Update Node.js to v26.13.1 #111
No reviewers
Labels
No milestone
No project
No assignees
1 participant
Notifications
Due date
No due date set.
Dependencies
No dependencies set
Reference
MobiusReactor/TicTacToeV2!111
Loading…
Reference in a new issue
No description provided.
Delete branch "renovate/node-26.x"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
This PR contains the following updates:
26.4.0-alpine→26.13.1-alpine26.4.0-alpine→26.13.1-alpine26.4.0-trixie→26.13.1-trixie26.1.0→26.6.6Release Notes
nodejs/node (node)
v26.13.1: 2026-11-11, Version 26.13.1 'Lithium' (LTS), @aduh95Compare Source
This is a security release.
Notable Changes
Commits
7b777661f5] - build: respect OpenSSL's configured API level (Filip Skokan) #669534518c7501f] - crypto: fix builds with older OpenSSL 3.0 (Filip Skokan) #6693194b73673b8] - deps: brotli: cherry-picke230f47(liujiahui) #61003e315236158] - deps: update llhttp to 9.4.4 (Antoine du Hamel) nodejs-private/node-private#10388e714f7daa] - deps: update undici to 8.12.4 (Node.js GitHub Bot) #67272af48b1a4d5] - deps: update brotli to 1.2.1 (Node.js GitHub Bot) #6699060316405bb] - deps: update undici to 8.12.3 (Node.js GitHub Bot) #6699389b17baef4] - deps: update sqlite to 3.54.1 (Node.js GitHub Bot) #66816d14db811c7] - http: redact proxy credentials in invalid proxy URL errors (Matteo Collina) nodejs-private/node-private#10019183db64fe] - http2: retain streams during pending writes (Matteo Collina) nodejs-private/node-private#104062ae278a23] - http2: charge inbound DATA retained by streams to maxSessionMemory (Matteo Collina) nodejs-private/node-private#10007df134e2ce] - http2: retain buffers until socket writes finish (Matteo Collina) nodejs-private/node-private#10170ff0cf6749] - http2: release headers when a stream is removed (Matteo Collina) nodejs-private/node-private#1026a84a01ddb8] - http2: avoid overflowing ALTSVC buffers (Matteo Collina) nodejs-private/node-private#10353fc67dc056] - http2: detect streams abandoned by nghttp2 (Matteo Collina) #66641df4011dafe] - http2: guard against null write request on cancelled stream (Matteo Collina) #67252fa61009dc1] - https: isolate Agent TLS policy keys (Matteo Collina) nodejs-private/node-private#103640d3d8ddca] - permission: do not leak denied descendants in recursive fs.watch (RafaelGSS) nodejs-private/node-private#9676c85b8e371] - tls: fix remotely reachable TLS server crash (Tim Perry) nodejs-private/node-private#1018a8d6286949] - tls: disable resumption for mTLS with no session id context (Tim Perry) nodejs-private/node-private#1030e750e1fa02] - tls: don't allow renegotiation or HRR to change SNI (Tim Perry) nodejs-private/node-private#103097b1357f08] - tls: don't allow TLS resumption to change SNI (Tim Perry) nodejs-private/node-private#103066e72ec604] - tls: apply the CA of SNI contexts without a certificate (Matteo Collina) nodejs-private/node-private#1020940cae5c33] - tls,http: prevent nested parser execution from empty writes (Matteo Collina) nodejs-private/node-private#10218232390dd8] - tools: use vendored trust store inshell.nix(Antoine du Hamel) #673186c223db6e2] - zlib: handle params callback after destroy (Matteo Collina) nodejs-private/node-private#1037v26.13.0: 2026-10-28, Version 26.13.0 'Lithium' (LTS), @richardlauCompare Source
Notable Changes
This release marks the transition of Node.js 26.x into Long Term Support (LTS)
with the codename 'Lithium'. It will continue to receive updates through to
the end of April 2029.
Other than updating metadata, such as the
process.releaseobject, to reflectthat the release is LTS, no further changes from Node.js 26.12.1 are included.
If you are updating from an earlier Long Term Support release (e.g. Node.js 24
or 22 or earlier) please note that since Node.js 25 the official binaries for
Linux are linked against libatomic, which may need to be installed separately
depending on your Linux distribution.
v26.12.1: 2026-10-21, Version 26.12.1 (Current), @aduh95 prepared by @RafaelGSSCompare Source
This is a security release.
Notable Changes
BROTLI_DECODER_ERROR_FORMAT_BLOCK_SWITCH(Antoine du Hamel) – High0ed4268(Evgenii Kliuchnikov) – High93cd21e(Joyee Cheung)Commits
818e4ca061] - crypto: update root certificates to NSS 3.131.1 (Antoine du Hamel) #66877fd3c87ed43] - crypto: harden X.509 conversion and formatting (Filip Skokan) nodejs-private/node-private#966acffa610db] - crypto: reset random caches across snapshots (Filip Skokan) nodejs-private/node-private#9877895a5cd2d] - deps: update undici to 8.12.2 (Node.js GitHub Bot) #6672112daa54d2e] - deps: V8: backport93cd21e(Joyee Cheung) nodejs-private/node-private#9996a8b3db7e2] - deps: update c-ares to 1.34.9 (Node.js GitHub Bot) #66868a6040b50d9] - deps: brotli: cherry-pick0ed4268(Evgenii Kliuchnikov) nodejs-private/node-private#10026b78ea171d] - dns: validate resolve inputs for null bytes (James M Snell) nodejs-private/node-private#9840683ee5f7d] - http: ensure agent data guard works without I/O (James M Snell) nodejs-private/node-private#983e5cae10148] - Revert "module: synchronously load most ES modules" (Antoine du Hamel) #66786cc244131aa] - permission: check permission model in realpathSync (RafaelGSS) nodejs-private/node-private#9730392385841] - src: exposeBROTLI_DECODER_ERROR_FORMAT_BLOCK_SWITCH(Antoine du Hamel) nodejs-private/node-private#1002c273a408c9] - src: fix the fs permission tree node on wildcard nodes (James M Snell) nodejs-private/node-private#986a2caddd20e] - tls: reject chains containing blocked public keys (Ulises Gascon) #66871ad788ccd07] - tls: reject non-canonical IP addresses (Matteo Collina) nodejs-private/node-private#982cd4b05469c] - tls: fix ip normalization regression (James M Snell) nodejs-private/node-private#9855fa440e0d7] - tools: retry Gatekeeper check and stapling after notarization (Ryan Aslett) #66855745ad77156] - zlib: avoid caching invalid ZIP local headers (Matteo Collina) nodejs-private/node-private#981v26.12.0: 2026-10-14, Version 26.12.0 (Current), @richardlauCompare Source
Notable Changes
1ebd6d3677] - (SEMVER-MINOR) doc,lib,src: throw on missing WebAssembly or RX support (Paolo Insogna) #665337f1937d2b9] - (SEMVER-MINOR) http: add websocketMask() and websocketUnmask() (James M Snell) #66335Commits
30e76bb16a] - benchmark: fix input passed to subtle.digest in webcrypto-digest (Rafael Gonzaga) #66608adef72223a] - benchmark: fix buffer option in buffer read/write benchmarks (Rafael Gonzaga) #666042f498f08fe] - benchmark: add util.parseArgs benchmark (Rafael Gonzaga) #665994ce8412e18] - benchmark: fix url-searchparams-sort to sort a fresh list (RafaelGSS) #66535493bd6c66e] - benchmark,tools: fix napi benchmarks on GHA (Nigro Simone) #66423e4515552d6] - build: run QUIC CI for V8 changes (Yuya Inoue) #66602a888e51062] - build: support Python 3.15 (Mike McCready) #657502afab9a63b] - build: do not include shared gtest innodelink path (Antoine du Hamel) #66626f88c2f8ec6] - build,test: enable temporal support on no-ICU and system-ICU builds (Antoine du Hamel) #666975fd03e6fdf] - child_process: propagate config-file permission flags to children (Rafael Gonzaga) #66559f771134b07] - crypto: isolate provider EC PKCS8 encoding (Filip Skokan) #664134e00a293db] - crypto: remove key export and metadata locks (Filip Skokan) #66413bcd8018775] - crypto: remove verify setup key locking (Filip Skokan) #66413883250fee2] - crypto: remove KEM key locking (Filip Skokan) #664139d98805071] - crypto: remove RSA-OAEP key locking (Filip Skokan) #66413d6293e7bb1] - crypto: skip secret key mutex allocation (Filip Skokan) #664138d8af8003e] - crypto: keep the root cert store per Environment (Shelley Vohr) #66411c6f0614785] - crypto: remove select Web Crypto warnings (Filip Skokan) #66312e5360b5a08] - deps: update googletest to988ea2c(Node.js GitHub Bot) #666527eb230a2c1] - deps: update acorn to 8.19.0 (Node.js GitHub Bot) #66655af946ba8f3] - deps: update sqlite to 3.54.0 (Node.js GitHub Bot) #66663007872a85d] - deps: V8: cherry-pick8d14d49(Antoine du Hamel) #66627f44aec4966] - deps: update simdjson to 5.0.3 (Daniel Lemire) #666201a33e914e8] - deps: V8: cherry-pick7d5eb1d(inoway46) #665663294d51e5a] - diagnostics_channel: fix default callback context (Matteo Collina) #664815c602a5824] - doc: list futimes among fd APIs disabled by the permission model (Rafael Gonzaga) #66649eaeb4736c8] - doc: add Test Runner to list of built-in diagnostic channels (Vas Sudanagunta) #665630e1c99afae] - doc: document stream/iter behaviors and Node.js extensions (James M Snell) #66483846236367d] - doc: document URL and Uint8Array references in process.permission (Rafael Gonzaga) #66557fc3b067be7] - doc: clarify http Agent keepSocketAlive behavior (Efe Karasakal) #6625273a4e90ce2] - doc: document keepAliveTimeoutBuffer server option (Efe Karasakal) #66286bb816582af] - doc: fix request.reusedSocket timeout example (Efe Karasakal) #6628682223ab4d9] - doc: clarify revert PR label policy (Antoine du Hamel) #66529c6f59d4e8e] - doc: clarify node binary misuse after compromise (Rafael Gonzaga) #665308904178498] - doc: document linux-x64-musl build toolchain (Issac) #665231e8247a74e] - doc: run license-builder (github-actions[bot]) #66517b2773d5e4c] - doc: add missing return types in cluster.md (Daniel Pinto) #664531ebd6d3677] - (SEMVER-MINOR) doc,lib,src: throw on missing WebAssembly or RX support (Paolo Insogna) #66533c1073f31de] - ffi: fix exportArrayBuffer type check (Trivikram Kamat) #6645569148ee0ff] - fs: lock FileHandle on first read in pull() and pullSync() (James M Snell) #66483700c60a1cd] - fs: serialize FileHandle writer() async writes (James M Snell) #6648332833def1c] - http: reduce raw header name allocations (Roberto Bianchi) #664887f1937d2b9] - (SEMVER-MINOR) http: add websocketMask() and websocketUnmask() (James M Snell) #66335115731dda7] - http2: speed up response getHeaders (Roberto Bianchi) #66592447c36cb45] - lib: fix AbortSignal.any() nested composite leak (Darius) #666171722ced4b4] - lib: add --allow-fs-vfs to permission available flags (Rafael Gonzaga) #66554062ece77fc] - lib: fix benchmark record acknowledgement race (Filip Skokan) #6643005d0b14438] - lib: set exit code on failed node:bench run() (RafaelGSS) #665342cab299471] - lib: default node:bench warmup to 10 invocations (RafaelGSS) #6653683f507845d] - meta: bump nodejs/node-pr-labeler todfe5eb3(Soul Lee) #666066fbffd5ee5] - meta: bump codecov/codecov-action from 7.1.0 to 7.1.1 (dependabot[bot]) #66448bd567f8bd6] - module: fix require of imports with package map (Lazizbek Ergashev) #66565c442f471a5] - module: synchronously load most ES modules (Geoffrey Booth) #6253051f66f0134] - permission: keep explicit fs grants when dropping a covering directory (Rafael Gonzaga) #665561aa10d80e2] - process: mark process.finalization as release candidate (Matteo Collina) #66436dd4715a6ba] - querystring: fix value decoding after encoded keys (Ved Chaudhari) #665539648a6ba8e] - quic: reject closed stream writer writes with a TypeError (James M Snell) #66483d6f566baf8] - quic: give each BindingData its own allocator state (Shelley Vohr) #66411c3204c15bd] - quic: validate session close error codes (Christian Aurich Zanettini Martins) #663025b87354f5a] - quic: destroy stream on invalid promise body (Christian Aurich Zanettini Martins) #662609ef698c781] - sqlite: validate aggregate() name and options (Guilherme Araújo) #66463bbf41f8cfb] - sqlite: persist enableDefensive() across reopen (Trivikram Kamat) #6640454867cd25e] - sqlite: throw on oversized strings instead of aborting (Trivikram Kamat) #665214314cde48b] - src: release uv_fs_t in permission WildcardIfDir (Rafael Gonzaga) #665550e58916f08] - src: stop including simdjson.h from env.h (Daniel Lemire) #6662006f56a55bb] - src: use native CopyArrayBufferBytes for webstream buffer copy (René) #664002e3dd5bb63] - src: fix config file handling (Marco Ippolito) #66431cd86506bc2] - src: mark config file as stable (Marco Ippolito) #6643115ff9884e4] - stream: skip idle webstreams start and watchers (Matteo Collina) #664243f75c89fb8] - stream: add pipeToSync() failOnIncompleteClose option (James M Snell) #664836cecf140e7] - stream: do not fail the writer when pipeToSync() cannot close (James M Snell) #6648316833534b6] - stream: fix fromSync() async input error messages (James M Snell) #66483af41622ad8] - stream: reject closed fromWritable() writes with a TypeError (James M