Notable Changes

• [616bd3fa26] - doc: deprecate Server.prototype._listen2 in node:net (Antoine du Hamel) #65593
• [ae1801eb55] - meta: refine the security vuln posture for experimental features (James M Snell) #65438
• [09feba74c8] - deps: update Undici to 8.10.2 (Node.js GitHub Bot) #65788
• [7efdbe3eb9] - deps: update OpenSSL to 3.5.8 (Node.js GitHub Bot) #65542

Commits

• [d8aedd6584] - build: skip dockit on riscv64 (Stewart X Addison) #62251
• [1899c274eb] - build: activate correct default flags for riscv64 (Stewart X Addison) #65708
• [ec8a3be996] - build: derive NODE_ARCH from target_cpu in the GN build (Shelley Vohr) #65491
• [b73118a507] - build,win: remove LTO parallelisation limit (Stefan Stojanovic) #65535
• [09feba74c8] - deps: update undici to 8.10.2 (Node.js GitHub Bot) #65788
• [e47c432dd6] - deps: upgrade npm to 11.19.1 (npm team) #65573
• [2fd6ce36a9] - deps: update corepack to 0.36.0 (Node.js GitHub Bot) #65653
• [49dec2767a] - deps: update googletest to 36ba75f0ad5383a9759f17f3f72fd4661c72cb6d (Node.js GitHub Bot) #65654
• [676174a071] - deps: update simdjson to 4.6.9 (Node.js GitHub Bot) #65655
• [2f1b7fa0bb] - deps: update perfetto to 58.2 (Node.js GitHub Bot) #65656
• [12acd0ad15] - deps: update zlib to 1.3.2.1-motley-5eb4d7e (Node.js GitHub Bot) #65494
• [48631c80fb] - deps: update archs files for openssl-3.5.8 (Node.js GitHub Bot) #65542
• [7efdbe3eb9] - deps: upgrade openssl sources to openssl-3.5.8 (Node.js GitHub Bot) #65542
• [bdc75900ee] - doc: replace node:modules documentation header (René) #65800
• [44c8a499ba] - doc: clarify return type of fs.mkdtemp* (Antoine du Hamel) #65743
• [025fb5eeb0] - doc: update changelog-maker instructions for releasing (Juan José) #65707
• [5f64847afa] - doc: add stability status to crypto.setEngine (Antoine du Hamel) #65746
• [299dee0cb9] - doc: remove outdated TLS authorized warning (Tim Perry) #65597
• [e97dcc0278] - doc: fix broken using link in ffi.md (Soul Lee) #65632
• [2c9cc7d237] - doc: fix some broken links (Antoine du Hamel) #65583
• [0c330ec329] - doc: fix stale TOC in maintaining-dependencies (greenhead) #65523
• [9c522a3a69] - doc: refactor the AI guidelines (Joyee Cheung) #65269
• [46cbf1bf8c] - doc: fix triggerAsyncId() comment in async_hooks example (soreavis) #64583
• [788904ff78] - doc: fix fsPromises.watch overflow value (Matt Radbourne) #64605
• [3d06ff19e8] - doc: clarify stream direction in options.stdio note (Avocado) #65236
• [d334838379] - doc: clarify signal listener behavior (Som Samantray) #65243
• [d55a2bd56a] - doc: add test reporter event lifecycle diagram (sangwook) #63780
• [c17dfc87de] - doc: discourage AbortSignal cleanup for long-lived resources (Efe Karasakal) #64342
• [616bd3fa26] - doc: deprecate Server.prototype._listen2 in node:net (Antoine du Hamel) #65593
• [4e6d7e0ca6] - meta: cleanup targos emeritus changes (Antoine du Hamel) #65738
• [a70cfe1747] - meta: bump github/codeql-action/init from 4.37.3 to 4.37.9 (dependabot[bot]) #65714
• [e43a0ad4ce] - meta: bump github/codeql-action/autobuild from 4.37.3 to 4.37.9 (dependabot[bot]) #65717
• [99e06288f1] - meta: bump actions/checkout from 7.0.0 to 7.0.1 (dependabot[bot]) #65718
• [89662762b3] - meta: bump cachix/install-nix-action from 31.11.0 to 31.11.1 (dependabot[bot]) #65719
• [6b8f078672] - meta: bump actions/setup-node from 6.4.0 to 7.0.0 (dependabot[bot]) #65720
• [6c6fb18e63] - meta: bump step-security/harden-runner from 2.20.0 to 2.21.0 (dependabot[bot]) #65721
• [0e002e859f] - meta: bump github/codeql-action/upload-sarif from 4.37.3 to 4.37.9 (dependabot[bot]) #65722
• [98aaffe4b9] - meta: bump github/codeql-action/analyze from 4.37.3 to 4.37.9 (dependabot[bot]) #65723
• [d247cb2975] - meta: document collaborator automation (Filip Skokan) #65671
• [ae1801eb55] - meta: refine the security vuln posture for experimental features (James M Snell) #65438
• [fab81d15c3] - test: widen the gap in the resolver maxTimeout comparison (Shelley Vohr) #65780
• [62e2a6265c] - test: fix the thread-spawn handshake in the WASI threads fixture (Shelley Vohr) #65780
• [7eb20b1810] - test: only count restarts after the write in watch emit-restarted test (Shelley Vohr) #65780
• [14c3a77bc5] - test: ignore tunnel resets in proxy invalid-char-in-url test (Shelley Vohr) #65780
• [ebc99e0560] - test: handle EPIPE in closed channel test (Christian Aurich) #65770
• [5e73a2ca79] - test: deflake test-permission-net-udp-handle (Christian Aurich) #65767
• [beb669f7de] - test: deflake test-runner-coverage (Christian Aurich) #65728
• [ef4b6bfa62] - test: set type=none on IBM i fo...

