6 hours ago
node

2026-08-26, Version 26.8.0 (Current), @aduh95

Notable Changes

  • [74234ee30e] - (SEMVER-MINOR) benchmark: add --analyze mode to compare.js (James M Snell) #65416
  • [4232997fa2] - crypto: update root certificates to NSS 3.126 (Node.js GitHub Bot) #65495
  • [f0531f1c87] - (SEMVER-MINOR) crypto: enable SIV and GCM-SIV modes in Cipher/Decipher APIs (Filip Skokan) #63411
  • [3f4b80ebb5] - diagnostics_channel: mark TracingChannel as stable (Abdelrahman Awad) #64525
  • [753033c110] - (SEMVER-MINOR) lib,src: improve histogram implementation (James M Snell) #65024
  • [3d7d277493] - (SEMVER-MINOR) net: improve performance of net.BlockList (James M Snell) #64974
  • [9e8e9080fd] - (SEMVER-MINOR) perf_hooks: add statistical hypothesis testing to histogram (James M Snell) #65416
  • [c18b0aa54e] - repl: add basic syntax highlighting (Aviv Keller) #64591
  • [58ea88e1d3] - (SEMVER-MINOR) sqlite: add StatementSync.prototype.close() (Guilherme Araújo) #64232
  • [7c61b08aed] - (SEMVER-MINOR) sqlite: add StatementSync.prototype[Symbol.dispose]() (Guilherme Araújo) #64232
  • [4299cd5897] - (SEMVER-MINOR) util: add non-throwing MIMEType.parse (James M Snell) #64965
  • [df48191061] - (SEMVER-MINOR) zlib: add ZipEntry, ZipFile, and ZipBuffer (Philipp Dunkel) #64339

