• [5a36018abc] - doc: add MikeMcC399 as collaborator (Mike McCready) #64656
• [9b04f82d7b] - (SEMVER-MINOR) ffi: add getCurrentEventLoop (Paolo Insogna) #64323
• [bb51f2c960] - (SEMVER-MINOR) test_runner: add context.log() and test:log event (Moshe Atlow) #64389
• [56ce83b3ee] - (SEMVER-MINOR) test_runner: report entryFile in TestStream events (Moshe Atlow) #64309

• [248ff9fa5c] - assert,util: fix TypeError on Maps with null keys (Paul Bouchon) #64441
• [3b5baceafe] - benchmark: add bytes variant to webstreams async-iterator (Matteo Collina) #64291
• [0a46d1ef66] - buffer: normalize lone "\r" in Blob native line endings (Daijiro Wachi) #64115
• [d9ada18b70] - buffer: fix Blob.stream() leaking source buffer (semimikoh) #63577
• [d05993bcf6] - build: merge multiple on download artifact (Chengzhong Wu) #64633
• [6c25ac909a] - build: extract temporal_capi crate directory name into gyp variable (René) #64482
• [612f60c300] - cli: style node --help output with util.styleText (Adrián Estrada) #64484
• [29a938ddbb] - crypto: preserve RSA-PSS legacy pubkey DER (Filip Skokan) #64547
• [2fde794357] - crypto: cleanse provider private key copies (Filip Skokan) #64547
• [33a0e08d41] - crypto: handle incomplete RSA private keys (Filip Skokan) #64547
• [11b4d505ef] - crypto: retain legacy DH validation (Filip Skokan) #64547
• [6e302041e1] - crypto: limit KangarooTwelveParams customization to 512 bytes (Filip Skokan) #64557
• [195f103e87] - crypto: split OpenSSL 3, BoringSSL, and legacy backends (Filip Skokan) #64211
• [ec67e24eee] - deps: update googletest to fa005b296f90faec4f352d7ab382287bf6548c8d (Node.js GitHub Bot) #64587
• [32ffff88fd] - deps: histogram: cherry-pick 62ea52b07ee9b195 (StefanStojanovic) #64296
• [e0664f1f09] - deps: update histogram to 0.11.10 (Node.js GitHub Bot) #64296
• [cf0622bdd6] - deps: update amaro to 1.1.11 (Node.js GitHub Bot) #64586
• [04c78b8b24] - deps: update timezone to 2026c (Node.js GitHub Bot) #64588
• [59f4318976] - deps: V8: cherry-pick 1158ae719749 (René) #64432
• [e5ea7cd299] - deps: update googletest to 8240fa7d62f73e01c7af27d61ed965d6d66698fa (Node.js GitHub Bot) #64439
• [0e7554cee4] - deps: update libffi to 3.7.1 (Node.js GitHub Bot) #64438
• [46c9d724ad] - deps: update ngtcp2 to 1.24.0 (Node.js GitHub Bot) #64297
• [3519aac9af] - deps: enable OpenSSL asm support for riscv64 (Jamie Magee) #62606
• [c09701218b] - deps: update c-ares to 1.34.8 (Node.js GitHub Bot) #64330
• [ad2f3bc95b] - deps: upgrade npm to 11.18.0 (npm team) #64199
• [d7a4b22c86] - deps: V8: backport a05321ebd98e (Chengzhong Wu) #64202
• [8679cff291] - deps: update zlib to 1.3.2.1-motley-8b3aa8a (Node.js GitHub Bot) #64295
• [df5b1e10ba] - doc: remove unsupported syntax from stream_iter.md (Antoine du Hamel) #64649
• [8a4ca9083f] - doc: clarify rules for adding new built-in modules (Antoine du Hamel) #64648
• [7d50fe6b7a] - doc: mention DEPENDENCY custom field for H1 reports (Rafael Gonzaga) #64634
• [8f415bf5fc] - doc: fix dnsPromises.lookup verbatim default (Shivam S) #64658
• [c6378f724d] - doc: fix broken links and clean up type map (Antoine du Hamel) #64625
• [9b53ec19a2] - doc: fix typo in releases guide (Jihwan) #64621
• [5a36018abc] - doc: add MikeMcC399 as collaborator (Mike McCready) #64656
• [d2c8acd764] - doc: use promote wording in release guide (Md Muhtasim Munif Fahim) #64371
• [5c692cb576] - doc: fix import.meta example for vm.SourceTextModule (Muhammad Zeeshan) #64112
• [7568ce71ca] - doc: mention crypto.hash() for better perf (Steven) #63420
• [cf3f631936] - doc: update sea example by fixing wrong code example (Maxence Robinet) #64025
• [ce21e567a4] - doc: fix socket.readyState state descriptions (YuSheng Chen) #64468
• [018c7f1c01] - doc: replace large tables in crypto.md and webcrypto.md with lists (Filip Skokan) #64582
• [cf82de8d8b] - doc: note --env-file is not applied to --run (Paul Bouchon) #64442
• [e635ce5201] - doc: fix typo in embedding.md (greenhead) #64425
• [0b1f6eda3f] - doc: fix typos in contributing docs (Donghoon Kang) #64520
• [d978ce80ef] - doc: document TLS alpnProtocol and servername fields (Tim Perry) #64362
• [394669e3b3] - doc: fix spelling in devcontainer guide (한만욱) #64459
• [9786a593ea] - doc: clarify PEM format for signing keys (Harjoth Khara) #64404
• [6251f832ba] - doc: fix typo in tls.md (Daijiro Wachi) #64458
• [b8656c40ad] - doc: document net Socket server property (Efe Karasakal) #64364
• [03e9c738f3] - doc: update a Dispatcher undici doc link (Filip Skokan) #64358
• [b6dd2debf0] - doc: fix typos in documentation (Jungwon Sohn) #64466
• [3b7d778c3c] - doc: clarify fixes and refs trailer guidance (Trivikram Kamat) #64421
• [eb086a6e03] - doc: remove duplicate VirtualProvider description (Archkon) #64400
• [bc221a8cd7] - doc: add scope overview tables for TestsStream events (Moshe Atlow) #64386
• [4b3dbd36df] - doc: clarify proxy threat model (Matteo Collina) #64366
• [c5526f69d6] - doc: add note about restricted CI to pull-requests.md (Stewart X Addison) #64321
• [968eaf6538] - doc: various updates to releases.md (Stewart X Addison) #64198
• [2a51f8ba8e] - doc: remove obsolete --napi-modules doc entry (Chengzhong Wu) #64220
• [ee5a54535e] - doc,test: widen fsPromises.appendFile()'s data type, add missing tests (Jimmy Leung) #64279
• [b923df86fc] - events: avoid retaining removed event names (Matteo Collina) #64475
• [7d8d413ff5] - events: optimize once() and removeListener() (Matteo Collina) #64373
• [f2f8881d2a] - ffi: evaluate function signatures once (Trivikram Kamat) #64559
• [9b04f82d7b] - (SEMVER-MINOR) ffi: add getCurrentEventLoop (Paolo Insogna) #64323
• [4a3ef5b2b5] - fs: add pattern cache for matchGlobPattern() (bq) #63915
• [ce113efcac] - fs: fix cp symlink and EEXIST handling on Windows (Kirill Saied) #64353
• [3be3041ac9] - http: fix perf_hooks detail.req.url port and proxied path (Stefano Baghino) #64311
• [0047ad73cf] - http: remove unused n arg from IncomingMessage._read (Efe Karasakal) #64370
• [4d48984d5c] - http2: don't throw when destroying socket proxy (Matteo Collina) #64427
• [3329647762] - http2: avoid copying the options in respond() (Matteo Collina) #64265
• [a44fca5e24] - http2: avoid per-write closures in kWriteGeneric (Matteo Collina) #64265
• [546e0e70a1] - inspector: add --cond to node inspect probe mode (Joyee Cheung) #64328
• [b38a39dd96] - lib: use assignFunctionName util where it makes sense (Antoine du Hamel) #64515
• [f60a12b94f] - lib,tools: add node-core/func-name-matching lint rule (Livia Medeiros) #57901
• [9e6e9d4745] - meta: lower stale to 3 months (Aviv Keller) #64569
• [3dd11c4993] - meta: move one or more collaborators to emeritus (Node.js GitHub Bot) #64315
• [3f55208104] - module: add two tests for eager imports when using import defer (Maya Lekova) #64197
