mirrors/node

0 Fork 0

mirror of https://github.com/nodejs/node.git synced 2026-10-28 10:15:07 +08:00

Files

T

RafaelGSS 18aaee07d6 2026-10-21, Version 26.12.1 (Current)

This is a security release.

Notable changes:

* (CVE-2026-106069, CVE-2026-106072) tls: reject non-canonical IP addresses (Matteo Collina) – High
* (CVE-2026-105482) dns: validate resolve inputs for null bytes (James M Snell) – High
* (CVE-2026-105483) tls: fix ip normalization regression (James M Snell) – High
* (CVE-2026-111497) src: expose `BROTLI_DECODER_ERROR_FORMAT_BLOCK_SWITCH` (Antoine du Hamel) – High
* (CVE-2026-111497) deps: brotli: cherry-pick 0ed4268a4401abcb44720963 (Evgenii Kliuchnikov) – High
* (CVE-2026-105481) http: ensure agent data guard works without I/O (James M Snell) – Medium
* (CVE-2026-106074) crypto: reset random caches across snapshots (Filip Skokan) – Medium
* (CVE-2026-106070) zlib: avoid caching invalid ZIP local headers (Matteo Collina) – Low
* (CVE-2026-106071) src: fix the fs permission tree node on wildcard nodes (James M Snell) – Low
* (CVE-2026-106073) permission: check permission model in realpathSync (RafaelGSS) – Low
* deps: V8: backport 93cd21e8254b (Joyee Cheung)
* crypto: update root certificates to NSS 3.131.1 (Antoine du Hamel)
* tls: reject chains containing blocked public keys (Ulises Gascon)
* deps: update c-ares to 1.34.9 (Node.js GitHub Bot)
* tools: retry Gatekeeper check and stapling after notarization (Ryan Aslett)
* crypto: harden X.509 conversion and formatting (Filip Skokan)

PR-URL: https://github.com/nodejs-private/node-private/pull/1013

2026-10-21 12:02:46 +02:00

528 KiB

Raw Permalink Blame History

Node.js 26 ChangeLog

Current
26.12.1 26.12.0 26.11.1 26.11.0 26.10.0 26.9.0 26.8.2 26.8.1 26.8.0 26.7.0 26.6.0 26.5.1 26.5.0 26.4.0 26.3.1 26.3.0 26.2.0 26.1.0 26.0.0

Other Versions
- 25.x
- 24.x
- 23.x
- 22.x
- 21.x
- 20.x
- 19.x
- 18.x
- 17.x
- 16.x
- 15.x
- 14.x
- 13.x
- 12.x
- 11.x
- 10.x
- 9.x
- 8.x
- 7.x
- 6.x
- 5.x
- 4.x
- 0.12.x
- 0.10.x
- io.js
- Archive

2026-10-21, Version 26.12.1 (Current), @aduh95 prepared by @RafaelGSS

This is a security release.

Notable Changes

(CVE-2026-106069, CVE-2026-106072) tls: reject non-canonical IP addresses (Matteo Collina) – High
(CVE-2026-105482) dns: validate resolve inputs for null bytes (James M Snell) – High
(CVE-2026-105483) tls: fix ip normalization regression (James M Snell) – High
(CVE-2026-111497) src: expose BROTLI_DECODER_ERROR_FORMAT_BLOCK_SWITCH (Antoine du Hamel) – High
(CVE-2026-111497) deps: brotli: cherry-pick 0ed4268a4401abcb44720963 (Evgenii Kliuchnikov) – High
(CVE-2026-105481) http: ensure agent data guard works without I/O (James M Snell) – Medium
(CVE-2026-106074) crypto: reset random caches across snapshots (Filip Skokan) – Medium
(CVE-2026-106070) zlib: avoid caching invalid ZIP local headers (Matteo Collina) – Low
(CVE-2026-106071) src: fix the fs permission tree node on wildcard nodes (James M Snell) – Low
(CVE-2026-106073) permission: check permission model in realpathSync (RafaelGSS) – Low
deps: V8: backport 93cd21e8254b (Joyee Cheung)
crypto: update root certificates to NSS 3.131.1 (Antoine du Hamel)
tls: reject chains containing blocked public keys (Ulises Gascon)
deps: update c-ares to 1.34.9 (Node.js GitHub Bot)
tools: retry Gatekeeper check and stapling after notarization (Ryan Aslett)
crypto: harden X.509 conversion and formatting (Filip Skokan)

Commits

[818e4ca061] - crypto: update root certificates to NSS 3.131.1 (Antoine du Hamel) #66877
[fd3c87ed43] - crypto: harden X.509 conversion and formatting (Filip Skokan) nodejs-private/node-private#966
[acffa610db] - crypto: reset random caches across snapshots (Filip Skokan) nodejs-private/node-private#987
[7895a5cd2d] - deps: update undici to 8.12.2 (Node.js GitHub Bot) #66721
[12daa54d2e] - deps: V8: backport 93cd21e8254b (Joyee Cheung) nodejs-private/node-private#999
[6a8b3db7e2] - deps: update c-ares to 1.34.9 (Node.js GitHub Bot) #66868
[a6040b50d9] - deps: brotli: cherry-pick 0ed4268a4401abcb44720963 (Evgenii Kliuchnikov) nodejs-private/node-private#1002
[6b78ea171d] - dns: validate resolve inputs for null bytes (James M Snell) nodejs-private/node-private#984
[0683ee5f7d] - http: ensure agent data guard works without I/O (James M Snell) nodejs-private/node-private#983
[e5cae10148] - Revert "module: synchronously load most ES modules" (Antoine du Hamel) #66786
[cc244131aa] - permission: check permission model in realpathSync (RafaelGSS) nodejs-private/node-private#973
[0392385841] - src: expose BROTLI_DECODER_ERROR_FORMAT_BLOCK_SWITCH (Antoine du Hamel) nodejs-private/node-private#1002
[c273a408c9] - src: fix the fs permission tree node on wildcard nodes (James M Snell) nodejs-private/node-private#986
[a2caddd20e] - tls: reject chains containing blocked public keys (Ulises Gascon) #66871
[ad788ccd07] - tls: reject non-canonical IP addresses (Matteo Collina) nodejs-private/node-private#982
[cd4b05469c] - tls: fix ip normalization regression (James M Snell) nodejs-private/node-private#985
[5fa440e0d7] - tools: retry Gatekeeper check and stapling after notarization (Ryan Aslett) #66855
[745ad77156] - zlib: avoid caching invalid ZIP local headers (Matteo Collina) nodejs-private/node-private#981

2026-10-14, Version 26.12.0 (Current), @richardlau

Notable Changes

[1ebd6d3677] - (SEMVER-MINOR) doc,lib,src: throw on missing WebAssembly or RX support (Paolo Insogna) #66533
[7f1937d2b9] - (SEMVER-MINOR) http: add websocketMask() and websocketUnmask() (James M Snell) #66335

Commits

[30e76bb16a] - benchmark: fix input passed to subtle.digest in webcrypto-digest (Rafael Gonzaga) #66608
[adef72223a] - benchmark: fix buffer option in buffer read/write benchmarks (Rafael Gonzaga) #66604
[2f498f08fe] - benchmark: add util.parseArgs benchmark (Rafael Gonzaga) #66599
[4ce8412e18] - benchmark: fix url-searchparams-sort to sort a fresh list (RafaelGSS) #66535
[493bd6c66e] - benchmark,tools: fix napi benchmarks on GHA (Nigro Simone) #66423
[e4515552d6] - build: run QUIC CI for V8 changes (Yuya Inoue) #66602
[a888e51062] - build: support Python 3.15 (Mike McCready) #65750
[2afab9a63b] - build: do not include shared gtest in node link path (Antoine du Hamel) #66626
[f88c2f8ec6] - build,test: enable temporal support on no-ICU and system-ICU builds (Antoine du Hamel) #66697
[5fd03e6fdf] - child_process: propagate config-file permission flags to children (Rafael Gonzaga) #66559
[f771134b07] - crypto: isolate provider EC PKCS8 encoding (Filip Skokan) #66413
[4e00a293db] - crypto: remove key export and metadata locks (Filip Skokan) #66413
[bcd8018775] - crypto: remove verify setup key locking (Filip Skokan) #66413
[883250fee2] - crypto: remove KEM key locking (Filip Skokan) #66413
[9d98805071] - crypto: remove RSA-OAEP key locking (Filip Skokan) #66413
[d6293e7bb1] - crypto: skip secret key mutex allocation (Filip Skokan) #66413
[8d8af8003e] - crypto: keep the root cert store per Environment (Shelley Vohr) #66411
[c6f0614785] - crypto: remove select Web Crypto warnings (Filip Skokan) #66312
[e5360b5a08] - deps: update googletest to 988ea2c1798de7779f656df2281dd36d6039a17a (Node.js GitHub Bot) #66652
[7eb230a2c1] - deps: update acorn to 8.19.0 (Node.js GitHub Bot) #66655
[af946ba8f3] - deps: update sqlite to 3.54.0 (Node.js GitHub Bot) #66663
[007872a85d] - deps: V8: cherry-pick 8d14d49c4040 (Antoine du Hamel) #66627
[f44aec4966] - deps: update simdjson to 5.0.3 (Daniel Lemire) #66620
[1a33e914e8] - deps: V8: cherry-pick 7d5eb1df2a72 (inoway46) #66566
[3294d51e5a] - diagnostics_channel: fix default callback context (Matteo Collina) #66481
[5c602a5824] - doc: list futimes among fd APIs disabled by the permission model (Rafael Gonzaga) #66649
[eaeb4736c8] - doc: add Test Runner to list of built-in diagnostic channels (Vas Sudanagunta) #66563
[0e1c99afae] - doc: document stream/iter behaviors and Node.js extensions (James M Snell) #66483
[846236367d] - doc: document URL and Uint8Array references in process.permission (Rafael Gonzaga) #66557
[fc3b067be7] - doc: clarify http Agent keepSocketAlive behavior (Efe Karasakal) #66252
[73a4e90ce2] - doc: document keepAliveTimeoutBuffer server option (Efe Karasakal) #66286
[bb816582af] - doc: fix request.reusedSocket timeout example (Efe Karasakal) #66286
[82223ab4d9] - doc: clarify revert PR label policy (Antoine du Hamel) #66529
[c6f59d4e8e] - doc: clarify node binary misuse after compromise (Rafael Gonzaga) #66530
[8904178498] - doc: document linux-x64-musl build toolchain (Issac) #66523
[1e8247a74e] - doc: run license-builder (github-actions[bot]) #66517
[b2773d5e4c] - doc: add missing return types in cluster.md (Daniel Pinto) #66453
[1ebd6d3677] - (SEMVER-MINOR) doc,lib,src: throw on missing WebAssembly or RX support (Paolo Insogna) #66533
[c1073f31de] - ffi: fix exportArrayBuffer type check (Trivikram Kamat) #66455
[69148ee0ff] - fs: lock FileHandle on first read in pull() and pullSync() (James M Snell) #66483
[700c60a1cd] - fs: serialize FileHandle writer() async writes (James M Snell) #66483
[32833def1c] - http: reduce raw header name allocations (Roberto Bianchi) #66488
[7f1937d2b9] - (SEMVER-MINOR) http: add websocketMask() and websocketUnmask() (James M Snell) #66335
[115731dda7] - http2: speed up response getHeaders (Roberto Bianchi) #66592
[447c36cb45] - lib: fix AbortSignal.any() nested composite leak (Darius) #66617
[1722ced4b4] - lib: add --allow-fs-vfs to permission available flags (Rafael Gonzaga) #66554
[062ece77fc] - lib: fix benchmark record acknowledgement race (Filip Skokan) #66430
[05d0b14438] - lib: set exit code on failed node:bench run() (RafaelGSS) #66534
[2cab299471] - lib: default node:bench warmup to 10 invocations (RafaelGSS) #66536
[83f507845d] - meta: bump nodejs/node-pr-labeler to dfe5eb3 (Soul Lee) #66606
[6fbffd5ee5] - meta: bump codecov/codecov-action from 7.1.0 to 7.1.1 (dependabot[bot]) #66448
[bd567f8bd6] - module: fix require of imports with package map (Lazizbek Ergashev) #66565
[c442f471a5] - module: synchronously load most ES modules (Geoffrey Booth) #62530
[51f66f0134] - permission: keep explicit fs grants when dropping a covering directory (Rafael Gonzaga) #66556
[1aa10d80e2] - process: mark process.finalization as release candidate (Matteo Collina) #66436
[dd4715a6ba] - querystring: fix value decoding after encoded keys (Ved Chaudhari) #66553
[9648a6ba8e] - quic: reject closed stream writer writes with a TypeError (James M Snell) #66483
[d6f566baf8] - quic: give each BindingData its own allocator state (Shelley Vohr) #66411
[c3204c15bd] - quic: validate session close error codes (Christian Aurich Zanettini Martins) #66302
[5b87354f5a] - quic: destroy stream on invalid promise body (Christian Aurich Zanettini Martins) #66260
[9ef698c781] - sqlite: validate aggregate() name and options (Guilherme Araújo) #66463
[bbf41f8cfb] - sqlite: persist enableDefensive() across reopen (Trivikram Kamat) #66404
[54867cd25e] - sqlite: throw on oversized strings instead of aborting (Trivikram Kamat) #66521
[4314cde48b] - src: release uv_fs_t in permission WildcardIfDir (Rafael Gonzaga) #66555
[0e58916f08] - src: stop including simdjson.h from env.h (Daniel Lemire) #66620
[06f56a55bb] - src: use native CopyArrayBufferBytes for webstream buffer copy (René) #66400
[2e3dd5bb63] - src: fix config file handling (Marco Ippolito) #66431
[cd86506bc2] - src: mark config file as stable (Marco Ippolito) #66431
[15ff9884e4] - stream: skip idle webstreams start and watchers (Matteo Collina) #66424
[3f75c89fb8] - stream: add pipeToSync() failOnIncompleteClose option (James M Snell) #66483
[6cecf140e7] - stream: do not fail the writer when pipeToSync() cannot close (James M Snell) #66483
[16833534b6] - stream: fix fromSync() async input error messages (James M Snell) #66483
[af41622ad8] - stream: reject closed fromWritable() writes with a TypeError (James M Snell) #66483
[4b83c6c38e] - stream: accept explicit stream/iter budgets below 16384 (James M Snell) #66483
[f302fbd04a] - stream: reduce per-chunk overhead in stream/iter consumers (James M Snell) #66483
[7ba60dcdbe] - stream: keep the original error when writer.fail() throws (James M Snell) #66483
[dcac51a7db] - stream: align pull() abort handling with the spec (James M Snell) #66483
[995dee6b6b] - stream: honor stream/iter protocols on function objects (James M Snell) #66483
[6eaf91353a] - stream: do not hold back nested async data in from() (James M Snell) #66483
[69d44aedb4] - stream: bound pre-batched async values in from() (James M Snell) #66483
[6b1e7c4cf1] - stream: guard shareSync() against re-entrant source reads (James M Snell) #66483
[8a47365425] - stream: split oversized share batches under drop-oldest (James M Snell) #66483
[30cbc4e643] - stream: reject drop-newest backpressure in shareSync() (James M Snell) #66483
[42ae08594e] - stream: detach shareSync consumers on strict budget errors (James M Snell) #66483
[fa49de9ba6] - stream: keep share buffer when all consumers detach (James M Snell) #66483
[e6662cb904] - stream: fix Utf8Stream flush handling (James M Snell) #66473
[93596b1a9e] - stream: add dump()/dumpSync() for stream/iter (Ethan Arrowood) #65598
[4ba6ce1b0c] - stream: port remaining SonicBoom tests for Utf8Stream (Matteo Collina) #66275
[cd8b5fa5b0] - test: tolerate async block count updates in test-fs-stat-bigint (Rafael Gonzaga) #66576
[30814ce991] - test: replace discard loops with dump() (Ethan Arrowood) #65598
[20441b8fc0] - test: run node-bench tools test sequentially (Filip Skokan) #66338
[9618da6fe3] - test: remove duplicated cases in permission fs-read fixture (Rafael Gonzaga) #66450
[c348a4cb46] - test: run instantiateStreaming-bad-imports WPT (Filip Skokan) #66322
[7d4fda6ba7] - test: honor allowed WPT promise rejections (Filip Skokan) #66322
[d4c87eb086] - test: scope Blob WPT failures to big-endian (Filip Skokan) #66322
[7309ddf204] - test_runner: rerun failing todo tests in suites (Barak) #66605
[da908b3072] - test_runner: report load errors with --test-isolation=none (Lazizbek Ergashev) #66550
[b18e121625] - test_runner: add mock call assertions to t.assert (Guilherme Araújo) #66476
[3d691ab75e] - tools: restore Python 3.14 for daily WPT (Filip Skokan) #66699
[714aca1ef6] - tools: switch to PGP and SHA256 in ICU updater (Antoine du Hamel) #66469
[fa9fca45e4] - tools: lint thread_local in src (Shelley Vohr) #66411
[dbc3e97847] - tools: copy hdr_histogram_internal.h in update-histogram.sh (Filipe Oliveira (Redis)) #66528
[4760c27904] - tools: bump the eslint group in /tools/eslint with 5 updates (dependabot[bot]) #66445
[63c20ee58e] - vfs: add ComposableProvider for layered mounts (Matteo Collina) #66235
[ab057989af] - watch: strip underscore aliases of watch flags (Trivikram Kamat) #66365

2026-10-07, Version 26.11.1 (Current), @aduh95

Commits

[2dc4638e85] - Revert "build: toggle doc-kit verbosity based on V" (Antoine du Hamel)
[3febbc54ec] - Revert "build, doc: move to redesign" (Antoine du Hamel)
[173250e2e7] - Revert "tools: bump the doc group in /tools/doc with 4 updates" (Antoine du Hamel)

2026-10-07, Version 26.11.0 (Current), @aduh95

Notable Changes

[232f178825] - (SEMVER-MINOR) buffer: add isLatin1 (James M Snell) #66298
[27778036de] - (SEMVER-MINOR) buffer: add Buffer.stringLength() (Matteo Collina) #66064
[4f84c4bda2] - build, doc: move to redesign (Aviv Keller) #62045
[6f6296fef9] - (SEMVER-MINOR) doc: promote Alpine Linux to tier 2 support (Stewart X Addison) #63737
[e998d260d0] - (SEMVER-MINOR) http: add isValidHeaderName() and isValidHeaderValue() (James M Snell) #66334
[7702a50e08] - (SEMVER-MINOR) http2: add connectionWindowSize option (Tim Perry) #65619
[e06aa62cec] - (SEMVER-MINOR) perf_hooks: fix truncation of monitorEventLoopDelay() resolution (James M Snell) #66115
[ee126e37e8] - (SEMVER-MINOR) perf_hooks: allow RecordableHistogram to record 0 (James M Snell) #66114
[1fef8f54db] - (SEMVER-MINOR) perf_hooks: add histogram.diff() (James M Snell) #66099
[f1b9758c4e] - (SEMVER-MINOR) perf_hooks: add histogram.snapshot() (James M Snell) #66099
[291d56ea3e] - (SEMVER-MINOR) perf_hooks: harden histogram CBOR import validation (James M Snell) #66098
[6299b09d5c] - (SEMVER-MINOR) process: graduate process.ref/unref to stable (James M Snell) #66213
[41d6707b63] - (SEMVER-MINOR) sqlite: rename DatabaseSync and StatementSync (Guilherme Araújo) #65988
[60d0aa0cd4] - (SEMVER-MINOR) src: add --process-timeout=N (James M Snell) #66138
[f39916a7e3] - (SEMVER-MINOR) src: expose size and count in heap profile output (Ilyas Shabi) #65737
[0b00d5ea59] - (SEMVER-MINOR) src: let embedders exempt linked bindings from the addon permission (Shelley Vohr) #66067

Commits

[11c3d7115d] - benchmark: add implicit-framing case to http/set-header (Matteo Collina) #66420
[168b764fec] - benchmark: add zstdCompress benchmark (James Ross) #66358
[69182564a7] - benchmark: add a node::MakeCallback benchmark (Nigro Simone) #66316
[12e540582f] - (SEMVER-MINOR) benchmark: add http header validator benchmark (James M Snell) #66334
[e6abdf6b01] - benchmark: remove duplicate ffi string length direct (Donghoon Kang) #66278
[480ca7cc55] - benchmark: fix shadowing that broke h=20 on incoming_headers benchmark (Tim Perry) #66257
[c6bbc1b128] - benchmark: cover Web Crypto conversion costs (Filip Skokan) #66237
[85a2e4e270] - benchmark: remove duplicate ffi add-64 benchmark (Soul Lee) #66121
[d0a72f2c12] - buffer: fix negative index for large buffers (Hilary Asogwa) #66325
[b7f6a66a9f] - (SEMVER-MINOR) buffer: add isLatin1 (James M Snell) #66298
[232f178825] - (SEMVER-MINOR) buffer: add isLatin1 (James M Snell) #66298
[f7d3d11c11] - buffer: fix odd UTF-16LE indexOf start (Yuya Inoue) #65960
[27778036de] - (SEMVER-MINOR) buffer: add Buffer.stringLength() (Matteo Collina) #66064
[9f1db461d2] - build: update common.gypi for z/OS (Gaby Baghdadi) #66449
[0002037b3f] - build: update configure.py for z/OS (Gaby Baghdadi) #66449
[a341ac460a] - build: fix vcbuild format-md install and exit (Ved Chaudhari) #66475
[bec52d9103] - build: fix vcbuild lint skipping lint-md-build (Ved Chaudhari) #66467
[9acdb5910c] - build: toggle doc-kit verbosity based on V (Brian Muenzenmeyer) #66293
[6ee32f857a] - build: support LIEF 0.17.x and 1.x (Yuya Inoue) #66240
[2248869955] - build: add clang support for pgo on macOS/Linux (Chengzhong Wu) #66136
[49069529eb] - build: add GZIP_COMPRESSION Make variable (inoway46) #66228
[9066d33aa2] - build: port make_temporal_zoneinfo_cpp to GYP (Antoine du Hamel) #66183
[1f4a8fb1cb] - build: add v8_enable_temporal_systemicu (Steven R. Loomis) #65992
[4f84c4bda2] - build, doc: move to redesign (Aviv Keller) #62045
[a0e7141ffc] - child_process: build the default env block in one native pass (Shelley Vohr) #65325
[9fa31096d4] - crypto: improve random synchronous number generation performance (Mert Can Altin) #66348
[53cde9d1f8] - crypto: fix raw key export error for wrong key type (한국) #66217
[32ba6d5ada] - crypto: use backend cSHAKE and KMAC (Filip Skokan) #66237
[67ccff6434] - crypto: separate conversion from validation (Filip Skokan) #66237
[ceeb37173d] - crypto: verify empty KMAC outputs (Filip Skokan) #66237
[359b07a641] - crypto: check EC coordinate conversion results (Filip Skokan) #66237
[e4d746c4a5] - crypto: map JWK export failures to OperationError (Filip Skokan) #66237
[a851dda86a] - crypto: include EC public keys in PKCS8 exports (Filip Skokan) #66237
[7f58476ed1] - crypto: use the public CryptoKey prototype (Filip Skokan) #66237
[75870623ad] - crypto: split hybrid keys without species (Filip Skokan) #66237
[a1bea87c6a] - crypto: report actual RSA modulus lengths (Filip Skokan) #66237
[5e04680036] - crypto: derive Argon2 without worker threads (Filip Skokan) #66237
[fe09120a0e] - crypto: create key usage arrays without species (Filip Skokan) #66237
[44a2965f5f] - crypto: minimize RSA public exponent metadata (Filip Skokan) #66237
[2f3e6dff9d] - crypto: copy derived bits without species (Filip Skokan) #66237
[d54a2b2049] - crypto: handle PBKDF2 iteration limits (Filip Skokan) #66237
[2ef6046f11] - crypto: reject duplicate unknown key usages (Filip Skokan) #66237
[2e25ae4a7a] - crypto: check RSA JWK alg with SHA-3 hashes (Filip Skokan) #66237
[0370e02e2a] - crypto: copy parameters without array species (Filip Skokan) #66237
[e042d35ca5] - crypto: convert importKey data as a union (Filip Skokan) #66237
[ff86606768] - crypto: copy detached parameters as empty (Filip Skokan) #66237
[1314d277b2] - crypto: resolve supports overloads by type (Filip Skokan) #66237
[a855a46aeb] - crypto: allow unbound SubtleCrypto.supports (Filip Skokan) #66237
[4a72c1d690] - crypto: allow short AES-GCM IVs (Filip Skokan) #66237
[2d84b7ed49] - crypto: validate normalized hash names (Filip Skokan) #66237
[6bfd3924ff] - crypto: convert getRandomValues views (Filip Skokan) #66237
[529bd18c1a] - crypto: isolate cipher job errors (Filip Skokan) #66237
[d4af11e171] - crypto: reject short AES-KW inputs (Filip Skokan) #66237
[78374c8af0] - crypto: match algorithm names as ASCII (Filip Skokan) #66237
[ab9a3f2b01] - crypto: use internal random buffer bounds (Filip Skokan) #66237
[7c9b2df87a] - crypto: use current FIPS state for availability (Filip Skokan) #66160
[55af1dcded] - crypto: update root certificates to NSS 3.129 (Node.js GitHub Bot) #66496
[4387cb46d2] - deps: update timezone to 2026e (Node.js GitHub Bot) #66419
[150c96ef3f] - deps: V8: cherry-pick c795f5948568 (Aviv Keller) #66380
[6b5ac2ab5d] - deps: update archs files for openssl-3.5.9 (Node.js GitHub Bot) #66396
[bee7e2403c] - deps: upgrade openssl sources to openssl-3.5.9 (Node.js GitHub Bot) #66396
[7a715495f2] - deps: update lief to 1.0.0 (Node.js GitHub Bot) #66345
[f9da04958a] - deps: update zlib to 1.3.2.1-motley-456ae73 (Node.js GitHub Bot) #66330
[5c34dd970d] - deps: update undici to 8.11.2 (Node.js GitHub Bot) #66332
[fdf0572cd1] - deps: update timezone to 2026d (Node.js GitHub Bot) #66333
[6c924ee1b0] - deps: upgrade npm to 11.20.0 (npm team) #66259
[2653b2617d] - deps: V8: backport 786c1c2d88d4 (Eliau Elkouby) #66249
[1d68f23e08] - deps: update googletest to 4267679b6887f349f17b01ccd70c9e3483689b25 (Node.js GitHub Bot) #66145
[c507c5ad12] - deps: V8: backport 9fb4444bfc46 (Steven R. Loomis) #65992
[8c556ab2b6] - deps: update histogram to 0.12.0 (Node.js GitHub Bot) #66494
[d3f55c7487] - diagnostics_channel: replace using with try-finally (Ayush Chaudhary) #64251
[510dfd899e] - doc: update FreeEnvironment() notes for sibling Environments (Shelley Vohr) #66239
[db2665ba17] - doc: add indexed Array.prototype properties to primordial exclusions (René) #66234
[b692079e3a] - doc: fixup and cleanup stream/iter docs (James M Snell) #66079
[9b191141a2] - doc: fix casing in util.markPromiseAsHandled section (Antoine du Hamel) #66206
[8e8c9762a8] - doc: add return type to Blocklist.isBlocklist (yuki motokane) #66181
[6c7fc98d7f] - doc: clarify Worker execArgv vs Permission Model grants (yunshingng) #66124
[9fd0a10b1e] - doc: document iterable input for AbortSignal.any (Haram Jeong) #66123
[c4508fd4c7] - doc: restore XadillaX to collaborators (Khaidi Chu) #66063
[b4ad8354f0] - doc: use Type for performanceNodeTiming.uvMetricsInfo (James M Snell) #66094
[50bc27f3c3] - doc: document the node:ffi call paths (Soul Lee) #66086
[a74a0ee748] - doc,src,test: fix typos in code comments (Noah) #66218
[6f6296fef9] - (SEMVER-MINOR) doc: promote Alpine Linux to tier 2 support (Stewart X Addison) #63737
[215639d6ce] - events: fix addAbortListener for aborted signals (Lazizbek Ergashev) #65640
[021f7d8d98] - ffi: accept safe integer numbers for 64-bit arguments (Donghoon Kang) #66197
[53fd8e7ebb] - ffi: remove permission checks from dlclose and dlsym (Trivikram Kamat) #66426
[fa7efaf782] - ffi: validate pointer ranges in optimized calls (Trivikram Kamat) #66371
[11f80798ba] - ffi: throw on allocation failure in toArrayBuffer() (Trivikram Kamat) #66406
[c65a333648] - ffi: do not abort when a Worker stops in a callback (Trivikram Kamat) #66389
[9bdab1eca0] - ffi: reject unsafe integers as length or offset (Christian Aurich Zanettini Martins) #66216
[343a5c2915] - ffi: fix use-after-free in PrepareFunction (Trivikram Kamat) #66368
[51daf16244] - ffi: reject non-boolean copy arguments (Christian Aurich Zanettini Martins) #66219
[b901b97cbf] - ffi: use type errors for invalid signatures (Donghoon Kang) #66222
[0f6cdce998] - ffi: allocate string argument storage lazily (Soul Lee) #66178
[ee84a36f12] - ffi: avoid memcpy() with a null pointer (Christian Aurich Zanettini Martins) #66200
[da32c79034] - fs: keep timestamps of files skipped by cpSync (Christian Aurich Zanettini Martins) #66305
[e7121be408] - fs: stop recursive mkdir from retrying ENOENT forever (Marco) #66340
[99a78b0d83] - fs: fix crash on negative zero file descriptor (Christian Aurich Zanettini Martins) #65888
[8b24247be1] - fs: validate falsy openAsBlob type option (Christian Aurich Zanettini Martins) #66125
[e7d5352fa6] - fs: close file streams with fd 0 (greenhead) #66131
[f38768f0fa] - fs: close fd 0 on discarded FileHandle transfer (Christian Aurich Zanettini Martins) #66095
[6487d36873] - http: avoid dictionary-mode objects in responses (Matteo Collina) #66420
[f8d30110b6] - http: cache parser callbacks (Matteo Collina) #66152
[e998d260d0] - (SEMVER-MINOR) http: add isValidHeaderName() and isValidHeaderValue() (James M Snell) #66334
[0bb98027e5] - http: avoid toLowerCase on the server hot path (Yagiz Nizipli) #66120
[9819b0c432] - http: normalize CONNECT request paths (Efe Karasakal) #64876
[ab93a3d51b] - http: preserve socket errors as response error causes (Khaidi Chu) #66061
[15184e8212] - http: reduce per-request allocations in the server (Matteo Collina) #65802
[7702a50e08] - (SEMVER-MINOR) http2: add new connectionWindowSize option (Tim Perry) #65619
[33e4ba358b] - https: handle invalid TLS options in proxied requests (Christian Aurich Zanettini Martins) #66096
[6f610a836b] - inspector: throw ERR_INSPECTOR_NOT_AVAILABLE without an agent (Shelley Vohr) #66239
[697980b6fc] - inspector: fix connectToMainThread() abort without parent inspector (Shelley Vohr) #65976
[37b3db91eb] - (SEMVER-MINOR) lib: fix stream loading bug in node:bench (James M Snell) #66114
[46a8a5dd65] - lib: add primitive fast path to structuredClone (Guilherme Araújo) #64190
[bec7c53400] - meta: bump github/codeql-action/analyze from 4.38.0 to 4.38.2 (dependabot[bot]) #66443
[39d721abed] - meta: bump github/codeql-action/autobuild from 4.38.0 to 4.38.2 (dependabot[bot]) #66444
[963804db4d] - meta: bump github/codeql-action/init from 4.38.0 to 4.38.2 (dependabot[bot]) #66446
[5837ef8608] - meta: bump github/codeql-action/upload-sarif from 4.38.0 to 4.38.2 (dependabot[bot]) #66447
[d8109f9831] - meta: label permission model changes correctly (Rafael Gonzaga) #66208
[27f20dcaea] - meta: bump codecov/codecov-action from 7.0.0 to 7.1.0 (dependabot[bot]) #66103
[dc6ef03ab6] - module: centralize builtin exposure policies (Jungwon Sohn) #66292
[f36efeb350] - module: avoid allocating a cache key string for every require() (Samuel Attard) #63884
[9baea33509] - module: normalize package map paths (Hilary Asogwa) #66054
[354c2cc867] - net: speed up BlockList.check for strings (Yagiz Nizipli) #66166
[995a67a5ff] - net: skip IPv6 regex when the string has no colon (Yagiz Nizipli) #66165
[1c7b4feebb] - node-api: do not crash on module version mismatch (Alexey Karimov) #66019
[e06aa62cec] - (SEMVER-MINOR) perf_hooks: fix truncation of monitorEventLoopDelay() resolution (James M Snell) #66115
[ee126e37e8] - (SEMVER-MINOR) perf_hooks: allow RecordableHistogram to record 0 (James M Snell) #66114
[1fef8f54db] - (SEMVER-MINOR) perf_hooks: add histogram.diff() (James M Snell) #66099
[a6dfb3bcfd] - (SEMVER-MINOR) perf_hooks: report histogram memory to V8 (James M Snell) #66099
[f1b9758c4e] - (SEMVER-MINOR) perf_hooks: add histogram.snapshot() (James M Snell) #66099
[e2ae016df8] - (SEMVER-MINOR) perf_hooks: add histogram export format version 2 (James M Snell) #66098
[291d56ea3e] - (SEMVER-MINOR) perf_hooks: harden histogram CBOR import validation (James M Snell) #66098
[70c269aadc] - perf_hooks: restore GC tracking after snapshot deserialization (James M Snell) #66097
[c545d044ee] - perf_hooks: track GC callback installation natively (James M Snell) #66097
[0bd9905959] - perf_hooks: fix PerformanceObserver observer count leaks (James M Snell) #66097
[8ec2a940c5] - perf_hooks: add performanceNodeTiming.uvMetricsInfoBigInt (James M Snell) #66094
[829891da14] - perf_hooks: fix truncation of uvMetricsInfo counters (James M Snell) #66094
[afa02fb69c] - process: use a class for nextTick resources (Matteo Collina) #66415
[6299b09d5c] - (SEMVER-MINOR) process: graduate process.ref/unref from experimental (James M Snell) #66213
[0965b28252] - querystring: speed up default parse and unescape (Yagiz Nizipli) #66175
[bd547c1176] - quic: cleanly tear down QUIC after worker.terminate() (Tim Perry) #66093
[52bbf8cb15] - report: skip unresponsive workers on process timeout (Trivikram Kamat) #66304
[702c744643] - sea: add test and update docs for import() with code cache (Ali Hassan) #62678
[a1bfb6fcda] - sea: add vfsArchive to serve the assets from a ZIP archive (Matteo Collina) #65810
[fe76deb537] - sqlite: restore connection state on reopen (Guilherme Araújo) #66042
[4977e51ff3] - sqlite: use cached strings for property keys (Kyungrae Kang) #65902
[cd16dcb82b] - sqlite: reject plans with unusable virtual table parameters (Trivikram Kamat) #66215
[33caead942] - sqlite: throw on oversized string values (Guilherme Araújo) #66209
[41d6707b63] - (SEMVER-MINOR) sqlite: rename DatabaseSync and StatementSync (Guilherme Araújo) #65988
[583ee1ce64] - sqlite: run generator return() on cursor refilter (Trivikram Kamat) #66195
[b46b6996e2] - sqlite: add virtual table support via createModule() (Trevor Burnham) #65787
[edbff8caf1] - src: fix --process-timeout message when exit waits (Trivikram Kamat) #66361
[cd814e7f23] - src: remove orphaned js_udp_wrap test binding (René) #66399
[1e9c10b8ea] - src: assert that an IsolateData outlives its Environments (Shelley Vohr) #66239
[286bffc0a1] - src: track handle cleanup per thread, not per IsolateData (Shelley Vohr) #66239
[25c08fcd0d] - src: remove HAVE_QUIC macro in favor of OPENSSL_NO_QUIC (Antoine du Hamel) #66373
[5eea87c561] - src: fix builds without SSL and SQLite (Filip Skokan) #66372
[9696e47c32] - src: reduce InternalCallbackScope overhead (Nigro Simone) #66316
[60d0aa0cd4] - (SEMVER-MINOR) src: add --process-timeout=N (James M Snell) #66138
[12962d8eb5] - src: fix FreeEnvironment() breaking JS in sibling Environments (Shelley Vohr) #65977
[abccf93d9f] - src: let Environments on one isolate share a cleanup hook (Shelley Vohr) #65777
[caa7858e4c] - src: fix abort when two Environments share an IsolateData (Shelley Vohr) #65978
[f39916a7e3] - (SEMVER-MINOR) src: expose size and count in heap profile output (Ilyas Shabi) #65737
[de34ddcf95] - src: throw on a malformed localStorage file (Trevor Burnham) #65879
[6651596663] - src: reserve shared_array_buffers capacity in Message::Deserialize (agape1225) #65304
[74835eef19] - src: ensure Socket(fd) cannot bypass allow-net permission (James M Snell) #66117
[d7c720f283] - src: add a flag to keep the embedder's wasm streaming callback (Shelley Vohr) #65690
[68931f70d9] - src: free placeholder nodes for cppgc wrappers in MemoryTracker (Shelley Vohr) #65793
[13dbf1923a] - src: fix task queue deadlock when built as C++23 (Shelley Vohr) #66066
[0b00d5ea59] - (SEMVER-MINOR) src: let embedders exempt linked bindings from the addon permission (Shelley Vohr) #66067
[158f6f78d4] - stream: share webstreams async iterator methods (Matteo Collina) #66392
[e241cb80da] - stream: keep webstreams nil requests in fast mode (Matteo Collina) #66230
[62187ab707] - stream: keep consumer state in fast mode (Matteo Collina) #66266
[dcc8665f7e] - stream: fix pipeline function tail deadlock (Dayun) #65559
[247c0274c1] - stream: skip write() checks in flowing pipe (Yagiz Nizipli) #66182
[26102c22f2] - stream: speed up flowing pipe of buffers (Yagiz Nizipli) #66182
[81e4ac47a3] - stream: support ArrayBufferView in Utf8Stream write() buffer mode (agape1225) #65301
[f7f1116fc9] - stream: fill out stream/iter test coverage (James M Snell) #66079
[dca736ba05] - stream: cleanup promise uses in stream/iter (James M Snell) #66079
[55ef82ac0c] - stream: make classic reads wake on return/throw/abort (James M Snell) #66079
[4e8df7ceee] - stream: correct strict pending-write behavior & cancellation (James M Snell) #66079
[b44b8658d3] - stream: make stream/iter toWritable apply backpressure (James M Snell) #66079
[3c9f8789c4] - stream: trim per-pipe and per-tee costs in webstreams (Matteo Collina) #66154
[d96a80930e] - stream: update ShareImpl to retain factory abort listener (James M Snell) #66030
[500b56774f] - stream: make Broadcast.from() only return the Broadcast (James M Snell) #66030
[d40236c98e] - stream: ensure streamable protocols precede fast paths (James M Snell) #66030
[cdeb53e807] - stream: have broadcast clean factory listeners on cancel (James M Snell) #66030
[84f9031add] - stream: ensure protocol and transform accessors are called once (James M Snell) #66030
[1c7c0f5267] - stream: make broadcast waiters use SafeSet (James M Snell) #66030
[9b50b629a2] - stream: ensure nested async iterators are cancellation aware (James M Snell) #66030
[a16320eb15] - stream: trim per-stream costs in webstreams (Matteo Collina) #66052
[3a77852e34] - stream,quic: correct stream/iter writer implementations (James M Snell) #66079
[6c5806b53c] - test: wait for ZIP source streams to close (Filip Skokan) #66429
[4706cafc59] - test: mark worker init failure flaky on SmartOS (Filip Skokan) #66428
[c19e2cedd2] - test: deflake process timeout report cleanup (Filip Skokan) #66428
[1047188452] - test: split process timeout report coverage (Filip Skokan) #66428
[430262ecb0] - test: do not hardcode V8 serialization header (Joyee Cheung) #66442
[7b25cb811a] - test: make histogram external memory test less overfitting (Joyee Cheung) #66416
[aead8a9019] - test: cover Environments sharing an embedder-owned isolate (Shelley Vohr) #66239
[f63ddfafdc] - test: isolate styleText tests from the environment (Filip Skokan) #66320
[a3ffd40d40] - test: probe cluster workers with signal 0 (Filip Skokan) #66320
[f59117e5fd] - test: deflake watch cwd with isolation none (Filip Skokan) #66320
[f23010d837] - test: deflake esm loader http imports (Filip Skokan) #66320
[3f51c49ff9] - test: deflake http headers timeout keepalive (Filip Skokan) #66320
[a5ee59cb00] - test: deflake http server mixed request timeouts (Filip Skokan) #66320
[7c3463901f] - test: deflake inspector close connection test (Filip Skokan) #66320
[fbdca3a120] - test: deflake debugger PID attachment and cleanup (Filip Skokan) #66320
[534561358e] - test: deflake inspector network fetch (Filip Skokan) #66320
[1ff8d5c2c9] - test: use correct constructor in test-sqlite-virtual-table (René) #66401
[de797aa4b4] - test: check frame restore in CallbackScope (Nigro Simone) #66316
[886fd32693] - test: use common.PIPE in fs.cp socket tests (Maksim Romanov) #66329
[3c50781d10] - test: deflake fast FFI buffer tests (Filip Skokan) #66327
[1d8f9a2bfb] - test: use Database in sqlite virtual table test (Trivikram Kamat) #66307
[61a87a246f] - test: deflake sliding window histogram test (James M Snell) #66132
[017ff85b82] - test: split FFI call and callback coverage (Filip Skokan) #66287
[19d8d1992c] - test: add smoke tests for defer importing synthetic modules (Maya Lekova) #65537
[fb3d90a986] - test: deflake test runner timeout coverage (Filip Skokan) #66255
[cee8eb9c74] - test: deflake inspector async hook setup (Filip Skokan) #66255
[37e9397bfe] - test: deflake debugger function name extraction (Filip Skokan) #66231
[7b1c74eec3] - test: use spawnSync helpers in cpu-prof tests (Junhwan Choi) #65694
[2fd51fd5d8] - test: reduce expensive crypto test variants (Filip Skokan) #66244
[c155248f1b] - test: ensure fsPromises.watch rejects on abort (Jihwan) #65768
[42255ab9b1] - test: avoid using promise wrapped timers (James M Snell) #66079
[62f92a5d3d] - test: enable trace_events tests with perfetto (Chengzhong Wu) #66068
[f2972bf10a] - test: accept ENOTEMPTY from libc++ in test-fs-rm (Shelley Vohr) #66065
[e0d0c5d0e2] - test: use heapdump test for SecureContext memory tracking (Mert Can Altin) #64344
[953e46789d] - test: update WPT for url to c48d58747e (Node.js GitHub Bot) #66141
[aaa7a7aebe] - test: deflake watch mode tests (Filip Skokan) #66232
[ee457cd306] - test: mark some tests flaky for now on riscv64 (Stewart X Addison) #65781
[9b432e97ca] - test: deflake pummel/test-timers (Filip Skokan) #66135
[63d32369b1] - test: update WPT for WebCryptoAPI to a6a0a0292a (Node.js GitHub Bot) #66142
[658951021a] - test: deflake test-bench-errors (Filip Skokan) #66153
[1be62ae8d5] - test: deflake test-http2-debug (Filip Skokan) #66151
[b9f61ea9ab] - test: deflake test-benchmark-crypto (Filip Skokan) #66151
[fb9aba67dd] - test: deflake long timer WPTs (Marco) #63106
[53b3a053a2] - test: update test426-fixtures to 9ea66b466fd37e8a4050033d23b3e1480973c3d (Node.js GitHub Bot) #66493
[ef1a602283] - test: update WPT for WebCryptoAPI to 3127c3a492 (Node.js GitHub Bot) #66492
[d573726238] - test_runner: do not crash on stdout that mimics a v8 frame (Muhammad Faizan Uddin) #66273
[ea2c1bbe8b] - test_runner: do not reuse a worker ID held by a running file (Vasiliy Serpokryl) #65739
[0f0892e59c] - tls: initialize session and SNI before connecting (Steven) #65624
[684cae7909] - tls: preserve CN name constraints with OpenSSL 4.1 (Filip Skokan) #65957
[df96c928a2] - tools: limit checkout for lint-cpp (Yuya Inoue) #66474
[593c96446c] - tools: limit format-cpp checkout history (Yuya Inoue) #66479
[4251b8b1f9] - tools: share CI and benchmark build configuration (Filip Skokan) #66351
[6948dd1232] - tools: fix nixpkgs updater script (Antoine du Hamel) #66337
[e3f861b23e] - tools: wait for test processes instead of polling (Matteo Collina) #66432
[14cc5877d7] - tools: avoid repeated subtree scans in must-call-assert (Yuya Inoue) #66408
[7fb76f9554] - tools: add cache to lint-js-and-md (Antoine du Hamel) #66412
[9015b992d0] - tools: bump brace-expansion in /tools/clang-format (dependabot[bot]) #66418
[84db29179a] - tools: bump brace-expansion from 5.0.9 to 5.0.12 in /tools/eslint (dependabot[bot]) #66417
[a952647d86] - tools: keep OpenSSL update PRs in draft until arch configs committed (René) #66398
[2d3be6adf2] - tools: update gyp-next to 0.22.3 (Node.js GitHub Bot) #66397
[5f54bc7763] - tools: fix Nix diff tools when pushing more than 1 commit (Antoine du Hamel) #66383
[2c06236669] - tools: reduce bundle size of benchmarkTools.nix (#65388) (Antoine du Hamel) #65388
[b10949cdca] - tools: add deps/LIEF to the ignore list of test-shared.yml (Antoine du Hamel) #66342
[80cd5d8143] - tools: bump the doc group in /tools/doc with 4 updates (dependabot[bot]) #66295
[aaaca48ce8] - tools: check CI availability and workload (Filip Skokan) #66280
[0607f14c3a] - tools: enable temporal by default in Nix integration (Antoine du Hamel) #66267
[605938efb3] - tools: reduce source tarball compression in CI (inoway46) #66228
[0913452391] - tools: add lief to automated dependency updates (René) #66242
[63469ca078] - tools: add resume-ci label handling (Filip Skokan) #65945
[8e79b1fa36] - typings: wire up spawn_sync internal binding types (agape1225) #65996
[0845991255] - typings: share AsyncWrap and HandleWrap types (Seongeun Lee) #66150
[e90ba99def] - typings: add mksnapshot internal binding types (Seongeun Lee) #65901
[8623a13d97] - typings: wire up quic internal binding types (agape1225) #65556
[7202aa55a7] - url: create URLSearchParams collision map lazily (Romain Lanz) #65801
[aff60171cd] - util: make mime parsing faster (James M Snell) #66369
[83a1697f1c] - util: fix inspect indentation of detached DataView (Miodrag Obradovic) #66421
[33ef1780fd] - util: show SuppressedError's error/suppressed properties on inspect (agape1225) #66159
[dbb0e6e164] - util,assert: expose util.isPartialDeepStrictEqual() (Thomas Hunter II) #66118
[afb61d6ca4] - vfs: make the reserved root readable through fs (Philipp Dunkel) #66140
[83c0e30cd7] - vfs: drop --vfs-mount, pin the load mount point (Philipp Dunkel) #66162
[9656992aff] - vfs: support recursive readdir in ZipProvider (Philipp Dunkel) #66127
[d5b65c3b94] - vfs: validate ZipProvider parent directories (Trivikram Kamat) #65829
[41e9ab96cd] - watch: escape quotes and backslashes in NODE_OPTIONS (Trivikram Kamat) #66363
[17964bb699] - watch: detect files replaced via unlink and create (Marco) #63888
[be7f637d0e] - watch: strip watch flags from NODE_OPTIONS in child process (Marco) #62143
[6c23e21c00] - worker: discard queued messages on termination (Filip Skokan) #66354
[ee51b0412f] - worker: serialize messages after exit (Filip Skokan) #66354
[c2c5f4ccbe] - worker: preserve blob module URLs (Filip Skokan) #66354
[05d533ede5] - worker: convert importScripts arguments first (Filip Skokan) #66354
[230cd0ce43] - worker: fix postMessage overload resolution (Filip Skokan) #66354
[78b502a565] - worker: add Symbol.toStringTag to BroadcastChannel (Lazizbek Ergashev) #65532
[56e6a5c8d8] - worker: add Symbol.toStringTag to MessageChannel and MessagePort (Lazizbek Ergashev) #65532
[b896580c47] - worker: remove messageerror listeners on exit (Dayun) #66075
[19732fc576] - worker: strip types in Web Worker module entries (Hubert Walczak) #66085
[bb3d33e610] - zlib: fix abort with decodeStrings: false (James Ross) #66359
[9b350d80ff] - zlib: pledge input size in async zstdCompress() (James Ross) #66358
[6c927c0009] - zlib: preserve brotli params and dictionary on reset (Xia Chao) #66157
[54e93301a1] - zlib: reject reset after gzip/deflate emitted incomplete output (Xia Chao) #66179
[d84b4550e5] - zlib: reject reset while a zstd frame is incomplete (Xia Chao) #66088

