Skip to content

2026-10-07, Version 26.11.0 (Current) - #66546

Open
github-actions[bot] wants to merge 293 commits into
v26.xfrom
v26.11.0-proposal
Open

github-actions[bot] wants to merge 293 commits into
v26.xfrom
v26.11.0-proposal

Conversation

@github-actions

@github-actions github-actions Bot commented Oct 5, 2026 •

Copy link
Copy Markdown
Contributor
  • [232f178825] - (SEMVER-MINOR) buffer: add isLatin1 (James M Snell) #66298
  • [27778036de] - (SEMVER-MINOR) buffer: add Buffer.stringLength() (Matteo Collina) #66064
  • [4f84c4bda2] - build, doc: move to redesign (Aviv Keller) #62045
  • [6f6296fef9] - (SEMVER-MINOR) doc: promote Alpine Linux to tier 2 support (Stewart X Addison) #63737
  • [e998d260d0] - (SEMVER-MINOR) http: add isValidHeaderName() and isValidHeaderValue() (James M Snell) #66334
  • [7702a50e08] - (SEMVER-MINOR) http2: add connectionWindowSize option (Tim Perry) #65619
  • [e06aa62cec] - (SEMVER-MINOR) perf_hooks: fix truncation of monitorEventLoopDelay() resolution (James M Snell) #66115
  • [ee126e37e8] - (SEMVER-MINOR) perf_hooks: allow RecordableHistogram to record 0 (James M Snell) #66114
  • [1fef8f54db] - (SEMVER-MINOR) perf_hooks: add histogram.diff() (James M Snell) #66099
  • [f1b9758c4e] - (SEMVER-MINOR) perf_hooks: add histogram.snapshot() (James M Snell) #66099
  • [291d56ea3e] - (SEMVER-MINOR) perf_hooks: harden histogram CBOR import validation (James M Snell) #66098
  • [6299b09d5c] - (SEMVER-MINOR) process: graduate process.ref/unref to stable (James M Snell) #66213
  • [41d6707b63] - (SEMVER-MINOR) sqlite: rename DatabaseSync and StatementSync (Guilherme Araújo) #65988
  • [60d0aa0cd4] - (SEMVER-MINOR) src: add --process-timeout=N (James M Snell) #66138
  • [f39916a7e3] - (SEMVER-MINOR) src: expose size and count in heap profile output (Ilyas Shabi) #65737
  • [0b00d5ea59] - (SEMVER-MINOR) src: let embedders exempt linked bindings from the addon permission (Shelley Vohr) #66067
Commits
  • [11c3d7115d] - benchmark: add implicit-framing case to http/set-header (Matteo Collina) #66420
  • [168b764fec] - benchmark: add zstdCompress benchmark (James Ross) #66358
  • [69182564a7] - benchmark: add a node::MakeCallback benchmark (Nigro Simone) #66316
  • [12e540582f] - (SEMVER-MINOR) benchmark: add http header validator benchmark (James M Snell) #66334
  • [e6abdf6b01] - benchmark: remove duplicate ffi string length direct (Donghoon Kang) #66278
  • [480ca7cc55] - benchmark: fix shadowing that broke h=20 on incoming_headers benchmark (Tim Perry) #66257
  • [c6bbc1b128] - benchmark: cover Web Crypto conversion costs (Filip Skokan) #66237
  • [85a2e4e270] - benchmark: remove duplicate ffi add-64 benchmark (Soul Lee) #66121
  • [d0a72f2c12] - buffer: fix negative index for large buffers (Hilary Asogwa) #66325
  • [b7f6a66a9f] - (SEMVER-MINOR) buffer: add isLatin1 (James M Snell) #66298
  • [232f178825] - (SEMVER-MINOR) buffer: add isLatin1 (James M Snell) #66298
  • [f7d3d11c11] - buffer: fix odd UTF-16LE indexOf start (Yuya Inoue) #65960
  • [27778036de] - (SEMVER-MINOR) buffer: add Buffer.stringLength() (Matteo Collina) #66064
  • [9f1db461d2] - build: update common.gypi for z/OS (Gaby Baghdadi) #66449
  • [0002037b3f] - build: update configure.py for z/OS (Gaby Baghdadi) #66449
  • [a341ac460a] - build: fix vcbuild format-md install and exit (Ved Chaudhari) #66475