• [c791eedc9d] - net: support sync connect for BoundSocket (Guy Bedford) #64375
• [4df4a3fc61] - net: make TCP Server and Socket transferable across worker threads (Matteo Collina) #64225
• [5dd34d7d06] - path: add benchmarks for path.matchesGlob() (bq) #63915
• [8e520646b6] - quic: defer server session emit until TLS ClientHello is processed (Tim Perry) #64132
• [4b8cc9a3fb] - quic: preserve session stats after close (한만욱) #64489
• [591090ca85] - quic: add support for TLS certificate compression (Sebastian Beltran) #64434
• [d636c9c30f] - quic: extract transport logic from Application to Session (Tim Perry) #64127
• [abb62f961f] - quic: correct http3 callback and fix revealed errs (Marten Richter) #64289
• [5f535fdbe8] - quic: fix no onstream handler crash quic (Efe) #64158
• [933e5f14b5] - quic: fix stall datagrams, if no pending streams (Marten Richter) #64303
• [272632a57f] - quic: fix potential crash from unobserved closed (Tim Perry) #64134
• [2d5f445489] - sqlite: read column count after step in StatementSync.all() (Guilherme Araújo) #64219
• [54929af44e] - src: avoid redundant KEM encapsulation copies (Filip Skokan) #64553
• [5380bf28b3] - src: avoid redundant DataPointer reallocations (Filip Skokan) #64552
• [6ff5a1b834] - src: fix comment typos (Jungwon Sohn) #64509
• [508ec0e435] - src: zero-initialize cap_data in node_credentials.cc (Samuel Kapust) #64347
• [c5090a36c1] - src: fix some typo errors and rename some variables (Archkon) #64301
• [0a89bef69e] - src,permission: do not throw on denied access in audit mode (Adrián Estrada) #64426
• [63e71195c5] - stream: abort pending single-source merge reads (Trivikram Kamat) #64445
• [f403b30c3d] - stream: use RangeError for broadcast overflow (Trivikram Kamat) #64420
• [5c0578cbf7] - stream: skip null output from stateful transforms (Trivikram Kamat) #64462
• [0488d02d5d] - stream: update iterable streams to use budget backpressure (James M Snell) #64464
• [f0811baeef] - stream: remove custom CloneableDOMException implementation (Antoine du Hamel) #64469
• [10f3f9682e] - stream: fix drop-newest behavior in share() (Trivikram Kamat) #64417
• [2aad973b29] - stream: resume flow when an errored pipe destination is removed (Mahin Anowar) #64310
• [6112ed5ceb] - stream: fold desired-size check into WHATWG backpressure update (Matteo Collina) #64451
• [d829aa1138] - stream: validate writer options signal (Trivikram Kamat) #64385
• [8e7a5e940e] - stream: reject push iterator.throw() with error (Trivikram Kamat) #64380
• [4390f81294] - stream: simplify nested PromisePrototypeThens (Antoine du Hamel) #64470
• [ddf2c38e9d] - stream: use the ring buffer for WHATWG stream request queues (Matteo Collina) #64431
• [518d81b36d] - stream: validate writevSync chunks before queuing (Trivikram Kamat) #64300
• [f745c4261d] - stream: speed up reads and iteration over default WHATWG streams (Matteo Collina) #64320
• [4f4bce62fe] - stream: copy SAB-backed chunks in iter consumers (Trivikram Kamat) #64382
• [f29937d26f] - stream: reject nested async streamables in from() (Trivikram Kamat) #64352
• [424cec71b7] - stream: avoid draining merged iter sources (Trivikram Kamat) #64293
• [e01906180c] - stream: use ring buffer for WHATWG stream queues (Yagiz Nizipli) #64312
• [0a0193f666] - stream: hoist repeated loads in readable paths (Yagiz Nizipli) #64312
• [ebe16003b6] - stream: prefer sync iterator in fromSync (Trivikram Kamat) #64294
• [f249614835] - stream: speed up async iteration over WHATWG byte streams (Matteo Collina) #64291
• [7331118699] - stream, quic: update iterable streams backpressure (James M Snell) #64464
• [46b117729d] - test: update quic tests for stream/iter update (James M Snell) #64464
• [b122ca5389] - test: fix flaky http2 socket proxy test (Tim Perry) #64673
• [68c46146fd] - test: apply correction to comment (Rich Trott) #64524
• [d7e119b26b] - test: keep finalization before-exit ref alive (Tim Perry) #64521
• [0db4e10a0c] - test: copyedit test-tls-psk-alpn-callback-exception-handling (Antoine du Hamel) #63485
• [21389f7b25] - test: fix stale async-context-frame status entries (Kirill Saied) #64141
• [af55304846] - test: update WPT for urlpattern to 5847ee5cfa (Node.js GitHub Bot) #64436
• [43a5ce4e00] - test: update WPT for WebCryptoAPI to ec2fee39a4 (Node.js GitHub Bot) #64435
• [11ca52a521] - test: fix flaky http2 maxOriginSetSize test (Tim Perry) #64407
• [af08a11e77] - test: fix 2nd flaky blob test case (Tim Perry) #64391
• [0104ae1171] - test: fix flaky watch + cwd + argv test-runner test (Tim Perry) #64372
• [b3ff5fe3f4] - test: normalize Windows crash in debugger test normalization (Joyee Cheung) #64332
• [4cdceb7436] - test: unmark flaky http2-large-file for Win (Kirill Saied) #64255
• [19f529377b] - test: unmark flaky SEA snapshot tests on Windows (Kirill Saied) #64317
• [66f9b342ef] - test: increase timeout in consumed-timeout test (Trivikram Kamat) #64204
• [fdbbf0ae6d] - test: handle null stdio streams in spawnSyncAndAssert helper (Joyee Cheung) #64273
• [10ea17dafe] - test: remove impact of tier-up changes in worker stack size test (Joyee Cheung) #64271
• [bb51f2c960] - (SEMVER-MINOR) test_runner: add context.log() and test:log event (Moshe Atlow) #64389
• [56ce83b3ee] - (SEMVER-MINOR) test_runner: report entryFile in TestStream events (Moshe Atlow) #64309
• [7a02e4f9e6] - timers: do not retain a reference to the async store after firing (Matteo Collina) #53443
• [7d5d46ef00] - tls: match IPv6 hosts against IP-Address SANs (Pascal Garber) #64145
• [f7bc0c62df] - tools: bump brace-expansion from 5.0.6 to 5.0.7 in /tools/eslint (dependabot[bot]) #64636
• [3f80ed2e93] - tools: reference 'git node land' in PR-URL: error message in merge.sh (Stewart X Addison) #64495
• [7b373cafce] - tools: disable zipping tarballs on GHA (Antoine du Hamel) #64423
• [5bdbd256e9] - tools: add workflow to compare Nix changes (Antoine du Hamel) #64410
• [ca4a16634b] - tools: add option for benchmark.yml to post comment on PR (Antoine du Hamel) #64395
• [86193ef193] - tools: fix redundant conditions in v8.gyp for riscv64 and loong64 (Jamie Magee) #62608
• [ee460404be] - util: make MIMEParams accessors case-insensitive (Daijiro Wachi) #64123
• [a63ee46ddd] - vfs: make recursive readdir iterative (AkshatOP) #64149
• [37f93c3b15] - vfs: make lchmod update symlink mode (Trivikram Kamat) #64350
• [ce54e2a9c8] - vfs: fix VirtualReadStream race with async iteration (Y1D7NG) #64394
• [54e8d3a14b] - vfs: follow symlinked dirs in recursive mkdir (Trivikram Kamat) #64287
• [7be42b64e1] - vm: enable interception on global restricted properties (Chengzhong Wu) #64202
• [c2cfcf8e7d] - zlib: reject truncated zstd input (Archkon) #64593

