This is a preview — how node's changelog would look hosted on Wakelog (31 entries found, first 15 shown). Nothing was saved. To make it real: sign up (30 seconds, no email), create a project, and paste the same URL in the Import box — you'll also get RSS, an embeddable widget, a README badge, and an API. Try another.

node

changelog preview · powered by Wakelog

Version 26.7.0 (Current), @aduh95 - 2026-08-05

Aug 5, 2026
Notable Changes
  • \[58717685a1] - (SEMVER-MINOR) crypto: support loading private keys through STORE loaders (Filip Skokan) #63949
  • \[44b940ee8c] - crypto: update root certificates to NSS 3.125 (Node.js GitHub Bot) #64746
  • \[c1e4f7365e] - (SEMVER-MINOR) lib: add perfetto support (Chengzhong Wu) #64565
  • \[11c2f9c642] - (SEMVER-MINOR) module: implement Symbol.dispose in ModuleHooks (Remco Haszing) #63928
  • \[a646319f61] - (SEMVER-MINOR) test\_runner: add support for --test-coverage-include-all (avivkeller) #64830
Commits
  • \[a2d3f891d3] - async\_hooks: use validateBoolean for trackPromises (Soul Lee) #64731
  • \[d7266cdd99] - benchmark: fix calibrate-n option handling (Luan Muniz) #64146
  • \[2e64293e3f] - buffer: use Clamp conversion in Blob slice (Donghoon Kang) #64739
  • \[5fda0958bd] - buffer: validate copyArrayBuffer offsets against buffer length (Ilia Alshanetsky) #63904
  • \[5298db40f9] - build: run perfetto build and test on GHA (Chengzhong Wu) #64721
  • \[e3eac7cef9] - build: fix v8\_use\_perfetto source scraping (Chengzhong Wu) #64721
  • \[ab5f076d7f] - build: bump rustc requirement to >=1.86 (Renegade334) #64543
  • \[df608e061f] - (SEMVER-MINOR) build: perfetto-sdk (Chengzhong Wu) #64565
  • \[74928adc46] - build,tools: fix shared library cross-compile (Kirill Saied) #63963
  • \[58717685a1] - (SEMVER-MINOR) crypto: support loading private keys through STORE loaders (Filip Skokan) #63949
  • \[58d13b6f3d] - crypto: preserve OpenSSL errors from KDF failures (Filip Skokan) #64776
  • \[478a719cb5] - crypto: fix Argon2 bypassing FIPS mode (Filip Skokan) #64776
  • \[44b940ee8c] - crypto: update root certificates to NSS 3.125 (Node.js GitHub Bot) #64746
  • \[fde85237c7] - crypto: clarify missing cipher error (Filip Skokan) #64852
  • \[c604d8846d] - crypto: reuse X509 issuer result (Filip Skokan) #64852
  • \[c68c7d0112] - crypto: validate key generation options (Filip Skokan) #64852
  • \[c36bb1d017] - crypto: fix Argon2 validation errors (Filip Skokan) #64852
  • \[f61408bb27] - crypto: handle XOF output allocation failure (Filip Skokan) #64851
  • \[2b4053d046] - crypto: initialize KeyObjectData mutex eagerly (Filip Skokan) #64851
  • \[4b7b2adf44] - crypto: handle DH operation failures (Filip Skokan) #64851
  • \[12170c3753] - crypto: use user-facing error for output encoding changes (Archkon) #64692
  • \[474f06d550] - debugger: preserve overlapping CDP request state (Trivikram Kamat) #64467
  • \[718cbe9497] - deps: upgrade npm to 11.19.0 (npm team) #64883
  • \[657c6154b3] - deps: update ngtcp2 to 1.25.0 (Node.js GitHub Bot) #64944
  • \[75a1fbeff9] - deps: update nghttp3 to 1.18.0 (Node.js GitHub Bot) #64943
  • \[07d7cb7cd8] - deps: update minimatch to 10.2.6 (Node.js GitHub Bot) #64945
  • \[f7d56359f1] - deps: update simdjson to 4.6.6 (Node.js GitHub Bot) #64942
  • \[8b06457cfb] - deps: update acorn to 8.18.0 (Node.js GitHub Bot) #64941
  • \[5919d01525] - deps: update googletest to 1b6f64d659944658a4c685b7bd9f04c1c3b8a39b (Node.js GitHub Bot) #64940
  • \[4a87ad6cff] - deps: update nghttp2 to 1.70.0 (Node.js GitHub Bot) #64939
  • \[c96d76a7c8] - deps: update zlib to 1.3.2.1-motley-42c2f19 (Node.js GitHub Bot) #64744
  • \[2b59984c0f] - deps: V8: backport 5177b10891e6 (avivkeller) #64631
  • \[b839af91da] - deps: update ada to 4.0.0 (Node.js GitHub Bot) #64790
  • \[70dedef942] - deps: update sqlite to 3.53.4 (Node.js GitHub Bot) #64745
  • \[7bc4c171f5] - deps: update Rust crates for V8 14.6.202.34-node.26 (Renegade334) #64543
  • \[308c6b2ac3] - deps: V8: backport 7d9b7e03141d (Manish Goregaokar) #64543
  • \[8eeae28e88] - deps: V8: backport c4d06ba586f3 (liujiahui) #63731
  • \[bbd6fc58c4] - diagnostics\_channel: grow native channel storage (Stephen Belanger) #64497
  • \[ce8b292955] - doc: fix grammar and punctuation in dgram documentation (Kamal Rawal) #64957
  • \[1a413a60cf] - doc: fix grammar and editorial issues in addons documentation (Kamal Rawal) #64952
  • \[63fbd59e64] - doc: formalize fn/name as part of TestOptions API (Christopher Hiller) #64946
  • \[b263b0bca1] - doc: remove references to ca/crl as per-context QuicSession options (René) #64769
  • \[f37de14b27] - doc: fix typo in maintaining-dependencies.md (greenhead) #64896
  • \[16cb77cdc8] - doc: add RafaelGSS as last security release stewards (Rafael Gonzaga) #64843
  • \[335c28cd17] - doc: fix typos in documentation (greenhead) #64900
  • \[d4bed8ca39] - doc: fix missing references in doc type map (Tim Perry) #64872
  • \[e71d09d5f1] - doc: improve TestContext hook descriptions (Kamal Rawal) #64899
  • \[7089bd9ae4] - doc: add missing float32/float64 FFI type names (Soul Lee) #64874
  • \[8d3ae0830e] - doc: document stream.isDestroyed() (YspritanHyzygy) #64789
  • \[a757e62af7] - doc: add contributing detail for git Signed-off-by trailer (Mike McCready) #64862
  • \[3e840f43ed] - doc: mark config-file as release candidate (Marco Ippolito) #64516
  • \[70cd5df810] - doc: fix duplicated word in test snapshot docs (Kamal Rawal) #64837
  • \[d5f36c7adc] - doc: remove obsolete cctest node.gyp instructions (Soul Lee) #64814
  • \[a0bf29ea09] - doc: report proper return type on url.format (Brian Muenzenmeyer) #64806
  • \[e655e42085] - doc: use ffi.suffix for library paths in examples (Junsoo Ha) #64805
  • \[e0f0830dbc] - doc: document --permission-audit audit mode behavior (Adrián Estrada) #64791
  • \[efbede6de0] - doc: clarify tlsSocket.authorized on resumption (soreavis) #64584
  • \[db95655c4a] - doc: stabilize --disable-warning (Jean Michelet) #64742
  • \[a8367200be] - doc: add MDN links for explicit resource management in fs (lluisemper) #59557
  • \[1c09165c2e] - doc: mention constructor check in deepStrictEqual (Sumit Kumar Das) #62010
  • \[29709324e0] - doc: update technical priorities (Jacob Smith) #64505
  • \[522a28e648] - doc: deprecation add more codemod (Augustin Mauroy) #63175
  • \[c40aaa6539] - doc: run license-builder (Node.js GitHub Bot) #63918
  • \[428e9bc50f] - ffi: fix crash in refCallback and unrefCallback (Trivikram Kamat) #64881
  • \[33912103e7] - ffi: reject fast calls after library close (Trivikram Kamat) #64860
  • \[b348ed7f92] - ffi: validate fast 32-bit integer argument ranges (Trivikram Kamat) #64691
  • \[48f4cfb480] - ffi: fix optimized buffer conversions (Trivikram Kamat) #64639
  • \[109ffcd4f3] - ffi: preserve link register in ppc64 trampoline (Trivikram Kamat) #64792
  • \[aa3f168b31] - ffi: preserve strings during reentrant calls (Trivikram Kamat) #64551
  • \[ca60942f38] - ffi: preserve uint8 semantics for bool fast calls (Trivikram Kamat) #64527
  • \[0fb1d2bd65] - ffi: validate fast integer argument ranges (Trivikram Kamat) #64614
  • \[b250b40b30] - fs: key glob matcher cache by platform (Archkon) #64571
  • \[e26891ec6a] - http: fix writableFinished and 'finish' after write errors (Tim Perry) #64847
  • \[dfc192fdfb] - http: avoid aborting IncomingMessage signal on normal close (Archkon) #64392
  • \[6794441c85] - http: guard invalid timeout values in checkConnections (Efe Karasakal) #64506
  • \[6879aa4aa8] - http: propagate highWaterMark to ClientRequest OutgoingMessage (trivenay) #64653
  • \[72448a82f4] - http2: avoid copying the options in respond() (Matteo Collina) #64265
  • \[f6692da576] - http2: avoid per-write closures in kWriteGeneric (Matteo Collina) #64265
  • \[3ed37153f8] - http2: reduce per-request allocations (Matteo Collina) #64265
  • \[bce92debba] - _Revert_ "http2: avoid per-write closures in kWriteGeneric" (Antoine du Hamel) #64663
  • \[b5d5dd74a1] - _Revert_ "http2: avoid copying the options in respond()" (Antoine du Hamel) #64663
  • \[19b9c14d60] - lib: fix AbortSignal.any() observed-composite leak (Paul Bouchon) #64481
  • \[d3cada57c2] - lib: fix typo in comment in \_http\_client.js (agape1225) #64729
  • \[c1e4f7365e] - (SEMVER-MINOR) lib: add perfetto support (Chengzhong Wu) #64565
  • \[6c2157522d] - loader: enforce path normalization before lookup (Maël Nison) #63917
  • \[31522c41a7] - meta: bump actions/stale from 10.3.0 to 11.0.0 (dependabot\[bot]) #64935
  • \[88c8b8ef54] - meta: bump github/codeql-action/analyze from 4.36.2 to 4.37.3 (dependabot\[bot]) #64934
  • \[9dcd759a84] - meta: bump github/codeql-action/autobuild from 4.36.2 to 4.37.3 (dependabot\[bot]) #64933
  • \[82ca02db3c] - meta: bump actions/setup-python from 6.3.0 to 7.0.0 (dependabot\[bot]) #64932
  • \[848e2287f2] - meta: bump github/codeql-action/init from 4.36.2 to 4.37.3 (dependabot\[bot]) #64931
  • \[ae8ad3b17b] - meta: bump Mozilla-Actions/sccache-action from 0.0.10 to 0.0.11 (dependabot\[bot]) #64930
  • \[0b359cfa4c] - meta: bump cachix/install-nix-action from 31.10.6 to 31.11.0 (dependabot\[bot]) #64929
  • \[3b4f980f4c] - meta: bump github/codeql-action/upload-sarif from 4.36.2 to 4.37.3 (dependabot\[bot]) #64927
  • \[d7ee9e9ea7] - meta: bump step-security/harden-runner from 2.19.4 to 2.20.0 (dependabot\[bot]) #64926
  • \[7e80bbaaa9] - meta: bump ossf/scorecard-action from 2.4.3 to 2.4.4 (dependabot\[bot]) #64925
  • \[915cabbfcf] - meta: remove node\_crates .gitignore (René) #64779
  • \[8e03c54347] - meta: add @nodejs/url as codeowner for node\_url\_pattern.\* (Efe Karasakal) #64737
  • \[11c2f9c642] - (SEMVER-MINOR) module: implement Symbol.dispose in ModuleHooks (Remco Haszing) #63928
  • \[fffd8a76d0] - net: support TCP handle transfer on Windows (Matteo Collina) #64460
  • \[[`

