2026-08-05, Version 26.7.0 (Current), @aduh95

Notable Changes

• [58717685a1] - (SEMVER-MINOR) crypto: support loading private keys through STORE loaders (Filip Skokan) #63949
• [44b940ee8c] - crypto: update root certificates to NSS 3.125 (Node.js GitHub Bot) #64746
• [c1e4f7365e] - (SEMVER-MINOR) lib: add perfetto support (Chengzhong Wu) #64565
• [11c2f9c642] - (SEMVER-MINOR) module: implement Symbol.dispose in ModuleHooks (Remco Haszing) #63928
• [a646319f61] - (SEMVER-MINOR) test_runner: add support for --test-coverage-include-all (avivkeller) #64830

Commits

• [a2d3f891d3] - async_hooks: use validateBoolean for trackPromises (Soul Lee) #64731
• [d7266cdd99] - benchmark: fix calibrate-n option handling (Luan Muniz) #64146
• [2e64293e3f] - buffer: use Clamp conversion in Blob slice (Donghoon Kang) #64739
• [5fda0958bd] - buffer: validate copyArrayBuffer offsets against buffer length (Ilia Alshanetsky) #63904
• [5298db40f9] - build: run perfetto build and test on GHA (Chengzhong Wu) #64721
• [e3eac7cef9] - build: fix v8_use_perfetto source scraping (Chengzhong Wu) #64721
• [ab5f076d7f] - build: bump rustc requirement to >=1.86 (Renegade334) #64543
• [df608e061f] - (SEMVER-MINOR) build: perfetto-sdk (Chengzhong Wu) #64565
• [74928adc46] - build,tools: fix shared library cross-compile (Kirill Saied) #63963
• [58717685a1] - (SEMVER-MINOR) crypto: support loading private keys through STORE loaders (Filip Skokan) #63949
• [58d13b6f3d] - crypto: preserve OpenSSL errors from KDF failures (Filip Skokan) #64776
• [478a719cb5] - crypto: fix Argon2 bypassing FIPS mode (Filip Skokan) #64776
• [44b940ee8c] - crypto: update root certificates to NSS 3.125 (Node.js GitHub Bot) #64746
• [fde85237c7] - crypto: clarify missing cipher error (Filip Skokan) #64852
• [c604d8846d] - crypto: reuse X509 issuer result (Filip Skokan) #64852
• [c68c7d0112] - crypto: validate key generation options (Filip Skokan) #64852
• [c36bb1d017] - crypto: fix Argon2 validation errors (Filip Skokan) #64852
• [f61408bb27] - crypto: handle XOF output allocation failure (Filip Skokan) #64851
• [2b4053d046] - crypto: initialize KeyObjectData mutex eagerly (Filip Skokan) #64851
• [4b7b2adf44] - crypto: handle DH operation failures (Filip Skokan) #64851
• [12170c3753] - crypto: use user-facing error for output encoding changes (Archkon) #64692
• [474f06d550] - debugger: preserve overlapping CDP request state (Trivikram Kamat) #64467
• [718cbe9497] - deps: upgrade npm to 11.19.0 (npm team) #64883
• [657c6154b3] - deps: update ngtcp2 to 1.25.0 (Node.js GitHub Bot) #64944
• [75a1fbeff9] - deps: update nghttp3 to 1.18.0 (Node.js GitHub Bot) #64943
• [07d7cb7cd8] - deps: update minimatch to 10.2.6 (Node.js GitHub Bot) #64945
• [f7d56359f1] - deps: update simdjson to 4.6.6 (Node.js GitHub Bot) #64942
• [8b06457cfb] - deps: update acorn to 8.18.0 (Node.js GitHub Bot) #64941
• [5919d01525] - deps: update googletest to 1b6f64d659944658a4c685b7bd9f04c1c3b8a39b (Node.js GitHub Bot) #64940
• [4a87ad6cff] - deps: update nghttp2 to 1.70.0 (Node.js GitHub Bot) #64939
• [c96d76a7c8] - deps: update zlib to 1.3.2.1-motley-42c2f19 (Node.js GitHub Bot) #64744
• [2b59984c0f] - deps: V8: backport 5177b10891e6 (avivkeller) #64631
• [b839af91da] - deps: update ada to 4.0.0 (Node.js GitHub Bot) #64790
• [70dedef942] - deps: update sqlite to 3.53.4 (Node.js GitHub Bot) #64745
• [7bc4c171f5] - deps: update Rust crates for V8 14.6.202.34-node.26 (Renegade334) #64543