Notable Changes

• [71106e1f17] - crypto: update root certificates to NSS 3.126 (Node.js GitHub Bot) #65495
• [afca0a912d] - (SEMVER-MINOR) crypto: support loading private keys through STORE loaders (Filip Skokan) #63949
• [6274fccbd9] - deps: update OpenSSL to 3.5.8 (Node.js GitHub Bot) #65542
• [53cba013c7] - deps: update Undici to 7.29.1 (Node.js GitHub Bot) #65789
• [0529772798] - (SEMVER-MINOR) lib,src: improve histogram implementation (James M Snell) #65024
• [41c7062b81] - (SEMVER-MINOR) net: improve performance of net.BlockList (James M Snell) #64974
• [5197b5a3c5] - (SEMVER-MINOR) perf_hooks: add statistical hypothesis testing to histogram (James M Snell) #65416
• [35c635b032] - (SEMVER-MINOR) util: add non-throwing MIMEType.parse (James M Snell) #64965

Commits

• [84d706cb9b] - assert: improve documentation wording (Kamal Rawal) #64953
• [90d127db33] - (SEMVER-MINOR) benchmark: add --analyze mode to compare.js (James M Snell) #65416
• [ad1d7884c3] - benchmark: add test-only and mock timers cases (Luan Muniz) #64097
• [1d8f045914] - benchmark: apply highWaterMark in webstreams pipe-to (Matteo Collina) #65138
• [ed7ba3c993] - benchmark: complete the sqlite is-transaction fix (Edy Silva) #65218
• [c8837e1aa3] - benchmark: add test runner hooks and options (Luan Muniz) #63754
• [2ba8661e23] - buffer: prevent string write offset overflow (Matteo Collina) #65043
• [cc9ee6c2ae] - buffer: treat detached ArrayBuffers as empty (Archkon) #64504
• [5a5d73e4c5] - build: pass target architecture to small-icu genccode (ulofiai) #65095
• [273e72d1a5] - build: deprecate always enabled --enable-static (Chengzhong Wu) #65103
• [89a67246e3] - build: check FIPS option value in node.gyp (Filip Skokan) #64982
• [2d21f41cd5] - build: handle malformed OpenSSL macros (Filip Skokan) #64982
• [f62bc0f862] - build,win: add PGO workload scripts (Stefan Stojanovic) #63696
• [33d0c7dc12] - child_process: keep SIGWINCH from killing on Win (Kirill Saied) #64510
• [71106e1f17] - crypto: update root certificates to NSS 3.126 (Node.js GitHub Bot) #65495
• [419af8b86d] - crypto: fix missing error checks on ASN1_STRING_to_UTF8() (Nora Dossche) #65200
• [8029383f3f] - crypto: use available BoringSSL APIs (Filip Skokan) #65423
• [a9bd780e19] - crypto: remove obsolete BoringSSL shims (Filip Skokan) #65423
• [7defefad3f] - crypto: read WebCrypto inputs through primordials (Filip Skokan) #65115
• [6ed1e38627] - crypto: fix disabling FIPS mode (Filip Skokan) #64982
• [afca0a912d] - (SEMVER-MINOR) crypto: support loading private keys through STORE loaders (Filip Skokan) #63949
• [9b9dd6e9cf] - debugger: wait for target startup (Filip Skokan) #65194
• [07faaeeffd] - deps: update corepack to 0.36.0 (Node.js GitHub Bot) #65653
• [53cba013c7] - deps: update undici to 7.29.1 (Node.js GitHub Bot) #65789
• [0268ca547c] - deps: update archs files for openssl-3.5.8 (Node.js GitHub Bot) #65542
• [6274fccbd9] - deps: upgrade openssl sources to openssl-3.5.8 (Node.js GitHub Bot) #65542
• [6bdcd121fa] - deps: update zlib to 1.3.2.1-motley-8002e91 (Node.js GitHub Bot) #65316
• [c2aa446b6d] - deps: update simdjson to 4.6.7 (Node.js GitHub Bot) #65318
• [3e58e48ea8] - deps: update googletest to 49495eacfdbda3f4b6ba219923fedbb2e3f99376 (Node.js GitHub Bot) #65317
• [670b3665c0] - deps: cherry-pick libuv/libuv@e640dc9 (ulofiai) #65118
• [ca1c67b021] - deps: float ICU-23262 patch for icu78 (René) #64678
• [4ad043b0aa] - deps: enable AVX-512 OpenSSL asm with clang (Daniel Lemire) #65136
• [96b4af109b] - deps: update googletest to d89aac5f0dd4021198d903d39de16f896726de21 (Node.js GitHub Bot) #65153
• [774f663c56] - dgram: don't swallow bind errors when callback is provided (armanmikoyan) #62602
• [94b118d62e] - diagnostics_channel: validate before channel activation (Trivikram Kamat) #65313
• [09788665bd] - dns: validate address type in lookupService (Lazizbek Ergashev) #64878
• [15f95fc0e2] - dns: validate port range in setServers() (René) #65021
• [37b9e9a154] - dns: fix crash on setServers with port 0 (Lazizbek Ergashev) #65009
• [cd6205fa0d] - doc: update AHAFS reference link (Taeuk Ha) #65481
• [0e6f9ae42e] - doc: fix property names in os.networkInterfaces() example (Jihwan) #65469
• [034a827b41] - doc: fix broken links in cli.md (Donghoon Kang) #65412
• [eb364621d4] - doc: remove outdated WASI version fallback (이혜미) #65303
• [b13f425bf8] - doc: fix broken GYP link in n-api.md (Donghoon Kang) #65413
• [45c4011067] - doc: document that an empty OPENSSL_CONF skips config loading (Orgad Shaneh) [#64949](#6494...

Notable Changes

Out-of-band release to fix node --version which was reporting an alpha version.