Snell) #664834b83c6c38e] - stream: accept explicit stream/iter budgets below 16384 (James M Snell) #66483f302fbd04a] - stream: reduce per-chunk overhead in stream/iter consumers (James M Snell) #664837ba60dcdbe] - stream: keep the original error when writer.fail() throws (James M Snell) #66483dcac51a7db] - stream: align pull() abort handling with the spec (James M Snell) #66483995dee6b6b] - stream: honor stream/iter protocols on function objects (James M Snell) #664836eaf91353a] - stream: do not hold back nested async data in from() (James M Snell) #6648369d44aedb4] - stream: bound pre-batched async values in from() (James M Snell) #664836b1e7c4cf1] - stream: guard shareSync() against re-entrant source reads (James M Snell) #664838a47365425] - stream: split oversized share batches under drop-oldest (James M Snell) #6648330cbc4e643] - stream: reject drop-newest backpressure in shareSync() (James M Snell) #6648342ae08594e] - stream: detach shareSync consumers on strict budget errors (James M Snell) #66483fa49de9ba6] - stream: keep share buffer when all consumers detach (James M Snell) #66483e6662cb904] - stream: fix Utf8Stream flush handling (James M Snell) #6647393596b1a9e] - stream: add dump()/dumpSync() for stream/iter (Ethan Arrowood) #655984ba6ce1b0c] - stream: port remaining SonicBoom tests for Utf8Stream (Matteo Collina) #66275cd8b5fa5b0] - test: tolerate async block count updates in test-fs-stat-bigint (Rafael Gonzaga) #6657630814ce991] - test: replace discard loops with dump() (Ethan Arrowood) #6559820441b8fc0] - test: run node-bench tools test sequentially (Filip Skokan) #663389618da6fe3] - test: remove duplicated cases in permission fs-read fixture (Rafael Gonzaga) #66450c348a4cb46] - test: run instantiateStreaming-bad-imports WPT (Filip Skokan) #663227d4fda6ba7] - test: honor allowed WPT promise rejections (Filip Skokan) #66322d4c87eb086] - test: scope Blob WPT failures to big-endian (Filip Skokan) #663227309ddf204] - test_runner: rerun failing todo tests in suites (Barak) #66605da908b3072] - test_runner: report load errors with --test-isolation=none (Lazizbek Ergashev) #66550b18e121625] - test_runner: add mock call assertions to t.assert (Guilherme Araújo) #664763d691ab75e] - tools: restore Python 3.14 for daily WPT (Filip Skokan) #66699714aca1ef6] - tools: switch to PGP and SHA256 in ICU updater (Antoine du Hamel) #66469fa9fca45e4] - tools: lint thread_local in src (Shelley Vohr) #66411dbc3e97847] - tools: copy hdr_histogram_internal.h in update-histogram.sh (Filipe Oliveira (Redis)) #665284760c27904] - tools: bump the eslint group in /tools/eslint with 5 updates (dependabot[bot]) #6644563c20ee58e] - vfs: add ComposableProvider for layered mounts (Matteo Collina) #66235ab057989af] - watch: strip underscore aliases of watch flags (Trivikram Kamat) #66365v26.11.1: 2026-10-07, Version 26.11.1 (Current), @aduh95Compare Source
Commits
2dc4638e85] - Revert "build: toggle doc-kit verbosity based on V" (Antoine du Hamel)3febbc54ec] - Revert "build, doc: move to redesign" (Antoine du Hamel)173250e2e7] - Revert "tools: bump the doc group in /tools/doc with 4 updates" (Antoine du Hamel)v26.10.0: 2026-09-22, Version 26.10.0 (Current), @aduh95Compare Source
Notable Changes
c0a42d23e5] - (SEMVER-MINOR) crypto: add crypto.parsePKCS12() (Brian Muenzenmeyer) #65627eb4fabe81e] - doc: add araujogui to collaborators (Guilherme Araújo) #6609064fb33d791] - (SEMVER-MINOR) ffi: load libraries from a mounted VFS (Matteo Collina) #659092b1701f810] - (SEMVER-MINOR) fs: add openAsBlobSync (greenhead) #65644080e76b3d7] - (SEMVER-MINOR) net: support sending net.BoundSocket to threads and child processes (Guy Bedford) #6472513e61f6ae6] - (SEMVER-MINOR) perf_hooks: implement SlidingWindowHistogram (James M Snell) #65825a326546094] - (SEMVER-MINOR) perf_hooks: implement qrde analysis support in Histogram (James M Snell) #658060306b0a71e] - (SEMVER-MINOR) sqlite: bind undefined to NULL (Trevor Burnham) #657093c999edef7] - (SEMVER-MINOR) src,lib: add util.markPromiseAsHandled (James M Snell) #65805f7d18ec360] - (SEMVER-MINOR) test: expand histogram test coverage (James M Snell) #658253ce4d23bbb] - (SEMVER-MINOR) util: implement util.throttle (James M Snell) #65899336f33ccc1] - (SEMVER-MINOR) util: implement debounce (James M Snell) #65899Commits
2bf082453b] - assert: fix TypeError on deepStrictEqual with null Map key or Set member (Sergey Sannikov) #64449c518831d00] - benchmark: add --csv option to compare.js with --analyze (James M Snell) #6592289bae46e68] - buffer: fix unaligned UTF-16LE decoding (Matteo Collina) #6590501cee9dcef] - build: do not use bundled simdutf when built with--shared-simdutf(Antoine du Hamel) #6589120606a4d19] - build: suppress OpenSSL asm warnings with clang (Richard Lau) #66023a76e97b5c5] - build: derive V8_LOGGING_LEVEL from dcheck_always_on (Joyee Cheung) #65744ac7fcf0cef] - build: sync cargo/rustc version warnings (Richard Lau) #65912f24a495b36] - build: fix quiet default for make builds (Shelley Vohr) #65826c4381765fe] - child_process: clear timeout timer on spawn-time error too (kishore280) #655068955781eeb] - crypto: remove redundentstd::movecall (Antoine du Hamel) #661110b88aa5a15] - crypto: read RSA-PSS restrictions from provider (Filip Skokan) #66108f90d3d3cb0] - crypto: skip private RSA parameters in key details (Filip Skokan) #6610897828d91db] - crypto: use provider EC group names (Filip Skokan) #661083de05da569] - crypto: fetch ciphers for private-key encoding (Filip Skokan) #66108ca8ee04594] - crypto: decode PKCS#1 keys through providers (Filip Skokan) #6610854a625e953] - crypto: derive keys through EVP_KDF (Filip Skokan) #66108971adece6a] - crypto: use names for asymmetric key algorithms (Filip Skokan) #65966bfb544eb00] - crypto: optimize and benchmark key preparation (Filip Skokan) #65892c0a42d23e5] - (SEMVER-MINOR) crypto: add crypto.parsePKCS12() (Brian Muenzenmeyer) #65627c58a4e0ba7] - crypto: add Hybrid KEMs to Web Cryptography (Filip Skokan) #6575970edf90851] - crypto: avoid EC reconstruction for signature sizing (Filip Skokan) #65908fab5dddd77] - crypto: avoid EC raw export reconstruction (Filip Skokan) #65908220a499614] - crypto: export EC JWK coordinates directly (Filip Skokan) #65908f1295e11db] - crypto: read EC curve metadata directly (Filip Skokan) #65908775173a5db] - crypto: optimize private EC JWK import (Filip Skokan) #65908e44669bb7d] - crypto: validate the limit of PBKDF2 iterations (Filip Skokan) #65704cd5a7611e9] - crypto: use primordials in HKDF info validation (Filip Skokan) #6570494affce749] - Revert "deps: V8: overridedepot_toolsversion" (Richard Lau) #66110870a366c49] - deps: V8: cherry-pick95efbaf(Igor Sheludko) #66020d62a452738] - deps: V8: backporta0607c5(Antoine du Hamel) #65891e8edeffe2d] - deps: update googletest to8eff9e3(Node.js GitHub Bot) #66009eb4fabe81e] - doc: add araujogui to collaborators (Guilherme Araújo) #660902fffb3872d] - doc: fix duplicate 'the' typo innode_platform.cc(Muhammad Al-Muzahid) #66058317abb8131] - doc: clarify sub-1000ms behavior in socket.setKeepAlive (Haram Jeong) #658691c12f815c2] - doc: remove obsolete mentioning of cl.exe on windows (Chengzhong Wu) #660382cc17dd67c] - doc: note that default signal handling resets the signal mask (Shelley Vohr) #658773a69cc1bf4] - doc: clarify QUIC async write backpressure (John Finnerty) #65947549694349d] - doc: clarify permission model scope for output paths (Rafael Gonzaga) #660043325ded3a8] - doc: fix sign-off format in AGENTS.md (Filip Skokan) #6595889aa2bd10c] - doc: fill in missing zstd docs (James M Snell) #658678d1ce4d477] - doc: add inoway46 as triager (Yuya Inoue) #655659a3697c5c7] - doc: document windowsHide for child_process.fork (Christopher Buss) #6588769911bf6b5] - doc: qualify directory read ordering for native fs (Trivikram Kamat) #658682d0c3fed12] - doc: add DOMException section to errors API reference (Avocado) #65206f744023cce] - doc: expand revert commit collaborator instructions (Mike McCready) #65848412399efd3] - doc: clarify supported Python releases (Mike McCready) #6585079331f5779] - doc: note that FreeEnvironment() runs a shared event loop (Shelley Vohr) #656916ddbb9982f] - doc,test: account for OpenSSL 4.1 behaviours (Filip Skokan) #6595664fb33d791] - (SEMVER-MINOR) ffi: load libraries from a mounted VFS (Matteo Collina) #6590907fcf1ed02] - ffi: throw ERR_INVALID_ARG_TYPE for wrong-typed pointer and size (Soul Lee) #65842b7406b0a9b] - fs: coerce FileHandle.read length like fs.read (Xia Chao) #65521cb9995be4d] - fs: honor dereference for symlinks nested in cpSync trees (Christian Aurich) #657312b1701f810] - (SEMVER-MINOR) fs: add openAsBlobSync (greenhead) #656449b3f1aa03f] - fs: throw on existing dir in cpSync with errorOnExist (Daijiro Wachi) #641242b502e0798] - fs: support removing read-only files in rmSync on Windows (Sparsh :)) #6445377d8f17ab1] - http: don't destroy socket after request completes (Barath Raj) #6595246f76ed57b] - http2: settle pending write callbacks on destroy (Matteo Collina) #66016205443721d] - http2: fix onread assert when destroying session from stream handler (Sankalp Thakur) #651167e1db4724a] - inspector: report an error when DOM storage is unavailable (Avocado) #6597395110712b8] - inspector: fix abort when two Environments own the inspector (Shelley Vohr) #658779fd3e6caa4] - inspector: fix crash when the IsolateData has no platform (Shelley Vohr) #65818cce2795ad7] - lib: fix AbortSignal.any() abort propagation (Yuya Inoue) #660142c0ccc0067] - lib: fix for FileHandle.readableWebStream (Patrick Dähne) #5884228acafe6a0] - lib: avoid repeat internal receiver checks (Filip Skokan) #65910b9b0e33923] - lib: avoid unsafe array iteration in cli table (Donghoon Kang) #658387f514d3310] - lib: fix shared buffer growability validation (Filip Skokan) #658457534117e38] - lib: optimize internal Web IDL dictionaries (Filip Skokan) #65857bdacc08fbe] - lib: validate sequence iterator objects (Filip Skokan) #658445b6ac71fb2] - lib: use Web IDL interface brand checks (Filip Skokan) #65846da341e2571] - lib,src: apply multiple updates to dtls implementation (James M Snell) #6551113eb4843d5] - meta: bump step-security/harden-runner from 2.21.0 to 2.21.1 (dependabot[bot]) #660440f759174af] - meta: bump github/codeql-action/upload-sarif from 4.37.9 to 4.38.0 (dependabot[bot]) #66046c75b830082] - meta: bump cachix/cachix-action (dependabot[bot]) #660471ada7055a4] - meta: bump github/codeql-action/init from 4.37.9 to 4.38.0 (dependabot[bot]) #660481ed8b05742] - meta: bump github/codeql-action/analyze from 4.37.9 to 4.38.0 (dependabot[bot]) #660499165abe840] - meta: bump github/codeql-action/autobuild from 4.37.9 to 4.38.0 (dependabot[bot]) #66050d03e7313cf] - meta: add joyeecheung as v8 currency strategic initiative champion (Joyee Cheung) #6596553d7592378] - meta: expand on collaborator restoration process (Chengzhong Wu) #65962fa972d02b2] - meta: add web-standards as webidl owners (Filip Skokan) #65856080e76b3d7] - (SEMVER-MINOR) net: support sending net.BoundSocket to threads and child processes (Guy Bedford) #647250d14c0e507] - path: removeStringPrototypeCharCodeAtfrom some methods ofposix(Wiyeong Seo) #5466813e61f6ae6] - (SEMVER-MINOR) perf_hooks: implement SlidingWindowHistogram (James M Snell) #65825a326546094] - (SEMVER-MINOR) perf_hooks: implement qrde analysis support in Histogram (James M Snell) #6580632401c2229] - perf_hooks: reuse buffer for uv metrics (Donghoon Kang) #659855e2fbfe0e5] - perf_hooks: validate import normalization offset (Matteo Collina) #659504743cd8d33] - quic: fix two small bugs in HTTP/3 stream internals (Tim Perry) #659700df54fb38f] - quic: improve stream cleanup & lookup (Tim Perry) #659447cf448889c] - quic: fix timeout regression from11ed325(James M Snell) #6602861a98e6512] - quic: fix readable stream truncation on stop-sending, abort & timeout (Tim Perry) #63967975cac593c] - quic: add promise to QuicStream for pending strms (Marten Richter) #65862ae29cc92ea] - quic: split headers out from src/quic/stream.