• [d08872b530] - (SEMVER-MINOR) buffer: implement blob.textStream() (Matthew Aitken) #64036
• [35222948be] - (SEMVER-MINOR) deps: update OpenSSL build config to support compression (Tim Perry) #62217
• [d6ab039f24] - (SEMVER-MINOR) doc: update blockList stability status to release candidate (alphaleadership) #63050
• [1da05fb79d] - doc: mark stream.compose stable (Matteo Collina) #62562
• [3c1636dabf] - (SEMVER-MINOR) esm: add --experimental-import-text flag (Efe) #62300
• [e323e877be] - (SEMVER-MINOR) fs: support caller-supplied readFile() buffers (Matteo Collina) #63634
• [c1248c9544] - (SEMVER-MINOR) http: add httpValidation option to configure header value validation (RajeshKumar11) #61597
• [a534b65815] - (SEMVER-MINOR) net: support TCP_KEEPINTVL and TCP_KEEPCNT in setKeepAlive (Guy Bedford) #63825
• [a23cdec683] - (SEMVER-MINOR) perf_hooks: sample delay per event loop iteration (Pablo Erhard) #62935
• [7428b57a37] - (SEMVER-MINOR) src: allow empty --experimental-config-file (Marco Ippolito) #61610
• [e57597173c] - (SEMVER-MINOR) stream: expose ReadableStreamTee (Matteo Collina) #64195
• [5396235993] - (SEMVER-MINOR) tls: report negotiated TLS groups (Filip Skokan) #64119
• [5e901b5cd9] - (SEMVER-MINOR) tls: add certificateCompression option (Tim Perry) #62217

