2026-08-05, Version 26.7.0 (Current), @aduh95 — Node.js - Product release notes & changelog tool

Notable Changes

[58717685a1] - (SEMVER-MINOR) crypto: support loading private keys through STORE loaders (Filip Skokan) #63949
[44b940ee8c] - crypto: update root certificates to NSS 3.125 (Node.js GitHub Bot) #64746
[c1e4f7365e] - (SEMVER-MINOR) lib: add perfetto support (Chengzhong Wu) #64565
[11c2f9c642] - (SEMVER-MINOR) module: implement Symbol.dispose in ModuleHooks (Remco Haszing) #63928
[a646319f61] - (SEMVER-MINOR) test_runner: add support for --test-coverage-include-all (avivkeller) #64830

Commits

[a2d3f891d3] - async_hooks: use validateBoolean for trackPromises (Soul Lee) #64731
[d7266cdd99] - benchmark: fix calibrate-n option handling (Luan Muniz) #64146
[2e64293e3f] - buffer: use Clamp conversion in Blob slice (Donghoon Kang) #64739
[5fda0958bd] - buffer: validate copyArrayBuffer offsets against buffer length (Ilia Alshanetsky) #63904
[5298db40f9] - build: run perfetto build and test on GHA (Chengzhong Wu) #64721
[e3eac7cef9] - build: fix v8_use_perfetto source scraping (Chengzhong Wu) #64721
[ab5f076d7f] - build: bump rustc requirement to >=1.86 (Renegade334) #64543
[df608e061f] - (SEMVER-MINOR) build: perfetto-sdk (Chengzhong Wu) #64565
[74928adc46] - build,tools: fix shared library cross-compile (Kirill Saied) #63963
[58717685a1] - (SEMVER-MINOR) crypto: support loading private keys through STORE loaders (Filip Skokan) #63949
[58d13b6f3d] - crypto: preserve OpenSSL errors from KDF failures (Filip Skokan) #64776
[478a719cb5] - crypto: fix Argon2 bypassing FIPS mode (Filip Skokan) #64776
[44b940ee8c] - crypto: update root certificates to NSS 3.125 (Node.js GitHub Bot) #64746
[fde85237c7] - crypto: clarify missing cipher error (Filip Skokan) #64852
[c604d8846d] - crypto: reuse X509 issuer result (Filip Skokan) #64852
[c68c7d0112] - crypto: validate key generation options (Filip Skokan) #64852
[c36bb1d017] - crypto: fix Argon2 validation errors (Filip Skokan) #64852
[f61408bb27] - crypto: handle XOF output allocation failure (Filip Skokan) #64851
[2b4053d046] - crypto: initialize KeyObjectData mutex eagerly (Filip Skokan) #64851
[4b7b2adf44] - crypto: handle DH operation failures (Filip Skokan) #64851
[12170c3753] - crypto: use user-facing error for output encoding changes (Archkon) #64692
[474f06d550] - debugger: preserve overlapping CDP request state (Trivikram Kamat) #64467
[718cbe9497] - deps: upgrade npm to 11.19.0 (npm team) #64883
[657c6154b3] - deps: update ngtcp2 to 1.25.0 (Node.js GitHub Bot) #64944
[75a1fbeff9] - deps: update nghttp3 to 1.18.0 (Node.js GitHub Bot) #64943
[07d7cb7cd8] - deps: update minimatch to 10.2.6 (Node.js GitHub Bot) #64945
[f7d56359f1] - deps: update simdjson to 4.6.6 (Node.js GitHub Bot) #64942
[8b06457cfb] - deps: update acorn to 8.18.0 (Node.js GitHub Bot) #64941
[5919d01525] - deps: update googletest to 1b6f64d659944658a4c685b7bd9f04c1c3b8a39b (Node.js GitHub Bot) #64940
[4a87ad6cff] - deps: update nghttp2 to 1.70.0 (Node.js GitHub Bot) #64939
[c96d76a7c8] - deps: update zlib to 1.3.2.1-motley-42c2f19 (Node.js GitHub Bot) #64744
[2b59984c0f] - deps: V8: backport 5177b10891e6 (avivkeller) #64631
[b839af91da] - deps: update ada to 4.0.0 (Node.js GitHub Bot) #64790
[70dedef942] - deps: update sqlite to 3.53.4 (Node.js GitHub Bot) #64745
