nodejs/node v26.10.0 on GitHub

Notable Changes

[c0a42d23e5] - (SEMVER-MINOR) crypto: add crypto.parsePKCS12() (Brian Muenzenmeyer) #65627
[eb4fabe81e] - doc: add araujogui to collaborators (Guilherme Araújo) #66090
[64fb33d791] - (SEMVER-MINOR) ffi: load libraries from a mounted VFS (Matteo Collina) #65909
[2b1701f810] - (SEMVER-MINOR) fs: add openAsBlobSync (greenhead) #65644
[080e76b3d7] - (SEMVER-MINOR) net: support sending net.BoundSocket to threads and child processes (Guy Bedford) #64725
[13e61f6ae6] - (SEMVER-MINOR) perf_hooks: implement SlidingWindowHistogram (James M Snell) #65825
[a326546094] - (SEMVER-MINOR) perf_hooks: implement qrde analysis support in Histogram (James M Snell) #65806
[0306b0a71e] - (SEMVER-MINOR) sqlite: bind undefined to NULL (Trevor Burnham) #65709
[3c999edef7] - (SEMVER-MINOR) src,lib: add util.markPromiseAsHandled (James M Snell) #65805
[f7d18ec360] - (SEMVER-MINOR) test: expand histogram test coverage (James M Snell) #65825
[3ce4d23bbb] - (SEMVER-MINOR) util: implement util.throttle (James M Snell) #65899
[336f33ccc1] - (SEMVER-MINOR) util: implement debounce (James M Snell) #65899

Commits

[2bf082453b] - assert: fix TypeError on deepStrictEqual with null Map key or Set member (Sergey Sannikov) #64449
[c518831d00] - benchmark: add --csv option to compare.js with --analyze (James M Snell) #65922
[89bae46e68] - buffer: fix unaligned UTF-16LE decoding (Matteo Collina) #65905
[01cee9dcef] - build: do not use bundled simdutf when built with --shared-simdutf (Antoine du Hamel) #65891
[20606a4d19] - build: suppress OpenSSL asm warnings with clang (Richard Lau) #66023
[a76e97b5c5] - build: derive V8_LOGGING_LEVEL from dcheck_always_on (Joyee Cheung) #65744
[ac7fcf0cef] - build: sync cargo/rustc version warnings (Richard Lau) #65912
[f24a495b36] - build: fix quiet default for make builds (Shelley Vohr) #65826
[c4381765fe] - child_process: clear timeout timer on spawn-time error too (kishore280) #65506
[8955781eeb] - crypto: remove redundent std::move call (Antoine du Hamel) #66111
[0b88aa5a15] - crypto: read RSA-PSS restrictions from provider (Filip Skokan) #66108
[f90d3d3cb0] - crypto: skip private RSA parameters in key details (Filip Skokan) #66108
[97828d91db] - crypto: use provider EC group names (Filip Skokan) #66108
[3de05da569] - crypto: fetch ciphers for private-key encoding (Filip Skokan) #66108
[ca8ee04594] - crypto: decode PKCS#1 keys through providers (Filip Skokan) #66108
[54a625e953] - crypto: derive keys through EVP_KDF (Filip Skokan) #66108
[971adece6a] - crypto: use names for asymmetric key algorithms (Filip Skokan) #65966
[bfb544eb00] - crypto: optimize and benchmark key preparation (Filip Skokan) #65892
[c0a42d23e5] - (SEMVER-MINOR) crypto: add crypto.parsePKCS12() (Brian Muenzenmeyer) #65627
[c58a4e0ba7] - crypto: add Hybrid KEMs to Web Cryptography (Filip Skokan) #65759
[70edf90851] - crypto: avoid EC reconstruction for signature sizing (Filip Skokan) #65908
[fab5dddd77] - crypto: avoid EC raw export reconstruction (Filip Skokan) #65908
[220a499614] - crypto: export EC JWK coordinates directly (Filip Skokan) #65908
[f1295e11db] - crypto: read EC curve metadata directly (Filip Skokan) #65908
[775173a5db] - crypto: optimize private EC JWK import (Filip Skokan) #65908
[e44669bb7d] - crypto: validate the limit of PBKDF2 iterations (Filip Skokan) #65704