Version 26.6.0 (Current), @aduh95 - 2026-08-03

Aug 3, 2026
Notable Changes
  • \[5a36018abc] - doc: add MikeMcC399 as collaborator (Mike McCready) #64656
  • \[9b04f82d7b] - (SEMVER-MINOR) ffi: add getCurrentEventLoop (Paolo Insogna) #64323
  • \[bb51f2c960] - (SEMVER-MINOR) test\_runner: add context.log() and test:log event (Moshe Atlow) #64389
  • \[56ce83b3ee] - (SEMVER-MINOR) test\_runner: report entryFile in TestStream events (Moshe Atlow) #64309
Commits
  • \[248ff9fa5c] - assert,util: fix TypeError on Maps with null keys (Paul Bouchon) #64441
  • \[3b5baceafe] - benchmark: add bytes variant to webstreams async-iterator (Matteo Collina) #64291
  • \[0a46d1ef66] - buffer: normalize lone "\r" in Blob native line endings (Daijiro Wachi) #64115
  • \[d9ada18b70] - buffer: fix Blob.stream() leaking source buffer (semimikoh) #63577
  • \[d05993bcf6] - build: merge multiple on download artifact (Chengzhong Wu) #64633
  • \[6c25ac909a] - build: extract temporal\_capi crate directory name into gyp variable (René) #64482
  • \[612f60c300] - cli: style node --help output with util.styleText (Adrián Estrada) #64484
  • \[29a938ddbb] - crypto: preserve RSA-PSS legacy pubkey DER (Filip Skokan) #64547
  • \[2fde794357] - crypto: cleanse provider private key copies (Filip Skokan) #64547
  • \[33a0e08d41] - crypto: handle incomplete RSA private keys (Filip Skokan) #64547
  • \[11b4d505ef] - crypto: retain legacy DH validation (Filip Skokan) #64547
  • \[6e302041e1] - crypto: limit KangarooTwelveParams customization to 512 bytes (Filip Skokan) #64557
  • \[195f103e87] - crypto: split OpenSSL 3, BoringSSL, and legacy backends (Filip Skokan) #64211
  • \[ec67e24eee] - deps: update googletest to fa005b296f90faec4f352d7ab382287bf6548c8d (Node.js GitHub Bot) #64587
  • \[32ffff88fd] - deps: histogram: cherry-pick 62ea52b07ee9b195 (StefanStojanovic) #64296
  • \[e0664f1f09] - deps: update histogram to 0.11.10 (Node.js GitHub Bot) #64296
  • \[cf0622bdd6] - deps: update amaro to 1.1.11 (Node.js GitHub Bot) #64586
  • \[04c78b8b24] - deps: update timezone to 2026c (Node.js GitHub Bot) #64588
  • \[59f4318976] - deps: V8: cherry-pick 1158ae719749 (René) #64432
  • \[e5ea7cd299] - deps: update googletest to 8240fa7d62f73e01c7af27d61ed965d6d66698fa (Node.js GitHub Bot) #64439
  • \[0e7554cee4] - deps: update libffi to 3.7.1 (Node.js GitHub Bot) #64438
  • \[46c9d724ad] - deps: update ngtcp2 to 1.24.0 (Node.js GitHub Bot) #64297
  • \[3519aac9af] - deps: enable OpenSSL asm support for riscv64 (Jamie Magee) #62606
  • \[c09701218b] - deps: update c-ares to 1.34.8 (Node.js GitHub Bot) #64330
  • \[ad2f3bc95b] - deps: upgrade npm to 11.18.0 (npm team) #64199
  • \[d7a4b22c86] - deps: V8: backport a05321ebd98e (Chengzhong Wu) #64202
  • \[8679cff291] - deps: update zlib to 1.3.2.1-motley-8b3aa8a (Node.js GitHub Bot) #64295
  • \[df5b1e10ba] - doc: remove unsupported syntax from stream_iter.md (Antoine du Hamel) #64649
  • \[8a4ca9083f] - doc: clarify rules for adding new built-in modules (Antoine du Hamel) #64648
  • \[7d50fe6b7a] - doc: mention DEPENDENCY custom field for H1 reports (Rafael Gonzaga) #64634
  • \[8f415bf5fc] - doc: fix dnsPromises.lookup verbatim default (Shivam S) #64658
  • \[c6378f724d] - doc: fix broken links and clean up type map (Antoine du Hamel) #64625
  • \[9b53ec19a2] - doc: fix typo in releases guide (Jihwan) #64621
  • \[5a36018abc] - doc: add MikeMcC399 as collaborator (Mike McCready) #64656
  • \[d2c8acd764] - doc: use promote wording in release guide (Md Muhtasim Munif Fahim) #64371
  • \[5c692cb576] - doc: fix import.meta example for vm.SourceTextModule (Muhammad Zeeshan) #64112
  • \[7568ce71ca] - doc: mention crypto.hash() for better perf (Steven) #63420
  • \[cf3f631936] - doc: update sea example by fixing wrong code example (Maxence Robinet) #64025
  • \[ce21e567a4] - doc: fix socket.readyState state descriptions (YuSheng Chen) #64468
  • \[018c7f1c01] - doc: replace large tables in crypto.md and webcrypto.md with lists (Filip Skokan) #64582
  • \[cf82de8d8b] - doc: note --env-file is not applied to --run (Paul Bouchon) #64442
  • \[e635ce5201] - doc: fix typo in embedding.md (greenhead) #64425
  • \[0b1f6eda3f] - doc: fix typos in contributing docs (Donghoon Kang) #64520
  • \[d978ce80ef] - doc: document TLS alpnProtocol and servername fields (Tim Perry) #64362
  • \[394669e3b3] - doc: fix spelling in devcontainer guide (한만욱) #64459
  • \[9786a593ea] - doc: clarify PEM format for signing keys (Harjoth Khara) #64404
  • \[6251f832ba] - doc: fix typo in tls.md (Daijiro Wachi) #64458
  • \[b8656c40ad] - doc: document net Socket server property (Efe Karasakal) #64364
  • \[03e9c738f3] - doc: update a Dispatcher undici doc link (Filip Skokan) #64358
  • \[b6dd2debf0] - doc: fix typos in documentation (Jungwon Sohn) #64466
  • \[3b7d778c3c] - doc: clarify fixes and refs trailer guidance (Trivikram Kamat) #64421
  • \[eb086a6e03] - doc: remove duplicate VirtualProvider description (Archkon) #64400
  • \[bc221a8cd7] - doc: add scope overview tables for TestsStream events (Moshe Atlow) #64386
  • \[4b3dbd36df] - doc: clarify proxy threat model (Matteo Collina) #64366
  • \[c5526f69d6] - doc: add note about restricted CI to pull-requests.md (Stewart X Addison) #64321
  • \[968eaf6538] - doc: various updates to releases.md (Stewart X Addison) #64198
  • \[2a51f8ba8e] - doc: remove obsolete --napi-modules doc entry (Chengzhong Wu) #64220
  • \[ee5a54535e] - doc,test: widen fsPromises.appendFile()'s data type, add missing tests (Jimmy Leung) #64279
  • \[b923df86fc] - events: avoid retaining removed event names (Matteo Collina) #64475
  • \[7d8d413ff5] - events: optimize once() and removeListener() (Matteo Collina) #64373
  • \[f2f8881d2a] - ffi: evaluate function signatures once (Trivikram Kamat) #64559
  • \[9b04f82d7b] - (SEMVER-MINOR) ffi: add getCurrentEventLoop (Paolo Insogna) #64323
  • \[4a3ef5b2b5] - fs: add pattern cache for matchGlobPattern() (bq) #63915
  • \[ce113efcac] - fs: fix cp symlink and EEXIST handling on Windows (Kirill Saied) #64353
  • \[3be3041ac9] - http: fix perf\_hooks detail.req.url port and proxied path (Stefano Baghino) #64311
  • \[0047ad73cf] - http: remove unused n arg from IncomingMessage.\_read (Efe Karasakal) #64370
  • \[4d48984d5c] - http2: don't throw when destroying socket proxy (Matteo Collina) #64427
  • \[3329647762] - http2: avoid copying the options in respond() (Matteo Collina) #64265
  • \[a44fca5e24] - http2: avoid per-write closures in kWriteGeneric (Matteo Collina) #64265
  • \[546e0e70a1] - inspector: add --cond to node inspect probe mode (Joyee Cheung) #64328
  • \[b38a39dd96] - lib: use assignFunctionName util where it makes sense (Antoine du Hamel) #64515
  • \[f60a12b94f] - lib,tools: add node-core/func-name-matching lint rule (Livia Medeiros) #57901
  • \[9e6e9d4745] - meta: lower stale to 3 months (Aviv Keller) #64569
  • \[3dd11c4993] - meta: move one or more collaborators to emeritus (Node.js GitHub Bot) #64315
  • \[3f55208104] - module: add two tests for eager imports when using import defer (Maya Lekova) #64197
  • \[c791eedc9d] - net: support sync connect for BoundSocket (Guy Bedford) #64375
  • \[4df4a3fc61] - net: make TCP Server and Socket transferable across worker threads (Matteo Collina) #64225
  • \[5dd34d7d06] - path: add benchmarks for path.matchesGlob() (bq) #63915
  • \[8e520646b6] - quic: defer server session emit until TLS ClientHello is processed (Tim Perry) #64132
  • \[4b8cc9a3fb] - quic: preserve session stats after close (한만욱) #64489
  • \[591090ca85] - quic: add support for TLS certificate compression (Sebastian Beltran) #64434
  • \[d636c9c30f] - quic: extract transport logic from Application to Session (Tim Perry) #64127
  • \[abb62f961f] - quic: correct http3 callback and fix revealed errs (Marten Richter) #64289
  • \[5f535fdbe8] - quic: fix no onstream handler crash quic (Efe) #64158
  • \[933e5f14b5] - quic: fix stall datagrams, if no pending streams (Marten Richter) #64303
  • \[272632a57f] - quic: fix potential crash from unobserved closed (Tim Perry) #64134
  • \[2d5f445489] - sqlite: read column count after step in StatementSync.all() (Guilherme Araújo) #64219
  • \[54929af44e] - src: avoid redundant KEM encapsulation copies (Filip Skokan) #64553
  • \[5380bf28b3] - src: avoid redundant DataPointer reallocations (Filip Skokan) #64552
  • \[6ff5a1b834] - src: fix comment typos (Jungwon Sohn) #64509
  • \[508ec0e435] - src: zero-initialize cap\_data in node\_credentials.cc (Samuel Kapust) #64347
  • \[c5090a36c1] - src: fix some typo errors and rename some variables (Archkon) #64301
  • \[0a89bef69e] - src,permission: do not throw on denied access in audit mode (Adrián Estrada) #64426
  • \[63e71195c5] - stream: abort pending single-source merge reads (Trivikram Kamat) #64445
  • \[f403b30c3d] - stream: use RangeError for broadcast overflow (Trivikram Kamat) #64420
  • \[5c0578cbf7] - stream: skip null output from stateful transforms (Trivikram Kamat) #64462
  • \[0488d02d5d] - stream: update iterable streams to use budget backpressure (James M Snell) #64464
  • \[f0811baeef] - stream: remove custom CloneableDOMException implementation (Antoine du Hamel) #64469
  • \[10f3f9682e] - stream: fix drop-newest behavior in share() (Trivikram Kamat) #64417
  • \[2aad973b29] - stream: resume flow when an errored pipe destination is removed (Mahin Anowar) #64310
  • \[6112ed5ceb] - stream: fo