Commits

• [ebd35a9eec] - src: revert accidental alpha designation (Antoine du Hamel) #65568
• [0b0dd87fcc] - tools: fix tools/nix/list-requisites.sh (Antoine du Hamel) #65560

Notable Changes

• [74234ee30e] - (SEMVER-MINOR) benchmark: add --analyze mode to compare.js (James M Snell) #65416
• [4232997fa2] - crypto: update root certificates to NSS 3.126 (Node.js GitHub Bot) #65495
• [f0531f1c87] - (SEMVER-MINOR) crypto: enable SIV and GCM-SIV modes in Cipher/Decipher APIs (Filip Skokan) #63411
• [3f4b80ebb5] - diagnostics_channel: mark TracingChannel as stable (Abdelrahman Awad) #64525
• [753033c110] - (SEMVER-MINOR) lib,src: improve histogram implementation (James M Snell) #65024
• [3d7d277493] - (SEMVER-MINOR) net: improve performance of net.BlockList (James M Snell) #64974
• [9e8e9080fd] - (SEMVER-MINOR) perf_hooks: add statistical hypothesis testing to histogram (James M Snell) #65416
• [c18b0aa54e] - repl: add basic syntax highlighting (Aviv Keller) #64591
• [58ea88e1d3] - (SEMVER-MINOR) sqlite: add StatementSync.prototype.close() (Guilherme Araújo) #64232
• [7c61b08aed] - (SEMVER-MINOR) sqlite: add StatementSync.prototype[Symbol.dispose]() (Guilherme Araújo) #64232
• [4299cd5897] - (SEMVER-MINOR) util: add non-throwing MIMEType.parse (James M Snell) #64965
• [df48191061] - (SEMVER-MINOR) zlib: add ZipEntry, ZipFile, and ZipBuffer (Philipp Dunkel) #64339

Commits

• [162257b403] - assert: improve documentation wording (Kamal Rawal) #64953
• [74234ee30e] - (SEMVER-MINOR) benchmark: add --analyze mode to compare.js (James M Snell) #65416
• [2cb96dd462] - benchmark: add test-only and mock timers cases (Luan Muniz) #64097
• [562168f93f] - benchmark: apply highWaterMark in webstreams pipe-to (Matteo Collina) #65138
• [fbec4eb386] - benchmark: complete the sqlite is-transaction fix (Edy Silva) #65218
• [d8acfc45f1] - benchmark: add test runner hooks and options (Luan Muniz) #63754
• [13e7d54f67] - buffer: prevent string write offset overflow (Matteo Collina) #65043
• [615273deac] - buffer: support aligned allocations (Robert Nagy) #65003
• [bc6b630e21] - buffer: treat detached ArrayBuffers as empty (Archkon) #64504
• [ddf9f9d265] - build: target Power 9 and z14 (Richard Lau) #65439
• [fda8ee894e] - build: use build-ci for benchmark merge-commit rebuild (Yagiz Nizipli) #65362
• [03692786ef] - build: add simdutf dir to include path in GN build (Shelley Vohr) #65382
• [3da555a3ed] - build: pass target architecture to small-icu genccode (ulofiai) #65095
• [ffe1e7cbea] - build: update binary-upload to use correct tarball name (Stewart X Addison) #65282
• [50174cb94a] - build: deprecate always enabled --enable-static (Chengzhong Wu) #65103
• [28f662b424] - build: check FIPS option value in node.gyp (Filip Skokan) #64982
• [29a2ecefeb] - build: handle malformed OpenSSL macros (Filip Skokan) #64982
• [6deeef1801] - build: enable perfetto updater (Chengzhong Wu) #64966
• [312f0c6a7e] - build: add host toolset to perfetto_sdk (Ryuhei Shima) #64751
• [1a4f5e537b] - build,win: add PGO workload scripts (Stefan Stojanovic) #63696
• [21655dccbc] - child_process: keep SIGWINCH from killing on Win (Kirill Saied) #64510
• [4232997fa2] - crypto: update root certificates to NSS 3.126 (Node.js GitHub Bot) #65495
• [f0531f1c87] - (SEMVER-MINOR) crypto: enable SIV and GCM-SIV modes in Cipher/Decipher APIs (Filip Skokan) #63411
• [109566a2f7] - crypto: fix missing error checks on ASN1_STRING_to_UTF8() (Nora Dossche) #65200
• [501f81612d] - crypto: improve SubtleCrypto.supports() accuracy (Filip Skokan) #65222
• [137ff67fd3] - crypto: use available BoringSSL APIs (Filip Skokan) #65423
• [0e87576ed4] - crypto: remove obsolete BoringSSL shims (Filip Skokan) #65423
• [af867ce3e4] - crypto: add mgf1Hash for RSA-OAEP (Adam Mcgrath) #65073
• [66ee4792bf] - crypto: disable non-FIPS WebCrypto paths in FIPS mode (Filip Skokan) #65172
• [6a142c03e9] - crypto: read WebCrypto inputs through primordials (Filip Skokan) #65115
• [92e3110462] - crypto: fix disabling FIPS mode (Filip Skokan) #64982
• [d69bed2f49] - debugger: wait for target startup (Filip Skokan) #65194
• [5c7c0b8b15] - deps: update zlib to 1.3.2.1-motley-8002e91 (Node.js GitHub Bot) #65316
• [4cb6b1335e] - deps: update simdjson to 4.6.7 (Node.js GitHub Bot) #65318
• [a39ad67482] - deps: update googletest to 49495eacfdbda3f4b6ba219923fedbb2e3f99376 (Node.js GitHub Bot) #65317
• [46762dad57] - deps: cherry-pick libuv/libuv@e640dc9 (ulofiai) #65118
• [abb7a15a8d] - deps: update perfetto to 57.2 (Node.js GitHub Bot) #65114
• [ebd8c6ba52] - deps: float ICU-23262 patch for icu78 (René) #64678
• [f2cc681109] - deps: enable AVX-512 OpenSSL asm with clang (Daniel Lemire) #65136
• [f45dc92913] - deps: update undici to 8.10.0 (Node.js Gi...