Commits

  • [162257b403] - assert: improve documentation wording (Kamal Rawal) #64953
  • [74234ee30e] - (SEMVER-MINOR) benchmark: add --analyze mode to compare.js (James M Snell) #65416
  • [2cb96dd462] - benchmark: add test-only and mock timers cases (Luan Muniz) #64097
  • [562168f93f] - benchmark: apply highWaterMark in webstreams pipe-to (Matteo Collina) #65138
  • [fbec4eb386] - benchmark: complete the sqlite is-transaction fix (Edy Silva) #65218
  • [d8acfc45f1] - benchmark: add test runner hooks and options (Luan Muniz) #63754
  • [13e7d54f67] - buffer: prevent string write offset overflow (Matteo Collina) #65043
  • [615273deac] - buffer: support aligned allocations (Robert Nagy) #65003
  • [bc6b630e21] - buffer: treat detached ArrayBuffers as empty (Archkon) #64504
  • [ddf9f9d265] - build: target Power 9 and z14 (Richard Lau) #65439
  • [fda8ee894e] - build: use build-ci for benchmark merge-commit rebuild (Yagiz Nizipli) #65362
  • [03692786ef] - build: add simdutf dir to include path in GN build (Shelley Vohr) #65382
  • [3da555a3ed] - build: pass target architecture to small-icu genccode (ulofiai) #65095
  • [ffe1e7cbea] - build: update binary-upload to use correct tarball name (Stewart X Addison) #65282
  • [50174cb94a] - build: deprecate always enabled --enable-static (Chengzhong Wu) #65103
  • [28f662b424] - build: check FIPS option value in node.gyp (Filip Skokan) #64982
  • [29a2ecefeb] - build: handle malformed OpenSSL macros (Filip Skokan) #64982
  • [6deeef1801] - build: enable perfetto updater (Chengzhong Wu) #64966
  • [312f0c6a7e] - build: add host toolset to perfetto_sdk (Ryuhei Shima) #64751
  • [1a4f5e537b] - build,win: add PGO workload scripts (Stefan Stojanovic) #63696
  • [21655dccbc] - child_process: keep SIGWINCH from killing on Win (Kirill Saied) #64510
  • [4232997fa2] - crypto: update root certificates to NSS 3.126 (Node.js GitHub Bot) #65495
  • [f0531f1c87] - (SEMVER-MINOR) crypto: enable SIV and GCM-SIV modes in Cipher/Decipher APIs (Filip Skokan) #63411
  • [109566a2f7] - crypto: fix missing error checks on ASN1_STRING_to_UTF8() (Nora Dossche) #65200
  • [501f81612d] - crypto: improve SubtleCrypto.supports() accuracy (Filip Skokan) #65222
  • [137ff67fd3] - crypto: use available BoringSSL APIs (Filip Skokan) #65423
  • [0e87576ed4] - crypto: remove obsolete BoringSSL shims (Filip Skokan) #65423
  • [af867ce3e4] - crypto: add mgf1Hash for RSA-OAEP (Adam Mcgrath) #65073
  • [66ee4792bf] - crypto: disable non-FIPS WebCrypto paths in FIPS mode (Filip Skokan) #65172
  • [6a142c03e9] - crypto: read WebCrypto inputs through primordials (Filip Skokan) #65115
  • [92e3110462] - crypto: fix disabling FIPS mode (Filip Skokan) #64982
  • [d69bed2f49] - debugger: wait for target startup (Filip Skokan) #65194
  • [5c7c0b8b15] - deps: update zlib to 1.3.2.1-motley-8002e91 (Node.js GitHub Bot) #65316
  • [4cb6b1335e] - deps: update simdjson to 4.6.7 (Node.js GitHub Bot) #65318
  • [a39ad67482] - deps: update googletest to 49495eacfdbda3f4b6ba219923fedbb2e3f99376 (Node.js GitHub Bot) #65317
  • [46762dad57] - deps: cherry-pick libuv/libuv@e640dc9 (ulofiai) #65118
  • [abb7a15a8d] - deps: update perfetto to 57.2 (Node.js GitHub Bot) #65114
  • [ebd8c6ba52] - deps: float ICU-23262 patch for icu78 (René) #64678
  • [f2cc681109] - deps: enable AVX-512 OpenSSL asm with clang (Daniel Lemire) #65136
  • [f45dc92913] - deps: update undici to 8.10.0 (Node.js GitHub Bot) #65155
  • [4160dfdf81] - deps: update googletest to d89aac5f0dd4021198d903d39de16f896726de21 (Node.js GitHub Bot) #65153
  • [631d3aa37b] - deps: update libffi to 3.8.0 (Node.js GitHub Bot) #65154
  • [788976c626] - dgram: don't swallow bind errors when callback is provided (armanmikoyan) #62602
  • [d286423043] - diagnostics_channel: validate before channel activation (Trivikram Kamat) #65313
  • [3f4b80ebb5] - diagnostics_channel: mark TracingChannel as stable (Abdelrahman Awad) #64525
  • [152a326f92] - dns: validate address type in lookupService (Lazizbek Ergashev) #64878
  • [00c71fec93] - dns: validate port range in setServers() (René) #65021
  • [e9327d1422] - dns: fix crash on setServers with port 0 (Lazizbek Ergashev) #65009
  • [9e227ef20d] - doc: update AHAFS reference link (Taeuk Ha) #65481
  • [5fbf6c57af] - doc: fix property names in os.networkInterfaces() example (Jihwan) #65469
  • [13f16d28d1] - doc: fix broken links in cli.md (Donghoon Kang) #65412
  • [0f36ee3755] - doc: remove outdated WASI version fallback (이혜미) #65303
  • [1ad09f712a] - doc: fix broken GYP link in n-api.md (Donghoon Kang) #65413
  • [24cd694237] - doc: document that an empty OPENSSL_CONF skips config loading (Orgad Shaneh) #64949
  • [dae434132e] - doc: fix broken TLS security level example (soreavis) #65391
  • [96b91dc987] - doc: clarify socket destroyed behavior (Dayun) #65395
  • [9d8d27d444] - doc: update outdated nodejs.org guide links (Donghoon Kang) #65394
  • [65f675086e] - doc: clarify that ipv4 mapped to ipv6 are classified as ipv6 (Vedant Kulkarni) #62117
  • [89aba0c311] - doc: clarify how fs.Dirent file types are determined (soreavis) #64532
  • [3ed0492f52] - doc: update security release prepare command (Rafael Gonzaga) #64699
  • [63583c4e75] - doc: clarify copyFile symlink behavior (T) #62941
  • [abfc51f757] - doc: document setRawMode write access on Windows (Erik Demaine) #63856
  • [4a784cb3e6] - doc: document per-architecture fast FFI argument limits (Seongeun Lee) #65207
  • [262f966155] - doc: add missing return types in fs.md (Chaseton Collins) #65307
  • [695cd896a7] - doc: add missing return types in buffer.md (Yuya Inoue) #65308
  • [676a1228cd] - doc: fix lint clean command (greenhead) #65274
  • [9ea318d4e3] - doc: fix typo in onboarding.md (서울민트초코) #65295
  • [3b6a918ab4] - doc: add missing added: tags to fs.lchmod (Lazizbek Ergashev) #65283
  • [a77b1e61df] - doc: fix SQLite changeset constant descriptions (greenhead) #65265
  • [ab50ae60e4] - doc: document open pull request limit (Matteo Collina) #65250
  • [e2f4ea03a3] - doc: document http2 header constants (Harjoth Khara) #64548
  • [5b5509d0d3] - doc: create ai-guidelines and include to CONTRIBUTING (Rafael Gonzaga) #62105
  • [c63e873073] - doc: fix broken fs.BigIntStats link in vfs.md (greenhead) #65045
  • [d6059e84c0] - doc: update synopsis (Augustin Mauroy) #65171
  • [43f1dc03e7] - doc: document close() error when in a sqlite callback (Trivikram Kamat) #65090
  • [8f5f48ad96] - doc: fix broken internal links (greenhead) #64901
  • [5b64b37739] - doc: report proper return type on urlPattern.test (Brian Muenzenmeyer) #64831
  • [9633bb0f29] - doc: fix permission documentation examples (greenhead) #64897
  • [e52e573fd7] - doc: document sqlite parameter binding (Guilherme Araújo) #65089
  • [fa52f11d3b] - doc: finalize statements in sqlite examples (Guilherme Araújo) #65088
  • [0157c45012] - doc: document quic stopSending() and resetStream() (Issac) #64888
  • [003a913799] - doc: clarify sqlite bare parameter default (Sumit Kumar Das) #62009
  • [c5588d71ad] - doc: remove usage of util.inherits (Augustin Mauroy) #60817
  • [673db40fbf] - doc: fix grammar in worker_threads.md (이혜미) #64913
  • [ee5f72cf16] - doc: fix broken link (Antoine du Hamel) #65078
  • [0450ab6c6a] - doc: update node.1 to fix linter (Antoine du Hamel) #65053
  • [9a256b0693] - doc: clarify OpenSSL FIPS configuration (Filip Skokan) #64982
  • [c321752dcb] - doc: remove --expose-gc flag from CLI documentation (Dario Piotrowicz) #58909
  • [0cf79931bb] - doc: document ArrayBuffer support in pbkd2Sync (kyungrae2002) #64976
  • [3b8a0bacaa] - doc: correct default highWaterMark values (Yilong Li) #64617
  • [be313012e4] - doc: use ffi.suffix in permission example (agape1225) #64914
  • [4a1c9a7ee0] - esm: avoid super-linear data URL MIME regex (Sumit Kumar Das) #61951
  • [b1770bc196] - esm: only register text format when enabled (Efe Karasakal) #64992
  • [f48927fe5b] - esm: fix wasm import name in error message (이혜미) #64950
  • [8d48adf688] - events: inline iterationCondition hybrid dispatch closure (Szymon Łągiewka) #64473
  • [b827c0047e] - events: inline createEvent hybrid dispatch closure (Szymon Łągiewka) #64473
  • [7670c81d99] - ffi: prefer canonical type names (Trivikram Kamat) #65417
  • [1fe7a1c33d] - ffi: validate the value passed to the float setters (Soul Lee) #65342
  • [537feecd0b] - ffi: reject direct SharedArrayBuffer pointers (Trivikram Kamat) #65233
  • [0002f0a718] - ffi: remove dead null check in callback arguments (Trivikram Kamat) #64998
  • [9024ec27b6] - ffi: keep FFI functions non-constructible (Trivikram Kamat) #65184
  • [9b4f349b01] - ffi: refresh cached string buffers on every call (Trivikram Kamat) #65051
  • [eacd65e9c2] - ffi: reject detached ArrayBufferViews (Trivikram Kamat) #65086
  • [be2ab89730] - ffi: reject detached ArrayBuffers as pointers (Trivikram Kamat) #65083
  • [6f9e0846ea] - ffi: validate fast pointer BigInt argument ranges (Trivikram Kamat) #65032
  • [3e6688c5e3] - ffi: reuse the callable created per symbol (Trivikram Kamat) #64971
  • [8b0bdd931c] - ffi: shrink trampoline placement probe window (Trivikram Kamat) #64969
  • [9c282c4532] - ffi: accept pointer BigInts in multi-argument fast calls (Trivikram Kamat) #64964
  • [b98294b57d] - ffi: support SharedArrayBuffer in getRawPointer (Junsoo Ha) #64864
  • [5cac7c2c55] - ffi: reuse libffi call plans (Yilong Li) #64958
  • [262f0ec82a] - fs: stop stat()ing every entry in recursive readdir (Shelley Vohr) #65487
  • [e3ae912e9a] - fs: use sized reads for large files in readFileUtf8 (Shelley Vohr) #65328
  • [bc1e19b4b7] - fs: fix realpath of namespaced drive paths (Jason Zhang) #65378
  • [6673ebadf2] - fs: abort in-flight stat operations (Mert Can Altin) #63143
  • [74dcdbb5f1] - fs: fix glob early return skipping sibling entries (Srinu desetti) #64895
  • [6305a744df] - fs: pass symlink type in cp when filter is provided (Jerry Zhao) #62654
  • [c5cb6bc7e2] - fs: allocate FSReqPromise stat arrays lazily (Samuel Attard) #63886
  • [992af05719] - fs: fix out-of-bounds write in mkdtemp for long prefixes (Hierax_Umbra) #64770
  • [2de845b2dd] - fs: treat std::errc::permission_denied as EPERM error (Kirill Saied) #64698
  • [77fedbd350] - fs: read small files in one thread pool round trip (Shelley Vohr) #65327
  • [810929b6dd] - Revert "fs: fix close listener leak in FileHandle streams" (Mike McCready) #65387
  • [8873b91fce] - fs: fix close listener leak in FileHandle streams (Y1D7NG) #64227
  • [656cfaeb2d] - fs: add windowsHandle option to file streams (Kirill Saied) #63851
  • [c2c31d69fd] - http: improve performance with known-length calls to end() (Tim Perry) #65466
  • [7e9204f4b3] - http: use intrusive lists in ConnectionsList (Matteo Collina) #65296
  • [98e6272c70] - http: cache maxHeaderPairs per header section (GetThatCookie) #64988
  • [6c3516f179] - http: fix keylog listener setup on existing agent sockets (Shani Singh) #65066
  • [dad9548fbc] - http: emit drain on socket takeover and avoid stale HWM reuse (Naman Trivedi) #64991
  • [563cab119b] - http2: avoid uaf while receiving and sending rst_stream (esgor) #64166
  • [099801641b] - inspector: avoid calling into JS from V8 interrupts (Joyee Cheung) #65028
  • [b71d5de0b8] - lib: use bracket notation instead of startsWith/endsWith for single char (Taejin Kim) #61500
  • [e8e2abcc8d] - lib: load fewer builtins when bootstrapping without a snapshot (Shelley Vohr) #65329
  • [3619dc0601] - lib: fix ERR_INVALID_ARG_TYPE with --enable-source-maps (June) #63215
  • [ad7c67026b] - lib: harden webidl dictionary member reads (Filip Skokan) #65115
  • [b5182f0a1c] - lib: use validateArray for array arguments (greenhead) #64959
  • [7f7df06821] - lib: add and test [EnforceRange] in webcrypto dictionaries (Filip Skokan) #65091
  • [753033c110] - (SEMVER-MINOR) lib,src: improve histogram implementation (James M Snell) #65024
  • [8d39d0d660] - meta: add a root-level AGENTS.md (James M Snell) #65493
  • [3770f9baea] - meta: move targos to emeritus (Michaël Zasso) #65393
  • [a9b31dfe30] - meta: add unified http api initiative (James M Snell) #65139
  • [6bffc306aa] - meta: move one or more collaborators to emeritus (Node.js GitHub Bot) #65182
  • [4abd1c8100] - meta: add support for alpha prerelease tag (Antoine du Hamel) #63135
  • [132c578e97] - meta: add Aviv Keller to .mailmap (Aviv Keller) #65048
  • [7aff78d231] - meta: update sccache to 0.17.0 (René) #64985
  • [97a437e7ea] - module: add a read-only mode to the compile cache (Shelley Vohr) #65302
  • [5821362819] - module: do not split a portable compile cache by uid (Shelley Vohr) #65293
  • [eb5d66e856] - module: report unreadable package.json (Paul Bouchon) #65223
  • [43757d07c1] - module: cache nearest parent package.json per directory (Shelley Vohr) #65326
  • [d7805e00dc] - module: fix --check on ambiguous ESM files (Paul Bouchon) #65203
  • [646221a495] - net: handle undefined parent in _unrefTimer and _destroy (Shivay-98) #64644
  • [3d7d277493] - (SEMVER-MINOR) net: improve performance of net.BlockList (James M Snell) #64974
  • [9e8e9080fd] - (SEMVER-MINOR) perf_hooks: add statistical hypothesis testing to histogram (James M Snell) #65416
  • [01a8ae0ce6] - permission: guard UDP handle adoption (Rafael Gonzaga) #65358
  • [ac3c412aaf] - permission: enforce addon permission in GetLinkedBinding (Rafael Gonzaga) #65432
  • [8765afd4c2] - process: validate resource stats array offsets (Archkon) #65098
  • [d0447c93f6] - quic: changes for nghttp3_conn_close_stream2 (Marten Richter) #64574
  • [91393898b5] - quic: mark drain promise handled (James M Snell) #65319
  • [5c9576bf50] - quic: reset rejected HTTP/3 request streams with H3_REQUEST_REJECTED (trivenay) #65442
  • [ec956f2abc] - quic: write desired size needs update on maxstream (Marten Richter) #64768
  • [41c510803d] - quic: do not destroy incoming streams that have a consumer (trivenay) #65335
  • [009e376581] - quic: fix wake up blob (Marten Richter) #64044
  • [4674a10368] - quic: convert incoming :status header to number (Hallison Pereira Melo) #63589
  • [5953165f53] - quic: fix infinite loop if STOP_SENDING received on a buffering stream (Tim Perry) #64715
  • [bb499c312e] - repl: keep entries added while history file is loading (Mhayk Whandson) #64513
  • [825fcfe4d5] - repl: add benchmarks (Aviv Keller) #64590
  • [c18b0aa54e] - repl: add basic syntax highlighting (Aviv Keller) #64591
  • [f32a8631ad] - sea: avoid dangling CLI option pointers (Archkon) #64755
  • [3126ce5779] - sea: handle NUL bytes in asset keys (Archkon) #64773
  • [64a8843ff2] - sea: reject trailing content in config JSON (Archkon) #64774
  • [1d9dd252f1] - sea: reject malformed --node-options values (Archkon) #64803
  • [6ec735c910] - sqlite: reject reentry while binding parameters (Trevor Burnham) #65294
  • [60cb384c15] - sqlite: remove unused column name helper (Trivikram Kamat) #65401
  • [fce6754a83] - sqlite: reject busy statement finalization in authorizer (Trivikram Kamat) #65369
  • [e2f952f2ff] - sqlite: prevent reentrant session.close() (Trivikram Kamat) #65349
  • [0e8af3378a] - sqlite: reuse cached column names in statement all() and get() (Edy Silva) #65276
  • [e6bfec91be] - sqlite: validate StatementSync.run() integers (Trivikram Kamat) #65178