• [676467fa9f] - benchmark: trim down the argon2 sets (Filip Skokan) #64218
• [a77a2000b7] - benchmark: add child_process async path baselines (Yagiz Nizipli) #63929
• [dd4482e915] - buffer: remove unreachable overflow check in atob (haramjeong) #60161
• [081c41eb86] - buffer: add fast api for isUtf8 and isAscii (Gürgün Dayıoğlu) #64169
• [d08872b530] - (SEMVER-MINOR) buffer: implement blob.textStream() (Matthew Aitken) #64036
• [6e2f7e6013] - build: remove redundant intermediate node_aix_shared (Chengzhong Wu) #63747
• [87e0675f51] - build: build codecache and snapshot with libnode (Chengzhong Wu) #63626
• [32174a7bae] - build: support setting an emulator from configure script (Ivan Trubach) #53899
• [69cfb2f240] - build: remove duplicated node_use_sqlite and node_use_ffi conditions (Chengzhong Wu) #63629
• [37ac6e8cb5] - build: add manually-dispatched stress-test workflow (Joyee Cheung) #64118
• [2424207191] - build: suppress compiler warnings for histogram (Richard Lau) #63980
• [63502b7404] - build,win: fix VS2022 arm64 PGO build (Stefan Stojanovic) #63413
• [fe4e4055d0] - child_process: fix permission model propagation via NODE_OPTIONS (Matteo Collina) #63972
• [aa2f3c066e] - child_process: pass spawn options to the binding positionally (Yagiz Nizipli) #63930
• [fcf32cf77a] - child_process: serialize advanced IPC messages natively (Yagiz Nizipli) #63933
• [7907134734] - crypto: reject small-order EdDSA points during verify (Filip Skokan) #64026
• [b505cd5465] - crypto: support non-byte WebCrypto lengths and cSHAKE (Filip Skokan) #63988
• [0f54a872e2] - crypto: share WebCrypto method and usage helpers (Filip Skokan) #63975
• [824ec11c05] - crypto: refactor keyObject.toCryptoKey() and SubtleCrypto.getPublicKey() (Filip Skokan) #63622
• [73aba92689] - crypto: coerce -0 to +0 before native calls (Filip Skokan) #63556
• [c83b79874e] - crypto: reject invalid raw key imports (Filip Skokan) #63134
• [934fda64b9] - crypto: improve accuracy of SubtleCrypto.supports (Filip Skokan) #63104
• [e392e1f791] - crypto: fix large DH generator validation (Tobias Nießen) #64092
• [e75a363e70] - crypto: use EVP_MAC for HMAC on OpenSSL >=3 (Filip Skokan) #63942
• [adbaf7af9b] - crypto: make webcrypto aliasKeyFormat directional (Filip Skokan) #63910
• [bb1aea8897] - crypto: fix unhandled error in Hash._transform (Haram Jeong) #63261
• [12c87732c1] - crypto: handle cipher context allocation failures (Tian Teng) #63542
• [858496b453] - crypto: deduplicate X509 subject matching logic (Tobias Nießen) #63644
• [9a29cb0964] - crypto: fix warnings in test_node_crypto.cc (Maya Lekova) #63490
• [8bb536066d] - crypto: optimize normalizeAlgorithm dispatch hot path (Filip Skokan) #62756
• [329e5496ff] - crypto,tls: do not ignore BN_get_word error (Tobias Nießen) #63895
• [97b7a3f9c7] - debugger: add --max-hit option to probe mode (Joyee Cheung) #63704
• [9098585c5e] - debugger: add more logs to probe mode (Joyee Cheung) #63663
• [59cca26cd5] - debugger: surface inspector failures in probe mode (Joyee Cheung) #63437
• [2922290eae] - debugger: disambiguate probe location binding (Joyee Cheung) #63286
• [6fb2c2c7e2] - debugger: lazily wait for initial break output (Trivikram Kamat) #63969
• [688e792551] - debugger: defer probe pause handling until startup (Trivikram Kamat) #63608
• [1ac93cc05a] - debugger: await initialization after run and restart (Trivikram Kamat) #63607
• [92a909cf72] - debugger,test: deflake resume failure test and add debug logs (Joyee Cheung) #63524
• [8b37af8b11] - deps: V8: backport bef0d9c1bc90 (Joyee Cheung) #62132
• [8832126422] - deps: V8: cherry-pick 64b36b441179 (Dan Carney) #61712
• [75990c2cd6] - deps: update googletest to 8b53336594cc52213c6c2c7a0b29194fa896d039 (Node.js GitHub Bot) #64181
• [8500c7ba86] - deps: update sqlite to 3.53.3 (Node.js GitHub Bot) #64180
• [dc78091b45] - deps: c-ares: cherry-pick 8ba37af8e3fb (René) #64110
• [873cc72125] - deps: update googletest to 0b1e895ba4226c2fda5ee0178c9b5b1195a741aa (Node.js GitHub Bot) #64039
• [1d3d166538] - deps: update acorn to 8.17.0 (Node.js GitHub Bot) #63901
• [35222948be] - (SEMVER-MINOR) deps: update OpenSSL build config to support compression (Tim Perry) #62217
• [e40cee5f79] - deps: upgrade npm to 11.17.0 (npm team) #63857
• [85c6d46606] - deps: add ngtcp2_fmt.c to build configuration (ngtcp2.gyp) (沈鸿飞) #63821
• [d2ea8b7a8c] - deps: update googletest to 7140cd416cecd7462a8aae488024abeee55598e4 (Node.js GitHub Bot) #63775
• [25b4d57bb6] - deps: update sqlite to 3.53.2 (Node.js GitHub Bot) #63774
• [a96368e4c7] - deps: update zlib to 1.3.2.1-motley-3246f1b (Node.js GitHub Bot) #63773
• [b59f1f5f37] - deps: update amaro to 1.1.10 (Node.js GitHub Bot) #63670
• [0b3b56ee95] - deps: update googletest to 8736d2cd5c1dcba41170ed2fddca14021d4916c3 (Node.js GitHub Bot) #63669
• [aa67b5b9c4] - dgram: add synchronous Socket connectSync() (Guy Bedford) #63932
• [ef38374875] - dgram: add synchronous Socket.prototype.bindSync() (Guy Bedford) #63838
• [6edc3a9967] - dgram: skip dns.lookup() for literal IP addresses (Ruben Bridgewater) #64133
• [d4cfe2d8ac] - dns: coerce -0 to +0 in lookup and resolver inputs (Filip Skokan) #63556
• [91c9ce5a45] - doc: improve fs.StatFs properties descriptions (aymanxdev) #62578
• [54e21675fa] - doc: fix inconsistencies in CJS code snippets (Antoine du Hamel) #63199
• [64c23daa76] - doc: remove typo comma from man page (Vas Sudanagunta) #63080
• [bc943cd34a] - doc: update Http2SecureServer.on("timeout") default value (YuSheng Chen) #64187
• [a46bc452a6] - doc: add note on visibility of CI failures to new contributor guide (Stewart X Addison) #64256
• [c0fb52506c] - doc: clarify HTTP/1.1 response ordering (Matteo Collina) #64213
• [d3073a7ba6] - doc: recommend node-stress-single-test for flaky tests (Trivikram Kamat) #64223
• [bb9951ead0] - doc: fix typo in examples (Vas Sudanagunta) #64184
• [fe674e96fc] - doc: clarify defense-in-depth issues (Matteo Collina) #64215
• [faad042184] - doc: add guide and answers to FAQs for first-time contributors (Joyee Cheung) #63685
• [79d685adf3] - doc: update Http2Server.close & Http2SecureServer.close (YuSheng Chen) #63298
• [744e40e05e] - doc: update list of people in SECURITY.md (Richard Lau) #64152
• [185f57c4a4] - doc: add missing option to man page (Richard Lau) #64156
• [8933303568] - doc: fix callback example import in fs docs (Kamal Rawal) #63912
• [3a0549dacb] - doc: fix keepAliveTimeout default in http.createServer options (Jahanzaib iqbal) #63974
• [5a35e48d08] - doc: add sxa GPG key (ed25519) (Stewart X Addison) #64193
• [66e7f815f1] - doc: add aduh95 to last security release steward (Antoine du Hamel) #63981
• [a7e35040dd] - doc: fix typo in util.md (Daijiro Wachi) #63961
• [d74b3a7e90] - doc: clarify callback exceptions (Matteo Collina) #63939
• [b7a8f8fabd] - doc: fix incorrect test runner mock examples (Kimaswa Emmanuel Yusufu) #63656
• [f11aa690cd] - doc: fix typo in cli.md (Daijiro Wachi) #63883
• [df85f50269] - doc: fix typo in vm.md (Daijiro Wachi) #63881
• [a00a567175] - doc: fix typo in packages.md (Daijiro Wachi) #63882
• [206c1b8437] - doc: fix a/an article typos in module, util, and dns (Daijiro Wachi) #63766