2026-09-22, Version 26.10.0 (Current), @aduh95

Notable Changes

[c0a42d23e5] - (SEMVER-MINOR) crypto: add crypto.parsePKCS12() (Brian Muenzenmeyer) #65627
[eb4fabe81e] - doc: add araujogui to collaborators (Guilherme Araújo) #66090
[64fb33d791] - (SEMVER-MINOR) ffi: load libraries from a mounted VFS (Matteo Collina) #65909
[2b1701f810] - (SEMVER-MINOR) fs: add openAsBlobSync (greenhead) #65644
[080e76b3d7] - (SEMVER-MINOR) net: support sending net.BoundSocket to threads and child processes (Guy Bedford) #64725
[13e61f6ae6] - (SEMVER-MINOR) perf_hooks: implement SlidingWindowHistogram (James M Snell) #65825
[a326546094] - (SEMVER-MINOR) perf_hooks: implement qrde analysis support in Histogram (James M Snell) #65806
[0306b0a71e] - (SEMVER-MINOR) sqlite: bind undefined to NULL (Trevor Burnham) #65709
[3c999edef7] - (SEMVER-MINOR) src,lib: add util.markPromiseAsHandled (James M Snell) #65805
[f7d18ec360] - (SEMVER-MINOR) test: expand histogram test coverage (James M Snell) #65825
[3ce4d23bbb] - (SEMVER-MINOR) util: implement util.throttle (James M Snell) #65899
[336f33ccc1] - (SEMVER-MINOR) util: implement debounce (James M Snell) #65899

Commits

[2bf082453b] - assert: fix TypeError on deepStrictEqual with null Map key or Set member (Sergey Sannikov) #64449
[c518831d00] - benchmark: add --csv option to compare.js with --analyze (James M Snell) #65922
[89bae46e68] - buffer: fix unaligned UTF-16LE decoding (Matteo Collina) #65905
[01cee9dcef] - build: do not use bundled simdutf when built with --shared-simdutf (Antoine du Hamel) #65891
[20606a4d19] - build: suppress OpenSSL asm warnings with clang (Richard Lau) #66023
[a76e97b5c5] - build: derive V8_LOGGING_LEVEL from dcheck_always_on (Joyee Cheung) #65744
[ac7fcf0cef] - build: sync cargo/rustc version warnings (Richard Lau) #65912
[f24a495b36] - build: fix quiet default for make builds (Shelley Vohr) #65826
[c4381765fe] - child_process: clear timeout timer on spawn-time error too (kishore280) #65506
[8955781eeb] - crypto: remove redundent std::move call (Antoine du Hamel) #66111
[0b88aa5a15] - crypto: read RSA-PSS restrictions from provider (Filip Skokan) #66108
[f90d3d3cb0] - crypto: skip private RSA parameters in key details (Filip Skokan) #66108
[97828d91db] - crypto: use provider EC group names (Filip Skokan) #66108
[3de05da569] - crypto: fetch ciphers for private-key encoding (Filip Skokan) #66108
[ca8ee04594] - crypto: decode PKCS#1 keys through providers (Filip Skokan) #66108
[54a625e953] - crypto: derive keys through EVP_KDF (Filip Skokan) #66108
[971adece6a] - crypto: use names for asymmetric key algorithms (Filip Skokan) #65966
[bfb544eb00] - crypto: optimize and benchmark key preparation (Filip Skokan) #65892
[c0a42d23e5] - (SEMVER-MINOR) crypto: add crypto.parsePKCS12() (Brian Muenzenmeyer) #65627
[c58a4e0ba7] - crypto: add Hybrid KEMs to Web Cryptography (Filip Skokan) #65759
[70edf90851] - crypto: avoid EC reconstruction for signature sizing (Filip Skokan) #65908
[fab5dddd77] - crypto: avoid EC raw export reconstruction (Filip Skokan) #65908
[220a499614] - crypto: export EC JWK coordinates directly (Filip Skokan) #65908
[f1295e11db] - crypto: read EC curve metadata directly (Filip Skokan) #65908
[775173a5db] - crypto: optimize private EC JWK import (Filip Skokan) #65908
[e44669bb7d] - crypto: validate the limit of PBKDF2 iterations (Filip Skokan) #65704
[cd5a7611e9] - crypto: use primordials in HKDF info validation (Filip Skokan) #65704
[94affce749] - Revert "deps: V8: override depot_tools version" (Richard Lau) #66110
[870a366c49] - deps: V8: cherry-pick 95efbaf92a0d (Igor Sheludko) #66020
[d62a452738] - deps: V8: backport a0607c5006b8 (Antoine du Hamel) #65891
[e8edeffe2d] - deps: update googletest to 8eff9e336692fc95961e096564f1044c600b881d (Node.js GitHub Bot) #66009
[eb4fabe81e] - doc: add araujogui to collaborators (Guilherme Araújo) #66090
[2fffb3872d] - doc: fix duplicate 'the' typo in node_platform.cc (Muhammad Al-Muzahid) #66058
[317abb8131] - doc: clarify sub-1000ms behavior in socket.setKeepAlive (Haram Jeong) #65869
[1c12f815c2] - doc: remove obsolete mentioning of cl.exe on windows (Chengzhong Wu) #66038
[2cc17dd67c] - doc: note that default signal handling resets the signal mask (Shelley Vohr) #65877
[3a69cc1bf4] - doc: clarify QUIC async write backpressure (John Finnerty) #65947
[549694349d] - doc: clarify permission model scope for output paths (Rafael Gonzaga) #66004
[3325ded3a8] - doc: fix sign-off format in AGENTS.md (Filip Skokan) #65958
[89aa2bd10c] - doc: fill in missing zstd docs (James M Snell) #65867
[8d1ce4d477] - doc: add inoway46 as triager (Yuya Inoue) #65565
[9a3697c5c7] - doc: document windowsHide for child_process.fork (Christopher Buss) #65887
[69911bf6b5] - doc: qualify directory read ordering for native fs (Trivikram Kamat) #65868
[2d0c3fed12] - doc: add DOMException section to errors API reference (Avocado) #65206
[f744023cce] - doc: expand revert commit collaborator instructions (Mike McCready) #65848
[412399efd3] - doc: clarify supported Python releases (Mike McCready) #65850
[79331f5779] - doc: note that FreeEnvironment() runs a shared event loop (Shelley Vohr) #65691
[6ddbb9982f] - doc,test: account for OpenSSL 4.1 behaviours (Filip Skokan) #65956
[64fb33d791] - (SEMVER-MINOR) ffi: load libraries from a mounted VFS (Matteo Collina) #65909
[07fcf1ed02] - ffi: throw ERR_INVALID_ARG_TYPE for wrong-typed pointer and size (Soul Lee) #65842
[b7406b0a9b] - fs: coerce FileHandle.read length like fs.read (Xia Chao) #65521
[cb9995be4d] - fs: honor dereference for symlinks nested in cpSync trees (Christian Aurich) #65731
[2b1701f810] - (SEMVER-MINOR) fs: add openAsBlobSync (greenhead) #65644
[9b3f1aa03f] - fs: throw on existing dir in cpSync with errorOnExist (Daijiro Wachi) #64124
[2b502e0798] - fs: support removing read-only files in rmSync on Windows (Sparsh :)) #64453
[77d8f17ab1] - http: don't destroy socket after request completes (Barath Raj) #65952
[46f76ed57b] - http2: settle pending write callbacks on destroy (Matteo Collina) #66016
[205443721d] - http2: fix onread assert when destroying session from stream handler (Sankalp Thakur) #65116
[7e1db4724a] - inspector: report an error when DOM storage is unavailable (Avocado) #65973
[95110712b8] - inspector: fix abort when two Environments own the inspector (Shelley Vohr) #65877
[9fd3e6caa4] - inspector: fix crash when the IsolateData has no platform (Shelley Vohr) #65818
[cce2795ad7] - lib: fix AbortSignal.any() abort propagation (Yuya Inoue) #66014
[2c0ccc0067] - lib: fix for FileHandle.readableWebStream (Patrick Dähne) #58842
[28acafe6a0] - lib: avoid repeat internal receiver checks (Filip Skokan) #65910
[b9b0e33923] - lib: avoid unsafe array iteration in cli table (Donghoon Kang) #65838
[7f514d3310] - lib: fix shared buffer growability validation (Filip Skokan) #65845
[7534117e38] - lib: optimize internal Web IDL dictionaries (Filip Skokan) #65857
[bdacc08fbe] - lib: validate sequence iterator objects (Filip Skokan) #65844
[5b6ac71fb2] - lib: use Web IDL interface brand checks (Filip Skokan) #65846
[da341e2571] - lib,src: apply multiple updates to dtls implementation (James M Snell) #65511
[13eb4843d5] - meta: bump step-security/harden-runner from 2.21.0 to 2.21.1 (dependabot[bot]) #66044
[0f759174af] - meta: bump github/codeql-action/upload-sarif from 4.37.9 to 4.38.0 (dependabot[bot]) #66046
[c75b830082] - meta: bump cachix/cachix-action (dependabot[bot]) #66047
[1ada7055a4] - meta: bump github/codeql-action/init from 4.37.9 to 4.38.0 (dependabot[bot]) #66048
[1ed8b05742] - meta: bump github/codeql-action/analyze from 4.37.9 to 4.38.0 (dependabot[bot]) #66049
[9165abe840] - meta: bump github/codeql-action/autobuild from 4.37.9 to 4.38.0 (dependabot[bot]) #66050
[d03e7313cf] - meta: add joyeecheung as v8 currency strategic initiative champion (Joyee Cheung) #65965
[53d7592378] - meta: expand on collaborator restoration process (Chengzhong Wu) #65962
[fa972d02b2] - meta: add web-standards as webidl owners (Filip Skokan) #65856
[080e76b3d7] - (SEMVER-MINOR) net: support sending net.BoundSocket to threads and child processes (Guy Bedford) #64725
[0d14c0e507] - path: remove StringPrototypeCharCodeAt from some methods of posix (Wiyeong Seo) #54668
[13e61f6ae6] - (SEMVER-MINOR) perf_hooks: implement SlidingWindowHistogram (James M Snell) #65825
[a326546094] - (SEMVER-MINOR) perf_hooks: implement qrde analysis support in Histogram (James M Snell) #65806
[32401c2229] - perf_hooks: reuse buffer for uv metrics (Donghoon Kang) #65985
[5e2fbfe0e5] - perf_hooks: validate import normalization offset (Matteo Collina) #65950
[4743cd8d33] - quic: fix two small bugs in HTTP/3 stream internals (Tim Perry) #65970
[0df54fb38f] - quic: improve stream cleanup & lookup (Tim Perry) #65944
[7cf448889c] - quic: fix timeout regression from 11ed32572b (James M Snell) #66028
[61a98e6512] - quic: fix readable stream truncation on stop-sending, abort & timeout (Tim Perry) #63967
[975cac593c] - quic: add promise to QuicStream for pending strms (Marten Richter) #65862
[ae29cc92ea] - quic: split headers out from src/quic/stream.{h/cc} (James M Snell) #65863
[833c58d9dc] - quic: fix crash in onStreamClose (Marten Richter) #65861
[84ecb21343] - quic: reject zero addressLRUSize (Christian Aurich) #65827
[293e69d065] - sqlite: throw on invalid URL path instead of abort (Guilherme Araújo) #66026
[6f5fb76d0e] - sqlite: track registered user-defined functions (Trivikram Kamat) #65896
[baf112b639] - sqlite: always copy changeset before applying (Trivikram Kamat) #65870
[0306b0a71e] - (SEMVER-MINOR) sqlite: bind undefined to NULL (Trevor Burnham) #65709
[1f24901c0c] - src: fix -Wextra warning in WriteFileSync (Antoine du Hamel) #66020
[b98787fe2d] - src: reuse crypto GetCipherInfo in DTLS session (Ilyas Shabi) #66022
[410093dbf7] - src: avoid union type-punning in trace values (Khaidi Chu) #65933
[9ec030b1e7] - src: print exception thrown during primordial initialization (Joyee Cheung) #65991
[a0f99f1d6c] - src: support building with the V8 sandbox (Shelley Vohr) #62237
[27c62235d0] - src: ffi: create fast-call metadata Symbols lazily (Matteo Collina) #66015
[5a5abd8fd0] - src: avoid copying SEA snapshot data (Colin McDonnell) #65876
[a05023f331] - src: fix crash on empty, foreign or truncated --snapshot-blob files (Shelley Vohr) #65955
[4141e22606] - src: don't kill own process group on failed spawn (Lazizbek Ergashev) #65054
[05f4e54eda] - src: fix external reference list race between concurrent isolates (Shelley Vohr) #65779
[1518b7d67f] - src: keep the first snapshot blob alive for later isolates (Shelley Vohr) #65779
[62e2bf025c] - src: detach cppgc wrappers from their Realm before it is freed (Shelley Vohr) #65778
[afc3e559d2] - src: fix Stop() terminating the next Environment on the isolate (Shelley Vohr) #65819
[f245e53b29] - src: seed V8 from the OS CSPRNG instead of OpenSSL's DRBG (Colin McDonnell) #65796
[830ca7df7a] - src: fix null pointer call when running without a startup snapshot (Shelley Vohr) #65820
[48158fba8c] - src: stop leaking a CppHeap in CommonEnvironmentSetup (Shelley Vohr) #65792
[3c999edef7] - (SEMVER-MINOR) src,lib: add util.markPromiseAsHandled (James M Snell) #65805
[e5d2a336bd] - stream: destroy half-open sockets after iteration (Matteo Collina) #65986
[4075161405] - stream: destroy Duplex.from async function on early return (Aman Chadha(IVIXMMI)) #65963
[7d245cfd8d] - stream: fixup stream/iter to drop at most one entry per share call (James M Snell) #66028
[30e1f7651c] - stream: reject unbounded at SyncShare construction (James M Snell) #66028
[0372056cd8] - stream: make share budget failures detach before throwing (James M Snell) #66028
[36cc238dce] - stream: make Broadcast.from abort its background pump (James M Snell) #66028
[3134ca6f8e] - stream: update broadcast to retain buffered data with zero consumers (James M Snell) #66028
[04e5c282a1] - stream: fix async iteration of undefined chunks (Caleb Everett) #65969
[f81a1483b3] - stream: avoid promise allocation for parked transform writes (Matteo Collina) #65625
[aec01c5ae1] - stream: keep webstream stream states in fast-mode objects (Matteo Collina) #65625
[898cd55bdf] - stream: reject closed only after sink abort settles (Lazizbek Ergashev) #65727
[5661526006] - stream: fix ERR_INVALID_STATE when cancelling Readable.toWeb() (Richard Scarrott) #62773
[fb8a97f46b] - stream: improve handling of falsy errors in stream/iter (James M Snell) #65864
[cfee7fa3d9] - stream: amortize writable buffer compaction (Gürgün Dayıoğlu) #65847
[15605210f8] - stream: create write request objects lazily (Matteo Collina) #64455
[619470a9ae] - stream: allocate stream read buffers from a slab (Matteo Collina) #64455
[7e79c33354] - test: consolidate crypto provider cache coverage (Filip Skokan) #66108
[dcc9c3c02a] - test: avoid call to chmodSync in test-fs-cp-async-file-modes (Antoine du Hamel) #66104
[dda22c06d7] - test: deflake test-run-watch-cwd-isolation-none-* (Antoine du Hamel) #66035
[d63928dda0] - test: move permission FFI test to native suite (Yuya Inoue) #66059
[80c1bf7fb5] - test: deflake user timing WPT assertions (Filip Skokan) #66036
[12116d1d70] - test: unskip test-watch-create-isolation-none (Antoine du Hamel) #66041
[e90575cb4d] - test: deflake util.throttle tests (Filip Skokan) #66034
[f7d18ec360] - (SEMVER-MINOR) test: expand histogram test coverage (James M Snell) #65825
[bfa6d49b5c] - test: implement low-risk test optimizations (James M Snell) #65926
[c3307ebddf] - test: update WPT for WebCryptoAPI to 55ce71bb9d (Node.js GitHub Bot) #65813
[ee29c56993] - test: prevent parser reuse across close scenarios (Filip Skokan) #66017
[8a27474044] - test: cover cpSync fast path timestamp preservation (Abhinandan Kumar) #65678
[89297305c0] - test: fix stderr Buffer assertion in exec encoding test (greenhead) #66008
[d4cb916624] - test: skip test-vfs-real-provider-watch.js on IBM i (SRAVANI GUNDEPALLI) #65987
[6515db8ab6] - test: fix RSA/DSA wrong-passphrase flake (Filip Skokan) #65983
[fa19ecad9d] - test: improve sequential test performance (James M Snell) #65928
[3666d6a238] - test: schedule WPT variants individually (Filip Skokan) #65984
[f2aa27d82d] - test: overlap SLH-DSA signature checks (Filip Skokan) #65980
[2170207253] - test: unref cancelled broadcast source timer (Filip Skokan) #65980
[71a54aaf5f] - test: collect timeout signals explicitly (Filip Skokan) #65980
[1a15aff897] - test: skip retries in DNS timeout coverage (Filip Skokan) #65980
[5c7e6b4a6e] - test: synchronize ordered runner events (Filip Skokan) #65980
[37f24eddc9] - test: reuse fixed primes in DH tests (Filip Skokan) #65980
[831ec42bcc] - test: avoid idle HTTP/HTTPS connections (Filip Skokan) #65980
[f523342bcd] - test: close WebAssembly test HTTP servers (Filip Skokan) #65980
[f23847a122] - test: use named parameters in DH stress test (Filip Skokan) #65980
[7131e3b437] - test: reduce ZIP64 stress test I/O (Filip Skokan) #65980
[e4ca72a984] - test: avoid allocations in external memory test (Filip Skokan) #65975
[7fe64727a2] - test: cover experimental stream iterator builtins (Jungwon Sohn) #65964
[88ba17bae2] - test: deflake node-api test-free-called (Christian Aurich) #65948
[6eee01fbae] - test: fix flaky common WPT inspector test (Yuya Inoue) #65937
[858702e51c] - test: skip C++ symbols in tick-processor-arguments (Philipp Dunkel) #65906
[472215ff9b] - test: try fixing windows build replacing WMIC (James M Snell) #65949
[7f5168149c] - test: fix flaky test-bench-stream (Matteo Collina) #65874
[9f2d544576] - test: move sqlite length validation out of the reentry test (Trevor Burnham) #65769
[75a9fa65ac] - test: fix flaky cleanup in http2 test (Tim Perry) #65701
[f8cdf05586] - test,benchmark: use OpenSSL feature helpers (Filip Skokan) #65762
[88b12c03cd] - test_runner: avoid reusing v8 serializers (Yuya Inoue) #65951
[9b3085e660] - test_runner: fix quote escaping in JUnit (Jihwan) #65971
[02c2302c31] - tls: propagate singleUse to the secure context (Carlos Vinicius) #66025
[2a8b5d9269] - tls: load all CRLs from a PEM bundle (Lazizbek Ergashev) #65577
[d141ddb8dc] - tls: defer re-entrant calls to SSL state machine from JS (Tim Perry) #65105
[b7fe779632] - tools: update tools/v8 for Python 3.13 (Richard Lau) #66109
[6105b37a3d] - tools: bump eslint-plugin-jsdoc in /tools/eslint in the eslint group (dependabot[bot]) #66102
[060ed69df9] - tools: disable fortify warnings in test-shared (Antoine du Hamel) #66020
[f8b7a2ff41] - tools: clean up handling of shared libs in shell.nix (Antoine du Hamel) #65891
[3c9586c1fc] - tools: group CodeQL GHA updates (Antoine du Hamel) #66057
[aa531a34f7] - tools: summarize auto-start-ci failures (Filip Skokan) #65979
[b7eef15f59] - tools: bump the eslint group in /tools/eslint with 6 updates (dependabot[bot]) #66045
[8914947d7c] - tools: update pgo build doc for linux (Chengzhong Wu) #66024
[a5b1659d5b] - tools: avoid workflow shell interpolation (Filip Skokan) #66013
[caf0ee0d7b] - tools: use self-repository references (Filip Skokan) #66013
[d5880dcb05] - tools: correct Slack action version comments (Filip Skokan) #66013
[66f182f565] - tools: make checkout credential use explicit (Filip Skokan) #66013
[287ece3f22] - tools: pass author to commit message validator (Filip Skokan) #66012
[6314ccf93b] - tools: reduce test runner timing overhead (Filip Skokan) #65980
[441350a867] - tools: do not download build tools when linting Nix files (Antoine du Hamel) #65961
[15f2549f74] - tools: bump js-yaml from 4.3.1 to 4.3.2 in /tools/eslint (dependabot[bot]) #65931
[0e449d02a6] - tools: bump js-yaml from 4.3.1 to 4.3.2 in /tools/lint-md (dependabot[bot]) #65932
[81eba460b5] - tools: fix commit queue error summary matching (Filip Skokan) #65913
[e5bbcfdd78] - tools: lint PR commit messages without approval (Filip Skokan) #65875
[07ae602005] - tools: unlabel author ready on base branch conflicts (Filip Skokan) #65872
[e3ad68289a] - tools: improve benchmark build cache reuse (Filip Skokan) #65859
[46ddc0220d] - tools: apply feedback to and simplify contributor guidance workflow (Filip Skokan) #65785
[66fd78803d] - trace_events: fix abort when Node.js does not own the V8 platform (Shelley Vohr) #65954
[3cb3c23a19] - typings: add task_queue internal binding types (Seongeun Lee) #65662
[c5c7036e7b] - typings: add timeoutInfo to TimersBinding (greenhead) #65811
[62fe96c166] - typings: add missing sea binding properties (이혜미) #65815
[e51673b4ed] - url: add Symbol.toStringTag to URLPattern (Khaidi Chu) #65925
[3ce4d23bbb] - (SEMVER-MINOR) util: implement util.throttle (James M Snell) #65899
[336f33ccc1] - (SEMVER-MINOR) util: implement debounce (James M Snell) #65899
[16e3e7eff3] - vfs: add --vfs-mount and --vfs-load startup flags (Philipp Dunkel) #65748
[c50cb9a553] - vfs: write RealFSProvider files to open fd (Christian Aurich) #65885
[1bbc5488a5] - vfs: close the fs hook gaps for mounted paths (Philipp Dunkel) #65852
[816790e0e5] - vfs: resolve symlinks when checking rename descendants (Trivikram Kamat) #65904
[a9149093df] - vfs: support renaming implicit ZIP directories (Trivikram Kamat) #65752
[cf5d4a8fe6] - vfs: reject statfs for missing paths (Trivikram Kamat) #65693
[de552bd044] - vfs: return FileHandle from fs.promises.open (Trivikram Kamat) #65730
[08f96f142e] - vfs: give ZipProvider option bags a null prototype (Philipp Dunkel) #65853
[5c4d319028] - vfs: commit ZipProvider handles the way open(2) does (Philipp Dunkel) #65853
[29d3406b6c] - vfs: apply open(2) effects to ZipProvider handles (Philipp Dunkel) #65853
[e379c26a92] - vfs: align virtual file handles with open(2) (Philipp Dunkel) #65854
[7cdf5f014a] - vfs: answer for unowned paths under reserved root (Philipp Dunkel) #65814
[5e55085bc1] - zlib: reject invalid zstd dictionaries (James M Snell) #65867
[4cdcf7f6a4] - zlib: fix zstd reset (James M Snell) #65867
[678ff3561a] - zlib: improve zstd decoding across chunk boundaries (James M Snell) #65865

2026-09-16, Version 26.9.0 (Current), @aduh95

Notable Changes

[d414624dce] - (SEMVER-MINOR) crypto: add a generic MAC API (Filip Skokan) #65553
[7ac458f802] - (SEMVER-MINOR) crypto: discover ciphers from OpenSSL providers (Filip Skokan) #65484
[7c7e95a3bd] - (SEMVER-MINOR) crypto: discover hashes from OpenSSL providers (Filip Skokan) #65484
[2d2f4f6d1a] - (SEMVER-MINOR) ffi: enable module by default (Matteo Collina) #65475
[657415c6df] - (SEMVER-MINOR) lib: implement node:bench (James M Snell) #65606
[ebcfec2f0c] - (SEMVER-MINOR) perf_hooks: implement Histogram meanCI API (James M Snell) #65606
[e1913630c3] - (SEMVER-MINOR) perf_hooks: add CBOR export/import for histogram exchange (James M Snell) #65434
[8e9151c9f2] - (SEMVER-MINOR) src: let embedders supply a builtin code cache without a snapshot (Shelley Vohr) #65352
[889854f18b] - (SEMVER-MINOR) src,lib: implement experimental DTLS API (James M Snell) #63182
[5198142c59] - (SEMVER-MINOR) vfs: integrate with CJS and ESM module loaders (Matteo Collina) #63653
[5af9d72e7f] - (SEMVER-MINOR) worker: add support for Web Workers (Aviv Keller) #64894