{h/cc} (James M Snell) #65863833c58d9dc] - quic: fix crash in onStreamClose (Marten Richter) #6586184ecb21343] - quic: reject zero addressLRUSize (Christian Aurich) #65827293e69d065] - sqlite: throw on invalid URL path instead of abort (Guilherme Araújo) #660266f5fb76d0e] - sqlite: track registered user-defined functions (Trivikram Kamat) #65896baf112b639] - sqlite: always copy changeset before applying (Trivikram Kamat) #658700306b0a71e] - (SEMVER-MINOR) sqlite: bind undefined to NULL (Trevor Burnham) #657091f24901c0c] - src: fix-Wextrawarning inWriteFileSync(Antoine du Hamel) #66020b98787fe2d] - src: reuse crypto GetCipherInfo in DTLS session (Ilyas Shabi) #66022410093dbf7] - src: avoid union type-punning in trace values (Khaidi Chu) #659339ec030b1e7] - src: print exception thrown during primordial initialization (Joyee Cheung) #65991a0f99f1d6c] - src: support building with the V8 sandbox (Shelley Vohr) #6223727c62235d0] - src: ffi: create fast-call metadata Symbols lazily (Matteo Collina) #660155a5abd8fd0] - src: avoid copying SEA snapshot data (Colin McDonnell) #65876a05023f331] - src: fix crash on empty, foreign or truncated --snapshot-blob files (Shelley Vohr) #659554141e22606] - src: don't kill own process group on failed spawn (Lazizbek Ergashev) #6505405f4e54eda] - src: fix external reference list race between concurrent isolates (Shelley Vohr) #657791518b7d67f] - src: keep the first snapshot blob alive for later isolates (Shelley Vohr) #6577962e2bf025c] - src: detach cppgc wrappers from their Realm before it is freed (Shelley Vohr) #65778afc3e559d2] - src: fix Stop() terminating the next Environment on the isolate (Shelley Vohr) #65819f245e53b29] - src: seed V8 from the OS CSPRNG instead of OpenSSL's DRBG (Colin McDonnell) #65796830ca7df7a] - src: fix null pointer call when running without a startup snapshot (Shelley Vohr) #6582048158fba8c] - src: stop leaking a CppHeap in CommonEnvironmentSetup (Shelley Vohr) #657923c999edef7] - (SEMVER-MINOR) src,lib: add util.markPromiseAsHandled (James M Snell) #65805e5d2a336bd] - stream: destroy half-open sockets after iteration (Matteo Collina) #659864075161405] - stream: destroy Duplex.from async function on early return (Aman Chadha(IVIXMMI)) #659637d245cfd8d] - stream: fixup stream/iter to drop at most one entry per share call (James M Snell) #6602830e1f7651c] - stream: reject unbounded at SyncShare construction (James M Snell) #660280372056cd8] - stream: make share budget failures detach before throwing (James M Snell) #6602836cc238dce] - stream: make Broadcast.from abort its background pump (James M Snell) #660283134ca6f8e] - stream: update broadcast to retain buffered data with zero consumers (James M Snell) #6602804e5c282a1] - stream: fix async iteration of undefined chunks (Caleb Everett) #65969f81a1483b3] - stream: avoid promise allocation for parked transform writes (Matteo Collina) #65625aec01c5ae1] - stream: keep webstream stream states in fast-mode objects (Matteo Collina) #65625898cd55bdf] - stream: reject closed only after sink abort settles (Lazizbek Ergashev) #657275661526006] - stream: fix ERR_INVALID_STATE when cancelling Readable.toWeb() (Richard Scarrott) #62773fb8a97f46b] - stream: improve handling of falsy errors in stream/iter (James M Snell) #65864cfee7fa3d9] - stream: amortize writable buffer compaction (Gürgün Dayıoğlu) #6584715605210f8] - stream: create write request objects lazily (Matteo Collina) #64455619470a9ae] - stream: allocate stream read buffers from a slab (Matteo Collina) #644557e79c33354] - test: consolidate crypto provider cache coverage (Filip Skokan) #66108dcc9c3c02a] - test: avoid call tochmodSyncintest-fs-cp-async-file-modes(Antoine du Hamel) #66104dda22c06d7] - test: deflake test-run-watch-cwd-isolation-none-* (Antoine du Hamel) #66035d63928dda0] - test: move permission FFI test to native suite (Yuya Inoue) #6605980c1bf7fb5] - test: deflake user timing WPT assertions (Filip Skokan) #6603612116d1d70] - test: unskiptest-watch-create-isolation-none(Antoine du Hamel) #66041e90575cb4d] - test: deflake util.throttle tests (Filip Skokan) #66034f7d18ec360] - (SEMVER-MINOR) test: expand histogram test coverage (James M Snell) #65825bfa6d49b5c] - test: implement low-risk test optimizations (James M Snell) #65926c3307ebddf] - test: update WPT for WebCryptoAPI to55ce71b(Node.js GitHub Bot) #65813ee29c56993] - test: prevent parser reuse across close scenarios (Filip Skokan) #660178a27474044] - test: cover cpSync fast path timestamp preservation (Abhinandan Kumar) #6567889297305c0] - test: fix stderr Buffer assertion in exec encoding test (greenhead) #66008d4cb916624] - test: skip test-vfs-real-provider-watch.js on IBM i (SRAVANI GUNDEPALLI) #659876515db8ab6] - test: fix RSA/DSA wrong-passphrase flake (Filip Skokan) #65983fa19ecad9d] - test: improve sequential test performance (James M Snell) #659283666d6a238] - test: schedule WPT variants individually (Filip Skokan) #65984f2aa27d82d] - test: overlap SLH-DSA signature checks (Filip Skokan) #659802170207253] - test: unref cancelled broadcast source timer (Filip Skokan) #6598071a54aaf5f] - test: collect timeout signals explicitly (Filip Skokan) #659801a15aff897] - test: skip retries in DNS timeout coverage (Filip Skokan) #659805c7e6b4a6e] - test: synchronize ordered runner events (Filip Skokan) #6598037f24eddc9] - test: reuse fixed primes in DH tests (Filip Skokan) #65980831ec42bcc] - test: avoid idle HTTP/HTTPS connections (Filip Skokan) #65980f523342bcd] - test: close WebAssembly test HTTP servers (Filip Skokan) #65980f23847a122] - test: use named parameters in DH stress test (Filip Skokan) #659807131e3b437] - test: reduce ZIP64 stress test I/O (Filip Skokan) #65980e4ca72a984] - test: avoid allocations in external memory test (Filip Skokan) #659757fe64727a2] - test: cover experimental stream iterator builtins (Jungwon Sohn) #6596488ba17bae2] - test: deflake node-api test-free-called (Christian Aurich) #659486eee01fbae] - test: fix flaky common WPT inspector test (Yuya Inoue) #65937858702e51c] - test: skip C++ symbols in tick-processor-arguments (Philipp Dunkel) #65906472215ff9b] - test: try fixing windows build replacing WMIC (James M Snell) #659497f5168149c] - test: fix flaky test-bench-stream (Matteo Collina) #658749f2d544576] - test: move sqlite length validation out of the reentry test (Trevor Burnham) #6576975a9fa65ac] - test: fix flaky cleanup in http2 test (Tim Perry) #65701f8cdf05586] - test,benchmark: use OpenSSL feature helpers (Filip Skokan) #6576288b12c03cd] - test_runner: avoid reusing v8 serializers (Yuya Inoue) #659519b3085e660] - test_runner: fix quote escaping in JUnit (Jihwan) #6597102c2302c31] - tls: propagate singleUse to the secure context (Carlos Vinicius) #660252a8b5d9269] - tls: load all CRLs from a PEM bundle (Lazizbek Ergashev) #65577d141ddb8dc] - tls: defer re-entrant calls to SSL state machine from JS (Tim Perry) #65105b7fe779632] - tools: updatetools/v8for Python 3.13 (Richard Lau) #661096105b37a3d] - tools: bump eslint-plugin-jsdoc in /tools/eslint in the eslint group (dependabot[bot]) #66102060ed69df9] - tools: disable fortify warnings intest-shared(Antoine du Hamel) #66020f8b7a2ff41] - tools: clean up handling of shared libs inshell.nix(Antoine du Hamel) #658913c9586c1fc] - tools: group CodeQL GHA updates (Antoine du Hamel) #66057aa531a34f7] - tools: summarize auto-start-ci failures (Filip Skokan) #65979b7eef15f59] - tools: bump the eslint group in /tools/eslint with 6 updates (dependabot[bot]) #660458914947d7c] - tools: update pgo build doc for linux (Chengzhong Wu) #66024a5b1659d5b] - tools: avoid workflow shell interpolation (Filip Skokan) #66013caf0ee0d7b] - tools: use self-repository references (Filip Skokan) #66013d5880dcb05] - tools: correct Slack action version comments (Filip Skokan) #6601366f182f565] - tools: make checkout credential use explicit (Filip Skokan) #66013287ece3f22] - tools: pass author to commit message validator (Filip Skokan) #660126314ccf93b] - tools: reduce test runner timing overhead (Filip Skokan) #65980441350a867] - tools: do not download build tools when linting Nix files (Antoine du Hamel) #6596115f2549f74] - tools: bump js-yaml from 4.3.1 to 4.3.2 in /tools/eslint (dependabot[bot]) #659310e449d02a6] - tools: bump js-yaml from 4.3.1 to 4.3.2 in /tools/lint-md (dependabot[bot]) #6593281eba460b5] - tools: fix commit queue error summary matching (Filip Skokan) #65913e5bbcfdd78] - tools: lint PR commit messages without approval (Filip Skokan) #6587507ae602005] - tools: unlabel author ready on base branch conflicts (Filip Skokan) #65872e3ad68289a] - tools: improve benchmark build cache reuse (Filip Skokan) #6585946ddc0220d] - tools: apply feedback to and simplify contributor guidance workflow (Filip Skokan) #6578566fd78803d] - trace_events: fix abort when Node.js does not own the V8 platform (Shelley Vohr) #659543cb3c23a19] - typings: add task_queue internal binding types (Seongeun Lee) #65662c5c7036e7b] - typings: add timeoutInfo to TimersBinding (greenhead) #6581162fe96c166] - typings: add missing sea binding properties (이혜미) #65815e51673b4ed] - url: add Symbol.toStringTag to URLPattern (Khaidi Chu) #659253ce4d23bbb] - (SEMVER-MINOR) util: implement util.throttle (James M Snell) #65899336f33ccc1] - (SEMVER-MINOR) util: implement debounce (James M Snell) #6589916e3e7eff3] - vfs: add --vfs-mount and --vfs-load startup flags (Philipp Dunkel) #65748c50cb9a553] - vfs: write RealFSProvider files to open fd (Christian Aurich) #658851bbc5488a5] - vfs: close the fs hook gaps for mounted paths (Philipp Dunkel) #65852816790e0e5] - vfs: resolve symlinks when checking rename descendants (Trivikram Kamat) #65904a9149093df] - vfs: support renaming implicit ZIP directories (Trivikram Kamat) #65752cf5d4a8fe6] - vfs: reject statfs for missing paths (Trivikram Kamat) #65693de552bd044] - vfs: return FileHandle from fs.promises.open (Trivikram Kamat) #6573008f96f142e] - vfs: give ZipProvider option bags a null prototype (Philipp Dunkel) #658535c4d319028] - vfs: commit ZipProvider handles the way open(2) does (Philipp Dunkel) #6585329d3406b6c] - vfs: apply open(2) effects to ZipProvider handles (Philipp Dunkel) #65853e379c26a92] - vfs: align virtual file handles with open(2) (Philipp Dunkel) #658547cdf5f014a] - vfs: answer for unowned paths under reserved root (Philipp Dunkel) #658145e55085bc1] - zlib: reject invalid zstd dictionaries (James M Snell) #658674cdcf7f6a4] - zlib: fix zstd reset (James M Snell) #65867678ff3561a] - zlib: improve zstd decoding across chunk boundaries (James M Snell) #65865v26.9.0: 2026-09-16, Version 26.9.0 (Current), @aduh95Compare Source
Notable Changes
d414624dce] - (SEMVER-MINOR) crypto: add a generic MAC API (Filip Skokan) #655537ac458f802] - (SEMVER-MINOR) crypto: discover ciphers from OpenSSL providers (Filip Skokan) #654847c7e95a3bd] - (SEMVER-MINOR) crypto: discover hashes from OpenSSL providers (Filip Skokan) #654842d2f4f6d1a] - (SEMVER-MINOR) ffi: enable module by default (Matteo Collina) #65475657415c6df] - (SEMVER-MINOR) lib: implementnode:bench(James M Snell) #65606ebcfec2f0c] - (SEMVER-MINOR) perf_hooks: implement HistogrammeanCIAPI (James M Snell) #65606e1913630c3] - (SEMVER-MINOR) perf_hooks: add CBOR export/import for histogram exchange (James M Snell) #654348e9151c9f2] - (SEMVER-MINOR) src: let embedders supply a builtin code cache without a snapshot (Shelley Vohr) #65352889854f18b] - (SEMVER-MINOR) src,lib: implement experimental DTLS API (James M Snell) #631825198142c59] - (SEMVER-MINOR) vfs: integrate with CJS and ESM module loaders (Matteo Collina) #636535af9d72e7f] - (SEMVER-MINOR) worker: add support for Web Workers (Aviv Keller) #64894Commits