Version 24.19.0 'Krypton' (LTS), @aduh95 - 2026-08-03

Aug 3, 2026
Notable Changes
  • \[d08872b530] - (SEMVER-MINOR) buffer: implement blob.textStream() (Matthew Aitken) #64036
  • \[35222948be] - (SEMVER-MINOR) deps: update OpenSSL build config to support compression (Tim Perry) #62217
  • \[d6ab039f24] - (SEMVER-MINOR) doc: update blockList stability status to release candidate (alphaleadership) #63050
  • \[1da05fb79d] - doc: mark stream.compose stable (Matteo Collina) #62562
  • \[3c1636dabf] - (SEMVER-MINOR) esm: add --experimental-import-text flag (Efe) #62300
  • \[e323e877be] - (SEMVER-MINOR) fs: support caller-supplied readFile() buffers (Matteo Collina) #63634
  • \[c1248c9544] - (SEMVER-MINOR) http: add httpValidation option to configure header value validation (RajeshKumar11) #61597
  • \[a534b65815] - (SEMVER-MINOR) net: support TCP_KEEPINTVL and TCP_KEEPCNT in setKeepAlive (Guy Bedford) #63825
  • \[a23cdec683] - (SEMVER-MINOR) perf\_hooks: sample delay per event loop iteration (Pablo Erhard) #62935
  • \[7428b57a37] - (SEMVER-MINOR) src: allow empty --experimental-config-file (Marco Ippolito) #61610
  • \[e57597173c] - (SEMVER-MINOR) stream: expose ReadableStreamTee (Matteo Collina) #64195
  • \[5396235993] - (SEMVER-MINOR) tls: report negotiated TLS groups (Filip Skokan) #64119
  • \[5e901b5cd9] - (SEMVER-MINOR) tls: add certificateCompression option (Tim Perry) #62217
Commits
  • \[676467fa9f] - benchmark: trim down the argon2 sets (Filip Skokan) #64218
  • \[a77a2000b7] - benchmark: add child\_process async path baselines (Yagiz Nizipli) #63929
  • \[dd4482e915] - buffer: remove unreachable overflow check in atob (haramjeong) #60161
  • \[081c41eb86] - buffer: add fast api for isUtf8 and isAscii (Gürgün Dayıoğlu) #64169
  • \[d08872b530] - (SEMVER-MINOR) buffer: implement blob.textStream() (Matthew Aitken) #64036
  • \[6e2f7e6013] - build: remove redundant intermediate node\_aix\_shared (Chengzhong Wu) #63747
  • \[87e0675f51] - build: build codecache and snapshot with libnode (Chengzhong Wu) #63626
  • \[32174a7bae] - build: support setting an emulator from configure script (Ivan Trubach) #53899
  • \[69cfb2f240] - build: remove duplicated node\_use\_sqlite and node\_use\_ffi conditions (Chengzhong Wu) #63629
  • \[37ac6e8cb5] - build: add manually-dispatched stress-test workflow (Joyee Cheung) #64118
  • \[2424207191] - build: suppress compiler warnings for histogram (Richard Lau) #63980
  • \[63502b7404] - build,win: fix VS2022 arm64 PGO build (Stefan Stojanovic) #63413
  • \[fe4e4055d0] - child\_process: fix permission model propagation via NODE\_OPTIONS (Matteo Collina) #63972
  • \[aa2f3c066e] - child\_process: pass spawn options to the binding positionally (Yagiz Nizipli) #63930
  • \[fcf32cf77a] - child\_process: serialize advanced IPC messages natively (Yagiz Nizipli) #63933
  • \[7907134734] - crypto: reject small-order EdDSA points during verify (Filip Skokan) #64026
  • \[b505cd5465] - crypto: support non-byte WebCrypto lengths and cSHAKE (Filip Skokan) #63988
  • \[0f54a872e2] - crypto: share WebCrypto method and usage helpers (Filip Skokan) #63975
  • \[824ec11c05] - crypto: refactor keyObject.toCryptoKey() and SubtleCrypto.getPublicKey() (Filip Skokan) #63622
  • \[73aba92689] - crypto: coerce -0 to +0 before native calls (Filip Skokan) #63556
  • \[c83b79874e] - crypto: reject invalid raw key imports (Filip Skokan) #63134
  • \[934fda64b9] - crypto: improve accuracy of SubtleCrypto.supports (Filip Skokan) #63104
  • \[e392e1f791] - crypto: fix large DH generator validation (Tobias Nießen) #64092
  • \[e75a363e70] - crypto: use EVP\_MAC for HMAC on OpenSSL >=3 (Filip Skokan) #63942
  • \[adbaf7af9b] - crypto: make webcrypto aliasKeyFormat directional (Filip Skokan) #63910
  • \[bb1aea8897] - crypto: fix unhandled error in Hash.\_transform (Haram Jeong) #63261
  • \[12c87732c1] - crypto: handle cipher context allocation failures (Tian Teng) #63542
  • \[858496b453] - crypto: deduplicate X509 subject matching logic (Tobias Nießen) #63644
  • \[9a29cb0964] - crypto: fix warnings in test\_node\_crypto.cc (Maya Lekova) #63490
  • \[8bb536066d] - crypto: optimize normalizeAlgorithm dispatch hot path (Filip Skokan) #62756
  • \[329e5496ff] - crypto,tls: do not ignore BN\_get\_word error (Tobias Nießen) #63895
  • \[97b7a3f9c7] - debugger: add --max-hit option to probe mode (Joyee Cheung) #63704
  • \[9098585c5e] - debugger: add more logs to probe mode (Joyee Cheung) #63663
  • \[59cca26cd5] - debugger: surface inspector failures in probe mode (Joyee Cheung) #63437
  • \[2922290eae] - debugger: disambiguate probe location binding (Joyee Cheung) #63286
  • \[6fb2c2c7e2] - debugger: lazily wait for initial break output (Trivikram Kamat) #63969
  • \[688e792551] - debugger: defer probe pause handling until startup (Trivikram Kamat) #63608
  • \[1ac93cc05a] - debugger: await initialization after run and restart (Trivikram Kamat) #63607
  • \[92a909cf72] - debugger,test: deflake resume failure test and add debug logs (Joyee Cheung) #63524
  • \[8b37af8b11] - deps: V8: backport bef0d9c1bc90 (Joyee Cheung) #62132
  • \[8832126422] - deps: V8: cherry-pick 64b36b441179 (Dan Carney) #61712
  • \[75990c2cd6] - deps: update googletest to 8b53336594cc52213c6c2c7a0b29194fa896d039 (Node.js GitHub Bot) #64181
  • \[8500c7ba86] - deps: update sqlite to 3.53.3 (Node.js GitHub Bot) #64180
  • \[dc78091b45] - deps: c-ares: cherry-pick 8ba37af8e3fb (René) #64110
  • \[873cc72125] - deps: update googletest to 0b1e895ba4226c2fda5ee0178c9b5b1195a741aa (Node.js GitHub Bot) #64039
  • \[1d3d166538] - deps: update acorn to 8.17.0 (Node.js GitHub Bot) #63901
  • \[35222948be] - (SEMVER-MINOR) deps: update OpenSSL build config to support compression (Tim Perry) #62217
  • \[e40cee5f79] - deps: upgrade npm to 11.17.0 (npm team) #63857
  • \[85c6d46606] - deps: add ngtcp2\_fmt.c to build configuration (ngtcp2.gyp) (沈鸿飞) #63821
  • \[d2ea8b7a8c] - deps: update googletest to 7140cd416cecd7462a8aae488024abeee55598e4 (Node.js GitHub Bot) #63775
  • \[25b4d57bb6] - deps: update sqlite to 3.53.2 (Node.js GitHub Bot) #63774
  • \[a96368e4c7] - deps: update zlib to 1.3.2.1-motley-3246f1b (Node.js GitHub Bot) #63773
  • \[b59f1f5f37] - deps: update amaro to 1.1.10 (Node.js GitHub Bot) #63670
  • \[0b3b56ee95] - deps: update googletest to 8736d2cd5c1dcba41170ed2fddca14021d4916c3 (Node.js GitHub Bot) #63669
  • \[aa67b5b9c4] - dgram: add synchronous Socket connectSync() (Guy Bedford) #63932
  • \[ef38374875] - dgram: add synchronous Socket.prototype.bindSync() (Guy Bedford) #63838
  • \[6edc3a9967] - dgram: skip dns.lookup() for literal IP addresses (Ruben Bridgewater) #64133
  • \[d4cfe2d8ac] - dns: coerce -0 to +0 in lookup and resolver inputs (Filip Skokan) #63556
  • \[91c9ce5a45] - doc: improve fs.StatFs properties descriptions (aymanxdev) #62578
  • \[54e21675fa] - doc: fix inconsistencies in CJS code snippets (Antoine du Hamel) #63199
  • \[64c23daa76] - doc: remove typo comma from man page (Vas Sudanagunta) #63080
  • \[bc943cd34a] - doc: update Http2SecureServer.on("timeout") default value (YuSheng Chen) #64187
  • \[a46bc452a6] - doc: add note on visibility of CI failures to new contributor guide (Stewart X Addison) #64256
  • \[c0fb52506c] - doc: clarify HTTP/1.1 response ordering (Matteo Collina) #64213
  • \[d3073a7ba6] - doc: recommend node-stress-single-test for flaky tests (Trivikram Kamat) #64223
  • \[bb9951ead0] - doc: fix typo in examples (Vas Sudanagunta) #64184
  • \[fe674e96fc] - doc: clarify defense-in-depth issues (Matteo Collina) #64215
  • \[faad042184] - doc: add guide and answers to FAQs for first-time contributors (Joyee Cheung) #63685
  • \[79d685adf3] - doc: update Http2Server.close & Http2SecureServer.close (YuSheng Chen) #63298
  • \[744e40e05e] - doc: update list of people in SECURITY.md (Richard Lau) #64152
  • \[185f57c4a4] - doc: add missing option to man page (Richard Lau) #64156
  • \[8933303568] - doc: fix callback example import in fs docs (Kamal Rawal) #63912
  • \[3a0549dacb] - doc: fix keepAliveTimeout default in http.createServer options (Jahanzaib iqbal) #63974
  • \[5a35e48d08] - doc: add sxa GPG key (ed25519) (Stewart X Addison) #64193
  • \[66e7f815f1] - doc: add aduh95 to last security release steward (Antoine du Hamel) #63981
  • \[a7e35040dd] - doc: fix typo in util.md (Daijiro Wachi) #63961
  • \[d74b3a7e90] - doc: clarify callback exceptions (Matteo Collina) #63939
  • \[b7a8f8fabd] - doc: fix incorrect test runner mock examples (Kimaswa Emmanuel Yusufu) #63656
  • \[f11aa690cd] - doc: fix typo in cli.md (Daijiro Wachi) #63883
  • \[df85f50269] - doc: fix typo in vm.md (Daijiro Wachi) #63881
  • \[a00a567175] - doc: fix typo in packages.md (Daijiro Wachi) #63882
  • \[206c1b8437] - doc: fix a/an article typos in module, util, and dns (Daijiro Wachi) #63766
  • \[e3e5ef1cff] - doc: update npm supported versions link (hojeong park) #63672
  • \[e3c4852413] - doc: fix AES-OCB IV length in SubtleCrypto.supports example (Anshika Jain) #63717
  • \[0b3fbc82d7] - doc: add webstreams to args for pipeline from stream/promises (David Sanders) #63628
  • \[62078a8328] - doc: fix "used to sent" → "used to send" in http2 (Daijiro Wachi) #63700
  • \[fd74eefb23] - doc: clarify tty raw mode applies to input processing only (Muhammad Zeeshan) #63438
  • \[42cd7e47de] - doc: add worker\_threads history entries (Bob Put) #63545
  • \[d6ab039f24] - (SEMVER-MINOR) doc: update blockList stability status to release candidate (alphaleadership) #63050
  • \[56bdd87378] - doc: move hyperlinks outside

Version 26.5.1 (Current), @RafaelGSS - 2026-07-29

Jul 29, 2026

This is a security release.

Notable Changes
  • (CVE-2026-56848) http2: defer rst stream while in scope (Matteo Collina) – High
  • (CVE-2026-58043) permission: avoid granting radix split nodes (RafaelGSS) – High
  • (CVE-2026-56850) https: distinguish PFX object-array agent keys (RafaelGSS) – Medium
  • (CVE-2026-58040) https: bind identity checks to session reuse (Matteo Collina) – Medium
  • (CVE-2026-58041) sqlite: invalidate tag store iterators on statement reset (Matteo Collina) – Medium
  • (CVE-2026-58042) dns: handle large resolveAny address replies (RafaelGSS) – Medium
  • (CVE-2026-58045) zlib: throw on out-of-bounds write buffers (RafaelGSS) – Medium
  • (CVE-2026-56847) permission: enforce fs write permission for trace events (RafaelGSS) – Low
  • (CVE-2026-58039) permission: check final report output path (RafaelGSS) – Low
  • (CVE-2026-58044) http: reject requests exceeding max header count (Matteo Collina) – Low
  • deps: update llhttp to 9.4.3 (Paolo Insogna)
  • deps: update undici to 8.9.0 (Node.js GitHub Bot)
Commits

Version 24.18.1 'Krypton' (LTS), @juanarbol - 2026-07-29

Jul 29, 2026

This is a security release.

Notable Changes
  • (CVE-2026-56846) http2: retain header memory in session accounting (Matteo Collina) – High
  • (CVE-2026-56848) http2: defer rst stream while in scope (Matteo Collina) – High
  • (CVE-2026-58043) permission: avoid granting radix split nodes (RafaelGSS) – High
  • (CVE-2026-56850) https: distinguish PFX object-array agent keys (RafaelGSS) – Medium
  • (CVE-2026-58040) https: bind identity checks to session reuse (Matteo Collina) – Medium
  • (CVE-2026-58041) sqlite: invalidate tag store iterators on statement reset (Matteo Collina) – Medium
  • (CVE-2026-58042) dns: handle large resolveAny address replies (RafaelGSS) – Medium
  • (CVE-2026-58045) zlib: throw on out-of-bounds write buffers (RafaelGSS) – Medium
  • (CVE-2026-56847) permission: enforce fs write permission for trace events (RafaelGSS) – Low
  • (CVE-2026-58039) permission: check final report output path (RafaelGSS) – Low
  • (CVE-2026-58044) http: reject requests exceeding max header count (Matteo Collina) – Low
  • deps: update llhttp to 9.4.3 (Paolo Insogna)
  • deps: update undici to 7.29.0 (Node.js GitHub Bot)
Commits

Version 22.23.2 'Jod' (LTS), @marco-ippolito - 2026-07-29

Jul 29, 2026

This is a security release.