Commits

[59dcad3f44] - (SEMVER-MINOR) benchmark: implement node:bench version of bench tools (James M Snell) #65606
[6bdb6dd8fa] - benchmark: fix max-regressions detection in compare.js (James M Snell) #65587
[49d40091ba] - benchmark: add --analyze option to benchmark/scatter.js (James M Snell) #65594
[bd40a9a19a] - benchmark: add crypto class benchmarks (Filip Skokan) #65518
[6bff2238f5] - buffer: pad aligned allocations by a multiple of 8 (Lazizbek Ergashev) #65605
[37d12946dd] - buffer: prevent abort on indexOf with lone surrogate needle (Rafael Gonzaga) #65430
[02f8eb3b2d] - build: add --shared-perfetto flag (Antoine du Hamel) #65614
[fe7032ec41] - build: enable V8 gdb/lldb plugin support (Chengzhong Wu) #65786
[109f2caf80] - build: allow linking shared dependencies in the GN build (Shelley Vohr) #65797
[55213fd8a8] - build: enable the V8 sandbox in shared-cage builds (Shelley Vohr) #62237
[120929a1b3] - build: add --shared-highway configure flag (Antoine du Hamel) #65686
[c99af0942b] - build: add --shared-abseil configure flag (Antoine du Hamel) #65682
[431c2bf0eb] - build: define V8_CONTIGUOUS_COMPRESSED_RO_SPACE for shared cage (Shelley Vohr) #65464
[b6b5764c6e] - build: remove obsolete configure flags (Chengzhong Wu) #65456
[a623ee29d9] - build,src: make --use-largepages a no-op (Joyee Cheung) #65389
[2f494cb7aa] - crypto: fix multi-prime RSA JWKs (Filip Skokan) #65649
[501d8ac815] - crypto: cache valid ECDH key pairs (Filip Skokan) #65615
[3fd905ea8f] - crypto: add strict mode to --force-fips (Filip Skokan) #65645
[54b3cdb805] - crypto: add FIPS indicator diagnostics channel (Filip Skokan) #65645
[3e6e931fc9] - crypto: fix public PKCS8 export error (한국) #65609
[d414624dce] - (SEMVER-MINOR) crypto: add a generic MAC API (Filip Skokan) #65553
[eef579047c] - crypto: validate JWK usages before key_ops (Filip Skokan) #65550
[9a9b137a24] - crypto: fix private SPKI export error (Filip Skokan) #65550
[9941fb5dab] - crypto: fix RSA-PSS oversized salt handling (Filip Skokan) #65550
[09b431596a] - crypto: correct CCM decryption FIPS error message (kyungrae) #65450
[e6b34e6f7a] - crypto: harden X509Certificate state (Filip Skokan) #65518
[a884b6ccbc] - crypto: optimize key slot caching (Filip Skokan) #65518
[fb512086d3] - crypto: add null checks for OPENSSL_INIT_new() (Nora Dossche) #63457
[656504ffc0] - crypto: prevent Hmac.digest() from returning uninitialized memory (Matteo Collina) #65112
[15e7884732] - crypto: avoid throwing CryptoKey brand checks (Filip Skokan) #65503
[3302bec74a] - crypto: avoid throwing KeyObject brand checks (Filip Skokan) #65503
[7ac458f802] - (SEMVER-MINOR) crypto: discover ciphers from OpenSSL providers (Filip Skokan) #65484
[7c7e95a3bd] - (SEMVER-MINOR) crypto: discover hashes from OpenSSL providers (Filip Skokan) #65484
[0539e90110] - deps: update googletest to 283c17563fe7a1111cd7f581aa5d541e8baeff2f (Node.js GitHub Bot) #65833
[e34af820da] - deps: update simdjson to 4.6.11 (Node.js GitHub Bot) #65834
[5fb7ffebc2] - deps: update zlib to 1.3.2.1-motley-285e94b (Node.js GitHub Bot) #65835
[05cdf1db62] - deps: V8: backport 1a0089053443 (Jakob Linke) #65764
[8910f7914a] - deps: V8: backport c9c0abfa51f0 (Jakob Linke) #65764
[e7fd388424] - deps: V8: backport ebd15783b7ba (Marja Hölttä) #65764
[82715158b8] - deps: V8: backport f3d4d458fe59 (Olivier Flückiger) #65702
[7003159885] - diagnostics_channel: lazily create tracing context (Romain Lanz) #65513
[a97def782f] - doc: clarify node:bench significance policy (James M Snell) #65631
[c74091647d] - doc: clarify isolation modes for node:bench (James M Snell) #65631
[3ef81a676c] - doc: clarify measurement integrity details of node:bench (James M Snell) #65631
[6b565d7b2c] - doc: clarify security triage dispositions and permission boundaries (Rafael Gonzaga) #65436
[724981287c] - (SEMVER-MINOR) doc: move histogram.burnRate to correct location in doc (James M Snell) #65434
[f8b627c09b] - doc: fix default limit of maxHeadersCount (Aryn H) #65472
[aa3d94fc1d] - doc: fix return types for sync methods (Chiang Fong Lee) #58575
[fe9f452ddd] - doc: document REPL DEP0185 throws and uncaught-exception behavior (Adrián Estrada) #64993
[6b84ee66fa] - errors: validate constructor name (Christian Aurich) #65607
[ed1b629901] - events: fix weak listener retention overwrite (Aryan) #64024
[7b4c17f723] - ffi: throw on missing memory helper arguments (Soul Lee) #65500
[cf78d4260e] - ffi: include SharedArrayBuffer in error message (Donghoon Kang) #65735
[2d2f4f6d1a] - (SEMVER-MINOR) ffi: enable module by default (Matteo Collina) #65475
[bdcb6def4e] - ffi: validate DynamicLibrary getter receivers (Trivikram Kamat) #65415
[5d24a8fe37] - fs: copy directory trees for fs.cp() on the thread pool (Shelley Vohr) #65488
[40bdf32d91] - fs: give directories created by cpSync the source directory's mode (Shelley Vohr) #65488
[6ac1bc040f] - fs: write files in one thread pool round trip (Shelley Vohr) #65489
[b4b89c08c1] - fs: handle recursive watch setup races (Filip Skokan) #65699
[54a1311d9e] - fs: apply nocase to literal glob exclude patterns (Yusuke Hayashi) #64817
[2130460831] - fs: improve performance of recursive directory read (Aviv Keller) #65524
[ab7f4c88b7] - fs: do not descend into symlinks for ** unless following symlinks (RafaelGSS) #65435
[e990324e7a] - fs: watch directories, not files, in recursive fs.watch fallback (Shelley Vohr) #65486
[b6db21972a] - fs: preserve directory timestamps in cp (Abhinandan Kumar) #65540
[d418ca140e] - fs: fix recursive watch error handling (Filip Skokan) #65635
[ea372bf9c9] - fs: cancel in-flight stat on abort (Mert Can Altin) #63142
[458664073e] - fs: fix rmSync error messages for non-ASCII paths (Yeaseen) #61233
[34b38235c3] - fs: add maxDepth option to glob (Alexander Lichter) #64003
[e3cc0d9313] - http: fast-forward teardown of unread messages (Matteo Collina) #65732
[f9175a212c] - http: coalesce chunked writes during auto-corking (GetThatCookie) #64987
[b4a7cd3efb] - http2: fix write deadlock exposed by larger window sizes (Tim Perry) #65440
[b7e97f6cfd] - http2: error for incomplete reads on RST, auto-drain, deprecate aborted (Tim Perry) #63249
[d62989dbdf] - http2: fix async context loss when trailers carry END_STREAM (Orgad Shaneh) #63814
[8aba314f87] - https: limit proxy CONNECT response headers (Matteo Collina) #64545
[bea74e1cb5] - lib: put node:bench behind an --experimental-bench flag (James M Snell) #65920
[2835523960] - lib: fixup node:bench handling of --require option (James M Snell) #65631
[aae83d87a4] - lib: improve diagnostic message support (James M Snell) #65631
[ba7baed423] - lib: have runFile honor permissions and accept URL/Buffer paths (James M Snell) #65631
[55103db988] - lib: add runFile api to node:bench (James M Snell) #65631
[0a4c50eb76] - lib: add context.diagnostic api to node:bench (James M Snell) #65631
[476e25e864] - lib: add bench:plan event to node:bench (James M Snell) #65631
[67cf0e556f] - lib: clarify mean in node:bench docs (James M Snell) #65631
[f85f72ad42] - lib: improve node:bench stream handling (James M Snell) #65631
[b32b09f56b] - lib: add runId, fileRunId, entryFile, namePath to node:bench (James M Snell) #65631
[4b9b53f958] - (SEMVER-MINOR) lib: add node:bench explicit createRunner (James M Snell) #65606
[d9f18171f0] - (SEMVER-MINOR) lib: complete the implementation of node:bench and cli (James M Snell) #65606
[c39e20e9ca] - (SEMVER-MINOR) lib: implement bench/reporters (James M Snell) #65606
[657415c6df] - (SEMVER-MINOR) lib: implement node:bench (James M Snell) #65606
[46863a7f9c] - lib: use Float16Array from primordials (Antoine du Hamel) #65702
[cbd0948138] - lib: defer source map payload decoding until first use (Shelley Vohr) #65490
[1ddb1c8934] - lib: optimize async context frame activation (Tim Perry) #65519
[02f6feef7e] - lib: use validateArray for array arguments (JunHwan Choi) #65344
[962795ab8c] - lib: apply minor dtls cleanups (James M Snell) #63539
[c07b2ab8a9] - lib,benchmark: address multiple review issues (James M Snell) #65631
[54a5e25f72] - module: derive builtinModules from enabled builtin set (Jungwon Sohn) #65418
[c93a90cf12] - net: fix BlockList.fromJSON for IPv4-mapped IPv6 rules (Daijiro Wachi) #64125
[506d23b76f] - net: recognize bare IPv6 loopback addresses in isLoopback (Daijiro Wachi) #63619
[81cd6d7b78] - net: improve dtls cert verification (James M Snell) #64314
[51d094e26b] - node-api: make object property arrays const (Yilong Li) #65621
[875c7ecee2] - node-api: enter env context for async callbacks (Shelley Vohr) #65406
[ebcfec2f0c] - (SEMVER-MINOR) perf_hooks: implement Histogram meanCI API (James M Snell) #65606
[09b333bcc5] - perf_hooks: add missing resource timing attributes (greenhead) #65017
[e1913630c3] - (SEMVER-MINOR) perf_hooks: add CBOR export/import for histogram exchange (James M Snell) #65434
[67a78317dd] - permission: do not enforce fs and addons in audit mode (Issac) #65659
[19e69e5f72] - permission: support URL and Uint8Array as has()/drop() reference (Seungmin Nam) #65492
[168af4d8d7] - permission: block FileHandle fsync and fdatasync (Rafael Gonzaga) #65431
[855fff682f] - quic: stop guarding ngtcp2_recv_stop_sending callback field (René) #65688
[d30df2a3e1] - quic: reuse TLS pause machinery to drop event deferral & improve 0RTT (Tim Perry) #65522
[fce1b6a482] - quic: remove unused fin flag from blob reader wakeup (trivenay) #65315
[c721aabfb7] - quic: apply multiple fixes to flow control signaling (James M Snell) #65309
[2c552cd32c] - quic: release stream arenas before cleanup (Trivikram Kamat) #65410
[487662717b] - sea: mount bundled assets as a virtual file system (Matteo Collina) #65675
[0ec15a2a54] - sea: keep ELF segments on separate pages in --build-sea output (Shelley Vohr) #65564
[1627fd6561] - sqlite: re-validate database state after reading options (Trevor Burnham) #65595
[18c3867d19] - sqlite: run backup completion in callback scope (Filip Skokan) #65666
[a77d738683] - sqlite: copy changeset before applying it (Matteo Collina) #65286
[b5f0558c84] - sqlite: reject closing a session from a callback (Trevor Burnham) #65454
[5f95032859] - sqlite: keep sessions alive across SQLite callbacks (Trevor Burnham) #65465
[2ce0e2eb10] - sqlite: throw on disposal of an in-use session (Guilherme Araújo) #65449
[f66ed89136] - src: fix use-after-free in CleanupHookThunkRun (Caleb Everett) #65630
[14613fdc3e] - (SEMVER-MINOR) src: fixup histogram and options linting issues (James M Snell) #65606
[6db3f662cf] - src: fix startup snapshot reproducibility of InternalFieldInfo (Chengzhong Wu) #65684
[8e9151c9f2] - (SEMVER-MINOR) src: let embedders supply a builtin code cache without a snapshot (Shelley Vohr) #65352
[760337aa5b] - src: fix live lock between environments with blocked requests (Ilyas Shabi) #65520
[f2a588c385] - src: apply IsolateSettings when using a snapshot (Shelley Vohr) #65407
[2fd50ae915] - src: add re-entrancy guard to TriggerUncaughtException (Temuulen Undrakhbayar) #64327
[e260fd146c] - src: reuse cached strings in CompileSerializeMain (agape1225) #65453
[0650dca863] - src: add missing vector include (Filip Skokan) #65622
[6e9d44d1fe] - src: disable V8 external memory reasonable size check (Paul Bouchon) #65589
[9c46e56303] - src: report libuv error when openAsBlob cannot stat (Paul Bouchon) #65517
[a0aaff6b07] - src: list scripts when --run has no command (James Ross) #64606
[469590c155] - src: fixup manual new/delete usages (James M Snell) #65348
[5902acf031] - src: make the options structs smaller with packed bits (James M Snell) #65145
[0c24639a5a] - (SEMVER-MINOR) src, lib: add stats to dtls (James M Snell) #63182
[652fbc286e] - (SEMVER-MINOR) src,lib: add dtls interop tests (James M Snell) #63182
[889854f18b] - (SEMVER-MINOR) src,lib: implement experimental DTLS API (James M Snell) #63182
[76538d519c] - stream: use webidl validation semantics for args (James M Snell) #65658
[649a4aba93] - stream: ensure that stateful transforms preserve this (James M Snell) #65658
[23220992c0] - stream: fix nested async flushing with infinite sources (James M Snell) #65658
[3ad1338139] - stream: ensure from() observes returned rejecting promise correctly (James M Snell) #65658
[cafdee6369] - stream: apply source normalization once at call time (James M Snell) #65658
[edb83cb620] - stream: make consumer signals on longer alter source precedence (James M Snell) #65658
[56bdd765df] - stream: make pipeTo source normalization independent of Writer (James M Snell) #65658
[037c07af2b] - stream: pre-aborted pipeTo now applies dest failure handling (James M Snell) #65658
[7308492d48] - stream: ensure pre-existing writes drain before EOF and end() waits (James M Snell) #65658
[756773477b] - stream: ensure async dispoal after endSync awaits for drain (James M Snell) #65658
[042b951312] - stream: ensure factory signals remain active through closing (James M Snell) #65658
[2dc09ca9ca] - stream: canWrite and ondrain now reflect physical capacity (James M Snell) #65658
[9192fbb6dd] - stream: skip unobserved 'readable' emission at EOF (Matteo Collina) #65749
[dc25a61e7a] - stream: avoid per-chunk promises in webstream adapters (Matteo Collina) #65548
[82ae196af6] - stream: address stream/iter review feedback (James M Snell) #65652
[3b37b48592] - stream: replace object sentinel with symbol (James M Snell) #65652
[b6424b6612] - stream: ensure pipeToSync requires synchronous close (James M Snell) #65652
[830fc81acf] - stream: cancel active stream/iter pulls (James M Snell) #65652
[30606908de] - stream: fix merge settlement tagging and falsy error tracking (James M Snell) #65652
[7319198755] - stream: ensure full-close semantics when closed (James M Snell) #65652
[bf5acb783f] - stream: defend against re-entrancy in writev (James M Snell) #65652
[b01594f93a] - stream: ensure stability of stored metadata (James M Snell) #65652
[7bfd81ab09] - stream: fixup writer to terminate on consumer return/throw (James M Snell) #65652
[dc2483c38d] - stream: ensure iterator cleanup on done, reject, etc (James M Snell) #65652
[f6fac6f7f0] - stream: fixup cancelation handling in pull() (James M Snell) #65652
[dfe0617e71] - stream: fix early drain after Utf8Stream reopen (Matteo Collina) #65633
[900fae0a24] - test: split test-bench-cli to try deflaking it (James M Snell) #65919
[31f4bd73b2] - test: make node:bench test samples survive a coarse clock (Shelley Vohr) #65780
[e0fa1893c3] - test: do not dump core in external memory limit test (Shelley Vohr) #65780
[00ad283b8d] - test: zero-fill buffers before the string length limit check (Christian Aurich) #65755
[70763fcc46] - test: expand test coverage of node:bench (James M Snell) #65631
[5a38e6b115] - (SEMVER-MINOR) test: fix node:bench test timing (James M Snell) #65606
[536ae0e24b] - (SEMVER-MINOR) test: improve node:bench test coverage (James M Snell) #65606
[eec66d529c] - (SEMVER-MINOR) test: update bench tests to not fail on no-crypto (James M Snell) #65606
[ce7b349de5] - test: bump WPT webidl and interfaces (Filip Skokan) #65679
[ec96f8dc23] - test: update WPT for url to c23755a144 (Node.js GitHub Bot) #65651
[ebe2ac248b] - test: fix recursive fs.watch error fixture (Filip Skokan) #65683
[a19912ee8f] - test: update streams WPT (Jeong SeokChan) #65638
[14b5dfc63d] - test: remove console.log call in node_run_list (Antoine du Hamel) #65572
[3f67df139c] - test: expect node:ffi to be enabled by default (Matteo Collina) #65636
[b9ee2e67bf] - (SEMVER-MINOR) test: use native builder for legacy SEA tests (Filip Skokan) #65553
[53a29d0894] - test: use common spawnSync helpers in more tests (greenhead) #65552
[5c680a50f4] - test: add coverage for removeEventListener boolean capture (Lazizbek Ergashev) #65245
[6f99474912] - test: deflake fastutf8stream destroy and reopen tests (Christian Aurich) #65554
[2342b2bf30] - test: cover Readable.from() sync iterator errors (jakecastelli) #65515
[1e455a4ffe] - test: support inspecting WPTs in child processes (Filip Skokan) #65510
[1f7cab588e] - test: document WPT runner workflows (Filip Skokan) #65510
[d39a902cec] - test: simplify test-worker-heap-profile.js (Donghoon Kang) #65372
[90d1b863f7] - test: keep WPT backend checks alive (Filip Skokan) #65320
[be60c34b52] - (SEMVER-MINOR) test: enable multi-global WPTs (Filip Skokan) #64894
[d04cfcda8e] - (SEMVER-MINOR) test: add opt-in process WPT runner (Filip Skokan) #64894
[715c21f805] - (SEMVER-MINOR) test: accomodate multi-global tests in WPT{Runner,TestSpec,Report} (Filip Skokan) #64894
[9aa8489a01] - test: fix lint in dtls tests (Matteo Collina) #64902
[6a3d8a6d9f] - tls: read the peer certificate chain without consuming it (Tony Gies) #65602
[2e519f8fef] - tls,quic: commonize TLS cert handling between tls, dtls & quic (Tim Perry) #64711
[2266c14051] - tools: add GHA workflow to test vendored Perfetto (Antoine du Hamel) #65614
[19779f121f] - tools: fix the list of globals in ESLint config files (Antoine du Hamel) #65281
[b57db8dfd3] - typings: add types for performance binding (Jungwon Sohn) #65574
[371e2260f4] - typings: add encodeIntoResults to EncodingBinding (greenhead) #65350
[417cdd8a77] - typings: add typing for permission binding (Seungmin Nam) #65385
[a82cc7097f] - url: align URLPatternInit dictionary conversion with WebIDL (Piyush Yadav) #65498
[0e8f7b96b0] - util: canonicalize namespaced tags in inspect() (René) #63257
[acd2bb10ce] - v8: add setHeapProfileNearHeapLimit (Ilyas Shabi) #64676
[d0535b1041] - vfs: load native addons from a mounted file system (Philipp Dunkel) #65680
[ea6f70ba41] - vfs: fix rename over non-empty directory (Christian Aurich) #65613
[b4f6b3798a] - vfs: add ZipProvider (Philipp Dunkel) #64915
[5198142c59] - (SEMVER-MINOR) vfs: integrate with CJS and ESM module loaders (Matteo Collina) #63653
[38192126e2] - worker: start worker threads from the built-in snapshot (Shelley Vohr) #65336
[56144ea80a] - worker: add ref/unref to web workers (Aviv Keller) #65507
[7231c13b8a] - (SEMVER-MINOR) worker: add wpt tests for Web Workers (Aviv Keller) #64894
[5af9d72e7f] - (SEMVER-MINOR) worker: add support for Web Workers (Aviv Keller) #64894
[069a1b1200] - zlib: avoid waiting for paused ZIP iterators (Trivikram Kamat) #65278

2026-09-09, Version 26.8.2 (Current), @aduh95

Notable Changes

[616bd3fa26] - doc: deprecate Server.prototype._listen2 in node:net (Antoine du Hamel) #65593
[ae1801eb55] - meta: refine the security vuln posture for experimental features (James M Snell) #65438
[09feba74c8] - deps: update Undici to 8.10.2 (Node.js GitHub Bot) #65788
[7efdbe3eb9] - deps: update OpenSSL to 3.5.8 (Node.js GitHub Bot) #65542

Commits

[d8aedd6584] - build: skip dockit on riscv64 (Stewart X Addison) #62251
[1899c274eb] - build: activate correct default flags for riscv64 (Stewart X Addison) #65708
[ec8a3be996] - build: derive NODE_ARCH from target_cpu in the GN build (Shelley Vohr) #65491
[b73118a507] - build,win: remove LTO parallelisation limit (Stefan Stojanovic) #65535
[09feba74c8] - deps: update undici to 8.10.2 (Node.js GitHub Bot) #65788
[e47c432dd6] - deps: upgrade npm to 11.19.1 (npm team) #65573
[2fd6ce36a9] - deps: update corepack to 0.36.0 (Node.js GitHub Bot) #65653
[49dec2767a] - deps: update googletest to 36ba75f0ad5383a9759f17f3f72fd4661c72cb6d (Node.js GitHub Bot) #65654
[676174a071] - deps: update simdjson to 4.6.9 (Node.js GitHub Bot) #65655
[2f1b7fa0bb] - deps: update perfetto to 58.2 (Node.js GitHub Bot) #65656
[12acd0ad15] - deps: update zlib to 1.3.2.1-motley-5eb4d7e (Node.js GitHub Bot) #65494
[48631c80fb] - deps: update archs files for openssl-3.5.8 (Node.js GitHub Bot) #65542
[7efdbe3eb9] - deps: upgrade openssl sources to openssl-3.5.8 (Node.js GitHub Bot) #65542
[bdc75900ee] - doc: replace node:modules documentation header (René) #65800
[44c8a499ba] - doc: clarify return type of fs.mkdtemp* (Antoine du Hamel) #65743
[025fb5eeb0] - doc: update changelog-maker instructions for releasing (Juan José) #65707
[5f64847afa] - doc: add stability status to crypto.setEngine (Antoine du Hamel) #65746
[299dee0cb9] - doc: remove outdated TLS authorized warning (Tim Perry) #65597
[e97dcc0278] - doc: fix broken using link in ffi.md (Soul Lee) #65632
[2c9cc7d237] - doc: fix some broken links (Antoine du Hamel) #65583
[0c330ec329] - doc: fix stale TOC in maintaining-dependencies (greenhead) #65523
[9c522a3a69] - doc: refactor the AI guidelines (Joyee Cheung) #65269
[46cbf1bf8c] - doc: fix triggerAsyncId() comment in async_hooks example (soreavis) #64583
[788904ff78] - doc: fix fsPromises.watch overflow value (Matt Radbourne) #64605
[3d06ff19e8] - doc: clarify stream direction in options.stdio note (Avocado) #65236
[d334838379] - doc: clarify signal listener behavior (Som Samantray) #65243
[d55a2bd56a] - doc: add test reporter event lifecycle diagram (sangwook) #63780
[c17dfc87de] - doc: discourage AbortSignal cleanup for long-lived resources (Efe Karasakal) #64342
[616bd3fa26] - doc: deprecate Server.prototype._listen2 in node:net (Antoine du Hamel) #65593
[4e6d7e0ca6] - meta: cleanup targos emeritus changes (Antoine du Hamel) #65738
[a70cfe1747] - meta: bump github/codeql-action/init from 4.37.3 to 4.37.9 (dependabot[bot]) #65714
[e43a0ad4ce] - meta: bump github/codeql-action/autobuild from 4.37.3 to 4.37.9 (dependabot[bot]) #65717
[99e06288f1] - meta: bump actions/checkout from 7.0.0 to 7.0.1 (dependabot[bot]) #65718
[89662762b3] - meta: bump cachix/install-nix-action from 31.11.0 to 31.11.1 (dependabot[bot]) #65719
[6b8f078672] - meta: bump actions/setup-node from 6.4.0 to 7.0.0 (dependabot[bot]) #65720
[6c6fb18e63] - meta: bump step-security/harden-runner from 2.20.0 to 2.21.0 (dependabot[bot]) #65721
[0e002e859f] - meta: bump github/codeql-action/upload-sarif from 4.37.3 to 4.37.9 (dependabot[bot]) #65722
[98aaffe4b9] - meta: bump github/codeql-action/analyze from 4.37.3 to 4.37.9 (dependabot[bot]) #65723
[d247cb2975] - meta: document collaborator automation (Filip Skokan) #65671
[ae1801eb55] - meta: refine the security vuln posture for experimental features (James M Snell) #65438
[fab81d15c3] - test: widen the gap in the resolver maxTimeout comparison (Shelley Vohr) #65780
[62e2a6265c] - test: fix the thread-spawn handshake in the WASI threads fixture (Shelley Vohr) #65780
[7eb20b1810] - test: only count restarts after the write in watch emit-restarted test (Shelley Vohr) #65780
[14c3a77bc5] - test: ignore tunnel resets in proxy invalid-char-in-url test (Shelley Vohr) #65780
[ebc99e0560] - test: handle EPIPE in closed channel test (Christian Aurich) #65770
[5e73a2ca79] - test: deflake test-permission-net-udp-handle (Christian Aurich) #65767
[beb669f7de] - test: deflake test-runner-coverage (Christian Aurich) #65728
[ef4b6bfa62] - test: set type=none on IBM i for empty source (Abdirahim Musse) #65545
[027eef0691] - test: deflake WASI poll timing checks (Filip Skokan) #65672
[a352b0e2fe] - test: skip fs-watch-recursive-delete-race on AIX (Antoine du Hamel) #65698
[f9ce35aa43] - test: deflake test-inspect-async-hook-setup-at-inspect (Christian Aurich) #65584
[32281cec7b] - test: deflake test-watch-mode-restart-esm-loading-error (Christian Aurich) #65623
[79be5d61be] - test: avoid orphaned child on Windows abort test (Kirill Saied) #65451
[8972b8540b] - test: fix link-local dgram scope assertion (Filip Skokan) #65629
[b7cd1d96de] - test: riscv64: skip node-api sea test (Stewart X Addison) #65569
[7eeb9d0e57] - test: mark platform-specific tests as flaky (Filip Skokan) #65562
[649ac82bda] - test: account for varied OpenSSL CCM final behaviours (Filip Skokan) #65542
[050fb1a15d] - tools: bump @humanfs/node from 0.16.7 to 0.16.8 in /tools/eslint (dependabot[bot]) #65757
[5314dda396] - tools: bump browserslist from 4.28.4 to 4.28.8 in /tools/eslint (dependabot[bot]) #65758
[5938a08929] - tools: do not hardcode yamllint path (Antoine du Hamel) #65747
[d8408f7415] - tools: refine contributor guidance workflow (Filip Skokan) #65745
[196e372b69] - tools: bump the eslint group in /tools/eslint with 4 updates (dependabot[bot]) #65716
[7e986b09f6] - tools: do not flag force push as invalid message (Antoine du Hamel) #65700
[837ce2ccef] - tools: do not hardcode path to Ruff (Antoine du Hamel) #65681
[1c7149a96a] - tools: retry first-time contributor query (Filip Skokan) #65648
[bd310a2bea] - tools: query first-time contributor status (Filip Skokan) #65592
[ab7b57e547] - tools: offset GitHub crons by 3 minutes (Michaël Zasso) #65612
[62ece28eae] - tools: label PRs lacking second approval (Filip Skokan) #65538
[68227b4029] - tools: welcome first-time contributors (Filip Skokan) #65533
[490dc93e37] - tools: enable concurrency for eslint (Huáng Jùnliàng) #62352
[d794676217] - typings: fix fs_event_wrap start filename type (leah-1ee) #65661
[29e2b5a325] - typings: add fs_event_wrap internal binding types (leah-1ee) #65661
[6357c8f56e] - typings: add stream_pipe internal binding types (Seongeun Lee) #65664
[569720ac7f] - typings: add profiler internal binding types (Seongeun Lee) #65660
[52ae89c69d] - typings: add ffi internal binding types (Donghoon Kang) #65734
[22c7469062] - typings: update zlib binding declarations (이혜미) #65639

2026-08-26, Version 26.8.1 (Current), @aduh95

Notable Changes

Out-of-band release to fix node --version which was reporting an alpha version.

Commits

[ebd35a9eec] - src: revert accidental alpha designation (Antoine du Hamel) #65568
[0b0dd87fcc] - tools: fix tools/nix/list-requisites.sh (Antoine du Hamel) #65560

2026-08-26, Version 26.8.0 (Current), @aduh95

Notable Changes

[74234ee30e] - (SEMVER-MINOR) benchmark: add --analyze mode to compare.js (James M Snell) #65416
[4232997fa2] - crypto: update root certificates to NSS 3.126 (Node.js GitHub Bot) #65495
[f0531f1c87] - (SEMVER-MINOR) crypto: enable SIV and GCM-SIV modes in Cipher/Decipher APIs (Filip Skokan) #63411
[3f4b80ebb5] - diagnostics_channel: mark TracingChannel as stable (Abdelrahman Awad) #64525
[753033c110] - (SEMVER-MINOR) lib,src: improve histogram implementation (James M Snell) #65024
[3d7d277493] - (SEMVER-MINOR) net: improve performance of net.BlockList (James M Snell) #64974
[9e8e9080fd] - (SEMVER-MINOR) perf_hooks: add statistical hypothesis testing to histogram (James M Snell) #65416
[c18b0aa54e] - repl: add basic syntax highlighting (Aviv Keller) #64591
[58ea88e1d3] - (SEMVER-MINOR) sqlite: add StatementSync.prototype.close() (Guilherme Araújo) #64232
[7c61b08aed] - (SEMVER-MINOR) sqlite: add StatementSync.prototype[Symbol.dispose]() (Guilherme Araújo) #64232
[4299cd5897] - (SEMVER-MINOR) util: add non-throwing MIMEType.parse (James M Snell) #64965
[df48191061] - (SEMVER-MINOR) zlib: add ZipEntry, ZipFile, and ZipBuffer (Philipp Dunkel) #64339