59dcad3f44] - (SEMVER-MINOR) benchmark: implement node:bench version of bench tools (James M Snell) #656066bdb6dd8fa] - benchmark: fix max-regressions detection in compare.js (James M Snell) #6558749d40091ba] - benchmark: add --analyze option to benchmark/scatter.js (James M Snell) #65594bd40a9a19a] - benchmark: add crypto class benchmarks (Filip Skokan) #655186bff2238f5] - buffer: pad aligned allocations by a multiple of 8 (Lazizbek Ergashev) #6560537d12946dd] - buffer: prevent abort on indexOf with lone surrogate needle (Rafael Gonzaga) #6543002f8eb3b2d] - build: add--shared-perfettoflag (Antoine du Hamel) #65614fe7032ec41] - build: enable V8 gdb/lldb plugin support (Chengzhong Wu) #65786109f2caf80] - build: allow linking shared dependencies in the GN build (Shelley Vohr) #6579755213fd8a8] - build: enable the V8 sandbox in shared-cage builds (Shelley Vohr) #62237120929a1b3] - build: add--shared-highwayconfigure flag (Antoine du Hamel) #65686c99af0942b] - build: add--shared-abseilconfigure flag (Antoine du Hamel) #65682431c2bf0eb] - build: define V8_CONTIGUOUS_COMPRESSED_RO_SPACE for shared cage (Shelley Vohr) #65464b6b5764c6e] - build: remove obsolete configure flags (Chengzhong Wu) #65456a623ee29d9] - build,src: make --use-largepages a no-op (Joyee Cheung) #653892f494cb7aa] - crypto: fix multi-prime RSA JWKs (Filip Skokan) #65649501d8ac815] - crypto: cache valid ECDH key pairs (Filip Skokan) #656153fd905ea8f] - crypto: add strict mode to --force-fips (Filip Skokan) #6564554b3cdb805] - crypto: add FIPS indicator diagnostics channel (Filip Skokan) #656453e6e931fc9] - crypto: fix public PKCS8 export error (한국) #65609d414624dce] - (SEMVER-MINOR) crypto: add a generic MAC API (Filip Skokan) #65553eef579047c] - crypto: validate JWK usages before key_ops (Filip Skokan) #655509a9b137a24] - crypto: fix private SPKI export error (Filip Skokan) #655509941fb5dab] - crypto: fix RSA-PSS oversized salt handling (Filip Skokan) #6555009b431596a] - crypto: correct CCM decryption FIPS error message (kyungrae) #65450e6b34e6f7a] - crypto: harden X509Certificate state (Filip Skokan) #65518a884b6ccbc] - crypto: optimize key slot caching (Filip Skokan) #65518fb512086d3] - crypto: add null checks for OPENSSL_INIT_new() (Nora Dossche) #63457656504ffc0] - crypto: prevent Hmac.digest() from returning uninitialized memory (Matteo Collina) #6511215e7884732] - crypto: avoid throwing CryptoKey brand checks (Filip Skokan) #655033302bec74a] - crypto: avoid throwing KeyObject brand checks (Filip Skokan) #655037ac458f802] - (SEMVER-MINOR) crypto: discover ciphers from OpenSSL providers (Filip Skokan) #654847c7e95a3bd] - (SEMVER-MINOR) crypto: discover hashes from OpenSSL providers (Filip Skokan) #654840539e90110] - deps: update googletest to283c175(Node.js GitHub Bot) #65833e34af820da] - deps: update simdjson to 4.6.11 (Node.js GitHub Bot) #658345fb7ffebc2] - deps: update zlib to 1.3.2.1-motley-285e94b (Node.js GitHub Bot) #6583505cdf1db62] - deps: V8: backport1a00890(Jakob Linke) #657648910f7914a] - deps: V8: backportc9c0abf(Jakob Linke) #65764e7fd388424] - deps: V8: backportebd1578(Marja Hölttä) #6576482715158b8] - deps: V8: backportf3d4d45(Olivier Flückiger) #657027003159885] - diagnostics_channel: lazily create tracing context (Romain Lanz) #65513a97def782f] - doc: clarify node:bench significance policy (James M Snell) #65631c74091647d] - doc: clarify isolation modes for node:bench (James M Snell) #656313ef81a676c] - doc: clarify measurement integrity details of node:bench (James M Snell) #656316b565d7b2c] - doc: clarify security triage dispositions and permission boundaries (Rafael Gonzaga) #65436724981287c] - (SEMVER-MINOR) doc: move histogram.burnRate to correct location in doc (James M Snell) #65434f8b627c09b] - doc: fix default limit of maxHeadersCount (Aryn H) #65472aa3d94fc1d] - doc: fix return types for sync methods (Chiang Fong Lee) #58575fe9f452ddd] - doc: document REPL DEP0185 throws and uncaught-exception behavior (Adrián Estrada) #649936b84ee66fa] - errors: validate constructor name (Christian Aurich) #65607ed1b629901] - events: fix weak listener retention overwrite (Aryan) #640247b4c17f723] - ffi: throw on missing memory helper arguments (Soul Lee) #65500cf78d4260e] - ffi: include SharedArrayBuffer in error message (Donghoon Kang) #657352d2f4f6d1a] - (SEMVER-MINOR) ffi: enable module by default (Matteo Collina) #65475bdcb6def4e] - ffi: validate DynamicLibrary getter receivers (Trivikram Kamat) #654155d24a8fe37] - fs: copy directory trees for fs.cp() on the thread pool (Shelley Vohr) #6548840bdf32d91] - fs: give directories created by cpSync the source directory's mode (Shelley Vohr) #654886ac1bc040f] - fs: write files in one thread pool round trip (Shelley Vohr) #65489b4b89c08c1] - fs: handle recursive watch setup races (Filip Skokan) #6569954a1311d9e] - fs: apply nocase to literal glob exclude patterns (Yusuke Hayashi) #648172130460831] - fs: improve performance of recursive directory read (Aviv Keller) #65524ab7f4c88b7] - fs: do not descend into symlinks for ** unless following symlinks (RafaelGSS) #65435e990324e7a] - fs: watch directories, not files, in recursive fs.watch fallback (Shelley Vohr) #65486b6db21972a] - fs: preserve directory timestamps in cp (Abhinandan Kumar) #65540d418ca140e] - fs: fix recursive watch error handling (Filip Skokan) #65635ea372bf9c9] - fs: cancel in-flight stat on abort (Mert Can Altin) #63142458664073e] - fs: fix rmSync error messages for non-ASCII paths (Yeaseen) #6123334b38235c3] - fs: add maxDepth option to glob (Alexander Lichter) #64003e3cc0d9313] - http: fast-forward teardown of unread messages (Matteo Collina) #65732f9175a212c] - http: coalesce chunked writes during auto-corking (GetThatCookie) #64987b4a7cd3efb] - http2: fix write deadlock exposed by larger window sizes (Tim Perry) #65440b7e97f6cfd] - http2: error for incomplete reads on RST, auto-drain, deprecate aborted (Tim Perry) #63249d62989dbdf] - http2: fix async context loss when trailers carry END_STREAM (Orgad Shaneh) #638148aba314f87] - https: limit proxy CONNECT response headers (Matteo Collina) #64545bea74e1cb5] - lib: put node:bench behind an --experimental-bench flag (James M Snell) #659202835523960] - lib: fixup node:bench handling of --require option (James M Snell) #65631aae83d87a4] - lib: improve diagnostic message support (James M Snell) #65631ba7baed423] - lib: have runFile honor permissions and accept URL/Buffer paths (James M Snell) #6563155103db988] - lib: add runFile api to node:bench (James M Snell) #656310a4c50eb76] - lib: add context.diagnostic api to node:bench (James M Snell) #65631476e25e864] - lib: addbench:planevent tonode:bench(James M Snell) #6563167cf0e556f] - lib: clarify mean in node:bench docs (James M Snell) #65631f85f72ad42] - lib: improve node:bench stream handling (James M Snell) #65631b32b09f56b] - lib: add runId, fileRunId, entryFile, namePath to node:bench (James M Snell) #656314b9b53f958] - (SEMVER-MINOR) lib: addnode:benchexplicit createRunner (James M Snell) #65606d9f18171f0] - (SEMVER-MINOR) lib: complete the implementation of node:bench and cli (James M Snell) #65606c39e20e9ca] - (SEMVER-MINOR) lib: implement bench/reporters (James M Snell) #65606657415c6df] - (SEMVER-MINOR) lib: implement node:bench (James M Snell) #6560646863a7f9c] - lib: useFloat16Arrayfrom primordials (Antoine du Hamel) #65702cbd0948138] - lib: defer source map payload decoding until first use (Shelley Vohr) #654901ddb1c8934] - lib: optimize async context frame activation (Tim Perry) #6551902f6feef7e] - lib: use validateArray for array arguments (JunHwan Choi) #65344962795ab8c] - lib: apply minor dtls cleanups (James M Snell) #63539c07b2ab8a9] - lib,benchmark: address multiple review issues (James M Snell) #6563154a5e25f72] - module: derive builtinModules from enabled builtin set (Jungwon Sohn) #65418c93a90cf12] - net: fix BlockList.fromJSON for IPv4-mapped IPv6 rules (Daijiro Wachi) #64125506d23b76f] - net: recognize bare IPv6 loopback addresses in isLoopback (Daijiro Wachi) #6361981cd6d7b78] - net: improve dtls cert verification (James M Snell) #6431451d094e26b] - node-api: make object property arrays const (Yilong Li) #65621875c7ecee2] - node-api: enter env context for async callbacks (Shelley Vohr) #65406ebcfec2f0c] - (SEMVER-MINOR) perf_hooks: implement Histogram meanCI API (James M Snell) #6560609b333bcc5] - perf_hooks: add missing resource timing attributes (greenhead) #65017e1913630c3] - (SEMVER-MINOR) perf_hooks: add CBOR export/import for histogram exchange (James M Snell) #6543467a78317dd] - permission: do not enforce fs and addons in audit mode (Issac) #6565919e69e5f72] - permission: support URL and Uint8Array as has()/drop() reference (Seungmin Nam) #65492168af4d8d7] - permission: block FileHandle fsync and fdatasync (Rafael Gonzaga) #65431855fff682f] - quic: stop guarding ngtcp2_recv_stop_sending callback field (René) #65688d30df2a3e1] - quic: reuse TLS pause machinery to drop event deferral & improve 0RTT (Tim Perry) #65522fce1b6a482] - quic: remove unused fin flag from blob reader wakeup (trivenay) #65315c721aabfb7] - quic: apply multiple fixes to flow control signaling (James M Snell) #653092c552cd32c] - quic: release stream arenas before cleanup (Trivikram Kamat) #65410487662717b] - sea: mount bundled assets as a virtual file system (Matteo Collina) #656750ec15a2a54] - sea: keep ELF segments on separate pages in --build-sea output (Shelley Vohr) #655641627fd6561] - sqlite: re-validate database state after reading options (Trevor Burnham) #6559518c3867d19] - sqlite: run backup completion in callback scope (Filip Skokan) #65666a77d738683] - sqlite: copy changeset before applying it (Matteo Collina) #65286b5f0558c84] - sqlite: reject closing a session from a callback (Trevor Burnham) #654545f95032859] - sqlite: keep sessions alive across SQLite callbacks (Trevor Burnham) #654652ce0e2eb10] - sqlite: throw on disposal of an in-use session (Guilherme Araújo) #65449f66ed89136] - src: fix use-after-free in CleanupHookThunkRun (Caleb Everett) #6563014613fdc3e] - (SEMVER-MINOR) src: fixup histogram and options linting issues (James M Snell) #656066db3f662cf] - src: fix startup snapshot reproducibility of InternalFieldInfo (Chengzhong Wu) #656848e9151c9f2] - (SEMVER-MINOR) src: let embedders supply a builtin code cache without a snapshot (Shelley Vohr) #65352760337aa5b] - src: fix live lock between environments with blocked requests (Ilyas Shabi) #65520f2a588c385] - src: apply IsolateSettings when using a snapshot (Shelley Vohr) #654072fd50ae915] - src: add re-entrancy guard to TriggerUncaughtException (Temuulen Undrakhbayar) #64327e260fd146c] - src: reuse cached strings in CompileSerializeMain (agape1225) #654530650dca863] - src: add missing vector include (Filip Skokan) #656226e9d44d1fe] - src: disable V8 external memory reasonable size check (Paul Bouchon) #655899c46e56303] - src: report libuv error when openAsBlob cannot stat (Paul Bouchon) #65517a0aaff6b07] - src: list scripts when--runhas no command (James Ross) #64606469590c155] - src: fixup manual new/delete usages (James M Snell) #653485902acf031] - src: make the options structs smaller with packed bits (James M Snell) #651450c24639a5a] - (SEMVER-MINOR) src, lib: add stats to dtls (James M Snell) #63182652fbc286e] - (SEMVER-MINOR) src,lib: add dtls interop tests (James M Snell) #63182889854f18b] - (SEMVER-MINOR) src,lib: implement experimental DTLS API (James M Snell) #6318276538d519c] - stream: use webidl validation semantics for args (James M Snell) #65658649a4aba93] - stream: ensure that stateful transforms preserve this (James M Snell) #6565823220992c0] - stream: fix nested async flushing with infinite sources (James M Snell) #656583ad1338139] - stream: ensure from() observes returned rejecting promise correctly (James M Snell) #65658cafdee6369] - stream: apply source normalization once at call time (James M Snell) #65658edb83cb620] - stream: make consumer signals on longer alter source precedence (James M Snell) #6565856bdd765df] - stream: make pipeTo source normalization independent of Writer (James M Snell) #65658037c07af2b] - stream: pre-aborted pipeTo now applies dest failure handling (James M Snell) #656587308492d48] - stream: ensure pre-existing writes drain before EOF and end() waits (James M Snell) #65658756773477b] - stream: ensure async dispoal after endSync awaits for drain (James M Snell) #65658042b951312] - stream: ensure factory signals remain active through closing (James M Snell) #656582dc09ca9ca] - stream: canWrite and ondrain now reflect physical capacity (James M Snell) #656589192fbb6dd] - stream: skip unobserved 'readable' emission at EOF (Matteo Collina) #65749dc25a61e7a] - stream: avoid per-chunk promises in webstream adapters (Matteo Collina) #6554882ae196af6] - stream: address stream/iter review feedback (James M Snell) #656523b37b48592] - stream: replace object sentinel with symbol (James M Snell) #65652b6424b6612] - stream: ensure pipeToSync requires synchronous close (James M Snell) #65652830fc81acf] - stream: cancel active stream/iter pulls (James M Snell) #6565230606908de] - stream: fix merge settlement tagging and falsy error tracking (James M Snell) #656527319198755] - stream: ensure full-close semantics when closed (James M Snell) #65652bf5acb783f] - stream: defend against re-entrancy in writev (James M Snell) #65652b01594f93a] - stream: ensure stability of stored metadata (James M Snell) #656527bfd81ab09] - stream: fixup writer to