  • [bbb1226dbe] - sqlite: add diagnostic channel (Guilherme Araújo) #62241
  • [6302168de8] - sqlite: add stmt persistent flag (Guilherme Araújo) #62757
  • [2989311d81] - sqlite: reject connection access from authorizer callbacks (Trevor Burnham) #65156
  • [72c37b133e] - sqlite: expose prepared statement statistics (Edy Silva) #64541
  • [3e50a2f1e9] - sqlite: manage sqlite3_stmt lifetime with RAII (Guilherme Araújo) #62419
  • [3ab7e72555] - sqlite: check sqlite3_step() and sqlite3_reset() results (semimikoh) #63319
  • [5e387ce979] - sqlite: reject statement-less SQL in prepare() (Trevor Burnham) #65157
  • [83169e58f3] - sqlite: reject statement-less SQL in SQLTagStore (Trevor Burnham) #65157
  • [7f31f6226e] - sqlite: isolate applyChangeset filter errors (Trivikram Kamat) #64823
  • [c89878c3c8] - sqlite: reject deserialize() while in a callback (Trivikram Kamat) #64796
  • [5a852b22d4] - sqlite: check null returns from sqlite value functions (Nora Dossche) #63288
  • [5cb78ed300] - sqlite: validate maxSize argument in createTagStore() (Anshika Jain) #63792
  • [ca885876f6] - sqlite: refactor error helpers and user function pointers (Ali Hassan) #62794
  • [06b1758dcd] - sqlite: reject non-positive backup rates (Trivikram Kamat) #64893
  • [ce0ca47023] - sqlite: clear SQLTagStore bindings (Matteo Collina) #65041
  • [49fb028714] - sqlite: bind Boolean (mike-git374) #62001
  • [09d0da99e9] - sqlite: fix undefined behaviour in Session::Changeset() (Nora Dossche) #63637
  • [58ea88e1d3] - (SEMVER-MINOR) sqlite: add StatementSync.prototype.close() (Guilherme Araújo) #64232
  • [7c61b08aed] - (SEMVER-MINOR) sqlite: add StatementSync.prototype[Symbol.dispose]() (Guilherme Araújo) #64232
  • [9167ebd32b] - sqlite: bind ArrayBuffer (mike-git374) #62061
  • [5da6eaa8af] - sqlite: prevent database close during callbacks (Matteo Collina) #64743
  • [29d794bc84] - src: fix heap value deduplication in embedder graph (Ilyas Shabi) #64801
  • [b405e9b039] - src: fix out-of-bounds write when transcoding odd-length ucs2 (nashit hayat) #64512
  • [101a215472] - src: use simdutf for two-byte utf8 conversion (Mert Can Altin) #62248
  • [340b98346f] - src: run same-priority platform tasks in posting order (Shelley Vohr) #65353
  • [83a7949c18] - src: define O_SYNC, O_DSYNC and O_DIRECT on Windows (Kirill Saied) #64707
  • [32bb197f2a] - src: use simdutf for two-byte strings in UTF-8 writes (Shelley Vohr) #65324
  • [613be79cf4] - src: add v8::Local specialization for MaybeStackBuffer (James M Snell) #65159
  • [922d47cbd7] - src: escape Windows environment variables in task runner (Antoine du Hamel) #65217
  • [3a47f1f282] - src: apply minor namespace format tweak in permissions (James M Snell) #65158
  • [981cfa537d] - src: simplify permissions with BooleanPermissions (James M Snell) #65158
  • [5954b13f88] - src: simplify includes in permissions (James M Snell) #65158
  • [d4ced88c09] - src: apply a modest performance perf to permissions (James M Snell) #65158
  • [efb649ec26] - src: make permission storage a bit more efficient (James M Snell) #65158
  • [521aaf10fc] - src: apply multiple general cleanups to permissions (James M Snell) #65158
  • [ac920e0d2b] - src: simplify c++ diagnostics channel API (James M Snell) #65158
  • [ec8fe275a1] - src: make minor cleanup to permission checks (James M Snell) #65158
  • [968bdd0135] - src: use DictionaryTemplate for permission diag channel message (James M Snell) #65158
  • [f77aa2f703] - src: cache permission strings (James M Snell) #65158
  • [4018f3a776] - src: shave about 20 bytes off each TLSWrap instance (James M Snell) #65144
  • [b7a23426d9] - src: add SetAbortHandler (Max H Fisher) #64684
  • [3cfe19489c] - src: use concepts where appropriate (James M Snell) #65148
  • [d8a0f288ab] - src: match cmd.exe case-insensitively in task runner (Archkon) #64907
  • [262d88e6c2] - src: reuse cached env strings in remaining files (Seongeun Lee) #65039
  • [ad35fe97f0] - src: expose Windows-only fs open flags (Kirill Saied) #64775
  • [8c4531bbc9] - src: report why --enable-fips failed (Filip Skokan) #64979
  • [a293dbf0e1] - src: update repeated use strings to env (James M Snell) #64760
  • [044402cf0e] - src: use UTF-8 for task runner filesystem paths (Archkon) #64868
  • [5b7d02e401] - stream: normalize fused stateless transform results (Trivikram Kamat) #65367
  • [1d6ec2ddc5] - stream: encode whole chunks in TextEncoderStream (Matteo Collina) #65414
  • [0afda47ca4] - stream: prevent share from eagerly draining source (Trivikram Kamat) #65338
  • [dc51c7926e] - stream: drain pending writes before broadcast end (Trivikram Kamat) #65334
  • [a77f9f7a32] - stream: reuse unexposed managed read buffers (GetThatCookie) #64990
  • [c42fbcc0d1] - stream: avoid duplicated endReadableNT scheduling (Matteo Collina) #65310
  • [9ec9383d1d] - stream: decouple transform backpressure changes (Matteo Collina) #65143
  • [a9dc50d275] - stream: reject pull on signal abort during flush (Trivikram Kamat) #65346
  • [815424db74] - stream: avoid leaking consumers on signal failure (Trivikram Kamat) #65299
  • [6a2e0561e8] - stream: use validateObject for zlib/iter params (greenhead) #65015
  • [4f6f2cfffa] - stream: use validateNumber for BYOB reader options.min (greenhead) #65014
  • [4d297428e6] - stream: consolidate non-op algorithm callbacks (Matteo Collina) #65138
  • [f7e0c81be4] - stream: cut promise churn in webstreams hot paths (Matteo Collina) #65138
  • [5edffb544f] - stream: speed up async iteration of Readable (Matteo Collina) #64447
  • [0876a29bb6] - stream: preserve falsy cancellation reasons (Trivikram Kamat) #64705
  • [374f7e214d] - stream: use validateBuffer for BYOB reader view (greenhead) #65046
  • [6bd15b2ac9] - stream: fix recursive WritableStream abort (Jeong SeokChan) #64825
  • [f33dba704d] - string_decoder: decode UTF-8 via StringBytes::Encode (Shelley Vohr) #65324
  • [6409983a6c] - test: update WPT for WebCryptoAPI to e235e089b4 (Node.js GitHub Bot) #65478
  • [01cb4f99a0] - test: convert forEach to for of test-messageevent-brandcheck file (Nachiketa Pathak) #65279
  • [359369e24e] - test: use spawnSyncAndAssert in windowsHide test (Junsoo Ha) #65351
  • [9304dee833] - test: remove test-debugger-run-after-quit-restart as flaky on macOS (Yuya Inoue) #65424
  • [30f1a19eec] - test: simplify test-timers-interval-promisified.js (Donghoon Kang) #65322
  • [acaf986ad5] - test: add Headers coverage and benchmark (Yagiz Nizipli) #65365
  • [b6852e2b96] - test: deflake test-net-listen-ipv6only (sangwook) #64173
  • [235a0baf8b] - test: use common/child_process spawnSync helpers (Junsoo Ha) #65377
  • [29f010fbb0] - test: fix Linux debug skip in SEA test guard (구현우) #63751
  • [33d7b4c6b3] - test: add closed-library assertions for getFunctions and getSymbols (Anshika Jain) #63769
  • [24a76e18ec] - test: avoid timer race in event loop delay test (Trivikram Kamat) #64728
  • [fdc1e78595] - test: enforce exit code in test-http-server-stale-close (Antoine du Hamel) #65198
  • [c644f2e07c] - test: convert test-async-local-storage-bind to async loop (freida-code) #65270
  • [1d5e5e8f43] - test: replace forEach() with for...of in parallel tests (Phillip Markert) #65272
  • [9346570fed] - test: convert forEach to for in test-constant.js file (NIxxy25) #65271
  • [7af0a96090] - test: use for-of instead of forEach (Felix P.) #65268
  • [63e6f2edc3] - test: wait for FFI background optimization (Trivikram Kamat) #65300
  • [bca3367583] - test: add a simple test for import defer of a CJS module (Maya Lekova) #64694
  • [00b687bc4a] - test: cover ZIP fd lifecycle and add rollback (Philipp Dunkel) #65016
  • [31742f2f42] - test: cover ZIP header-confusion and DoS guards (Philipp Dunkel) #65016
  • [87ee7bff38] - test: cover realpathSync resolving symlinks after a FIFO stat (Hendrik Liebau) #65113
  • [fd7e904433] - test: update tests to run with OpenSSL >= 3.0 FIPS mode (Filip Skokan) #64960
  • [219495fe2c] - test: account for [EnforceRange] in test-webcrypto-prototype-pollution (Filip Skokan) #65173
  • [bf86fab458] - test: add permission fast api test (James M Snell) #65158
  • [cc19107e5d] - test: update WPT for WebCryptoAPI to 4c2fd05ed5 (Node.js GitHub Bot) #65150
  • [69e4fabb29] - test: update WPT for urlpattern to 4832db4761 (Node.js GitHub Bot) #65151
  • [b1aa78a57e] - test: fix hidden error in test-http-server-stale-close.js (Meghan Denny) #59357
  • [59d7e22a12] - test: avoid deadlock issue in pipeline http2 tests to fix flakiness (Tim Perry) #65079
  • [7074ae30fa] - test: allow half-open CONNECT tunnel sockets (Trivikram Kamat) #64973
  • [82b2d9c08d] - test: update passphrases to comply with the next OpenSSL FIPS mode (Filip Skokan) #65077
  • [7f3a42035c] - test: use libuv clock for immediate queue test (Trivikram Kamat) #64889
  • [7ddd853d8c] - test: increase timeout in probe-failure-hang-during-evaluate (Joyee Cheung) #64719
  • [28cad47cef] - test: update WPT for WebCryptoAPI to 82c3d9069c (Node.js GitHub Bot) #64977
  • [74a3e91bb7] - test: prefer in-memory databases in sqlite tests (Paul Bouchon) #64701
  • [7fc8a3ad8c] - test,doc: cover and document multi-byte offset/size in randomFill (kyungrae2002) #64834
  • [4de7e63883] - test_runner: match dotfiles in default coverage exclude (semimikoh) #63401
  • [79c39c217d] - test_runner: print coverage and diagnostic info with dot reporter (mag123c) #61423
  • [cce803b174] - test_runner: use run options with isolation="none" (Sylvester Keil) #62269
  • [797ef40d23] - test_runner: mock dual-package with conditional exports (Maruthan G) #62943
  • [1ad7ca310a] - test_runner: restore directory search for --test (Paul Bouchon) #64637
  • [400d598b3c] - test_runner: add classname hierarchy for JUnit reporter (mag123c) #60220
  • [9572a0b15f] - test_runner: fix junit report on empty diagnostic (Lazizbek Ergashev) #65357
  • [e3fda695fe] - test_runner: extend tag filter with boolean expression DSL (Chemi Atlow) #63054
  • [4e06739c7b] - test_runner: do not tag-filter test file wrappers (Chemi Atlow) #65170
  • [e73f74738d] - test_runner: fix env option validation (Jihwan) #64865
  • [2a0b1ec4cc] - tls: throw on invalid ALPNProtocols instead of aborting (Sankalp Thakur) #65076
  • [15da4a190b] - tls: fix authorized state on no-cert TLS1.3 client cert resumption (Tim Perry) #64677
  • [1864175435] - tls: don't trigger SNICallback or OCSPRequest from the TLS lib stack (Tim Perry) #64827
  • [8f4ee7eda5] - tls: drop hand-rolled TLS client hello parser (Tim Perry) #64827
  • [a457631496] - tools: improve commit queue failure comment (Filip Skokan) #65433
  • [78175c68f8] - tools: improve nix-changes coverage (Antoine du Hamel) #65403
  • [6f0c08bf80] - tools: refactor shell.nix pkcs11 integration to its own section (Antoine du Hamel) #65404
  • [35b18b4455] - tools: fix max body length handler in create-release-proposal.sh (Antoine du Hamel) #65455
  • [88d5f644a2] - tools: bump brace-expansion in /tools/clang-format (dependabot[bot]) #64984
  • [41edd2f214] - tools: make env variables consistent in cron jobs (Antoine du Hamel) #65168
  • [7c09bd5ece] - tools: fix man-page generation on Windows (James Ross) #64886
  • [1a20d27118] - tools: bump undici from 6.27.0 to 6.28.0 in /tools/doc (dependabot[bot]) #65011
  • [ebbe4af869] - tools: fix linter when permittedInsecurePackages is empty (Antoine du Hamel) #65226
  • [17d2b067bf] - tools: update BoringSSL pin on v26.x (Filip Skokan) #65483
  • [be4e7de04c] - tools: only include fast-tracked and old enough PRs in CQ (Antoine du Hamel) #65197
  • [53d52731c9] - tools: fix quote escaping in update-nixpkgs-pin.sh (Antoine du Hamel) #65166
  • [40b1b18839] - tools: remove skip logic in commit-queue.sh (Antoine du Hamel) #65162
  • [5506f77924] - tools: bump js-yaml from 4.2.0 to 4.3.1 in /tools/lint-md (dependabot[bot]) #65129
  • [fc038a0ef5] - tools: bump js-yaml from 4.2.0 to 4.3.1 in /tools/eslint (dependabot[bot]) #65130
  • [10b2c8a873] - tools: fix GITHUB_TOKEN permissions for CQ workflow (Antoine du Hamel) #65192
  • [73de450845] - tools: use the read-only token when filtering PRs in CQ (Antoine du Hamel) #65169
  • [31c1bcb627] - tools: delay removal of commit-queue label (Antoine du Hamel) #65101
  • [89d3905595] - tools: move ncu config to global for commit queue (Filip Skokan) #65132
  • [aa3b598e2e] - tools: prefilter commit queue metadata (Filip Skokan) #64343
  • [4f2c634258] - tools: lazy-abort failed PR merges in CQ (Antoine du Hamel) #65004
  • [8657497521] - tools: fix pkcs11-store-test check (Antoine du Hamel) #65023
  • [0e1a99ac24] - tools: add an OpenSSL FIPS build to test-shared.yml (Filip Skokan) #64960
  • [b6fa9c1819] - tools: sync mk-ca-bundle.pl with curl (Archkon) #64753
  • [f0140d7ebd] - tools: store "default" OpenSSL version in openssl-matrix.nix (Antoine du Hamel) #64962
  • [4c8d8afa99] - tools: remove true from branch name for auto-update automation (Antoine du Hamel) #64961
  • [2dd7d4c56f] - tools: add ./tools/nix/pkcs11.nix to nix-changes.yml (Filip Skokan) #64967
  • [cf395004ed] - tty: add raw-vt and io raw modes (Samuel Williams) #64140
  • [a5e5c7f756] - typings: add signal_wrap internal binding types (Seongeun Lee) #65229
  • [5219e53dd6] - typings: add diagnostics_channel typings (Seongeun Lee) #65227
  • [215223dff1] - typings: add watchdog internal binding types (Seongeun Lee) #65228
  • [eb095a94bd] - typings: add internal_only_v8 binding typeis (Donghoon Kang) #65071
  • [9fc811a0f2] - typings: add credentials internal binding types (Donghoon Kang) #65036
  • [f032c22430] - url: skip unused href reuse comparison (Yagiz Nizipli) #65361
  • [2a64032141] - url: speed up WHATWG URL parsing (Yagiz Nizipli) #65361
  • [c4dbe14ec6] - url: speed up URLSearchParams (Yagiz Nizipli) #65363
  • [001c37c0a2] - url: bounds-check short Windows file URL paths (Archkon) #64788
  • [1a63416b1a] - url: handle unparsable serialized URLs in setters (Matteo Collina) #64651
  • [cb4b89c018] - util: allow single-line format when break length is infinite (Hamid Reza Ghavami) #64238
  • [f644853680] - util: fix OSC 8 hyperlink stripping in stripVTControlCharacters (Dushyant Singh Hada) #64319
  • [eb1ebbb39d] - util: fix formatting of functions returned from getters (Richard Gibson) #64839
  • [f373dab724] - util: use more primordials in comparisons.js (Ayoub Mabrouk) #61198
  • [6ca9c1e078] - util: preserve function names without source map names (Hiroki Osame) #65108
  • [4299cd5897] - (SEMVER-MINOR) util: add non-throwing MIMEType.parse (James M Snell) #64965
  • [1aafd19813] - zlib: roll back a failed add() directory rewrite (Philipp Dunkel) #65016
  • [d29cc0926a] - zlib: let a ZipFile read finish before close() (Philipp Dunkel) #65016
  • [2bda6db916] - zlib: do not hang archiving a FIFO or device (Philipp Dunkel) #65016
  • [55b04957c9] - zlib: reject local/central ZIP header mismatch (Philipp Dunkel) #65016
  • [575260d3b4] - zlib: validate central directory record count (Matteo Collina) #65002
  • [8e848d9be3] - zlib: reject ambiguous ZIP archive ends (Matteo Collina) #65007
  • [df48191061] - (SEMVER-MINOR) zlib: add ZipEntry, ZipFile, and ZipBuffer (Philipp Dunkel) #64339
  • [ee7bf09090] - zlib: validate pledgedSrcSize for sync zstd (Archkon) #64601
6 hours ago
node