• [e3e5ef1cff] - doc: update npm supported versions link (hojeong park) #63672
• [e3c4852413] - doc: fix AES-OCB IV length in SubtleCrypto.supports example (Anshika Jain) #63717
• [0b3fbc82d7] - doc: add webstreams to args for pipeline from stream/promises (David Sanders) #63628
• [62078a8328] - doc: fix "used to sent" → "used to send" in http2 (Daijiro Wachi) #63700
• [fd74eefb23] - doc: clarify tty raw mode applies to input processing only (Muhammad Zeeshan) #63438
• [42cd7e47de] - doc: add worker_threads history entries (Bob Put) #63545
• [d6ab039f24] - (SEMVER-MINOR) doc: update blockList stability status to release candidate (alphaleadership) #63050
• [56bdd87378] - doc: move hyperlinks outside of text blocks (Aviv Keller) #63493
• [1da05fb79d] - doc: mark stream.compose stable (Matteo Collina) #62562
• [7bb6dab70c] - doc,crypto: mark argon2 and encap/decap as stable (Filip Skokan) #63924
• [1a4edb3c22] - doc,lib: align WebCrypto names with spec (Filip Skokan) #63518
• [3c1636dabf] - (SEMVER-MINOR) esm: add --experimental-import-text flag (Efe) #62300
• [e0f211ca79] - events: improve addAbortListener perf by caching options object (Raz Luvaton) #52367
• [a124429b36] - fs: do not treat EPERM as ENOTEMPTY on Windows (Kirill Saied) #63709
• [e323e877be] - (SEMVER-MINOR) fs: support caller-supplied readFile() buffers (Matteo Collina) #63634
• [a41b4824d7] - fs: prevent spurious recursive watch events on prefix siblings (Marco) #63095
• [c63e00e3a5] - fs: ignore deleted dirs in recursive watch scan (Trivikram Kamat) #63686
• [d3d7cd05e3] - fs: coerce -0 to +0 in mode flags and watch intervals (Filip Skokan) #63556
• [6f6387ecb3] - gyp: update deps gypfiles (Nad Alaba) #63117
• [592544af44] - http: document and validate options.path when it's in absolute-form (Joyee Cheung) #64108
• [c1248c9544] - (SEMVER-MINOR) http: add httpValidation option to configure header value validation (RajeshKumar11) #61597
• [85a223bf15] - http: fix drain event with cork/uncork (David Evans) #64038
• [8b060a9628] - inspector: fix crash when writing to closed inspector socket (ympark2011) #64209
• [e68a3d33ac] - inspector: fix inspector.close() documented behavior (Chengzhong Wu) #63837
• [d3682930b7] - lib: fix missing lazyDOMException import (Filip Skokan) #64033
• [af9ea9cfcf] - lib: reject string "0" in validatePort when allowZero is false (Daijiro Wachi) #64174
• [cd1ea26110] - lib: use __proto__: null when calling ObjectDefineProperty (Antoine du Hamel) #64239
• [5b264398ce] - lib: lazily initialize kEvents and kHandlers maps (Guilherme Araújo) #63702
• [823efe8c71] - lib: improve control abstraction coverage in frozen intrinsics (Renegade334) #63698
• [7f4af5568f] - lib: add Iterator global to primordials (Renegade334) #63698
• [c8f3f5e5a5] - lib: make Navigator#language getter throw on invalid this (Mohamed Sayed) #63601
• [1ebbbd59cf] - lib: optimize webidl conversion options (Filip Skokan) #62756
• [88590d1bb7] - meta: bump actions/checkout from 6.0.2 to 6.0.3 (dependabot[bot]) #63726
• [0ea9cb9630] - meta: bump actions/upload-artifact from 7.0.0 to 7.0.1 (dependabot[bot]) #62850
• [f7275a0864] - meta: fix linter warning in stale.yml (Antoine du Hamel) #64281
• [3a77d21d8c] - meta: bump actions/cache from 5.0.5 to 6.1.0 (dependabot[bot]) #64248
• [84e2836c95] - meta: bump github/codeql-action/autobuild from 4.36.1 to 4.36.2 (dependabot[bot]) #64247
• [09f800eec6] - meta: bump github/codeql-action/analyze from 4.36.1 to 4.36.2 (dependabot[bot]) #64246
• [6df1f97e64] - meta: bump codecov/codecov-action from 6.0.1 to 7.0.0 (dependabot[bot]) #64244
• [737eb89651] - meta: bump rtCamp/action-slack-notify from 2.3.3 to 2.4.0 (dependabot[bot]) #64243
• [dac3cd8b8f] - meta: bump github/codeql-action/init from 4.36.1 to 4.36.2 (dependabot[bot]) #64242
• [108a6bc481] - meta: bump github/codeql-action/upload-sarif from 4.36.1 to 4.36.2 (dependabot[bot]) #64240
• [34d09a725d] - meta: clarify V8 flags are outside threat model (Matteo Collina) #64224
• [944d9bc25f] - meta: move one or more collaborators to emeritus (Node.js GitHub Bot) #64057
• [cc22555402] - meta: update status of past strategic initiatives (Joyee Cheung) #63480
• [da7a21931e] - meta: speed up stale bot (Aviv Keller) #64075
• [7bfcf7ca56] - meta: bump github/codeql-action from 4.35.3 to 4.36.1 (dependabot[bot]) #63724
• [db6c983cdd] - meta: bump actions/cache from 5.0.4 to 5.0.5 (dependabot[bot]) #62847
• [9e4f1339d1] - meta: bump codecov/codecov-action from 6.0.0 to 6.0.1 (dependabot[bot]) #63725
• [92c98d3ade] - meta: bump actions/stale from 10.2.0 to 10.3.0 (dependabot[bot]) #63728
• [bbd3ffde89] - meta: bump step-security/harden-runner from 2.19.0 to 2.19.4 (dependabot[bot]) #63727
• [a6dd675c82] - module: enable import support for addons by default (Chengzhong Wu) #64221
• [fb2ccb15a1] - module: use file: URL as sourceURL for type-stripped CommonJS (Joyee Cheung) #63705
• [b9e17dc424] - net: early TCP binding via synchronous net.BoundSocket (Guy Bedford) #63951
• [a534b65815] - (SEMVER-MINOR) net: support TCP_KEEPINTVL and TCP_KEEPCNT in setKeepAlive (Guy Bedford) #63825
• [c55dd030e6] - net: coerce -0 to +0 in BlockList prefixes (Filip Skokan) #63556
• [a23cdec683] - (SEMVER-MINOR) perf_hooks: sample delay per event loop iteration (Pablo Erhard) #62935
• [f08b83bc1d] - perf_hooks: add NODE_PERFORMANCE_GC_MINOR_MARK_SWEEP constant (Attila Szegedi) #63877
• [8d58e1b415] - process: fix finalization cleanup ref tracking (Trivikram Kamat) #64087
• [c757e3ef59] - sqlite: do not leave database open after failed open (Yagiz Nizipli) #63854
• [87064a096b] - sqlite: fix stack-use-after-scope with function callback (ndossche) #63640
• [7428b57a37] - (SEMVER-MINOR) src: allow empty --experimental-config-file (Marco Ippolito) #61610
• [d7946c9c07] - src: add test flag to config file (Marco Ippolito) #60798
• [a642657d71] - src: rename config file testRunner to test (Marco Ippolito) #60798
• [818b43d09e] - src: do not enable wasm trap handler if there's not enough vmem (Joyee Cheung) #62132
• [af5e1a9729] - src: fix escaping of single quotes in task runner (Antoine du Hamel) #64089
• [8a5d3bc168] - src: abstract tracing agent for both legacy and perfetto (Chengzhong Wu) #64053
• [ce6f29e45b] - src: avoid redundant call to std::get_if<>() (Tobias Nießen) #64094
• [96478050f2] - src: omit unconvertible names in cjs_lexer::Parse (Yagiz Nizipli) #63943
• [0147ed746e] - src: guard OpenSSL compression header include (Filip Skokan) #64009
• [8d2858a9c4] - src: handle empty MaybeLocal in cjs_lexer::Parse (Yagiz Nizipli) #63885
• [e5289d180f] - src: do not track weak BaseObjects as childrens of Realms (Anna Henningsen) #63842
• [e8352ff754] - src: allow tracking children in MemoryTracker with weak edges (Anna Henningsen) #63842
• [a408f279c5] - src: use C++14 deprecated attribute for NODE_DEPRECATED (Anna Henningsen) #63755
• [4b5eb7b72d] - src: add cleanup hooks to node::ObjectWrap (Anna Henningsen) #63642
• [44976c6071] - src: fix edge case when deflateInit2() fails with Z_VERSION_ERROR (Nora Dossche) #63476
• [5b3bb284f3] - src: add Latin1 fast path in StringBytes::Encode utf8 (Mert Can Altin) #63385