terminate on consumer return/throw (James M Snell) #65652dc2483c38d] - stream: ensure iterator cleanup on done, reject, etc (James M Snell) #65652f6fac6f7f0] - stream: fixup cancelation handling in pull() (James M Snell) #65652dfe0617e71] - stream: fix early drain after Utf8Stream reopen (Matteo Collina) #65633900fae0a24] - test: split test-bench-cli to try deflaking it (James M Snell) #6591931f4bd73b2] - test: make node:bench test samples survive a coarse clock (Shelley Vohr) #65780e0fa1893c3] - test: do not dump core in external memory limit test (Shelley Vohr) #6578000ad283b8d] - test: zero-fill buffers before the string length limit check (Christian Aurich) #6575570763fcc46] - test: expand test coverage of node:bench (James M Snell) #656315a38e6b115] - (SEMVER-MINOR) test: fix node:bench test timing (James M Snell) #65606536ae0e24b] - (SEMVER-MINOR) test: improve node:bench test coverage (James M Snell) #65606eec66d529c] - (SEMVER-MINOR) test: update bench tests to not fail on no-crypto (James M Snell) #65606ce7b349de5] - test: bump WPT webidl and interfaces (Filip Skokan) #65679ec96f8dc23] - test: update WPT for url toc23755a(Node.js GitHub Bot) #65651ebe2ac248b] - test: fix recursive fs.watch error fixture (Filip Skokan) #65683a19912ee8f] - test: update streams WPT (Jeong SeokChan) #6563814b5dfc63d] - test: removeconsole.logcall innode_run_list(Antoine du Hamel) #655723f67df139c] - test: expect node:ffi to be enabled by default (Matteo Collina) #65636b9ee2e67bf] - (SEMVER-MINOR) test: use native builder for legacy SEA tests (Filip Skokan) #6555353a29d0894] - test: use common spawnSync helpers in more tests (greenhead) #655525c680a50f4] - test: add coverage for removeEventListener boolean capture (Lazizbek Ergashev) #652456f99474912] - test: deflake fastutf8stream destroy and reopen tests (Christian Aurich) #655542342b2bf30] - test: cover Readable.from() sync iterator errors (jakecastelli) #655151e455a4ffe] - test: support inspecting WPTs in child processes (Filip Skokan) #655101f7cab588e] - test: document WPT runner workflows (Filip Skokan) #65510d39a902cec] - test: simplify test-worker-heap-profile.js (Donghoon Kang) #6537290d1b863f7] - test: keep WPT backend checks alive (Filip Skokan) #65320be60c34b52] - (SEMVER-MINOR) test: enable multi-global WPTs (Filip Skokan) #64894d04cfcda8e] - (SEMVER-MINOR) test: add opt-in process WPT runner (Filip Skokan) #64894715c21f805] - (SEMVER-MINOR) test: accomodate multi-global tests in WPT{Runner,TestSpec,Report} (Filip Skokan) #648949aa8489a01] - test: fix lint in dtls tests (Matteo Collina) #649026a3d8a6d9f] - tls: read the peer certificate chain without consuming it (Tony Gies) #656022e519f8fef] - tls,quic: commonize TLS cert handling between tls, dtls & quic (Tim Perry) #647112266c14051] - tools: add GHA workflow to test vendored Perfetto (Antoine du Hamel) #6561419779f121f] - tools: fix the list of globals in ESLint config files (Antoine du Hamel) #65281b57db8dfd3] - typings: add types for performance binding (Jungwon Sohn) #65574371e2260f4] - typings: add encodeIntoResults to EncodingBinding (greenhead) #65350417cdd8a77] - typings: add typing for permission binding (Seungmin Nam) #65385a82cc7097f] - url: align URLPatternInit dictionary conversion with WebIDL (Piyush Yadav) #654980e8f7b96b0] - util: canonicalize namespaced tags in inspect() (René) #63257acd2bb10ce] - v8: add setHeapProfileNearHeapLimit (Ilyas Shabi) #64676d0535b1041] - vfs: load native addons from a mounted file system (Philipp Dunkel) #65680ea6f70ba41] - vfs: fix rename over non-empty directory (Christian Aurich) #65613b4f6b3798a] - vfs: add ZipProvider (Philipp Dunkel) #649155198142c59] - (SEMVER-MINOR) vfs: integrate with CJS and ESM module loaders (Matteo Collina) #6365338192126e2] - worker: start worker threads from the built-in snapshot (Shelley Vohr) #6533656144ea80a] - worker: add ref/unref to web workers (Aviv Keller) #655077231c13b8a] - (SEMVER-MINOR) worker: add wpt tests for Web Workers (Aviv Keller) #648945af9d72e7f] - (SEMVER-MINOR) worker: add support for Web Workers (Aviv Keller) #64894069a1b1200] - zlib: avoid waiting for paused ZIP iterators (Trivikram Kamat) #65278v26.8.2: 2026-09-09, Version 26.8.2 (Current), @aduh95Compare Source
Notable Changes
616bd3fa26] - doc: deprecateServer.prototype._listen2innode:net(Antoine du Hamel) #65593ae1801eb55] - meta: refine the security vuln posture for experimental features (James M Snell) #6543809feba74c8] - deps: update Undici to 8.10.2 (Node.js GitHub Bot) #657887efdbe3eb9] - deps: update OpenSSL to 3.5.8 (Node.js GitHub Bot) #65542Commits
d8aedd6584] - build: skip dockit on riscv64 (Stewart X Addison) #622511899c274eb] - build: activate correct default flags for riscv64 (Stewart X Addison) #65708ec8a3be996] - build: derive NODE_ARCH from target_cpu in the GN build (Shelley Vohr) #65491b73118a507] - build,win: remove LTO parallelisation limit (Stefan Stojanovic) #6553509feba74c8] - deps: update undici to 8.10.2 (Node.js GitHub Bot) #65788e47c432dd6] - deps: upgrade npm to 11.19.1 (npm team) #655732fd6ce36a9] - deps: update corepack to 0.36.0 (Node.js GitHub Bot) #6565349dec2767a] - deps: update googletest to36ba75f(Node.js GitHub Bot) #65654676174a071] - deps: update simdjson to 4.6.9 (Node.js GitHub Bot) #656552f1b7fa0bb] - deps: update perfetto to 58.2 (Node.js GitHub Bot) #6565612acd0ad15] - deps: update zlib to 1.3.2.1-motley-5eb4d7e (Node.js GitHub Bot) #6549448631c80fb] - deps: update archs files for openssl-3.5.8 (Node.js GitHub Bot) #655427efdbe3eb9] - deps: upgrade openssl sources to openssl-3.5.8 (Node.js GitHub Bot) #65542bdc75900ee] - doc: replacenode:modulesdocumentation header (René) #6580044c8a499ba] - doc: clarify return type offs.mkdtemp*(Antoine du Hamel) #65743025fb5eeb0] - doc: updatechangelog-makerinstructions for releasing (Juan José) #657075f64847afa] - doc: add stability status tocrypto.setEngine(Antoine du Hamel) #65746299dee0cb9] - doc: remove outdated TLS authorized warning (Tim Perry) #65597e97dcc0278] - doc: fix brokenusinglink in ffi.md (Soul Lee) #656322c9cc7d237] - doc: fix some broken links (Antoine du Hamel) #655830c330ec329] - doc: fix stale TOC in maintaining-dependencies (greenhead) #655239c522a3a69] - doc: refactor the AI guidelines (Joyee Cheung) #6526946cbf1bf8c] - doc: fix triggerAsyncId() comment in async_hooks example (soreavis) #64583788904ff78] - doc: fix fsPromises.watch overflow value (Matt Radbourne) #646053d06ff19e8] - doc: clarify stream direction in options.stdio note (Avocado) #65236d334838379] - doc: clarify signal listener behavior (Som Samantray) #65243d55a2bd56a] - doc: add test reporter event lifecycle diagram (sangwook) #63780c17dfc87de] - doc: discourage AbortSignal cleanup for long-lived resources (Efe Karasakal) #64342616bd3fa26] - doc: deprecateServer.prototype._listen2innode:net(Antoine du Hamel) #655934e6d7e0ca6] - meta: cleanup targos emeritus changes (Antoine du Hamel) #65738a70cfe1747] - meta: bump github/codeql-action/init from 4.37.3 to 4.37.9 (dependabot[bot]) #65714e43a0ad4ce] - meta: bump github/codeql-action/autobuild from 4.37.3 to 4.37.9 (dependabot[bot]) #6571799e06288f1] - meta: bump actions/checkout from 7.0.0 to 7.0.1 (dependabot[bot]) #6571889662762b3] - meta: bump cachix/install-nix-action from 31.11.0 to 31.11.1 (dependabot[bot]) #657196b8f078672] - meta: bump actions/setup-node from 6.4.0 to 7.0.0 (dependabot[bot]) #657206c6fb18e63] - meta: bump step-security/harden-runner from 2.20.0 to 2.21.0 (dependabot[bot]) #657210e002e859f] - meta: bump github/codeql-action/upload-sarif from 4.37.3 to 4.37.9 (dependabot[bot]) #6572298aaffe4b9] - meta: bump github/codeql-action/analyze from 4.37.3 to 4.37.9 (dependabot[bot]) #65723d247cb2975] - meta: document collaborator automation (Filip Skokan) #65671ae1801eb55] - meta: refine the security vuln posture for experimental features (James M Snell) #65438fab81d15c3] - test: widen the gap in the resolver maxTimeout comparison (Shelley Vohr) #6578062e2a6265c] - test: fix the thread-spawn handshake in the WASI threads fixture (Shelley Vohr) #657807eb20b1810] - test: only count restarts after the write in watch emit-restarted test (Shelley Vohr) #6578014c3a77bc5] - test: ignore tunnel resets in proxy invalid-char-in-url test (Shelley Vohr) #65780ebc99e0560] - test: handle EPIPE in closed channel test (Christian Aurich) #657705e73a2ca79] - test: deflake test-permission-net-udp-handle (Christian Aurich) #65767beb669f7de] - test: deflake test-runner-coverage (Christian Aurich) #65728ef4b6bfa62] - test: set type=none on IBM i for empty source (Abdirahim Musse) #65545027eef0691] - test: deflake WASI poll timing checks (Filip Skokan) #65672a352b0e2fe] - test: skipfs-watch-recursive-delete-raceon AIX (Antoine du Hamel) #65698f9ce35aa43] - test: deflake test-inspect-async-hook-setup-at-inspect (Christian Aurich) #6558432281cec7b] - test: deflake test-watch-mode-restart-esm-loading-error (Christian Aurich) #6562379be5d61be] - test: avoid orphaned child on Windows abort test (Kirill Saied) #654518972b8540b] - test: fix link-local dgram scope assertion (Filip Skokan) #65629b7cd1d96de] - test: riscv64: skip node-api sea test (Stewart X Addison) #655697eeb9d0e57] - test: mark platform-specific tests as flaky (Filip Skokan) #65562649ac82bda] - test: account for varied OpenSSL CCM final behaviours (Filip Skokan) #65542050fb1a15d] - tools: bump @humanfs/node from 0.16.7 to 0.16.8 in /tools/eslint (dependabot[bot]) #657575314dda396] - tools: bump browserslist from 4.28.4 to 4.28.8 in /tools/eslint (dependabot[bot]) #657585938a08929] - tools: do not hardcodeyamllintpath (Antoine du Hamel) #65747d8408f7415] - tools: refine contributor guidance workflow (Filip Skokan) #65745196e372b69] - tools: bump the eslint group in /tools/eslint with 4 updates (dependabot[bot]) #657167e986b09f6] - tools: do not flag force push as invalid message (Antoine du Hamel) #65700837ce2ccef] - tools: do not hardcode path to Ruff (Antoine du Hamel) #656811c7149a96a] - tools: retry first-time contributor query (Filip Skokan) #65648bd310a2bea] - tools: query first-time contributor status (Filip Skokan) #65592ab7b57e547] - tools: offset GitHub crons by 3 minutes (Michaël Zasso) #6561262ece28eae] - tools: label PRs lacking second approval (Filip Skokan) #6553868227b4029] - tools: welcome first-time contributors (Filip Skokan) #65533490dc93e37] - tools: enable concurrency for eslint (Huáng Jùnliàng) #62352d794676217] - typings: fix fs_event_wrap start filename type (leah-1ee) #6566129e2b5a325] - typings: add fs_event_wrap internal binding types (leah-1ee) #656616357c8f56e] - typings: add stream_pipe internal binding types (Seongeun Lee) #65664569720ac7f] - typings: add profiler internal binding types (Seongeun Lee) #6566052ae89c69d] - typings: add ffi internal binding types (Donghoon Kang) #6573422c7469062] - typings: update zlib binding declarations (이혜미) #65639v26.8.1: 2026-08-26, Version 26.8.1 (Current), @aduh95Compare Source
Notable Changes
Out-of-band release to fix
node --versionwhich was reporting an alpha version.Commits
ebd35a9eec] - src: revert accidental alpha designation (Antoine du Hamel) #655680b0dd87fcc] - tools: fixtools/nix/list-requisites.sh(Antoine du Hamel) #65560v26.7.0: 2026-08-05, Version 26.7.0 (Current), @aduh95Compare Source
Notable Changes
58717685a1] - (SEMVER-MINOR) crypto: support loading private keys through STORE loaders (Filip Skokan) #6394944b940ee8c] - crypto: update root certificates to NSS 3.125 (Node.js GitHub Bot) #64746c1e4f7365e] - (SEMVER-MINOR) lib: add perfetto support (Chengzhong Wu) #6456511c2f9c642] - (SEMVER-MINOR) module: implementSymbol.disposeinModuleHooks(Remco Haszing) #63928a646319f61] - (SEMVER-MINOR) test_runner: add support for--test-coverage-include-all(avivkeller) #64830Commits