Commits

[162257b403] - assert: improve documentation wording (Kamal Rawal) #64953
[74234ee30e] - (SEMVER-MINOR) benchmark: add --analyze mode to compare.js (James M Snell) #65416
[2cb96dd462] - benchmark: add test-only and mock timers cases (Luan Muniz) #64097
[562168f93f] - benchmark: apply highWaterMark in webstreams pipe-to (Matteo Collina) #65138
[fbec4eb386] - benchmark: complete the sqlite is-transaction fix (Edy Silva) #65218
[d8acfc45f1] - benchmark: add test runner hooks and options (Luan Muniz) #63754
[13e7d54f67] - buffer: prevent string write offset overflow (Matteo Collina) #65043
[615273deac] - buffer: support aligned allocations (Robert Nagy) #65003
[bc6b630e21] - buffer: treat detached ArrayBuffers as empty (Archkon) #64504
[ddf9f9d265] - build: target Power 9 and z14 (Richard Lau) #65439
[fda8ee894e] - build: use build-ci for benchmark merge-commit rebuild (Yagiz Nizipli) #65362
[03692786ef] - build: add simdutf dir to include path in GN build (Shelley Vohr) #65382
[3da555a3ed] - build: pass target architecture to small-icu genccode (ulofiai) #65095
[ffe1e7cbea] - build: update binary-upload to use correct tarball name (Stewart X Addison) #65282
[50174cb94a] - build: deprecate always enabled --enable-static (Chengzhong Wu) #65103
[28f662b424] - build: check FIPS option value in node.gyp (Filip Skokan) #64982
[29a2ecefeb] - build: handle malformed OpenSSL macros (Filip Skokan) #64982
[6deeef1801] - build: enable perfetto updater (Chengzhong Wu) #64966
[312f0c6a7e] - build: add host toolset to perfetto_sdk (Ryuhei Shima) #64751
[1a4f5e537b] - build,win: add PGO workload scripts (Stefan Stojanovic) #63696
[21655dccbc] - child_process: keep SIGWINCH from killing on Win (Kirill Saied) #64510
[4232997fa2] - crypto: update root certificates to NSS 3.126 (Node.js GitHub Bot) #65495
[f0531f1c87] - (SEMVER-MINOR) crypto: enable SIV and GCM-SIV modes in Cipher/Decipher APIs (Filip Skokan) #63411
[109566a2f7] - crypto: fix missing error checks on ASN1_STRING_to_UTF8() (Nora Dossche) #65200
[501f81612d] - crypto: improve SubtleCrypto.supports() accuracy (Filip Skokan) #65222
[137ff67fd3] - crypto: use available BoringSSL APIs (Filip Skokan) #65423
[0e87576ed4] - crypto: remove obsolete BoringSSL shims (Filip Skokan) #65423
[af867ce3e4] - crypto: add mgf1Hash for RSA-OAEP (Adam Mcgrath) #65073
[66ee4792bf] - crypto: disable non-FIPS WebCrypto paths in FIPS mode (Filip Skokan) #65172
[6a142c03e9] - crypto: read WebCrypto inputs through primordials (Filip Skokan) #65115
[92e3110462] - crypto: fix disabling FIPS mode (Filip Skokan) #64982
[d69bed2f49] - debugger: wait for target startup (Filip Skokan) #65194
[5c7c0b8b15] - deps: update zlib to 1.3.2.1-motley-8002e91 (Node.js GitHub Bot) #65316
[4cb6b1335e] - deps: update simdjson to 4.6.7 (Node.js GitHub Bot) #65318
[a39ad67482] - deps: update googletest to 49495eacfdbda3f4b6ba219923fedbb2e3f99376 (Node.js GitHub Bot) #65317
[46762dad57] - deps: cherry-pick libuv/libuv@e640dc9 (ulofiai) #65118
[abb7a15a8d] - deps: update perfetto to 57.2 (Node.js GitHub Bot) #65114
[ebd8c6ba52] - deps: float ICU-23262 patch for icu78 (René) #64678
[f2cc681109] - deps: enable AVX-512 OpenSSL asm with clang (Daniel Lemire) #65136
[f45dc92913] - deps: update undici to 8.10.0 (Node.js GitHub Bot) #65155
[4160dfdf81] - deps: update googletest to d89aac5f0dd4021198d903d39de16f896726de21 (Node.js GitHub Bot) #65153
[631d3aa37b] - deps: update libffi to 3.8.0 (Node.js GitHub Bot) #65154
[788976c626] - dgram: don't swallow bind errors when callback is provided (armanmikoyan) #62602
[d286423043] - diagnostics_channel: validate before channel activation (Trivikram Kamat) #65313
[3f4b80ebb5] - diagnostics_channel: mark TracingChannel as stable (Abdelrahman Awad) #64525
[152a326f92] - dns: validate address type in lookupService (Lazizbek Ergashev) #64878
[00c71fec93] - dns: validate port range in setServers() (René) #65021
[e9327d1422] - dns: fix crash on setServers with port 0 (Lazizbek Ergashev) #65009
[9e227ef20d] - doc: update AHAFS reference link (Taeuk Ha) #65481
[5fbf6c57af] - doc: fix property names in os.networkInterfaces() example (Jihwan) #65469
[13f16d28d1] - doc: fix broken links in cli.md (Donghoon Kang) #65412
[0f36ee3755] - doc: remove outdated WASI version fallback (이혜미) #65303
[1ad09f712a] - doc: fix broken GYP link in n-api.md (Donghoon Kang) #65413
[24cd694237] - doc: document that an empty OPENSSL_CONF skips config loading (Orgad Shaneh) #64949
[dae434132e] - doc: fix broken TLS security level example (soreavis) #65391
[96b91dc987] - doc: clarify socket destroyed behavior (Dayun) #65395
[9d8d27d444] - doc: update outdated nodejs.org guide links (Donghoon Kang) #65394
[65f675086e] - doc: clarify that ipv4 mapped to ipv6 are classified as ipv6 (Vedant Kulkarni) #62117
[89aba0c311] - doc: clarify how fs.Dirent file types are determined (soreavis) #64532
[3ed0492f52] - doc: update security release prepare command (Rafael Gonzaga) #64699
[63583c4e75] - doc: clarify copyFile symlink behavior (T) #62941
[abfc51f757] - doc: document setRawMode write access on Windows (Erik Demaine) #63856
[4a784cb3e6] - doc: document per-architecture fast FFI argument limits (Seongeun Lee) #65207
[262f966155] - doc: add missing return types in fs.md (Chaseton Collins) #65307
[695cd896a7] - doc: add missing return types in buffer.md (Yuya Inoue) #65308
[676a1228cd] - doc: fix lint clean command (greenhead) #65274
[9ea318d4e3] - doc: fix typo in onboarding.md (서울민트초코) #65295
[3b6a918ab4] - doc: add missing added: tags to fs.lchmod (Lazizbek Ergashev) #65283
[a77b1e61df] - doc: fix SQLite changeset constant descriptions (greenhead) #65265
[ab50ae60e4] - doc: document open pull request limit (Matteo Collina) #65250
[e2f4ea03a3] - doc: document http2 header constants (Harjoth Khara) #64548
[5b5509d0d3] - doc: create ai-guidelines and include to CONTRIBUTING (Rafael Gonzaga) #62105
[c63e873073] - doc: fix broken fs.BigIntStats link in vfs.md (greenhead) #65045
[d6059e84c0] - doc: update synopsis (Augustin Mauroy) #65171
[43f1dc03e7] - doc: document close() error when in a sqlite callback (Trivikram Kamat) #65090
[8f5f48ad96] - doc: fix broken internal links (greenhead) #64901
[5b64b37739] - doc: report proper return type on urlPattern.test (Brian Muenzenmeyer) #64831
[9633bb0f29] - doc: fix permission documentation examples (greenhead) #64897
[e52e573fd7] - doc: document sqlite parameter binding (Guilherme Araújo) #65089
[fa52f11d3b] - doc: finalize statements in sqlite examples (Guilherme Araújo) #65088
[0157c45012] - doc: document quic stopSending() and resetStream() (Issac) #64888
[003a913799] - doc: clarify sqlite bare parameter default (Sumit Kumar Das) #62009
[c5588d71ad] - doc: remove usage of util.inherits (Augustin Mauroy) #60817
[673db40fbf] - doc: fix grammar in worker_threads.md (이혜미) #64913
[ee5f72cf16] - doc: fix broken link (Antoine du Hamel) #65078
[0450ab6c6a] - doc: update node.1 to fix linter (Antoine du Hamel) #65053
[9a256b0693] - doc: clarify OpenSSL FIPS configuration (Filip Skokan) #64982
[c321752dcb] - doc: remove --expose-gc flag from CLI documentation (Dario Piotrowicz) #58909
[0cf79931bb] - doc: document ArrayBuffer support in pbkd2Sync (kyungrae2002) #64976
[3b8a0bacaa] - doc: correct default highWaterMark values (Yilong Li) #64617
[be313012e4] - doc: use ffi.suffix in permission example (agape1225) #64914
[4a1c9a7ee0] - esm: avoid super-linear data URL MIME regex (Sumit Kumar Das) #61951
[b1770bc196] - esm: only register text format when enabled (Efe Karasakal) #64992
[f48927fe5b] - esm: fix wasm import name in error message (이혜미) #64950
[8d48adf688] - events: inline iterationCondition hybrid dispatch closure (Szymon Łągiewka) #64473
[b827c0047e] - events: inline createEvent hybrid dispatch closure (Szymon Łągiewka) #64473
[7670c81d99] - ffi: prefer canonical type names (Trivikram Kamat) #65417
[1fe7a1c33d] - ffi: validate the value passed to the float setters (Soul Lee) #65342
[537feecd0b] - ffi: reject direct SharedArrayBuffer pointers (Trivikram Kamat) #65233
[0002f0a718] - ffi: remove dead null check in callback arguments (Trivikram Kamat) #64998
[9024ec27b6] - ffi: keep FFI functions non-constructible (Trivikram Kamat) #65184
[9b4f349b01] - ffi: refresh cached string buffers on every call (Trivikram Kamat) #65051
[eacd65e9c2] - ffi: reject detached ArrayBufferViews (Trivikram Kamat) #65086
[be2ab89730] - ffi: reject detached ArrayBuffers as pointers (Trivikram Kamat) #65083
[6f9e0846ea] - ffi: validate fast pointer BigInt argument ranges (Trivikram Kamat) #65032
[3e6688c5e3] - ffi: reuse the callable created per symbol (Trivikram Kamat) #64971
[8b0bdd931c] - ffi: shrink trampoline placement probe window (Trivikram Kamat) #64969
[9c282c4532] - ffi: accept pointer BigInts in multi-argument fast calls (Trivikram Kamat) #64964
[b98294b57d] - ffi: support SharedArrayBuffer in getRawPointer (Junsoo Ha) #64864
[5cac7c2c55] - ffi: reuse libffi call plans (Yilong Li) #64958
[262f0ec82a] - fs: stop stat()ing every entry in recursive readdir (Shelley Vohr) #65487
[e3ae912e9a] - fs: use sized reads for large files in readFileUtf8 (Shelley Vohr) #65328
[bc1e19b4b7] - fs: fix realpath of namespaced drive paths (Jason Zhang) #65378
[6673ebadf2] - fs: abort in-flight stat operations (Mert Can Altin) #63143
[74dcdbb5f1] - fs: fix glob early return skipping sibling entries (Srinu desetti) #64895
[6305a744df] - fs: pass symlink type in cp when filter is provided (Jerry Zhao) #62654
[c5cb6bc7e2] - fs: allocate FSReqPromise stat arrays lazily (Samuel Attard) #63886
[992af05719] - fs: fix out-of-bounds write in mkdtemp for long prefixes (Hierax_Umbra) #64770
[2de845b2dd] - fs: treat std::errc::permission_denied as EPERM error (Kirill Saied) #64698
[77fedbd350] - fs: read small files in one thread pool round trip (Shelley Vohr) #65327
[810929b6dd] - Revert "fs: fix close listener leak in FileHandle streams" (Mike McCready) #65387
[8873b91fce] - fs: fix close listener leak in FileHandle streams (Y1D7NG) #64227
[656cfaeb2d] - fs: add windowsHandle option to file streams (Kirill Saied) #63851
[c2c31d69fd] - http: improve performance with known-length calls to end() (Tim Perry) #65466
[7e9204f4b3] - http: use intrusive lists in ConnectionsList (Matteo Collina) #65296
[98e6272c70] - http: cache maxHeaderPairs per header section (GetThatCookie) #64988
[6c3516f179] - http: fix keylog listener setup on existing agent sockets (Shani Singh) #65066
[dad9548fbc] - http: emit drain on socket takeover and avoid stale HWM reuse (Naman Trivedi) #64991
[563cab119b] - http2: avoid uaf while receiving and sending rst_stream (esgor) #64166
[099801641b] - inspector: avoid calling into JS from V8 interrupts (Joyee Cheung) #65028
[b71d5de0b8] - lib: use bracket notation instead of startsWith/endsWith for single char (Taejin Kim) #61500
[e8e2abcc8d] - lib: load fewer builtins when bootstrapping without a snapshot (Shelley Vohr) #65329
[3619dc0601] - lib: fix ERR_INVALID_ARG_TYPE with --enable-source-maps (June) #63215
[ad7c67026b] - lib: harden webidl dictionary member reads (Filip Skokan) #65115
[b5182f0a1c] - lib: use validateArray for array arguments (greenhead) #64959
[7f7df06821] - lib: add and test [EnforceRange] in webcrypto dictionaries (Filip Skokan) #65091
[753033c110] - (SEMVER-MINOR) lib,src: improve histogram implementation (James M Snell) #65024
[8d39d0d660] - meta: add a root-level AGENTS.md (James M Snell) #65493
[3770f9baea] - meta: move targos to emeritus (Michaël Zasso) #65393
[a9b31dfe30] - meta: add unified http api initiative (James M Snell) #65139
[6bffc306aa] - meta: move one or more collaborators to emeritus (Node.js GitHub Bot) #65182
[4abd1c8100] - meta: add support for alpha prerelease tag (Antoine du Hamel) #63135
[132c578e97] - meta: add Aviv Keller to .mailmap (Aviv Keller) #65048
[7aff78d231] - meta: update sccache to 0.17.0 (René) #64985
[97a437e7ea] - module: add a read-only mode to the compile cache (Shelley Vohr) #65302
[5821362819] - module: do not split a portable compile cache by uid (Shelley Vohr) #65293
[eb5d66e856] - module: report unreadable package.json (Paul Bouchon) #65223
[43757d07c1] - module: cache nearest parent package.json per directory (Shelley Vohr) #65326
[d7805e00dc] - module: fix --check on ambiguous ESM files (Paul Bouchon) #65203
[646221a495] - net: handle undefined parent in _unrefTimer and _destroy (Shivay-98) #64644
[3d7d277493] - (SEMVER-MINOR) net: improve performance of net.BlockList (James M Snell) #64974
[9e8e9080fd] - (SEMVER-MINOR) perf_hooks: add statistical hypothesis testing to histogram (James M Snell) #65416
[01a8ae0ce6] - permission: guard UDP handle adoption (Rafael Gonzaga) #65358
[ac3c412aaf] - permission: enforce addon permission in GetLinkedBinding (Rafael Gonzaga) #65432
[8765afd4c2] - process: validate resource stats array offsets (Archkon) #65098
[d0447c93f6] - quic: changes for nghttp3_conn_close_stream2 (Marten Richter) #64574
[91393898b5] - quic: mark drain promise handled (James M Snell) #65319
[5c9576bf50] - quic: reset rejected HTTP/3 request streams with H3_REQUEST_REJECTED (trivenay) #65442
[ec956f2abc] - quic: write desired size needs update on maxstream (Marten Richter) #64768
[41c510803d] - quic: do not destroy incoming streams that have a consumer (trivenay) #65335
[009e376581] - quic: fix wake up blob (Marten Richter) #64044
[4674a10368] - quic: convert incoming :status header to number (Hallison Pereira Melo) #63589
[5953165f53] - quic: fix infinite loop if STOP_SENDING received on a buffering stream (Tim Perry) #64715
[bb499c312e] - repl: keep entries added while history file is loading (Mhayk Whandson) #64513
[825fcfe4d5] - repl: add benchmarks (Aviv Keller) #64590
[c18b0aa54e] - repl: add basic syntax highlighting (Aviv Keller) #64591
[f32a8631ad] - sea: avoid dangling CLI option pointers (Archkon) #64755
[3126ce5779] - sea: handle NUL bytes in asset keys (Archkon) #64773
[64a8843ff2] - sea: reject trailing content in config JSON (Archkon) #64774
[1d9dd252f1] - sea: reject malformed --node-options values (Archkon) #64803
[6ec735c910] - sqlite: reject reentry while binding parameters (Trevor Burnham) #65294
[60cb384c15] - sqlite: remove unused column name helper (Trivikram Kamat) #65401
[fce6754a83] - sqlite: reject busy statement finalization in authorizer (Trivikram Kamat) #65369
[e2f952f2ff] - sqlite: prevent reentrant session.close() (Trivikram Kamat) #65349
[0e8af3378a] - sqlite: reuse cached column names in statement all() and get() (Edy Silva) #65276
[e6bfec91be] - sqlite: validate StatementSync.run() integers (Trivikram Kamat) #65178
[bbb1226dbe] - sqlite: add diagnostic channel (Guilherme Araújo) #62241
[6302168de8] - sqlite: add stmt persistent flag (Guilherme Araújo) #62757
[2989311d81] - sqlite: reject connection access from authorizer callbacks (Trevor Burnham) #65156
[72c37b133e] - sqlite: expose prepared statement statistics (Edy Silva) #64541
[3e50a2f1e9] - sqlite: manage sqlite3_stmt lifetime with RAII (Guilherme Araújo) #62419
[3ab7e72555] - sqlite: check sqlite3_step() and sqlite3_reset() results (semimikoh) #63319
[5e387ce979] - sqlite: reject statement-less SQL in prepare() (Trevor Burnham) #65157
[83169e58f3] - sqlite: reject statement-less SQL in SQLTagStore (Trevor Burnham) #65157
[7f31f6226e] - sqlite: isolate applyChangeset filter errors (Trivikram Kamat) #64823
[c89878c3c8] - sqlite: reject deserialize() while in a callback (Trivikram Kamat) #64796
[5a852b22d4] - sqlite: check null returns from sqlite value functions (Nora Dossche) #63288
[5cb78ed300] - sqlite: validate maxSize argument in createTagStore() (Anshika Jain) #63792
[ca885876f6] - sqlite: refactor error helpers and user function pointers (Ali Hassan) #62794
[06b1758dcd] - sqlite: reject non-positive backup rates (Trivikram Kamat) #64893
[ce0ca47023] - sqlite: clear SQLTagStore bindings (Matteo Collina) #65041
[49fb028714] - sqlite: bind Boolean (mike-git374) #62001
[09d0da99e9] - sqlite: fix undefined behaviour in Session::Changeset() (Nora Dossche) #63637
[58ea88e1d3] - (SEMVER-MINOR) sqlite: add StatementSync.prototype.close() (Guilherme Araújo) #64232
[7c61b08aed] - (SEMVER-MINOR) sqlite: add StatementSync.prototype[Symbol.dispose]() (Guilherme Araújo) #64232
[9167ebd32b] - sqlite: bind ArrayBuffer (mike-git374) #62061
[5da6eaa8af] - sqlite: prevent database close during callbacks (Matteo Collina) #64743
[29d794bc84] - src: fix heap value deduplication in embedder graph (Ilyas Shabi) #64801
[b405e9b039] - src: fix out-of-bounds write when transcoding odd-length ucs2 (nashit hayat) #64512
[101a215472] - src: use simdutf for two-byte utf8 conversion (Mert Can Altin) #62248
[340b98346f] - src: run same-priority platform tasks in posting order (Shelley Vohr) #65353
[83a7949c18] - src: define O_SYNC, O_DSYNC and O_DIRECT on Windows (Kirill Saied) #64707
[32bb197f2a] - src: use simdutf for two-byte strings in UTF-8 writes (Shelley Vohr) #65324
[613be79cf4] - src: add v8::Local specialization for MaybeStackBuffer (James M Snell) #65159
[922d47cbd7] - src: escape Windows environment variables in task runner (Antoine du Hamel) #65217
[3a47f1f282] - src: apply minor namespace format tweak in permissions (James M Snell) #65158
[981cfa537d] - src: simplify permissions with BooleanPermissions (James M Snell) #65158
[5954b13f88] - src: simplify includes in permissions (James M Snell) #65158
[d4ced88c09] - src: apply a modest performance perf to permissions (James M Snell) #65158
[efb649ec26] - src: make permission storage a bit more efficient (James M Snell) #65158
[521aaf10fc] - src: apply multiple general cleanups to permissions (James M Snell) #65158
[ac920e0d2b] - src: simplify c++ diagnostics channel API (James M Snell) #65158
[ec8fe275a1] - src: make minor cleanup to permission checks (James M Snell) #65158
[968bdd0135] - src: use DictionaryTemplate for permission diag channel message (James M Snell) #65158
[f77aa2f703] - src: cache permission strings (James M Snell) #65158
[4018f3a776] - src: shave about 20 bytes off each TLSWrap instance (James M Snell) #65144
[b7a23426d9] - src: add SetAbortHandler (Max H Fisher) #64684
[3cfe19489c] - src: use concepts where appropriate (James M Snell) #65148
[d8a0f288ab] - src: match cmd.exe case-insensitively in task runner (Archkon) #64907
[262d88e6c2] - src: reuse cached env strings in remaining files (Seongeun Lee) #65039
[ad35fe97f0] - src: expose Windows-only fs open flags (Kirill Saied) #64775
[8c4531bbc9] - src: report why --enable-fips failed (Filip Skokan) #64979
[a293dbf0e1] - src: update repeated use strings to env (James M Snell) #64760
[044402cf0e] - src: use UTF-8 for task runner filesystem paths (Archkon) #64868
[5b7d02e401] - stream: normalize fused stateless transform results (Trivikram Kamat) #65367
[1d6ec2ddc5] - stream: encode whole chunks in TextEncoderStream (Matteo Collina) #65414
[0afda47ca4] - stream: prevent share from eagerly draining source (Trivikram Kamat) #65338
[dc51c7926e] - stream: drain pending writes before broadcast end (Trivikram Kamat) #65334
[a77f9f7a32] - stream: reuse unexposed managed read buffers (GetThatCookie) #64990
[c42fbcc0d1] - stream: avoid duplicated endReadableNT scheduling (Matteo Collina) #65310
[9ec9383d1d] - stream: decouple transform backpressure changes (Matteo Collina) #65143
[a9dc50d275] - stream: reject pull on signal abort during flush (Trivikram Kamat) #65346
[815424db74] - stream: avoid leaking consumers on signal failure (Trivikram Kamat) #65299
[6a2e0561e8] - stream: use validateObject for zlib/iter params (greenhead) #65015
[4f6f2cfffa] - stream: use validateNumber for BYOB reader options.min (greenhead) #65014
[4d297428e6] - stream: consolidate non-op algorithm callbacks (Matteo Collina) #65138
[f7e0c81be4] - stream: cut promise churn in webstreams hot paths (Matteo Collina) #65138
[5edffb544f] - stream: speed up async iteration of Readable (Matteo Collina) #64447
[0876a29bb6] - stream: preserve falsy cancellation reasons (Trivikram Kamat) #64705
[374f7e214d] - stream: use validateBuffer for BYOB reader view (greenhead) #65046
[6bd15b2ac9] - stream: fix recursive WritableStream abort (Jeong SeokChan) #64825
[f33dba704d] - string_decoder: decode UTF-8 via StringBytes::Encode (Shelley Vohr) #65324
[6409983a6c] - test: update WPT for WebCryptoAPI to e235e089b4 (Node.js GitHub Bot) #65478
[01cb4f99a0] - test: convert forEach to for of test-messageevent-brandcheck file (Nachiketa Pathak) #65279
[359369e24e] - test: use spawnSyncAndAssert in windowsHide test (Junsoo Ha) #65351
[9304dee833] - test: remove test-debugger-run-after-quit-restart as flaky on macOS (Yuya Inoue) #65424
[30f1a19eec] - test: simplify test-timers-interval-promisified.js (Donghoon Kang) #65322
[acaf986ad5] - test: add Headers coverage and benchmark (Yagiz Nizipli) #65365
[b6852e2b96] - test: deflake test-net-listen-ipv6only (sangwook) #64173
[235a0baf8b] - test: use common/child_process spawnSync helpers (Junsoo Ha) #65377
[29f010fbb0] - test: fix Linux debug skip in SEA test guard (구현우) #63751
[33d7b4c6b3] - test: add closed-library assertions for getFunctions and getSymbols (Anshika Jain) #63769
[24a76e18ec] - test: avoid timer race in event loop delay test (Trivikram Kamat) #64728
[fdc1e78595] - test: enforce exit code in test-http-server-stale-close (Antoine du Hamel) #65198
[c644f2e07c] - test: convert test-async-local-storage-bind to async loop (freida-code) #65270
[1d5e5e8f43] - test: replace forEach() with for...of in parallel tests (Phillip Markert) #65272
[9346570fed] - test: convert forEach to for in test-constant.js file (NIxxy25) #65271
[7af0a96090] - test: use for-of instead of forEach (Felix P.) #65268
[63e6f2edc3] - test: wait for FFI background optimization (Trivikram Kamat) #65300
[bca3367583] - test: add a simple test for import defer of a CJS module (Maya Lekova) #64694
[00b687bc4a] - test: cover ZIP fd lifecycle and add rollback (Philipp Dunkel) #65016
[31742f2f42] - test: cover ZIP header-confusion and DoS guards (Philipp Dunkel) #65016
[87ee7bff38] - test: cover realpathSync resolving symlinks after a FIFO stat (Hendrik Liebau) #65113
[fd7e904433] - test: update tests to run with OpenSSL >= 3.0 FIPS mode (Filip Skokan) #64960
[219495fe2c] - test: account for [EnforceRange] in test-webcrypto-prototype-pollution (Filip Skokan) #65173
[bf86fab458] - test: add permission fast api test (James M Snell) #65158
[cc19107e5d] - test: update WPT for WebCryptoAPI to 4c2fd05ed5 (Node.js GitHub Bot) #65150
[69e4fabb29] - test: update WPT for urlpattern to 4832db4761 (Node.js GitHub Bot) #65151
[b1aa78a57e] - test: fix hidden error in test-http-server-stale-close.js (Meghan Denny) #59357
[59d7e22a12] - test: avoid deadlock issue in pipeline http2 tests to fix flakiness (Tim Perry) #65079
[7074ae30fa] - test: allow half-open CONNECT tunnel sockets (Trivikram Kamat) #64973
[82b2d9c08d] - test: update passphrases to comply with the next OpenSSL FIPS mode (Filip Skokan) #65077
[7f3a42035c] - test: use libuv clock for immediate queue test (Trivikram Kamat) #64889
[7ddd853d8c] - test: increase timeout in probe-failure-hang-during-evaluate (Joyee Cheung) #64719
[28cad47cef] - test: update WPT for WebCryptoAPI to 82c3d9069c (Node.js GitHub Bot) #64977
[74a3e91bb7] - test: prefer in-memory databases in sqlite tests (Paul Bouchon) #64701
[7fc8a3ad8c] - test,doc: cover and document multi-byte offset/size in randomFill (kyungrae2002) #64834
[4de7e63883] - test_runner: match dotfiles in default coverage exclude (semimikoh) #63401
[79c39c217d] - test_runner: print coverage and diagnostic info with dot reporter (mag123c) #61423
[cce803b174] - test_runner: use run options with isolation="none" (Sylvester Keil) #62269
[797ef40d23] - test_runner: mock dual-package with conditional exports (Maruthan G) #62943
[1ad7ca310a] - test_runner: restore directory search for --test (Paul Bouchon) #64637
[400d598b3c] - test_runner: add classname hierarchy for JUnit reporter (mag123c) #60220
[9572a0b15f] - test_runner: fix junit report on empty diagnostic (Lazizbek Ergashev) #65357
[e3fda695fe] - test_runner: extend tag filter with boolean expression DSL (Chemi Atlow) #63054
[4e06739c7b] - test_runner: do not tag-filter test file wrappers (Chemi Atlow) #65170
[e73f74738d] - test_runner: fix env option validation (Jihwan) #64865
[2a0b1ec4cc] - tls: throw on invalid ALPNProtocols instead of aborting (Sankalp Thakur) #65076
[15da4a190b] - tls: fix authorized state on no-cert TLS1.3 client cert resumption (Tim Perry) #64677
[1864175435] - tls: don't trigger SNICallback or OCSPRequest from the TLS lib stack (Tim Perry) #64827
[8f4ee7eda5] - tls: drop hand-rolled TLS client hello parser (Tim Perry) #64827
[a457631496] - tools: improve commit queue failure comment (Filip Skokan) #65433
[78175c68f8] - tools: improve nix-changes coverage (Antoine du Hamel) #65403
[6f0c08bf80] - tools: refactor shell.nix pkcs11 integration to its own section (Antoine du Hamel) #65404
[35b18b4455] - tools: fix max body length handler in create-release-proposal.sh (Antoine du Hamel) #65455
[88d5f644a2] - tools: bump brace-expansion in /tools/clang-format (dependabot[bot]) #64984
[41edd2f214] - tools: make env variables consistent in cron jobs (Antoine du Hamel) #65168
[7c09bd5ece] - tools: fix man-page generation on Windows (James Ross) #64886
[1a20d27118] - tools: bump undici from 6.27.0 to 6.28.0 in /tools/doc (dependabot[bot]) #65011
[ebbe4af869] - tools: fix linter when permittedInsecurePackages is empty (Antoine du Hamel) #65226
[17d2b067bf] - tools: update BoringSSL pin on v26.x (Filip Skokan) #65483
[be4e7de04c] - tools: only include fast-tracked and old enough PRs in CQ (Antoine du Hamel) #65197
[53d52731c9] - tools: fix quote escaping in update-nixpkgs-pin.sh (Antoine du Hamel) #65166
[40b1b18839] - tools: remove skip logic in commit-queue.sh (Antoine du Hamel) #65162
[5506f77924] - tools: bump js-yaml from 4.2.0 to 4.3.1 in /tools/lint-md (dependabot[bot]) #65129
[fc038a0ef5] - tools: bump js-yaml from 4.2.0 to 4.3.1 in /tools/eslint (dependabot[bot]) #65130
[10b2c8a873] - tools: fix GITHUB_TOKEN permissions for CQ workflow (Antoine du Hamel) #65192
[73de450845] - tools: use the read-only token when filtering PRs in CQ (Antoine du Hamel) #65169
[31c1bcb627] - tools: delay removal of commit-queue label (Antoine du Hamel) #65101
[89d3905595] - tools: move ncu config to global for commit queue (Filip Skokan) #65132
[aa3b598e2e] - tools: prefilter commit queue metadata (Filip Skokan) #64343
[4f2c634258] - tools: lazy-abort failed PR merges in CQ (Antoine du Hamel) #65004
[8657497521] - tools: fix pkcs11-store-test check (Antoine du Hamel) #65023
[0e1a99ac24] - tools: add an OpenSSL FIPS build to test-shared.yml (Filip Skokan) #64960
[b6fa9c1819] - tools: sync mk-ca-bundle.pl with curl (Archkon) #64753
[f0140d7ebd] - tools: store "default" OpenSSL version in openssl-matrix.nix (Antoine du Hamel) #64962
[4c8d8afa99] - tools: remove true from branch name for auto-update automation (Antoine du Hamel) #64961
[2dd7d4c56f] - tools: add ./tools/nix/pkcs11.nix to nix-changes.yml (Filip Skokan) #64967
[cf395004ed] - tty: add raw-vt and io raw modes (Samuel Williams) #64140
[a5e5c7f756] - typings: add signal_wrap internal binding types (Seongeun Lee) #65229
[5219e53dd6] - typings: add diagnostics_channel typings (Seongeun Lee) #65227
[215223dff1] - typings: add watchdog internal binding types (Seongeun Lee) #65228
[eb095a94bd] - typings: add internal_only_v8 binding typeis (Donghoon Kang) #65071
[9fc811a0f2] - typings: add credentials internal binding types (Donghoon Kang) #65036
[f032c22430] - url: skip unused href reuse comparison (Yagiz Nizipli) #65361
[2a64032141] - url: speed up WHATWG URL parsing (Yagiz Nizipli) #65361
[c4dbe14ec6] - url: speed up URLSearchParams (Yagiz Nizipli) #65363
[001c37c0a2] - url: bounds-check short Windows file URL paths (Archkon) #64788
[1a63416b1a] - url: handle unparsable serialized URLs in setters (Matteo Collina) #64651
[cb4b89c018] - util: allow single-line format when break length is infinite (Hamid Reza Ghavami) #64238
[f644853680] - util: fix OSC 8 hyperlink stripping in stripVTControlCharacters (Dushyant Singh Hada) #64319
[eb1ebbb39d] - util: fix formatting of functions returned from getters (Richard Gibson) #64839
[f373dab724] - util: use more primordials in comparisons.js (Ayoub Mabrouk) #61198
[6ca9c1e078] - util: preserve function names without source map names (Hiroki Osame) #65108
[4299cd5897] - (SEMVER-MINOR) util: add non-throwing MIMEType.parse (James M Snell) #64965
[1aafd19813] - zlib: roll back a failed add() directory rewrite (Philipp Dunkel) #65016
[d29cc0926a] - zlib: let a ZipFile read finish before close() (Philipp Dunkel) #65016
[2bda6db916] - zlib: do not hang archiving a FIFO or device (Philipp Dunkel) #65016
[55b04957c9] - zlib: reject local/central ZIP header mismatch (Philipp Dunkel) #65016
[575260d3b4] - zlib: validate central directory record count (Matteo Collina) #65002
[8e848d9be3] - zlib: reject ambiguous ZIP archive ends (Matteo Collina) #65007
[df48191061] - (SEMVER-MINOR) zlib: add ZipEntry, ZipFile, and ZipBuffer (Philipp Dunkel) #64339
[ee7bf09090] - zlib: validate pledgedSrcSize for sync zstd (Archkon) #64601

2026-08-05, Version 26.7.0 (Current), @aduh95

Notable Changes

[58717685a1] - (SEMVER-MINOR) crypto: support loading private keys through STORE loaders (Filip Skokan) #63949
[44b940ee8c] - crypto: update root certificates to NSS 3.125 (Node.js GitHub Bot) #64746
[c1e4f7365e] - (SEMVER-MINOR) lib: add perfetto support (Chengzhong Wu) #64565
[11c2f9c642] - (SEMVER-MINOR) module: implement Symbol.dispose in ModuleHooks (Remco Haszing) #63928
[a646319f61] - (SEMVER-MINOR) test_runner: add support for --test-coverage-include-all (avivkeller) #64830

Commits

[a2d3f891d3] - async_hooks: use validateBoolean for trackPromises (Soul Lee) #64731
[d7266cdd99] - benchmark: fix calibrate-n option handling (Luan Muniz) #64146
[2e64293e3f] - buffer: use Clamp conversion in Blob slice (Donghoon Kang) #64739
[5fda0958bd] - buffer: validate copyArrayBuffer offsets against buffer length (Ilia Alshanetsky) #63904
[5298db40f9] - build: run perfetto build and test on GHA (Chengzhong Wu) #64721
[e3eac7cef9] - build: fix v8_use_perfetto source scraping (Chengzhong Wu) #64721
[ab5f076d7f] - build: bump rustc requirement to >=1.86 (Renegade334) #64543
[df608e061f] - (SEMVER-MINOR) build: perfetto-sdk (Chengzhong Wu) #64565
[74928adc46] - build,tools: fix shared library cross-compile (Kirill Saied) #63963
[58717685a1] - (SEMVER-MINOR) crypto: support loading private keys through STORE loaders (Filip Skokan) #63949
[58d13b6f3d] - crypto: preserve OpenSSL errors from KDF failures (Filip Skokan) #64776
[478a719cb5] - crypto: fix Argon2 bypassing FIPS mode (Filip Skokan) #64776
[44b940ee8c] - crypto: update root certificates to NSS 3.125 (Node.js GitHub Bot) #64746
[fde85237c7] - crypto: clarify missing cipher error (Filip Skokan) #64852
[c604d8846d] - crypto: reuse X509 issuer result (Filip Skokan) #64852
[c68c7d0112] - crypto: validate key generation options (Filip Skokan) #64852
[c36bb1d017] - crypto: fix Argon2 validation errors (Filip Skokan) #64852
[f61408bb27] - crypto: handle XOF output allocation failure (Filip Skokan) #64851
[2b4053d046] - crypto: initialize KeyObjectData mutex eagerly (Filip Skokan) #64851
[4b7b2adf44] - crypto: handle DH operation failures (Filip Skokan) #64851
[12170c3753] - crypto: use user-facing error for output encoding changes (Archkon) #64692
[474f06d550] - debugger: preserve overlapping CDP request state (Trivikram Kamat) #64467
[718cbe9497] - deps: upgrade npm to 11.19.0 (npm team) #64883
[657c6154b3] - deps: update ngtcp2 to 1.25.0 (Node.js GitHub Bot) #64944
[75a1fbeff9] - deps: update nghttp3 to 1.18.0 (Node.js GitHub Bot) #64943
[07d7cb7cd8] - deps: update minimatch to 10.2.6 (Node.js GitHub Bot) #64945
[f7d56359f1] - deps: update simdjson to 4.6.6 (Node.js GitHub Bot) #64942
[8b06457cfb] - deps: update acorn to 8.18.0 (Node.js GitHub Bot) #64941
[5919d01525] - deps: update googletest to 1b6f64d659944658a4c685b7bd9f04c1c3b8a39b (Node.js GitHub Bot) #64940
[4a87ad6cff] - deps: update nghttp2 to 1.70.0 (Node.js GitHub Bot) #64939
[c96d76a7c8] - deps: update zlib to 1.3.2.1-motley-42c2f19 (Node.js GitHub Bot) #64744
[2b59984c0f] - deps: V8: backport 5177b10891e6 (avivkeller) #64631
[b839af91da] - deps: update ada to 4.0.0 (Node.js GitHub Bot) #64790
[70dedef942] - deps: update sqlite to 3.53.4 (Node.js GitHub Bot) #64745
[7bc4c171f5] - deps: update Rust crates for V8 14.6.202.34-node.26 (Renegade334) #64543
[308c6b2ac3] - deps: V8: backport 7d9b7e03141d (Manish Goregaokar) #64543
[8eeae28e88] - deps: V8: backport c4d06ba586f3 (liujiahui) #63731
[bbd6fc58c4] - diagnostics_channel: grow native channel storage (Stephen Belanger) #64497
[ce8b292955] - doc: fix grammar and punctuation in dgram documentation (Kamal Rawal) #64957
[1a413a60cf] - doc: fix grammar and editorial issues in addons documentation (Kamal Rawal) #64952
[63fbd59e64] - doc: formalize fn/name as part of TestOptions API (Christopher Hiller) #64946
[b263b0bca1] - doc: remove references to ca/crl as per-context QuicSession options (René) #64769
[f37de14b27] - doc: fix typo in maintaining-dependencies.md (greenhead) #64896
[16cb77cdc8] - doc: add RafaelGSS as last security release stewards (Rafael Gonzaga) #64843
[335c28cd17] - doc: fix typos in documentation (greenhead) #64900
[d4bed8ca39] - doc: fix missing references in doc type map (Tim Perry) #64872
[e71d09d5f1] - doc: improve TestContext hook descriptions (Kamal Rawal) #64899
[7089bd9ae4] - doc: add missing float32/float64 FFI type names (Soul Lee) #64874
[8d3ae0830e] - doc: document stream.isDestroyed() (YspritanHyzygy) #64789
[a757e62af7] - doc: add contributing detail for git Signed-off-by trailer (Mike McCready) #64862
[3e840f43ed] - doc: mark config-file as release candidate (Marco Ippolito) #64516
[70cd5df810] - doc: fix duplicated word in test snapshot docs (Kamal Rawal) #64837
[d5f36c7adc] - doc: remove obsolete cctest node.gyp instructions (Soul Lee) #64814
[a0bf29ea09] - doc: report proper return type on url.format (Brian Muenzenmeyer) #64806
[e655e42085] - doc: use ffi.suffix for library paths in examples (Junsoo Ha) #64805
[e0f0830dbc] - doc: document --permission-audit audit mode behavior (Adrián Estrada) #64791
[efbede6de0] - doc: clarify tlsSocket.authorized on resumption (soreavis) #64584
[db95655c4a] - doc: stabilize --disable-warning (Jean Michelet) #64742
[a8367200be] - doc: add MDN links for explicit resource management in fs (lluisemper) #59557
[1c09165c2e] - doc: mention constructor check in deepStrictEqual (Sumit Kumar Das) #62010
[29709324e0] - doc: update technical priorities (Jacob Smith) #64505
[522a28e648] - doc: deprecation add more codemod (Augustin Mauroy) #63175
[c40aaa6539] - doc: run license-builder (Node.js GitHub Bot) #63918
[428e9bc50f] - ffi: fix crash in refCallback and unrefCallback (Trivikram Kamat) #64881
[33912103e7] - ffi: reject fast calls after library close (Trivikram Kamat) #64860
[b348ed7f92] - ffi: validate fast 32-bit integer argument ranges (Trivikram Kamat) #64691
[48f4cfb480] - ffi: fix optimized buffer conversions (Trivikram Kamat) #64639
[109ffcd4f3] - ffi: preserve link register in ppc64 trampoline (Trivikram Kamat) #64792
[aa3f168b31] - ffi: preserve strings during reentrant calls (Trivikram Kamat) #64551
[ca60942f38] - ffi: preserve uint8 semantics for bool fast calls (Trivikram Kamat) #64527
[0fb1d2bd65] - ffi: validate fast integer argument ranges (Trivikram Kamat) #64614
[b250b40b30] - fs: key glob matcher cache by platform (Archkon) #64571
[e26891ec6a] - http: fix writableFinished and 'finish' after write errors (Tim Perry) #64847
[dfc192fdfb] - http: avoid aborting IncomingMessage signal on normal close (Archkon) #64392
[6794441c85] - http: guard invalid timeout values in checkConnections (Efe Karasakal) #64506
[6879aa4aa8] - http: propagate highWaterMark to ClientRequest OutgoingMessage (trivenay) #64653
[72448a82f4] - http2: avoid copying the options in respond() (Matteo Collina) #64265
[f6692da576] - http2: avoid per-write closures in kWriteGeneric (Matteo Collina) #64265
[3ed37153f8] - http2: reduce per-request allocations (Matteo Collina) #64265
[bce92debba] - Revert "http2: avoid per-write closures in kWriteGeneric" (Antoine du Hamel) #64663
[b5d5dd74a1] - Revert "http2: avoid copying the options in respond()" (Antoine du Hamel) #64663
[19b9c14d60] - lib: fix AbortSignal.any() observed-composite leak (Paul Bouchon) #64481
[d3cada57c2] - lib: fix typo in comment in _http_client.js (agape1225) #64729
[c1e4f7365e] - (SEMVER-MINOR) lib: add perfetto support (Chengzhong Wu) #64565
[6c2157522d] - loader: enforce path normalization before lookup (Maël Nison) #63917
[31522c41a7] - meta: bump actions/stale from 10.3.0 to 11.0.0 (dependabot[bot]) #64935
[88c8b8ef54] - meta: bump github/codeql-action/analyze from 4.36.2 to 4.37.3 (dependabot[bot]) #64934
[9dcd759a84] - meta: bump github/codeql-action/autobuild from 4.36.2 to 4.37.3 (dependabot[bot]) #64933
[82ca02db3c] - meta: bump actions/setup-python from 6.3.0 to 7.0.0 (dependabot[bot]) #64932
[848e2287f2] - meta: bump github/codeql-action/init from 4.36.2 to 4.37.3 (dependabot[bot]) #64931
[ae8ad3b17b] - meta: bump Mozilla-Actions/sccache-action from 0.0.10 to 0.0.11 (dependabot[bot]) #64930
[0b359cfa4c] - meta: bump cachix/install-nix-action from 31.10.6 to 31.11.0 (dependabot[bot]) #64929
[3b4f980f4c] - meta: bump github/codeql-action/upload-sarif from 4.36.2 to 4.37.3 (dependabot[bot]) #64927
[d7ee9e9ea7] - meta: bump step-security/harden-runner from 2.19.4 to 2.20.0 (dependabot[bot]) #64926
[7e80bbaaa9] - meta: bump ossf/scorecard-action from 2.4.3 to 2.4.4 (dependabot[bot]) #64925
[915cabbfcf] - meta: remove node_crates .gitignore (René) #64779
[8e03c54347] - meta: add @nodejs/url as codeowner for node_url_pattern.* (Efe Karasakal) #64737
[11c2f9c642] - (SEMVER-MINOR) module: implement Symbol.dispose in ModuleHooks (Remco Haszing) #63928
[fffd8a76d0] - net: support TCP handle transfer on Windows (Matteo Collina) #64460
[fe9e0dbdc2] - net: support AF_UNIX paths in net.BoundSocket (Guy Bedford) #64399
[eb61b7ee1e] - permission: add unique warning codes (David Evans) #64414
[999a928822] - permission: support v8.setHeapSnapshotNearHeapLimit (Ilyas Shabi) #64808
[7de3d095b6] - quic: fix stop sending behaviour & callback (Tim Perry) #64710
[6289398bb2] - quic: fix coverage comment typo (Jungwon Sohn) #64486
[01510dc759] - quic: fix segfault after fragmented client hello (Tim Perry) #64720
[dcc348af97] - quic: serialize stream reset code as string (한만욱) #64577
[c25b8e3331] - readline: reduce createInterface overhead (Matteo Collina) #64585
[14e802d1cd] - sqlite: invalidate sessions when closing database (Trivikram Kamat) #64783
[279547b7da] - sqlite: check database state before calling SQLite (Trivikram Kamat) #64812
[bb86521a42] - sqlite: fix crash when a session outlives its database (Mohamed Sayed) #63797
[870f4997e7] - sqlite: fix use-after-free in Exec() and ApplyChangeset() (Matteo Collina) #64535
[a8ec5a9df7] - src: fix perfetto build on GetTraceFilePath (Chengzhong Wu) #64721
[6cd643acaa] - src: implement MemoryRetainer protocol for ByteSource (Filip Skokan) #64660
[8725e56928] - src: fix crash when writing odd-length hex string via Writev (RajeshKumar11) #63658
[e018f9a4a1] - (SEMVER-MINOR) src: add perfetto trace agent (Chengzhong Wu) #64565
[0611d443ab] - (SEMVER-MINOR) src: rename legacy trace event headers (Chengzhong Wu) #64565
[2897cc1d93] - (SEMVER-MINOR) src: fix trace macro compatibility (Chengzhong Wu) #64565
[d4d7172e10] - src: avoid using ToLocalChecked in crypto_hash (James M Snell) #64668
[53b7d48b47] - src: fix libuv assertion on windows (liuxingbaoyu) #61999
[69d10ed021] - src,test: disable trace events tests when perfetto is enabled (Chengzhong Wu) #64721
[1b0597b4ef] - stream: cut per-chunk allocations in pipeTo (Matteo Collina) #64890
[2632d606bb] - stream: preserve push signal abort reason (Trivikram Kamat) #64798
[d5358a75bc] - stream: skip zero-byte broadcast writes (Trivikram Kamat) #64772
[796c896fb4] - stream: honor AbortSignal in Writer.end() (Trivikram Kamat) #64727
[ff12b8e22e] - stream: use validateString for consumer encoding (Jungwon Sohn) #64754
[cfad2efb06] - stream: use the ring buffer for pending BYOB pull-into descriptors (Matteo Collina) #64818
[fe06bf56dc] - stream: fix uncatchable error closing half-open Duplex.toWeb() writable (Mohamed Sayed) #64161
[f2919dbb83] - test: unflake debugger and REPL tests (Matteo Collina) #64718
[a1c29174e8] - test: ensure assertions are reached on all tests (Antoine du Hamel) #64716
[b9e596f8e5] - test: reuse ffi.suffix instead of reimplementing it (Seongeun Lee) #64840
[c816918e14] - test: remove test-repl-user-error-handler from flaky (avivkeller) #64631
[9d2f10ec54] - test: update WPT for url to 4832db4761 (Node.js GitHub Bot) #64829
[75b80d0b7b] - test: update WPT for url to b63305b743 (Node.js GitHub Bot) #64790
[9a139b3c86] - test: cover worker throwing primitive values (varshitha) #64365
[796acc8920] - test: mark test-repl-user-error-handler as flaky (Aviv Keller) #64612
[a646319f61] - (SEMVER-MINOR) test_runner: add support for --test-coverage-include-all (avivkeller) #64830
[4368303e01] - test_runner: wait for filtered suite build (semimikoh) #64208
[70d11241a3] - test_runner: convert to uint during deserialization (Aviv Keller) #64706
[cafe7bffcc] - tls: fix SNICallback certificate selection (Matteo Collina) #64700
[9ee05ec40f] - tools: bump the eslint group in /tools/eslint with 4 updates (dependabot[bot]) #64928
[5f4b859932] - tools: bump brace-expansion from 5.0.7 to 5.0.9 in /tools/eslint (dependabot[bot]) #64904
[b5ced907b3] - tools: use 'readonly' for EventSource global (Honey Tyagi) #64787
[fd4460e34e] - typings: add heap_utils internalBinding types (Donghoon Kang) #64816
[3bc0ee0492] - typings: remove isDataView from types binding (Archkon) #64738
[236d7ca965] - url: create URLPattern result properties in WebIDL order (Archkon) #64733
[3def577ab4] - v8: report minor mark-sweep in GCProfiler (Archkon) #64688
[5293abff73] - vfs: speed up recursive readdir test setup (Trivikram Kamat) #64813
[4345185496] - vfs: make lchown update symlink metadata (Trivikram Kamat) #64573
[b6ab546de5] - wasm: register missing SetURL function (Archkon) #64679
[f322870bd1] - zlib: validate pledgedSrcSize as a safe integer (Archkon) #64604
[44042c20d4] - zlib: accept ArrayBuffer dictionary in Zstd (Ryuhei Shima) #64599