[cd5a7611e9] - crypto: use primordials in HKDF info validation (Filip Skokan) #65704
[94affce749] - Revert "deps: V8: override depot_tools version" (Richard Lau) #66110
[870a366c49] - deps: V8: cherry-pick 95efbaf92a0d (Igor Sheludko) #66020
[d62a452738] - deps: V8: backport a0607c5006b8 (Antoine du Hamel) #65891
[e8edeffe2d] - deps: update googletest to 8eff9e336692fc95961e096564f1044c600b881d (Node.js GitHub Bot) #66009
[eb4fabe81e] - doc: add araujogui to collaborators (Guilherme Araújo) #66090
[2fffb3872d] - doc: fix duplicate 'the' typo in node_platform.cc (Muhammad Al-Muzahid) #66058
[317abb8131] - doc: clarify sub-1000ms behavior in socket.setKeepAlive (Haram Jeong) #65869
[1c12f815c2] - doc: remove obsolete mentioning of cl.exe on windows (Chengzhong Wu) #66038
[2cc17dd67c] - doc: note that default signal handling resets the signal mask (Shelley Vohr) #65877
[3a69cc1bf4] - doc: clarify QUIC async write backpressure (John Finnerty) #65947
[549694349d] - doc: clarify permission model scope for output paths (Rafael Gonzaga) #66004
[3325ded3a8] - doc: fix sign-off format in AGENTS.md (Filip Skokan) #65958
[89aa2bd10c] - doc: fill in missing zstd docs (James M Snell) #65867
[8d1ce4d477] - doc: add inoway46 as triager (Yuya Inoue) #65565
[9a3697c5c7] - doc: document windowsHide for child_process.fork (Christopher Buss) #65887
[69911bf6b5] - doc: qualify directory read ordering for native fs (Trivikram Kamat) #65868
[2d0c3fed12] - doc: add DOMException section to errors API reference (Avocado) #65206
[f744023cce] - doc: expand revert commit collaborator instructions (Mike McCready) #65848
[412399efd3] - doc: clarify supported Python releases (Mike McCready) #65850
[79331f5779] - doc: note that FreeEnvironment() runs a shared event loop (Shelley Vohr) #65691
[6ddbb9982f] - doc,test: account for OpenSSL 4.1 behaviours (Filip Skokan) #65956
[64fb33d791] - (SEMVER-MINOR) ffi: load libraries from a mounted VFS (Matteo Collina) #65909
[07fcf1ed02] - ffi: throw ERR_INVALID_ARG_TYPE for wrong-typed pointer and size (Soul Lee) #65842
[b7406b0a9b] - fs: coerce FileHandle.read length like fs.read (Xia Chao) #65521
[cb9995be4d] - fs: honor dereference for symlinks nested in cpSync trees (Christian Aurich) #65731
[2b1701f810] - (SEMVER-MINOR) fs: add openAsBlobSync (greenhead) #65644
[9b3f1aa03f] - fs: throw on existing dir in cpSync with errorOnExist (Daijiro Wachi) #64124
[2b502e0798] - fs: support removing read-only files in rmSync on Windows (Sparsh :)) #64453
[77d8f17ab1] - http: don't destroy socket after request completes (Barath Raj) #65952
[46f76ed57b] - http2: settle pending write callbacks on destroy (Matteo Collina) #66016
[205443721d] - http2: fix onread assert when destroying session from stream handler (Sankalp Thakur) #65116
[7e1db4724a] - inspector: report an error when DOM storage is unavailable (Avocado) #65973
[95110712b8] - inspector: fix abort when two Environments own the inspector (Shelley Vohr) #65877
[9fd3e6caa4] - inspector: fix crash when the IsolateData has no platform (Shelley Vohr) #65818
[cce2795ad7] - lib: fix AbortSignal.any() abort propagation (Yuya Inoue) #66014
[2c0ccc0067] - lib: fix for FileHandle.readableWebStream (Patrick Dähne) #58842
[28acafe6a0] - lib: avoid repeat internal receiver checks (Filip Skokan) #65910
[b9b0e33923] - lib: avoid unsafe array iteration in cli table (Donghoon Kang) #65838