a2d3f891d3] - async_hooks: use validateBoolean for trackPromises (Soul Lee) #64731d7266cdd99] - benchmark: fix calibrate-n option handling (Luan Muniz) #641462e64293e3f] - buffer: use Clamp conversion in Blob slice (Donghoon Kang) #647395fda0958bd] - buffer: validate copyArrayBuffer offsets against buffer length (Ilia Alshanetsky) #639045298db40f9] - build: run perfetto build and test on GHA (Chengzhong Wu) #64721e3eac7cef9] - build: fix v8_use_perfetto source scraping (Chengzhong Wu) #64721ab5f076d7f] - build: bump rustc requirement to >=1.86 (Renegade334) #64543df608e061f] - (SEMVER-MINOR) build: perfetto-sdk (Chengzhong Wu) #6456574928adc46] - build,tools: fix shared library cross-compile (Kirill Saied) #6396358717685a1] - (SEMVER-MINOR) crypto: support loading private keys through STORE loaders (Filip Skokan) #6394958d13b6f3d] - crypto: preserve OpenSSL errors from KDF failures (Filip Skokan) #64776478a719cb5] - crypto: fix Argon2 bypassing FIPS mode (Filip Skokan) #6477644b940ee8c] - crypto: update root certificates to NSS 3.125 (Node.js GitHub Bot) #64746fde85237c7] - crypto: clarify missing cipher error (Filip Skokan) #64852c604d8846d] - crypto: reuse X509 issuer result (Filip Skokan) #64852c68c7d0112] - crypto: validate key generation options (Filip Skokan) #64852c36bb1d017] - crypto: fix Argon2 validation errors (Filip Skokan) #64852f61408bb27] - crypto: handle XOF output allocation failure (Filip Skokan) #648512b4053d046] - crypto: initialize KeyObjectData mutex eagerly (Filip Skokan) #648514b7b2adf44] - crypto: handle DH operation failures (Filip Skokan) #6485112170c3753] - crypto: use user-facing error for output encoding changes (Archkon) #64692474f06d550] - debugger: preserve overlapping CDP request state (Trivikram Kamat) #64467718cbe9497] - deps: upgrade npm to 11.19.0 (npm team) #64883657c6154b3] - deps: update ngtcp2 to 1.25.0 (Node.js GitHub Bot) #6494475a1fbeff9] - deps: update nghttp3 to 1.18.0 (Node.js GitHub Bot) #6494307d7cb7cd8] - deps: update minimatch to 10.2.6 (Node.js GitHub Bot) #64945f7d56359f1] - deps: update simdjson to 4.6.6 (Node.js GitHub Bot) #649428b06457cfb] - deps: update acorn to 8.18.0 (Node.js GitHub Bot) #649415919d01525] - deps: update googletest to1b6f64d(Node.js GitHub Bot) #649404a87ad6cff] - deps: update nghttp2 to 1.70.0 (Node.js GitHub Bot) #64939c96d76a7c8] - deps: update zlib to 1.3.2.1-motley-42c2f19 (Node.js GitHub Bot) #647442b59984c0f] - deps: V8: backport5177b10(avivkeller) #64631b839af91da] - deps: update ada to 4.0.0 (Node.js GitHub Bot) #6479070dedef942] - deps: update sqlite to 3.53.4 (Node.js GitHub Bot) #647457bc4c171f5] - deps: update Rust crates for V8 14.6.202.34-node.26 (Renegade334) #64543308c6b2ac3] - deps: V8: backport7d9b7e0(Manish Goregaokar) #645438eeae28e88] - deps: V8: backportc4d06ba(liujiahui) #63731bbd6fc58c4] - diagnostics_channel: grow native channel storage (Stephen Belanger) #64497ce8b292955] - doc: fix grammar and punctuation in dgram documentation (Kamal Rawal) #649571a413a60cf] - doc: fix grammar and editorial issues in addons documentation (Kamal Rawal) #6495263fbd59e64] - doc: formalize fn/name as part of TestOptions API (Christopher Hiller) #64946b263b0bca1] - doc: remove references toca/crlas per-context QuicSession options (René) #64769f37de14b27] - doc: fix typo in maintaining-dependencies.md (greenhead) #6489616cb77cdc8] - doc: add RafaelGSS as last security release stewards (Rafael Gonzaga) #64843335c28cd17] - doc: fix typos in documentation (greenhead) #64900d4bed8ca39] - doc: fix missing references in doc type map (Tim Perry) #64872e71d09d5f1] - doc: improve TestContext hook descriptions (Kamal Rawal) #648997089bd9ae4] - doc: add missing float32/float64 FFI type names (Soul Lee) #648748d3ae0830e] - doc: document stream.isDestroyed() (YspritanHyzygy) #64789a757e62af7] - doc: add contributing detail for git Signed-off-by trailer (Mike McCready) #648623e840f43ed] - doc: mark config-file as release candidate (Marco Ippolito) #6451670cd5df810] - doc: fix duplicated word in test snapshot docs (Kamal Rawal) #64837d5f36c7adc] - doc: remove obsolete cctest node.gyp instructions (Soul Lee) #64814a0bf29ea09] - doc: report proper return type on url.format (Brian Muenzenmeyer) #64806e655e42085] - doc: use ffi.suffix for library paths in examples (Junsoo Ha) #64805e0f0830dbc] - doc: document --permission-audit audit mode behavior (Adrián Estrada) #64791efbede6de0] - doc: clarify tlsSocket.authorized on resumption (soreavis) #64584db95655c4a] - doc: stabilize --disable-warning (Jean Michelet) #64742a8367200be] - doc: add MDN links for explicit resource management in fs (lluisemper) #595571c09165c2e] - doc: mention constructor check in deepStrictEqual (Sumit Kumar Das) #6201029709324e0] - doc: update technical priorities (Jacob Smith) #64505522a28e648] - doc: deprecation add more codemod (Augustin Mauroy) #63175c40aaa6539] - doc: run license-builder (Node.js GitHub Bot) #63918428e9bc50f] - ffi: fix crash in refCallback and unrefCallback (Trivikram Kamat) #6488133912103e7] - ffi: reject fast calls after library close (Trivikram Kamat) #64860b348ed7f92] - ffi: validate fast 32-bit integer argument ranges (Trivikram Kamat) #6469148f4cfb480] - ffi: fix optimized buffer conversions (Trivikram Kamat) #64639109ffcd4f3] - ffi: preserve link register in ppc64 trampoline (Trivikram Kamat) #64792aa3f168b31] - ffi: preserve strings during reentrant calls (Trivikram Kamat) #64551ca60942f38] - ffi: preserve uint8 semantics for bool fast calls (Trivikram Kamat) #645270fb1d2bd65] - ffi: validate fast integer argument ranges (Trivikram Kamat) #64614b250b40b30] - fs: key glob matcher cache by platform (Archkon) #64571e26891ec6a] - http: fix writableFinished and 'finish' after write errors (Tim Perry) #64847dfc192fdfb] - http: avoid aborting IncomingMessage signal on normal close (Archkon) #643926794441c85] - http: guard invalid timeout values in checkConnections (Efe Karasakal) #645066879aa4aa8] - http: propagate highWaterMark to ClientRequest OutgoingMessage (trivenay) #6465372448a82f4] - http2: avoid copying the options in respond() (Matteo Collina) #64265f6692da576] - http2: avoid per-write closures in kWriteGeneric (Matteo Collina) #642653ed37153f8] - http2: reduce per-request allocations (Matteo Collina) #64265bce92debba] - Revert "http2: avoid per-write closures in kWriteGeneric" (Antoine du Hamel) #64663b5d5dd74a1] - Revert "http2: avoid copying the options in respond()" (Antoine du Hamel) #6466319b9c14d60] - lib: fix AbortSignal.any() observed-composite leak (Paul Bouchon) #64481d3cada57c2] - lib: fix typo in comment in _http_client.js (agape1225) #64729c1e4f7365e] - (SEMVER-MINOR) lib: add perfetto support (Chengzhong Wu) #645656c2157522d] - loader: enforce path normalization before lookup (Maël Nison) #6391731522c41a7] - meta: bump actions/stale from 10.3.0 to 11.0.0 (dependabot[bot]) #6493588c8b8ef54] - meta: bump github/codeql-action/analyze from 4.36.2 to 4.37.3 (dependabot[bot]) #649349dcd759a84] - meta: bump github/codeql-action/autobuild from 4.36.2 to 4.37.3 (dependabot[bot]) #6493382ca02db3c] - meta: bump actions/setup-python from 6.3.0 to 7.0.0 (dependabot[bot]) #64932848e2287f2] - meta: bump github/codeql-action/init from 4.36.2 to 4.37.3 (dependabot[bot]) #64931ae8ad3b17b] - meta: bump Mozilla-Actions/sccache-action from 0.0.10 to 0.0.11 (dependabot[bot]) #649300b359cfa4c] - meta: bump cachix/install-nix-action from 31.10.6 to 31.11.0 (dependabot[bot]) #649293b4f980f4c] - meta: bump github/codeql-action/upload-sarif from 4.36.2 to 4.37.3 (dependabot[bot]) #64927d7ee9e9ea7] - meta: bump step-security/harden-runner from 2.19.4 to 2.20.0 (dependabot[bot]) #649267e80bbaaa9] - meta: bump ossf/scorecard-action from 2.4.3 to 2.4.4 (dependabot[bot]) #64925915cabbfcf] - meta: remove node_crates .gitignore (René) #647798e03c54347] - meta: add @nodejs/url as codeowner for node_url_pattern.* (Efe Karasakal) #6473711c2f9c642] - (SEMVER-MINOR) module: implement Symbol.dispose in ModuleHooks (Remco Haszing) #63928fffd8a76d0] - net: support TCP handle transfer on Windows (Matteo Collina) #64460fe9e0dbdc2] - net: support AF_UNIX paths in net.BoundSocket (Guy Bedford) #64399eb61b7ee1e] - permission: add unique warning codes (David Evans) #64414999a928822] - permission: support v8.setHeapSnapshotNearHeapLimit (Ilyas Shabi) #648087de3d095b6] - quic: fix stop sending behaviour & callback (Tim Perry) #647106289398bb2] - quic: fix coverage comment typo (Jungwon Sohn) #6448601510dc759] - quic: fix segfault after fragmented client hello (Tim Perry) #64720dcc348af97] - quic: serialize stream reset code as string (한만욱) #64577c25b8e3331] - readline: reduce createInterface overhead (Matteo Collina) #6458514e802d1cd] - sqlite: invalidate sessions when closing database (Trivikram Kamat) #64783279547b7da] - sqlite: check database state before calling SQLite (Trivikram Kamat) #64812bb86521a42] - sqlite: fix crash when a session outlives its database (Mohamed Sayed) #63797870f4997e7] - sqlite: fix use-after-free in Exec() and ApplyChangeset() (Matteo Collina) #64535a8ec5a9df7] - src: fix perfetto build on GetTraceFilePath (Chengzhong Wu) #647216cd643acaa] - src: implement MemoryRetainer protocol for ByteSource (Filip Skokan) #646608725e56928] - src: fix crash when writing odd-length hex string via Writev (RajeshKumar11) #63658e018f9a4a1] - (SEMVER-MINOR) src: add perfetto trace agent (Chengzhong Wu) #645650611d443ab] - (SEMVER-MINOR) src: rename legacy trace event headers (Chengzhong Wu) #645652897cc1d93] - (SEMVER-MINOR) src: fix trace macro compatibility (Chengzhong Wu) #64565d4d7172e10] - src: avoid using ToLocalChecked in crypto_hash (James M Snell) #6466853b7d48b47] - src: fix libuv assertion on windows (liuxingbaoyu) #6199969d10ed021] - src,test: disable trace events tests when perfetto is enabled (Chengzhong Wu) #647211b0597b4ef] - stream: cut per-chunk allocations in pipeTo (Matteo Collina) #648902632d606bb] - stream: preserve push signal abort reason (Trivikram Kamat) #64798d5358a75bc] - stream: skip zero-byte broadcast writes (Trivikram Kamat) #64772796c896fb4] - stream: honor AbortSignal in Writer.end() (Trivikram Kamat) #64727ff12b8e22e] - stream: use validateString for consumer encoding (Jungwon Sohn) #64754cfad2efb06] - stream: use the ring buffer for pending BYOB pull-into descriptors (Matteo Collina) #64818fe06bf56dc] - stream: fix uncatchable error closing half-open Duplex.toWeb() writable (Mohamed Sayed) #64161f2919dbb83] - test: unflake debugger and REPL tests (Matteo Collina) #64718a1c29174e8] - test: ensure assertions are reached on all tests (Antoine du Hamel) #64716b9e596f8e5] - test: reuse ffi.suffix instead of reimplementing it (Seongeun Lee) #64840c816918e14] - test: remove test-repl-user-error-handler from flaky (avivkeller) #646319d2f10ec54] - test: update WPT for url to4832db4(Node.js GitHub Bot) #6482975b80d0b7b] - test: update WPT for url tob63305b(Node.js GitHub Bot) #647909a139b3c86] - test: cover worker throwing primitive values (varshitha) #64365796acc8920] - test: mark test-repl-user-error-handler as flaky (Aviv Keller) #64612a646319f61] - (SEMVER-MINOR) test_runner: add support for --test-coverage-include-all (avivkeller) #648304368303e01] - test_runner: wait for filtered suite build (semimikoh) #6420870d11241a3] - test_runner: convert to uint during deserialization (Aviv Keller) #64706cafe7bffcc] - tls: fix SNICallback certificate selection (Matteo Collina) #647009ee05ec40f] - tools: bump the eslint group in /tools/eslint with 4 updates (dependabot[bot]) #649285f4b859932] - tools: bump brace-expansion from 5.0.7 to 5.0.9 in /tools/eslint (dependabot[bot]) #64904b5ced907b3] - tools: use 'readonly' for EventSource global (Honey Tyagi) #64787fd4460e34e] - typings: add heap_utils internalBinding types (Donghoon Kang) #648163bc0ee0492] - typings: remove isDataView from types binding (Archkon) #64738236d7ca965] - url: create URLPattern result properties in WebIDL order (Archkon) #647333def577ab4] - v8: report minor mark-sweep in GCProfiler (Archkon) #646885293abff73] - vfs: speed up recursive readdir test setup (Trivikram Kamat) #648134345185496] - vfs: make lchown update symlink metadata (Trivikram Kamat) #64573b6ab546de5] - wasm: register missing SetURL function (Archkon) #64679f322870bd1] - zlib: validate pledgedSrcSize as a safe integer (Archkon) #6460444042c20d4] - zlib: accept ArrayBuffer dictionary in Zstd (Ryuhei Shima) #64599v26.6.0: 2026-08-03, Version 26.6.0 (Current), @aduh95Compare Source
Notable Changes
5a36018abc] - doc: add MikeMcC399 as collaborator (Mike McCready) #646569b04f82d7b] - (SEMVER-MINOR) ffi: addgetCurrentEventLoop(Paolo Insogna) #64323bb51f2c960] - (SEMVER-MINOR) test_runner: addcontext.log()andtest:logevent (Moshe Atlow) #6438956ce83b3ee] - (SEMVER-MINOR) test_runner: reportentryFileinTestStreamevents (Moshe Atlow) #64309Commits