2026-08-03, Version 26.6.0 (Current), @aduh95

Notable Changes

[5a36018abc] - doc: add MikeMcC399 as collaborator (Mike McCready) #64656
[9b04f82d7b] - (SEMVER-MINOR) ffi: add getCurrentEventLoop (Paolo Insogna) #64323
[bb51f2c960] - (SEMVER-MINOR) test_runner: add context.log() and test:log event (Moshe Atlow) #64389
[56ce83b3ee] - (SEMVER-MINOR) test_runner: report entryFile in TestStream events (Moshe Atlow) #64309

Commits

[248ff9fa5c] - assert,util: fix TypeError on Maps with null keys (Paul Bouchon) #64441
[3b5baceafe] - benchmark: add bytes variant to webstreams async-iterator (Matteo Collina) #64291
[0a46d1ef66] - buffer: normalize lone "\r" in Blob native line endings (Daijiro Wachi) #64115
[d9ada18b70] - buffer: fix Blob.stream() leaking source buffer (semimikoh) #63577
[d05993bcf6] - build: merge multiple on download artifact (Chengzhong Wu) #64633
[6c25ac909a] - build: extract temporal_capi crate directory name into gyp variable (René) #64482
[612f60c300] - cli: style node --help output with util.styleText (Adrián Estrada) #64484
[29a938ddbb] - crypto: preserve RSA-PSS legacy pubkey DER (Filip Skokan) #64547
[2fde794357] - crypto: cleanse provider private key copies (Filip Skokan) #64547
[33a0e08d41] - crypto: handle incomplete RSA private keys (Filip Skokan) #64547
[11b4d505ef] - crypto: retain legacy DH validation (Filip Skokan) #64547
[6e302041e1] - crypto: limit KangarooTwelveParams customization to 512 bytes (Filip Skokan) #64557
[195f103e87] - crypto: split OpenSSL 3, BoringSSL, and legacy backends (Filip Skokan) #64211
[ec67e24eee] - deps: update googletest to fa005b296f90faec4f352d7ab382287bf6548c8d (Node.js GitHub Bot) #64587
[32ffff88fd] - deps: histogram: cherry-pick 62ea52b07ee9b195 (StefanStojanovic) #64296
[e0664f1f09] - deps: update histogram to 0.11.10 (Node.js GitHub Bot) #64296
[cf0622bdd6] - deps: update amaro to 1.1.11 (Node.js GitHub Bot) #64586
[04c78b8b24] - deps: update timezone to 2026c (Node.js GitHub Bot) #64588
[59f4318976] - deps: V8: cherry-pick 1158ae719749 (René) #64432
[e5ea7cd299] - deps: update googletest to 8240fa7d62f73e01c7af27d61ed965d6d66698fa (Node.js GitHub Bot) #64439
[0e7554cee4] - deps: update libffi to 3.7.1 (Node.js GitHub Bot) #64438
[46c9d724ad] - deps: update ngtcp2 to 1.24.0 (Node.js GitHub Bot) #64297
[3519aac9af] - deps: enable OpenSSL asm support for riscv64 (Jamie Magee) #62606
[c09701218b] - deps: update c-ares to 1.34.8 (Node.js GitHub Bot) #64330
[ad2f3bc95b] - deps: upgrade npm to 11.18.0 (npm team) #64199
[d7a4b22c86] - deps: V8: backport a05321ebd98e (Chengzhong Wu) #64202
[8679cff291] - deps: update zlib to 1.3.2.1-motley-8b3aa8a (Node.js GitHub Bot) #64295
[df5b1e10ba] - doc: remove unsupported syntax from stream_iter.md (Antoine du Hamel) #64649
[8a4ca9083f] - doc: clarify rules for adding new built-in modules (Antoine du Hamel) #64648
[7d50fe6b7a] - doc: mention DEPENDENCY custom field for H1 reports (Rafael Gonzaga) #64634
[8f415bf5fc] - doc: fix dnsPromises.lookup verbatim default (Shivam S) #64658
[c6378f724d] - doc: fix broken links and clean up type map (Antoine du Hamel) #64625
[9b53ec19a2] - doc: fix typo in releases guide (Jihwan) #64621
[5a36018abc] - doc: add MikeMcC399 as collaborator (Mike McCready) #64656
[d2c8acd764] - doc: use promote wording in release guide (Md Muhtasim Munif Fahim) #64371
[5c692cb576] - doc: fix import.meta example for vm.SourceTextModule (Muhammad Zeeshan) #64112
[7568ce71ca] - doc: mention crypto.hash() for better perf (Steven) #63420
[cf3f631936] - doc: update sea example by fixing wrong code example (Maxence Robinet) #64025
[ce21e567a4] - doc: fix socket.readyState state descriptions (YuSheng Chen) #64468
[018c7f1c01] - doc: replace large tables in crypto.md and webcrypto.md with lists (Filip Skokan) #64582
[cf82de8d8b] - doc: note --env-file is not applied to --run (Paul Bouchon) #64442
[e635ce5201] - doc: fix typo in embedding.md (greenhead) #64425
[0b1f6eda3f] - doc: fix typos in contributing docs (Donghoon Kang) #64520
[d978ce80ef] - doc: document TLS alpnProtocol and servername fields (Tim Perry) #64362
[394669e3b3] - doc: fix spelling in devcontainer guide (한만욱) #64459
[9786a593ea] - doc: clarify PEM format for signing keys (Harjoth Khara) #64404
[6251f832ba] - doc: fix typo in tls.md (Daijiro Wachi) #64458
[b8656c40ad] - doc: document net Socket server property (Efe Karasakal) #64364
[03e9c738f3] - doc: update a Dispatcher undici doc link (Filip Skokan) #64358
[b6dd2debf0] - doc: fix typos in documentation (Jungwon Sohn) #64466
[3b7d778c3c] - doc: clarify fixes and refs trailer guidance (Trivikram Kamat) #64421
[eb086a6e03] - doc: remove duplicate VirtualProvider description (Archkon) #64400
[bc221a8cd7] - doc: add scope overview tables for TestsStream events (Moshe Atlow) #64386
[4b3dbd36df] - doc: clarify proxy threat model (Matteo Collina) #64366
[c5526f69d6] - doc: add note about restricted CI to pull-requests.md (Stewart X Addison) #64321
[968eaf6538] - doc: various updates to releases.md (Stewart X Addison) #64198
[2a51f8ba8e] - doc: remove obsolete --napi-modules doc entry (Chengzhong Wu) #64220
[ee5a54535e] - doc,test: widen fsPromises.appendFile()'s data type, add missing tests (Jimmy Leung) #64279
[b923df86fc] - events: avoid retaining removed event names (Matteo Collina) #64475
[7d8d413ff5] - events: optimize once() and removeListener() (Matteo Collina) #64373
[f2f8881d2a] - ffi: evaluate function signatures once (Trivikram Kamat) #64559
[9b04f82d7b] - (SEMVER-MINOR) ffi: add getCurrentEventLoop (Paolo Insogna) #64323
[4a3ef5b2b5] - fs: add pattern cache for matchGlobPattern() (bq) #63915
[ce113efcac] - fs: fix cp symlink and EEXIST handling on Windows (Kirill Saied) #64353
[3be3041ac9] - http: fix perf_hooks detail.req.url port and proxied path (Stefano Baghino) #64311
[0047ad73cf] - http: remove unused n arg from IncomingMessage._read (Efe Karasakal) #64370
[4d48984d5c] - http2: don't throw when destroying socket proxy (Matteo Collina) #64427
[3329647762] - http2: avoid copying the options in respond() (Matteo Collina) #64265
[a44fca5e24] - http2: avoid per-write closures in kWriteGeneric (Matteo Collina) #64265
[546e0e70a1] - inspector: add --cond to node inspect probe mode (Joyee Cheung) #64328
[b38a39dd96] - lib: use assignFunctionName util where it makes sense (Antoine du Hamel) #64515
[f60a12b94f] - lib,tools: add node-core/func-name-matching lint rule (Livia Medeiros) #57901
[9e6e9d4745] - meta: lower stale to 3 months (Aviv Keller) #64569
[3dd11c4993] - meta: move one or more collaborators to emeritus (Node.js GitHub Bot) #64315
[3f55208104] - module: add two tests for eager imports when using import defer (Maya Lekova) #64197
[c791eedc9d] - net: support sync connect for BoundSocket (Guy Bedford) #64375
[4df4a3fc61] - net: make TCP Server and Socket transferable across worker threads (Matteo Collina) #64225
[5dd34d7d06] - path: add benchmarks for path.matchesGlob() (bq) #63915
[8e520646b6] - quic: defer server session emit until TLS ClientHello is processed (Tim Perry) #64132
[4b8cc9a3fb] - quic: preserve session stats after close (한만욱) #64489
[591090ca85] - quic: add support for TLS certificate compression (Sebastian Beltran) #64434
[d636c9c30f] - quic: extract transport logic from Application to Session (Tim Perry) #64127
[abb62f961f] - quic: correct http3 callback and fix revealed errs (Marten Richter) #64289
[5f535fdbe8] - quic: fix no onstream handler crash quic (Efe) #64158
[933e5f14b5] - quic: fix stall datagrams, if no pending streams (Marten Richter) #64303
[272632a57f] - quic: fix potential crash from unobserved closed (Tim Perry) #64134
[2d5f445489] - sqlite: read column count after step in StatementSync.all() (Guilherme Araújo) #64219
[54929af44e] - src: avoid redundant KEM encapsulation copies (Filip Skokan) #64553
[5380bf28b3] - src: avoid redundant DataPointer reallocations (Filip Skokan) #64552
[6ff5a1b834] - src: fix comment typos (Jungwon Sohn) #64509
[508ec0e435] - src: zero-initialize cap_data in node_credentials.cc (Samuel Kapust) #64347
[c5090a36c1] - src: fix some typo errors and rename some variables (Archkon) #64301
[0a89bef69e] - src,permission: do not throw on denied access in audit mode (Adrián Estrada) #64426
[63e71195c5] - stream: abort pending single-source merge reads (Trivikram Kamat) #64445
[f403b30c3d] - stream: use RangeError for broadcast overflow (Trivikram Kamat) #64420
[5c0578cbf7] - stream: skip null output from stateful transforms (Trivikram Kamat) #64462
[0488d02d5d] - stream: update iterable streams to use budget backpressure (James M Snell) #64464
[f0811baeef] - stream: remove custom CloneableDOMException implementation (Antoine du Hamel) #64469
[10f3f9682e] - stream: fix drop-newest behavior in share() (Trivikram Kamat) #64417
[2aad973b29] - stream: resume flow when an errored pipe destination is removed (Mahin Anowar) #64310
[6112ed5ceb] - stream: fold desired-size check into WHATWG backpressure update (Matteo Collina) #64451
[d829aa1138] - stream: validate writer options signal (Trivikram Kamat) #64385
[8e7a5e940e] - stream: reject push iterator.throw() with error (Trivikram Kamat) #64380
[4390f81294] - stream: simplify nested PromisePrototypeThens (Antoine du Hamel) #64470
[ddf2c38e9d] - stream: use the ring buffer for WHATWG stream request queues (Matteo Collina) #64431
[518d81b36d] - stream: validate writevSync chunks before queuing (Trivikram Kamat) #64300
[f745c4261d] - stream: speed up reads and iteration over default WHATWG streams (Matteo Collina) #64320
[4f4bce62fe] - stream: copy SAB-backed chunks in iter consumers (Trivikram Kamat) #64382
[f29937d26f] - stream: reject nested async streamables in from() (Trivikram Kamat) #64352
[424cec71b7] - stream: avoid draining merged iter sources (Trivikram Kamat) #64293
[e01906180c] - stream: use ring buffer for WHATWG stream queues (Yagiz Nizipli) #64312
[0a0193f666] - stream: hoist repeated loads in readable paths (Yagiz Nizipli) #64312
[ebe16003b6] - stream: prefer sync iterator in fromSync (Trivikram Kamat) #64294
[f249614835] - stream: speed up async iteration over WHATWG byte streams (Matteo Collina) #64291
[7331118699] - stream, quic: update iterable streams backpressure (James M Snell) #64464
[46b117729d] - test: update quic tests for stream/iter update (James M Snell) #64464
[b122ca5389] - test: fix flaky http2 socket proxy test (Tim Perry) #64673
[68c46146fd] - test: apply correction to comment (Rich Trott) #64524
[d7e119b26b] - test: keep finalization before-exit ref alive (Tim Perry) #64521
[0db4e10a0c] - test: copyedit test-tls-psk-alpn-callback-exception-handling (Antoine du Hamel) #63485
[21389f7b25] - test: fix stale async-context-frame status entries (Kirill Saied) #64141
[af55304846] - test: update WPT for urlpattern to 5847ee5cfa (Node.js GitHub Bot) #64436
[43a5ce4e00] - test: update WPT for WebCryptoAPI to ec2fee39a4 (Node.js GitHub Bot) #64435
[11ca52a521] - test: fix flaky http2 maxOriginSetSize test (Tim Perry) #64407
[af08a11e77] - test: fix 2nd flaky blob test case (Tim Perry) #64391
[0104ae1171] - test: fix flaky watch + cwd + argv test-runner test (Tim Perry) #64372
[b3ff5fe3f4] - test: normalize Windows crash in debugger test normalization (Joyee Cheung) #64332
[4cdceb7436] - test: unmark flaky http2-large-file for Win (Kirill Saied) #64255
[19f529377b] - test: unmark flaky SEA snapshot tests on Windows (Kirill Saied) #64317
[66f9b342ef] - test: increase timeout in consumed-timeout test (Trivikram Kamat) #64204
[fdbbf0ae6d] - test: handle null stdio streams in spawnSyncAndAssert helper (Joyee Cheung) #64273
[10ea17dafe] - test: remove impact of tier-up changes in worker stack size test (Joyee Cheung) #64271
[bb51f2c960] - (SEMVER-MINOR) test_runner: add context.log() and test:log event (Moshe Atlow) #64389
[56ce83b3ee] - (SEMVER-MINOR) test_runner: report entryFile in TestStream events (Moshe Atlow) #64309
[7a02e4f9e6] - timers: do not retain a reference to the async store after firing (Matteo Collina) #53443
[7d5d46ef00] - tls: match IPv6 hosts against IP-Address SANs (Pascal Garber) #64145
[f7bc0c62df] - tools: bump brace-expansion from 5.0.6 to 5.0.7 in /tools/eslint (dependabot[bot]) #64636
[3f80ed2e93] - tools: reference 'git node land' in PR-URL: error message in merge.sh (Stewart X Addison) #64495
[7b373cafce] - tools: disable zipping tarballs on GHA (Antoine du Hamel) #64423
[5bdbd256e9] - tools: add workflow to compare Nix changes (Antoine du Hamel) #64410
[ca4a16634b] - tools: add option for benchmark.yml to post comment on PR (Antoine du Hamel) #64395
[86193ef193] - tools: fix redundant conditions in v8.gyp for riscv64 and loong64 (Jamie Magee) #62608
[ee460404be] - util: make MIMEParams accessors case-insensitive (Daijiro Wachi) #64123
[a63ee46ddd] - vfs: make recursive readdir iterative (AkshatOP) #64149
[37f93c3b15] - vfs: make lchmod update symlink mode (Trivikram Kamat) #64350
[ce54e2a9c8] - vfs: fix VirtualReadStream race with async iteration (Y1D7NG) #64394
[54e8d3a14b] - vfs: follow symlinked dirs in recursive mkdir (Trivikram Kamat) #64287
[7be42b64e1] - vm: enable interception on global restricted properties (Chengzhong Wu) #64202
[c2cfcf8e7d] - zlib: reject truncated zstd input (Archkon) #64593

2026-07-29, Version 26.5.1 (Current), @RafaelGSS

This is a security release.

Notable Changes

(CVE-2026-56848) http2: defer rst stream while in scope (Matteo Collina) – High
(CVE-2026-58043) permission: avoid granting radix split nodes (RafaelGSS) – High
(CVE-2026-56850) https: distinguish PFX object-array agent keys (RafaelGSS) – Medium
(CVE-2026-58040) https: bind identity checks to session reuse (Matteo Collina) – Medium
(CVE-2026-58041) sqlite: invalidate tag store iterators on statement reset (Matteo Collina) – Medium
(CVE-2026-58042) dns: handle large resolveAny address replies (RafaelGSS) – Medium
(CVE-2026-58045) zlib: throw on out-of-bounds write buffers (RafaelGSS) – Medium
(CVE-2026-56847) permission: enforce fs write permission for trace events (RafaelGSS) – Low
(CVE-2026-58039) permission: check final report output path (RafaelGSS) – Low
(CVE-2026-58044) http: reject requests exceeding max header count (Matteo Collina) – Low
deps: update llhttp to 9.4.3 (Paolo Insogna)
deps: update undici to 8.9.0 (Node.js GitHub Bot)

Commits

[af0bf96877] - deps: update llhttp to 9.4.3 (Paolo Insogna) nodejs-private/node-private#935
[0354678355] - deps: update undici to 8.9.0 (Node.js GitHub Bot) #64712
[dbeeaeec13] - (CVE-2026-58042) dns: handle large resolveAny address replies (RafaelGSS) nodejs-private/node-private#929
[064d339f56] - (CVE-2026-58044) http: reject requests exceeding max header count (Matteo Collina) nodejs-private/node-private#922
[23b94c843a] - (CVE-2026-56848) http2: defer rst stream while in scope (Matteo Collina) nodejs-private/node-private#921
[c7ec3dc0b9] - (CVE-2026-58040) https: bind identity checks to session reuse (Matteo Collina) nodejs-private/node-private#904
[8f666925b1] - (CVE-2026-56850) https: distinguish PFX object-array agent keys (RafaelGSS) nodejs-private/node-private#930
[ad99d075b1] - (CVE-2026-58043) permission: avoid granting radix split nodes (RafaelGSS) nodejs-private/node-private#911
[61222008b7] - (CVE-2026-58039) permission: check final report output path (RafaelGSS) nodejs-private/node-private#908
[3cb607dfc4] - (CVE-2026-56847) permission: enforce fs write permission for trace events (RafaelGSS) nodejs-private/node-private#924
[d08fde8a16] - (CVE-2026-58041) sqlite: invalidate tag store iterators on statement reset (Matteo Collina) nodejs-private/node-private#896
[b3fbb6e11f] - (CVE-2026-58045) zlib: throw on out-of-bounds write buffers (RafaelGSS) nodejs-private/node-private#931

2026-07-08, Version 26.5.0 (Current), @richardlau

Notable Changes

New release key

Welcome to our newest releaser, Stewart X Addison. Future Node.js releases may be signed with his release key, 655F3B5C1FB3FA8D1A0CA6BDE4A7D232B936D2FD.

Other notable changes

[55f48446c7] - (SEMVER-MINOR) buffer: implement blob.textStream() (Matthew Aitken) #64036
[b373202efc] - (SEMVER-MINOR) esm: add --experimental-import-text flag (Efe) #62300
[39e0c14455] - (SEMVER-MINOR) perf_hooks: sample delay per event loop iteration (Pablo Erhard) #62935
[999a83c937] - (SEMVER-MINOR) stream: expose ReadableStreamTee (Matteo Collina) #64195
[4e0236dc3d] - (SEMVER-MINOR) tls: report negotiated TLS groups (Filip Skokan) #64119

Commits

[87648c0a6c] - benchmark: trim down the argon2 sets (Filip Skokan) #64218
[a483bfd3f0] - buffer: remove unreachable overflow check in atob (haramjeong) #60161
[6d14279688] - buffer: add fast api for isUtf8 and isAscii (Gürgün Dayıoğlu) #64169
[55f48446c7] - (SEMVER-MINOR) buffer: implement blob.textStream() (Matthew Aitken) #64036
[a67d9a7a44] - build: allow linting node.1 (Aviv Keller) #64157
[06c1fbc25b] - build: enable Maglev for riscv64 (Jamie Magee) #62605
[518309c363] - build: suppress clang errors building libffi on Windows (René) #64222
[6a80ab485c] - build: add manually-dispatched stress-test workflow (Joyee Cheung) #64118
[f4e7bf1f1c] - build: pin envinfo versions in github actions (Joyee Cheung) #64117
[66f6ac0d86] - build: support setting an emulator from configure script (Ivan Trubach) #53899
[7f26c54aa6] - child_process: fix permission model propagation via NODE_OPTIONS (Matteo Collina) #63972
[32bb554f5b] - crypto: fix large DH generator validation (Tobias Nießen) #64092
[0908d76ef6] - crypto: reject small-order EdDSA points during verify (Filip Skokan) #64026
[7f7e5863c2] - deps: update undici to 8.7.0 (Node.js GitHub Bot) #64282
[af91029801] - deps: update nghttp3 to 1.17.0 (Node.js GitHub Bot) #64182
[2e500ba7b0] - deps: update googletest to 8b53336594cc52213c6c2c7a0b29194fa896d039 (Node.js GitHub Bot) #64181
[74e3aa24ba] - deps: update sqlite to 3.53.3 (Node.js GitHub Bot) #64180
[c7e57f55a7] - deps: c-ares: cherry-pick 8ba37af8e3fb (René) #64110
[879fdc4daf] - deps: V8: backport da20a197a7f9 (Kevin Gibbons) #64101
[a640543a7c] - deps: V8: cherry-pick 0cc9eb22c0b0 (Kevin Gibbons) #64101
[feefd179e5] - deps: V8: cherry-pick 1a391f98cc7a (Kevin Gibbons) #64101
[8ef643d4b0] - deps: update googletest to 0b1e895ba4226c2fda5ee0178c9b5b1195a741aa (Node.js GitHub Bot) #64039
[9e50bb0655] - dgram: skip dns.lookup() for literal IP addresses (Ruben Bridgewater) #64133
[dc052c095c] - diagnostics_channel: return original thenable (Stephen Belanger) #62407
[a22a840293] - doc: clarify QUIC stream state wording (EduardF1) #63660
[8d4bec2d71] - doc: update Http2SecureServer.on("timeout") default value (YuSheng Chen) #64187
[da88f70afa] - doc: add note on visibility of CI failures to new contributor guide (Stewart X Addison) #64256
[20ce359ccb] - doc: clarify HTTP/1.1 response ordering (Matteo Collina) #64213
[05eae2835c] - doc: recommend node-stress-single-test for flaky tests (Trivikram Kamat) #64223
[3966eb67e7] - doc: fix typo in examples (Vas Sudanagunta) #64184
[12a2b9daa3] - doc: fix typo in node-config-schema.json (Hamid Reza Ghavami) #64188
[0854482671] - doc: clarify defense-in-depth issues (Matteo Collina) #64215
[ef4915fc3a] - doc: fix Fast FFI argument count in ffi.md (Daijiro Wachi) #63960
[bb2eed863c] - doc: add sxa GPG key (ed25519) (Stewart X Addison) #64193
[b7bf6e3a06] - doc: add guide and answers to FAQs for first-time contributors (Joyee Cheung) #63685
[ff537ba858] - doc: update Http2Server.close & Http2SecureServer.close (YuSheng Chen) #63298
[f3db304588] - doc: update list of people in SECURITY.md (Richard Lau) #64152
[2a126647b0] - doc: clarify vfs is not a sandbox (Matteo Collina) #64143
[85fc79dd9b] - doc: fix broken links and duplicate stability label (Antoine du Hamel) #64130
[189e830eb3] - doc: add missing option to man page (Richard Lau) #64156
[7a16ccccd0] - doc: announce upcoming end of tier 2 support for macOS x64 (Antoine du Hamel) #63931
[d5f826045f] - doc: update toolchain for official AIX releases (Richard Lau) #64068
[60abc4400f] - doc: fix callback example import in fs docs (Kamal Rawal) #63912
[e470c74a6c] - doc: fix keepAliveTimeout default in http.createServer options (Jahanzaib iqbal) #63974
[851b460583] - esm: improve ERR_REQUIRE_ASYNC_MODULE (Joyee Cheung) #64260
[0cd443df39] - esm: print required top-level await locations without evaluating (Joyee Cheung) #64154
[b373202efc] - (SEMVER-MINOR) esm: add --experimental-import-text flag (Efe) #62300
[eacfbd0ca5] - http: add CONNECT method handling for default Host header with proxy (Archkon) #64114
[aeb539a383] - http: fix drain event with cork/uncork (David Evans) #64038
[8e8874b216] - http: document and validate options.path when it's in absolute-form (Joyee Cheung) #64108
[eb2e96bc28] - inspector: fix crash when writing to closed inspector socket (ympark2011) #64209
[243b0e4e57] - lib: reject string "0" in validatePort when allowZero is false (Daijiro Wachi) #64174
[34a537c0ed] - lib: use __proto__: null when calling ObjectDefineProperty (Antoine du Hamel) #64239
[1f72393f19] - lib: lazily initialize kEvents and kHandlers maps (Guilherme Araújo) #63702
[92a3dc3191] - lib,permission: fix addon permission drop (Martin Wagner) #64007
[87b8f2a296] - meta: fix linter warning in stale.yml (Antoine du Hamel) #64281
[829c4a5913] - meta: bump actions/cache from 5.0.5 to 6.1.0 (dependabot[bot]) #64248
[0808dcd31c] - meta: bump github/codeql-action/autobuild from 4.36.1 to 4.36.2 (dependabot[bot]) #64247
[64aa17058f] - meta: bump github/codeql-action/analyze from 4.36.1 to 4.36.2 (dependabot[bot]) #64246
[873d1e0412] - meta: bump actions/checkout from 6.0.2 to 7.0.0 (dependabot[bot]) #64245
[fe460ccf0b] - meta: bump codecov/codecov-action from 6.0.1 to 7.0.0 (dependabot[bot]) #64244
[845c63ed50] - meta: bump rtCamp/action-slack-notify from 2.3.3 to 2.4.0 (dependabot[bot]) #64243
[2cad2d6de5] - meta: bump github/codeql-action/init from 4.36.1 to 4.36.2 (dependabot[bot]) #64242
[0ddde950c7] - meta: bump actions/setup-python from 6.2.0 to 6.3.0 (dependabot[bot]) #64241
[c0a8760d2f] - meta: bump github/codeql-action/upload-sarif from 4.36.1 to 4.36.2 (dependabot[bot]) #64240
[f49704b9d0] - meta: clarify V8 flags are outside threat model (Matteo Collina) #64224
[6b8dc58e6e] - meta: move one or more collaborators to emeritus (Node.js GitHub Bot) #64057
[fe5260cca7] - meta: update status of past strategic initiatives (Joyee Cheung) #63480
[7b01040008] - meta: speed up stale bot (Aviv Keller) #64075
[874c46c24f] - meta: update sccache version in test-linux-quic (René) #64043
[48c5c86363] - module: enable import support for addons by default (Chengzhong Wu) #64221
[39e0c14455] - (SEMVER-MINOR) perf_hooks: sample delay per event loop iteration (Pablo Erhard) #62935
[f90f1bd032] - perf_hooks: add NODE_PERFORMANCE_GC_MINOR_MARK_SWEEP constant (Attila Szegedi) #63877
[bdf32628c7] - process: fix finalization cleanup ref tracking (Trivikram Kamat) #64087
[9a65b7fff4] - quic: drop version negotiation packets with oversized CIDs (Mohamed Sayed) #64228
[2699fe4706] - quic: fixes undefined handle in QuicStream kInspect (Marten Richter) #64170
[00dea28bb3] - repl: lazy-load acorn and defer vm context creation (Daijiro Wachi) #63879
[ce659a1cf9] - src: fix escaping of single quotes in task runner (Antoine du Hamel) #64089
[dbb3126e5c] - src: abstract tracing agent for both legacy and perfetto (Chengzhong Wu) #64053
[12edf1d68d] - src: avoid redundant call to std::get_if<>() (Tobias Nießen) #64094
[eda91b6d01] - src: avoid copying source string in TextEncoder.encode (Yagiz Nizipli) #63897
[efbbb9a03c] - stream: preserve half-open duplexes in async iteration (Efe) #64275
[999a83c937] - (SEMVER-MINOR) stream: expose ReadableStreamTee (Matteo Collina) #64195
[ab5ed72903] - stream: reject iter consumers on abort (Trivikram Kamat) #64066
[d3fa77c5e2] - stream: fix merge abort for pending sources (Trivikram Kamat) #64013
[38b99140ed] - stream: refactor unnecessary optional chaining away (Antoine du Hamel) #64253
[c81f894ebe] - stream: cut per-chunk overhead in WHATWG streams (Matteo Collina) #64252
[f162234f24] - stream: normalize Broadcast.from() byte inputs (Trivikram Kamat) #64082
[1182ad8f3b] - stream: proxy first own method in Readable.wrap() (Daijiro Wachi) #64048
[d0b830b382] - stream: observe abort while awaiting pipeTo source (Trivikram Kamat) #64015
[f7adcd8359] - stream: respect iter consumer abort signals (Trivikram Kamat) #63997
[b09e624c6f] - test: make blob desiredSize assertion robust (Trivikram Kamat) #64106
[d0d8f0c774] - test: update WPT for urlpattern to 11a459a2b1 (Node.js GitHub Bot) #64037
[ff9122c20c] - test: improve lcov reporter snapshot diagnostics (Trivikram Kamat) #64049
[570952d4f3] - test: keep finalization close fixture ref alive (Trivikram Kamat) #64085
[1b4f213380] - test: fix typo from overriden to overridden (parkhojeong) #63403
[4c91090b8b] - test: fix typo from funciton to function (parkhojeong) #63403
[bf080c7917] - test: mark hr-time WPT flaky on macos15-x64 (Trivikram Kamat) #64054
[24e32098c5] - test: use one-off agent in http consumed timeout test (Trivikram Kamat) #64052
[3229886de2] - test: fix flaky test-runner coverage threshold test (Trivikram Kamat) #64051
[83b91ea6ec] - test_runner: filter execArgv fallback for child tests (Trivikram Kamat) #64056
[269b609a3d] - test_runner: improve coverage failure diagnostics (Trivikram Kamat) #64050
[0342744c34] - test_runner: add timestamp to JUnit reporter testsuites (sangwook) #64029
[086741d121] - timers: reuse Timeout objects in setStreamTimeout (Matteo Collina) #64254
[4e0236dc3d] - (SEMVER-MINOR) tls: report negotiated TLS groups (Filip Skokan) #64119
[3bdd7e20be] - tls: handle large RSA exponents in X.509 cert (Tobias Nießen) #64093
[c96c838977] - tools: update RUSTC_VERSION for remaining GHA workflows (René) #64325
[ee873b7aaf] - tools: bump temporal_rs version (Antoine du Hamel) #63281
[ea3b870155] - tools: remove envinfo from our workflows (Antoine du Hamel) #64259
[d940f02e8b] - tools: bump the eslint group in /tools/eslint with 8 updates (dependabot[bot]) #64249
[fe0ea2bb5d] - tools: bump @node-core/doc-kit (dependabot[bot]) #64010
[4dceefde1e] - tools: bump undici from 6.24.1 to 6.27.0 in /tools/doc (dependabot[bot]) #64031
[6e187db7d7] - tools: update c-ares updater script (Antoine du Hamel) #64194
[657a35f5a2] - tools: validate version number in release proposal commit message lint (Antoine du Hamel) #64070
[17228a861c] - tools: add GHA benchmark runner (Antoine du Hamel) #60293
[6d11a71d91] - tools: update build-shared/action.yml to a reusable workflow (Antoine du Hamel) #64059
[7a17c50b7f] - tools: update libffi updater script (Antoine du Hamel) #64046
[28047a3e71] - tools: exclude libffi changes from test-shared GHA CI (Antoine du Hamel) #64047
[58d9685acc] - typings: add typing for crypto (Filip Skokan) #64122
[7a9dcad44d] - util: fix OOM in inspect color stack formatting (Ijtihed Kilani) #64022
[d5f01bbbde] - vfs: reject rename into descendant directory (Trivikram Kamat) #64285
[0b6af91081] - vfs: handle current-position sentinel in memory files (Trivikram Kamat) #64163
[322230d641] - vfs: support writeFileSync with virtual fds (Trivikram Kamat) #64165
[9395d209c7] - vfs: avoid recursive readdir symlink cycles (Matteo Collina) #64168
[bbdd7643b6] - vfs: read RealFSProvider files from open fd (Trivikram Kamat) #64104
[92859b8097] - vm: fix copying PropertyDescriptor (Chengzhong Wu) #64073
[9046035475] - zlib: validate flush king for all streams (Ic3b3rg) #63746
[98be4304a3] - zlib: validate flush kind for brotli streams (Ic3b3rg) #63746
[90007a59a9] - zlib: expose rejectGarbageAfterEnd option (Filip Skokan) #64023
[5933516066] - zlib: reject trailing gzip members in web streams (Filip Skokan) #64023