[7bc4c171f5] - deps: update Rust crates for V8 14.6.202.34-node.26 (Renegade334) #64543
[308c6b2ac3] - deps: V8: backport 7d9b7e03141d (Manish Goregaokar) #64543
[8eeae28e88] - deps: V8: backport c4d06ba586f3 (liujiahui) #63731
[bbd6fc58c4] - diagnostics_channel: grow native channel storage (Stephen Belanger) #64497
[ce8b292955] - doc: fix grammar and punctuation in dgram documentation (Kamal Rawal) #64957
[1a413a60cf] - doc: fix grammar and editorial issues in addons documentation (Kamal Rawal) #64952
[63fbd59e64] - doc: formalize fn/name as part of TestOptions API (Christopher Hiller) #64946
[b263b0bca1] - doc: remove references to ca/crl as per-context QuicSession options (René) #64769
[f37de14b27] - doc: fix typo in maintaining-dependencies.md (greenhead) #64896
[16cb77cdc8] - doc: add RafaelGSS as last security release stewards (Rafael Gonzaga) #64843
[335c28cd17] - doc: fix typos in documentation (greenhead) #64900
[d4bed8ca39] - doc: fix missing references in doc type map (Tim Perry) #64872
[e71d09d5f1] - doc: improve TestContext hook descriptions (Kamal Rawal) #64899
[7089bd9ae4] - doc: add missing float32/float64 FFI type names (Soul Lee) #64874
[8d3ae0830e] - doc: document stream.isDestroyed() (YspritanHyzygy) #64789
[a757e62af7] - doc: add contributing detail for git Signed-off-by trailer (Mike McCready) #64862
[3e840f43ed] - doc: mark config-file as release candidate (Marco Ippolito) #64516
[70cd5df810] - doc: fix duplicated word in test snapshot docs (Kamal Rawal) #64837
[d5f36c7adc] - doc: remove obsolete cctest node.gyp instructions (Soul Lee) #64814
[a0bf29ea09] - doc: report proper return type on url.format (Brian Muenzenmeyer) #64806
[e655e42085] - doc: use ffi.suffix for library paths in examples (Junsoo Ha) #64805
[e0f0830dbc] - doc: document –permission-audit audit mode behavior (Adrián Estrada) #64791
[efbede6de0] - doc: clarify tlsSocket.authorized on resumption (soreavis) #64584
[db95655c4a] - doc: stabilize –disable-warning (Jean Michelet) #64742
[a8367200be] - doc: add MDN links for explicit resource management in fs (lluisemper) #59557
[1c09165c2e] - doc: mention constructor check in deepStrictEqual (Sumit Kumar Das) #62010
[29709324e0] - doc: update technical priorities (Jacob Smith) #64505
[522a28e648] - doc: deprecation add more codemod (Augustin Mauroy) #63175
[c40aaa6539] - doc: run license-builder (Node.js GitHub Bot) #63918
[428e9bc50f] - ffi: fix crash in refCallback and unrefCallback (Trivikram Kamat) #64881
[33912103e7] - ffi: reject fast calls after library close (Trivikram Kamat) #64860
[b348ed7f92] - ffi: validate fast 32-bit integer argument ranges (Trivikram Kamat) #64691
[48f4cfb480] - ffi: fix optimized buffer conversions (Trivikram Kamat) #64639
[109ffcd4f3] - ffi: preserve link register in ppc64 trampoline (Trivikram Kamat) #64792
[aa3f168b31] - ffi: preserve strings during reentrant calls (Trivikram Kamat) #64551
[ca60942f38] - ffi: preserve uint8 semantics for bool fast calls (Trivikram Kamat) #64527
[0fb1d2bd65] - ffi: validate fast integer argument ranges (Trivikram Kamat) #64614
[b250b40b30] - fs: key glob matcher cache by platform (Archkon) #64571
[e26891ec6a] - http: fix writableFinished and ‘finish’ after write errors (Tim Perry) #64847
[dfc192fdfb] - http: avoid aborting IncomingMessage signal on normal close (Archkon) #64392