• [308c6b2ac3] - deps: V8: backport 7d9b7e03141d (Manish Goregaokar) #64543
• [8eeae28e88] - deps: V8: backport c4d06ba586f3 (liujiahui) #63731
• [bbd6fc58c4] - diagnostics_channel: grow native channel storage (Stephen Belanger) #64497
• [ce8b292955] - doc: fix grammar and punctuation in dgram documentation (Kamal Rawal) #64957
• [1a413a60cf] - doc: fix grammar and editorial issues in addons documentation (Kamal Rawal) #64952
• [63fbd59e64] - doc: formalize fn/name as part of TestOptions API (Christopher Hiller) #64946
• [b263b0bca1] - doc: remove references to ca/crl as per-context QuicSession options (René) #64769
• [f37de14b27] - doc: fix typo in maintaining-dependencies.md (greenhead) #64896
• [16cb77cdc8] - doc: add RafaelGSS as last security release stewards (Rafael Gonzaga) #64843
• [335c28cd17] - doc: fix typos in documentation (greenhead) #64900
• [d4bed8ca39] - doc: fix missing references in doc type map (Tim Perry) #64872
• [e71d09d5f1] - doc: improve TestContext hook descriptions (Kamal Rawal) #64899
• [7089bd9ae4] - doc: add missing float32/float64 FFI type names (Soul Lee) #64874
• [8d3ae0830e] - doc: document stream.isDestroyed() (YspritanHyzygy) #64789
• [a757e62af7] - doc: add contributing detail for git Signed-off-by trailer (Mike McCready) #64862
• [3e840f43ed] - doc: mark config-file as release candidate (Marco Ippolito) #64516
• [70cd5df810] - doc: fix duplicated word in test snapshot docs (Kamal Rawal) #64837
• [d5f36c7adc] - doc: remove obsolete cctest node.gyp instructions (Soul Lee) #64814
• [a0bf29ea09] - doc: report proper return type on url.format (Brian Muenzenmeyer) #64806
• [e655e42085] - doc: use ffi.suffix for library paths in examples (Junsoo Ha) #64805
• [e0f0830dbc] - doc: document --permission-audit audit mode behavior (Adrián Estrada) #64791
• [efbede6de0] - doc: clarify tlsSocket.authorized on resumption (soreavis) #64584
• [db95655c4a] - doc: stabilize --disable-warning (Jean Michelet) #64742
• [a8367200be] - doc: add MDN links for explicit resource management in fs (lluisemper) #59557
• [1c09165c2e] - doc: mention constructor check in deepStrictEqual (Sumit Kumar Das) #62010
• [29709324e0] - doc: update technical priorities (Jacob Smith) #64505
• [522a28e648] - doc: deprecation add more codemod (Augustin Mauroy) #63175
• [c40aaa6539] - doc: run license-builder (Node.js GitHub Bot) #63918
• [428e9bc50f] - ffi: fix crash in refCallback and unrefCallback (Trivikram Kamat) #64881
• [33912103e7] - ffi: reject fast calls after library close (Trivikram Kamat) #64860
• [b348ed7f92] - ffi: validate fast 32-bit integer argument ranges (Trivikram Kamat) #64691
• [48f4cfb480] - ffi: fix optimized buffer conversions (Trivikram Kamat) #64639
• [109ffcd4f3] - ffi: preserve link register in ppc64 trampoline (Trivikram Kamat) #64792
• [aa3f168b31] - ffi: preserve strings during reentrant calls (Trivikram Kamat) #64551
• [ca60942f38] - ffi: preserve uint8 semantics for bool fast calls (Trivikram Kamat) #64527
• [0fb1d2bd65] - ffi: validate fast integer argument ranges (Trivikram Kamat) #64614
• [b250b40b30] - fs: key glob matcher cache by platform (Archkon) #64571
• [e26891ec6a] - http: fix writableFinished and 'finish' after write errors (Tim Perry) #64847
• [dfc192fdfb] - http: avoid aborting IncomingMessage signal on normal close (Archkon) #64392
• [6794441c85] - http: guard invalid timeout values in checkConnections (Efe Karasakal) #64506