• [7cdad636c4] - src: fix crash when reading length on Storage.prototype (Mohamed Sayed) #63529
• [c438250c68] - stream: cut per-chunk overhead in WHATWG streams (Matteo Collina) #64252
• [291c127947] - stream: reduce allocations on WHATWG streams hot paths (Matteo Collina) #63876
• [3d91aeb434] - stream: optimize pipeTo promise handling (Matteo Collina) #63572
• [fcbff00a44] - stream: preserve half-open duplexes in async iteration (Efe) #64275
• [e57597173c] - (SEMVER-MINOR) stream: expose ReadableStreamTee (Matteo Collina) #64195
• [a48edf40e8] - stream: proxy first own method in Readable.wrap() (Daijiro Wachi) #64048
• [f58c5bafcf] - stream: fix Writable.toWeb() desiredSize for non-object-mode (Matteo Collina) #62986
• [7261276f45] - stream: fix Utf8Stream stall after full write of multi-byte data (Daijiro Wachi) #63964
• [1558986b78] - stream: only pass the expected number of parameters to callbacks (Antoine du Hamel) #63909
• [edef89ba6a] - stream: fix dropped first chunk in Utf8Stream buffer mode (Daijiro Wachi) #63833
• [915e3e2f42] - stream: check done before backpressure in stream reader (Daijiro Wachi) #63699
• [2d29628b5b] - test: update WPT for WebCryptoAPI to 03a1476844 (Node.js GitHub Bot) #63900
• [89e23b70c4] - test: deflake test-debugger-probe-timeout (Joyee Cheung) #63547
• [54ca514414] - test: make blob desiredSize assertion robust (Trivikram Kamat) #64106
• [01cbe530eb] - test: update WPT for urlpattern to 11a459a2b1 (Node.js GitHub Bot) #64037
• [6fcd3cf516] - test: improve lcov reporter snapshot diagnostics (Trivikram Kamat) #64049
• [f50a55d7e5] - test: keep finalization close fixture ref alive (Trivikram Kamat) #64085
• [3085714530] - test: fix typo from overriden to overridden (parkhojeong) #63403
• [9f5347e8df] - test: mark hr-time WPT flaky on macos15-x64 (Trivikram Kamat) #64054
• [44b4fe4246] - test: use one-off agent in http consumed timeout test (Trivikram Kamat) #64052
• [2f567edaca] - test: fix flaky test-runner coverage threshold test (Trivikram Kamat) #64051
• [a56fbb2d36] - test: tolerate duplicate watch change events (Trivikram Kamat) #63937
• [b636f4769c] - test: mark test-debugger-run-after-quit-restart as flaky on macOS (Matteo Collina) #64006
• [ba23eb9717] - test: update WPT for url to d4598eba09 (Node.js GitHub Bot) #63899
• [bc420f20d8] - test: update WPT for urlpattern to 23aac92784 (Node.js GitHub Bot) #63898
• [d2c9c07af8] - test: add tests for 3 methods in utils (Daijiro Wachi) #63765
• [4e00c8ec2e] - test: mark SEA tests flaky on linux arm debug (Trivikram Kamat) #63743
• [a17cf06d12] - test: validate ERR_INVALID_THIS for scheduler methods (Daijiro Wachi) #63764
• [d59d7fdd16] - test: add coverage outside SEA (Daijiro Wachi) #63744
• [71a32d31bf] - test: update WPT for urlpattern to 2f28df545c (Node.js GitHub Bot) #63771
• [28c77ab174] - test: make Brotli 16GB test wait for backpressure (Trivikram Kamat) #63389
• [9a81921d4a] - test: add regression test for using ObjectWrap in worker (Mohamed Akram) #63642
• [88ab61f2f8] - test: accept SIGILL aborts in async-hooks tests (Trivikram Kamat) #63687
• [b4f5c86463] - test: add more test cases for pathToFileURL (Rafael Gonzaga) #63293
• [812a66f0ac] - test: update test426-fixtures to 2965987bf4c96afa400c9356c8e620cb340aaee (Node.js GitHub Bot) #63668
• [2bf0de838d] - test: cover webcrypto prototype pollution systematically (Filip Skokan) #63520
• [bec6856ae8] - test,debugger: add test for type stripping in debugger probe mode (Joyee Cheung) #63748
• [a2b9095e03] - test_runner: avoid recompiling coverage globs for every file (sangwook) #63675
• [02fbff446f] - test_runner: cache shouldSkipFileCoverage result per URL (sangwook) #63675
• [094869354a] - test_runner: ignore erased TS lines in coverage (Matteo Collina) #63510
• [68edc2b009] - test_runner: fix suite diagnostic chanel end (Moshe Atlow) #63533
• [659d5bf068] - test_runner: add parentId to test events with testId (Moshe Atlow) #63435
• [eaebeb8b88] - test_runner: fix hooks test context (Moshe Atlow) #63285
• [d03d96889b] - test_runner: add tags option and tag-name filter (Chemi Atlow) #63221
• [e8c3db1364] - test_runner: add getTestContext() (Moshe Atlow) #62501
• [345c591d10] - test_runner: filter execArgv fallback for child tests (Trivikram Kamat) #64056
• [2f47fb23bf] - test_runner: improve coverage failure diagnostics (Trivikram Kamat) #64050
• [260cf1ac89] - test_runner: add timestamp to JUnit reporter testsuites (sangwook) #64029
• [24140eafdf] - test_runner: remove unused shuffleArrayWithSeed (Daijiro Wachi) #63847
• [b7fdb4891a] - test_runner: fix watch cwd with isolation none (Trivikram Kamat) #63690
• [e48b307e09] - timers: reuse Timeout objects in setStreamTimeout (Matteo Collina) #64254
• [5396235993] - (SEMVER-MINOR) tls: report negotiated TLS groups (Filip Skokan) #64119
• [a653e9bb57] - tls: handle large RSA exponents in X.509 cert (Tobias Nießen) #64093
• [5e901b5cd9] - (SEMVER-MINOR) tls: add certificateCompression option (Tim Perry) #62217
• [3abcfa723c] - tls: route event listener exceptions through error handlers (Antoine du Hamel) #63822
• [eaba4cd59d] - tools: bump the eslint group in /tools/eslint with 8 updates (dependabot[bot]) #64249
• [7d7ea1dbca] - tools: update c-ares updater script (Antoine du Hamel) #64194
• [976827cd71] - tools: validate version number in release proposal commit message lint (Antoine du Hamel) #64070
• [cc0c586b52] - tools: update sccache to v0.16.0 (Michaël Zasso) #63078
• [f0a35fa56a] - tools: bump js-yaml from 4.1.1 to 4.2.0 in /tools/lint-md (dependabot[bot]) #63948
• [dafbd23240] - tools: bump js-yaml from 4.1.1 to 4.2.0 in /tools/eslint (dependabot[bot]) #63947
• [0ae1552650] - tools: update the llhttp updater script (Antoine du Hamel) #63819
• [3623586d1f] - tools: align Bash snippets in GHA with lint-sh conventions (Antoine du Hamel) #63829
• [64b130ce1d] - tools: bump the eslint group in /tools/eslint with 7 updates (dependabot[bot]) #63730
• [4900cac251] - tools: fix zlib updater script (Antoine du Hamel) #63707
• [8edf3abafc] - typings: add typing for crypto (Filip Skokan) #64122
• [d5be94e820] - url: fix URLSearchParams(null) to prudce null= per spec (Marco) #63782
• [ee66a3851c] - util: fix OOM in inspect color stack formatting (Ijtihed Kilani) #64022
• [e26f183699] - util: fix scientific notation formatting (Daijiro Wachi) #63823
• [7993e3e476] - util: fix -0 formatting when numericSeparator is enabled (Daijiro Wachi) #63815
• [38758a7789] - util: remove style caches from styleText slow path (Guilherme Araújo) #63706
• [46a0ca256a] - watch: print name of changed file that triggers restart (Marco) #63781
• [e1582818ad] - watch: cancel pending restart on shutdown (Trivikram Kamat) #63383
• [9a208668b0] - zlib: validate flush king for all streams (Ic3b3rg) #63746
• [928981d803] - zlib: validate flush kind for brotli streams (Ic3b3rg) #63746
• [fd0fb00164] - zlib: expose rejectGarbageAfterEnd option (Filip Skokan) #64023
• [e334d30b4c] - zlib: reject trailing gzip members in web streams (Filip Skokan) #64023
• [7433c3df2e] - zlib: coerce -0 to +0 for crc32 seeds (Filip Skokan) #63556