[6794441c85] - http: guard invalid timeout values in checkConnections (Efe Karasakal) #64506
[6879aa4aa8] - http: propagate highWaterMark to ClientRequest OutgoingMessage (trivenay) #64653
[72448a82f4] - http2: avoid copying the options in respond() (Matteo Collina) #64265
[f6692da576] - http2: avoid per-write closures in kWriteGeneric (Matteo Collina) #64265
[3ed37153f8] - http2: reduce per-request allocations (Matteo Collina) #64265
[bce92debba] - Revert “http2: avoid per-write closures in kWriteGeneric” (Antoine du Hamel) #64663
[b5d5dd74a1] - Revert “http2: avoid copying the options in respond()” (Antoine du Hamel) #64663
[19b9c14d60] - lib: fix AbortSignal.any() observed-composite leak (Paul Bouchon) #64481
[d3cada57c2] - lib: fix typo in comment in _http_client.js (agape1225) #64729
[c1e4f7365e] - (SEMVER-MINOR) lib: add perfetto support (Chengzhong Wu) #64565
[6c2157522d] - loader: enforce path normalization before lookup (Maël Nison) #63917
[31522c41a7] - meta: bump actions/stale from 10.3.0 to 11.0.0 (dependabot[bot]) #64935
[88c8b8ef54] - meta: bump github/codeql-action/analyze from 4.36.2 to 4.37.3 (dependabot[bot]) #64934
[9dcd759a84] - meta: bump github/codeql-action/autobuild from 4.36.2 to 4.37.3 (dependabot[bot]) #64933
[82ca02db3c] - meta: bump actions/setup-python from 6.3.0 to 7.0.0 (dependabot[bot]) #64932
[848e2287f2] - meta: bump github/codeql-action/init from 4.36.2 to 4.37.3 (dependabot[bot]) #64931
[ae8ad3b17b] - meta: bump Mozilla-Actions/sccache-action from 0.0.10 to 0.0.11 (dependabot[bot]) #64930
[0b359cfa4c] - meta: bump cachix/install-nix-action from 31.10.6 to 31.11.0 (dependabot[bot]) #64929
[3b4f980f4c] - meta: bump github/codeql-action/upload-sarif from 4.36.2 to 4.37.3 (dependabot[bot]) #64927
[d7ee9e9ea7] - meta: bump step-security/harden-runner from 2.19.4 to 2.20.0 (dependabot[bot]) #64926
[7e80bbaaa9] - meta: bump ossf/scorecard-action from 2.4.3 to 2.4.4 (dependabot[bot]) #64925
[915cabbfcf] - meta: remove node_crates .gitignore (René) #64779
[8e03c54347] - meta: add @nodejs/url as codeowner for node_url_pattern.* (Efe Karasakal) #64737
[11c2f9c642] - (SEMVER-MINOR) module: implement Symbol.dispose in ModuleHooks (Remco Haszing) #63928
[fffd8a76d0] - net: support TCP handle transfer on Windows (Matteo Collina) #64460
[fe9e0dbdc2] - net: support AF_UNIX paths in net.BoundSocket (Guy Bedford) #64399
[eb61b7ee1e] - permission: add unique warning codes (David Evans) #64414
[999a928822] - permission: support v8.setHeapSnapshotNearHeapLimit (Ilyas Shabi) #64808
[7de3d095b6] - quic: fix stop sending behaviour & callback (Tim Perry) #64710
[6289398bb2] - quic: fix coverage comment typo (Jungwon Sohn) #64486
[01510dc759] - quic: fix segfault after fragmented client hello (Tim Perry) #64720
[dcc348af97] - quic: serialize stream reset code as string (한만욱) #64577
[c25b8e3331] - readline: reduce createInterface overhead (Matteo Collina) #64585
[14e802d1cd] - sqlite: invalidate sessions when closing database (Trivikram Kamat) #64783
[279547b7da] - sqlite: check database state before calling SQLite (Trivikram Kamat) #64812
[bb86521a42] - sqlite: fix crash when a session outlives its database (Mohamed Sayed) #63797
[870f4997e7] - sqlite: fix use-after-free in Exec() and ApplyChangeset() (Matteo Collina) #64535
[a8ec5a9df7] - src: fix perfetto build on GetTraceFilePath (Chengzhong Wu) #64721