  • [bec52d9103] - build: fix vcbuild lint skipping lint-md-build (Ved Chaudhari) #66467
  • [9acdb5910c] - build: toggle doc-kit verbosity based on V (Brian Muenzenmeyer) #66293
  • [6ee32f857a] - build: support LIEF 0.17.x and 1.x (Yuya Inoue) #66240
  • [2248869955] - build: add clang support for pgo on macOS/Linux (Chengzhong Wu) #66136
  • [49069529eb] - build: add GZIP_COMPRESSION Make variable (inoway46) #66228
  • [9066d33aa2] - build: port make_temporal_zoneinfo_cpp to GYP (Antoine du Hamel) #66183
  • [1f4a8fb1cb] - build: add v8_enable_temporal_systemicu (Steven R. Loomis) #65992
  • [4f84c4bda2] - build, doc: move to redesign (Aviv Keller) #62045
  • [a0e7141ffc] - child_process: build the default env block in one native pass (Shelley Vohr) #65325
  • [9fa31096d4] - crypto: improve random synchronous number generation performance (Mert Can Altin) #66348
  • [53cde9d1f8] - crypto: fix raw key export error for wrong key type (한국) #66217
  • [32ba6d5ada] - crypto: use backend cSHAKE and KMAC (Filip Skokan) #66237
  • [67ccff6434] - crypto: separate conversion from validation (Filip Skokan) #66237
  • [ceeb37173d] - crypto: verify empty KMAC outputs (Filip Skokan) #66237
  • [359b07a641] - crypto: check EC coordinate conversion results (Filip Skokan) #66237
  • [e4d746c4a5] - crypto: map JWK export failures to OperationError (Filip Skokan) #66237
  • [a851dda86a] - crypto: include EC public keys in PKCS8 exports (Filip Skokan) #66237
  • [7f58476ed1] - crypto: use the public CryptoKey prototype (Filip Skokan) #66237
  • [75870623ad] - crypto: split hybrid keys without species (Filip Skokan) #66237
  • [a1bea87c6a] - crypto: report actual RSA modulus lengths (Filip Skokan) #66237
  • [5e04680036] - crypto: derive Argon2 without worker threads (Filip Skokan) #66237
  • [fe09120a0e] - crypto: create key usage arrays without species (Filip Skokan) #66237
  • [44a2965f5f] - crypto: minimize RSA public exponent metadata (Filip Skokan) #66237
  • [2f3e6dff9d] - crypto: copy derived bits without species (Filip Skokan) #66237
  • [d54a2b2049] - crypto: handle PBKDF2 iteration limits (Filip Skokan) #66237
  • [2ef6046f11] - crypto: reject duplicate unknown key usages (Filip Skokan) #66237
  • [2e25ae4a7a] - crypto: check RSA JWK alg with SHA-3 hashes (Filip Skokan) #66237
  • [0370e02e2a] - crypto: copy parameters without array species (Filip Skokan) #66237
  • [e042d35ca5] - crypto: convert importKey data as a union (Filip Skokan) #66237
  • [ff86606768] - crypto: copy detached parameters as empty (Filip Skokan) #66237
  • [1314d277b2] - crypto: resolve supports overloads by type (Filip Skokan) #66237
  • [a855a46aeb] - crypto: allow unbound SubtleCrypto.supports (Filip Skokan) #66237
  • [4a72c1d690] - crypto: allow short AES-GCM IVs (Filip Skokan) #66237
  • [2d84b7ed49] - crypto: validate normalized hash names (Filip Skokan) #66237
  • [6bfd3924ff] - crypto: convert getRandomValues views (Filip Skokan) #66237
  • [529bd18c1a] - crypto: isolate cipher job errors (Filip Skokan) #66237
  • [d4af11e171] - crypto: reject short AES-KW inputs (Filip Skokan) #66237
  • [78374c8af0] - crypto: match algorithm names as ASCII (Filip Skokan) #66237
  • [ab9a3f2b01] - crypto: use internal random buffer bounds (Filip Skokan) #66237
  • [7c9b2df87a] - crypto: use current FIPS state for availability (Filip Skokan) #66160