Notable Changes

• [b12bcc9ae1] - (SEMVER-MINOR) async_hooks: add using scopes to AsyncLocalStorage (Stephen Belanger) #61674
• [e2eb88b36b] - (SEMVER-MINOR) buffer: add end parameter (Robert Nagy) #62390
• [1fefdda18e] - crypto: update root certificates to NSS 3.125 (Node.js GitHub Bot) #64746
• [4a158cf1ab] - doc: add MikeMcC399 as collaborator (Mike McCready) #64656
• [d4cafce076] - (SEMVER-MINOR) lib,permission: add permission.drop (Rafael Gonzaga) #62672
• [b3cfb55267] - (SEMVER-MINOR) loader: implement package maps (Maël Nison) #62239
• [cd1eb3e60b] - (SEMVER-MINOR) src,permission: add --permission-audit (RafaelGSS) #61869
• [28dc85d8d2] - (SEMVER-MINOR) stream: add node:stream/iter implementation (James M Snell) #62066
• [d31c168740] - (SEMVER-MINOR) test_runner: add context.log() and test:log event (Moshe Atlow) #64389
• [add1edbc42] - (SEMVER-MINOR) test_runner: report entryFile in TestStream events (Moshe Atlow) #64309
• [d937c8c6cd] - (SEMVER-MINOR) wasm: enable JSPI (Guy Bedford) #59941

Commits

• [1822c0f335] - assert,util: fix TypeError on Maps with null keys (Paul Bouchon) #64441
• [b12bcc9ae1] - (SEMVER-MINOR) async_hooks: add using scopes to AsyncLocalStorage (Stephen Belanger) #61674
• [984260bf44] - async_hooks: use validateBoolean for trackPromises (Soul Lee) #64731
• [ba2612cca2] - benchmark: fix calibrate-n option handling (Luan Muniz) #64146
• [236dc4d2d7] - benchmark: add bytes variant to webstreams async-iterator (Matteo Collina) #64291
• [b022a1419c] - benchmark: respect stream/iter broadcast backpressure (Trivikram Kamat) #63314
• [a290f51f15] - (SEMVER-MINOR) benchmark: add benchmarks for experimental stream/iter (James M Snell) #62066
• [465f2bfb74] - buffer: use Clamp conversion in Blob slice (Donghoon Kang) #64739
• [74a22cd0c5] - buffer: validate copyArrayBuffer offsets against buffer length (Ilia Alshanetsky) #63904
• [21e24208dc] - buffer: normalize lone "\r" in Blob native line endings (Daijiro Wachi) #64115
• [ddacb3ff10] - buffer: fix Blob.stream() leaking source buffer (semimikoh) #63577
• [49198d2313] - buffer: fix end parameter bugs in indexOf/lastIndexOf (Robert Nagy) #62711
• [e2eb88b36b] - (SEMVER-MINOR) buffer: add end parameter (Robert Nagy) #62390
• [e2e5c4fe88] - build: update binary-upload to use correct tarball name (Stewart X Addison) #65282
• [b78a212553] - build: pin envinfo versions in github actions (Joyee Cheung) #64117
• [094fb840aa] - build: add QUIC CI job for PRs matching QUIC related paths (Tim Perry) #63875
• [91f5003cad] - build: fix flags for ngtcp2 on IBM i (SRAVANI GUNDEPALLI) #60073
• [e83648effd] - build,test: add tests for binary linked with shared libnode (Joyee Cheung) #61463
• [4a425b41d9] - build,tools: fix shared library cross-compile (Kirill Saied) #63963
• [fe8fa45ff2] - cli: style node --help output with util.styleText (Adrián Estrada) #64484
• [3cd1576cb2] - crypto: preserve OpenSSL errors from KDF failures (Filip Skokan) #64776
• [74b3023565] - crypto: handle XOF output allocation failure (Filip Skokan) #64851
• [fea0666a1b] - crypto: clarify missing cipher error (Filip Skokan) #64852
• [33fec91b54] - crypto: reuse X509 issuer result (Filip Skokan) #64852
• [44c1473348] - crypto: validate key generation options (Filip Skokan) #64852
• [c2c53a18e5] - crypto: fix Argon2 validation errors (Filip Skokan) #64852
• [edc1f2126d] - crypto: initialize KeyObjectData mutex eagerly (Filip Skokan) #64851
• [be8237240c] - crypto: handle DH operation failures (Filip Skokan) #64851
• [b65a8f3875] - crypto: preserve RSA-PSS legacy pubkey DER (Filip Skokan) #64547
• [49f2ae204b] - crypto: cleanse provider private key copies (Filip Skokan) #64547
• [a5d4ac8208] - crypto: handle incomplete RSA private keys (Filip Skokan) #64547
• [b72c0b9616] - crypto: retain legacy DH validation (Filip Skokan) #64547
• [24a1be5886] - crypto: limit KangarooTwelveParams customization to 512 bytes (Filip Skokan) #64557
• [0290e0a61e] - crypto: split OpenSSL 3, BoringSSL, and legacy backends (Filip Skokan) #64211
• [ba27e72ff8] - crypto: fix Argon2 bypassing FIPS mode (Filip Skokan) #64776
• [1fefdda18e] - crypto: update root certificates to NSS 3.125 (Node.js GitHub Bot) #64746
• [c0dd022081] - crypto: use user-facing error for output encoding changes (Archkon) #64692
• [ff485a9410] - crypto: make --use-system-ca per-env rather than per-process (Aditi) #60678
• [1329d9b9f1] - debugger: preserve overlapping CDP request state (Trivikram Kamat) #64467
• [82a02336aa] - deps: V8: backport d259a9e2ead7 (Leszek Swirski) #63865
• [[f0fc82d404](f0fc82d404...