248ff9fa5c] - assert,util: fix TypeError on Maps with null keys (Paul Bouchon) #644413b5baceafe] - benchmark: add bytes variant to webstreams async-iterator (Matteo Collina) #642910a46d1ef66] - buffer: normalize lone "\r" in Blob native line endings (Daijiro Wachi) #64115d9ada18b70] - buffer: fix Blob.stream() leaking source buffer (semimikoh) #63577d05993bcf6] - build: merge multiple on download artifact (Chengzhong Wu) #646336c25ac909a] - build: extract temporal_capi crate directory name into gyp variable (René) #64482612f60c300] - cli: style node --help output with util.styleText (Adrián Estrada) #6448429a938ddbb] - crypto: preserve RSA-PSS legacy pubkey DER (Filip Skokan) #645472fde794357] - crypto: cleanse provider private key copies (Filip Skokan) #6454733a0e08d41] - crypto: handle incomplete RSA private keys (Filip Skokan) #6454711b4d505ef] - crypto: retain legacy DH validation (Filip Skokan) #645476e302041e1] - crypto: limit KangarooTwelveParams customization to 512 bytes (Filip Skokan) #64557195f103e87] - crypto: split OpenSSL 3, BoringSSL, and legacy backends (Filip Skokan) #64211ec67e24eee] - deps: update googletest tofa005b2(Node.js GitHub Bot) #6458732ffff88fd] - deps: histogram: cherry-pick62ea52b(StefanStojanovic) #64296e0664f1f09] - deps: update histogram to 0.11.10 (Node.js GitHub Bot) #64296cf0622bdd6] - deps: update amaro to 1.1.11 (Node.js GitHub Bot) #6458604c78b8b24] - deps: update timezone to 2026c (Node.js GitHub Bot) #6458859f4318976] - deps: V8: cherry-pick1158ae7(René) #64432e5ea7cd299] - deps: update googletest to8240fa7(Node.js GitHub Bot) #644390e7554cee4] - deps: update libffi to 3.7.1 (Node.js GitHub Bot) #6443846c9d724ad] - deps: update ngtcp2 to 1.24.0 (Node.js GitHub Bot) #642973519aac9af] - deps: enable OpenSSL asm support for riscv64 (Jamie Magee) #62606c09701218b] - deps: update c-ares to 1.34.8 (Node.js GitHub Bot) #64330ad2f3bc95b] - deps: upgrade npm to 11.18.0 (npm team) #64199d7a4b22c86] - deps: V8: backporta05321e(Chengzhong Wu) #642028679cff291] - deps: update zlib to 1.3.2.1-motley-8b3aa8a (Node.js GitHub Bot) #64295df5b1e10ba] - doc: remove unsupported syntax fromstream_iter.md(Antoine du Hamel) #646498a4ca9083f] - doc: clarify rules for adding new built-in modules (Antoine du Hamel) #646487d50fe6b7a] - doc: mention DEPENDENCY custom field for H1 reports (Rafael Gonzaga) #646348f415bf5fc] - doc: fix dnsPromises.lookup verbatim default (Shivam S) #64658c6378f724d] - doc: fix broken links and clean up type map (Antoine du Hamel) #646259b53ec19a2] - doc: fix typo in releases guide (Jihwan) #646215a36018abc] - doc: add MikeMcC399 as collaborator (Mike McCready) #64656d2c8acd764] - doc: use promote wording in release guide (Md Muhtasim Munif Fahim) #643715c692cb576] - doc: fix import.meta example for vm.SourceTextModule (Muhammad Zeeshan) #641127568ce71ca] - doc: mention crypto.hash() for better perf (Steven) #63420cf3f631936] - doc: update sea example by fixing wrong code example (Maxence Robinet) #64025ce21e567a4] - doc: fix socket.readyState state descriptions (YuSheng Chen) #64468018c7f1c01] - doc: replace large tables in crypto.md and webcrypto.md with lists (Filip Skokan) #64582cf82de8d8b] - doc: note --env-file is not applied to --run (Paul Bouchon) #64442e635ce5201] - doc: fix typo in embedding.md (greenhead) #644250b1f6eda3f] - doc: fix typos in contributing docs (Donghoon Kang) #64520d978ce80ef] - doc: document TLS alpnProtocol and servername fields (Tim Perry) #64362394669e3b3] - doc: fix spelling in devcontainer guide (한만욱) #644599786a593ea] - doc: clarify PEM format for signing keys (Harjoth Khara) #644046251f832ba] - doc: fix typo in tls.md (Daijiro Wachi) #64458b8656c40ad] - doc: document net Socket server property (Efe Karasakal) #6436403e9c738f3] - doc: update a Dispatcher undici doc link (Filip Skokan) #64358b6dd2debf0] - doc: fix typos in documentation (Jungwon Sohn) #644663b7d778c3c] - doc: clarify fixes and refs trailer guidance (Trivikram Kamat) #64421eb086a6e03] - doc: remove duplicate VirtualProvider description (Archkon) #64400bc221a8cd7] - doc: add scope overview tables for TestsStream events (Moshe Atlow) #643864b3dbd36df] - doc: clarify proxy threat model (Matteo Collina) #64366c5526f69d6] - doc: add note about restricted CI to pull-requests.md (Stewart X Addison) #64321968eaf6538] - doc: various updates to releases.md (Stewart X Addison) #641982a51f8ba8e] - doc: remove obsolete --napi-modules doc entry (Chengzhong Wu) #64220ee5a54535e] - doc,test: widen fsPromises.appendFile()'s data type, add missing tests (Jimmy Leung) #64279b923df86fc] - events: avoid retaining removed event names (Matteo Collina) #644757d8d413ff5] - events: optimize once() and removeListener() (Matteo Collina) #64373f2f8881d2a] - ffi: evaluate function signatures once (Trivikram Kamat) #645599b04f82d7b] - (SEMVER-MINOR) ffi: add getCurrentEventLoop (Paolo Insogna) #643234a3ef5b2b5] - fs: add pattern cache for matchGlobPattern() (bq) #63915ce113efcac] - fs: fix cp symlink and EEXIST handling on Windows (Kirill Saied) #643533be3041ac9] - http: fix perf_hooks detail.req.url port and proxied path (Stefano Baghino) #643110047ad73cf] - http: remove unused n arg from IncomingMessage._read (Efe Karasakal) #643704d48984d5c] - http2: don't throw when destroying socket proxy (Matteo Collina) #644273329647762] - http2: avoid copying the options in respond() (Matteo Collina) #64265a44fca5e24] - http2: avoid per-write closures in kWriteGeneric (Matteo Collina) #64265546e0e70a1] - inspector: add --cond to node inspect probe mode (Joyee Cheung) #64328b38a39dd96] - lib: useassignFunctionNameutil where it makes sense (Antoine du Hamel) #64515f60a12b94f] - lib,tools: addnode-core/func-name-matchinglint rule (Livia Medeiros) #579019e6e9d4745] - meta: lower stale to 3 months (Aviv Keller) #645693dd11c4993] - meta: move one or more collaborators to emeritus (Node.js GitHub Bot) #643153f55208104] - module: add two tests for eager imports when usingimport defer(Maya Lekova) #64197c791eedc9d] - net: support sync connect for BoundSocket (Guy Bedford) #643754df4a3fc61] - net: make TCP Server and Socket transferable across worker threads (Matteo Collina) #642255dd34d7d06] - path: add benchmarks for path.matchesGlob() (bq) #639158e520646b6] - quic: defer server session emit until TLS ClientHello is processed (Tim Perry) #641324b8cc9a3fb] - quic: preserve session stats after close (한만욱) #64489591090ca85] - quic: add support for TLS certificate compression (Sebastian Beltran) #64434d636c9c30f] - quic: extract transport logic from Application to Session (Tim Perry) #64127abb62f961f] - quic: correct http3 callback and fix revealed errs (Marten Richter) #642895f535fdbe8] - quic: fix no onstream handler crash quic (Efe) #64158933e5f14b5] - quic: fix stall datagrams, if no pending streams (Marten Richter) #64303272632a57f] - quic: fix potential crash from unobserved closed (Tim Perry) #641342d5f445489] - sqlite: read column count after step in StatementSync.all() (Guilherme Araújo) #6421954929af44e] - src: avoid redundant KEM encapsulation copies (Filip Skokan) #645535380bf28b3] - src: avoid redundant DataPointer reallocations (Filip Skokan) #645526ff5a1b834] - src: fix comment typos (Jungwon Sohn) #64509508ec0e435] - src: zero-initialize cap_data in node_credentials.cc (Samuel Kapust) #64347c5090a36c1] - src: fix some typo errors and rename some variables (Archkon) #643010a89bef69e] - src,permission: do not throw on denied access in audit mode (Adrián Estrada) #6442663e71195c5] - stream: abort pending single-source merge reads (Trivikram Kamat) #64445f403b30c3d] - stream: use RangeError for broadcast overflow (Trivikram Kamat) #644205c0578cbf7] - stream: skip null output from stateful transforms (Trivikram Kamat) #644620488d02d5d] - stream: update iterable streams to use budget backpressure (James M Snell) #64464f0811baeef] - stream: remove customCloneableDOMExceptionimplementation (Antoine du Hamel) #6446910f3f9682e] - stream: fix drop-newest behavior in share() (Trivikram Kamat) #644172aad973b29] - stream: resume flow when an errored pipe destination is removed (Mahin Anowar) #643106112ed5ceb] - stream: fold desired-size check into WHATWG backpressure update (Matteo Collina) #64451d829aa1138] - stream: validate writer options signal (Trivikram Kamat) #643858e7a5e940e] - stream: reject push iterator.throw() with error (Trivikram Kamat) #643804390f81294] - stream: simplify nestedPromisePrototypeThens (Antoine du Hamel) #64470ddf2c38e9d] - stream: use the ring buffer for WHATWG stream request queues (Matteo Collina) #64431518d81b36d] - stream: validate writevSync chunks before queuing (Trivikram Kamat) #64300f745c4261d] - stream: speed up reads and iteration over default WHATWG streams (Matteo Collina) #643204f4bce62fe] - stream: copy SAB-backed chunks in iter consumers (Trivikram Kamat) #64382f29937d26f] - stream: reject nested async streamables in from() (Trivikram Kamat) #64352424cec71b7] - stream: avoid draining merged iter sources (Trivikram Kamat) #64293e01906180c] - stream: use ring buffer for WHATWG stream queues (Yagiz Nizipli) #643120a0193f666] - stream: hoist repeated loads in readable paths (Yagiz Nizipli) #64312ebe16003b6] - stream: prefer sync iterator in fromSync (Trivikram Kamat) #64294f249614835] - stream: speed up async iteration over WHATWG byte streams (Matteo Collina) #642917331118699] - stream, quic: update iterable streams backpressure (James M Snell) #6446446b117729d] - test: update quic tests for stream/iter update (James M Snell) #64464b122ca5389] - test: fix flaky http2 socket proxy test (Tim Perry) #6467368c46146fd] - test: apply correction to comment (Rich Trott) #64524d7e119b26b] - test: keep finalization before-exit ref alive (Tim Perry) #645210db4e10a0c] - test: copyedittest-tls-psk-alpn-callback-exception-handling(Antoine du Hamel) #6348521389f7b25] - test: fix stale async-context-frame status entries (Kirill Saied) #64141af55304846] - test: update WPT for urlpattern to5847ee5(Node.js GitHub Bot) #6443643a5ce4e00] - test: update WPT for WebCryptoAPI toec2fee3(Node.js GitHub Bot) #6443511ca52a521] - test: fix flaky http2 maxOriginSetSize test (Tim Perry) #64407af08a11e77] - test: fix 2nd flaky blob test case (Tim Perry) #643910104ae1171] - test: fix flaky watch + cwd + argv test-runner test (Tim Perry) #64372b3ff5fe3f4] - test: normalize Windows crash in debugger test normalization (Joyee Cheung) #643324cdceb7436] - test: unmark flaky http2-large-file for Win (Kirill Saied) #6425519f529377b] - test: unmark flaky SEA snapshot tests on Windows (Kirill Saied) #6431766f9b342ef] - test: increase timeout in consumed-timeout test (Trivikram Kamat) #64204fdbbf0ae6d] - test: handle null stdio streams in spawnSyncAndAssert helper (Joyee Cheung) #6427310ea17dafe] - test: remove impact of tier-up changes in worker stack size test (Joyee Cheung) #64271bb51f2c960] - (SEMVER-MINOR) test_runner: add context.log() and test:log event (Moshe Atlow) #6438956ce83b3ee] - (SEMVER-MINOR) test_runner: reportentryFileinTestStreamevents (Moshe Atlow) #643097a02e4f9e6] - timers: do not retain a reference to the async store after firing (Matteo Collina) #534437d5d46ef00] - tls: match IPv6 hosts against IP-Address SANs (Pascal Garber) #64145f7bc0c62df] - tools: bump brace-expansion from 5.0.6 to 5.0.7 in /tools/eslint (dependabot[bot]) #646363f80ed2e93] - tools: reference 'git node land' in PR-URL: error message in merge.sh (Stewart X Addison) #644957b373cafce] - tools: disable zipping tarballs on GHA (Antoine du Hamel) #644235bdbd256e9] - tools: add workflow to compare Nix changes (Antoine du Hamel) #64410ca4a16634b] - tools: add option forbenchmark.ymlto post comment on PR (Antoine du Hamel) #6439586193ef193] - tools: fix redundant conditions in v8.gyp for riscv64 and loong64 (Jamie Magee) #62608ee460404be] - util: make MIMEParams accessors case-insensitive (Daijiro Wachi) #64123a63ee46ddd] - vfs: make recursive readdir iterative (AkshatOP) #6414937f93c3b15] - vfs: make lchmod update symlink mode (Trivikram Kamat) #64350ce54e2a9c8] - vfs: fix VirtualReadStream race with async iteration (Y1D7NG) #6439454e8d3a14b] - vfs: follow symlinked dirs in recursive mkdir (Trivikram Kamat) #642877be42b64e1] - vm: enable interception on global restricted properties (Chengzhong Wu) #64202c2cfcf8e7d] - zlib: reject truncated zstd input (Archkon) #64593v26.5.1: 2026-07-29, Version 26.5.1 (Current), @RafaelGSSCompare Source
This is a security release.