2026-08-26, Version 24.20.0 'Krypton' (LTS), @aduh95

Notable Changes

  • [b12bcc9ae1] - (SEMVER-MINOR) async_hooks: add using scopes to AsyncLocalStorage (Stephen Belanger) #61674
  • [e2eb88b36b] - (SEMVER-MINOR) buffer: add end parameter (Robert Nagy) #62390
  • [1fefdda18e] - crypto: update root certificates to NSS 3.125 (Node.js GitHub Bot) #64746
  • [4a158cf1ab] - doc: add MikeMcC399 as collaborator (Mike McCready) #64656
  • [d4cafce076] - (SEMVER-MINOR) lib,permission: add permission.drop (Rafael Gonzaga) #62672
  • [b3cfb55267] - (SEMVER-MINOR) loader: implement package maps (Maël Nison) #62239
  • [cd1eb3e60b] - (SEMVER-MINOR) src,permission: add --permission-audit (RafaelGSS) #61869
  • [28dc85d8d2] - (SEMVER-MINOR) stream: add node:stream/iter implementation (James M Snell) #62066
  • [d31c168740] - (SEMVER-MINOR) test_runner: add context.log() and test:log event (Moshe Atlow) #64389
  • [add1edbc42] - (SEMVER-MINOR) test_runner: report entryFile in TestStream events (Moshe Atlow) #64309
  • [d937c8c6cd] - (SEMVER-MINOR) wasm: enable JSPI (Guy Bedford) #59941