  • [55af1dcded] - crypto: update root certificates to NSS 3.129 (Node.js GitHub Bot) #66496
  • [4387cb46d2] - deps: update timezone to 2026e (Node.js GitHub Bot) #66419
  • [150c96ef3f] - deps: V8: cherry-pick c795f5948568 (Aviv Keller) #66380
  • [6b5ac2ab5d] - deps: update archs files for openssl-3.5.9 (Node.js GitHub Bot) #66396
  • [bee7e2403c] - deps: upgrade openssl sources to openssl-3.5.9 (Node.js GitHub Bot) #66396
  • [7a715495f2] - deps: update lief to 1.0.0 (Node.js GitHub Bot) #66345
  • [f9da04958a] - deps: update zlib to 1.3.2.1-motley-456ae73 (Node.js GitHub Bot) #66330
  • [5c34dd970d] - deps: update undici to 8.11.2 (Node.js GitHub Bot) #66332
  • [fdf0572cd1] - deps: update timezone to 2026d (Node.js GitHub Bot) #66333
  • [6c924ee1b0] - deps: upgrade npm to 11.20.0 (npm team) #66259
  • [2653b2617d] - deps: V8: backport 786c1c2d88d4 (Eliau Elkouby) #66249
  • [1d68f23e08] - deps: update googletest to 4267679b6887f349f17b01ccd70c9e3483689b25 (Node.js GitHub Bot) #66145
  • [c507c5ad12] - deps: V8: backport 9fb4444bfc46 (Steven R. Loomis) #65992
  • [8c556ab2b6] - deps: update histogram to 0.12.0 (Node.js GitHub Bot) #66494
  • [d3f55c7487] - diagnostics_channel: replace using with try-finally (Ayush Chaudhary) #64251
  • [510dfd899e] - doc: update FreeEnvironment() notes for sibling Environments (Shelley Vohr) #66239
  • [db2665ba17] - doc: add indexed Array.prototype properties to primordial exclusions (René) #66234
  • [b692079e3a] - doc: fixup and cleanup stream/iter docs (James M Snell) #66079
  • [9b191141a2] - doc: fix casing in util.markPromiseAsHandled section (Antoine du Hamel) #66206
  • [8e8c9762a8] - doc: add return type to Blocklist.isBlocklist (yuki motokane) #66181
  • [6c7fc98d7f] - doc: clarify Worker execArgv vs Permission Model grants (yunshingng) #66124
  • [9fd0a10b1e] - doc: document iterable input for AbortSignal.any (Haram Jeong) #66123
  • [c4508fd4c7] - doc: restore XadillaX to collaborators (Khaidi Chu) #66063
  • [b4ad8354f0] - doc: use Type for performanceNodeTiming.uvMetricsInfo (James M Snell) #66094
  • [50bc27f3c3] - doc: document the node:ffi call paths (Soul Lee) #66086
  • [a74a0ee748] - doc,src,test: fix typos in code comments (Noah) #66218
  • [6f6296fef9] - (SEMVER-MINOR) doc: promote Alpine Linux to tier 2 support (Stewart X Addison) #63737
  • [215639d6ce] - events: fix addAbortListener for aborted signals (Lazizbek Ergashev) #65640
  • [021f7d8d98] - ffi: accept safe integer numbers for 64-bit arguments (Donghoon Kang) #66197
  • [53fd8e7ebb] - ffi: remove permission checks from dlclose and dlsym (Trivikram Kamat) #66426
  • [fa7efaf782] - ffi: validate pointer ranges in optimized calls (Trivikram Kamat) #66371
  • [11f80798ba] - ffi: throw on allocation failure in toArrayBuffer() (Trivikram Kamat) #66406
  • [c65a333648] - ffi: do not abort when a Worker stops in a callback (Trivikram Kamat) #66389
  • [9bdab1eca0] - ffi: reject unsafe integers as length or offset (Christian Aurich Zanettini Martins) #66216
  • [343a5c2915] - ffi: fix use-after-free in PrepareFunction (Trivikram Kamat) #66368
  • [51daf16244] - ffi: reject non-boolean copy arguments (Christian Aurich Zanettini Martins) #66219
  • [b901b97cbf] - ffi: use type errors for invalid signatures (Donghoon Kang) #66222
  • [0f6cdce998] - ffi: allocate string argument storage lazily (Soul Lee) #66178