Notable Changes
  • (CVE-2026-56846) http2: retain header memory in session accounting (Matteo Collina) – High
  • (CVE-2026-56848) http2: defer rst stream while in scope (Matteo Collina) – High
  • (CVE-2026-58043) permission: avoid granting radix split nodes (RafaelGSS) – High
  • (CVE-2026-56850) https: distinguish PFX object-array agent keys (RafaelGSS) – Medium
  • (CVE-2026-58040) https: bind identity checks to session reuse (Matteo Collina) – Medium
  • (CVE-2026-58042) dns: handle large resolveAny address replies (RafaelGSS) – Medium
  • (CVE-2026-58045) zlib: throw on out-of-bounds write buffers (RafaelGSS) – Medium
  • (CVE-2026-56847) permission: enforce fs write permission for trace events (RafaelGSS) – Low
  • (CVE-2026-58039) permission: check final report output path (RafaelGSS) – Low
  • (CVE-2026-58044) http: reject requests exceeding max header count (Matteo Collina) – Low
  • deps: update llhttp to 9.4.3 (Paolo Insogna)
  • deps: update undici to 6.28.0 (Node.js GitHub Bot)
Commits

Version 26.5.0 (Current), @richardlau - 2026-07-08

Jul 8, 2026
Notable Changes
New release key

Welcome to our newest releaser, Stewart X Addison. Future Node.js releases may be signed with his release key, 655F3B5C1FB3FA8D1A0CA6BDE4A7D232B936D2FD.

Other notable changes
  • \[55f48446c7] - (SEMVER-MINOR) buffer: implement blob.textStream() (Matthew Aitken) #64036
  • \[b373202efc] - (SEMVER-MINOR) esm: add --experimental-import-text flag (Efe) #62300
  • \[39e0c14455] - (SEMVER-MINOR) perf\_hooks: sample delay per event loop iteration (Pablo Erhard) #62935
  • \[999a83c937] - (SEMVER-MINOR) stream: expose ReadableStreamTee (Matteo Collina) #64195
  • \[4e0236dc3d] - (SEMVER-MINOR) tls: report negotiated TLS groups (Filip Skokan) #64119
Commits
  • \[87648c0a6c] - benchmark: trim down the argon2 sets (Filip Skokan) #64218
  • \[a483bfd3f0] - buffer: remove unreachable overflow check in atob (haramjeong) #60161
  • \[6d14279688] - buffer: add fast api for isUtf8 and isAscii (Gürgün Dayıoğlu) #64169
  • \[55f48446c7] - (SEMVER-MINOR) buffer: implement blob.textStream() (Matthew Aitken) #64036
  • \[a67d9a7a44] - build: allow linting node.1 (Aviv Keller) #64157
  • \[06c1fbc25b] - build: enable Maglev for riscv64 (Jamie Magee) #62605
  • \[518309c363] - build: suppress clang errors building libffi on Windows (René) #64222
  • \[6a80ab485c] - build: add manually-dispatched stress-test workflow (Joyee Cheung) #64118
  • \[f4e7bf1f1c] - build: pin envinfo versions in github actions (Joyee Cheung) #64117
  • \[66f6ac0d86] - build: support setting an emulator from configure script (Ivan Trubach) #53899
  • \[7f26c54aa6] - child\_process: fix permission model propagation via NODE\_OPTIONS (Matteo Collina) #63972
  • \[32bb554f5b] - crypto: fix large DH generator validation (Tobias Nießen) #64092
  • \[0908d76ef6] - crypto: reject small-order EdDSA points during verify (Filip Skokan) #64026
  • \[7f7e5863c2] - deps: update undici to 8.7.0 (Node.js GitHub Bot) #64282
  • \[af91029801] - deps: update nghttp3 to 1.17.0 (Node.js GitHub Bot) #64182
  • \[2e500ba7b0] - deps: update googletest to 8b53336594cc52213c6c2c7a0b29194fa896d039 (Node.js GitHub Bot) #64181
  • \[74e3aa24ba] - deps: update sqlite to 3.53.3 (Node.js GitHub Bot) #64180
  • \[c7e57f55a7] - deps: c-ares: cherry-pick 8ba37af8e3fb (René) #64110
  • \[879fdc4daf] - deps: V8: backport da20a197a7f9 (Kevin Gibbons) #64101
  • \[a640543a7c] - deps: V8: cherry-pick 0cc9eb22c0b0 (Kevin Gibbons) #64101
  • \[feefd179e5] - deps: V8: cherry-pick 1a391f98cc7a (Kevin Gibbons) #64101
  • \[8ef643d4b0] - deps: update googletest to 0b1e895ba4226c2fda5ee0178c9b5b1195a741aa (Node.js GitHub Bot) #64039
  • \[9e50bb0655] - dgram: skip dns.lookup() for literal IP addresses (Ruben Bridgewater) #64133
  • \[dc052c095c] - diagnostics\_channel: return original thenable (Stephen Belanger) #62407
  • \[a22a840293] - doc: clarify QUIC stream state wording (EduardF1) #63660
  • \[8d4bec2d71] - doc: update Http2SecureServer.on("timeout") default value (YuSheng Chen) #64187
  • \[da88f70afa] - doc: add note on visibility of CI failures to new contributor guide (Stewart X Addison) #64256
  • \[20ce359ccb] - doc: clarify HTTP/1.1 response ordering (Matteo Collina) #64213
  • \[05eae2835c] - doc: recommend node-stress-single-test for flaky tests (Trivikram Kamat) #64223
  • \[3966eb67e7] - doc: fix typo in examples (Vas Sudanagunta) #64184
  • \[12a2b9daa3] - doc: fix typo in node-config-schema.json (Hamid Reza Ghavami) #64188
  • \[0854482671] - doc: clarify defense-in-depth issues (Matteo Collina) #64215
  • \[ef4915fc3a] - doc: fix Fast FFI argument count in ffi.md (Daijiro Wachi) #63960
  • \[bb2eed863c] - doc: add sxa GPG key (ed25519) (Stewart X Addison) #64193
  • \[b7bf6e3a06] - doc: add guide and answers to FAQs for first-time contributors (Joyee Cheung) #63685
  • \[ff537ba858] - doc: update Http2Server.close & Http2SecureServer.close (YuSheng Chen) #63298
  • \[f3db304588] - doc: update list of people in SECURITY.md (Richard Lau) #64152
  • \[2a126647b0] - doc: clarify vfs is not a sandbox (Matteo Collina) #64143
  • \[85fc79dd9b] - doc: fix broken links and duplicate stability label (Antoine du Hamel) #64130
  • \[189e830eb3] - doc: add missing option to man page (Richard Lau) #64156
  • \[7a16ccccd0] - doc: announce upcoming end of tier 2 support for macOS x64 (Antoine du Hamel) #63931
  • \[d5f826045f] - doc: update toolchain for official AIX releases (Richard Lau) #64068
  • \[60abc4400f] - doc: fix callback example import in fs docs (Kamal Rawal) #63912
  • \[e470c74a6c] - doc: fix keepAliveTimeout default in http.createServer options (Jahanzaib iqbal) #63974
  • \[851b460583] - esm: improve ERR\_REQUIRE\_ASYNC\_MODULE (Joyee Cheung) #64260
  • \[0cd443df39] - esm: print required top-level await locations without evaluating (Joyee Cheung) #64154
  • \[b373202efc] - (SEMVER-MINOR) esm: add --experimental-import-text flag (Efe) #62300
  • \[eacfbd0ca5] - http: add CONNECT method handling for default Host header with proxy (Archkon) #64114
  • \[aeb539a383] - http: fix drain event with cork/uncork (David Evans) #64038
  • \[8e8874b216] - http: document and validate options.path when it's in absolute-form (Joyee Cheung) #64108
  • \[eb2e96bc28] - inspector: fix crash when writing to closed inspector socket (ympark2011) #64209
  • \[243b0e4e57] - lib: reject string "0" in validatePort when allowZero is false (Daijiro Wachi) #64174
  • \[34a537c0ed] - lib: use __proto__: null when calling ObjectDefineProperty (Antoine du Hamel) #64239
  • \[1f72393f19] - lib: lazily initialize kEvents and kHandlers maps (Guilherme Araújo) #63702
  • \[92a3dc3191] - lib,permission: fix addon permission drop (Martin Wagner) #64007
  • \[87b8f2a296] - meta: fix linter warning in stale.yml (Antoine du Hamel) #64281
  • \[829c4a5913] - meta: bump actions/cache from 5.0.5 to 6.1.0 (dependabot\[bot]) #64248
  • \[0808dcd31c] - meta: bump github/codeql-action/autobuild from 4.36.1 to 4.36.2 (dependabot\[bot]) #64247
  • \[64aa17058f] - meta: bump github/codeql-action/analyze from 4.36.1 to 4.36.2 (dependabot\[bot]) #64246
  • \[873d1e0412] - meta: bump actions/checkout from 6.0.2 to 7.0.0 (dependabot\[bot]) #64245
  • \[fe460ccf0b] - meta: bump codecov/codecov-action from 6.0.1 to 7.0.0 (dependabot\[bot]) #64244
  • \[845c63ed50] - meta: bump rtCamp/action-slack-notify from 2.3.3 to 2.4.0 (dependabot\[bot]) #64243
  • \[2cad2d6de5] - meta: bump github/codeql-action/init from 4.36.1 to 4.36.2 (dependabot\[bot]) #64242
  • \[0ddde950c7] - meta: bump actions/setup-python from 6.2.0 to 6.3.0 (dependabot\[bot]) #64241
  • \[c0a8760d2f] - meta: bump github/codeql-action/upload-sarif from 4.36.1 to 4.36.2 (dependabot\[bot]) #64240
  • \[f49704b9d0] - meta: clarify V8 flags are outside threat model (Matteo Collina) #64224
  • \[6b8dc58e6e] - meta: move one or more collaborators to emeritus (Node.js GitHub Bot) #64057
  • \[fe5260cca7] - meta: update status of past strategic initiatives (Joyee Cheung) #63480
  • \[7b01040008] - meta: speed up stale bot (Aviv Keller) #64075
  • \[874c46c24f] - meta: update sccache version in test-linux-quic (René) #64043
  • \[48c5c86363] - module: enable import support for addons by default (Chengzhong Wu) #64221
  • \[39e0c14455] - (SEMVER-MINOR) perf\_hooks: sample delay per event loop iteration (Pablo Erhard) #62935
  • \[f90f1bd032] - perf\_hooks: add NODE\_PERFORMANCE\_GC\_MINOR\_MARK\_SWEEP constant (Attila Szegedi) #63877
  • \[bdf32628c7] - process: fix finalization cleanup ref tracking (Trivikram Kamat) #64087
  • \[9a65b7fff4] - quic: drop version negotiation packets with oversized CIDs (Mohamed Sayed) #64228
  • \[2699fe4706] - quic: fixes undefined handle in QuicStream kInspect (Marten Richter) #64170
  • \[00dea28bb3] - repl: lazy-load acorn and defer vm context creation (Daijiro Wachi) #63879
  • \[ce659a1cf9] - src: fix escaping of single quotes in task runner (Antoine du Hamel) #64089
  • \[dbb3126e5c] - src: abstract tracing agent for both legacy and perfetto (Chengzhong Wu) #64053
  • \[12edf1d68d] - src: avoid redundant call to std::get_if<>() (Tobias Nießen) #64094
  • \[eda91b6d01] - src: avoid copying source string in TextEncoder.encode (Yagiz Nizipli) #63897
  • \[efbbb9a03c] - stream: preserve half-open duplexes in async iteration (Efe) #64275
  • \[999a83c937] - (SEMVER-MINOR) stream: expose ReadableStreamTee (Matteo Collina) #64195
  • \[ab5ed72903] - stream: reject iter consumers on abort (Trivikram Kamat) #64066
  • \[d3fa77c5e2] - stream: fix merge abort for pending sources (Trivikram Kamat) #64013
  • \[38b99140ed] - stream: refactor unnecessary optional chaining away (Antoine du Hamel) #64253
  • \[c81f894ebe] - stream: cut per-chunk overhead in WHATWG streams (Matteo Collina) #64252
  • \[f162234f24] - stream: normalize Broadcast.from() byte inputs (Trivikram Kamat) #64082
  • \[1182ad8f3b] - stream: proxy first own method in Readable.wrap() (Daijiro Wachi) #64048
  • \[d0b830b382] - stream: observe abort while awaiting pipeTo source (Trivikram Kamat) #64015
  • \[f7adcd8359] - stream: respect iter consumer abort signals (Trivikram Kamat) #63997
  • \[b09e624c6f] - test: make blob desiredSize assertion robust (Trivikram Kamat) #64106
  • \[d0d8f0c774] - test: update WPT for urlpattern to 11a459a2b1 (Node.js GitHub Bot) #64037
  • \[ff9122c20c] - test: improve lcov reporter snapshot diagnostics (Trivikram Kamat) #64049
  • \[570952d4f3] - test: keep finalization close fixture ref alive (Trivikram Kamat) #64085
  • \[1b4f213380] - test: fix typo from overriden to overridden (parkhoje