2026-06-24, Version 26.4.0 (Current), @aduh95

Notable Changes

[cde0daabcc] - (SEMVER-MINOR) doc: update blockList stability status to release candidate (alphaleadership) #63050
[b78f5a7537] - (SEMVER-MINOR) fs: support caller-supplied readFile() buffers (Matteo Collina) #63634
[417aacbc36] - (SEMVER-MINOR) http: close pre-request sockets in closeIdleConnections (semimikoh) #63470
[fbb108be7d] - (SEMVER-MINOR) loader: implement package maps (Maël Nison) #62239
[45494d5a8a] - (SEMVER-MINOR) net: support TCP_KEEPINTVL and TCP_KEEPCNT in setKeepAlive (Guy Bedford) #63825
[ee29465e77] - (SEMVER-MINOR) tls: add certificateCompression option (Tim Perry) #62217
[b17817eb2b] - (SEMVER-MINOR) vfs: dispatch node:fs/promises to mounted VFS instances (Matteo Collina) #63537
[7bc93a6ac5] - (SEMVER-MINOR) vfs: add minimal node:vfs subsystem (Matteo Collina) #63115

Commits

[c7eb83b46a] - benchmark: add child_process async path baselines (Yagiz Nizipli) #63929
[066fff17a5] - benchmark: remove old alias usage in ffi benchmarks (Anna Henningsen) #63666
[509cd1b94f] - buffer: optimize Buffer.prototype.copy (Robert Nagy) #63828
[86e651bbd0] - buffer: use simdutf for two-byte utf8 byteLength (Mert Can Altin) #63639
[d3f4ed9015] - build: suppress compiler warnings for histogram (Richard Lau) #63980
[82dd7ddbe6] - build: add QUIC CI job for PRs matching QUIC related paths (Tim Perry) #63875
[1124c0652d] - build: remove redundant intermediate node_aix_shared (Chengzhong Wu) #63747
[e510ee8087] - build: build codecache and snapshot with libnode (Chengzhong Wu) #63626
[5b583dace5] - build: enable maglev by default on Linux ppc64le (Richard Lau) #63474
[a2324246b4] - build: remove duplicated node_use_sqlite and node_use_ffi conditions (Chengzhong Wu) #63629
[2a467a5f69] - Revert "build, doc: generate node.1 with doc-kit" (Antoine du Hamel) #64091
[e01dec45b8] - build, doc: generate node.1 with doc-kit (Aviv Keller) #62044
[2ab9848fe4] - child_process: pass spawn options to the binding positionally (Yagiz Nizipli) #63930
[04c04c8b5c] - child_process: serialize advanced IPC messages natively (Yagiz Nizipli) #63933
[1eef57293d] - crypto: support non-byte WebCrypto lengths and cSHAKE (Filip Skokan) #63988
[788a66e147] - crypto: share WebCrypto method and usage helpers (Filip Skokan) #63975
[f9fdce3f46] - crypto: use EVP_MAC for HMAC on OpenSSL >=3 (Filip Skokan) #63942
[7e9ca87e58] - crypto: make webcrypto aliasKeyFormat directional (Filip Skokan) #63910
[656e57ebbf] - crypto: fix unhandled error in Hash._transform (Haram Jeong) #63261
[65536f0d98] - crypto: refactor keyObject.toCryptoKey() and SubtleCrypto.getPublicKey() (Filip Skokan) #63622
[978f1d2bcc] - crypto: handle cipher context allocation failures (Tian Teng) #63542
[5551e8f773] - crypto: deduplicate X509 subject matching logic (Tobias Nießen) #63644
[57ae87640a] - crypto: fix warnings in test_node_crypto.cc (Maya Lekova) #63490
[9984b05dff] - crypto: coerce -0 to +0 before native calls (Filip Skokan) #63556
[88011a3689] - crypto,tls: do not ignore BN_get_word error (Tobias Nießen) #63895
[9a3393d14f] - debugger: lazily wait for initial break output (Trivikram Kamat) #63969
[b0bfcb9c59] - debugger: defer probe pause handling until startup (Trivikram Kamat) #63608
[8516003953] - debugger: await initialization after run and restart (Trivikram Kamat) #63607
[4438cb5284] - debugger: add --max-hit option to probe mode (Joyee Cheung) #63704
[238b54ed2a] - debugger: add more logs to probe mode (Joyee Cheung) #63663
[bbef54b413] - deps: libffi: cherry-pick 9ca53a19833d (Anthony Green) #64040
[9761385dbd] - deps: update libffi to 3.6.0 (Node.js GitHub Bot) #64040
[373ec2d092] - deps: update acorn to 8.17.0 (Node.js GitHub Bot) #63901
[e44b5d487e] - (SEMVER-MINOR) deps: update OpenSSL build config to support compression (Tim Perry) #62217
[3ed287a2e2] - deps: upgrade npm to 11.17.0 (npm team) #63857
[b1b597c797] - deps: add ngtcp2_fmt.c to build configuration (ngtcp2.gyp) (沈鸿飞) #63821
[0bf8e12305] - deps: V8: add CopyArrayBufferBytes API (Robert Nagy) #63828
[e49d7301a5] - deps: update ngtcp2 to 1.23.0 (Node.js GitHub Bot) #63777
[e5c079004b] - deps: update nghttp3 to 1.16.0 (Node.js GitHub Bot) #63776
[d599fa2346] - deps: update googletest to 7140cd416cecd7462a8aae488024abeee55598e4 (Node.js GitHub Bot) #63775
[bc09f1508c] - deps: update sqlite to 3.53.2 (Node.js GitHub Bot) #63774
[60787746c4] - deps: update zlib to 1.3.2.1-motley-3246f1b (Node.js GitHub Bot) #63773
[971af104f1] - deps: update amaro to 1.1.10 (Node.js GitHub Bot) #63670
[e17f665444] - deps: update googletest to 8736d2cd5c1dcba41170ed2fddca14021d4916c3 (Node.js GitHub Bot) #63669
[7591949457] - dgram: add synchronous Socket connectSync() (Guy Bedford) #63932
[d75222d7cb] - dgram: add synchronous Socket.prototype.bindSync() (Guy Bedford) #63838
[0cf8342ae2] - dns: coerce -0 to +0 in lookup and resolver inputs (Filip Skokan) #63556
[e068299320] - doc: update gcc toolchains to gcc-13 and g++-13 (Louie Llaneta) #64018
[65178bdcf3] - doc: add aduh95 to last security release steward (Antoine du Hamel) #63981
[83eedfe85b] - doc: fix typo in util.md (Daijiro Wachi) #63961
[54948c78e7] - doc: clarify callback exceptions (Matteo Collina) #63939
[205d0a57f2] - doc: fix incorrect test runner mock examples (Kimaswa Emmanuel Yusufu) #63656
[44809b176c] - doc: clarify fromReadable() duck-typed contract (Trivikram Kamat) #63682
[9cb15fcc85] - doc: fix typo in cli.md (Daijiro Wachi) #63883
[394d0bb928] - doc: fix typo in vm.md (Daijiro Wachi) #63881
[59b7be8193] - doc: fix typo in packages.md (Daijiro Wachi) #63882
[33c236cea9] - doc: fix a/an article typos in module, util, and dns (Daijiro Wachi) #63766
[30595da67b] - doc: update npm supported versions link (hojeong park) #63672
[5919ba7e97] - doc: fix AES-OCB IV length in SubtleCrypto.supports example (Anshika Jain) #63717
[51cab5cb72] - doc: add webstreams to args for pipeline from stream/promises (David Sanders) #63628
[ce85b2af88] - doc: fix "used to sent" → "used to send" in http2 (Daijiro Wachi) #63700
[298735e8df] - doc: mark Node.js 25 as End-of-Life (Antoine du Hamel) #63692
[56948518b9] - doc: clarify tty raw mode applies to input processing only (Muhammad Zeeshan) #63438
[32ff731248] - doc: add worker_threads history entries (Bob Put) #63545
[cde0daabcc] - (SEMVER-MINOR) doc: update blockList stability status to release candidate (alphaleadership) #63050
[d29483fc4f] - doc,crypto: mark argon2 and encap/decap as stable (Filip Skokan) #63924
[6e668331d9] - events: improve addAbortListener perf by caching options object (Raz Luvaton) #52367
[97aafe2519] - ffi: add fast support for almost all other platforms (Paolo Insogna) #63941
[f52cf5eeaa] - ffi: add experimental fast FFI call API for AArch64 and x86_64 (Paolo Insogna) #63068
[d9461fee05] - ffi: port semi-colon fix for riscv64 (and others) (Stewart X Addison) #63794
[4c8402e0a8] - fs: do not treat EPERM as ENOTEMPTY on Windows (Kirill Saied) #63709
[b78f5a7537] - (SEMVER-MINOR) fs: support caller-supplied readFile() buffers (Matteo Collina) #63634
[3d0097d489] - fs: prevent spurious recursive watch events on prefix siblings (Marco) #63095
[14d829cb3c] - fs: ignore deleted dirs in recursive watch scan (Trivikram Kamat) #63686
[ceba08a1ea] - fs: coerce -0 to +0 in mode flags and watch intervals (Filip Skokan) #63556
[6577d3b282] - http: avoid stream listeners on idle agent sockets (Matteo Collina) #64004
[417aacbc36] - (SEMVER-MINOR) http: close pre-request sockets in closeIdleConnections (semimikoh) #63470
[b7fd13a59a] - http2: retain header memory in session accounting (Matteo Collina) #63752
[e611ccd167] - inspector: fix inspector.close() documented behavior (Chengzhong Wu) #63837
[a44f51eef3] - lib: fix missing lazyDOMException import (Filip Skokan) #64033
[27cc4ec598] - lib: add lint rule to enforce use of kEmptyObject (Antoine du Hamel) #63790
[7ee31b0bf4] - lib: improve control abstraction coverage in frozen intrinsics (Renegade334) #63698
[078457839a] - lib: add Iterator global to primordials (Renegade334) #63698
[58837dc4dd] - lib: remove source map deadcode in type stripping (Chengzhong Wu) #63738
[e7513a8b9e] - lib: make Navigator#language getter throw on invalid this (Mohamed Sayed) #63601
[fbb108be7d] - (SEMVER-MINOR) loader: implement package maps (Maël Nison) #62239
[ea0b8e1dc2] - meta: bump github/codeql-action from 4.35.3 to 4.36.1 (dependabot[bot]) #63724
[ac90719532] - meta: bump actions/cache from 5.0.4 to 5.0.5 (dependabot[bot]) #62847
[3ed3de3062] - meta: bump actions/checkout from 6.0.2 to 6.0.3 (dependabot[bot]) #63726
[d08d57bf70] - meta: bump codecov/codecov-action from 6.0.0 to 6.0.1 (dependabot[bot]) #63725
[e748d192cf] - meta: bump cachix/cachix-action (dependabot[bot]) #63729
[10554eb131] - meta: bump actions/stale from 10.2.0 to 10.3.0 (dependabot[bot]) #63728
[791885f2af] - meta: bump step-security/harden-runner from 2.19.0 to 2.19.4 (dependabot[bot]) #63727
[32d9a407d9] - meta: bump cachix/install-nix-action from 31.10.5 to 31.10.6 (dependabot[bot]) #63723
[b97c7bed07] - module: enable existing machinery for deferred import of static modules (Maya Lekova) #63712
[4becad2117] - module: use file: URL as sourceURL for type-stripped CommonJS (Joyee Cheung) #63705
[c71c85b95f] - net: early TCP binding via synchronous net.BoundSocket (Guy Bedford) #63951
[45494d5a8a] - (SEMVER-MINOR) net: support TCP_KEEPINTVL and TCP_KEEPCNT in setKeepAlive (Guy Bedford) #63825
[3988efa1f3] - net: coerce -0 to +0 in BlockList prefixes (Filip Skokan) #63556
[484efd1c44] - quic: fix get_reader bug that dropped data on FIN (Tim Perry) #63946
[04a17fe6f0] - quic: expose QUIC certificates as JS X509Certificate, not raw handles (Tim Perry) #63191
[b62d5696dc] - quic: fix reader backpressure deadlock on idle connections (Tim Perry) #63950
[3f1c8d7453] - quic: fix broken listEndpoints export, test callbacks & nghttp3 include (Tim Perry) #63874
[d8538b9deb] - quic: impl. cb for http/3 settings/app. options (Marten Richter) #63558
[643b19716e] - quic: add listEndpoints API (James M Snell) #63536
[2bce35bea4] - sqlite: do not leave database open after failed open (Yagiz Nizipli) #63854
[394af52abb] - sqlite: fix stack-use-after-scope with function callback (ndossche) #63640
[10f03e5958] - src: omit unconvertible names in cjs_lexer::Parse (Yagiz Nizipli) #63943
[1723773d41] - src: keep global list of addon-provided cleanup hooks (Anna Henningsen) #63985
[ef12e9ea44] - src: guard OpenSSL compression header include (Filip Skokan) #64009
[48af8a6d8d] - src: handle empty MaybeLocal in cjs_lexer::Parse (Yagiz Nizipli) #63885
[2a672ee9e8] - src: fast path empty native immediate drain (Gürgün Dayıoğlu) #62969
[db6a31d1a1] - src: do not track weak BaseObjects as childrens of Realms (Anna Henningsen) #63842
[5fb837ff46] - src: allow tracking children in MemoryTracker with weak edges (Anna Henningsen) #63842
[6d22d373a9] - src: use C++14 deprecated attribute for NODE_DEPRECATED (Anna Henningsen) #63755
[7ac3fe1992] - src: add cleanup hooks to node::ObjectWrap (Anna Henningsen) #63642
[d82d369155] - src: fix edge case when deflateInit2() fails with Z_VERSION_ERROR (Nora Dossche) #63476
[03858d152b] - src: remove redundant handle_ field in ffi (Anna Henningsen) #63665
[1682264f6b] - src: add Latin1 fast path in StringBytes::Encode utf8 (Mert Can Altin) #63385
[cc29696acf] - stream: fix Writable.toWeb() desiredSize for non-object-mode (Matteo Collina) #62986
[d9967a25b2] - stream: handle falsy push writer fail reasons (Trivikram Kamat) #63569
[b53f8f75c9] - stream: reduce allocations on WHATWG streams hot paths (Matteo Collina) #63876
[315ca426d8] - stream: handle setEncoding after buffered data (Matteo Collina) #63973
[06413cd6bd] - stream: fix Utf8Stream stall after full write of multi-byte data (Daijiro Wachi) #63964
[a9f9a3dafa] - stream: keep overlapping broadcast reads pending (Trivikram Kamat) #63500
[009cca11bd] - stream: refine the stream/iter backpressure (James M Snell) #63697
[3f81dcfc99] - stream: only pass the expected number of parameters to callbacks (Antoine du Hamel) #63909
[9a83b5d1fe] - stream: fix dropped first chunk in Utf8Stream buffer mode (Daijiro Wachi) #63833
[0bdf5adea9] - stream: remove transform-writer handling in pipeTo (Trivikram Kamat) #63684
[10272a94b6] - stream: check done before backpressure in stream reader (Daijiro Wachi) #63699
[792c410631] - stream: fix pipeToSync byte accounting (Trivikram Kamat) #63564
[3cfafbc54b] - stream: reject pull() reads on abort (Trivikram Kamat) #63498
[640a8cede5] - stream: fast-path stateless transform flush results (Trivikram Kamat) #63605
[ece4477872] - stream: optimize pipeTo promise handling (Matteo Collina) #63572
[2cb84c2daf] - stream: handle sync writev completion in pipeTo (Trivikram Kamat) #63561
[7d9fdda5fa] - stream: settle pending broadcast reads on return (Trivikram Kamat) #63603
[e2aea3aac7] - test: tolerate duplicate watch change events (Trivikram Kamat) #63937
[ea6300593a] - test: mark test-debugger-run-after-quit-restart as flaky on macOS (Matteo Collina) #64006
[be1b204fa4] - test: update WPT for url to d4598eba09 (Node.js GitHub Bot) #63899
[b3d0d05b05] - test: update WPT for WebCryptoAPI to 03a1476844 (Node.js GitHub Bot) #63900
[046af2609f] - test: update WPT for urlpattern to 23aac92784 (Node.js GitHub Bot) #63898
[562b831a98] - test: add tests for 3 methods in utils (Daijiro Wachi) #63765
[28e3629dd3] - test: mark SEA tests flaky on linux arm debug (Trivikram Kamat) #63743
[243aa846de] - test: validate ERR_INVALID_THIS for scheduler methods (Daijiro Wachi) #63764
[6bd07df2bc] - test: add coverage outside SEA (Daijiro Wachi) #63744
[bd67c9d11b] - test: update WPT for urlpattern to 2f28df545c (Node.js GitHub Bot) #63771
[e40bfe7081] - test: make Brotli 16GB test wait for backpressure (Trivikram Kamat) #63389
[444c03fd3b] - test: add regression test for using ObjectWrap in worker (Mohamed Akram) #63642
[771230df78] - test: accept SIGILL aborts in async-hooks tests (Trivikram Kamat) #63687
[0b3cd8e5e6] - test: add more test cases for pathToFileURL (Rafael Gonzaga) #63293
[0cbc77c60e] - test: update test426-fixtures to 2965987bf4c96afa400c9356c8e620cb340aaee (Node.js GitHub Bot) #63668
[f53dee5fe4] - test: update WPT for WebCryptoAPI to 0c413fb56b (Node.js GitHub Bot) #63647
[3048f8dc1a] - test,debugger: add test for type stripping in debugger probe mode (Joyee Cheung) #63748
[9485caa97e] - test_runner: remove unused shuffleArrayWithSeed (Daijiro Wachi) #63847
[34433a4a87] - test_runner: fix watch cwd with isolation none (Trivikram Kamat) #63690
[2e7da29b7c] - test_runner: avoid recompiling coverage globs for every file (sangwook) #63675
[205295a31e] - test_runner: cache shouldSkipFileCoverage result per URL (sangwook) #63675
[ee29465e77] - (SEMVER-MINOR) tls: add certificateCompression option (Tim Perry) #62217
[57d060ed2b] - tls: route event listener exceptions through error handlers (Antoine du Hamel) #63822
[d2dc6f8506] - tools: bump piscina from 5.1.4 to 5.2.0 in /tools/doc (dependabot[bot]) #64002
[b0c418f605] - tools: update sccache to v0.16.0 (Michaël Zasso) #63078
[2af8433bef] - tools: bump js-yaml from 4.1.1 to 4.2.0 in /tools/lint-md (dependabot[bot]) #63948
[8ba5b8574b] - tools: bump js-yaml from 4.1.1 to 4.2.0 in /tools/eslint (dependabot[bot]) #63947
[325087be5b] - tools: enforce iterator result property order (Trivikram Kamat) #63526
[314f417db7] - tools: update the llhttp updater script (Antoine du Hamel) #63819
[c6e4f5a4fe] - tools: avoid test/fixtures/wpt/README.md conflicts (Filip Skokan) #63938
[363912acc3] - tools: align Bash snippets in GHA with lint-sh conventions (Antoine du Hamel) #63829
[cfd16e973c] - tools: bump @node-core/doc-kit in /tools/doc in the doc group (dependabot[bot]) #63760
[1566872706] - tools: bump the eslint group in /tools/eslint with 7 updates (dependabot[bot]) #63730
[08437a3a5b] - tools: fix zlib updater script (Antoine du Hamel) #63707
[e883366172] - url: fix URLSearchParams(null) to prudce null= per spec (Marco) #63782
[60e83d9bfd] - util: fix scientific notation formatting (Daijiro Wachi) #63823
[5f7f60ac36] - util: fix -0 formatting when numericSeparator is enabled (Daijiro Wachi) #63815
[af1a11e0dd] - util: remove style caches from styleText slow path (Guilherme Araújo) #63706
[b17817eb2b] - (SEMVER-MINOR) vfs: dispatch fs/promises to mounted VFS instances (Matteo Collina) #63537
[7bc93a6ac5] - (SEMVER-MINOR) vfs: add minimal node:vfs subsystem (Matteo Collina) #63115
[584e7527c4] - vm: fix property queries for proxy sandboxes (Brian Meek) #63742
[a926e72eaf] - watch: print name of changed file that triggers restart (Marco) #63781
[32a2621ca4] - watch: cancel pending restart on shutdown (Trivikram Kamat) #63383
[692215d1b1] - zlib: coerce -0 to +0 for crc32 seeds (Filip Skokan) #63556

2026-06-18, Version 26.3.1 (Current), @aduh95

This is a security release.

Notable Changes

(CVE-2026-48618) tls: normalize hostname for server identity checks (Matteo Collina) – High
(CVE-2026-48933) crypto: guard WebCrypto cipher output length (Filip Skokan) – High
(CVE-2026-48615) lib,test: redact proxy credentials in tunnel errors (Matteo Collina) – Medium
(CVE-2026-48619) http2: cap originSet size to prevent unbounded memory growth (Matteo Collina) – Medium
(CVE-2026-48928) tls: fix case-sensitive SNI context matching (Matteo Collina) – Medium
(CVE-2026-48930) dns,net: reject hostnames with embedded NUL bytes (Matteo Collina) – Medium
(CVE-2026-48934) tls: bind reusable sessions to authenticated host (Matteo Collina) – Medium
(CVE-2026-48617) permission: handle process.chdir on writereport (RafaelGSS) – Low
(CVE-2026-48931) http: fix response queue poisoning in http.Agent (Matteo Collina) – Low
(CVE-2026-48935) permission: disable FileHandle utimes with permission model (RafaelGSS) – Low
(CVE-2026-48936) permission: guard pipe open and chmod with net scope (RafaelGSS) – Low

Commits

[98fbc89211] - (CVE-2026-48933) crypto: guard WebCrypto cipher output length (Filip Skokan) nodejs-private/node-private#878
[110840f2c7] - deps: update llhttp to 9.4.2 (Antoine du Hamel) nodejs-private/node-private#890
[8d36d522b2] - deps: update undici to 8.5.0 (Node.js GitHub Bot) #63903
[2e6d03993a] - deps: update undici to 8.4.0 (Node.js GitHub Bot) #63779
[5a17d5b07a] - deps: update archs files for openssl-3.5.7 (Node.js GitHub Bot) #63820
[362725d4e5] - deps: upgrade openssl sources to openssl-3.5.7 (Node.js GitHub Bot) #63820
[bd1214ab01] - (CVE-2026-48930) dns,net: reject hostnames with embedded NUL bytes (Matteo Collina) nodejs-private/node-private#868
[bc0b53813e] - (CVE-2026-48931) http: fix response queue poisoning in http.Agent (Matteo Collina) nodejs-private/node-private#846
[87d847bc70] - (CVE-2026-48619) http2: cap originSet size to prevent unbounded memory growth (Matteo Collina) nodejs-private/node-private#855
[9308084fcb] - (CVE-2026-48615) lib,test: redact proxy credentials in tunnel errors (Matteo Collina) nodejs-private/node-private#867
[a67dd46891] - (CVE-2026-48936) permission: guard pipe open and chmod with net scope (RafaelGSS) nodejs-private/node-private#885
[7057c3f16c] - (CVE-2026-48935) permission: disable FileHandle utimes with permission model (RafaelGSS) nodejs-private/node-private#873
[6bc17a6b51] - (CVE-2026-48617) permission: handle process.chdir on writereport (RafaelGSS) nodejs-private/node-private#870
[c8668beff8] - test: add session reuse host verification regressions (Matteo Collina) nodejs-private/node-private#854
[d1be630415] - (CVE-2026-48934) tls: bind reusable sessions to authenticated host (Matteo Collina) nodejs-private/node-private#854
[a14c158bb3] - (CVE-2026-48928) tls: fix case-sensitive SNI context matching (Matteo Collina) nodejs-private/node-private#857
[ebda73470d] - (CVE-2026-48618) tls: normalize hostname for server identity checks (Matteo Collina) nodejs-private/node-private#869

2026-06-01, Version 26.3.0 (Current), @aduh95

Notable Changes

Potential changes to macOS Universal Binary availability

With Apple and its ecosystem progressively dropping support for Intel-based architectures, it has become apparent that the Node.js project may not be able to maintain the universal binaries we currently distribute for the full lifetime of Node.js 26. This change serves to communicate that risk. At present, our intention remains to continue shipping universal binaries supporting both Apple Silicon and Intel-based Macs for as long as practical.

Contributed by Antoine du Hamel in #63055.

Other notable changes

[a2a4b33dd8] - (SEMVER-MINOR) buffer: increase Buffer.poolSize default to 64 KiB (Matteo Collina) #63597
[051a2152f7] - crypto: update root certificates to NSS 3.123.1 (Node.js GitHub Bot) #63527
[49462eca37] - (SEMVER-MINOR) http: add httpValidation option to configure header value validation (RajeshKumar11) #61597
[97b7ab19bd] - (SEMVER-MINOR) inspector: expose precise coverage start to JS runtime (sangwook) #63079
[cfb80a2103] - (SEMVER-MINOR) lib,permission: add permission.drop (Rafael Gonzaga) #62672

Commits

[a2a4b33dd8] - (SEMVER-MINOR) buffer: increase Buffer.poolSize default to 64 KiB (Matteo Collina) #63597
[0eff3e23b9] - build: def NODE_USE_NODE_CODE_CACHE only used in node_mksnapshot (Chengzhong Wu) #63588
[447ab2d252] - build,win: fix VS2022 arm64 PGO build (Stefan Stojanovic) #63413
[86032758e4] - build,win: replace LTCG with Thin LTO for releases (Stefan Stojanovic) #63114
[5f4d794052] - build,win: add Rust toolchain automated configuration Windows (Mike McCready) #63381
[051a2152f7] - crypto: update root certificates to NSS 3.123.1 (Node.js GitHub Bot) #63527
[d0f65e3579] - crypto: coerce -0 keylen to +0 in pbkdf2 and scrypt (Jordan Harband) #63531
[e3ddb326c9] - crypto: harden WebCrypto against prototype pollution (Filip Skokan) #63363
[e04cd17dc0] - crypto: pass CryptoKey handles to KDF jobs (Filip Skokan) #63363
[64ba74d847] - crypto: remove async from WebCrypto methods (Filip Skokan) #63363
[bd230418b4] - crypto: add WebCrypto CryptoJob mode (Filip Skokan) #63363
[1a4090a83d] - debugger: surface inspector failures in probe mode (Joyee Cheung) #63437
[dbc78ff825] - debugger,test: deflake resume failure test and add debug logs (Joyee Cheung) #63524
[4da442f432] - deps: upgrade npm to 11.16.0 (npm team) #63602
[63372cfa87] - deps: SQLite: cherry-pick b869ed6b067d623cb1383549f2a18aa35508385d (Junsu Han) #63525
[e286fa170d] - deps: upgrade npm to 11.15.0 (npm team) #63463
[de996437a5] - doc: downgrade macOS x64 to Tier 2 (Antoine du Hamel) #63055
[22ac78750c] - doc: remove duplicated sentences in large-pull-requests.md (Joyee Cheung) #63650
[532f7f2085] - doc: update git node land instructions for security releases (Antoine du Hamel) #63586
[c61f90dfb9] - doc: drop --experimental from --permission (Rafael Gonzaga) #63583
[fd69d7b16a] - doc: improve fs.StatFs properties descriptions (aymanxdev) #62578
[693257782c] - doc: generate llms.txt (Guilherme Araújo) #62027
[55a57beb26] - doc: explicitly ask for reproducible in JS (Rafael Gonzaga) #63479
[4895c2babc] - doc: fix URL postMessage example in worker_threads (Kit Dallege) #62203
[0355c36e37] - doc: clarify filter option of sqlite.database.applyChangeset (Antoine du Hamel) #63515
[c85ee22df6] - doc: fix double spaces in ERR_TLS_INVALID_PROTOCOL_METHOD (Daijiro Wachi) #63511
[62947192f6] - doc: move hyperlinks outside of text blocks (Aviv Keller) #63493
[9849690a1d] - doc: edit Rust toolchain general install instructions (Antoine du Hamel) #63488
[885d2462e9] - doc: fix double space in modules.md (Daijiro Wachi) #63512
[42fbb48bc6] - doc: fix "options" to "option" in tls.createServer (Daijiro Wachi) #63453
[05a7b0a301] - doc: add Rust toolchain general install instructions (Mike McCready) #63426
[e13dfd7ed0] - doc: update toolchain for official releases (Richard Lau) #63441
[82306881cc] - doc: fix typo in deprecations (Daijiro Wachi) #63434
[eeb77d217c] - doc,lib: align WebCrypto names with spec (Filip Skokan) #63518
[679e13c57f] - errors: handle V8 warnings in DisallowJavascriptExecutionScope (Divyanshu Sharma) #63491
[7f41f5d803] - ffi: validate 'void' as parameter type in getFunction and getFunctions (Anshika Jain) #63504
[972cd227cb] - ffi: remove function signature property aliases (René) #63482
[5d7805e433] - ffi: move DynamicLibrary disposer to native layer (René) #63459
[5a0b32dc24] - gyp: update deps gypfiles (Nad Alaba) #63117
[49462eca37] - (SEMVER-MINOR) http: add httpValidation option to configure header value validation (RajeshKumar11) #61597
[e3c6629ee3] - http2: emit session close before stream close (Matteo Collina) #63414
[97b7ab19bd] - (SEMVER-MINOR) inspector: expose precise coverage start to JS runtime (sangwook) #63079
[6bef10e7b7] - lib: cleanup stateless diffiehellman key handling (Filip Skokan) #62645
[fdc0b3d49c] - lib: define kEnumerableProperty atomically (Antoine du Hamel) #63609
[99baf27aeb] - lib: fix typos in esm loader comments (RonGamzu) #63465
[cfb80a2103] - (SEMVER-MINOR) lib,permission: add permission.drop (Rafael Gonzaga) #62672
[8e75efb9bc] - meta: flip mcollina emails in .mailmap (Matteo Collina) #63621
[a4ae97045f] - meta: label "source maps" PRs (Chengzhong Wu) #63591
[3455a48ae1] - meta: add vfs subsystem label (René) #62331
[01bfcdfc20] - meta: skip scheduled workflows on forks (Jamie Magee) #63565
[bc4c457eae] - meta: add additional gitignore entries (James M Snell) #63267
[e1d65d9509] - module: load ESM helpers eagerly in the snapshot (Joyee Cheung) #63550
[6a97b0932a] - quic: add proper error codes & messages for QUIC failures (Tim Perry) #63198
[5989f4a6e1] - quic: support hostname verification (James M Snell) #63483
[b4d30e7a78] - quic: add stream idle timeout (James M Snell) #63483
[8a1017f774] - quic: add block list support for endpoints (James M Snell) #63483
[5a3ab93c49] - quic: improve peer cert verification (James M Snell) #63483
[9701a82a78] - quic: handle h3 max header size option (James M Snell) #63483
[71788a2048] - quic: add rate limiting docs (James M Snell) #63483
[309bd49906] - quic: cache timestamp for address lru cache (James M Snell) #63483
[2ce5588d51] - quic: add session creation rate limiting (James M Snell) #63483
[98808baed1] - quic: refine rate limiting (James M Snell) #63483
[75a4176b32] - quic: flip preferred address policy default to 'ignore' (James M Snell) #63483
[8b6b03d60c] - quic: add doc note about certificate size limitations (James M Snell) #63483
[30eff873e0] - quic: add applicationOptions to session (James M Snell) #63267
[4303daa43c] - quic: add getters for local and remote transport parameters (James M Snell) #63267
[e1b1bb5465] - quic: improve recv coalescing test sizes (James M Snell) #63267
[25a416f457] - quic: add initial RTT option to session options (James M Snell) #63267
[22e91c357f] - quic: enable recvmmsg batching in Endpoint (James M Snell) #63267
[c96d8a9d9b] - quic: improve stream header collection performance (James M Snell) #63267
[409460f2ce] - quic: add reusePort option to QuicEndpoint (James M Snell) #63267
[9a2afffec9] - quic: coalesce received data into fewer buffers (James M Snell) #63267
[f9a6a2f558] - quic: apply multiple additional minor improvements (James M Snell) #63267
[ea5f3724ee] - quic: fix tests that are missing serverEndpoint close (James M Snell) #63267
[6cffc931fc] - quic: fixup some v8:: qualifiers (James M Snell) #63267
[9bc875e522] - quic: fix premature unref of endpoint when listening (James M Snell) #63267
[f940d6b1be] - quic: fixup UAFs in bindingdata, streams, and app (James M Snell) #63267
[fd00e0acb0] - quic: fix UAF in Application::OnTimeout() (James M Snell) #63267
[378dbf00e9] - quic: improve the quic js structure (James M Snell) #63267
[0045dc30b6] - quic: improve internal structure of QuicStream (James M Snell) #63267
[5e38946b26] - quic: add aliased struct arenas (James M Snell) #63267
[95430437a0] - quic: add handshake timeout and default connection limits (James M Snell) #63267
[5622701429] - quic: implement rate limiting for version nego and immediate close (James M Snell) #63267
[b171f391cd] - quic: fixup linting issue after other changes (James M Snell) #63267
[24e9f4f177] - quic: fix crash in early handshake failure (James M Snell) #63267
[5025e85d0a] - quic: eliminate per-received datagram allocation (James M Snell) #63267
[aec1e17ec5] - quic: cache the timestamp on send and receive (James M Snell) #63267
[9560084560] - quic: add support for future ECN marking (James M Snell) #63267
[2b3ff8ada2] - quic: improve batching of packet sending (James M Snell) #63267
[fe3639a4d6] - quic: improve backend quic packet processing (James M Snell) #63267
[f043013d9a] - src: remove TOCTOU race condition when encoding SAB-backed Buffers (Antoine du Hamel) #63517
[343958224d] - src: skip duplicate UTF-8 validation in TextDecoder fatal path (Mert Can Altin) #63231
[2906fa833d] - src: dispatch ToV8Value(string_view) via StringBytes::Encode (Mert Can Altin) #63370
[860f9d8d4b] - src: fix ContextifyContext property definer interception result (Chengzhong Wu) #63549
[fcccffcbe6] - src: fix crash when reading length on Storage.prototype (Mohamed Sayed) #63529
[55f65f9fb6] - src: improve token return value check (James M Snell) #63483
[7a36ca46cd] - src: expose node::RegisterContext to make a node managed context (Chengzhong Wu) #62322
[9bda92963c] - src,sqlite: only pass xFilter when user provided a callback (Antoine du Hamel) #63516
[563db50f38] - stream: switch to internal sleep binding (Antoine du Hamel) #63611
[a6e2322ee6] - stream: use data listener for compose forwarding (Trivikram Kamat) #63593
[7198895c6b] - stream: serialize concurrent share consumer reads (Trivikram Kamat) #63478
[70ba8be1d7] - stream: fix lint error (Antoine du Hamel) #63598
[1608d905a7] - stream: reject pending reads on iterator throw (Trivikram Kamat) #63555
[dc12b730d8] - stream: wait for push writer end fallback to drain (Trivikram Kamat) #63503
[4f40a85a1a] - stream: flush each fused stateless transform (Trivikram Kamat) #63468
[526e0fc427] - stream: avoid duplicate writes in toWritable (Trivikram Kamat) #63360
[0008d01f9c] - stream: propagate abort reason in share and broadcast (Trivikram Kamat) #63358
[217338e18b] - stream: fix Writable.toWeb() hang on synchronous drain (sangwook) #61197
[381f4b1b10] - stream: disallow writing string chunk with 'buffer' encoding (René) #63062
[cbee0de1cb] - stream: align Readable.toWeb termination with eos (ikeyan) #62394
[be91f0a927] - test: shorten path in net pipe connect errors (Matteo Collina) #63405
[83cada8bcc] - test: deflake test-debugger-probe-timeout (Joyee Cheung) #63547
[3560b96a10] - test: deflake test-webcrypto-crypto-job-mode (Filip Skokan) #63543
[0c9c52373a] - test: remove test-node-output-v8-warning (Joyee Cheung) #63469
[12052dbe14] - test: cover webcrypto prototype pollution systematically (Filip Skokan) #63520
[8c479f274a] - test: update test426-fixtures to 9b9e225b5a63139e9a95cdd1bf874a8f0b9d131 (Node.js GitHub Bot) #63373
[2ca32a5ee8] - test: update WPT for url to e4a4672e9e (Node.js GitHub Bot) #63372
[1bf875bd21] - test: deflake async-hooks statwatcher test (Trivikram Kamat) #63396
[97dbfa09f7] - test: avoid test_runner watch restart in spec snapshot (Trivikram Kamat) #63392
[8b038d7b33] - test: reduce watch mode restart flakiness (Trivikram Kamat) #63390
[f504c01d66] - test: get rid of unnecessary AbortController instanciations (Antoine du Hamel) #63489
[170585ff90] - test: isolate rerun-failures state file under tmpdir (Chemi Atlow) #63449
[935468a49e] - test: fixup quic tests (James M Snell) #63267
[fbbdfdcfc7] - test: wait for ok before initial break after restart (Yuya Inoue) #62807
[db808ad77d] - test: unskip snapshot reproducibility test (Joyee Cheung) #63307
[259d8b3dce] - test: update WPT for WebCryptoAPI to 97bbc7247a (Node.js GitHub Bot) #63417
[d56c6cd708] - test_runner: ignore erased TS lines in coverage (Matteo Collina) #63510
[16015f1565] - test_runner: fix suite diagnostic chanel end (Moshe Atlow) #63533
[003b9ccbe9] - test_runner: dont buffer unordered events in process isolation mode (Moshe Atlow) #63432
[fdc4b5aed4] - test_runner: fix --test-rerun-failures swallowing failures on retry (Chemi Atlow) #63431
[6a0bd2f329] - test_runner: add parentId to test events with testId (Moshe Atlow) #63435
[a646c93254] - test_runner: show replayed-from-attempt hint in spec reporter (Moshe Atlow) #63429
[b1fa59cbb6] - test_runner: preserve run duration when using test-rerun (Moshe Atlow) #63429
[6ac7ff24ac] - tools: refine v8.nix source definition (Antoine du Hamel) #63625
[59c01b959f] - tools: add lint rule for aborted AbortController (Trivikram Kamat) #63541
[2ab034f6f9] - tools: bump @node-core/doc-kit in /tools/doc in the doc group (dependabot[bot]) #63494
[a6af903e0a] - tools: bump brace-expansion from 5.0.5 to 5.0.6 in /tools/eslint (dependabot[bot]) #63415
[215cd543dd] - tools: skip commit-lint on backport pull requests (Marco) #63378
[0479f28e95] - tools: fix skip of test-internet on forks (Antoine du Hamel) #63492
[69dfadf785] - tools: mock some Python utils in v8.nix to reuse builds (Antoine du Hamel) #63454
[7b3e222cda] - util: remove unused functions (Antoine du Hamel) #63612
[5a1f67c27b] - util: create hex style cache and fast path (Guilherme Araújo) #62999