Notable Changes

• [58717685a1] - (SEMVER-MINOR) crypto: support loading private keys through STORE loaders (Filip Skokan) #63949
• [44b940ee8c] - crypto: update root certificates to NSS 3.125 (Node.js GitHub Bot) #64746
• [c1e4f7365e] - (SEMVER-MINOR) lib: add perfetto support (Chengzhong Wu) #64565
• [11c2f9c642] - (SEMVER-MINOR) module: implement Symbol.dispose in ModuleHooks (Remco Haszing) #63928
• [a646319f61] - (SEMVER-MINOR) test_runner: add support for --test-coverage-include-all (avivkeller) #64830

Commits

• [a2d3f891d3] - async_hooks: use validateBoolean for trackPromises (Soul Lee) #64731
• [d7266cdd99] - benchmark: fix calibrate-n option handling (Luan Muniz) #64146
• [2e64293e3f] - buffer: use Clamp conversion in Blob slice (Donghoon Kang) #64739
• [5fda0958bd] - buffer: validate copyArrayBuffer offsets against buffer length (Ilia Alshanetsky) #63904
• [5298db40f9] - build: run perfetto build and test on GHA (Chengzhong Wu) #64721
• [e3eac7cef9] - build: fix v8_use_perfetto source scraping (Chengzhong Wu) #64721
• [ab5f076d7f] - build: bump rustc requirement to >=1.86 (Renegade334) #64543
• [df608e061f] - (SEMVER-MINOR) build: perfetto-sdk (Chengzhong Wu) #64565
• [74928adc46] - build,tools: fix shared library cross-compile (Kirill Saied) #63963
• [58717685a1] - (SEMVER-MINOR) crypto: support loading private keys through STORE loaders (Filip Skokan) #63949
• [58d13b6f3d] - crypto: preserve OpenSSL errors from KDF failures (Filip Skokan) #64776
• [478a719cb5] - crypto: fix Argon2 bypassing FIPS mode (Filip Skokan) #64776
• [44b940ee8c] - crypto: update root certificates to NSS 3.125 (Node.js GitHub Bot) #64746
• [fde85237c7] - crypto: clarify missing cipher error (Filip Skokan) #64852
• [c604d8846d] - crypto: reuse X509 issuer result (Filip Skokan) #64852
• [c68c7d0112] - crypto: validate key generation options (Filip Skokan) #64852
• [c36bb1d017] - crypto: fix Argon2 validation errors (Filip Skokan) #64852
• [f61408bb27] - crypto: handle XOF output allocation failure (Filip Skokan) #64851
• [2b4053d046] - crypto: initialize KeyObjectData mutex eagerly (Filip Skokan) #64851
• [4b7b2adf44] - crypto: handle DH operation failures (Filip Skokan) #64851
• [12170c3753] - crypto: use user-facing error for output encoding changes (Archkon) #64692
• [474f06d550] - debugger: preserve overlapping CDP request state (Trivikram Kamat) #64467
• [718cbe9497] - deps: upgrade npm to 11.19.0 (npm team) #64883
• [657c6154b3] - deps: update ngtcp2 to 1.25.0 (Node.js GitHub Bot) #64944
• [75a1fbeff9] - deps: update nghttp3 to 1.18.0 (Node.js GitHub Bot) #64943
• [07d7cb7cd8] - deps: update minimatch to 10.2.6 (Node.js GitHub Bot) #64945
• [f7d56359f1] - deps: update simdjson to 4.6.6 (Node.js GitHub Bot) #64942
• [8b06457cfb] - deps: update acorn to 8.18.0 (Node.js GitHub Bot) #64941
• [5919d01525] - deps: update googletest to 1b6f64d659944658a4c685b7bd9f04c1c3b8a39b (Node.js GitHub Bot) #64940
• [4a87ad6cff] - deps: update nghttp2 to 1.70.0 (Node.js GitHub Bot) #64939
• [c96d76a7c8] - deps: update zlib to 1.3.2.1-motley-42c2f19 (Node.js GitHub Bot) #64744
• [2b59984c0f] - deps: V8: backport 5177b10891e6 (avivkeller) #64631
• [b839af91da] - deps: update ada to 4.0.0 (Node.js GitHub Bot) #64790
• [70dedef942] - deps: update sqlite to 3.53.4 (Node.js GitHub Bot) #64745
• [7bc4c171f5] - deps: update Rust crates for V8 14.6.202.34-node.26 (Renegade334) #64543
• [308c6b2ac3] - deps: V8: backport 7d9b7e03141d (Manish Goregaokar) #64543
• [8eeae28e88] - deps: V8: backport c4d06ba586f3 (liujiahui) #63731
• [bbd6fc58c4] - diagnostics_channel: grow native channel storage (Stephen Belanger) #64497
• [ce8b292955] - doc: fix grammar and punctuation in dgram documentation (Kamal Rawal) #64957
• [1a413a60cf] - doc: fix grammar and editorial issues in addons documentation (Kamal Rawal) #64952
• [63fbd59e64] - doc: formalize fn/name as part of TestOptions API (Christopher Hiller) #64946
• [b263b0bca1] - doc: remove references to ca/crl as per-context QuicSession options (René) #64769
• [f37de14b27] - doc: fix typo in maintaining-dependencies.md (greenhead) #64896
• [16cb77cdc8] - doc: add RafaelGSS as last security release stewards (Rafael Gonzaga) #64843
• [335c28cd17] - doc: fix typos in documentation (greenhead) #64900
• [d4bed8ca39] - doc: fix missing references in doc type map (Tim Perry) #64872
• [e71d09d5f1] - doc: improve TestContext hook descriptions (Kamal Rawal) #64899
• [7089bd9ae4] - doc: add missing float32...