Version 26.4.0 (Current), @aduh95 - 2026-06-24

Jun 24, 2026
Notable Changes
  • \[cde0daabcc] - (SEMVER-MINOR) doc: update blockList stability status to release candidate (alphaleadership) #63050
  • \[b78f5a7537] - (SEMVER-MINOR) fs: support caller-supplied readFile() buffers (Matteo Collina) #63634
  • \[417aacbc36] - (SEMVER-MINOR) http: close pre-request sockets in closeIdleConnections (semimikoh) #63470
  • \[fbb108be7d] - (SEMVER-MINOR) loader: implement package maps (Maël Nison) #62239
  • \[45494d5a8a] - (SEMVER-MINOR) net: support TCP_KEEPINTVL and TCP_KEEPCNT in setKeepAlive (Guy Bedford) #63825
  • \[ee29465e77] - (SEMVER-MINOR) tls: add certificateCompression option (Tim Perry) #62217
  • \[b17817eb2b] - (SEMVER-MINOR) vfs: dispatch node:fs/promises to mounted VFS instances (Matteo Collina) #63537
  • \[7bc93a6ac5] - (SEMVER-MINOR) vfs: add minimal node:vfs subsystem (Matteo Collina) #63115
Commits
  • \[c7eb83b46a] - benchmark: add child\_process async path baselines (Yagiz Nizipli) #63929
  • \[066fff17a5] - benchmark: remove old alias usage in ffi benchmarks (Anna Henningsen) #63666
  • \[509cd1b94f] - buffer: optimize Buffer.prototype.copy (Robert Nagy) #63828
  • \[86e651bbd0] - buffer: use simdutf for two-byte utf8 byteLength (Mert Can Altin) #63639
  • \[d3f4ed9015] - build: suppress compiler warnings for histogram (Richard Lau) #63980
  • \[82dd7ddbe6] - build: add QUIC CI job for PRs matching QUIC related paths (Tim Perry) #63875
  • \[1124c0652d] - build: remove redundant intermediate node\_aix\_shared (Chengzhong Wu) #63747
  • \[e510ee8087] - build: build codecache and snapshot with libnode (Chengzhong Wu) #63626
  • \[5b583dace5] - build: enable maglev by default on Linux ppc64le (Richard Lau) #63474
  • \[a2324246b4] - build: remove duplicated node\_use\_sqlite and node\_use\_ffi conditions (Chengzhong Wu) #63629
  • \[2a467a5f69] - _Revert_ "build, doc: generate node.1 with doc-kit" (Antoine du Hamel) #64091
  • \[e01dec45b8] - build, doc: generate node.1 with doc-kit (Aviv Keller) #62044
  • \[2ab9848fe4] - child\_process: pass spawn options to the binding positionally (Yagiz Nizipli) #63930
  • \[04c04c8b5c] - child\_process: serialize advanced IPC messages natively (Yagiz Nizipli) #63933
  • \[1eef57293d] - crypto: support non-byte WebCrypto lengths and cSHAKE (Filip Skokan) #63988
  • \[788a66e147] - crypto: share WebCrypto method and usage helpers (Filip Skokan) #63975
  • \[f9fdce3f46] - crypto: use EVP\_MAC for HMAC on OpenSSL >=3 (Filip Skokan) #63942
  • \[7e9ca87e58] - crypto: make webcrypto aliasKeyFormat directional (Filip Skokan) #63910
  • \[656e57ebbf] - crypto: fix unhandled error in Hash.\_transform (Haram Jeong) #63261
  • \[65536f0d98] - crypto: refactor keyObject.toCryptoKey() and SubtleCrypto.getPublicKey() (Filip Skokan) #63622
  • \[978f1d2bcc] - crypto: handle cipher context allocation failures (Tian Teng) #63542
  • \[5551e8f773] - crypto: deduplicate X509 subject matching logic (Tobias Nießen) #63644
  • \[57ae87640a] - crypto: fix warnings in test\_node\_crypto.cc (Maya Lekova) #63490
  • \[9984b05dff] - crypto: coerce -0 to +0 before native calls (Filip Skokan) #63556
  • \[88011a3689] - crypto,tls: do not ignore BN\_get\_word error (Tobias Nießen) #63895
  • \[9a3393d14f] - debugger: lazily wait for initial break output (Trivikram Kamat) #63969
  • \[b0bfcb9c59] - debugger: defer probe pause handling until startup (Trivikram Kamat) #63608
  • \[8516003953] - debugger: await initialization after run and restart (Trivikram Kamat) #63607
  • \[4438cb5284] - debugger: add --max-hit option to probe mode (Joyee Cheung) #63704
  • \[238b54ed2a] - debugger: add more logs to probe mode (Joyee Cheung) #63663
  • \[bbef54b413] - deps: libffi: cherry-pick 9ca53a19833d (Anthony Green) #64040
  • \[9761385dbd] - deps: update libffi to 3.6.0 (Node.js GitHub Bot) #64040
  • \[373ec2d092] - deps: update acorn to 8.17.0 (Node.js GitHub Bot) #63901
  • \[e44b5d487e] - (SEMVER-MINOR) deps: update OpenSSL build config to support compression (Tim Perry) #62217
  • \[3ed287a2e2] - deps: upgrade npm to 11.17.0 (npm team) #63857
  • \[b1b597c797] - deps: add ngtcp2\_fmt.c to build configuration (ngtcp2.gyp) (沈鸿飞) #63821
  • \[0bf8e12305] - deps: V8: add CopyArrayBufferBytes API (Robert Nagy) #63828
  • \[e49d7301a5] - deps: update ngtcp2 to 1.23.0 (Node.js GitHub Bot) #63777
  • \[e5c079004b] - deps: update nghttp3 to 1.16.0 (Node.js GitHub Bot) #63776
  • \[d599fa2346] - deps: update googletest to 7140cd416cecd7462a8aae488024abeee55598e4 (Node.js GitHub Bot) #63775
  • \[bc09f1508c] - deps: update sqlite to 3.53.2 (Node.js GitHub Bot) #63774
  • \[60787746c4] - deps: update zlib to 1.3.2.1-motley-3246f1b (Node.js GitHub Bot) #63773
  • \[971af104f1] - deps: update amaro to 1.1.10 (Node.js GitHub Bot) #63670
  • \[e17f665444] - deps: update googletest to 8736d2cd5c1dcba41170ed2fddca14021d4916c3 (Node.js GitHub Bot) #63669
  • \[7591949457] - dgram: add synchronous Socket connectSync() (Guy Bedford) #63932
  • \[d75222d7cb] - dgram: add synchronous Socket.prototype.bindSync() (Guy Bedford) #63838
  • \[0cf8342ae2] - dns: coerce -0 to +0 in lookup and resolver inputs (Filip Skokan) #63556
  • \[e068299320] - doc: update gcc toolchains to gcc-13 and g++-13 (Louie Llaneta) #64018
  • \[65178bdcf3] - doc: add aduh95 to last security release steward (Antoine du Hamel) #63981
  • \[83eedfe85b] - doc: fix typo in util.md (Daijiro Wachi) #63961
  • \[54948c78e7] - doc: clarify callback exceptions (Matteo Collina) #63939
  • \[205d0a57f2] - doc: fix incorrect test runner mock examples (Kimaswa Emmanuel Yusufu) #63656
  • \[44809b176c] - doc: clarify fromReadable() duck-typed contract (Trivikram Kamat) #63682
  • \[9cb15fcc85] - doc: fix typo in cli.md (Daijiro Wachi) #63883
  • \[394d0bb928] - doc: fix typo in vm.md (Daijiro Wachi) #63881
  • \[59b7be8193] - doc: fix typo in packages.md (Daijiro Wachi) #63882
  • \[33c236cea9] - doc: fix a/an article typos in module, util, and dns (Daijiro Wachi) #63766
  • \[30595da67b] - doc: update npm supported versions link (hojeong park) #63672
  • \[5919ba7e97] - doc: fix AES-OCB IV length in SubtleCrypto.supports example (Anshika Jain) #63717
  • \[51cab5cb72] - doc: add webstreams to args for pipeline from stream/promises (David Sanders) #63628
  • \[ce85b2af88] - doc: fix "used to sent" → "used to send" in http2 (Daijiro Wachi) #63700
  • \[298735e8df] - doc: mark Node.js 25 as End-of-Life (Antoine du Hamel) #63692
  • \[56948518b9] - doc: clarify tty raw mode applies to input processing only (Muhammad Zeeshan) #63438
  • \[32ff731248] - doc: add worker\_threads history entries (Bob Put) #63545
  • \[cde0daabcc] - (SEMVER-MINOR) doc: update blockList stability status to release candidate (alphaleadership) #63050
  • \[d29483fc4f] - doc,crypto: mark argon2 and encap/decap as stable (Filip Skokan) #63924
  • \[6e668331d9] - events: improve addAbortListener perf by caching options object (Raz Luvaton) #52367
  • \[97aafe2519] - ffi: add fast support for almost all other platforms (Paolo Insogna) #63941
  • \[f52cf5eeaa] - ffi: add experimental fast FFI call API for AArch64 and x86\_64 (Paolo Insogna) #63068
  • \[d9461fee05] - ffi: port semi-colon fix for riscv64 (and others) (Stewart X Addison) #63794
  • \[4c8402e0a8] - fs: do not treat EPERM as ENOTEMPTY on Windows (Kirill Saied) #63709
  • \[b78f5a7537] - (SEMVER-MINOR) fs: support caller-supplied readFile() buffers (Matteo Collina) #63634
  • \[3d0097d489] - fs: prevent spurious recursive watch events on prefix siblings (Marco) #63095
  • \[14d829cb3c] - fs: ignore deleted dirs in recursive watch scan (Trivikram Kamat) #63686
  • \[ceba08a1ea] - fs: coerce -0 to +0 in mode flags and watch intervals (Filip Skokan) #63556
  • \[6577d3b282] - http: avoid stream listeners on idle agent sockets (Matteo Collina) #64004
  • \[417aacbc36] - (SEMVER-MINOR) http: close pre-request sockets in closeIdleConnections (semimikoh) #63470
  • \[b7fd13a59a] - http2: retain header memory in session accounting (Matteo Collina) #63752
  • \[e611ccd167] - inspector: fix inspector.close() documented behavior (Chengzhong Wu) #63837
  • \[a44f51eef3] - lib: fix missing lazyDOMException import (Filip Skokan) #64033
  • \[27cc4ec598] - lib: add lint rule to enforce use of kEmptyObject (Antoine du Hamel) #63790
  • \[7ee31b0bf4] - lib: improve control abstraction coverage in frozen intrinsics (Renegade334) #63698
  • \[078457839a] - lib: add Iterator global to primordials (Renegade334) #63698
  • \[58837dc4dd] - lib: remove source map deadcode in type stripping (Chengzhong Wu) #63738
  • \[e7513a8b9e] - lib: make Navigator#language getter throw on invalid this (Mohamed Sayed) #63601
  • \[fbb108be7d] - (SEMVER-MINOR) loader: implement package maps (Maël Nison) #62239
  • \[ea0b8e1dc2] - meta: bump github/codeql-action from 4.35.3 to 4.36.1 (dependabot\[bot]) #63724
  • \[ac90719532] - meta: bump actions/cache from 5.0.4 to 5.0.5 (dependabot\[bot]) #62847
  • \[3ed3de3062] - meta: bump actions/checkout from 6.0.2 to 6.0.3 (dependabot\[bot]) #63726
  • \[d08d57bf70] - meta: bump codecov/codecov-action from 6.0.0 to 6.0.1 (dependabot\[bot]) #63725
  • \[e748d192cf] - meta: bump cachix/cachix-action (dependabot\[bot]) #63729
  • \[10554eb131] - meta: bump actions/stale from 10.2.0 to 10.3.0 (dependabot\[bot]) #63728
  • \[791885f2af] - meta: bump step-security/harden-runner from 2.19.0 to 2.19.4 (dependabot\[bot]) #63727
  • \[32d9a407d9] - meta: bump cachix/install-nix-action from 31.10.5 to 31.10.6 (dependabot\[bot]) #63723
  • \[[b97c7bed07](https://github.com/nodejs/node/commit/b97c