[7f514d3310] - lib: fix shared buffer growability validation (Filip Skokan) #65845
[7534117e38] - lib: optimize internal Web IDL dictionaries (Filip Skokan) #65857
[bdacc08fbe] - lib: validate sequence iterator objects (Filip Skokan) #65844
[5b6ac71fb2] - lib: use Web IDL interface brand checks (Filip Skokan) #65846
[da341e2571] - lib,src: apply multiple updates to dtls implementation (James M Snell) #65511
[13eb4843d5] - meta: bump step-security/harden-runner from 2.21.0 to 2.21.1 (dependabot[bot]) #66044
[0f759174af] - meta: bump github/codeql-action/upload-sarif from 4.37.9 to 4.38.0 (dependabot[bot]) #66046
[c75b830082] - meta: bump cachix/cachix-action (dependabot[bot]) #66047
[1ada7055a4] - meta: bump github/codeql-action/init from 4.37.9 to 4.38.0 (dependabot[bot]) #66048
[1ed8b05742] - meta: bump github/codeql-action/analyze from 4.37.9 to 4.38.0 (dependabot[bot]) #66049
[9165abe840] - meta: bump github/codeql-action/autobuild from 4.37.9 to 4.38.0 (dependabot[bot]) #66050
[d03e7313cf] - meta: add joyeecheung as v8 currency strategic initiative champion (Joyee Cheung) #65965
[53d7592378] - meta: expand on collaborator restoration process (Chengzhong Wu) #65962
[fa972d02b2] - meta: add web-standards as webidl owners (Filip Skokan) #65856
[080e76b3d7] - (SEMVER-MINOR) net: support sending net.BoundSocket to threads and child processes (Guy Bedford) #64725
[0d14c0e507] - path: remove StringPrototypeCharCodeAt from some methods of posix (Wiyeong Seo) #54668
[13e61f6ae6] - (SEMVER-MINOR) perf_hooks: implement SlidingWindowHistogram (James M Snell) #65825
[a326546094] - (SEMVER-MINOR) perf_hooks: implement qrde analysis support in Histogram (James M Snell) #65806
[32401c2229] - perf_hooks: reuse buffer for uv metrics (Donghoon Kang) #65985
[5e2fbfe0e5] - perf_hooks: validate import normalization offset (Matteo Collina) #65950
[4743cd8d33] - quic: fix two small bugs in HTTP/3 stream internals (Tim Perry) #65970
[0df54fb38f] - quic: improve stream cleanup & lookup (Tim Perry) #65944
[7cf448889c] - quic: fix timeout regression from 11ed325 (James M Snell) #66028
[61a98e6512] - quic: fix readable stream truncation on stop-sending, abort & timeout (Tim Perry) #63967
[975cac593c] - quic: add promise to QuicStream for pending strms (Marten Richter) #65862
[ae29cc92ea] - quic: split headers out from src/quic/stream.{h/cc} (James M Snell) #65863
[833c58d9dc] - quic: fix crash in onStreamClose (Marten Richter) #65861
[84ecb21343] - quic: reject zero addressLRUSize (Christian Aurich) #65827
[293e69d065] - sqlite: throw on invalid URL path instead of abort (Guilherme Araújo) #66026
[6f5fb76d0e] - sqlite: track registered user-defined functions (Trivikram Kamat) #65896
[baf112b639] - sqlite: always copy changeset before applying (Trivikram Kamat) #65870
[0306b0a71e] - (SEMVER-MINOR) sqlite: bind undefined to NULL (Trevor Burnham) #65709
[1f24901c0c] - src: fix -Wextra warning in WriteFileSync (Antoine du Hamel) #66020
[b98787fe2d] - src: reuse crypto GetCipherInfo in DTLS session (Ilyas Shabi) #66022
[410093dbf7] - src: avoid union type-punning in trace values (Khaidi Chu) #65933
[9ec030b1e7] - src: print exception thrown during primordial initialization (Joyee Cheung) #65991
[a0f99f1d6c] - src: support building with the V8 sandbox (Shelley Vohr) #62237