Notable Changes

• [5a36018abc] - doc: add MikeMcC399 as collaborator (Mike McCready) #64656
• [9b04f82d7b] - (SEMVER-MINOR) ffi: add getCurrentEventLoop (Paolo Insogna) #64323
• [bb51f2c960] - (SEMVER-MINOR) test_runner: add context.log() and test:log event (Moshe Atlow) #64389
• [56ce83b3ee] - (SEMVER-MINOR) test_runner: report entryFile in TestStream events (Moshe Atlow) #64309

Commits

• [248ff9fa5c] - assert,util: fix TypeError on Maps with null keys (Paul Bouchon) #64441
• [3b5baceafe] - benchmark: add bytes variant to webstreams async-iterator (Matteo Collina) #64291
• [0a46d1ef66] - buffer: normalize lone "\r" in Blob native line endings (Daijiro Wachi) #64115
• [d9ada18b70] - buffer: fix Blob.stream() leaking source buffer (semimikoh) #63577
• [d05993bcf6] - build: merge multiple on download artifact (Chengzhong Wu) #64633
• [6c25ac909a] - build: extract temporal_capi crate directory name into gyp variable (René) #64482
• [612f60c300] - cli: style node --help output with util.styleText (Adrián Estrada) #64484
• [29a938ddbb] - crypto: preserve RSA-PSS legacy pubkey DER (Filip Skokan) #64547
• [2fde794357] - crypto: cleanse provider private key copies (Filip Skokan) #64547
• [33a0e08d41] - crypto: handle incomplete RSA private keys (Filip Skokan) #64547
• [11b4d505ef] - crypto: retain legacy DH validation (Filip Skokan) #64547
• [6e302041e1] - crypto: limit KangarooTwelveParams customization to 512 bytes (Filip Skokan) #64557
• [195f103e87] - crypto: split OpenSSL 3, BoringSSL, and legacy backends (Filip Skokan) #64211
• [ec67e24eee] - deps: update googletest to fa005b296f90faec4f352d7ab382287bf6548c8d (Node.js GitHub Bot) #64587
• [32ffff88fd] - deps: histogram: cherry-pick 62ea52b07ee9b195 (StefanStojanovic) #64296
• [e0664f1f09] - deps: update histogram to 0.11.10 (Node.js GitHub Bot) #64296
• [cf0622bdd6] - deps: update amaro to 1.1.11 (Node.js GitHub Bot) #64586
• [04c78b8b24] - deps: update timezone to 2026c (Node.js GitHub Bot) #64588
• [59f4318976] - deps: V8: cherry-pick 1158ae719749 (René) #64432
• [e5ea7cd299] - deps: update googletest to 8240fa7d62f73e01c7af27d61ed965d6d66698fa (Node.js GitHub Bot) #64439
• [0e7554cee4] - deps: update libffi to 3.7.1 (Node.js GitHub Bot) #64438
• [46c9d724ad] - deps: update ngtcp2 to 1.24.0 (Node.js GitHub Bot) #64297
• [3519aac9af] - deps: enable OpenSSL asm support for riscv64 (Jamie Magee) #62606
• [c09701218b] - deps: update c-ares to 1.34.8 (Node.js GitHub Bot) #64330
• [ad2f3bc95b] - deps: upgrade npm to 11.18.0 (npm team) #64199
• [d7a4b22c86] - deps: V8: backport a05321ebd98e (Chengzhong Wu) #64202
• [8679cff291] - deps: update zlib to 1.3.2.1-motley-8b3aa8a (Node.js GitHub Bot) #64295
• [df5b1e10ba] - doc: remove unsupported syntax from stream_iter.md (Antoine du Hamel) #64649
• [8a4ca9083f] - doc: clarify rules for adding new built-in modules (Antoine du Hamel) #64648
• [7d50fe6b7a] - doc: mention DEPENDENCY custom field for H1 reports (Rafael Gonzaga) #64634
• [8f415bf5fc] - doc: fix dnsPromises.lookup verbatim default (Shivam S) #64658
• [c6378f724d] - doc: fix broken links and clean up type map (Antoine du Hamel) #64625
• [9b53ec19a2] - doc: fix typo in releases guide (Jihwan) #64621
• [5a36018abc] - doc: add MikeMcC399 as collaborator (Mike McCready) #64656
• [d2c8acd764] - doc: use promote wording in release guide (Md Muhtasim Munif Fahim) #64371
• [5c692cb576] - doc: fix import.meta example for vm.SourceTextModule (Muhammad Zeeshan) #64112
• [7568ce71ca] - doc: mention crypto.hash() for better perf (Steven) #63420
• [cf3f631936] - doc: update sea example by fixing wrong code example (Maxence Robinet) #64025
• [ce21e567a4] - doc: fix socket.readyState state descriptions (YuSheng Chen) #64468
• [018c7f1c01] - doc: replace large tables in crypto.md and webcrypto.md with lists (Filip Skokan) #64582
• [cf82de8d8b] - doc: note --env-file is not applied to --run (Paul Bouchon) #64442
• [e635ce5201] - doc: fix typo in embedding.md (greenhead) #64425
• [0b1f6eda3f] - doc: fix typos in contributing docs (Donghoon Kang) #64520
• [d978ce80ef] - doc: document TLS alpnProtocol and servername fields (Tim Perry) #64362
• [394669e3b3] - doc: fix spelling in devcontainer guide (한만욱) #64459
• [9786a593ea] - doc: clarify PEM format for signing keys (Harjoth Khara) #64404
• [6251f832ba] - doc: fix typo in tls.md (Daijiro Wachi) #64458
• [b8656c40ad] - doc: document net Socket server property (Efe Karasakal) #64364
• [03e9c738f3] - doc: update a Dispatcher undic...