  • [ee84a36f12] - ffi: avoid memcpy() with a null pointer (Christian Aurich Zanettini Martins) #66200
  • [da32c79034] - fs: keep timestamps of files skipped by cpSync (Christian Aurich Zanettini Martins) #66305
  • [e7121be408] - fs: stop recursive mkdir from retrying ENOENT forever (Marco) #66340
  • [99a78b0d83] - fs: fix crash on negative zero file descriptor (Christian Aurich Zanettini Martins) #65888
  • [8b24247be1] - fs: validate falsy openAsBlob type option (Christian Aurich Zanettini Martins) #66125
  • [e7d5352fa6] - fs: close file streams with fd 0 (greenhead) #66131
  • [f38768f0fa] - fs: close fd 0 on discarded FileHandle transfer (Christian Aurich Zanettini Martins) #66095
  • [6487d36873] - http: avoid dictionary-mode objects in responses (Matteo Collina) #66420
  • [f8d30110b6] - http: cache parser callbacks (Matteo Collina) #66152
  • [e998d260d0] - (SEMVER-MINOR) http: add isValidHeaderName() and isValidHeaderValue() (James M Snell) #66334
  • [0bb98027e5] - http: avoid toLowerCase on the server hot path (Yagiz Nizipli) #66120
  • [9819b0c432] - http: normalize CONNECT request paths (Efe Karasakal) #64876
  • [ab93a3d51b] - http: preserve socket errors as response error causes (Khaidi Chu) #66061
  • [15184e8212] - http: reduce per-request allocations in the server (Matteo Collina) #65802
  • [7702a50e08] - (SEMVER-MINOR) http2: add new connectionWindowSize option (Tim Perry) #65619
  • [33e4ba358b] - https: handle invalid TLS options in proxied requests (Christian Aurich Zanettini Martins) #66096
  • [6f610a836b] - inspector: throw ERR_INSPECTOR_NOT_AVAILABLE without an agent (Shelley Vohr) #66239
  • [697980b6fc] - inspector: fix connectToMainThread() abort without parent inspector (Shelley Vohr) #65976
  • [37b3db91eb] - (SEMVER-MINOR) lib: fix stream loading bug in node:bench (James M Snell) #66114
  • [46a8a5dd65] - lib: add primitive fast path to structuredClone (Guilherme Araújo) #64190
  • [bec7c53400] - meta: bump github/codeql-action/analyze from 4.38.0 to 4.38.2 (dependabot[bot]) #66443
  • [39d721abed] - meta: bump github/codeql-action/autobuild from 4.38.0 to 4.38.2 (dependabot[bot]) #66444
  • [963804db4d] - meta: bump github/codeql-action/init from 4.38.0 to 4.38.2 (dependabot[bot]) #66446
  • [5837ef8608] - meta: bump github/codeql-action/upload-sarif from 4.38.0 to 4.38.2 (dependabot[bot]) #66447
  • [d8109f9831] - meta: label permission model changes correctly (Rafael Gonzaga) #66208
  • [27f20dcaea] - meta: bump codecov/codecov-action from 7.0.0 to 7.1.0 (dependabot[bot]) #66103
  • [dc6ef03ab6] - module: centralize builtin exposure policies (Jungwon Sohn) #66292
  • [f36efeb350] - module: avoid allocating a cache key string for every require() (Samuel Attard) #63884
  • [9baea33509] - module: normalize package map paths (Hilary Asogwa) #66054
  • [354c2cc867] - net: speed up BlockList.check for strings (Yagiz Nizipli) #66166
  • [995a67a5ff] - net: skip IPv6 regex when the string has no colon (Yagiz Nizipli) #66165
  • [1c7b4feebb] - node-api: do not crash on module version mismatch (Alexey Karimov) #66019
  • [e06aa62cec] - (SEMVER-MINOR) perf_hooks: fix truncation of monitorEventLoopDelay() resolution (James M Snell) #66115
  • [ee126e37e8] - (SEMVER-MINOR) perf_hooks: allow RecordableHistogram to record 0 (James M Snell) #66114
  • [1fef8f54db] - (SEMVER-MINOR) perf_hooks: add histogram.diff() (James M Snell) #66099