[27c62235d0] - src: ffi: create fast-call metadata Symbols lazily (Matteo Collina) #66015
[5a5abd8fd0] - src: avoid copying SEA snapshot data (Colin McDonnell) #65876
[a05023f331] - src: fix crash on empty, foreign or truncated --snapshot-blob files (Shelley Vohr) #65955
[4141e22606] - src: don't kill own process group on failed spawn (Lazizbek Ergashev) #65054
[05f4e54eda] - src: fix external reference list race between concurrent isolates (Shelley Vohr) #65779
[1518b7d67f] - src: keep the first snapshot blob alive for later isolates (Shelley Vohr) #65779
[62e2bf025c] - src: detach cppgc wrappers from their Realm before it is freed (Shelley Vohr) #65778
[afc3e559d2] - src: fix Stop() terminating the next Environment on the isolate (Shelley Vohr) #65819
[f245e53b29] - src: seed V8 from the OS CSPRNG instead of OpenSSL's DRBG (Colin McDonnell) #65796
[830ca7df7a] - src: fix null pointer call when running without a startup snapshot (Shelley Vohr) #65820
[48158fba8c] - src: stop leaking a CppHeap in CommonEnvironmentSetup (Shelley Vohr) #65792
[3c999edef7] - (SEMVER-MINOR) src,lib: add util.markPromiseAsHandled (James M Snell) #65805
[e5d2a336bd] - stream: destroy half-open sockets after iteration (Matteo Collina) #65986
[4075161405] - stream: destroy Duplex.from async function on early return (Aman Chadha(IVIXMMI)) #65963
[7d245cfd8d] - stream: fixup stream/iter to drop at most one entry per share call (James M Snell) #66028
[30e1f7651c] - stream: reject unbounded at SyncShare construction (James M Snell) #66028
[0372056cd8] - stream: make share budget failures detach before throwing (James M Snell) #66028
[36cc238dce] - stream: make Broadcast.from abort its background pump (James M Snell) #66028
[3134ca6f8e] - stream: update broadcast to retain buffered data with zero consumers (James M Snell) #66028
[04e5c282a1] - stream: fix async iteration of undefined chunks (Caleb Everett) #65969
[f81a1483b3] - stream: avoid promise allocation for parked transform writes (Matteo Collina) #65625
[aec01c5ae1] - stream: keep webstream stream states in fast-mode objects (Matteo Collina) #65625
[898cd55bdf] - stream: reject closed only after sink abort settles (Lazizbek Ergashev) #65727
[5661526006] - stream: fix ERR_INVALID_STATE when cancelling Readable.toWeb() (Richard Scarrott) #62773
[fb8a97f46b] - stream: improve handling of falsy errors in stream/iter (James M Snell) #65864
[cfee7fa3d9] - stream: amortize writable buffer compaction (Gürgün Dayıoğlu) #65847
[15605210f8] - stream: create write request objects lazily (Matteo Collina) #64455
[619470a9ae] - stream: allocate stream read buffers from a slab (Matteo Collina) #64455
[7e79c33354] - test: consolidate crypto provider cache coverage (Filip Skokan) #66108
[dcc9c3c02a] - test: avoid call to chmodSync in test-fs-cp-async-file-modes (Antoine du Hamel) #66104
[dda22c06d7] - test: deflake test-run-watch-cwd-isolation-none-* (Antoine du Hamel) #66035
[d63928dda0] - test: move permission FFI test to native suite (Yuya Inoue) #66059
[80c1bf7fb5] - test: deflake user timing WPT assertions (Filip Skokan) #66036
[12116d1d70] - test: unskip test-watch-create-isolation-none (Antoine du Hamel) #66041
[e90575cb4d] - test: deflake util.throttle tests (Filip Skokan) #66034
[f7d18ec360] - (SEMVER-MINOR) test: expand histogram test coverage (James M Snell) #65825