[6cd643acaa] - src: implement MemoryRetainer protocol for ByteSource (Filip Skokan) #64660
[8725e56928] - src: fix crash when writing odd-length hex string via Writev (RajeshKumar11) #63658
[e018f9a4a1] - (SEMVER-MINOR) src: add perfetto trace agent (Chengzhong Wu) #64565
[0611d443ab] - (SEMVER-MINOR) src: rename legacy trace event headers (Chengzhong Wu) #64565
[2897cc1d93] - (SEMVER-MINOR) src: fix trace macro compatibility (Chengzhong Wu) #64565
[d4d7172e10] - src: avoid using ToLocalChecked in crypto_hash (James M Snell) #64668
[53b7d48b47] - src: fix libuv assertion on windows (liuxingbaoyu) #61999
[69d10ed021] - src,test: disable trace events tests when perfetto is enabled (Chengzhong Wu) #64721
[1b0597b4ef] - stream: cut per-chunk allocations in pipeTo (Matteo Collina) #64890
[2632d606bb] - stream: preserve push signal abort reason (Trivikram Kamat) #64798
[d5358a75bc] - stream: skip zero-byte broadcast writes (Trivikram Kamat) #64772
[796c896fb4] - stream: honor AbortSignal in Writer.end() (Trivikram Kamat) #64727
[ff12b8e22e] - stream: use validateString for consumer encoding (Jungwon Sohn) #64754
[cfad2efb06] - stream: use the ring buffer for pending BYOB pull-into descriptors (Matteo Collina) #64818
[fe06bf56dc] - stream: fix uncatchable error closing half-open Duplex.toWeb() writable (Mohamed Sayed) #64161
[f2919dbb83] - test: unflake debugger and REPL tests (Matteo Collina) #64718
[a1c29174e8] - test: ensure assertions are reached on all tests (Antoine du Hamel) #64716
[b9e596f8e5] - test: reuse ffi.suffix instead of reimplementing it (Seongeun Lee) #64840
[c816918e14] - test: remove test-repl-user-error-handler from flaky (avivkeller) #64631
[9d2f10ec54] - test: update WPT for url to 4832db4761 (Node.js GitHub Bot) #64829
[75b80d0b7b] - test: update WPT for url to b63305b743 (Node.js GitHub Bot) #64790
[9a139b3c86] - test: cover worker throwing primitive values (varshitha) #64365
[796acc8920] - test: mark test-repl-user-error-handler as flaky (Aviv Keller) #64612
[a646319f61] - (SEMVER-MINOR) test_runner: add support for –test-coverage-include-all (avivkeller) #64830
[4368303e01] - test_runner: wait for filtered suite build (semimikoh) #64208
[70d11241a3] - test_runner: convert to uint during deserialization (Aviv Keller) #64706
[cafe7bffcc] - tls: fix SNICallback certificate selection (Matteo Collina) #64700
[9ee05ec40f] - tools: bump the eslint group in /tools/eslint with 4 updates (dependabot[bot]) #64928
[5f4b859932] - tools: bump brace-expansion from 5.0.7 to 5.0.9 in /tools/eslint (dependabot[bot]) #64904
[b5ced907b3] - tools: use ‘readonly’ for EventSource global (Honey Tyagi) #64787
[fd4460e34e] - typings: add heap_utils internalBinding types (Donghoon Kang) #64816
[3bc0ee0492] - typings: remove isDataView from types binding (Archkon) #64738
[236d7ca965] - url: create URLPattern result properties in WebIDL order (Archkon) #64733
[3def577ab4] - v8: report minor mark-sweep in GCProfiler (Archkon) #64688
[5293abff73] - vfs: speed up recursive readdir test setup (Trivikram Kamat) #64813
[4345185496] - vfs: make lchown update symlink metadata (Trivikram Kamat) #64573
[b6ab546de5] - wasm: register missing SetURL function (Archkon) #64679
[f322870bd1] - zlib: validate pledgedSrcSize as a safe integer (Archkon) #64604
[44042c20d4] - zlib: accept ArrayBuffer dictionary in Zstd (Ryuhei Shima) #64599