Commits

  • [1822c0f335] - assert,util: fix TypeError on Maps with null keys (Paul Bouchon) #64441
  • [b12bcc9ae1] - (SEMVER-MINOR) async_hooks: add using scopes to AsyncLocalStorage (Stephen Belanger) #61674
  • [984260bf44] - async_hooks: use validateBoolean for trackPromises (Soul Lee) #64731
  • [ba2612cca2] - benchmark: fix calibrate-n option handling (Luan Muniz) #64146
  • [236dc4d2d7] - benchmark: add bytes variant to webstreams async-iterator (Matteo Collina) #64291
  • [b022a1419c] - benchmark: respect stream/iter broadcast backpressure (Trivikram Kamat) #63314
  • [a290f51f15] - (SEMVER-MINOR) benchmark: add benchmarks for experimental stream/iter (James M Snell) #62066
  • [465f2bfb74] - buffer: use Clamp conversion in Blob slice (Donghoon Kang) #64739
  • [74a22cd0c5] - buffer: validate copyArrayBuffer offsets against buffer length (Ilia Alshanetsky) #63904
  • [21e24208dc] - buffer: normalize lone "\r" in Blob native line endings (Daijiro Wachi) #64115
  • [ddacb3ff10] - buffer: fix Blob.stream() leaking source buffer (semimikoh) #63577
  • [49198d2313] - buffer: fix end parameter bugs in indexOf/lastIndexOf (Robert Nagy) #62711
  • [e2eb88b36b] - (SEMVER-MINOR) buffer: add end parameter (Robert Nagy) #62390
  • [e2e5c4fe88] - build: update binary-upload to use correct tarball name (Stewart X Addison) #65282
  • [b78a212553] - build: pin envinfo versions in github actions (Joyee Cheung) #64117
  • [094fb840aa] - build: add QUIC CI job for PRs matching QUIC related paths (Tim Perry) #63875
  • [91f5003cad] - build: fix flags for ngtcp2 on IBM i (SRAVANI GUNDEPALLI) #60073
  • [e83648effd] - build,test: add tests for binary linked with shared libnode (Joyee Cheung) #61463
  • [4a425b41d9] - build,tools: fix shared library cross-compile (Kirill Saied) #63963
  • [fe8fa45ff2] - cli: style node --help output with util.styleText (Adrián Estrada) #64484
  • [3cd1576cb2] - crypto: preserve OpenSSL errors from KDF failures (Filip Skokan) #64776
  • [74b3023565] - crypto: handle XOF output allocation failure (Filip Skokan) #64851
  • [fea0666a1b] - crypto: clarify missing cipher error (Filip Skokan) #64852
  • [33fec91b54] - crypto: reuse X509 issuer result (Filip Skokan) #64852
  • [44c1473348] - crypto: validate key generation options (Filip Skokan) #64852
  • [c2c53a18e5] - crypto: fix Argon2 validation errors (Filip Skokan) #64852
  • [edc1f2126d] - crypto: initialize KeyObjectData mutex eagerly (Filip Skokan) #64851
  • [be8237240c] - crypto: handle DH operation failures (Filip Skokan) #64851
  • [b65a8f3875] - crypto: preserve RSA-PSS legacy pubkey DER (Filip Skokan) #64547
  • [49f2ae204b] - crypto: cleanse provider private key copies (Filip Skokan) #64547
  • [a5d4ac8208] - crypto: handle incomplete RSA private keys (Filip Skokan) #64547
  • [b72c0b9616] - crypto: retain legacy DH validation (Filip Skokan) #64547
  • [24a1be5886] - crypto: limit KangarooTwelveParams customization to 512 bytes (Filip Skokan) #64557
  • [0290e0a61e] - crypto: split OpenSSL 3, BoringSSL, and legacy backends (Filip Skokan) #64211
  • [ba27e72ff8] - crypto: fix Argon2 bypassing FIPS mode (Filip Skokan) #64776
  • [1fefdda18e] - crypto: update root certificates to NSS 3.125 (Node.js GitHub Bot) #64746
  • [c0dd022081] - crypto: use user-facing error for output encoding changes (Archkon) #64692
  • [ff485a9410] - crypto: make --use-system-ca per-env rather than per-process (Aditi) #60678
  • [1329d9b9f1] - debugger: preserve overlapping CDP request state (Trivikram Kamat) #64467
  • [82a02336aa] - deps: V8: backport d259a9e2ead7 (Leszek Swirski) #63865
  • [f0fc82d404] - deps: update ngtcp2 to 1.25.0 (Node.js GitHub Bot) #64944
  • [c4e02f0fbc] - deps: upgrade npm to 11.19.0 (npm team) #64883
  • [d5a57ed4dd] - deps: update nghttp3 to 1.18.0 (Node.js GitHub Bot) #64943
  • [51d413150a] - deps: update minimatch to 10.2.6 (Node.js GitHub Bot) #64945
  • [21f79ce140] - deps: update simdjson to 4.6.6 (Node.js GitHub Bot) #64942
  • [7a4960d6a9] - deps: update acorn to 8.18.0 (Node.js GitHub Bot) #64941
  • [5c423aa113] - deps: update googletest to 1b6f64d659944658a4c685b7bd9f04c1c3b8a39b (Node.js GitHub Bot) #64940
  • [40561e61b0] - deps: update nghttp2 to 1.70.0 (Node.js GitHub Bot) #64939
  • [51090925b0] - deps: update zlib to 1.3.2.1-motley-42c2f19 (Node.js GitHub Bot) #64744
  • [7c534bf8e5] - deps: V8: backport 5177b10891e6 (avivkeller) #64631
  • [7b1898a341] - deps: update ada to 4.0.0 (Node.js GitHub Bot) #64790
  • [9209cc4095] - deps: update sqlite to 3.53.4 (Node.js GitHub Bot) #64745
  • [3833fceff6] - deps: update googletest to fa005b296f90faec4f352d7ab382287bf6548c8d (Node.js GitHub Bot) #64587
  • [bc7ce488d1] - deps: histogram: cherry-pick 62ea52b07ee9b195 (StefanStojanovic) #64296
  • [e3fa05841d] - deps: update histogram to 0.11.10 (Node.js GitHub Bot) #64296
  • [e75bdb9bbe] - deps: update amaro to 1.1.11 (Node.js GitHub Bot) #64586
  • [1e034e6e40] - deps: update timezone to 2026c (Node.js GitHub Bot) #64588
  • [2b8f1f27bd] - deps: update googletest to 8240fa7d62f73e01c7af27d61ed965d6d66698fa (Node.js GitHub Bot) #64439
  • [241ece0417] - deps: enable OpenSSL asm support for riscv64 (Jamie Magee) #62606
  • [215105eb90] - deps: update c-ares to 1.34.8 (Node.js GitHub Bot) #64330
  • [7ac97fc84e] - deps: upgrade npm to 11.18.0 (npm team) #64199
  • [8d4cb9ae46] - deps: update zlib to 1.3.2.1-motley-8b3aa8a (Node.js GitHub Bot) #64295
  • [564c0f4592] - deps: update ngtcp2 to 1.24.0 (Node.js GitHub Bot) #64297
  • [e3304cd31a] - deps: update nghttp3 to 1.17.0 (Node.js GitHub Bot) #64182
  • [345d6ad4eb] - deps: update ngtcp2 to 1.23.0 (Node.js GitHub Bot) #63777
  • [a53db015e6] - deps: update nghttp3 to 1.16.0 (Node.js GitHub Bot) #63776
  • [1f4a5c1c76] - deps: update ngtcp2 to 1.22.1 (Node.js GitHub Bot) #62812
  • [080c4d7cda] - deps: update ngtcp2 to 1.22.0 (Node.js GitHub Bot) #62595
  • [4309e7c82f] - deps: update ngtcp2 to 1.21.0 (Node.js GitHub Bot) #62051
  • [90cf11cfb5] - deps: update nghttp3 to 1.15.0 (Node.js GitHub Bot) #61512
  • [e1f315a554] - deps: update ngtcp2 to 1.20.0 (Node.js GitHub Bot) #61511
  • [9a3f690c9d] - deps: update ngtcp2 to 1.19.0 (Node.js GitHub Bot) #61156
  • [fe88f31764] - deps: add ngtcp2 test binaries (James M Snell) #59946
  • [6d60fce138] - diagnostics_channel: grow native channel storage (Stephen Belanger) #64497
  • [30ae8ab091] - doc: document --permission-audit audit mode behavior (Adrián Estrada) #64791
  • [8cefc6efa8] - doc: fix guaranteed typo (lilianakatrina684-a11y) #62374
  • [2e78e4b120] - doc: add throwIfNoEntry version history to fs.stat (kovan) #62204
  • [c7a04401cb] - doc: fix grammar and punctuation in dgram documentation (Kamal Rawal) #64957
  • [331e5e8f62] - doc: fix grammar and editorial issues in addons documentation (Kamal Rawal) #64952
  • [232287fcc6] - doc: formalize fn/name as part of TestOptions API (Christopher Hiller) #64946
  • [7f9efeb445] - doc: remove references to ca/crl as per-context QuicSession options (René) #64769
  • [b54aa83cc6] - doc: fix typo in maintaining-dependencies.md (greenhead) #64896
  • [f4e427803c] - doc: add RafaelGSS as last security release stewards (Rafael Gonzaga) #64843
  • [f2cd6df3f3] - doc: fix typos in documentation (greenhead) #64900
  • [d5627162bd] - doc: improve TestContext hook descriptions (Kamal Rawal) #64899
  • [72ee03bd2e] - doc: document stream.isDestroyed() (YspritanHyzygy) #64789
  • [995141eb81] - doc: add contributing detail for git Signed-off-by trailer (Mike McCready) #64862
  • [dc30379310] - doc: fix duplicated word in test snapshot docs (Kamal Rawal) #64837
  • [205d4d0472] - doc: remove obsolete cctest node.gyp instructions (Soul Lee) #64814
  • [108b883d0b] - doc: report proper return type on url.format (Brian Muenzenmeyer) #64806
  • [b03bd3a8ed] - doc: clarify tlsSocket.authorized on resumption (soreavis) #64584
  • [093098ad7f] - doc: stabilize --disable-warning (Jean Michelet) #64742
  • [2de1d76d80] - doc: add MDN links for explicit resource management in fs (lluisemper) #59557
  • [2e0f36a891] - doc: mention constructor check in deepStrictEqual (Sumit Kumar Das) #62010
  • [1c9d354d09] - doc: update technical priorities (Jacob Smith) #64505
  • [30c99bf08f] - doc: deprecation add more codemod (Augustin Mauroy) #63175
  • [8a971a09eb] - doc: run license-builder (Node.js GitHub Bot) #63918
  • [707f6eacfc] - doc: clarify rules for adding new built-in modules (Antoine du Hamel) #64648
  • [928208cffc] - doc: mention DEPENDENCY custom field for H1 reports (Rafael Gonzaga) #64634
  • [ee593cadf5] - doc: fix dnsPromises.lookup verbatim default (Shivam S) #64658
  • [9c228b32d1] - doc: fix typo in releases guide (Jihwan) #64621
  • [4a158cf1ab] - doc: add MikeMcC399 as collaborator (Mike McCready) #64656
  • [8125809853] - doc: use promote wording in release guide (Md Muhtasim Munif Fahim) #64371
  • [2a2effadf6] - doc: fix import.meta example for vm.SourceTextModule (Muhammad Zeeshan) #64112
  • [c879f912bf] - doc: mention crypto.hash() for better perf (Steven) #63420
  • [634afda904] - doc: update sea example by fixing wrong code example (Maxence Robinet) #64025
  • [bced1433a3] - doc: fix socket.readyState state descriptions (YuSheng Chen) #64468
  • [4b2c18938f] - doc: replace large tables in crypto.md and webcrypto.md with lists (Filip Skokan) #64582
  • [5207231996] - doc: note --env-file is not applied to --run (Paul Bouchon) #64442
  • [329a2884fd] - doc: fix typo in embedding.md (greenhead) #64425
  • [fab3f56aa1] - doc: fix typos in contributing docs (Donghoon Kang) #64520
  • [cbc2bed4e8] - doc: document TLS alpnProtocol and servername fields (Tim Perry) #64362
  • [dada3ae60e] - doc: fix spelling in devcontainer guide (한만욱) #64459
  • [71343b28aa] - doc: clarify PEM format for signing keys (Harjoth Khara) #64404
  • [0544ec1c78] - doc: fix typo in tls.md (Daijiro Wachi) #64458
  • [8fe58078e7] - doc: document net Socket server property (Efe Karasakal) #64364
  • [d54fd03fa4] - doc: update a Dispatcher undici doc link (Filip Skokan) #64358
  • [1bdebecd41] - doc: fix typos in documentation (Jungwon Sohn) #64466
  • [86bca58641] - doc: clarify fixes and refs trailer guidance (Trivikram Kamat) #64421
  • [b5b84c9394] - doc: add scope overview tables for TestsStream events (Moshe Atlow) #64386
  • [004238d77c] - doc: clarify proxy threat model (Matteo Collina) #64366
  • [6851b8d55f] - doc: add note about restricted CI to pull-requests.md (Stewart X Addison) #64321
  • [662e33714a] - doc: various updates to releases.md (Stewart X Addison) #64198
  • [949bc3cfd3] - doc: remove obsolete --napi-modules doc entry (Chengzhong Wu) #64220
  • [830d16067f] - doc: clarify QUIC stream state wording (EduardF1) #63660
  • [79b6704630] - doc: fix typo in node-config-schema.json (Hamid Reza Ghavami) #64188
  • [9f5bf554db] - doc: fix broken link (Antoine du Hamel) #65078
  • [42b27ed428] - doc: remove unsupported syntax from stream_iter.md (Antoine du Hamel) #64649
  • [f1a9df7f22] - doc: clarify fromReadable() duck-typed contract (Trivikram Kamat) #63682
  • [c7a3d450ac] - doc: improve quic documentation (James M Snell) #63157
  • [cc425bc659] - doc: fix promise nomenclature in stream_iter.md (Antoine du Hamel) #63406
  • [859a02da96] - doc: minor structural stream/iter edits (René) #63089
  • [630b15eb20] - doc: fix doubled word typo in stream_iter.md (Daijiro Wachi) #62916
  • [50791fa8fa] - doc,test: widen fsPromises.appendFile()'s data type, add missing tests (Jimmy Leung) #64279