Version 24.18.0 'Krypton' (LTS), @richardlau prepared by @sxa - 2026-06-23

Jun 23, 2026
Notable Changes
  • \[e07e7a31e1] - crypto: update root certificates to NSS 3.123.1 (Node.js GitHub Bot) #63527
  • \[44c8ebcbd6] - http: avoid stream listeners on idle agent sockets (Matteo Collina) #64004
  • \[d3ef4122ee] - (SEMVER-MINOR) buffer: increase Buffer.poolSize default to 64 KiB (Matteo Collina) #63597
  • \[bb2857b85a] - (SEMVER-MINOR) crypto: align key argument names in docs and error messages (Filip Skokan) #62527
  • \[b9d5e87880] - (SEMVER-MINOR) crypto: accept key data in crypto.diffieHellman() and cleanup DH jobs (Filip Skokan) #62527
  • \[ccd756d61e] - (SEMVER-MINOR) crypto: add TurboSHAKE and KangarooTwelve Web Cryptography algorithms (Filip Skokan) #62183
  • \[4c9251fc09] - (SEMVER-MINOR) http: add writeInformation to send arbitrary 1xx status codes (Tim Perry) #63155
  • \[8c989ec4a3] - (SEMVER-MINOR) inspector: expose precise coverage start to JS runtime (sangwook) #63079
  • \[3f54c8ba32] - _Revert_ "stream: noop pause/resume on destroyed streams" (Stewart X Addison) #63834
Commits
  • \[d3ef4122ee] - (SEMVER-MINOR) buffer: increase Buffer.poolSize default to 64 KiB (Matteo Collina) #63597
  • \[9ff36e40f0] - build: add --enable-all-experimentals build flag (Paolo Insogna) #62755
  • \[7c22ee23aa] - build: def NODE_USE_NODE_CODE_CACHE only used in node\_mksnapshot (Chengzhong Wu) #63588
  • \[2551abdb4a] - build,win: enable x64 PGO (Stefan Stojanovic) #62761
  • \[e8a55ce9b1] - crypto: strengthen argument CHECKs in TurboSHAKE (Tobias Nießen) #62763
  • \[ae61cd68f3] - crypto: harden WebCrypto against prototype pollution (Filip Skokan) #63363
  • \[3d05a1d396] - crypto: pass CryptoKey handles to KDF jobs (Filip Skokan) #63363
  • \[f9d10a3f6b] - crypto: remove async from WebCrypto methods (Filip Skokan) #63363
  • \[e431d93e9e] - crypto: add WebCrypto CryptoJob mode (Filip Skokan) #63363
  • \[56e2505e48] - crypto: wire ML-DSA and ML-KEM for use when using BoringSSL (Filip Skokan) #63255
  • \[3bac77f2a8] - crypto: wire ChaCha20-Poly1305 in Web Cryptography when using BoringSSL (Filip Skokan) #63255
  • \[1bff901b09] - crypto: wire AES-KW in Web Cryptography when using BoringSSL (Filip Skokan) #63255
  • \[4433fca3df] - crypto: harden CryptoKey algorithm slots (Filip Skokan) #63111
  • \[b5cf01217a] - crypto: harden KeyObject internal slots (Filip Skokan) #63111
  • \[ce84aef37d] - crypto: add guards and adjust tests for BoringSSL (Filip Skokan) #62883
  • \[26781689b0] - crypto: reject duplicate ML-KEM JWK key\_ops (Filip Skokan) #62905
  • \[aeea8f4970] - crypto: add JWK support for ML-KEM and SLH-DSA key types (Filip Skokan) #62706
  • \[407cf91656] - crypto: guard against size\_t overflow on experimental 32-bit arch (Filip Skokan) #62626
  • \[bb2857b85a] - (SEMVER-MINOR) crypto: align key argument names in docs and error messages (Filip Skokan) #62527
  • \[b9d5e87880] - (SEMVER-MINOR) crypto: accept key data in crypto.diffieHellman() and cleanup DH jobs (Filip Skokan) #62527
  • \[b46d52b283] - crypto: unify asymmetric key import through KeyObjectHandle::Init (Filip Skokan) #62499
  • \[ccd756d61e] - (SEMVER-MINOR) crypto: add TurboSHAKE and KangarooTwelve Web Cryptography algorithms (Filip Skokan) #62183
  • \[e07e7a31e1] - crypto: update root certificates to NSS 3.123.1 (Node.js GitHub Bot) #63527
  • \[61826df455] - crypto: coerce -0 keylen to +0 in pbkdf2 and scrypt (Jordan Harband) #63531
  • \[16d2fd3c07] - crypto: align verifyOneShot accepted types (Anshika Jain) #63280
  • \[3b8330deda] - crypto: improve system certificate enumeration logic on macOS (Robo) #62576
  • \[141de35399] - debugger: add --help to node inspect and improve docs (Joyee Cheung) #63201
  • \[b76bfcd4fa] - deps: upgrade npm to 11.16.0 (npm team) #63602
  • \[4ec142314c] - deps: SQLite: cherry-pick b869ed6b067d623cb1383549f2a18aa35508385d (Junsu Han) #63525
  • \[19e8ce1c36] - deps: upgrade npm to 11.15.0 (npm team) #63463
  • \[8a264260e2] - deps: update sqlite to 3.53.1 (Node.js GitHub Bot) #63217
  • \[50c8ff3f94] - deps: update simdjson to 4.6.4 (Node.js GitHub Bot) #62811
  • \[6e56f01c4b] - deps: V8: cherry-pick 435a2cdf664c (Matthias Liedtke) #63136
  • \[3ba813b242] - deps: cherry-pick libuv/libuv\@a43e543 (Ali Hassan) #63222
  • \[2390e3a5ac] - doc: remove duplicated sentences in large-pull-requests.md (Joyee Cheung) #63650
  • \[52a1c18374] - doc: update git node land instructions for security releases (Antoine du Hamel) #63586
  • \[3e6b4da037] - doc: drop --experimental from --permission (Rafael Gonzaga) #63583
  • \[84d05163b9] - doc: explicitly ask for reproducible in JS (Rafael Gonzaga) #63479
  • \[7da2a4450e] - doc: fix URL postMessage example in worker\_threads (Kit Dallege) #62203
  • \[3d79bd8b29] - doc: clarify filter option of sqlite.database.applyChangeset (Antoine du Hamel) #63515
  • \[4f4174aace] - doc: fix double spaces in ERR\_TLS\_INVALID\_PROTOCOL\_METHOD (Daijiro Wachi) #63511
  • \[388323ca4b] - doc: fix double space in modules.md (Daijiro Wachi) #63512
  • \[5258ccc058] - doc: fix "options" to "option" in tls.createServer (Daijiro Wachi) #63453
  • \[43e83e6507] - doc: fix typo in deprecations (Daijiro Wachi) #63434
  • \[f05a61d54c] - doc: remove unsupported template type from v8.md (René) #63410
  • \[c39d5fc820] - doc: fix article usage before vowel-sound acronyms (joao-oliveira-softtor) #62696
  • \[398261f911] - doc: remove the bi-monthly contributor spotlight section (Claudio Wunder) #62734
  • \[fd9e14c405] - doc: update http2's push and trailers events with rawHeaders param (YuSheng Chen) #63259
  • \[b943ce6933] - doc: remove inactive members from Triagers list (Antoine du Hamel) #63329
  • \[4b9cdfc022] - doc: reference correct function in Module docs (Robin Malfait) #63247
  • \[bed84b6df2] - doc: replace Visual Studio 2022 Evergreen version reference with 17.14 (Mike McCready) #63211
  • \[32ea70569b] - doc: recommend explicitly Tier 1 or 2 for production applications (Mike McCready) #63187
  • \[4627bcfd82] - doc: run license-builder (github-actions\[bot]) #63232
  • \[28eba71845] - doc: add large pull requests contributing guide (Matteo Collina) #62829
  • \[2648efd438] - doc: remove unnecessary <!-- eslint- magic comments (Antoine du Hamel) #63200
  • \[a95fc1f8fc] - doc: clarify SEA platform support excludes darwin-x64 (MJSHANG) #63181
  • \[aaef29e2e1] - doc: update release steps when post-release fails (Rafael Gonzaga) #63131
  • \[7d81419cf2] - doc: add Hmac.digest() documentation-only deprecation (DEP0206) (Anshika Jain) #63121
  • \[ececd80d81] - doc: document the latest-vX.x schema (Marco Ippolito) #63033
  • \[27c1c1d842] - doc: remove list of versions in BUILDING.md (Antoine du Hamel) #63113
  • \[e369886a65] - doc,sqlite: document entryPoint argument for loadExtension (Edy Silva) #63152
  • \[e4e5137cbd] - errors: handle V8 warnings in DisallowJavascriptExecutionScope (Divyanshu Sharma) #63491
  • \[6d1f6048d2] - fs: make Date properties on Stats enumerable (LiviaMedeiros) #63328
  • \[44c8ebcbd6] - http: avoid stream listeners on idle agent sockets (Matteo Collina) #64004
  • \[4c9251fc09] - (SEMVER-MINOR) http: add writeInformation to send arbitrary 1xx status codes (Tim Perry) #63155
  • \[39f61fb06c] - http2: emit session close before stream close (Matteo Collina) #63414
  • \[8a8f2127d1] - http2: validate non-link headers in writeEarlyHints (Matteo Collina) #62017
  • \[8c989ec4a3] - (SEMVER-MINOR) inspector: expose precise coverage start to JS runtime (sangwook) #63079
  • \[c05f38229b] - lib: cleanup stateless diffiehellman key handling (Filip Skokan) #62645
  • \[1c16b45d35] - lib: refactor internal webidl converters (Filip Skokan) #62979
  • \[02f35d6dce] - lib: define kEnumerableProperty atomically (Antoine du Hamel) #63609
  • \[12c51547ba] - lib: fix typos in esm loader comments (RonGamzu) #63465
  • \[9b03b84262] - lib: fix typo idenity => identity (Daijiro Wachi) #63112
  • \[a84e6b0567] - lib: fixes validator message (Daijiro Wachi) #62823
  • \[11734166a8] - lib: narrow ReadableStreamBYOBRequest.view return type to Uint8Array (RoomWithOutRoof) #63017
  • \[7cead61d21] - meta: flip mcollina emails in .mailmap (Matteo Collina) #63621
  • \[a08cfcfd35] - meta: label "source maps" PRs (Chengzhong Wu) #63591
  • \[d56e8d2512] - meta: add vfs subsystem label (René) #62331
  • \[6201cfe488] - meta: skip scheduled workflows on forks (Jamie Magee) #63565
  • \[f095e2bd31] - meta: add additional gitignore entries (James M Snell) #63267
  • \[1ea52c444c] - meta: move one or more collaborators to emeritus (Node.js GitHub Bot) #63402
  • \[b1b2327611] - meta: move one or more collaborators to emeritus (Node.js GitHub Bot) #63235
  • \[7d88e130a9] - meta: ignore AI assistants files (Matteo Collina) #62612
  • \[a53b51df38] - module: load ESM helpers eagerly in the snapshot (Joyee Cheung) #63550
  • \[69df688fff] - module: fix sync hook short-circuit in require() in imported CJS (Joyee Cheung) #62920
  • \[75d9a4ed47] - node-api: support SharedArrayBuffer in napi\_create\_typedarray (Yilong Li) #62710
  • \[c20aa4c47b] - quic: add reusePort option to QuicEndpoint (James M Snell) #63267
  • \[26a30d8a7f] - quic: implement rate limiting for version nego and immediate close (James M Snell) #63267
  • \[0b534b5770] - quic: fixup linting issue after other changes (James M Snell) #63267
  • \[4b367cbe09] - quic: remove unused binding variable in session.cc (James M Snell) #63177
  • \[2574bef5a6] - repl: fix dedup comparing normalized line against raw history (Daijiro Wachi) #62886
  • \[30e71c7e49] - sqlite: keep source database alive during backup (Matteo Collina) [#62673](https://github.com/nodejs/n

Version 22.23.1 'Jod' (LTS), @RafaelGSS - 2026-06-23

Jun 23, 2026

This release includes a fix for an unexpected behavior introduced by the recent security release (22.23.0).

Commits
  • \[41d2ee13be] - build: switch coverage-windows to windows-2022 (Richard Lau) #63940
  • \[eaa292549e] - http: avoid stream listeners on idle agent sockets (Matteo Collina) #64004

Version 26.3.1 (Current), @aduh95 - 2026-06-18

Jun 18, 2026

This is a security release.

Notable Changes
  • (CVE-2026-48618) tls: normalize hostname for server identity checks (Matteo Collina) – High
  • (CVE-2026-48933) crypto: guard WebCrypto cipher output length (Filip Skokan) – High
  • (CVE-2026-48615) lib,test: redact proxy credentials in tunnel errors (Matteo Collina) – Medium
  • (CVE-2026-48619) http2: cap originSet size to prevent unbounded memory growth (Matteo Collina) – Medium
  • (CVE-2026-48928) tls: fix case-sensitive SNI context matching (Matteo Collina) – Medium
  • (CVE-2026-48930) dns,net: reject hostnames with embedded NUL bytes (Matteo Collina) – Medium
  • (CVE-2026-48934) tls: bind reusable sessions to authenticated host (Matteo Collina) – Medium
  • (CVE-2026-48617) permission: handle process.chdir on writereport (RafaelGSS) – Low
  • (CVE-2026-48931) http: fix response queue poisoning in http.Agent (Matteo Collina) – Low
  • (CVE-2026-48935) permission: disable FileHandle utimes with permission model (RafaelGSS) – Low
  • (CVE-2026-48936) permission: guard pipe open and chmod with net scope (RafaelGSS) – Low
Commits

Version 24.17.0 'Krypton' (LTS), @aduh95 - 2026-06-18

Jun 18, 2026

This is a security release.