[bfa6d49b5c] - test: implement low-risk test optimizations (James M Snell) #65926
[c3307ebddf] - test: update WPT for WebCryptoAPI to 55ce71bb9d (Node.js GitHub Bot) #65813
[ee29c56993] - test: prevent parser reuse across close scenarios (Filip Skokan) #66017
[8a27474044] - test: cover cpSync fast path timestamp preservation (Abhinandan Kumar) #65678
[89297305c0] - test: fix stderr Buffer assertion in exec encoding test (greenhead) #66008
[d4cb916624] - test: skip test-vfs-real-provider-watch.js on IBM i (SRAVANI GUNDEPALLI) #65987
[6515db8ab6] - test: fix RSA/DSA wrong-passphrase flake (Filip Skokan) #65983
[fa19ecad9d] - test: improve sequential test performance (James M Snell) #65928
[3666d6a238] - test: schedule WPT variants individually (Filip Skokan) #65984
[f2aa27d82d] - test: overlap SLH-DSA signature checks (Filip Skokan) #65980
[2170207253] - test: unref cancelled broadcast source timer (Filip Skokan) #65980
[71a54aaf5f] - test: collect timeout signals explicitly (Filip Skokan) #65980
[1a15aff897] - test: skip retries in DNS timeout coverage (Filip Skokan) #65980
[5c7e6b4a6e] - test: synchronize ordered runner events (Filip Skokan) #65980
[37f24eddc9] - test: reuse fixed primes in DH tests (Filip Skokan) #65980
[831ec42bcc] - test: avoid idle HTTP/HTTPS connections (Filip Skokan) #65980
[f523342bcd] - test: close WebAssembly test HTTP servers (Filip Skokan) #65980
[f23847a122] - test: use named parameters in DH stress test (Filip Skokan) #65980
[7131e3b437] - test: reduce ZIP64 stress test I/O (Filip Skokan) #65980
[e4ca72a984] - test: avoid allocations in external memory test (Filip Skokan) #65975
[7fe64727a2] - test: cover experimental stream iterator builtins (Jungwon Sohn) #65964
[88ba17bae2] - test: deflake node-api test-free-called (Christian Aurich) #65948
[6eee01fbae] - test: fix flaky common WPT inspector test (Yuya Inoue) #65937
[858702e51c] - test: skip C++ symbols in tick-processor-arguments (Philipp Dunkel) #65906
[472215ff9b] - test: try fixing windows build replacing WMIC (James M Snell) #65949
[7f5168149c] - test: fix flaky test-bench-stream (Matteo Collina) #65874
[9f2d544576] - test: move sqlite length validation out of the reentry test (Trevor Burnham) #65769
[75a9fa65ac] - test: fix flaky cleanup in http2 test (Tim Perry) #65701
[f8cdf05586] - test,benchmark: use OpenSSL feature helpers (Filip Skokan) #65762
[88b12c03cd] - test_runner: avoid reusing v8 serializers (Yuya Inoue) #65951
[9b3085e660] - test_runner: fix quote escaping in JUnit (Jihwan) #65971
[02c2302c31] - tls: propagate singleUse to the secure context (Carlos Vinicius) #66025
[2a8b5d9269] - tls: load all CRLs from a PEM bundle (Lazizbek Ergashev) #65577
[d141ddb8dc] - tls: defer re-entrant calls to SSL state machine from JS (Tim Perry) #65105
[b7fe779632] - tools: update tools/v8 for Python 3.13 (Richard Lau) #66109
[6105b37a3d] - tools: bump eslint-plugin-jsdoc in /tools/eslint in the eslint group (dependabot[bot]) #66102
[060ed69df9] - tools: disable fortify warnings in test-shared (Antoine du Hamel) #66020
[f8b7a2ff41] - tools: clean up handling of shared libs in shell.nix (Antoine du Hamel) #65891
[3c9586c1fc] - tools: group CodeQL GHA updates (Antoine du Hamel) #66057
[aa531a34f7] - tools: summarize auto-start-ci failures (Filip Skokan) #65979
[b7eef15f59] - tools: bump the eslint group in /tools/eslint with 6 updates (dependabot[bot]) #66045