  • [9e39360a09] - esm: improve ERR_REQUIRE_ASYNC_MODULE (Joyee Cheung) #64260
  • [d2b02e443a] - esm: print required top-level await locations without evaluating (Joyee Cheung) #64154
  • [e8c153f3f4] - events: avoid retaining removed event names (Matteo Collina) #64475
  • [73e1701bad] - events: optimize once() and removeListener() (Matteo Collina) #64373
  • [12f7fc0558] - fs: key glob matcher cache by platform (Archkon) #64571
  • [e5af022302] - fs: add pattern cache for matchGlobPattern() (bq) #63915
  • [63321eeb11] - fs: fix cp symlink and EEXIST handling on Windows (Kirill Saied) #64353
  • [0ad55e5618] - http: fix writableFinished and 'finish' after write errors (Tim Perry) #64847
  • [ee54d9d4d2] - http: avoid aborting IncomingMessage signal on normal close (Archkon) #64392
  • [14cb8b0a06] - http: guard invalid timeout values in checkConnections (Efe Karasakal) #64506
  • [f24177ccc6] - http: propagate highWaterMark to ClientRequest OutgoingMessage (trivenay) #64653
  • [55e2c2da8c] - http: fix perf_hooks detail.req.url port and proxied path (Stefano Baghino) #64311
  • [b57350fe27] - http: remove unused n arg from IncomingMessage._read (Efe Karasakal) #64370
  • [af3a17e0b3] - http2: avoid copying the options in respond() (Matteo Collina) #64265
  • [f11ac0da37] - http2: avoid per-write closures in kWriteGeneric (Matteo Collina) #64265
  • [157bd07b6e] - http2: reduce per-request allocations (Matteo Collina) #64265
  • [b075b33429] - http2: don't throw when destroying socket proxy (Matteo Collina) #64427
  • [445bcce079] - inspector: add --cond to node inspect probe mode (Joyee Cheung) #64328
  • [06b54fe7d3] - lib: fix AbortSignal.any() observed-composite leak (Paul Bouchon) #64481
  • [d8fac094d1] - lib: fix typo in comment in _http_client.js (agape1225) #64729
  • [9ce72fd6fb] - lib: use assignFunctionName util where it makes sense (Antoine du Hamel) #64515
  • [c40d1473e6] - lib,permission: fix addon permission drop (Martin Wagner) #64007
  • [d4cafce076] - (SEMVER-MINOR) lib,permission: add permission.drop (Rafael Gonzaga) #62672
  • [6b09d30a76] - lib,tools: add node-core/func-name-matching lint rule (Livia Medeiros) #57901
  • [d7d4f0e2ac] - loader: enforce path normalization before lookup (Maël Nison) #63917
  • [b3cfb55267] - (SEMVER-MINOR) loader: implement package maps (Maël Nison) #62239
  • [cf425ad935] - meta: bump actions/stale from 10.3.0 to 11.0.0 (dependabot[bot]) #64935
  • [26fa9cc32b] - meta: bump github/codeql-action/analyze from 4.36.2 to 4.37.3 (dependabot[bot]) #64934
  • [c90fa82cd7] - meta: bump github/codeql-action/autobuild from 4.36.2 to 4.37.3 (dependabot[bot]) #64933
  • [314893253a] - meta: bump actions/setup-python from 6.3.0 to 7.0.0 (dependabot[bot]) #64932
  • [6ab711278f] - meta: bump github/codeql-action/init from 4.36.2 to 4.37.3 (dependabot[bot]) #64931
  • [9138f5892a] - meta: bump Mozilla-Actions/sccache-action from 0.0.10 to 0.0.11 (dependabot[bot]) #64930
  • [3ef3f934d4] - meta: bump github/codeql-action/upload-sarif from 4.36.2 to 4.37.3 (dependabot[bot]) #64927
  • [a0a33127ae] - meta: bump step-security/harden-runner from 2.19.4 to 2.20.0 (dependabot[bot]) #64926
  • [4ad2afbf33] - meta: bump ossf/scorecard-action from 2.4.3 to 2.4.4 (dependabot[bot]) #64925
  • [d9b2ee4083] - meta: add @nodejs/url as codeowner for node_url_pattern.* (Efe Karasakal) #64737
  • [2b43b78e82] - meta: lower stale to 3 months (Aviv Keller) #64569
  • [0ffe8352ae] - meta: move one or more collaborators to emeritus (Node.js GitHub Bot) #64315
  • [afd922cd8a] - meta: bump actions/checkout from 6.0.2 to 7.0.0 (dependabot[bot]) #64245
  • [b6149a2976] - meta: bump actions/setup-python from 6.2.0 to 6.3.0 (dependabot[bot]) #64241
  • [8f4a5c622f] - meta: update sccache version in test-linux-quic (René) #64043
  • [9040b08696] - net: support TCP handle transfer on Windows (Matteo Collina) #64460
  • [1216481a09] - net: support AF_UNIX paths in net.BoundSocket (Guy Bedford) #64399
  • [f6bf3f8a5d] - net: support sync connect for BoundSocket (Guy Bedford) #64375
  • [fb8a7e15ca] - net: make TCP Server and Socket transferable across worker threads (Matteo Collina) #64225
  • [224d2c7886] - path: add benchmarks for path.matchesGlob() (bq) #63915
  • [980c651de5] - permission: add unique warning codes (David Evans) #64414
  • [9f9a96030d] - permission: support v8.setHeapSnapshotNearHeapLimit (Ilyas Shabi) #64808
  • [8a00872183] - quic: fix stop sending behaviour & callback (Tim Perry) #64710
  • [7aab0c3183] - quic: fix coverage comment typo (Jungwon Sohn) #64486
  • [b4ecb3040b] - quic: fix segfault after fragmented client hello (Tim Perry) #64720
  • [6386540dad] - quic: serialize stream reset code as string (한만욱) #64577
  • [82717741c9] - quic: defer server session emit until TLS ClientHello is processed (Tim Perry) #64132
  • [7cb3099907] - quic: preserve session stats after close (한만욱) #64489
  • [50e639b578] - quic: add support for TLS certificate compression (Sebastian Beltran) #64434
  • [e2e28292cc] - quic: extract transport logic from Application to Session (Tim Perry) #64127
  • [2ef4b7ebf2] - quic: correct http3 callback and fix revealed errs (Marten Richter) #64289
  • [a682b53456] - quic: fix no onstream handler crash quic (Efe) #64158
  • [9445e2719a] - quic: fix stall datagrams, if no pending streams (Marten Richter) #64303
  • [2ea9d193bd] - quic: fix potential crash from unobserved closed (Tim Perry) #64134
  • [3b7f4fc1fb] - quic: drop version negotiation packets with oversized CIDs (Mohamed Sayed) #64228
  • [bd477a3202] - quic: fixes undefined handle in QuicStream kInspect (Marten Richter) #64170
  • [3dd04b3ec6] - quic: fix get_reader bug that dropped data on FIN (Tim Perry) #63946
  • [4be8abe8f9] - quic: expose QUIC certificates as JS X509Certificate, not raw handles (Tim Perry) #63191
  • [e264c5c0cb] - quic: fix reader backpressure deadlock on idle connections (Tim Perry) #63950
  • [2f749dde18] - quic: impl. cb for http/3 settings/app. options (Marten Richter) #63558
  • [5ca7ef3202] - quic: fix broken listEndpoints export, test callbacks & nghttp3 include (Tim Perry) #63874
  • [147150cfdd] - quic: add listEndpoints API (James M Snell) #63536
  • [3b59d12f5d] - quic: add proper error codes & messages for QUIC failures (Tim Perry) #63198
  • [b68f8eadb9] - quic: support hostname verification (James M Snell) #63483
  • [7652bd9c6d] - quic: add stream idle timeout (James M Snell) #63483
  • [e493f04214] - quic: add block list support for endpoints (James M Snell) #63483
  • [6d6cd45f8b] - quic: improve peer cert verification (James M Snell) #63483
  • [dbe0b371ee] - quic: handle h3 max header size option (James M Snell) #63483
  • [39dca4150c] - quic: add rate limiting docs (James M Snell) #63483
  • [c726a893d6] - quic: cache timestamp for address lru cache (James M Snell) #63483
  • [11778a7925] - quic: add session creation rate limiting (James M Snell) #63483
  • [8107f1b3ed] - quic: refine rate limiting (James M Snell) #63483
  • [3f0d7371e0] - quic: flip preferred address policy default to 'ignore' (James M Snell) #63483
  • [97c8a96774] - quic: add doc note about certificate size limitations (James M Snell) #63483
  • [42aa3f6612] - quic: add applicationOptions to session (James M Snell) #63267
  • [4c00ab9d29] - quic: add getters for local and remote transport parameters (James M Snell) #63267
  • [858b636576] - quic: improve recv coalescing test sizes (James M Snell) #63267
  • [84d3100256] - quic: add initial RTT option to session options (James M Snell) #63267
  • [a2b6a81c66] - quic: enable recvmmsg batching in Endpoint (James M Snell) #63267
  • [46a0868994] - quic: improve stream header collection performance (James M Snell) #63267
  • [bc7f4efdb7] - quic: coalesce received data into fewer buffers (James M Snell) #63267
  • [f727efb8b2] - quic: apply multiple additional minor improvements (James M Snell) #63267
  • [ee0a0f1540] - quic: fix tests that are missing serverEndpoint close (James M Snell) #63267
  • [f8a1fdad07] - quic: fixup some v8:: qualifiers (James M Snell) #63267
  • [c66605609c] - quic: fix premature unref of endpoint when listening (James M Snell) #63267
  • [9a72949b0b] - quic: fixup UAFs in bindingdata, streams, and app (James M Snell) #63267
  • [a4db12198e] - quic: fix UAF in Application::OnTimeout() (James M Snell) #63267
  • [0a11b2ccde] - quic: improve the quic js structure (James M Snell) #63267
  • [1bc25d2a03] - quic: improve internal structure of QuicStream (James M Snell) #63267
  • [69e48aed02] - quic: add aliased struct arenas (James M Snell) #63267
  • [6b7185351b] - quic: add handshake timeout and default connection limits (James M Snell) #63267
  • [91e3c39097] - quic: fix crash in early handshake failure (James M Snell) #63267
  • [098e3d715d] - quic: eliminate per-received datagram allocation (James M Snell) #63267
  • [53b05e2ab2] - quic: cache the timestamp on send and receive (James M Snell) #63267
  • [1592a11219] - quic: add support for future ECN marking (James M Snell) #63267
  • [80e6bf9539] - quic: improve batching of packet sending (James M Snell) #63267
  • [ff0cd5b95f] - quic: improve backend quic packet processing (James M Snell) #63267
  • [c4eb6a95da] - quic: send correct OpenSSL alert for ALPN mismatches (Tim Perry) #63193
  • [575dc7d100] - quic: fixup quic stream variable chunk len (James M Snell) #63230
  • [2551f9e6dd] - quic: remove unused env_ variable in session_manager.h/cc (James M Snell) #63177
  • [bea62a14b3] - quic: ignore coverage for quic files (James M Snell) #63149
  • [9788bbff97] - quic: complete the internal implementation of QUIC (James M Snell) #62876
  • [54c094d245] - quic: continue working on quic api bits (James M Snell) #60123
  • [ea82bc418d] - readline: reduce createInterface overhead (Matteo Collina) #64585
  • [90a8b23db0] - sqlite: invalidate sessions when closing database (Trivikram Kamat) #64783
  • [6abd00ed65] - sqlite: check database state before calling SQLite (Trivikram Kamat) #64812
  • [c2a52514d6] - sqlite: fix crash when a session outlives its database (Mohamed Sayed) #63797
  • [f9126923ef] - sqlite: fix use-after-free in Exec() and ApplyChangeset() (Matteo Collina) #64535
  • [c010131bc3] - sqlite: read column count after step in StatementSync.all() (Guilherme Araújo) #64219
  • [782ad5d5b0] - src: implement MemoryRetainer protocol for ByteSource (Filip Skokan) #64660
  • [4afc15bf1d] - src: avoid redundant KEM encapsulation copies (Filip Skokan) #64553
  • [37085f850d] - src: fix crash when writing odd-length hex string via Writev (RajeshKumar11) #63658
  • [f58ac8224c] - src: avoid using ToLocalChecked in crypto_hash (James M Snell) #64668
  • [05ec9c4771] - src: fix libuv assertion on windows (liuxingbaoyu) #61999
  • [308a589ee9] - src: avoid redundant DataPointer reallocations (Filip Skokan) #64552
  • [3650fabcb4] - src: fix comment typos (Jungwon Sohn) #64509
  • [06b3441ea2] - src: zero-initialize cap_data in node_credentials.cc (Samuel Kapust) #64347
  • [bb24a88b99] - src: fix some typo errors and rename some variables (Archkon) #64301
  • [ba36ab71fd] - src: make node.config.json throw at unknown fields (Marco Ippolito) #62992
  • [fbb3960189] - src: show original file name in FileHandle GC close errors (Anna Henningsen) #60593
  • [d53d582be7] - src,permission: do not throw on denied access in audit mode (Adrián Estrada) #64426
  • [cd1eb3e60b] - (SEMVER-MINOR) src,permission: add --permission-audit (RafaelGSS) #61869