2026-05-20, Version 26.2.0 (Current), @aduh95

Notable Changes

[189d43a193] - doc: mark stream.compose stable (Matteo Collina) #62562
[f858c6140e] - (SEMVER-MINOR) fs: add Temporal.Instant support to Stats and BigIntStats (Livia Medeiros) #60789
[0cbb3895df] - (SEMVER-MINOR) http: add writeInformation to send arbitrary 1xx status codes (Tim Perry) #63155

Commits

[9a394bab84] - benchmark: respect stream/iter broadcast backpressure (Trivikram Kamat) #63314
[ad98b4620b] - crypto: align verifyOneShot accepted types (Anshika Jain) #63280
[ba0736a847] - crypto: wire ML-DSA and ML-KEM for use when using BoringSSL (Filip Skokan) #63255
[5573a6a4a8] - crypto: wire ChaCha20-Poly1305 in Web Cryptography when using BoringSSL (Filip Skokan) #63255
[7dc563b8d6] - crypto: wire AES-KW in Web Cryptography when using BoringSSL (Filip Skokan) #63255
[b55e2b1f4d] - crypto: improve system certificate enumeration logic on macOS (Robo) #62576
[fd509a755a] - crypto: harden CryptoKey algorithm slots (Filip Skokan) #63111
[8657df39e7] - crypto: harden KeyObject internal slots (Filip Skokan) #63111
[729274e046] - crypto: reject invalid raw key imports (Filip Skokan) #63134
[8fc9cb9c01] - crypto: improve accuracy of SubtleCrypto.supports (Filip Skokan) #63104
[288065cb3f] - crypto: optimize normalizeAlgorithm dispatch hot path (Filip Skokan) #62756
[ecf3797d09] - debugger: disambiguate probe location binding (Joyee Cheung) #63286
[bdc57135fd] - debugger: add --help to node inspect and improve docs (Joyee Cheung) #63201
[2a6e6058e9] - deps: update undici to 8.3.0 (Node.js GitHub Bot) #63377
[327b927271] - deps: update corepack to 0.35.0 (Node.js GitHub Bot) #63375
[5828fadf52] - deps: update sqlite to 3.53.1 (Node.js GitHub Bot) #63217
[fe127a999b] - deps: update simdjson to 4.6.4 (Node.js GitHub Bot) #62811
[a34c4ea159] - deps: V8: cherry-pick 435a2cdf664c (Matthias Liedtke) #63136
[ad91efcc43] - deps: cherry-pick libuv/libuv@a43e543 (Ali Hassan) #63222
[5ea6c3ee7e] - deps: add missing static linking targets for libffi (Paolo Insogna) #63168
[c1f6ba22b4] - deps: update ngtcp2 to 1.22.1 (Node.js GitHub Bot) #62812
[7b8767ef76] - doc: remove unsupported template type from v8.md (René) #63410
[b2ec1880b1] - doc: fix promise nomenclature in stream_iter.md (Antoine du Hamel) #63406
[cf6cbbd39d] - doc: fix article usage before vowel-sound acronyms (joao-oliveira-softtor) #62696
[da05065d98] - doc: remove the bi-monthly contributor spotlight section (Claudio Wunder) #62734
[c31f320fba] - doc: update http2's push and trailers events with rawHeaders param (YuSheng Chen) #63259
[f0d008439b] - doc: add Rust toolchain manual installation instructions Windows (Mike McCready) #63367
[68b1220fbd] - doc: remove inactive members from Triagers list (Antoine du Hamel) #63329
[189d43a193] - doc: mark stream.compose stable (Matteo Collina) #62562
[c4fb894039] - doc: fix CHANGELOG (Richard Lau) #63292
[9f319a77e4] - doc: reference correct function in Module docs (Robin Malfait) #63247
[2c13acc88e] - doc: replace Visual Studio 2022 Evergreen version reference with 17.14 (Mike McCready) #63211
[7e42c336c9] - doc: recommend explicitly Tier 1 or 2 for production applications (Mike McCready) #63187
[d99e0bb6d5] - doc: document Temporal configure flags in BUILDING.md (ChrisJr404) #63248
[c0ea77b305] - doc: run license-builder (github-actions[bot]) #63232
[8265aba0f4] - doc: add large pull requests contributing guide (Matteo Collina) #62829
[be241bacc8] - doc: remove unnecessary <!-- eslint- magic comments (Antoine du Hamel) #63200
[e0b1f092c3] - doc: fix inconsistencies in CJS code snippets (Antoine du Hamel) #63199
[a3feb15871] - doc: clarify SEA platform support excludes darwin-x64 (MJSHANG) #63181
[cafd7667fc] - doc: improve quic documentation (James M Snell) #63157
[3c784edb6f] - doc: update release steps when post-release fails (Rafael Gonzaga) #63131
[9de954e9be] - doc: fix deprecation list in 26.0.0 changelog (Antoine du Hamel) #63147
[20c553e456] - doc: add Hmac.digest() documentation-only deprecation (DEP0206) (Anshika Jain) #63121
[3494eae2c8] - doc: document the latest-vX.x schema (Marco Ippolito) #63033
[c02413d29d] - doc: remove list of versions in BUILDING.md (Antoine du Hamel) #63113
[53f9a902a1] - doc,sqlite: document entryPoint argument for loadExtension (Edy Silva) #63152
[f858c6140e] - (SEMVER-MINOR) fs: add Temporal.Instant support to Stats and BigIntStats (Livia Medeiros) #60789
[b2ba62ca0e] - fs: make Date properties on Stats enumerable (LiviaMedeiros) #63328
[0cbb3895df] - (SEMVER-MINOR) http: add writeInformation to send arbitrary 1xx status codes (Tim Perry) #63155
[f712e6856e] - http2: validate non-link headers in writeEarlyHints (Matteo Collina) #62017
[3acadae676] - lib: fix typo idenity => identity (Daijiro Wachi) #63112
[460329e886] - lib: fixes validator message (Daijiro Wachi) #62823
[9438c832b2] - lib: narrow ReadableStreamBYOBRequest.view return type to Uint8Array (RoomWithOutRoof) #63017
[c7d27c82c4] - lib: handle --permission-audit when propagating flags (Rafael Gonzaga) #63047
[9f19915276] - lib: optimize webidl conversion options (Filip Skokan) #62756
[771afd626a] - meta: move one or more collaborators to emeritus (Node.js GitHub Bot) #63402
[67d094a554] - meta: move one or more collaborators to emeritus (Node.js GitHub Bot) #63235
[9091398f3d] - meta: ignore AI assistants files (Matteo Collina) #62612
[96f19a16d0] - module: fix sync hook short-circuit in require() in imported CJS (Joyee Cheung) #62920
[45f3e3ef11] - node-api: support SharedArrayBuffer in napi_create_typedarray (Yilong Li) #62710
[d7afa617bb] - quic: send correct OpenSSL alert for ALPN mismatches (Tim Perry) #63193
[526313beb8] - quic: fixup quic stream variable chunk len (James M Snell) #63230
[1613c7fe70] - quic: support --allow-net permissions (James M Snell) #63184
[72ab7444a8] - quic: remove unused env_ variable in session_manager.h/cc (James M Snell) #63177
[2b55656778] - quic: remove unused binding variable in session.cc (James M Snell) #63177
[83f0d37400] - quic: ignore coverage for quic files (James M Snell) #63149
[7e6b77b14d] - quic: complete the internal implementation of QUIC (James M Snell) #62876
[71372418f1] - repl: fix dedup comparing normalized line against raw history (Daijiro Wachi) #62886
[20f40c2c25] - sqlite: keep source database alive during backup (Matteo Collina) #62673
[592f741bd0] - src: simplify OpenSSL feature gates (Filip Skokan) #63255
[520ab7ad40] - src: add BoringSSL EVP enumeration fallback (Filip Skokan) #63206
[12be49acbc] - src: support multiple versions in node.config.json (Marco Ippolito) #63033
[296f907585] - src: remove unused using declarations in node_task_queue (Mert Can Altin) #63144
[7703f11b3c] - src: skip JS callback for settled Promise.race losers (Felipe Coelho) #62336
[74ab710c3a] - src,sqlite: remove dead code (Edy Silva) #63204
[e49154f4c8] - stream: add sync iterable fast path to pipeTo (Trivikram Kamat) #63318
[537455e98d] - stream: fix merge handling for object-like sources (Trivikram Kamat) #63356
[e21b8a47f0] - stream: limit iter from sync iterable batches (Trivikram Kamat) #63324
[3bdb64dc67] - stream: cache minimum cursor count in broadcast (Trivikram Kamat) #63322
[81819add6b] - stream: remove unnecessary check (Antoine du Hamel) #63030
[22e3579d74] - stream: avoid retrying accepted pipeTo writes (Trivikram Kamat) #63297
[691915ea94] - stream: validate broadcast writer writev chunks (Trivikram Kamat) #63300
[253f5f4ca2] - stream: uncork fromWritable writev on chunk error (Trivikram Kamat) #63295
[aa6913cc4a] - stream: validate fromWritable() options before cache (Trivikram Kamat) #63278
[6c53ddb988] - stream: optimize single-slot push queue drain (Trivikram Kamat) #63274
[b568649f6f] - stream: preserve toReadableSync batch after backpressure (Trivikram Kamat) #63276
[cdcefd7e2f] - stream: cache minimum cursor count in share (Trivikram Kamat) #63262
[ba7000e4f7] - stream: minor stream/iter implementation edits (René) #63132
[c694999ab8] - test: disable Maglev in near-heap-limit worker test (Trivikram Kamat) #63398
[a6d6d51c1b] - test: deflake connection refused proxy tests (Trivikram Kamat) #63395
[31d89c4f59] - test: avoid repeated writes in watch helper (Trivikram Kamat) #63386
[6f3587c773] - test: deflake watch mode worker test (Trivikram Kamat) #63384
[a57aebaa73] - test: update tls/crypto behaviour expectations when using BoringSSL (Filip Skokan) #63161
[b871cff2db] - test: relax test-memory-usage arrayBuffers check (inoway46) #63244
[25189bcb95] - test: reduce flakiness of different-registry-per-thread (Antoine du Hamel) #63244
[5bdb1f8426] - test: fix flaky test-watch-mode-inspect timeout (Matteo Collina) #63361
[d57bd2bf59] - test: relax min assertion in test-performance-eventloopdelay (Marco) #63100
[014e1f00c1] - test: avoid flaky restart sync in debugger exceptions test (Yuya Inoue) #62055
[dd28ff8a80] - test: avoid initial-break wait in restart-message (inoway46) #62060
[e89a49a13a] - test: move FFI tests to NATIVE_SUITES (Antoine du Hamel) #63165
[51ef0258ba] - test: update WPT for wasm/jsapi to 288c467d35 (Node.js GitHub Bot) #63136
[c0175a9ba1] - test: use ERM to destroy sqlite database handles after tests (René) #63076
[83054e8aba] - test_runner: avoid hanging on incomplete v8 frames (Ali Hassan) #62704
[4f1426d361] - test_runner: fix hooks test context (Moshe Atlow) #63285
[6a4c4b7193] - test_runner: fix diagnostics channel context tracking (Moshe Atlow) #63283
[eba9c3481b] - test_runner: add tags option and tag-name filter (Chemi Atlow) #63221
[2ba124f23b] - tls: add unsupported renegotiation error (Filip Skokan) #63161
[7c5048495a] - tools: bump the eslint group in /tools/eslint with 4 updates (dependabot[bot]) #63075
[6c574110a7] - tools: update gyp-next to 0.22.2 (Node.js GitHub Bot) #63374
[f14ed762b3] - tools: add boringssl to tools/nix/openssl-matrix.nix (Filip Skokan) #63206
[14d3924c48] - tools: fix test426 updater (Antoine du Hamel) #63271
[0d017ece8d] - tools: filter V8 scripts for build toolchain (Richard Lau) #63069
[3859a8700e] - tools: use different branch for tool updates on staging branches (Antoine du Hamel) #63110
[4a32ed82bd] - tools: prevent lib code from reading KeyObject and CryptoKey accessors (Filip Skokan) #63111

2026-05-07, Version 26.1.0 (Current), @aduh95

Notable Changes

Experimental `node:ffi` module

Node.js now includes an experimental node:ffi module for loading dynamic libraries and calling native symbols from JavaScript.

The API is gated behind the --experimental-ffi flag and, when the Permission Model is enabled, requires --allow-ffi.

This API is inherently unsafe. Invalid pointers, incorrect signatures, or accessing memory after it has been freed can crash the process or corrupt memory.

Contributed by Paolo Insogna in #62072.

Other Notable Changes

[34a6454fe3] - (SEMVER-MINOR) buffer: add end parameter (Robert Nagy) #62390
[073e84d7fe] - (SEMVER-MINOR) crypto: accept key data in crypto.diffieHellman() and cleanup DH jobs (Filip Skokan) #62527
[5b9cb10a5f] - (SEMVER-MINOR) crypto: implement randomUUIDv7() (nabeel378) #62553
[98f9becd16] - (SEMVER-MINOR) debugger: add edit-free runtime expression probes to node inspect (Joyee Cheung) #62713
[06defaa2ea] - (SEMVER-MINOR) fs: add signal option to fs.stat() (Mert Can Altin) #57775
[db66a963bf] - (SEMVER-MINOR) fs: expose frsize field in statfs (Jinho Jang) #62277
[87adb3472b] - (SEMVER-MINOR) http: harden ClientRequest options merge (Matteo Collina) #63082
[9047ec12ce] - (SEMVER-MINOR) http: add req.signal to IncomingMessage (Akshat) #62541
[ab66de8eaa] - (SEMVER-MINOR) process: throw on execve(2) failure instead of aborting (Bryan English) #62878
[8273682c87] - (SEMVER-MINOR) src: allow empty --experimental-config-file (Marco Ippolito) #61610
[fbff28f7e6] - (SEMVER-MINOR) stream: propagate destruction in duplexPair (Ahmed Elhor) #61098
[a8c773a0c7] - (SEMVER-MINOR) test_runner: align mock timeout api (sangwook) #62820
[b883a5eaea] - (SEMVER-MINOR) test_runner: add mock-timers support for AbortSignal.timeout (DeveloperViraj) #60751
[a21ae1771e] - (SEMVER-MINOR) test_runner: support test order randomization (Pietro Marchini) #61747
[b85c73ff10] - (SEMVER-MINOR) util: colorize text with hex colors (Guilherme Araújo) #61556

Commits

[1b959d02c2] - assert,util: fix stale nested cycle memo entries (Ruben Bridgewater) #62509
[bbeb38d210] - buffer: fix end parameter bugs in indexOf/lastIndexOf (Robert Nagy) #62711
[34a6454fe3] - (SEMVER-MINOR) buffer: add end parameter (Robert Nagy) #62390
[8b91526cd5] - build: track PDL files as inputs in inspector GN build (Robo) #62888
[da40ed7842] - build: remove armv6 from experimental platforms (René) #63063
[b36e55a23e] - build: make test-addons dependency-free (Joyee Cheung) #62388
[c27f3cf8f2] - build: add --enable-all-experimentals build flag (Paolo Insogna) #62755
[0d73b63a76] - build: fix cargo check when Temporal is disabled (Antoine du Hamel) #62730
[d8f97e6f7b] - build: fix ffi dependency compilation (Paolo Insogna) #62731
[d1eb7b340f] - build: fix stray debug string in LIEF defines (Om Ghante) #62683
[845283009d] - build: remove redundant -fuse-linker-plugin from GCC LTO flags (Daniel Lando) #62667
[a6e99879f4] - build,win: enable x64 PGO (Stefan Stojanovic) #62761
[38befee0fb] - crypto: add JWK support for ML-KEM and SLH-DSA key types (Filip Skokan) #62706
[b10653ad87] - crypto: add guards and adjust tests for BoringSSL (Filip Skokan) #62883
[2a7a69c6b0] - crypto: reject unintended raw key format string input (Filip Skokan) #62974
[bad1e2fe6a] - crypto: fix unsigned conversion of 4-byte RSA publicExponent (DeepView Autofix) #62839
[c9d5bae598] - crypto: remove Argon2 KDF derivation from its job setup (Filip Skokan) #62863
[6eea52426f] - crypto: reject duplicate ML-KEM JWK key_ops (Filip Skokan) #62905
[80d4836616] - crypto: deduplicate and canonicalize CryptoKey usages (Filip Skokan) #62902
[8950247027] - crypto: reject inherited key type names (Jonathan Lopes) #62875
[3f42f9615a] - crypto: strengthen argument CHECKs in TurboSHAKE (Tobias Nießen) #62763
[28346d999b] - crypto: guard against size_t overflow on experimental 32-bit arch (Filip Skokan) #62626
[d4cec263c4] - (SEMVER-MINOR) crypto: align key argument names in docs and error messages (Filip Skokan) #62527
[073e84d7fe] - (SEMVER-MINOR) crypto: accept key data in crypto.diffieHellman() and cleanup DH jobs (Filip Skokan) #62527
[518b578fe7] - crypto: add memory tracking for secureContext openssl objects (Mert Can Altin) #59051
[5b9cb10a5f] - (SEMVER-MINOR) crypto: implement randomUUIDv7() (nabeel378) #62553
[7133826053] - debugger: move ProbeInspectorSession and helpers to separate files (Joyee Cheung) #63013
[98f9becd16] - (SEMVER-MINOR) debugger: add edit-free runtime expression probes to node inspect (Joyee Cheung) #62713
[94ac62a2d1] - deps: update undici to 8.2.0 (Node.js GitHub Bot) #63092
[ef71de87e6] - deps: update amaro to 1.1.9 (Node.js GitHub Bot) #63090
[c4f0ef881a] - deps: update llhttp to 9.4.1 (Node.js GitHub Bot) #63045
[d29fbc0029] - deps: fix integration issues with the latest nghttp2 (Tim Perry) #62891
[537825acee] - deps: update nghttp2 to 1.69.0 (Node.js GitHub Bot) #62891
[4446bf694d] - deps: update corepack to 0.34.7 (Node.js GitHub Bot) #62810
[8f55327f1c] - deps: fix libffi macos build (Paolo Insogna) #63006
[3dee18f72f] - deps: patch V8 to 14.6.202.34 (Node.js GitHub Bot) #62964
[e281b247e6] - deps: update timezone to 2026b (Node.js GitHub Bot) #62962
[4dd982df13] - deps: upgrade npm to 11.13.0 (npm team) #62898
[61c0ff4a13] - deps: cherry-pick libuv/libuv@439a54b (skooch) #62881
[d26ca462ae] - deps: update undici to 8.1.0 (Node.js GitHub Bot) #62728
[6f08489ac9] - deps: update sqlite to 3.53.0 (Node.js GitHub Bot) #62699
[713601e8bd] - deps: update nbytes to 0.1.4 (Node.js GitHub Bot) #62698
[578cf1c0c1] - deps: update archs files for openssl-3.5.6 (Node.js GitHub Bot) #62629
[4a4ef13c67] - deps: upgrade openssl sources to openssl-3.5.6 (Node.js GitHub Bot) #62629
[2f3eca8c1e] - deps: update perfetto to 54.0 (Chengzhong Wu) #62397
[944ed9b739] - deps: add perfetto build files (Chengzhong Wu) #62397
[15530a7484] - deps: update ngtcp2 to 1.22.0 (Node.js GitHub Bot) #62595
[b813b4c4b5] - deps: update minimatch to 10.2.5 (Node.js GitHub Bot) #62594
[38e7ce58c5] - deps: update googletest to d72f9c8aea6817cdf1ca0ac10887f328de7f3da2 (Node.js GitHub Bot) #62593
[b5c573ed14] - deps: update simdjson to 4.6.1 (Node.js GitHub Bot) #62592
[318e2c7cd3] - deps: libuv: cherry-pick aabb7651de (Santiago Gimeno) #62561
[c6ccbd742a] - deps: libuv: reapply 3a9a6e3e6b (Andy Pan) #62561
[4ad07de7ae] - diagnostics_channel: add BoundedChannel and scopes (Stephen Belanger) #61680
[44416ea3fd] - doc: fix documentation history missing 25.9.0 (Antoine du Hamel) #63151
[5f6dfbf68e] - doc: fix changelog for chromium numbering (Rafael Gonzaga) #63133
[30c4b3658c] - doc: fix the TypeScript Execute (tsx) project link (David Thornton) #63093
[ca3c3097f1] - doc: minor structural stream/iter edits (René) #63089
[92324aab6f] - doc: remove typo comma from man page (Vas Sudanagunta) #63080
[712a15da73] - doc: correct diagnostics_channel built-in channel names (Bryan English) #62995
[c92cb6fe0d] - doc: use mjs/cjs blocks for callbackify null reason example (Daijiro Wachi) #62884
[020776d4d6] - doc: fix typo in test.md (Rich Trott) #62960
[7d52f2061e] - doc: correct typo in PR contribution instructions (Mike McCready) #62738
[70e8944676] - doc: fix duplicate word "of of" in postMessageToThread (Daijiro Wachi) #62917
[11c6c29284] - doc: fix duplicate word "to to" in util.styleText (Daijiro Wachi) #62917
[242adab671] - doc: fix duplicate word "for for" in compile cache (Daijiro Wachi) #62917
[b9f3abd63e] - doc: fix doubled word typo in stream_iter.md (Daijiro Wachi) #62916
[7a52fd0448] - doc: fix typo in dns.lookup options description (Daijiro Wachi) #62882
[acd7e18a8c] - doc: fix Argon2 parameter bounds (Tobias Nießen) #62868
[b43ecf40bb] - doc: trust FFI in the threat model (Paolo Insogna) #62852
[981ce96b03] - doc: fix typos and inconsistencies in crypto.md and webcrypto.md (Filip Skokan) #62828
[acc52ef257] - doc: clarify diffieHellman.generateKeys recomputes same key (Kit Dallege) #62205
[ae87597c07] - doc: remove Ayase-252 and meixg from triagger team (Antoine du Hamel) #62841
[1cd3694a5f] - doc: clarify dns.lookup() callback signature when all is true (eungi) #62800
[40a4337d65] - doc: add experimental modules lifetime policy (Paolo Insogna) #62753
[46f48222f8] - doc: clarify process._debugProcess() in Permission Model (Fahad Khan) #62537
[6eb9917497] - doc: fix typo in devcontainer guide (Rohan Santhosh Kumar) #62687
[3826c5ed7e] - doc: clarify Backport-PR-URL metadata added automatically (Mike McCready) #62668
[5d7e0dbbd8] - doc: update WPT test runner README.md (Filip Skokan) #62680
[e9d76b2a75] - doc: fix spelling in release announcement guidance (Rohan Santhosh Kumar) #62663
[1ae41cebb0] - doc: note GCC >= 14 requirement for native riscv64 builds (Jamie Magee) #62607
[9b29be6a28] - doc: note non-monotonic clock in crypto.randomUUIDv7 (nabeel378) #62600
[5ae59553f6] - doc: update bug bounty program (Rafael Gonzaga) #62590
[ce3f4c85dd] - doc: document TransformStream transformer.cancel option (Tom Pereira) #62566
[08a9ba73e4] - doc: mention test runner retry attemp is zero based (Moshe Atlow) #62504
[32f2169ede] - doc,src,test: fix dead inspector help URL (semimikoh) #62745
[870c1cd3f4] - doc,test: mem protection must be observed in ffi (Bryan English) #62818
[3d5cf171dc] - esm: add ERR_REQUIRE_ESM_RACE_CONDITION (Antoine du Hamel) #62462
[2004d8d6db] - ffi: make FFIFunctionInfo a BaseObject subclass (Anna Henningsen) #63071
[53eb7abeba] - ffi: prevent premature GC of DynamicLibrary (semimikoh) #63024
[58dc92f502] - ffi: support Symbol.dispose on DynamicLibrary (Matteo Collina) #62925
[528f8b2bae] - ffi: add shared-buffer fast path for numeric and pointer signatures (Bryan English) #62918
[42ac8b9ae7] - fs: add followSymlinks option to glob (Matteo Collina) #62695
[873c2bca70] - fs: restore fs patchability in ESM loader (Joyee Cheung) #62835
[349c7502c3] - fs: validate position argument before length === 0 early return (Edy Silva) #62674
[06defaa2ea] - (SEMVER-MINOR) fs: add signal option to fs.stat() (Mert Can Altin) #57775
[db66a963bf] - (SEMVER-MINOR) fs: expose frsize field in statfs (Jinho Jang) #62277
[3191d2936a] - http: emit 'drain' on OutgoingMessage only after buffers drain (Robert Nagy) #62936
[87adb3472b] - (SEMVER-MINOR) http: harden ClientRequest options merge (Matteo Collina) #63082
[e0b79633f6] - http: fix leaked error listener on sync HTTP req create + destroy (Tim Perry) #62872
[70c5491f53] - http: fix no_proxy leading-dot suffix matching (Daijiro Wachi) #62333
[60a585e68a] - http: cleanup pipeline queue (Robert Nagy) #62534
[9047ec12ce] - (SEMVER-MINOR) http: add req.signal to IncomingMessage (Akshat) #62541
[01eed5901b] - http2: expose writable stream state on compat response (T) #63003
[19b7adf3ba] - inspector: fix absolute URLs in network http (bugyaluwang) #62955
[4d10823fbb] - inspector: coerce key and value to string in webstorage events (Ali Hassan) #62616
[9a3ac66cc5] - inspector: return errors when CDP protocol event emission fails (Ryuhei Shima) #62162
[c89501c6e5] - inspector: auto collect webstorage data (Ryuhei Shima) #62145
[ef08c5016a] - lib: refactor internal webidl converters (Filip Skokan) #62979
[d0744c6a99] - lib: add Temporal to frozen intrinsics (René) #63029
[6d81cb17b3] - lib: avoid quadratic shift() in startup snapshot callback (Daijiro Wachi) #62914
[3491f73051] - lib: fix FLOAT_32 and FLOAT_64 type constants in ffi (Daijiro Wachi) #62892
[c4ca303b36] - lib: harden kKeyOps lookup with null prototype (Filip Skokan) #62877
[2e612fe070] - lib: short-circuit WebIDL BufferSource SAB check (Filip Skokan) #62833
[e850ee9c69] - lib: add new methods and error codes (Paolo Insogna) #62762
[e21b873589] - lib: use js-only implementation of isDataView() (René) #62780
[f454d1719d] - lib: fix lint in internal/webstreams/util.js (Filip Skokan) #62806
[fbd8ededba] - lib: fix sequence argument handling in Blob constructor (Ms2ger) #62179
[16860e6abd] - lib: improve Web Cryptography key validation ordering (Filip Skokan) #62749
[ba3f3e1753] - lib: reject SharedArrayBuffer in web APIs per spec (Ali Hassan) #62632
[d065e996bb] - lib: defer AbortSignal.any() following (sangwook) #62367
[2a711f4b0c] - (SEMVER-MINOR) lib,src,test,doc: add node:ffi module (Colin Ihrig) #62072
[d578343582] - meta: bump github/codeql-action from 4.35.1 to 4.35.3 (dependabot[bot]) #63074
[1b4b90d544] - meta: bump Mozilla-Actions/sccache-action from 0.0.9 to 0.0.10 (dependabot[bot]) #63073
[1477349e47] - meta: bump actions/upload-artifact from 7.0.0 to 7.0.1 (dependabot[bot]) #63072
[ecb7de271a] - meta: bump cachix/install-nix-action from 31.10.3 to 31.10.5 (dependabot[bot]) #62846
[fb91408312] - meta: bump actions/upload-artifact from 7.0.0 to 7.0.1 (dependabot[bot]) #62850
[7eb9a6be68] - meta: add automation policy (Chengzhong Wu) #62871
[6f053a4cb8] - meta: update CODEOWNERS for FFI (Paolo Insogna) #62853
[88fe50a725] - meta: move VoltrexKeyva to emeritus (Matteo Collina) #62895
[42e770bdd0] - meta: bump peter-evans/create-pull-request from 8.1.0 to 8.1.1 (dependabot[bot]) #62845
[952d005233] - meta: bump step-security/harden-runner from 2.16.1 to 2.19.0 (dependabot[bot]) #62844
[1bd19d9768] - meta: bump actions/github-script from 8.0.0 to 9.0.0 (dependabot[bot]) #62843
[386244a7dd] - meta: bump actions/setup-node from 6.3.0 to 6.4.0 (dependabot[bot]) #62842
[16b2c41f70] - meta: broaden stale bot (Aviv Keller) #62658
[41e7a4ba82] - meta: pass release version to release worker (flakey5) #62777
[632821db85] - meta: add QUIC to CODEOWNERS (Tim Perry) #62652
[4a7ad93ed8] - meta: move Michael to emeritus (Michael Dawson) #62536
[44d5a33efb] - meta: populate apt list for slim runner in update-openssl workflow (René) #62628
[d874596aa3] - meta: bump cachix/install-nix-action from 31.9.1 to 31.10.3 (dependabot[bot]) #62551
[1631b27e2b] - meta: bump step-security/harden-runner from 2.15.0 to 2.16.1 (dependabot[bot]) #62550
[4de376894d] - meta: bump actions/download-artifact from 8.0.0 to 8.0.1 (dependabot[bot]) #62549
[39da4d7bd6] - meta: bump actions/setup-node from 6.2.0 to 6.3.0 (dependabot[bot]) #62548
[62e3aa55ad] - meta: bump github/codeql-action from 4.32.4 to 4.35.1 (dependabot[bot]) #62547
[83986de8a2] - meta: bump codecov/codecov-action from 5.5.2 to 6.0.0 (dependabot[bot]) #62545
[18e56861dc] - meta: bump cachix/cachix-action from 16 to 17 (dependabot[bot]) #62544
[d4e49d567a] - meta: bump actions/cache from 5.0.3 to 5.0.4 (dependabot[bot]) #62543
[2c5a914af4] - meta: require DCO signoff in commit message guidelines (James M Snell) #62510
[f21039ce59] - meta: expand memory leak DoS criteria to all DoS (Joyee Cheung) #62505
[824ac6b5bf] - module: exclude node:ffi from builtinModules when not enabled (Jordan Harband) #63158
[bb6293ab7c] - module: remove duplicated checks from _resolveFilename (Antoine du Hamel) #62729
[34ec8c9f5c] - module,win: fix long subpath import (Stefan Stojanovic) #62101
[de46e68918] - node-api: update libuv ABI stability note (Chengzhong Wu) #62789
[78c7d77bbf] - node-api: add napi_create_external_sharedarraybuffer (Ben Noordhuis) #62623
[a0ccf94f61] - node-api: execute tsfn finalizer after queue drains when aborted (Kevin Eady) #61956
[ab66de8eaa] - (SEMVER-MINOR) process: throw on execve(2) failure instead of aborting (Bryan English) #62878
[20151be8cb] - process: handle rejections only when needed (Gürgün Dayıoğlu) #62919
[9b24a815a2] - quic: add QuicEndpoint.listening & QuicStream.destroy() and tests (Tim Perry) #62648
[761a96740c] - quic: fixup token verification to handle zero expiration (James M Snell) #62620
[4ade02ac85] - quic: support multiple ALPN negotiation (James M Snell) #62620
[b2e2e648e4] - quic: apply multiple TLS context improvements and SNI support (James M Snell) #62620
[56b941af4a] - quic: implement rapidhash for hashing improvements (James M Snell) #62620
[7cda4300b8] - quic: use arena allocation for packets (James M Snell) #62589
[1e8fa2f1bd] - sqlite: use OneByte for ASCII text and internalize col names (Ali Hassan) #61954
[3af44ee508] - sqlite: add serialize() and deserialize() (Ali Hassan) #62579
[6386914b4b] - src: decouple KeyObject and CryptoKey and move CryptoKey to src (Filip Skokan) #62924
[2dc1d205ee] - src: replace uses of deprecated v8::External APIs (gahaas) #61898
[cb33a794a5] - src: remove license headers for new node_profiling files (Chengzhong Wu) #63066
[59860eb798] - src: swap dotenv and config file parsing order (Marco Ippolito) #63035
[fda439cb58] - src: use unique_ptr for ffi memory management (Anna Henningsen) #63071
[56917afc57] - src: split profiling helpers from util (Ilyas Shabi) #63008
[fca56a409d] - src: add missing <cstdlib> for abort() declaration (Charles Kerr) #63001
[d49c89e915] - src: make node.config.json throw at unknown fields (Marco Ippolito) #62992
[e89c8e9b68] - src: fix crash in GetErrorSource() for invalid using syntax (semimikoh) #62770
[d89f719ce0] - src: remove outdated comments in contextify (Chengzhong Wu) #62932
[5117a3e52b] - src: simplify TCPWrap::Connect signature (Anna Henningsen) #62929
[41bd288ec7] - src: align FFI error handling with Node.js source (Anna Henningsen) #62858
[faaccfb9df] - src: simplify and fix FFI ArrayBuffer accesses (Anna Henningsen) #62857
[43bf39c350] - src: use DCHECK in AsyncWrap::MakeCallback instead emiting a warning (Gerhard Stöbich) #62795
[da52b09859] - src: fix MaybeStackBuffer char_traits deprecation warning (om-ghante) #62507
[2b12bca317] - src: use context-free V8 message column getters (René) #62778
[7efc2ce7b3] - src: clean up experimental flag variables (Antoine du Hamel) #62759
[8273682c87] - (SEMVER-MINOR) src: allow empty --experimental-config-file (Marco Ippolito) #61610
[b844c24395] - src: coerce spawnSync args to string once (Antoine du Hamel) #62633
[28679d76c4] - src: use stack allocation for small string encoding (Ali Hassan) #62431
[144ef93735] - src: add contextify interceptor debug logs (Chengzhong Wu) #62460
[d34cfb512e] - stream: remove redundant method check from iter.pipeToSync (René) #63099
[a95830b72a] - stream: copyedit webstreams/adapter.js (Antoine du Hamel) #63034
[4bf3e1e084] - stream: remove duplicated utility (Antoine du Hamel) #63031
[214a8c197b] - stream: simplify setPromiseHandled utility (Antoine du Hamel) #63032
[c12a767ff2] - stream: validate ReadableStream.from iterator objects (Daeyeon Jeong) #62911
[b09953d2d4] - stream: reject duplicate nested transferables (Daeyeon Jeong) #62831
[b9929622f3] - stream: ensuring cross-destruction in _duplexify to prevent leaks (Daijiro Wachi) #62824
[c51a39b3ec] - stream: simplify readableStreamFromIterable (Antoine du Hamel) #62651
[36078574b9] - stream: fix nested compose error propagation (Matteo Collina) #62556
[e1928cd481] - stream: allow shared array buffer sources in writable webstream adapter (René) #62163
[450e0519d9] - stream: simplify createPromiseCallback (Antoine du Hamel) #62650
[57e59ea070] - stream: fix writev unhandled rejection in fromWeb (sangwook) #62297
[958373413c] - stream: noop pause/resume on destroyed streams (Robert Nagy) #62557
[ee38d2c43d] - stream: refactor duplexify to be less suceptible to prototype pollution (Antoine du Hamel) #62559
[fbff28f7e6] - (SEMVER-MINOR) stream: propagate destruction in duplexPair (Ahmed Elhor) #61098
[d7317f4f90] - stream: add stream/iter to classic stream adapters (James M Snell) #62469
[55298c443f] - test: accept OpenSSL 4 generic internal error for DH key-type mismatches (Filip Skokan) #62805
[96581bccc7] - test: update WPT for url to 258f285de0 (Node.js GitHub Bot) #63087
[c73aba07fb] - test: run Temporal presence checks without V8 flag (René) #63028
[9c94dce55b] - test: export isRiscv64 from common module (Jamie Magee) #62609
[33c5f7fdbf] - test: normalize known inspector crash as completion (Joyee Cheung) #62851
[8146a97bc3] - test: update WPT for streams to f8f26a372f (Node.js GitHub Bot) #62864
[7c77c301c9] - test: account for RFC 7919 FFDHE negotiation in OpenSSL 4.0 (Filip Skokan) #62805
[9bf7604eb6] - test: skip tls-deprecated secp256k1 on OpenSSL 4.0 (Filip Skokan) #62805
[d173604b53] - test: use an always invalid cipher and cover OpenSSL 4.0 behaviours (Filip Skokan) #62805
[72f52163b4] - test: use valid DER OCSP responses (Filip Skokan) #62805
[e242394ad9] - test: skip test-tls-error-stack when engines are unsupported (Filip Skokan) #62805
[9bff52ebf8] - test: accept renamed OpenSSL 4.0 error code and reason (Filip Skokan) #62805
[d9b8cc1b68] - test: update test/addons/openssl-binding for OpenSSL 4.0 (Filip Skokan) #62805
[960fb16287] - test: mark test-snapshot-reproducible flaky (Filip Skokan) #62808
[7a12dd58cf] - test: check contextify contextual store behavior in strict mode (René) #62571
[c73c8e603f] - test: skip test-temporal-with-zoneinfo on system-icu builds (Antoine du Hamel) #62754
[48a3ca303e] - test: generate localstorage.db in a temp dir (Chengzhong Wu) #62660
[1a41c2c5db] - test: update tls junk data error expectations (Filip Skokan) #62629
[115e8c2052] - test: ensure WPT report is in out/wpt (Filip Skokan) #62637
[cb07b918bd] - test: improve WPT runner summary (Filip Skokan) #62636
[7f48438380] - test: skip url WPT subtests instead of modifying test script (Filip Skokan) #62635
[4097fb95d7] - test: capture negative utimes mtime at call time (Yuya Inoue) #62490
[e29f46df81] - test: allow skipping individual WPT subtests (Filip Skokan) #62517
[4d546886c3] - test: use on-disk fixture for test-npm-install (Joyee Cheung) #62584
[5b35eb02ec] - test: update WPT for url to 7a3645b79a (Node.js GitHub Bot) #62591
[7a8610835d] - test_runner: fix failing suite hooks when marked with todo (Moshe Atlow) #63097
[a8c773a0c7] - (SEMVER-MINOR) test_runner: align mock timeout api (sangwook) #62820
[dc0d757c8a] - test_runner: fix suite rerun edge case (Moshe Atlow) #62860
[b883a5eaea] - (SEMVER-MINOR) test_runner: add mock-timers support for AbortSignal.timeout (DeveloperViraj) #60751
[6fa62b7d58] - test_runner: add testId to test events (Moshe Atlow) #62772
[39e08340ff] - test_runner: publish to TracingChannel for OTel instrumentation (Moshe Atlow) #62502
[a21ae1771e] - (SEMVER-MINOR) test_runner: support test order randomization (Pietro Marchini) #61747
[cf0edeb65d] - test_runner: add passed, attempt, and diagnostic to SuiteContext (Moshe Atlow) #62504
[644e2399d6] - test_runner: add getTestContext() (Moshe Atlow) #62501
[480d538830] - tools: use npm ci in Undici update script (Antoine du Hamel) #63098
[9afb013edd] - tools: update nixpkgs-unstable to c6d65881c5624c9cae5ea6cedef24699b0c (Node.js GitHub Bot) #63091
[b9f2f5a90a] - tools: bump postcss from 8.5.8 to 8.5.10 in /tools/doc (dependabot[bot]) #62966
[09e4f4caca] - tools: use LTS Node.js in notify-on-push workflow (Nenad Spasenic) #63084
[2af4c89774] - tools: implements a few nits on build-aarch64-linux-v8 (Antoine du Hamel) #63048
[cf9c1849ca] - tools: update gr2m/create-or-update-pull-request-action to v1.10.1 (Mike McCready) #63065
[96370a57ed] - tools: simplify update-undici.sh (Antoine du Hamel) #63044
[b90486edd8] - tools: do not run test-linux on unrelated tools changes (Antoine du Hamel) #63037
[ac49e7c9fc] - tools: migrate from openssl-matrix.json to openssl-matrix.nix (Antoine du Hamel) #63036
[a9df3e37fd] - tools: update labels for nixpkgs pin bumps (Antoine du Hamel) #62994
[cee0154af8] - tools: reuse V8 builds even without Cachix on test-shared (Antoine du Hamel) #62980
[78c183da6b] - tools: do not include HTML docs in slim tarball (Antoine du Hamel) #62989
[04ce9df084] - tools: bump the eslint group in /tools/eslint with 4 updates (dependabot[bot]) #62848
[4d2952c00a] - tools: update nixpkgs-unstable to 01fbdeef22b76df85ea168fbfe1bfd9e636 (Node.js GitHub Bot) #62963
[555ad12f27] - tools: update gyp-next to 0.22.1 (Node.js GitHub Bot) #62961
[f92cbc2c81] - tools: fix commit linter for semver-major release proposals (Antoine du Hamel) #62993
[3b5bb4d758] - tools: consolidate and simplify .editorconfig deps section (Daijiro Wachi) #62887
[027bef4f3e] - tools: add non-default OpenSSL versions to the test-shared workflow (Filip Skokan) #62862
[fdcd7752de] - tools: set bot as author of tools-deps-update PRs (Antoine du Hamel) #62856
[ab7be6d987] - tools: bump brace-expansion from 5.0.4 to 5.0.5 in /tools/eslint (dependabot[bot]) #62458
[82281ffd59] - tools: bump brace-expansion in /tools/clang-format (dependabot[bot]) #62467
[48bb51b3d7] - tools: update nixpkgs-unstable to ab72be9733b41190ea34f1422a3e4e243ed (Node.js GitHub Bot) #62821
[67baa3254b] - tools: bump @node-core/doc-kit in /tools/doc in the doc group (dependabot[bot]) #62512
[bdee0a859d] - tools: exclude @node-core/doc-kit from dependabot cooldown (Levi Zim) #62775
[9e19f55214] - tools: re-enable undici WPTs in daily wpt.fyi job (Filip Skokan) #62677
[1eedbdded9] - tools: use upstream version of OpenSSL in test-shared (Antoine du Hamel) #62679
[3490c1fba1] - tools: pass the Temporal disable flag when disabled in shell.nix (Antoine du Hamel) #62733
[3a29dafd2d] - tools: fix --shared-ffi compilation on macOS (Antoine du Hamel) #62737
[5cb9108b9c] - tools: update nixpkgs-unstable to 13043924aaa7375ce482ebe2494338e0582 (Node.js GitHub Bot) #62700
[757cd21ea0] - tools: update gyp-next to 0.22.0 (Node.js GitHub Bot) #62697
[fad51c2f03] - tools: add a check for clean git tree after tests (Antoine du Hamel) #62661
[d1c517fd61] - tools: improve backport review script (Antoine du Hamel) #62573
[6d169c75f7] - tools: make v8.nix more stable (Antoine du Hamel) #62508
[1587a60bf8] - tools: add perfetto updater (Chengzhong Wu) #62397
[f54d74a5e7] - tools: improve output for unexpected passes in WTP tests (Antoine du Hamel) #62587
[a86c96333c] - tools: revert OpenSSL update workflow to ubuntu-latest (Richard Lau) #62627
[c9860f5800] - tools: update nixpkgs-unstable to a6522db5b947cd7026a40d02acc3ca26136 (Node.js GitHub Bot) #62596
[ae41e2a141] - tools: bump the eslint group in /tools/eslint with 2 updates (dependabot[bot]) #62552
[e2ba824407] - tools: allow triagers to queue a PR for CI until it's reviewed (Antoine du Hamel) #62524
[899d780f15] - tools: do not run commit-lint on release proposals (Antoine du Hamel) #62523
[102da27b4e] - url: process crash via malformed UNC hostname in pathToFileURL() (Nicola Del Gobbo) #62574
[3abd78c3e5] - url: optimize URLSearchParams set/delete duplicate handling (Gürgün Dayıoğlu) #62266
[fd3bf3830b] - url: align default argument handling for URLPattern with webidl (Filip Skokan) #62719
[b85c73ff10] - (SEMVER-MINOR) util: colorize text with hex colors (Guilherme Araújo) #61556
[c1d6b3db73] - v8: add cpu profile options (Ilyas Shabi) #62684
[717d9a7fda] - v8: add heap profile API (Ilyas Shabi) #62273
[2b885667a9] - watch: track worker entry files in watch mode (SudhansuBandha) #62368
[457fb55193] - watch: fix --env-file-if-exists crashing on linux if the file is missing (Efe) #61870

