and remove unnecessary public-key mutation where safe; the API has no useful supported role. Do not substitute setPrivateKey() without an actual private key.
  Manual: No dedicated migration issue found.

• 25. DEP0198 — SHAKE hashes without outputLength (25.0.0). Make the intended digest length explicit. For known legacy defaults, SHAKE-128 used 16 bytes and SHAKE-256 used 32 bytes; preserve explicitly configured values.
  Tracked: #553

• 26. DEP0201 — Duplex.toWeb() option type (26.0.0). Use readableType, preserving conflicting keys and spreads safely. Documentation deprecation started in 25.7.0.
  Tracked: #559

• 27. DEP0203 — CryptoKey arguments to legacy node:crypto APIs (26.0.0). Use KeyObject.from() only for keys proven extractable, or migrate the operation to Web Crypto. Also handle nested key options where applicable. Documentation deprecation started in 25.9.0.
  Tracked: #555

• 28. DEP0204 — KeyObject.from() with non-extractable CryptoKey (26.0.0). Keep the operation within Web Crypto or redesign the integration. Do not change a key to extractable: true as an automatic fix.
  Manual: #555 already discusses this exclusion; it is not an implemented DEP0204 migration.

• 29. DEP0205 — module.register() (26.0.0). Migrate compatible hooks to module.registerHooks(). Async off-thread hooks cannot be converted by renaming the API; review I/O, initialization, messaging and execution context.
  Tracked: #561

Documentation-only deprecations

These are preparation work, not APIs removed in Node.js 26. In particular, SQLite's replacement names require 26.11.0 or later, so they must be gated if the recipe also promises support for 26.0.0.

• 30. DEP0202 — HTTP/2 options Http1IncomingMessage / Http1ServerResponse (25.7.0). Move them to http1Options.IncomingMessage / http1Options.ServerResponse, preserving existing http1Options, precedence and spreads.
  Missing: No dedicated migration issue found.

• 31. DEP0206 — Repeated Hmac.digest() calls (26.2.0). Remove or change only provably redundant finalization. Preserve whether callers use the empty result returned by a subsequent call in Node.js 26.
  Tracked: #557

• 32. DEP0208 — Internal net.Server.prototype._listen2 (26.8.2). Replace private calls or monkey patches with supported listening behavior. _listen2 and listen() do not have interchangeable signatures.
  Manual: No dedicated migration issue found.

• 33. DEP0209 — Using AbortSignal solely to dispose of resources (26.8.2). Consider using / await using for clearly scoped cleanup. Preserve cancellation propagation, timeouts, external signals and resource lifetime.
  Partial: No dedicated migration issue found.

• 34. DEP0210 — sqlite.DatabaseSync name (26.11.0). Use Database; the old name remains a deprecated alias. Restrict the migration to a target that has the replacement.
  Tracked: #560

• 35. DEP0211 — sqlite.StatementSync name (26.11.0). Use Statement; the old name remains a deprecated alias. Handle imports, exports and type references where supported.
  Tracked: #560