Notable Changes

• [d08872b530] - (SEMVER-MINOR) buffer: implement blob.textStream() (Matthew Aitken) #64036
• [35222948be] - (SEMVER-MINOR) deps: update OpenSSL build config to support compression (Tim Perry) #62217
• [d6ab039f24] - (SEMVER-MINOR) doc: update blockList stability status to release candidate (alphaleadership) #63050
• [1da05fb79d] - doc: mark stream.compose stable (Matteo Collina) #62562
• [3c1636dabf] - (SEMVER-MINOR) esm: add --experimental-import-text flag (Efe) #62300
• [e323e877be] - (SEMVER-MINOR) fs: support caller-supplied readFile() buffers (Matteo Collina) #63634
• [c1248c9544] - (SEMVER-MINOR) http: add httpValidation option to configure header value validation (RajeshKumar11) #61597
• [a534b65815] - (SEMVER-MINOR) net: support TCP_KEEPINTVL and TCP_KEEPCNT in setKeepAlive (Guy Bedford) #63825
• [a23cdec683] - (SEMVER-MINOR) perf_hooks: sample delay per event loop iteration (Pablo Erhard) #62935
• [7428b57a37] - (SEMVER-MINOR) src: allow empty --experimental-config-file (Marco Ippolito) #61610
• [e57597173c] - (SEMVER-MINOR) stream: expose ReadableStreamTee (Matteo Collina) #64195
• [5396235993] - (SEMVER-MINOR) tls: report negotiated TLS groups (Filip Skokan) #64119
• [5e901b5cd9] - (SEMVER-MINOR) tls: add certificateCompression option (Tim Perry) #62217

Commits

• [676467fa9f] - benchmark: trim down the argon2 sets (Filip Skokan) #64218
• [a77a2000b7] - benchmark: add child_process async path baselines (Yagiz Nizipli) #63929
• [dd4482e915] - buffer: remove unreachable overflow check in atob (haramjeong) #60161
• [081c41eb86] - buffer: add fast api for isUtf8 and isAscii (Gürgün Dayıoğlu) #64169
• [d08872b530] - (SEMVER-MINOR) buffer: implement blob.textStream() (Matthew Aitken) #64036
• [6e2f7e6013] - build: remove redundant intermediate node_aix_shared (Chengzhong Wu) #63747
• [87e0675f51] - build: build codecache and snapshot with libnode (Chengzhong Wu) #63626
• [32174a7bae] - build: support setting an emulator from configure script (Ivan Trubach) #53899
• [69cfb2f240] - build: remove duplicated node_use_sqlite and node_use_ffi conditions (Chengzhong Wu) #63629
• [37ac6e8cb5] - build: add manually-dispatched stress-test workflow (Joyee Cheung) #64118
• [2424207191] - build: suppress compiler warnings for histogram (Richard Lau) #63980
• [63502b7404] - build,win: fix VS2022 arm64 PGO build (Stefan Stojanovic) #63413
• [fe4e4055d0] - child_process: fix permission model propagation via NODE_OPTIONS (Matteo Collina) #63972
• [aa2f3c066e] - child_process: pass spawn options to the binding positionally (Yagiz Nizipli) #63930
• [fcf32cf77a] - child_process: serialize advanced IPC messages natively (Yagiz Nizipli) #63933
• [7907134734] - crypto: reject small-order EdDSA points during verify (Filip Skokan) #64026
• [b505cd5465] - crypto: support non-byte WebCrypto lengths and cSHAKE (Filip Skokan) #63988
• [0f54a872e2] - crypto: share WebCrypto method and usage helpers (Filip Skokan) #63975
• [824ec11c05] - crypto: refactor keyObject.toCryptoKey() and SubtleCrypto.getPublicKey() (Filip Skokan) #63622
• [73aba92689] - crypto: coerce -0 to +0 before native calls (Filip Skokan) #63556
• [c83b79874e] - crypto: reject invalid raw key imports (Filip Skokan) #63134
• [934fda64b9] - crypto: improve accuracy of SubtleCrypto.supports (Filip Skokan) #63104
• [e392e1f791] - crypto: fix large DH generator validation (Tobias Nießen) #64092
• [e75a363e70] - crypto: use EVP_MAC for HMAC on OpenSSL >=3 (Filip Skokan) #63942
• [adbaf7af9b] - crypto: make webcrypto aliasKeyFormat directional (Filip Skokan) #63910
• [bb1aea8897] - crypto: fix unhandled error in Hash._transform (Haram Jeong) #63261
• [12c87732c1] - crypto: handle cipher context allocation failures (Tian Teng) #63542
• [858496b453] - crypto: deduplicate X509 subject matching logic (Tobias Nießen) #63644
• [9a29cb0964] - crypto: fix warnings in test_node_crypto.cc (Maya Lekova) #63490
• [8bb536066d] - crypto: optimize normalizeAlgorithm dispatch hot path (Filip Skokan) #62756
• [329e5496ff] - crypto,tls: do not ignore BN_get_word error (Tobias Nießen) #63895
• [97b7a3f9c7] - debugger: add --max-hit option to probe mode (Joyee Cheung) #63704
• [9098585c5e] - debugger: add more logs to probe mode (Joyee Cheung) #63663
• [59cca26cd5] - debugger: surface inspector failures in probe mode (Joyee Cheung) #63437
• [2922290eae] - debugger: disambiguate probe location binding (Joyee Cheung) #63286
• [6fb2c2c7e2] - debugger: lazily wait for initial break output (Trivikram Kamat) #63969
• [688e792551] - debugger: defer probe pause handling until startup (Trivikram Kamat) #63608
• [1ac93cc05a] - ...

This is a security release.