[8914947d7c] - tools: update pgo build doc for linux (Chengzhong Wu) #66024
[a5b1659d5b] - tools: avoid workflow shell interpolation (Filip Skokan) #66013
[caf0ee0d7b] - tools: use self-repository references (Filip Skokan) #66013
[d5880dcb05] - tools: correct Slack action version comments (Filip Skokan) #66013
[66f182f565] - tools: make checkout credential use explicit (Filip Skokan) #66013
[287ece3f22] - tools: pass author to commit message validator (Filip Skokan) #66012
[6314ccf93b] - tools: reduce test runner timing overhead (Filip Skokan) #65980
[441350a867] - tools: do not download build tools when linting Nix files (Antoine du Hamel) #65961
[15f2549f74] - tools: bump js-yaml from 4.3.1 to 4.3.2 in /tools/eslint (dependabot[bot]) #65931
[0e449d02a6] - tools: bump js-yaml from 4.3.1 to 4.3.2 in /tools/lint-md (dependabot[bot]) #65932
[81eba460b5] - tools: fix commit queue error summary matching (Filip Skokan) #65913
[e5bbcfdd78] - tools: lint PR commit messages without approval (Filip Skokan) #65875
[07ae602005] - tools: unlabel author ready on base branch conflicts (Filip Skokan) #65872
[e3ad68289a] - tools: improve benchmark build cache reuse (Filip Skokan) #65859
[46ddc0220d] - tools: apply feedback to and simplify contributor guidance workflow (Filip Skokan) #65785
[66fd78803d] - trace_events: fix abort when Node.js does not own the V8 platform (Shelley Vohr) #65954
[3cb3c23a19] - typings: add task_queue internal binding types (Seongeun Lee) #65662
[c5c7036e7b] - typings: add timeoutInfo to TimersBinding (greenhead) #65811
[62fe96c166] - typings: add missing sea binding properties (이혜미) #65815
[e51673b4ed] - url: add Symbol.toStringTag to URLPattern (Khaidi Chu) #65925
[3ce4d23bbb] - (SEMVER-MINOR) util: implement util.throttle (James M Snell) #65899
[336f33ccc1] - (SEMVER-MINOR) util: implement debounce (James M Snell) #65899
[16e3e7eff3] - vfs: add --vfs-mount and --vfs-load startup flags (Philipp Dunkel) #65748
[c50cb9a553] - vfs: write RealFSProvider files to open fd (Christian Aurich) #65885
[1bbc5488a5] - vfs: close the fs hook gaps for mounted paths (Philipp Dunkel) #65852
[816790e0e5] - vfs: resolve symlinks when checking rename descendants (Trivikram Kamat) #65904
[a9149093df] - vfs: support renaming implicit ZIP directories (Trivikram Kamat) #65752
[cf5d4a8fe6] - vfs: reject statfs for missing paths (Trivikram Kamat) #65693
[de552bd044] - vfs: return FileHandle from fs.promises.open (Trivikram Kamat) #65730
[08f96f142e] - vfs: give ZipProvider option bags a null prototype (Philipp Dunkel) #65853
[5c4d319028] - vfs: commit ZipProvider handles the way open(2) does (Philipp Dunkel) #65853
[29d3406b6c] - vfs: apply open(2) effects to ZipProvider handles (Philipp Dunkel) #65853
[e379c26a92] - vfs: align virtual file handles with open(2) (Philipp Dunkel) #65854
[7cdf5f014a] - vfs: answer for unowned paths under reserved root (Philipp Dunkel) #65814
[5e55085bc1] - zlib: reject invalid zstd dictionaries (James M Snell) #65867
[4cdcf7f6a4] - zlib: fix zstd reset (James M Snell) #65867
[678ff3561a] - zlib: improve zstd decoding across chunk boundaries (James M Snell) #65865

nodejs/node v26.10.0 2026-09-22, Version 26.10.0 (Current), @aduh95 on GitHub

Notable Changes

Commits

nodejs/node v26.10.0
2026-09-22, Version 26.10.0 (Current), @aduh95

on GitHub