Notable Changes
  • (CVE-2026-48618) tls: normalize hostname for server identity checks (Matteo Collina) – High
  • (CVE-2026-48933) crypto: guard WebCrypto cipher output length (Filip Skokan) – High
  • (CVE-2026-48615) lib,test: redact proxy credentials in tunnel errors (Matteo Collina) – Medium
  • (CVE-2026-48619) http2: cap originSet size to prevent unbounded memory growth (Matteo Collina) – Medium
  • (CVE-2026-48928) tls: fix case-sensitive SNI context matching (Matteo Collina) – Medium
  • (CVE-2026-48930) dns,net: reject hostnames with embedded NUL bytes (Matteo Collina) – Medium
  • (CVE-2026-48934) tls: bind reusable sessions to authenticated host (Matteo Collina) – Medium
  • (CVE-2026-48937) deps: fix integration issues with the latest nghttp2 – Medium
  • (CVE-2026-48617) permission: handle process.chdir on writereport (RafaelGSS) – Low
  • (CVE-2026-48931) http: fix response queue poisoning in http.Agent (Matteo Collina) – Low
  • (CVE-2026-48935) permission: disable FileHandle utimes with permission model (RafaelGSS) – Low
Commits

Version 22.23.0 'Jod' (LTS), @aduh95 - 2026-06-18

Jun 18, 2026

This is a security release.

Notable Changes
  • (CVE-2026-48618) tls: normalize hostname for server identity checks (Matteo Collina) – High
  • (CVE-2026-48933) crypto: guard WebCrypto cipher output length (Filip Skokan) – High
  • (CVE-2026-48937) deps: fix integration issues with the latest nghttp2 – Medium
  • (CVE-2026-48930) dns,net: reject hostnames with embedded NUL bytes (Matteo Collina) – Medium
  • (CVE-2026-48619) http2: cap originSet size to prevent unbounded memory growth (Matteo Collina) – Medium
  • (CVE-2026-48615) lib,test: redact proxy credentials in tunnel errors (Matteo Collina) – Medium
  • (CVE-2026-48934) tls: bind reusable sessions to authenticated host (Matteo Collina) – Medium
  • (CVE-2026-48928) tls: fix case-sensitive SNI context matching (Matteo Collina) – Medium
  • (CVE-2026-48617) permission: handle process.chdir on writereport (RafaelGSS) – Low
  • (CVE-2026-48931) http: fix response queue poisoning in http.Agent (Matteo Collina) – Low
  • (CVE-2026-48935) permission: disable FileHandle utimes with permission model (RafaelGSS) – Low
Commits

Version 26.3.0 (Current), @aduh95 - 2026-06-01

Jun 1, 2026
Notable Changes
Potential changes to macOS Universal Binary availability

With Apple and its ecosystem progressively dropping support for Intel-based architectures, it has become apparent that the Node.js project may not be able to maintain the universal binaries we currently distribute for the full lifetime of Node.js 26. This change serves to communicate that risk. At present, our intention remains to continue shipping universal binaries supporting both Apple Silicon and Intel-based Macs for as long as practical.

Contributed by Antoine du Hamel in #63055.

Other notable changes
  • \[a2a4b33dd8] - (SEMVER-MINOR) buffer: increase Buffer.poolSize default to 64 KiB (Matteo Collina) #63597
  • \[051a2152f7] - crypto: update root certificates to NSS 3.123.1 (Node.js GitHub Bot) #63527
  • \[49462eca37] - (SEMVER-MINOR) http: add httpValidation option to configure header value validation (RajeshKumar11) #61597
  • \[97b7ab19bd] - (SEMVER-MINOR) inspector: expose precise coverage start to JS runtime (sangwook) #63079
  • \[cfb80a2103] - (SEMVER-MINOR) lib,permission: add permission.drop (Rafael Gonzaga) #62672
Commits
  • \[a2a4b33dd8] - (SEMVER-MINOR) buffer: increase Buffer.poolSize default to 64 KiB (Matteo Collina) #63597
  • \[0eff3e23b9] - build: def NODE_USE_NODE_CODE_CACHE only used in node\_mksnapshot (Chengzhong Wu) #63588
  • \[447ab2d252] - build,win: fix VS2022 arm64 PGO build (Stefan Stojanovic) #63413
  • \[86032758e4] - build,win: replace LTCG with Thin LTO for releases (Stefan Stojanovic) #63114
  • \[5f4d794052] - build,win: add Rust toolchain automated configuration Windows (Mike McCready) #63381
  • \[051a2152f7] - crypto: update root certificates to NSS 3.123.1 (Node.js GitHub Bot) #63527
  • \[d0f65e3579] - crypto: coerce -0 keylen to +0 in pbkdf2 and scrypt (Jordan Harband) #63531
  • \[e3ddb326c9] - crypto: harden WebCrypto against prototype pollution (Filip Skokan) #63363
  • \[e04cd17dc0] - crypto: pass CryptoKey handles to KDF jobs (Filip Skokan) #63363
  • \[64ba74d847] - crypto: remove async from WebCrypto methods (Filip Skokan) #63363
  • \[bd230418b4] - crypto: add WebCrypto CryptoJob mode (Filip Skokan) #63363
  • \[1a4090a83d] - debugger: surface inspector failures in probe mode (Joyee Cheung) #63437
  • \[dbc78ff825] - debugger,test: deflake resume failure test and add debug logs (Joyee Cheung) #63524
  • \[4da442f432] - deps: upgrade npm to 11.16.0 (npm team) #63602
  • \[63372cfa87] - deps: SQLite: cherry-pick b869ed6b067d623cb1383549f2a18aa35508385d (Junsu Han) #63525
  • \[e286fa170d] - deps: upgrade npm to 11.15.0 (npm team) #63463
  • \[de996437a5] - doc: downgrade macOS x64 to Tier 2 (Antoine du Hamel) #63055
  • \[22ac78750c] - doc: remove duplicated sentences in large-pull-requests.md (Joyee Cheung) #63650
  • \[532f7f2085] - doc: update git node land instructions for security releases (Antoine du Hamel) #63586
  • \[c61f90dfb9] - doc: drop --experimental from --permission (Rafael Gonzaga) #63583
  • \[fd69d7b16a] - doc: improve fs.StatFs properties descriptions (aymanxdev) #62578
  • \[693257782c] - doc: generate llms.txt (Guilherme Araújo) #62027
  • \[55a57beb26] - doc: explicitly ask for reproducible in JS (Rafael Gonzaga) #63479
  • \[4895c2babc] - doc: fix URL postMessage example in worker\_threads (Kit Dallege) #62203
  • \[0355c36e37] - doc: clarify filter option of sqlite.database.applyChangeset (Antoine du Hamel) #63515
  • \[c85ee22df6] - doc: fix double spaces in ERR\_TLS\_INVALID\_PROTOCOL\_METHOD (Daijiro Wachi) #63511
  • \[62947192f6] - doc: move hyperlinks outside of text blocks (Aviv Keller) #63493
  • \[9849690a1d] - doc: edit Rust toolchain general install instructions (Antoine du Hamel) #63488
  • \[885d2462e9] - doc: fix double space in modules.md (Daijiro Wachi) #63512
  • \[42fbb48bc6] - doc: fix "options" to "option" in tls.createServer (Daijiro Wachi) #63453
  • \[05a7b0a301] - doc: add Rust toolchain general install instructions (Mike McCready) #63426
  • \[e13dfd7ed0] - doc: update toolchain for official releases (Richard Lau) #63441
  • \[82306881cc] - doc: fix typo in deprecations (Daijiro Wachi) #63434
  • \[eeb77d217c] - doc,lib: align WebCrypto names with spec (Filip Skokan) #63518
  • \[679e13c57f] - errors: handle V8 warnings in DisallowJavascriptExecutionScope (Divyanshu Sharma) #63491
  • \[7f41f5d803] - ffi: validate 'void' as parameter type in getFunction and getFunctions (Anshika Jain) #63504
  • \[972cd227cb] - ffi: remove function signature property aliases (René) #63482
  • \[5d7805e433] - ffi: move DynamicLibrary disposer to native layer (René) #63459
  • \[5a0b32dc24] - gyp: update deps gypfiles (Nad Alaba) #63117
  • \[49462eca37] - (SEMVER-MINOR) http: add httpValidation option to configure header value validation (RajeshKumar11) #61597
  • \[e3c6629ee3] - http2: emit session close before stream close (Matteo Collina) #63414
  • \[97b7ab19bd] - (SEMVER-MINOR) inspector: expose precise coverage start to JS runtime (sangwook) #63079
  • \[6bef10e7b7] - lib: cleanup stateless diffiehellman key handling (Filip Skokan) #62645
  • \[fdc0b3d49c] - lib: define kEnumerableProperty atomically (Antoine du Hamel) #63609
  • \[99baf27aeb] - lib: fix typos in esm loader comments (RonGamzu) #63465
  • \[cfb80a2103] - (SEMVER-MINOR) lib,permission: add permission.drop (Rafael Gonzaga) #62672
  • \[8e75efb9bc] - meta: flip mcollina emails in .mailmap (Matteo Collina) #63621
  • \[a4ae97045f] - meta: label "source maps" PRs (Chengzhong Wu) #63591
  • \[3455a48ae1] - meta: add vfs subsystem label (René) #62331
  • \[01bfcdfc20] - meta: skip scheduled workflows on forks (Jamie Magee) #63565
  • \[bc4c457eae] - meta: add additional gitignore entries (James M Snell) #63267
  • \[e1d65d9509] - module: load ESM helpers eagerly in the snapshot (Joyee Cheung) #63550
  • \[6a97b0932a] - quic: add proper error codes & messages for QUIC failures (Tim Perry) #63198
  • \[5989f4a6e1] - quic: support hostname verification (James M Snell) #63483
  • \[b4d30e7a78] - quic: add stream idle timeout (James M Snell) #63483
  • \[8a1017f774] - quic: add block list support for endpoints (James M Snell) #63483
  • \[5a3ab93c49] - quic: improve peer cert verification (James M Snell) #63483
  • \[9701a82a78] - quic: handle h3 max header size option (James M Snell) #63483
  • \[71788a2048] - quic: add rate limiting docs (James M Snell) #63483
  • \[309bd49906] - quic: cache timestamp for address lru cache (James M Snell) #63483
  • \[2ce5588d51] - quic: add session creation rate limiting (James M Snell) #63483
  • \[98808baed1] - quic: refine rate limiting (James M Snell) #63483
  • \[75a4176b32] - quic: flip preferred address policy default to 'ignore' (James M Snell) #63483
  • \[8b6b03d60c] - quic: add doc note about certificate size limitations (James M Snell) #63483
  • \[30eff873e0] - quic: add applicationOptions to session (James M Snell) #63267
  • \[4303daa43c] - quic: add getters for local and remote transport parameters (James M Snell) #63267
  • \[e1b1bb5465] - quic: improve recv coalescing test sizes (James M Snell) #63267
  • \[25a416f457] - quic: add initial RTT option to session options (James M Snell) #63267
  • \[22e91c357f] - quic: enable recvmmsg batching in Endpoint (James M Snell) #63267
  • \[c96d8a9d9b] - quic: improve stream header collection performance (James M Snell) #63267
  • \[409460f2ce] - quic: add reusePort option to QuicEndpoint (James M Snell) #63267
  • \[9a2afffec9] - quic: coalesce received data into fewer buffers (James M Snell) #63267
  • \[f9a6a2f558] - quic: apply multiple additional minor improvements (James M Snell) #63267
  • \[ea5f3724ee] - quic: fix tests that are missing serverEndpoint close (James M Snell) #63267
  • \[6cffc931fc] - quic: fixup some v8:: qualifiers (James M Snell) #63267
  • \[9bc875e522] - quic: fix premature unref of endpoint when listening (James M Snell) #63267
  • \[f940d6b1be] - quic: fixup UAFs in bindingdata, streams, and app (James M Snell) #63267
  • \[fd00e0acb0] - quic: fix UAF in Application::OnTimeout() (James M Snell) #63267
  • \[378dbf00e9] - quic: improve the quic js structure (James M Snell) #63267
  • \[0045dc30b6] - quic: improve internal structure of QuicStream (James M Snell) #63267
  • \[5e38946b26] - quic: add aliased struct arenas (James M Snell) #63267
  • \[95430437a0] - quic: add handshake timeout and default connection limits (James M Snell) #63267
  • \[5622701429] - quic: implement rate limiting for version nego and immediate close (James M Snell) #63267
  • \[b171f391cd] - quic: fixup linting issue after other changes (James M Snell) #63267
  • \[24e9f4f177] - quic: fix crash in early handshake failure (James M Snell) #63267
  • \[5025e85d0a] - quic: eliminate per-received datagram allocation (James M Snell) #63267
  • \[aec1e17ec5] - quic: cache the timestamp on send and receive (James M Snell) #63267
  • \[9560084560] - quic: add support for future ECN marking (James M Snell) #63267
  • \[2b3ff8ada2] - quic: improve batching of packet sending (James M Snell) #63267
  • \[fe3639a4d6] - quic: improve backend quic packet processing (James M Snell) #63267
  • \[f043013d9a] - src: remove TOCTOU race condition when encoding SAB-backed Buffers (Antoine du Hamel) #63517
  • \[343958224d] - src: skip duplicate UTF-8 validation in TextDecoder fatal path (Mert Can Altin) #63231
  • \[2906fa833d] - src: dispatch ToV8Value(string\_view) via StringBytes::Encode (Mert Can Altin) #63370
  • \[860f9d8d4b] - src: fix ContextifyContext property definer interception result (Chengzhong Wu) #63549
  • \[fcccffcbe6] - src: fix crash when reading length on Storage.prototype (Mohamed Sayed) #63529
  • \[55f65f9fb6] - **sr