Notable Changes

• (CVE-2026-56848) http2: defer rst stream while in scope (Matteo Collina) – High
• (CVE-2026-58043) permission: avoid granting radix split nodes (RafaelGSS) – High
• (CVE-2026-56850) https: distinguish PFX object-array agent keys (RafaelGSS) – Medium
• (CVE-2026-58040) https: bind identity checks to session reuse (Matteo Collina) – Medium
• (CVE-2026-58041) sqlite: invalidate tag store iterators on statement reset (Matteo Collina) – Medium
• (CVE-2026-58042) dns: handle large resolveAny address replies (RafaelGSS) – Medium
• (CVE-2026-58045) zlib: throw on out-of-bounds write buffers (RafaelGSS) – Medium
• (CVE-2026-56847) permission: enforce fs write permission for trace events (RafaelGSS) – Low
• (CVE-2026-58039) permission: check final report output path (RafaelGSS) – Low
• (CVE-2026-58044) http: reject requests exceeding max header count (Matteo Collina) – Low
• deps: update llhttp to 9.4.3 (Paolo Insogna)
• deps: update undici to 8.9.0 (Node.js GitHub Bot)

Commits

• [af0bf96877] - deps: update llhttp to 9.4.3 (Paolo Insogna) nodejs-private/node-private#935
• [0354678355] - deps: update undici to 8.9.0 (Node.js GitHub Bot) #64712
• [dbeeaeec13] - (CVE-2026-58042) dns: handle large resolveAny address replies (RafaelGSS) nodejs-private/node-private#929
• [064d339f56] - (CVE-2026-58044) http: reject requests exceeding max header count (Matteo Collina) nodejs-private/node-private#922
• [23b94c843a] - (CVE-2026-56848) http2: defer rst stream while in scope (Matteo Collina) nodejs-private/node-private#921
• [c7ec3dc0b9] - (CVE-2026-58040) https: bind identity checks to session reuse (Matteo Collina) nodejs-private/node-private#904
• [8f666925b1] - (CVE-2026-56850) https: distinguish PFX object-array agent keys (RafaelGSS) nodejs-private/node-private#930
• [ad99d075b1] - (CVE-2026-58043) permission: avoid granting radix split nodes (RafaelGSS) nodejs-private/node-private#911
• [61222008b7] - (CVE-2026-58039) permission: check final report output path (RafaelGSS) nodejs-private/node-private#908
• [3cb607dfc4] - (CVE-2026-56847) permission: enforce fs write permission for trace events (RafaelGSS) nodejs-private/node-private#924
• [d08fde8a16] - (CVE-2026-58041) sqlite: invalidate tag store iterators on statement reset (Matteo Collina) nodejs-private/node-private#896
• [b3fbb6e11f] - (CVE-2026-58045) zlib: throw on out-of-bounds write buffers (RafaelGSS) nodejs-private/node-private#931

This is a security release.

Notable Changes

• (CVE-2026-56846) http2: retain header memory in session accounting (Matteo Collina) – High
• (CVE-2026-56848) http2: defer rst stream while in scope (Matteo Collina) – High
• (CVE-2026-58043) permission: avoid granting radix split nodes (RafaelGSS) – High
• (CVE-2026-56850) https: distinguish PFX object-array agent keys (RafaelGSS) – Medium
• (CVE-2026-58040) https: bind identity checks to session reuse (Matteo Collina) – Medium
• (CVE-2026-58041) sqlite: invalidate tag store iterators on statement reset (Matteo Collina) – Medium
• (CVE-2026-58042) dns: handle large resolveAny address replies (RafaelGSS) – Medium
• (CVE-2026-58045) zlib: throw on out-of-bounds write buffers (RafaelGSS) – Medium
• (CVE-2026-56847) permission: enforce fs write permission for trace events (RafaelGSS) – Low
• (CVE-2026-58039) permission: check final report output path (RafaelGSS) – Low
• (CVE-2026-58044) http: reject requests exceeding max header count (Matteo Collina) – Low
• deps: update llhttp to 9.4.3 (Paolo Insogna)
• deps: update undici to 7.29.0 (Node.js GitHub Bot)

Commits

• [6cb0475751] - deps: update llhttp to 9.4.3 (Paolo Insogna) nodejs-private/node-private#935
• [bcfe21d3dc] - deps: update undici to 7.29.0 (Node.js GitHub Bot) #64713
• [9d0d36cffd] - (CVE-2026-58042) dns: handle large resolveAny address replies (RafaelGSS) nodejs-private/node-private#929
• [8a008fb523] - (CVE-2026-58044) http: reject requests exceeding max header count (Matteo Collina) nodejs-private/node-private#922
• [a77c7f7354] - (CVE-2026-56848) http2: defer rst stream while in scope (Matteo Collina) nodejs-private/node-private#921
• [34ed88a069] - (CVE-2026-56846) http2: retain header memory in session accounting (Matteo Collina) #63752
• [95ba2cfde7] - (CVE-2026-58040) https: bind identity checks to session reuse (Matteo Collina) nodejs-private/node-private#904
• [fcbdbe47ea] - (CVE-2026-56850) https: distinguish PFX object-array agent keys (RafaelGSS) nodejs-private/node-private#930
• [ea26c12b56] - (CVE-2026-58043) permission: avoid granting radix split nodes (RafaelGSS) nodejs-private/node-private#911
• [9a6b7e343a] - (CVE-2026-58039) permission: check final report output path (RafaelGSS) nodejs-private/node-private#926
• [6c0c990880] - (CVE-2026-56847) permission: enforce fs write permission for trace events (RafaelGSS) nodejs-private/node-private#927
• [af9ff0490c] - (CVE-2026-58041) sqlite: invalidate tag store iterators on statement reset (Matteo Collina) nodejs-private/node-private#896
• [05f541b5c0] - (CVE-2026-58045) zlib: throw on out-of-bounds write buffers (RafaelGSS) nodejs-private/node-private#931