Cherry-picked changes

• [fix][sec][branch-4.0] Upgrade Hadoop to 3.5.0 (#26195)
• [fix][sec][branch-4.0] Upgrade Jackson version to 2.18.9 (#26187)
• [fix][sec][branch-4.0] Upgrade Netty to 4.1.136.Final (#26170)
• [fix][ci] Upgrade sandboxed-trivy-action to approved sha (#26169)
• [improve][meta] Upgrade Oxia client to 0.8.0 (#25964)
• [improve][meta] Upgrade Oxia client to 0.9.4 (#26193)
• [improve][monitor][branch-4.0] Upgrade OpenTelemetry libraries (#26165)
• [improve][build] Upgrade docker base image Alpine to 3.24 (#26225)
• [improve][build] Upgrade slog to 0.10.0 (#26226)
• [improve][misc] Upgrade Jetty to 12.1.11 (#26233)
• [improve][misc] Upgrade to Alpine 3.23 (#25180)

• [fix][broker] Check deliverAt before containsMessage in bucket addMessage (#26230)
• [fix][broker] Fix getEstimatedSizeSinceMarkDeletePosition throw IllegalArgumentException (#26184)
• [fix][broker] Fix bucket delayed message index metrics reset on scrape (#26171)
• [fix][broker] Fix delayed message index data loss when trimming overlapping bucket snapshots (#26240)
• [fix][broker] Fix incorrect listener URLs returned by ModularLoadManager lookups (#26245)
• [fix][broker] Fix Key_Shared delivery stall when look-ahead triggers at the end of the topic (#26236)
• [fix][broker] Fix silently dropped acknowledgement failures in PulsarMetadataEventSynchronizer (#26237)
• [fix][broker] Fix TableViewLoadDataStoreImpl close deadlock that stalls broker shutdown (#26243)
• [fix][broker] Prevent completing replicated snapshot before marker publish (#26119)
• [fix][broker] Prevent partition expansion from inheriting delayed-delivery bucket state (#26179)
• [fix][broker] Prevent stale read completions from stranding Failover subscriptions (#26174)
• [fix][broker] Prevent stale service unit callbacks from dropping active lookup and cleanup jobs (#26146)
• [fix][broker] Prevent stale topic unload cleanup from removing active cache entries (#26145)
• [fix][broker] Read subscription properties directly from cursor (#26159)
• [fix][broker] Release entry on GetLastMessageId when parseMessageMetadata throws (#26089)
• [fix][broker] Trigger max read position callback for messages published during transaction buffer recovery (#26234)
• [fix][broker][branch-4.2] Fix admin API HTTP 400 FAIL_ON_TRAILING_TOKENS when a broker interceptor is loaded (#26223)
• [fix][ml] Preserve ledger entries/size when transformLedgerInfo callback completes after a concurrent close (#26228)
• [fix][meta] Complete handleMetadataEvent future exceptionally when the initial get fails (#26199)
• [fix][meta] Fix NPE in shouldIgnoreEvent when MetadataEvent options is null (#26200)
• [fix][meta] Fix RocksdbMetadataStore instanceId not advancing across restarts (#26218)
• [fix][meta] Record get op stats on the correct completion branch in AbstractMetadataStore (#26201)
• [improve][broker] Skip system cursor when check inactive cursor. (#26149)
• [improve][broker][branch-4.0] Trace the asynchronous tasks in logs when loading topics (#26163) (#26224)
• [improve][offload] Support credentials from offload policies for S3 and Aliyun OSS drivers (#26232)