• [6879aa4aa8] - http: propagate highWaterMark to ClientRequest OutgoingMessage (trivenay) #64653
• [72448a82f4] - http2: avoid copying the options in respond() (Matteo Collina) #64265
• [f6692da576] - http2: avoid per-write closures in kWriteGeneric (Matteo Collina) #64265
• [3ed37153f8] - http2: reduce per-request allocations (Matteo Collina) #64265
• [bce92debba] - Revert "http2: avoid per-write closures in kWriteGeneric" (Antoine du Hamel) #64663
• [b5d5dd74a1] - Revert "http2: avoid copying the options in respond()" (Antoine du Hamel) #64663
• [19b9c14d60] - lib: fix AbortSignal.any() observed-composite leak (Paul Bouchon) #64481
• [d3cada57c2] - lib: fix typo in comment in _http_client.js (agape1225) #64729
• [c1e4f7365e] - (SEMVER-MINOR) lib: add perfetto support (Chengzhong Wu) #64565
• [6c2157522d] - loader: enforce path normalization before lookup (Maël Nison) #63917
• [31522c41a7] - meta: bump actions/stale from 10.3.0 to 11.0.0 (dependabot[bot]) #64935
• [88c8b8ef54] - meta: bump github/codeql-action/analyze from 4.36.2 to 4.37.3 (dependabot[bot]) #64934
• [9dcd759a84] - meta: bump github/codeql-action/autobuild from 4.36.2 to 4.37.3 (dependabot[bot]) #64933
• [82ca02db3c] - meta: bump actions/setup-python from 6.3.0 to 7.0.0 (dependabot[bot]) #64932
• [848e2287f2] - meta: bump github/codeql-action/init from 4.36.2 to 4.37.3 (dependabot[bot]) #64931
• [ae8ad3b17b] - meta: bump Mozilla-Actions/sccache-action from 0.0.10 to 0.0.11 (dependabot[bot]) #64930
• [0b359cfa4c] - meta: bump cachix/install-nix-action from 31.10.6 to 31.11.0 (dependabot[bot]) #64929
• [3b4f980f4c] - meta: bump github/codeql-action/upload-sarif from 4.36.2 to 4.37.3 (dependabot[bot]) #64927
• [d7ee9e9ea7] - meta: bump step-security/harden-runner from 2.19.4 to 2.20.0 (dependabot[bot]) #64926
• [7e80bbaaa9] - meta: bump ossf/scorecard-action from 2.4.3 to 2.4.4 (dependabot[bot]) #64925
• [915cabbfcf] - meta: remove node_crates .gitignore (René) #64779
• [8e03c54347] - meta: add @nodejs/url as codeowner for node_url_pattern.* (Efe Karasakal) #64737
• [11c2f9c642] - (SEMVER-MINOR) module: implement Symbol.dispose in ModuleHooks (Remco Haszing) #63928
• [fffd8a76d0] - net: support TCP handle transfer on Windows (Matteo Collina) #64460
• [fe9e0dbdc2] - net: support AF_UNIX paths in net.BoundSocket (Guy Bedford) #64399
• [eb61b7ee1e] - permission: add unique warning codes (David Evans) #64414
• [999a928822] - permission: support v8.setHeapSnapshotNearHeapLimit (Ilyas Shabi) #64808
• [7de3d095b6] - quic: fix stop sending behaviour & callback (Tim Perry) #64710
• [6289398bb2] - quic: fix coverage comment typo (Jungwon Sohn) #64486
• [01510dc759] - quic: fix segfault after fragmented client hello (Tim Perry) #64720
• [dcc348af97] - quic: serialize stream reset code as string (한만욱) #64577
• [c25b8e3331] - readline: reduce createInterface overhead (Matteo Collina) #64585
• [14e802d1cd] - sqlite: invalidate sessions when closing database (Trivikram Kamat) #64783
• [279547b7da] - sqlite: check database state before calling SQLite (Trivikram Kamat) #64812
• [bb86521a42] - sqlite: fix crash when a session outlives its database (Mohamed Sayed) #63797
• [870f4997e7] - sqlite: fix use-after-free in Exec() and ApplyChangeset() (Matteo Collina) #64535
• [a8ec5a9df7] - src: fix perfetto build on GetTraceFilePath (Chengzhong Wu) #64721