2026-05-05, Version 26.0.0 (Current), @RafaelGSS

We're excited to announce the release of Node.js 26! Highlights include the Temporal API enabled by default, updates to the V8 JavaScript engine to 14.6, Undici to 8.0, and several important deprecations and removals as we continue to modernize the platform.

As a reminder, Node.js 26 will enter long-term support (LTS) in October, but until then, it will be the "Current" release for the next six months. We encourage you to explore the new features and benefits offered by this latest release and evaluate their potential impact on your applications.

Notable Changes

Temporal API

The Temporal API is now enabled by default in Node.js 26. Temporal is a modern date/time API for JavaScript that provides a more robust and feature-rich alternative to the legacy Date object.

Contributed by Richard Lau in #61806.

V8 14.6

The V8 engine is updated to version 14.6.202.33, which is part of Chromium 146.

This version also includes:

Upsert (https://github.com/tc39/proposal-upsert): [Weak]Map.prototype.getOrInsert(), [Weak]Map.prototype.getOrInsertComputed()
Iterator sequencing (https://github.com/tc39/proposal-iterator-sequencing): Iterator.concat()

Contributed by Michaël Zasso in #61898.

Undici 8

Undici has been updated to version 8.0.2, bringing new features and improvements to Node.js's HTTP client implementation.

Deprecations and Removals

[dff46c07c3] - (SEMVER-MAJOR) crypto: move DEP0182 to End-of-Life (Tobias Nießen) #61084
[93c25815ee] - (SEMVER-MAJOR) http: move writeHeader to end-of-life (Sebastian Beltran) #60635

http.Server.prototype.writeHeader() is now fully removed. Use http.Server.prototype.writeHead() instead.
[c755b0113c] - (SEMVER-MAJOR) stream: move _stream_* to end-of-life (Sebastian Beltran) #60657

The legacy _stream_wrap, _stream_readable, _stream_writable, _stream_duplex, _stream_transform, and _stream_passthrough modules are now fully removed.
[adac077484] - (SEMVER-MAJOR) crypto: runtime-deprecate DEP0203 and DEP0204 (Filip Skokan) #62453
[ac6375417a] - (SEMVER-MAJOR) stream: promote DEP0201 to runtime deprecation (René) #62173
[98907f560f] - (SEMVER-MAJOR) module: runtime-deprecate module.register() (Geoffrey Booth) #62401
[89f4b6cddb] - (SEMVER-MAJOR) module: remove --experimental-transform-types (Marco Ippolito) #61803

Semver-Major Commits

[d3f79aa65d] - (SEMVER-MAJOR) assert: allow printf-style messages as assertion error (Ruben Bridgewater) #58849
[f6ce381fec] - (SEMVER-MAJOR) build: bump GCC requirement to 13.2 (Michaël Zasso) #62555
[bff81fca46] - (SEMVER-MAJOR) build: enable Temporal by default (Richard Lau) #61806
[6ddb1643e1] - (SEMVER-MAJOR) build: enable V8_VERIFY_WRITE_BARRIERS in debug build (Joyee Cheung) #61898
[a8ab08b373] - (SEMVER-MAJOR) build: reset embedder string to "-node.0" (Michaël Zasso) #61898
[0998c37eb6] - (SEMVER-MAJOR) build: target Power 9 for AIX/IBM i (Richard Lau) #62296
[d73c49e849] - (SEMVER-MAJOR) build: drop support for Python 3.9 (Mike McCready) #61177
[3c92ee1008] - (SEMVER-MAJOR) build: enable maglev for Linux on s390x (Richard Lau) #60863
[908c468828] - (SEMVER-MAJOR) build: reset embedder string to "-node.0" (Michaël Zasso) #60488
[6380fbb5ee] - (SEMVER-MAJOR) build: reset embedder string to "-node.0" (Michaël Zasso) #60111
[089d6c77e7] - (SEMVER-MAJOR) (CVE-2026-21717) build,test: test array index hash collision (Joyee Cheung) #61898
[f9bd0165c4] - (SEMVER-MAJOR) build,win: fix Temporal build (StefanStojanovic) #61806
[6cc4cf8fe8] - (SEMVER-MAJOR) crypto: unify asymmetric key import through KeyObjectHandle::Init (Filip Skokan) #62499
[adac077484] - (SEMVER-MAJOR) crypto: runtime-deprecate DEP0203 and DEP0204 (Filip Skokan) #62453
[74509b166a] - (SEMVER-MAJOR) crypto: decorate async crypto job errors with OpenSSL error details (Filip Skokan) #62348
[da5843b91d] - (SEMVER-MAJOR) crypto: default ML-KEM and ML-DSA pkcs8 export to seed-only format (Filip Skokan) #62178
[dff46c07c3] - (SEMVER-MAJOR) crypto: move DEP0182 to End-of-Life (Tobias Nießen) #61084
[94cd600542] - (SEMVER-MAJOR) crypto: fix DOMException name for non-extractable key error (Filip Skokan) #60830
[dae2219cca] - (SEMVER-MAJOR) deps: V8: cherry-pick 0f024d4e66e0 (ishabi) #62408
[15d406c1b1] - (SEMVER-MAJOR) deps: fix V8 race condition for AIX (Abdirahim Musse) #61898
[46852d2d7a] - (SEMVER-MAJOR) deps: V8: cherry-pick cd2c216e7658 (LuYahan) #61898
[784431d6fc] - (SEMVER-MAJOR) deps: V8: backport 088b7112e7ab (Igor Sheludko) #61898
[3839c4a756] - (SEMVER-MAJOR) deps: V8: cherry-pick 00f6e834029f (Joyee Cheung) #61898
[44f64f1dd9] - (SEMVER-MAJOR) deps: V8: backport bef0d9c1bc90 (Joyee Cheung) #61898
[1f8f288e22] - (SEMVER-MAJOR) deps: V8: cherry-pick cf1bce40a5ef (Richard Lau) #61898
[d7eccac9ad] - (SEMVER-MAJOR) deps: V8: cherry-pick daf4656ba85e (Milad Fa) #61898
[3ee1ea7d0b] - (SEMVER-MAJOR) deps: V8: cherry-pick d83f479604c8 (Joyee Cheung) #61898
[80907c0239] - (SEMVER-MAJOR) deps: V8: cherry-pick edeb0a4fa181 (Joyee Cheung) #61898
[5e0dc169e9] - (SEMVER-MAJOR) deps: V8: cherry-pick aa0b288f87cc (Richard Lau) #61898
[8c1f7adbcd] - (SEMVER-MAJOR) deps: patch V8 to fix Windows build (StefanStojanovic) #61898
[3cbd3404d9] - (SEMVER-MAJOR) deps: V8: cherry-pick highway@989a498fdf3 (Richard Lau) #61898
[9f2b7d4031] - (SEMVER-MAJOR) deps: support madvise(3C) across ALL illumos revisions (Dan McDonald) #61898
[947ec32118] - (SEMVER-MAJOR) deps: patch V8 for illumos (Dan McDonald) #61898
[0660b942b2] - (SEMVER-MAJOR) deps: remove problematic comment from v8-internal (Michaël Zasso) #61898
[bef7b31a3f] - (SEMVER-MAJOR) deps: define V8_PRESERVE_MOST as no-op on Windows (Stefan Stojanovic) #61898
[a10bf1e6ce] - (SEMVER-MAJOR) deps: patch V8 to avoid duplicated zlib symbol (Michaël Zasso) #61898
[cc547428e1] - (SEMVER-MAJOR) deps: update V8 to 14.6.202.33 (Michaël Zasso) #61898
[b81d2cbcae] - (SEMVER-MAJOR) deps: update undici to 8.0.2 (Node.js GitHub Bot) #62384
[bf5c6a8bd4] - (SEMVER-MAJOR) deps: V8: backport 151d0a44a1b2 (Abdirahim Musse) #60488
[b59af772dc] - (SEMVER-MAJOR) deps: V8: cherry-pick 47800791b35c (Jakob Kummerow) #60488
[5e41e5228a] - (SEMVER-MAJOR) deps: patch V8 for illumos (Dan McDonald) #59805
[2243e58e43] - (SEMVER-MAJOR) deps: use std::map in MSVC STL for EphemeronRememberedSet (Joyee Cheung) #58070
[4157964c42] - (SEMVER-MAJOR) deps: remove problematic comment from v8-internal (Michaël Zasso) #58070
[7c8483a4e9] - (SEMVER-MAJOR) deps: patch V8 to avoid duplicated zlib symbol (Michaël Zasso) #54077
[53379f3706] - (SEMVER-MAJOR) deps: update V8 to 14.3.127.12 (Michaël Zasso) #60488
[f819aec288] - (SEMVER-MAJOR) deps: V8: cherry-pick ff34ae20c8e3 (Chengzhong Wu) #60111
[1acd8df36f] - (SEMVER-MAJOR) deps: V8: backport fed47445bbdd (Abdirahim Musse) #60111
[46f72577a4] - (SEMVER-MAJOR) deps: patch V8 for illumos (Dan McDonald) #59805
[39eb88eaa8] - (SEMVER-MAJOR) deps: use std::map in MSVC STL for EphemeronRememberedSet (Joyee Cheung) #58070
[ea3d14eadb] - (SEMVER-MAJOR) deps: remove problematic comment from v8-internal (Michaël Zasso) #58070
[7bc0f245b4] - (SEMVER-MAJOR) deps: patch V8 to avoid duplicated zlib symbol (Michaël Zasso) #54077
[c2843b722c] - (SEMVER-MAJOR) deps: update V8 to 14.2.231.9 (Michaël Zasso) #60111
[b4ea323833] - (SEMVER-MAJOR) diagnostics_channel: ensure tracePromise consistency with non-Promises (René) #61766
[0c08835f71] - (SEMVER-MAJOR) doc: remove extensionless CJS exception for type:module packages (Matteo Collina) #62176
[ef0f0b0865] - (SEMVER-MAJOR) doc: update supported Windows SDK version to 11 (Mike McCready) #61973
[a00d95c73d] - (SEMVER-MAJOR) doc: drop p8 and z13 support (Milad Fa) #61005
[93c25815ee] - (SEMVER-MAJOR) http: move writeHeader to end-of-life (Sebastian Beltran) #60635
[4346c0f7a7] - (SEMVER-MAJOR) http: fix handling of HTTP upgrades with bodies (Tim Perry) #60016
[fa70327610] - (SEMVER-MAJOR) lib: return undefined for localStorage without file (Matteo Collina) #61333
[b328bf74bd] - (SEMVER-MAJOR) lib,src: implement QuotaExceededError as DOMException-derived interface (Filip Skokan) #62293
[98907f560f] - (SEMVER-MAJOR) module: runtime-deprecate module.register() (Geoffrey Booth) #62401
[89f4b6cddb] - (SEMVER-MAJOR) module: remove --experimental-transform-types (Marco Ippolito) #61803
[5334433437] - (SEMVER-MAJOR) src: replace uses of deprecated v8::External APIs (gahaas) #61898
[46e75f4874] - (SEMVER-MAJOR) src: stop using v8::PropertyCallbackInfo<T>::This() (Igor Sheludko) #61898
[54fefda0aa] - (SEMVER-MAJOR) src: avoid deprecated Wasm API (Clemens Backes) #61898
[840f509bd1] - (SEMVER-MAJOR) src: avoid deprecated FixedArray::Get (Clemens Backes) #61898
[75c3bcc3ec] - (SEMVER-MAJOR) src: update NODE_MODULE_VERSION to 147 (Michaël Zasso) #61898
[8480f87375] - (SEMVER-MAJOR) src: remove deprecated and unused isolate fields (Michaël Zasso) #60488
[70b6bd8e19] - (SEMVER-MAJOR) src: update NODE_MODULE_VERSION to 144 (Michaël Zasso) #60488
[7d2bc5249b] - (SEMVER-MAJOR) src: include node_api_types.h instead of node_api.h in node.h (Anna Henningsen) #60496
[91ab1101bc] - (SEMVER-MAJOR) src: update NODE_MODULE_VERSION to 142 (Michaël Zasso) #60111
[ac6375417a] - (SEMVER-MAJOR) stream: promote DEP0201 to runtime deprecation (René) #62173
[c755b0113c] - (SEMVER-MAJOR) stream: move _stream_* to end-of-life (Sebastian Beltran) #60657
[fadb214d95] - (SEMVER-MAJOR) stream: readable read one buffer at a time (Robert Nagy) #60441
[4fe325d93d] - (SEMVER-MAJOR) stream: preserve AsyncLocalStorage on finished only when needed (avcribl) #59873
[7682e7e9c5] - (SEMVER-MAJOR) test: skip wasm allocation tests in workers (Michaël Zasso) #61898
[ebfaf25870] - (SEMVER-MAJOR) test: update wpt Wasm jsapi expectations (Michaël Zasso) #61898
[ece6a17574] - (SEMVER-MAJOR) test: support presence of Temporal global (Michaël Zasso) #61898
[75b8d7a912] - (SEMVER-MAJOR) test: add type tags to uses of v8::External (gahaas) #61898
[092a448ad0] - (SEMVER-MAJOR) test: fix test-linux-perf-logger for V8 14.3 (Michaël Zasso) #60488
[8eb9c8f794] - (SEMVER-MAJOR) tools: remove v8_initializers_slow workaround from v8.gyp (Michaël Zasso) #61898
[a34fe77fe7] - (SEMVER-MAJOR) tools: add Rust args to tools/make-v8.sh (Richard Lau) #61898
[f4666bd6e3] - (SEMVER-MAJOR) tools: update V8 gypfiles for 14.6 (Michaël Zasso) #61898
[3c23d217a6] - (SEMVER-MAJOR) tools: update V8 gypfiles for 14.5 (Michaël Zasso) #61898
[e508489e37] - (SEMVER-MAJOR) tools: update V8 gypfiles for 14.4 (Michaël Zasso) #61898
[dc97b507d0] - (SEMVER-MAJOR) util: mark proxied objects as such when inspecting them (Ruben Bridgewater) #61029
[ddbe1365ff] - (SEMVER-MAJOR) util: reduce TextEncoder.encodeInto function size (Yagiz Nizipli) #60339

Semver-Minor Commits

[d4fa60cf9f] - (SEMVER-MINOR) crypto: add raw key formats support to the KeyObject APIs (Filip Skokan) #62240

Semver-Patch Commits

[4d8834fbef] - build: add rust target for macOS cross compiles (Richard Lau) #63015
[a4edab8dfb] - build: use CARGO environment variable if set (Richard Lau) #62421
[ecf8721076] - build: add weak symbol detection to export script (Abdirahim Musse) #62656
[5b9f811662] - build: filter hidden visibility symbols on AIX (Abdirahim Musse) #62656
[2e724793e6] - build: aix add conditonal flags for clang builds (Abdirahim Musse) #62656
[f212aee483] - build: enable temporal on GHA macOS build (Chengzhong Wu) #61691
[159ae48f8c] - build: add cargo and rustc checks for Temporal (Richard Lau) #61467
[a004535617] - build: add temporal to linux GHA build (Chengzhong Wu) #60942
[9df9b66c18] - crypto: add support for Ed25519 context parameter (Filip Skokan) #62474
[c3042c605b] - crypto: recognize raw formats in keygen (Filip Skokan) #62480
[ce0f498def] - deps: V8: cherry-pick fcf8b990c73c (Abdirahim Musse) #62894
[b7fab70d56] - Revert "deps: V8: cherry-pick 7107287" (Richard Lau) #62894
[d936c30fb4] - deps: V8: cherry-pick 7107287 (Abdirahim Musse) #62656
[c91d00b6d4] - deps: fix aix implicit declaration in OpenSSL (Abdirahim Musse) #62656
[0474a27c06] - deps: libuv: revert 3a9a6e3e6b (Antoine du Hamel) #62511
[7547e795ef] - deps: update icu to 78.3 (Node.js GitHub Bot) #62324
[5bebd7eaea] - deps: update libuv to 1.52.1 (Node.js GitHub Bot) #61829
[87d7db1918] - deps: patch V8 to 14.3.127.18 (Node.js GitHub Bot) #61421
[9d27d9a393] - deps: patch V8 to 14.3.127.17 (Node.js GitHub Bot) #61058
[bfc729cf19] - deps: patch V8 to 14.3.127.16 (Node.js GitHub Bot) #60819
[8716146d5b] - deps: patch V8 to 14.3.127.14 (Node.js GitHub Bot) #60743
[da71ab6895] - deps: V8: cherry-pick highway@989a498fdf3 (Richard Lau) #60682
[72d719dc00] - deps: support madvise(3C) across ALL illumos revisions (Dan McDonald) #58237
[ecca2b0d64] - deps: define V8_PRESERVE_MOST as no-op on Windows (Stefan Stojanovic) #56238
[baefd4d5e2] - deps: patch V8 to 14.2.231.17 (Node.js GitHub Bot) #60647
[76d6be5fc5] - deps: patch V8 to 14.2.231.16 (Node.js GitHub Bot) #60544
[e0ca993514] - deps: patch V8 to 14.2.231.14 (Node.js GitHub Bot) #60413
[de8386de4d] - deps: V8: cherry-pick f93055fbd5aa (Olivier Flückiger) #60105
[710105bab5] - deps: support madvise(3C) across ALL illumos revisions (Dan McDonald) #58237
[6e5f3b9fe1] - deps: define V8_PRESERVE_MOST as no-op on Windows (Stefan Stojanovic) #56238
[b2c5235254] - doc: fix stray carriage return in packages.md (Filip Skokan) #62350
[f38a739623] - doc: reserve NMV 146 for Electron 42 (Niklas Wenzel) #62124
[a57893b799] - doc: add Temporal section to Table of Contents (Richard Lau) #61805
[d4cc54b8c8] - doc: fix v24 changelog after security release (Marco Ippolito) #61371
[659fd01b3e] - doc: fix v22 changelog after security release (Marco Ippolito) #61371
[6c96a63891] - doc: fix v20 changelog after security release (Marco Ippolito) #61371
[a18f8c1693] - doc: reserve NMV 145 for Electron 41 (Niklas Wenzel) #61291
[253b16fe14] - doc: add note about rust toolchain version requirement (Chengzhong Wu) #60942
[0177491df2] - doc: restore REPLACEME on assert change (Michaël Zasso) #60848
[dec0213c83] - doc: add known issue to v24.11.0 release notes (Richard Lau) #60467
[f7ca0ae765] - doc: remove Corepack documentation page (Antoine du Hamel) #57663
[a7d9c49490] - doc: reserve NMV 143 for Electron 40 (Shelley Vohr) #60386
[04a086a1f4] - esm: use wasm version of cjs-module-lexer (Joyee Cheung) #60663
[a27052f2e0] - Revert "inspector: fix compressed responses" (Antoine du Hamel) #61502
[186c7a9c74] - inspector: fix compressed responses (Ruben Nogueira) #61226
[012bf70908] - process: optimize asyncHandledRejections by using FixedQueue (Gürgün Dayıoğlu) #60854
[1a88acbfa2] - quic: fixup linting/formatting issues (James M Snell) #62387
[79b960a2bc] - quic: update http3 impl details (James M Snell) #62387
[57186e5827] - quic: fix a handful of bugs and missing functionality (James M Snell) #62387
[637bda0238] - sqlite: enable Percentile extension (Jurj Andrei George) #61295
[e619adfb86] - src: workaround AIX libc++ std::filesystem bug (Richard Lau) #62788
[79262ff860] - src: do not enable wasm trap handler if there's not enough vmem (Joyee Cheung) #62132
[2422ed8b5b] - src: remove redundant experimental_transform_types from node_options.h (沈鸿飞) #62058
[a86db6be70] - src: simplify handling of kNoAuthTagLength (Tobias Nießen) #61192
[d546e7fd0b] - src: tag more v8 aligned pointer slots (Chengzhong Wu) #60666
[b8e264d3c3] - src: tag v8 aligned pointer slots with embedder data type tags (Chengzhong Wu) #60602
[cd391b5f11] - test: wpt for Wasm jsapi including new ESM Integration tests (Guy Bedford) #59034
[1baafcc882] - test: update WPT resources, interfaces and WebCryptoAPI (Node.js GitHub Bot) #62389
[6a84d4a17c] - tools: update nixpkgs-unstable to 832efc09b4caf6b4569fbf9dc01bec3082a (Node.js GitHub Bot) #62486
[a98d9f6ad7] - tools: update nixpkgs-unstable to 9cf7092bdd603554bd8b63c216e8943cf9b (Node.js GitHub Bot) #62383
[f6d02af01f] - tools: update nixpkgs-unstable to f82ce7af0b79ac154b12e27ed800aeb9741 (Node.js GitHub Bot) #62258
[5b5f069a27] - tools: bump nixpkgs-unstable pin to e38213b91d3786389a446dfce4ff5a8aaf6 (Node.js GitHub Bot) #62052
[13eb80f3b7] - tools: update nixpkgs-unstable to d1c15b7d5806069da59e819999d70e1cec0 (Node.js GitHub Bot) #61931
[4d1557a744] - tools: update nixpkgs-unstable to 2343bbb58f99267223bc2aac4fc9ea301a1 (Node.js GitHub Bot) #61831
[ecd979c95a] - tools: update nixpkgs-unstable to ae67888ff7ef9dff69b3cf0cc0fbfbcd3a7 (Node.js GitHub Bot) #61733
[7de56bdee2] - tools: update nixpkgs-unstable to 6308c3b21396534d8aaeac46179c14c439a (Node.js GitHub Bot) #61606
[e33ce7a6fe] - tools: update nixpkgs-unstable to ab9fbbcf4858bd6d40ba2bbec37ceb4ab6e (Node.js GitHub Bot) #61513
[ba05a66774] - tools: update nixpkgs-unstable to be5afa0fcb31f0a96bf9ecba05a516c66fc (Node.js GitHub Bot) #61420
[bb5d066989] - tools: update nixpkgs-unstable to 3146c6aa9995e7351a398e17470e15305e6 (Node.js GitHub Bot) #61340
[d050aa87e8] - tools: update nixpkgs-unstable to 16c7794d0a28b5a37904d55bcca36003b91 (Node.js GitHub Bot) #61272
[2696391b18] - tools: update nixpkgs-unstable to 3edc4a30ed3903fdf6f90c837f961fa6b49 (Node.js GitHub Bot) #61188
[c5d3f5f9c8] - tools: update nixpkgs-unstable to 7d853e518814cca2a657b72eeba67ae20eb (Node.js GitHub Bot) #61137
[dcb9573d0f] - tools: update nixpkgs-unstable to f997fa0f94fb1ce55bccb97f60d41412ae8 (Node.js GitHub Bot) #61057
[bd426739dc] - tools: update nixpkgs-unstable to a672be65651c80d3f592a89b3945466584a (Node.js GitHub Bot) #60980
[85852a3221] - tools: update nixpkgs-unstable to 59b6c96beacc898566c9be1052ae806f383 (Node.js GitHub Bot) #60900
[1e7eb90b39] - tools: update nixpkgs-unstable to a8d610af3f1a5fb71e23e08434d8d61a466 (Node.js GitHub Bot) #60818
[fb6b83c9ef] - tools: lint Temporal global (René) #60793
[adb40439ca] - tools: update nixpkgs-unstable to 71cf367cc2c168b0c2959835659c38f0a34 (Node.js GitHub Bot) #60742
[8a76958005] - tools: update nixpkgs-unstable to ffcdcf99d65c61956d882df249a9be53e59 (Node.js GitHub Bot) #60315
[9120924de1] - util: fix nested proxy inspection (Ruben Bridgewater) #61077

528 KiB Raw Permalink Blame History Unescape Escape

Node.js 26 ChangeLog

2026-10-21, Version 26.12.1 (Current), @aduh95 prepared by @RafaelGSS

Notable Changes

Commits

2026-10-14, Version 26.12.0 (Current), @richardlau

Notable Changes

Commits

2026-10-07, Version 26.11.1 (Current), @aduh95

Commits

2026-10-07, Version 26.11.0 (Current), @aduh95

Notable Changes

Commits

2026-09-22, Version 26.10.0 (Current), @aduh95

Notable Changes

Commits

2026-09-16, Version 26.9.0 (Current), @aduh95

Notable Changes

Commits

2026-09-09, Version 26.8.2 (Current), @aduh95

Notable Changes

Commits

2026-08-26, Version 26.8.1 (Current), @aduh95

Notable Changes

Commits

2026-08-26, Version 26.8.0 (Current), @aduh95

Notable Changes

Commits

2026-08-05, Version 26.7.0 (Current), @aduh95

Notable Changes

Commits

2026-08-03, Version 26.6.0 (Current), @aduh95

Notable Changes

Commits

2026-07-29, Version 26.5.1 (Current), @RafaelGSS

Notable Changes

Commits

2026-07-08, Version 26.5.0 (Current), @richardlau

Notable Changes

New release key

Other notable changes

Commits

2026-06-24, Version 26.4.0 (Current), @aduh95

Notable Changes

Commits

2026-06-18, Version 26.3.1 (Current), @aduh95

Notable Changes

Commits

2026-06-01, Version 26.3.0 (Current), @aduh95

Notable Changes

Potential changes to macOS Universal Binary availability

Other notable changes

Commits

2026-05-20, Version 26.2.0 (Current), @aduh95

Notable Changes

Commits

2026-05-07, Version 26.1.0 (Current), @aduh95

Notable Changes

Experimental node:ffi module

Other Notable Changes

Commits

2026-05-05, Version 26.0.0 (Current), @RafaelGSS

Notable Changes

Temporal API

V8 14.6

Undici 8

Deprecations and Removals

Semver-Major Commits

Semver-Minor Commits

Semver-Patch Commits

528 KiB

Raw Permalink Blame History

Experimental `node:ffi` module