• [fix][client] Fix lookup permit double-release, waiting queue starvation and timeout-response races in ClientCnx (#26143)
• [fix][client] Fix lookup request semaphore not release problem (#25038)
• [fix][client] Fix UnAckedMessageRedeliveryTracker to skip cancelled timeouts (#26043)
• [fix][client] Fix unAckedMessageTracker cleanup on multi-topics batch ack (#26001)
• [fix][client] Preserve null values in pulsar-admin schema output (#26196)
• [fix][client] Sync ackSet in client with broker to stop acked messages reaching the DLQ (#26135)

• [fix][fn] Forward source message properties in Python runtime (#26191)
• [fix][fn] Return inputSpecs consumerProperties in function GET info (#26217)

• [improve][misc][branch-4.0] Add CustomLog config for slog
• [fix][metadata] Fix orphaned UR parent nodes not cleaned up with Oxia metadata backend (#26158)
• [fix][misc][branch-4.0] Make log4j pattern compatible with slog which got pulled in by Oxia client upgrade

• [fix][test] Fix flaky test testCompactionPriority (#26198)
• [improve][ci] Replace trivy-action with sandboxed-trivy-action (#25480)
• [fix][build][branch-4.0] Fix spotbugs failure in OffloadPoliciesImpl
• [fix][ci][branch-4.0] Fix OpenTelemetrySanityTest after Otel library upgrade
• [fix][ci][branch-4.0] Skip testMarkReplicatedDeletesEmptyParentNodes for Etcd

For the complete list, check the full changelog.

• Introduce the /tasks/stream and /batches/stream SSE routes by @Kerollmops in https://github.com/meilisearch/meilisearch/pull/6533 This experimental feature allows establishing a live connection to the engine, avoiding the need to implement long polling and instead letting the engine provide new tasks, batches, and batch progress in a push-based manner. Using this route can drastically reduce network load when retrieving the status of a Meilisearch instance.
• Speed up the search speed a bit more by @Kerollmops in https://github.com/meilisearch/meilisearch/pull/6542 We improve the search speed when it comes to formatting the documents by making an O(n) operation, where n is the number of retrieved documents, become an O(1) operation. This improvement can significantly increase search speed when requesting a large (> 20) number of documents.

• Fix duplicate pins in federated search by @dureuill in https://github.com/meilisearch/meilisearch/pull/6543
• Skip the settings when nothing changes by @Kerollmops in https://github.com/meilisearch/meilisearch/pull/6544

Download the artifacts and read the release notes here - https://docs.yugabyte.com/stable/releases/ybdb-releases/v2025.2/#v2025.2.5.2

• feat(zero): Zero now accepts a --security superflag (token=...;whitelist=...), matching Alpha's, and authorizes its administrative HTTP endpoints against it.

  WARNING Zero's admin HTTP endpoints (default port 6080) previously had no authentication. /removeNode and /moveTablet are now always guarded: without a configured token or whitelist, only loopback callers are admitted. /state and /assign keep their previous behavior until a token or whitelist is configured, at which point they are enforced too. Operators driving these endpoints remotely must set --security "whitelist=...;token=..." on Zero.

• fix(backup): contain restore file paths within the handler root by @alhudz in https://github.com/dgraph-io/dgraph/pull/9760

• fix(zero): size-aware predicate move timeout and rebalancer backoff by @matthewmcneely in https://github.com/dgraph-io/dgraph/pull/9792

• fix(posting): don't serve calculatedUids to reads below their compute ts by @shiva-istari in https://github.com/dgraph-io/dgraph/pull/9801

• chore(test): configure Zero security whitelist in test clusters by @matthewmcneely in https://github.com/dgraph-io/dgraph/pull/9788

• chore(deps): bump google.golang.org/grpc from 1.80.0 to 1.82.1 by @dependabot[bot] in https://github.com/dgraph-io/dgraph/pull/9789

• chore(deps): bump github.com/dgraph-io/gqlgen to v1.0.0 by @matthewmcneely in https://github.com/dgraph-io/dgraph/pull/9802

• chore: upgrade Go to 1.26.5 by @matthewmcneely in https://github.com/dgraph-io/dgraph/pull/9797

• chore(deps): bump go.opentelemetry.io/otel from 1.43.0 to 1.44.0 by @matthewmcneely in https://github.com/dgraph-io/dgraph/pull/9799

• chore(deps): bump golang.org/x/text from 0.37.0 to 0.39.0 by @matthewmcneely in https://github.com/dgraph-io/dgraph/pull/9798

• chore(deps): bump github.com/klauspost/compress from 1.18.5 to 1.18.7 by @matthewmcneely in https://github.com/dgraph-io/dgraph/pull/9796

• chore: bump SPDX copyright headers from 2025 to 2026 by @mlwelles in https://github.com/dgraph-io/dgraph/pull/9709

• chore: add three published CVEs to openvex.json by @matthewmcneely in https://github.com/dgraph-io/dgraph/pull/9787

• chore(ci): update ci-dgraph-load-tests.yml by @matthewmcneely in https://github.com/dgraph-io/dgraph/pull/9800

Full Changelog: https://github.com/dgraph-io/dgraph/compare/v25.3.8...v25.4.0

• [SECURITY] Bump golang.org/x/text to v0.39.0 (CVE-2026-56852) and google.golang.org/grpc to v1.82.1 (GHSA-hrxh-6v49-42gf). #19290 by @krajorama
• [BUGFIX] PromQL: Preallocate the active query tracker file to avoid SIGBUS crashes when the data disk is full. #19289 by @akshajrawat

Full Changelog: https://github.com/prometheus/prometheus/compare/v3.13.1...v3.13.2

Release 1.0.0-beta.12