v5.1.0

Fixed

• Fixed Curl.perform() intermittently throwing CurlMultiError: Could not remove easy handle from multi handle.: API function called from within callback (CURLM_RECURSIVE_API_CALL) under concurrent load, particularly visible on Alpine. The regression came from v5.0.0 enabling libcurl 8.17's new CURLMOPT_NOTIFYFUNCTION API, which fires from inside curl_multi_socket_action. The notification resolved the perform-promise synchronously, and the resulting .then() microtask called curl_multi_remove_handle while libcurl was still on its own call stack. The removal is now deferred via setImmediate so libcurl can unwind first. (fixes #439)
• Fixed macOS x64 prebuilt binary tarballs containing an arm64 binary instead of x86_64. The universal build packaging in scripts/ci/build.sh was extracting both architectures to the same output file before either was packaged, so the second lipo extraction overwrote the first. This affected all macOS releases since v5.0.0. (#446, fixes #445)
• Fixed CurlMimePart#setDataStream hanging on Linux when libcurl needed a second read callback after the stream emitted its initial data. The mime read callback wasn't tracking CURLPAUSE_SEND state after returning CURL_READFUNC_PAUSE, so isPausedSend stayed false and the test/example unpause callbacks were silent no-ops. The unpause is now also deferred via setImmediate to avoid re-entering libcurl while it's still processing the pause. (#448)
• Fixed vcpkg build failures when the exact OpenSSL version bundled with Node.js isn't present in the vcpkg registry. The build now resolves to the closest compatible version (preferring a newer patch on the same minor line, falling back to the closest lower patch, then the next minor) with a clear warning about the substitution. (#447)
• Fixed Alpine CI builds failing with fatal error: ngtcp2/ngtcp2_crypto_quictls.h: No such file or directory after the ngtcp2 1.17.0 + OpenSSL 3.5+ combination switched to the new libngtcp2_crypto_ossl backend. Added the statically-built OpenSSL's pkgconfig dir to PKG_CONFIG_PATH so libcurl's probe for libngtcp2_crypto_ossl can resolve its Requires: libcrypto on systems without system OpenSSL.
• Fixed Windows CI builds failing with Could not find any Visual Studio installation to use after GitHub started serving Visual Studio 2026 (v145) on the windows-2025 runner ahead of the official 2026-06-15 migration. The build script no longer pins msvs_version=2022, letting node-gyp 12.1.0+ auto-detect whichever supported MSVC toolset is installed.

Added

• Node.js 26 to the CI matrix. Prebuilt binaries are now published for Node 26 alongside the existing 22, 24, and 25 versions.

Changed

• Bumped node-gyp from 11.4.2 to 12.3.0 and @mapbox/node-pre-gyp from 2.0.0 to 2.0.3. node-gyp v12.1.0+ adds Visual Studio 2026 detection support. The only node-gyp v12 breaking change (engine range bumped to ^20.17.0 || >=22.9.0) does not affect this project, which already requires Node.js ≥ 22.20.0.
• Bumped Alpine container image from alpine3.21 to alpine3.22 so the Node.js 26 image variant is available (node:26-alpine3.21 is not published). Musl is 1.2.5 across Alpine 3.20–3.23, so the prebuilt binary remains runtime-compatible on Alpine 3.21.
• The unpause callback documentation and examples for CurlMimePart#setDataStream and Easy#setMimePost now correctly reference CurlPause.Send instead of CurlPause.Recv. Mime upload data is supplied via the read callback, so pausing affects CURLPAUSE_SEND. (#448)