• [6cd643acaa] - src: implement MemoryRetainer protocol for ByteSource (Filip Skokan) #64660
• [8725e56928] - src: fix crash when writing odd-length hex string via Writev (RajeshKumar11) #63658
• [e018f9a4a1] - (SEMVER-MINOR) src: add perfetto trace agent (Chengzhong Wu) #64565
• [0611d443ab] - (SEMVER-MINOR) src: rename legacy trace event headers (Chengzhong Wu) #64565
• [2897cc1d93] - (SEMVER-MINOR) src: fix trace macro compatibility (Chengzhong Wu) #64565
• [d4d7172e10] - src: avoid using ToLocalChecked in crypto_hash (James M Snell) #64668
• [53b7d48b47] - src: fix libuv assertion on windows (liuxingbaoyu) #61999
• [69d10ed021] - src,test: disable trace events tests when perfetto is enabled (Chengzhong Wu) #64721
• [1b0597b4ef] - stream: cut per-chunk allocations in pipeTo (Matteo Collina) #64890
• [2632d606bb] - stream: preserve push signal abort reason (Trivikram Kamat) #64798
• [d5358a75bc] - stream: skip zero-byte broadcast writes (Trivikram Kamat) #64772
• [796c896fb4] - stream: honor AbortSignal in Writer.end() (Trivikram Kamat) #64727
• [ff12b8e22e] - stream: use validateString for consumer encoding (Jungwon Sohn) #64754
• [cfad2efb06] - stream: use the ring buffer for pending BYOB pull-into descriptors (Matteo Collina) #64818
• [fe06bf56dc] - stream: fix uncatchable error closing half-open Duplex.toWeb() writable (Mohamed Sayed) #64161
• [f2919dbb83] - test: unflake debugger and REPL tests (Matteo Collina) #64718
• [a1c29174e8] - test: ensure assertions are reached on all tests (Antoine du Hamel) #64716
• [b9e596f8e5] - test: reuse ffi.suffix instead of reimplementing it (Seongeun Lee) #64840
• [c816918e14] - test: remove test-repl-user-error-handler from flaky (avivkeller) #64631
• [9d2f10ec54] - test: update WPT for url to 4832db4761 (Node.js GitHub Bot) #64829
• [75b80d0b7b] - test: update WPT for url to b63305b743 (Node.js GitHub Bot) #64790
• [9a139b3c86] - test: cover worker throwing primitive values (varshitha) #64365
• [796acc8920] - test: mark test-repl-user-error-handler as flaky (Aviv Keller) #64612
• [a646319f61] - (SEMVER-MINOR) test_runner: add support for --test-coverage-include-all (avivkeller) #64830
• [4368303e01] - test_runner: wait for filtered suite build (semimikoh) #64208
• [70d11241a3] - test_runner: convert to uint during deserialization (Aviv Keller) #64706
• [cafe7bffcc] - tls: fix SNICallback certificate selection (Matteo Collina) #64700
• [9ee05ec40f] - tools: bump the eslint group in /tools/eslint with 4 updates (dependabot[bot]) #64928
• [5f4b859932] - tools: bump brace-expansion from 5.0.7 to 5.0.9 in /tools/eslint (dependabot[bot]) #64904
• [b5ced907b3] - tools: use 'readonly' for EventSource global (Honey Tyagi) #64787
• [fd4460e34e] - typings: add heap_utils internalBinding types (Donghoon Kang) #64816
• [3bc0ee0492] - typings: remove isDataView from types binding (Archkon) #64738
• [236d7ca965] - url: create URLPattern result properties in WebIDL order (Archkon) #64733
• [3def577ab4] - v8: report minor mark-sweep in GCProfiler (Archkon) #64688
• [5293abff73] - vfs: speed up recursive readdir test setup (Trivikram Kamat) #64813
• [4345185496] - vfs: make lchown update symlink metadata (Trivikram Kamat) #64573
• [b6ab546de5] - wasm: register missing SetURL function (Archkon) #64679
• [f322870bd1] - zlib: validate pledgedSrcSize as a safe integer (Archkon) #64604
• [44042c20d4] - zlib: accept ArrayBuffer dictionary in Zstd (Ryuhei Shima) #64599