  • [b1596c2b65] - stream: cut per-chunk allocations in pipeTo (Matteo Collina) #64890
  • [2cfa96f5cb] - stream: preserve push signal abort reason (Trivikram Kamat) #64798
  • [fc80ff5f7a] - stream: skip zero-byte broadcast writes (Trivikram Kamat) #64772
  • [486cff4c08] - stream: honor AbortSignal in Writer.end() (Trivikram Kamat) #64727
  • [59ef1789f7] - stream: use validateString for consumer encoding (Jungwon Sohn) #64754
  • [8aba47536a] - stream: use the ring buffer for pending BYOB pull-into descriptors (Matteo Collina) #64818
  • [b20217cb56] - stream: fix uncatchable error closing half-open Duplex.toWeb() writable (Mohamed Sayed) #64161
  • [8accb0c4c0] - stream: abort pending single-source merge reads (Trivikram Kamat) #64445
  • [ed5b04027c] - stream: use RangeError for broadcast overflow (Trivikram Kamat) #64420
  • [136d4e7628] - stream: skip null output from stateful transforms (Trivikram Kamat) #64462
  • [193091f1ba] - stream: update iterable streams to use budget backpressure (James M Snell) #64464
  • [e2b32fce77] - stream: remove custom CloneableDOMException implementation (Antoine du Hamel) #64469
  • [d77788eafe] - stream: fix drop-newest behavior in share() (Trivikram Kamat) #64417
  • [de4ca2c962] - stream: fold desired-size check into WHATWG backpressure update (Matteo Collina) #64451
  • [2a3babb8d7] - stream: validate writer options signal (Trivikram Kamat) #64385
  • [0ab8f269b0] - stream: reject push iterator.throw() with error (Trivikram Kamat) #64380
  • [262e6545d1] - stream: simplify nested PromisePrototypeThens (Antoine du Hamel) #64470
  • [0ddfc6af91] - stream: use the ring buffer for WHATWG stream request queues (Matteo Collina) #64431
  • [a5e7d89f9e] - stream: validate writevSync chunks before queuing (Trivikram Kamat) #64300
  • [8044f895bf] - stream: speed up reads and iteration over default WHATWG streams (Matteo Collina) #64320
  • [d4dfb66bdf] - stream: copy SAB-backed chunks in iter consumers (Trivikram Kamat) #64382
  • [9c9ade337f] - stream: reject nested async streamables in from() (Trivikram Kamat) #64352
  • [271c7454f4] - stream: avoid draining merged iter sources (Trivikram Kamat) #64293
  • [cbb2568a04] - stream: use ring buffer for WHATWG stream queues (Yagiz Nizipli) #64312
  • [67688cc651] - stream: hoist repeated loads in readable paths (Yagiz Nizipli) #64312
  • [3f8b446a67] - stream: prefer sync iterator in fromSync (Trivikram Kamat) #64294
  • [3043b2a68a] - stream: speed up async iteration over WHATWG byte streams (Antoine du Hamel) #64291
  • [870273ccde] - stream: reject iter consumers on abort (Trivikram Kamat) #64066
  • [8a4a997f3e] - stream: fix merge abort for pending sources (Trivikram Kamat) #64013
  • [ac5e5d5dec] - stream: refactor unnecessary optional chaining away (Antoine du Hamel) #64253
  • [cb298cfb15] - stream: normalize Broadcast.from() byte inputs (Trivikram Kamat) #64082
  • [bbbb4aadef] - stream: observe abort while awaiting pipeTo source (Trivikram Kamat) #64015
  • [4387ad412f] - stream: respect iter consumer abort signals (Trivikram Kamat) #63997
  • [4ba1fa0062] - stream: handle falsy push writer fail reasons (Trivikram Kamat) #63569
  • [3b8c30c096] - stream: handle setEncoding after buffered data (Matteo Collina) #63973
  • [97ef13c84e] - stream: keep overlapping broadcast reads pending (Trivikram Kamat) #63500
  • [a46ddad9fa] - stream: refine the stream/iter backpressure (James M Snell) #63697
  • [557bf99245] - stream: remove transform-writer handling in pipeTo (Trivikram Kamat) #63684
  • [24b7831a1a] - stream: fix pipeToSync byte accounting (Trivikram Kamat) #63564
  • [3b5f1b56bc] - stream: reject pull() reads on abort (Trivikram Kamat) #63498
  • [e48e287633] - stream: fast-path stateless transform flush results (Trivikram Kamat) #63605
  • [f0ee316f45] - stream: handle sync writev completion in pipeTo (Trivikram Kamat) #63561
  • [fbed90b2fb] - stream: settle pending broadcast reads on return (Trivikram Kamat) #63603
  • [568dcc250f] - stream: serialize concurrent share consumer reads (Trivikram Kamat) #63478
  • [5e2b4c4ade] - stream: fix lint error (Antoine du Hamel) #63598
  • [74bd0cd35a] - stream: reject pending reads on iterator throw (Trivikram Kamat) #63555
  • [45780df841] - stream: wait for push writer end fallback to drain (Trivikram Kamat) #63503
  • [217b495e0a] - stream: flush each fused stateless transform (Trivikram Kamat) #63468
  • [2e8685592e] - stream: avoid duplicate writes in toWritable (Trivikram Kamat) #63360
  • [88a3392a78] - stream: propagate abort reason in share and broadcast (Trivikram Kamat) #63358
  • [fce3df74e9] - stream: disallow writing string chunk with 'buffer' encoding (René) #63062
  • [5658c631fa] - stream: align Readable.toWeb termination with eos (ikeyan) #62394
  • [02a51a746b] - stream: add sync iterable fast path to pipeTo (Trivikram Kamat) #63318
  • [4c9f3edb64] - stream: fix merge handling for object-like sources (Trivikram Kamat) #63356
  • [c50d8e49cc] - stream: limit iter from sync iterable batches (Trivikram Kamat) #63324
  • [1d7c86d577] - stream: cache minimum cursor count in broadcast (Trivikram Kamat) #63322
  • [ec2666edbe] - stream: avoid retrying accepted pipeTo writes (Trivikram Kamat) #63297
  • [f63143fd83] - stream: validate broadcast writer writev chunks (Trivikram Kamat) #63300
  • [944470b08a] - stream: uncork fromWritable writev on chunk error (Trivikram Kamat) #63295
  • [ae79f2b67a] - stream: validate fromWritable() options before cache (Trivikram Kamat) #63278
  • [c98cc67f33] - stream: optimize single-slot push queue drain (Trivikram Kamat) #63274
  • [9a45ff5d8f] - stream: preserve toReadableSync batch after backpressure (Trivikram Kamat) #63276
  • [eb72fe94fc] - stream: cache minimum cursor count in share (Trivikram Kamat) #63262
  • [b57b51eeed] - stream: minor stream/iter implementation edits (René) #63132
  • [274b3a2ea1] - stream: remove redundant method check from iter.pipeToSync (René) #63099
  • [baf98faa06] - stream: add stream/iter to classic stream adapters (James M Snell) #62469
  • [28dc85d8d2] - (SEMVER-MINOR) stream: add stream/iter Implementation (James M Snell) #62066
  • [125c19da43] - stream, quic: update iterable streams backpressure (James M Snell) #64464
  • [11d1bd3ba7] - test: split test-embedding.js and run tests in parallel (Joyee Cheung) #61571
  • [e59346b704] - test: ensure assertions are reached on all tests (Antoine du Hamel) #64716
  • [42a967d7ed] - test: unflake debugger and REPL tests (Matteo Collina) #64718
  • [d80a45fdc4] - test: update WPT for url to 4832db4761 (Node.js GitHub Bot) #64829
  • [7264efb21b] - test: update WPT for url to b63305b743 (Node.js GitHub Bot) #64790
  • [539f5dc8f9] - test: cover worker throwing primitive values (varshitha) #64365
  • [087d9e8dd0] - test: mark test-repl-user-error-handler as flaky (Aviv Keller) #64612
  • [dd1e7139a5] - test: update quic tests for stream/iter update (James M Snell) #64464
  • [eee0e84537] - test: fix flaky http2 socket proxy test (Tim Perry) #64673
  • [a5ce44dd75] - test: apply correction to comment (Rich Trott) #64524
  • [da8508c5a0] - test: keep finalization before-exit ref alive (Tim Perry) #64521
  • [14b710c415] - test: copyedit test-tls-psk-alpn-callback-exception-handling (Antoine du Hamel) #63485
  • [99b7382c6a] - test: fix stale async-context-frame status entries (Kirill Saied) #64141
  • [6da6ca730d] - test: update WPT for urlpattern to 5847ee5cfa (Node.js GitHub Bot) #64436
  • [73bf0f07f1] - test: update WPT for WebCryptoAPI to ec2fee39a4 (Node.js GitHub Bot) #64435
  • [9a7ec52e6f] - test: fix flaky http2 maxOriginSetSize test (Tim Perry) #64407
  • [59af7e0ed9] - test: fix 2nd flaky blob test case (Tim Perry) #64391
  • [7fd5f66376] - test: fix flaky watch + cwd + argv test-runner test (Tim Perry) #64372
  • [d5b47d2fae] - test: normalize Windows crash in debugger test normalization (Joyee Cheung) #64332
  • [a8ae44096d] - test: unmark flaky http2-large-file for Win (Kirill Saied) #64255
  • [8461d18597] - test: increase timeout in consumed-timeout test (Trivikram Kamat) #64204
  • [af52410d70] - test: handle null stdio streams in spawnSyncAndAssert helper (Joyee Cheung) #64273
  • [0ea079be7b] - test: remove impact of tier-up changes in worker stack size test (Joyee Cheung) #64271
  • [1bde0ef053] - test: update WPT for WebCryptoAPI to 0c413fb56b (Node.js GitHub Bot) #63647
  • [f32b412867] - test: get rid of unnecessary AbortController instanciations (Antoine du Hamel) #63489
  • [8cbd90161b] - test: update WPT for wasm/jsapi to 288c467d35 (Node.js GitHub Bot) #63136
  • [f200aaccf0] - test: fixup quic tests (James M Snell) #63267
  • [14c547351b] - (SEMVER-MINOR) test: add tests for experimental stream/iter implementation (James M Snell) #62066
  • [2cc54e1793] - test: skip quic tests that IBM i does not support (SRAVANI GUNDEPALLI) #60160
  • [8ec80b311b] - test_runner: wait for filtered suite build (semimikoh) #64208
  • [9ed7146851] - test_runner: convert to uint during deserialization (Aviv Keller) #64706
  • [d31c168740] - (SEMVER-MINOR) test_runner: add context.log() and test:log event (Moshe Atlow) #64389
  • [add1edbc42] - (SEMVER-MINOR) test_runner: report entryFile in TestStream events (Moshe Atlow) #64309
  • [8d97dee696] - tests: start adding quic test server utilities (James M Snell) #59946
  • [e5278b7f7d] - timers: do not retain a reference to the async store after firing (Matteo Collina) #53443
  • [e277bc4608] - tls: fix SNICallback certificate selection (Matteo Collina) #64700
  • [b9104decc3] - tls: match IPv6 hosts against IP-Address SANs (Pascal Garber) #64145
  • [b50139e89f] - tools: bump the eslint group in /tools/eslint with 4 updates (dependabot[bot]) #64928
  • [5460c464a0] - tools: bump brace-expansion from 5.0.7 to 5.0.9 in /tools/eslint (dependabot[bot]) #64904
  • [f8a13811cd] - tools: use 'readonly' for EventSource global (Honey Tyagi) #64787
  • [6e10012c0d] - tools: bump brace-expansion from 5.0.6 to 5.0.7 in /tools/eslint (dependabot[bot]) #64636
  • [d66b7588ac] - tools: reference 'git node land' in PR-URL: error message in merge.sh (Stewart X Addison) #64495
  • [5d90e48175] - tools: disable zipping tarballs on GHA (Antoine du Hamel) #64423
  • [8a909f4540] - tools: fix redundant conditions in v8.gyp for riscv64 and loong64 (Jamie Magee) #62608
  • [9e171710fa] - tools: remove envinfo from our workflows (Antoine du Hamel) #64259
  • [3fb722054f] - tools: avoid test/fixtures/wpt/README.md conflicts (Filip Skokan) #63938
  • [5755712920] - tools: add lint rule for aborted AbortController (Trivikram Kamat) #63541
  • [e88d5b78bc] - typings: add heap_utils internalBinding types (Donghoon Kang) #64816
  • [ae93bc8ad1] - typings: remove isDataView from types binding (Archkon) #64738
  • [c00bd1427d] - url: create URLPattern result properties in WebIDL order (Archkon) #64733
  • [8a07969e28] - util: make MIMEParams accessors case-insensitive (Daijiro Wachi) #64123
  • [bf86741167] - v8: report minor mark-sweep in GCProfiler (Archkon) #64688
  • [d937c8c6cd] - (SEMVER-MINOR) wasm: enable JSPI (Guy Bedford) #59941
  • [9016ddabb9] - wasm: register missing SetURL function (Archkon) #64679
  • [e599b9428b] - zlib: validate pledgedSrcSize as a safe integer (Archkon) #64604
  • [1f1adc89da] - zlib: accept ArrayBuffer dictionary in Zstd (Ryuhei Shima) #64599
  • [0ee91ead8b] - zlib: reject truncated zstd input (Archkon) #64593
1 days ago
openssl