Version 24.16.0 'Krypton' (LTS), @aduh95 - 2026-05-21

May 21, 2026
Notable Changes
  • \[b267f6bca3] - (SEMVER-MINOR) crypto: implement randomUUIDv7() (nabeel378) #62553
  • \[ec2451b9cd] - (SEMVER-MINOR) debugger: add edit-free runtime expression probes to node inspect (Joyee Cheung) #62713
  • \[9705f628d9] - (SEMVER-MINOR) fs: add signal option to fs.stat() (Mert Can Altin) #57775
  • \[40ccfdecf9] - (SEMVER-MINOR) fs: expose frsize field in statfs (Jinho Jang) #62277
  • \[d7188af5c9] - (SEMVER-MINOR) http: harden ClientRequest options merge (Matteo Collina) #63082
  • \[aa1d8a9afc] - (SEMVER-MINOR) http: add req.signal to IncomingMessage (Akshat) #62541
  • \[6f37f7e240] - (SEMVER-MINOR) stream: propagate destruction in duplexPair (Ahmed Elhor) #61098
  • \[d14029be7f] - (SEMVER-MINOR) test\_runner: support test order randomization (Pietro Marchini) #61747
  • \[d142c584cd] - (SEMVER-MINOR) test\_runner: align mock timeout api (sangwook) #62820
  • \[01a9552585] - (SEMVER-MINOR) test\_runner: add mock-timers support for AbortSignal.timeout (DeveloperViraj) #60751
  • \[00705a459a] - (SEMVER-MINOR) util: colorize text with hex colors (Guilherme Araújo) #61556
Commits
  • \[dd72df060d] - assert,util: fix stale nested cycle memo entries (Ruben Bridgewater) #62509
  • \[add94f4bc3] - build: track PDL files as inputs in inspector GN build (Robo) #62888
  • \[1b1eb9e334] - build: remove redundant -fuse-linker-plugin from GCC LTO flags (Daniel Lando) #62667
  • \[8752b604ec] - crypto: deduplicate and canonicalize CryptoKey usages (Filip Skokan) #62902
  • \[341947e7fd] - crypto: reject unintended raw key format string input (Filip Skokan) #62974
  • \[28a78747fc] - crypto: remove Argon2 KDF derivation from its job setup (Filip Skokan) #62863
  • \[16e8c2b54d] - crypto: fix unsigned conversion of 4-byte RSA publicExponent (DeepView Autofix) #62839
  • \[eeae754a87] - crypto: reject inherited key type names (Jonathan Lopes) #62875
  • \[9dd5540325] - crypto: add memory tracking for secureContext openssl objects (Mert Can Altin) #59051
  • \[b267f6bca3] - (SEMVER-MINOR) crypto: implement randomUUIDv7() (nabeel378) #62553
  • \[7597d204c1] - crypto: add support for Ed25519 context parameter (Filip Skokan) #62474
  • \[4bf85845da] - debugger: move ProbeInspectorSession and helpers to separate files (Joyee Cheung) #63013
  • \[ec2451b9cd] - (SEMVER-MINOR) debugger: add edit-free runtime expression probes to node inspect (Joyee Cheung) #62713
  • \[83e98f77b7] - deps: update corepack to 0.35.0 (Node.js GitHub Bot) #63375
  • \[ec8c6b939a] - deps: V8: cherry-pick 657d8de27427 (Guy Bedford) #62784
  • \[722c0c3274] - deps: update nghttp3 to 1.14.0 (Node.js GitHub Bot) #61187
  • \[5304db93d3] - deps: update nghttp3 to 1.13.1 (Node.js GitHub Bot) #60046
  • \[e073b3811d] - deps: update nghttp3 to 1.11.0 (James M Snell) #59249
  • \[1d00313fb2] - deps: update ngtcp2 to 1.14.0 (James M Snell) #59249
  • \[8b3a4fc18f] - deps: update amaro to 1.1.9 (Node.js GitHub Bot) #63090
  • \[62fe0cfcd1] - deps: update llhttp to 9.4.1 (Node.js GitHub Bot) #63045
  • \[137e09c8e9] - deps: update corepack to 0.34.7 (Node.js GitHub Bot) #62810
  • \[14a4cb8fbc] - deps: update timezone to 2026b (Node.js GitHub Bot) #62962
  • \[3e1036583a] - deps: upgrade npm to 11.13.0 (npm team) #62898
  • \[01dfe5961c] - deps: cherry-pick libuv/libuv\@439a54b (skooch) #62881
  • \[6cd368b10c] - deps: update sqlite to 3.53.0 (Node.js GitHub Bot) #62699
  • \[f218a4f553] - deps: update nbytes to 0.1.4 (Node.js GitHub Bot) #62698
  • \[b47688524a] - deps: update archs files for openssl-3.5.6 (Node.js GitHub Bot) #62629
  • \[d202e2d343] - deps: upgrade openssl sources to openssl-3.5.6 (Node.js GitHub Bot) #62629
  • \[2faba66341] - deps: update minimatch to 10.2.5 (Node.js GitHub Bot) #62594
  • \[fa46c90c5d] - deps: update googletest to d72f9c8aea6817cdf1ca0ac10887f328de7f3da2 (Node.js GitHub Bot) #62593
  • \[099ded5713] - deps: update simdjson to 4.6.1 (Node.js GitHub Bot) #62592
  • \[7ce95afe96] - deps: libuv: cherry-pick aabb7651de (Santiago Gimeno) #62561
  • \[57ef845623] - deps: update icu to 78.3 (Node.js GitHub Bot) #62324
  • \[493ac40e12] - deps: update libuv to 1.52.1 (Node.js GitHub Bot) #61829
  • \[b39508b368] - deps: update undici to 7.25.0 (Node.js GitHub Bot) #63011
  • \[cb67a925e9] - deps: use npm undici\@seven tag in update-undici.sh (Matteo Collina) #62739
  • \[aa1e0bc28b] - doc: fix typos and inconsistencies in crypto.md and webcrypto.md (Filip Skokan) #62828
  • \[f2a1735ed9] - doc: fix duplicate word "to to" in util.styleText (Daijiro Wachi) #62917
  • \[b6378e215c] - doc: fix node-config-schema (Сковорода Никита Андреевич) #61596
  • \[233894a9ce] - doc: fix the TypeScript Execute (tsx) project link (David Thornton) #63093
  • \[5d97919f8f] - doc: correct diagnostics\_channel built-in channel names (Bryan English) #62995
  • \[2a9ccc927e] - doc: use mjs/cjs blocks for callbackify null reason example (Daijiro Wachi) #62884
  • \[ef413b5358] - doc: fix typo in test.md (Rich Trott) #62960
  • \[76f21c5070] - doc: correct typo in PR contribution instructions (Mike McCready) #62738
  • \[ca02af1f7d] - doc: fix duplicate word "of of" in postMessageToThread (Daijiro Wachi) #62917
  • \[46c99ed526] - doc: fix duplicate word "for for" in compile cache (Daijiro Wachi) #62917
  • \[1a60851734] - doc: fix typo in dns.lookup options description (Daijiro Wachi) #62882
  • \[169b5ea2ed] - doc: fix Argon2 parameter bounds (Tobias Nießen) #62868
  • \[9a3a190f4e] - doc: clarify diffieHellman.generateKeys recomputes same key (Kit Dallege) #62205
  • \[0fba9e87d6] - doc: remove Ayase-252 and meixg from triagger team (Antoine du Hamel) #62841
  • \[9c700f3446] - doc: clarify dns.lookup() callback signature when all is true (eungi) #62800
  • \[6b7280bc17] - doc: add experimental modules lifetime policy (Paolo Insogna) #62753
  • \[ce47ea31c9] - doc: clarify process.\_debugProcess() in Permission Model (Fahad Khan) #62537
  • \[ba01633757] - doc: fix typo in devcontainer guide (Rohan Santhosh Kumar) #62687
  • \[70b4d5839b] - doc: clarify Backport-PR-URL metadata added automatically (Mike McCready) #62668
  • \[8126d1c3eb] - doc: update WPT test runner README.md (Filip Skokan) #62680
  • \[978afea4b5] - doc: fix spelling in release announcement guidance (Rohan Santhosh Kumar) #62663
  • \[1684ab8ff8] - doc: note non-monotonic clock in crypto.randomUUIDv7 (nabeel378) #62600
  • \[86d4f07930] - doc: update bug bounty program (Rafael Gonzaga) #62590
  • \[736ed8a08f] - doc: document TransformStream transformer.cancel option (Tom Pereira) #62566
  • \[938af9be01] - doc: mention test runner retry attemp is zero based (Moshe Atlow) #62504
  • \[94433e450f] - doc,src,test: fix dead inspector help URL (semimikoh) #62745
  • \[ddf1f01659] - esm: add ERR_REQUIRE_ESM_RACE_CONDITION (Antoine du Hamel) #62462
  • \[4a506acd16] - fs: add followSymlinks option to glob (Matteo Collina) #62695
  • \[f4ea495f9b] - fs: restore fs patchability in ESM loader (Joyee Cheung) #62835
  • \[63c111cd60] - fs: validate position argument before length === 0 early return (Edy Silva) #62674
  • \[9705f628d9] - (SEMVER-MINOR) fs: add signal option to fs.stat() (Mert Can Altin) #57775
  • \[40ccfdecf9] - (SEMVER-MINOR) fs: expose frsize field in statfs (Jinho Jang) #62277
  • \[717476a24e] - http: emit 'drain' on OutgoingMessage only after buffers drain (Robert Nagy) #62936
  • \[d7188af5c9] - (SEMVER-MINOR) http: harden ClientRequest options merge (Matteo Collina) #63082
  • \[64f15c274a] - http: fix leaked error listener on sync HTTP req create + destroy (Tim Perry) #62872
  • \[5c4798d799] - http: fix no\_proxy leading-dot suffix matching (Daijiro Wachi) #62333
  • \[9f3bc70ae5] - http: cleanup pipeline queue (Robert Nagy) #62534
  • \[aa1d8a9afc] - (SEMVER-MINOR) http: add req.signal to IncomingMessage (Akshat) #62541
  • \[900dc758ff] - http2: expose writable stream state on compat response (T) #63003
  • \[b3bfe35912] - inspector: coerce key and value to string in webstorage events (Ali Hassan) #62616
  • \[3dc3fb6ad8] - inspector: return errors when CDP protocol event emission fails (Ryuhei Shima) #62162
  • \[4f3f21bd7c] - inspector: auto collect webstorage data (Ryuhei Shima) #62145
  • \[36cc04189d] - inspector: initial support storage inspection (Ryuhei Shima) #61139
  • \[1718bc3b9b] - inspector: fix absolute URLs in network http (bugyaluwang) #62955
  • \[97e32c7a74] - lib: avoid quadratic shift() in startup snapshot callback (Daijiro Wachi) #62914
  • \[25d2e999de] - lib: harden kKeyOps lookup with null prototype (Filip Skokan) #62877
  • \[37d3913c8f] - lib: short-circuit WebIDL BufferSource SAB check (Filip Skokan) #62833
  • \[430c69d25f] - lib: use js-only implementation of isDataView() (René) #62780
  • \[3ba0add6a0] - lib: fix lint in internal/webstreams/util.js (Filip Skokan) #62806
  • \[9b95c41398] - lib: fix sequence argument handling in Blob constructor (Ms2ger) #62179
  • \[314dacdbee] - lib: improve Web Cryptography key validation ordering (Filip Skokan) #62749
  • \[3d18162430] - lib: reject SharedArrayBuffer in web APIs per spec (Ali Hassan) #62632
  • \[ada3ce879d] - lib: defer AbortSignal.any() following (sangwook) #62367
  • \[b2981ec7eb] - meta: bump actions/download-artifact from 8.0.0 to 8.0.1 (dependabot\[bot]) #62549
  • \[7cd20667b5] - meta: bump github/codeql-action from 4.35.1 to 4.35.3 (dependabot\[bot]) #63074
  • \[91a07cfe9f] - meta: bump Mozill

Claim your changelog — free