Notable Changes
Commits
af0bf96877] - deps: update llhttp to 9.4.3 (Paolo Insogna) nodejs-private/node-private#9350354678355] - deps: update undici to 8.9.0 (Node.js GitHub Bot) #64712dbeeaeec13] - (CVE-2026-58042) dns: handle large resolveAny address replies (RafaelGSS) nodejs-private/node-private#929064d339f56] - (CVE-2026-58044) http: reject requests exceeding max header count (Matteo Collina) nodejs-private/node-private#92223b94c843a] - (CVE-2026-56848) http2: defer rst stream while in scope (Matteo Collina) nodejs-private/node-private#921c7ec3dc0b9] - (CVE-2026-58040) https: bind identity checks to session reuse (Matteo Collina) nodejs-private/node-private#9048f666925b1] - (CVE-2026-56850) https: distinguish PFX object-array agent keys (RafaelGSS) nodejs-private/node-private#930ad99d075b1] - (CVE-2026-58043) permission: avoid granting radix split nodes (RafaelGSS) nodejs-private/node-private#91161222008b7] - (CVE-2026-58039) permission: check final report output path (RafaelGSS) nodejs-private/node-private#9083cb607dfc4] - (CVE-2026-56847) permission: enforce fs write permission for trace events (RafaelGSS) nodejs-private/node-private#924d08fde8a16] - (CVE-2026-58041) sqlite: invalidate tag store iterators on statement reset (Matteo Collina) nodejs-private/node-private#896b3fbb6e11f] - (CVE-2026-58045) zlib: throw on out-of-bounds write buffers (RafaelGSS) nodejs-private/node-private#931v26.5.0: 2026-07-08, Version 26.5.0 (Current), @richardlauCompare Source
Notable Changes
New release key
Welcome to our newest releaser, Stewart X Addison. Future Node.js releases may be signed with his release key,
655F3B5C1FB3FA8D1A0CA6BDE4A7D232B936D2FD.Other notable changes
55f48446c7] - (SEMVER-MINOR) buffer: implement blob.textStream() (Matthew Aitken) #64036b373202efc] - (SEMVER-MINOR) esm: add--experimental-import-textflag (Efe) #6230039e0c14455] - (SEMVER-MINOR) perf_hooks: sample delay per event loop iteration (Pablo Erhard) #62935999a83c937] - (SEMVER-MINOR) stream: expose ReadableStreamTee (Matteo Collina) #641954e0236dc3d] - (SEMVER-MINOR) tls: report negotiated TLS groups (Filip Skokan) #64119Commits
87648c0a6c] - benchmark: trim down the argon2 sets (Filip Skokan) #64218a483bfd3f0] - buffer: remove unreachable overflow check in atob (haramjeong) #601616d14279688] - buffer: add fast api for isUtf8 and isAscii (Gürgün Dayıoğlu) #6416955f48446c7] - (SEMVER-MINOR) buffer: implement blob.textStream() (Matthew Aitken) #64036a67d9a7a44] - build: allow linting node.1 (Aviv Keller) #6415706c1fbc25b] - build: enable Maglev for riscv64 (Jamie Magee) #62605518309c363] - build: suppress clang errors building libffi on Windows (René) #642226a80ab485c] - build: add manually-dispatched stress-test workflow (Joyee Cheung) #64118f4e7bf1f1c] - build: pin envinfo versions in github actions (Joyee Cheung) #6411766f6ac0d86] - build: support setting an emulator from configure script (Ivan Trubach) #538997f26c54aa6] - child_process: fix permission model propagation via NODE_OPTIONS (Matteo Collina) #6397232bb554f5b] - crypto: fix large DH generator validation (Tobias Nießen) #640920908d76ef6] - crypto: reject small-order EdDSA points during verify (Filip Skokan) #640267f7e5863c2] - deps: update undici to 8.7.0 (Node.js GitHub Bot) #64282af91029801] - deps: update nghttp3 to 1.17.0 (Node.js GitHub Bot) #641822e500ba7b0] - deps: update googletest to8b53336(Node.js GitHub Bot) #6418174e3aa24ba] - deps: update sqlite to 3.53.3 (Node.js GitHub Bot) #64180c7e57f55a7] - deps: c-ares: cherry-pick8ba37af(René) #64110879fdc4daf] - deps: V8: backportda20a19(Kevin Gibbons) #64101a640543a7c] - deps: V8: cherry-pick0cc9eb2(Kevin Gibbons) #64101feefd179e5] - deps: V8: cherry-pick1a391f9(Kevin Gibbons) #641018ef643d4b0] - deps: update googletest to0b1e895(Node.js GitHub Bot) #640399e50bb0655] - dgram: skip dns.lookup() for literal IP addresses (Ruben Bridgewater) #64133dc052c095c] - diagnostics_channel: return original thenable (Stephen Belanger) #62407a22a840293] - doc: clarify QUIC stream state wording (EduardF1) #636608d4bec2d71] - doc: update Http2SecureServer.on("timeout") default value (YuSheng Chen) #64187da88f70afa] - doc: add note on visibility of CI failures to new contributor guide (Stewart X Addison) #6425620ce359ccb] - doc: clarify HTTP/1.1 response ordering (Matteo Collina) #6421305eae2835c] - doc: recommend node-stress-single-test for flaky tests (Trivikram Kamat) #642233966eb67e7] - doc: fix typo in examples (Vas Sudanagunta) #6418412a2b9daa3] - doc: fix typo in node-config-schema.json (Hamid Reza Ghavami) #641880854482671] - doc: clarify defense-in-depth issues (Matteo Collina) #64215ef4915fc3a] - doc: fix Fast FFI argument count in ffi.md (Daijiro Wachi) #63960bb2eed863c] - doc: add sxa GPG key (ed25519) (Stewart X Addison) #64193b7bf6e3a06] - doc: add guide and answers to FAQs for first-time contributors (Joyee Cheung) #63685ff537ba858] - doc: updateHttp2Server.close&Http2SecureServer.close(YuSheng Chen) #63298f3db304588] - doc: update list of people inSECURITY.md(Richard Lau) #641522a126647b0] - doc: clarify vfs is not a sandbox (Matteo Collina) #6414385fc79dd9b] - doc: fix broken links and duplicate stability label (Antoine du Hamel) #64130189e830eb3] - doc: add missing option to man page (Richard Lau) #641567a16ccccd0] - doc: announce upcoming end of tier 2 support for macOS x64 (Antoine du Hamel) #63931d5f826045f] - doc: update toolchain for official AIX releases (Richard Lau) #6406860abc4400f] - doc: fix callback example import in fs docs (Kamal Rawal) #63912e470c74a6c] - doc: fix keepAliveTimeout default in http.createServer options (Jahanzaib iqbal) #63974851b460583] - esm: improve ERR_REQUIRE_ASYNC_MODULE (Joyee Cheung) #642600cd443df39] - esm: print required top-level await locations without evaluating (Joyee Cheung) #64154b373202efc] - (SEMVER-MINOR) esm: add--experimental-import-textflag (Efe) #62300eacfbd0ca5] - http: add CONNECT method handling for default Host header with proxy (Archkon) #64114aeb539a383] - http: fix drain event with cork/uncork (David Evans) #640388e8874b216] - http: document and validate options.path when it's in absolute-form (Joyee Cheung) #64108eb2e96bc28] - inspector: fix crash when writing to closed inspector socket (ympark2011) #64209243b0e4e57] - lib: reject string "0" in validatePort when allowZero is false (Daijiro Wachi) #6417434a537c0ed] - lib: use__proto__: nullwhen callingObjectDefineProperty(Antoine du Hamel) #642391f72393f19] - lib: lazily initialize kEvents and kHandlers maps (Guilherme Araújo) #6370292a3dc3191] - lib,permission: fix addon permission drop (Martin Wagner) #6400787b8f2a296] - meta: fix linter warning instale.yml(Antoine du Hamel) #64281829c4a5913] - meta: bump actions/cache from 5.0.5 to 6.1.0 (dependabot[bot]) #642480808dcd31c] - meta: bump github/codeql-action/autobuild from 4.36.1 to 4.36.2 (dependabot[bot]) #6424764aa17058f] - meta: bump github/codeql-action/analyze from 4.36.1 to 4.36.2 (dependabot[bot]) #64246873d1e0412] - meta: bump actions/checkout from 6.0.2 to 7.0.0 (dependabot[bot]) #64245fe460ccf0b] - meta: bump codecov/codecov-action from 6.0.1 to 7.0.0 (dependabot[bot]) #64244845c63ed50] - meta: bump rtCamp/action-slack-notify from 2.3.3 to 2.4.0 (dependabot[bot]) #642432cad2d6de5] - meta: bump github/codeql-action/init from 4.36.1 to 4.36.2 (dependabot[bot]) #642420ddde950c7] - meta: bump actions/setup-python from 6.2.0 to 6.3.0 (dependabot[bot]) #64241c0a8760d2f] - meta: bump github/codeql-action/upload-sarif from 4.36.1 to 4.36.2 (dependabot[bot]) #64240f49704b9d0] - meta: clarify V8 flags are outside threat model (Matteo Collina) #642246b8dc58e6e] - meta: move one or more collaborators to emeritus (Node.js GitHub Bot) #64057fe5260cca7] - meta: update status of past strategic initiatives (Joyee Cheung) #634807b01040008] - meta: speed up stale bot (Aviv Keller) #64075874c46c24f] - meta: update sccache version in test-linux-quic (René) #6404348c5c86363] - module: enable import support for addons by default (Chengzhong Wu) #6422139e0c14455] - (SEMVER-MINOR) perf_hooks: sample delay per event loop iteration (Pablo Erhard) #62935f90f1bd032] - perf_hooks: add NODE_PERFORMANCE_GC_MINOR_MARK_SWEEP constant (Attila Szegedi) #63877bdf32628c7] - process: fix finalization cleanup ref tracking (Trivikram Kamat) #640879a65b7fff4] - quic: drop version negotiation packets with oversized CIDs (Mohamed Sayed) #642282699fe4706] - quic: fixes undefined handle in QuicStream kInspect (Marten Richter) #6417000dea28bb3] - repl: lazy-load acorn and defer vm context creation (Daijiro Wachi) #63879ce659a1cf9] - src: fix escaping of single quotes in task runner (Antoine du Hamel) #64089dbb3126e5c] - src: abstract tracing agent for both legacy and perfetto (Chengzhong Wu) #6405312edf1d68d] - src: avoid redundant call tostd::get_if<>()(Tobias Nießen) #64094eda91b6d01] - src: avoid copying source string in TextEncoder.encode (Yagiz Nizipli) #63897efbbb9a03c] - stream: preserve half-open duplexes in async iteration (Efe) #64275999a83c937] - (SEMVER-MINOR) stream: expose ReadableStreamTee (Matteo Collina) #64195ab5ed72903] - stream: reject iter consumers on abort (Trivikram Kamat) #64066d3fa77c5e2] - stream: fix merge abort for pending sources (Trivikram Kamat) #6401338b99140ed] - stream: refactor unnecessary optional chaining away (Antoine du Hamel) #64253c81f894ebe] - stream: cut per-chunk overhead in WHATWG streams (Matteo Collina) #64252f162234f24] - stream: normalize Broadcast.from() byte inputs (Trivikram Kamat) #640821182ad8f3b] - stream: proxy first own method in Readable.wrap() (Daijiro Wachi) #64048d0b830b382] - stream: observe abort while awaiting pipeTo source (Trivikram Kamat) #64015f7adcd8359] - stream: respect iter consumer abort signals (Trivikram Kamat) #63997b09e624c6f] - test: make blob desiredSize assertion robust (Trivikram Kamat) #64106d0d8f0c774] - test: update WPT for urlpattern to11a459a(Node.js GitHub Bot) #64037ff9122c20c] - test: improve lcov reporter snapshot diagnostics (Trivikram Kamat) #64049570952d4f3] - test: keep finalization close fixture ref alive (Trivikram Kamat) #640851b4f213380] - test: fix typo from overriden to overridden (parkhojeong) #634034c91090b8b] - test: fix typo from funciton to function (parkhojeong) #63403bf080c7917] - test: mark hr-time WPT flaky on macos15-x64 (Trivikram Kamat) #6405424e32098c5] - test: use one-off agent in http consumed timeout test (Trivikram Kamat) #640523229886de2] - test: fix flaky test-runner coverage threshold test (Trivikram Kamat) #6405183b91ea6ec] - test_runner: filter execArgv fallback for child tests (Trivikram Kamat) #64056269b609a3d] - test_runner: improve coverage failure diagnostics (Trivikram Kamat) #640500342744c34] - test_runner: add timestamp to JUnit reporter testsuites (sangwook) #64029086741d121] - timers: reuse Timeout objects in setStreamTimeout (Matteo Collina) #642544e0236dc3d] - (SEMVER-MINOR) tls: report negotiated TLS groups (Filip Skokan) #641193bdd7e20be] - tls: handle large RSA exponents in X.509 cert (Tobias Nießen) #64093c96c838977] - tools: update RUSTC_VERSION for remaining GHA workflows (René) #64325ee873b7aaf] - tools: bumptemporal_rsversion (Antoine du Hamel) #63281ea3b870155] - tools: removeenvinfofrom our workflows (Antoine du Hamel) #64259d940f02e8b] - tools: bump the eslint group in /tools/eslint with 8 updates (dependabot[bot]) #64249fe0ea2bb5d] - tools: bump @node-core/doc-kit (dependabot[bot]) #640104dceefde1e] - tools: bump undici from 6.24.1 to 6.27.0 in /tools/doc (dependabot[bot]) #640316e187db7d7] - tools: update c-ares updater script (Antoine du Hamel) #64194657a35f5a2] - tools: validate version number in release proposal commit message lint (Antoine du Hamel) #6407017228a861c] - tools: add GHA benchmark runner (Antoine du Hamel) #602936d11a71d91] - tools: updatebuild-shared/action.ymlto a reusable workflow (Antoine du Hamel) #640597a17c50b7f] - tools: update libffi updater script (Antoine du Hamel) #6404628047a3e71] - tools: excludelibffichanges fromtest-sharedGHA CI (Antoine du Hamel) #6404758d9685acc] - typings: add typing for crypto (Filip Skokan) #641227a9dcad44d] - util: fix OOM in inspect color stack formatting (Ijtihed Kilani) #64022d5f01bbbde] - vfs: reject rename into descendant directory (Trivikram Kamat) #642850b6af91081] - vfs: handle current-position sentinel in memory files (Trivikram Kamat) #64163322230d641] - vfs: support writeFileSync with virtual fds (Trivikram Kamat) #641659395d209c7] - vfs: avoid recursive readdir symlink cycles (Matteo Collina) #64168bbdd7643b6] - vfs: read RealFSProvider files from open fd (Trivikram Kamat) #6410492859b8097] - vm: fix copying PropertyDescriptor (Chengzhong Wu) #640739046035475] - zlib: validate flush king for all streams (Ic3b3rg) #6374698be4304a3] - zlib: validate flush kind for brotli streams (Ic3b3rg) #6374690007a59a9] - zlib: expose rejectGarbageAfterEnd option (Filip Skokan) #640235933516066] - zlib: reject trailing gzip members in web streams (Filip Skokan) #64023Configuration
📅 Schedule: (UTC)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about these updates again.
This PR has been generated by Mend Renovate CLI.
e4d91c4feeto3a614663c03a614663c0tof43a30e5dff43a30e5dfto992c9c3e9bUpdate Node.js to v26.5.0to Update Node.js to v26.5.1992c9c3e9btodb46903f5dUpdate Node.js to v26.5.1to Update Node.js to v26.7.0db46903f5dto2fcafb1d762fcafb1d76tof0b6b7b3d8f0b6b7b3d8to87b50e83f9Update Node.js to v26.7.0to Update Node.js to v26.8.187b50e83f9toe81074f2e0e81074f2e0toc8e68af2b0c8e68af2b0to0061499088Update Node.js to v26.8.1to Update Node.js to v26.8.20061499088toec409837aaec409837aatode7d5dab67Update Node.js to v26.8.2to Update Node.js to v26.9.0de7d5dab67todaff2f553edaff2f553etod88ff4e4abUpdate Node.js to v26.9.0to Update Node.js to v26.10.0d88ff4e4abtoe888ab382ae888ab382ato15607168841560716884toc4a5bbc9f1Update Node.js to v26.10.0to Update Node.js to v26.11.1c4a5bbc9f1to6eb67983596eb6798359tof932131097Update Node.js to v26.11.1to Update Node.js to v26.12.0f932131097to06df4603f6Update Node.js to v26.12.0to Update Node.js to v26.12.106df4603f6tod49e4e6657Update Node.js to v26.12.1to Update Node.js to v26.13.0d49e4e6657to4d1b433c05Update Node.js to v26.13.0to Update Node.js to v26.13.1View command line instructions
Checkout
From your project repository, check out a new branch and test the changes.Merge
Merge the changes and update on Forgejo.Warning: The "Autodetect manual merge" setting is not enabled for this repository, you will have to mark this pull request as manually merged afterwards.