OpenSSL 3.0.22

OpenSSL 3.0.22 is a security patch release. The most severe CVE fixed in this release is Moderate.

This release incorporates the following bug fixes and mitigations:

  • Fixed heap buffer overflow in CMS key unwrapping. (CVE-2026-63072)

  • Fixed invalid pointer dereference in CMP server via crafted protectionAlg. (CVE-2026-63076)

  • Fixed excessive memory use buffering DTLS records for a future epoch. (CVE-2026-54874)

  • Fixed CMP indefinite cache growth of extraCerts. (CVE-2026-63074)

  • Fixed possibility of AEAD forgeries with empty ciphertext when using EVP_Cipher(). (CVE-2026-75803)

  • Fixed checking of authentication tags for empty ciphertexts for AEAD ciphers in CCM cipher mode.

1 days ago
openssl

OpenSSL 3.4.7

OpenSSL 3.4.7 is a security patch release. The most severe CVE fixed in this release is Moderate.

This release incorporates the following bug fixes and mitigations:

  • Fixed heap buffer overflow in CMS key unwrapping. (CVE-2026-63072)

  • Fixed invalid pointer dereference in CMP server via crafted protectionAlg. (CVE-2026-63076)

  • Fixed RPK server signature algorithm selection being able to dereference a missing certificate. (CVE-2026-14457)

  • Fixed excessive memory use buffering DTLS records for a future epoch. (CVE-2026-54874)

  • Fixed untrusted Sender DN being used as a format string in CMP response validation. (CVE-2026-63073)

  • Fixed CMP indefinite cache growth of extraCerts. (CVE-2026-63074)

  • Fixed QUIC ACK-only packet retention being able to cause memory exhaustion. (CVE-2026-63075)

  • Fixed possibility of AEAD forgeries with empty ciphertext when using EVP_Cipher(). (CVE-2026-75803)

  • Fixed checking of authentication tags for empty ciphertexts for AEAD ciphers in CCM cipher mode.

1 days ago
openssl

OpenSSL 3.5.8

OpenSSL 3.5.8 is a security patch release. The most severe CVE fixed in this release is Moderate.

This release incorporates the following bug fixes and mitigations:

  • Fixed QUIC server being able to trigger double free when processing INITIAL packet. (CVE-2026-18798)

  • Fixed heap buffer overflow in CMS key unwrapping. (CVE-2026-63072)

  • Fixed invalid pointer dereference in CMP server via crafted protectionAlg. (CVE-2026-63076)

  • Fixed unbounded memory growth in QUIC server incoming channel queue. (CVE-2026-14456)

  • Fixed RPK server signature algorithm selection being able to dereference a missing certificate. (CVE-2026-14457)

  • Fixed excessive memory use buffering DTLS records for a future epoch. (CVE-2026-54874)

  • Fixed untrusted Sender DN being used as a format string in CMP response validation. (CVE-2026-63073)

  • Fixed CMP indefinite cache growth of extraCerts. (CVE-2026-63074)

  • Fixed QUIC ACK-only packet retention being able to cause memory exhaustion. (CVE-2026-63075)

  • Fixed possibility of AEAD forgeries with empty ciphertext when using EVP_Cipher(). (CVE-2026-75803)

  • Fixed checking of authentication tags for empty ciphertexts for AEAD ciphers in CCM cipher mode.

1 days ago
openssl

OpenSSL 3.6.4

OpenSSL 3.6.4 is a security patch release. The most severe CVE fixed in this release is Moderate.

This release incorporates the following bug fixes and mitigations:

  • Fixed QUIC server being able to trigger double free when processing INITIAL packet. (CVE-2026-18798)

  • Fixed heap buffer overflow in CMS key unwrapping. (CVE-2026-63072)

  • Fixed invalid pointer dereference in CMP server via crafted protectionAlg. (CVE-2026-63076)

  • Fixed unbounded memory growth in QUIC server incoming channel queue. (CVE-2026-14456)

  • Fixed RPK server signature algorithm selection being able to dereference a missing certificate. (CVE-2026-14457)

  • Fixed excessive memory use buffering DTLS records for a future epoch. (CVE-2026-54874)

  • Fixed client-side memory leak in OCSP response checking. (CVE-2026-54876)

  • Fixed untrusted Sender DN being used as a format string in CMP response validation. (CVE-2026-63073)

  • Fixed CMP indefinite cache growth of extraCerts. (CVE-2026-63074)

  • Fixed QUIC ACK-only packet retention being able to cause memory exhaustion. (CVE-2026-63075)

  • Fixed possibility of AEAD forgeries with empty ciphertext when using EVP_Cipher(). (CVE-2026-75803)

  • Fixed checking of authentication tags for empty ciphertexts for AEAD ciphers in CCM cipher mode.

1 days ago
openssl

OpenSSL 4.0.2

OpenSSL 4.0.2 is a security patch release. The most severe CVE fixed in this release is Moderate.

This release incorporates the following bug fixes and mitigations:

  • Fixed QUIC server being able to trigger double free when processing INITIAL packet. (CVE-2026-18798)

  • Fixed heap buffer overflow in CMS key unwrapping. (CVE-2026-63072)

  • Fixed invalid pointer dereference in CMP server via crafted protectionAlg. (CVE-2026-63076)

  • Fixed unbounded memory growth in QUIC server incoming channel queue. (CVE-2026-14456)

  • Fixed RPK server signature algorithm selection being able to dereference a missing certificate. (CVE-2026-14457)

  • Fixed excessive memory use buffering DTLS records for a future epoch. (CVE-2026-54874)

  • Fixed client-side memory leak in OCSP response checking. (CVE-2026-54876)

  • Fixed untrusted Sender DN being used as a format string in CMP response validation. (CVE-2026-63073)

  • Fixed CMP indefinite cache growth of extraCerts. (CVE-2026-63074)

  • Fixed QUIC ACK-only packet retention being able to cause memory exhaustion. (CVE-2026-63075)

  • Fixed possibility of AEAD forgeries with empty ciphertext when using EVP_Cipher(). (CVE-2026-75803)

  • Fixed checking of authentication tags for empty ciphertexts for AEAD ciphers in CCM cipher mode.