  • [a6dfb3bcfd] - (SEMVER-MINOR) perf_hooks: report histogram memory to V8 (James M Snell) #66099
  • [f1b9758c4e] - (SEMVER-MINOR) perf_hooks: add histogram.snapshot() (James M Snell) #66099
  • [e2ae016df8] - (SEMVER-MINOR) perf_hooks: add histogram export format version 2 (James M Snell) #66098
  • [291d56ea3e] - (SEMVER-MINOR) perf_hooks: harden histogram CBOR import validation (James M Snell) #66098
  • [70c269aadc] - perf_hooks: restore GC tracking after snapshot deserialization (James M Snell) #66097
  • [c545d044ee] - perf_hooks: track GC callback installation natively (James M Snell) #66097
  • [0bd9905959] - perf_hooks: fix PerformanceObserver observer count leaks (James M Snell) #66097
  • [8ec2a940c5] - perf_hooks: add performanceNodeTiming.uvMetricsInfoBigInt (James M Snell) #66094
  • [829891da14] - perf_hooks: fix truncation of uvMetricsInfo counters (James M Snell) #66094
  • [afa02fb69c] - process: use a class for nextTick resources (Matteo Collina) #66415
  • [6299b09d5c] - (SEMVER-MINOR) process: graduate process.ref/unref from experimental (James M Snell) #66213
  • [0965b28252] - querystring: speed up default parse and unescape (Yagiz Nizipli) #66175
  • [bd547c1176] - quic: cleanly tear down QUIC after worker.terminate() (Tim Perry) #66093
  • [52bbf8cb15] - report: skip unresponsive workers on process timeout (Trivikram Kamat) #66304
  • [702c744643] - sea: add test and update docs for import() with code cache (Ali Hassan) #62678
  • [a1bfb6fcda] - sea: add vfsArchive to serve the assets from a ZIP archive (Matteo Collina) #65810
  • [fe76deb537] - sqlite: restore connection state on reopen (Guilherme Araújo) #66042
  • [4977e51ff3] - sqlite: use cached strings for property keys (Kyungrae Kang) #65902
  • [cd16dcb82b] - sqlite: reject plans with unusable virtual table parameters (Trivikram Kamat) #66215
  • [33caead942] - sqlite: throw on oversized string values (Guilherme Araújo) #66209
  • [41d6707b63] - (SEMVER-MINOR) sqlite: rename DatabaseSync and StatementSync (Guilherme Araújo) #65988
  • [583ee1ce64] - sqlite: run generator return() on cursor refilter (Trivikram Kamat) #66195
  • [b46b6996e2] - sqlite: add virtual table support via createModule() (Trevor Burnham) #65787
  • [edbff8caf1] - src: fix --process-timeout message when exit waits (Trivikram Kamat) #66361
  • [cd814e7f23] - src: remove orphaned js_udp_wrap test binding (René) #66399
  • [1e9c10b8ea] - src: assert that an IsolateData outlives its Environments (Shelley Vohr) #66239
  • [286bffc0a1] - src: track handle cleanup per thread, not per IsolateData (Shelley Vohr) #66239
  • [25c08fcd0d] - src: remove HAVE_QUIC macro in favor of OPENSSL_NO_QUIC (Antoine du Hamel) #66373
  • [5eea87c561] - src: fix builds without SSL and SQLite (Filip Skokan) #66372
  • [9696e47c32] - src: reduce InternalCallbackScope overhead (Nigro Simone) #66316
  • [60d0aa0cd4] - (SEMVER-MINOR) src: add --process-timeout=N (James M Snell) #66138
  • [12962d8eb5] - src: fix FreeEnvironment() breaking JS in sibling Environments (Shelley Vohr) #65977
  • [abccf93d9f] - src: let Environments on one isolate share a cleanup hook (Shelley Vohr) #65777
  • [caa7858e4c] - src: fix abort when two Environments share an IsolateData (Shelley Vohr) #65978
  • [f39916a7e3] - (SEMVER-MINOR) src: expose size and count in heap profile output (Ilyas Shabi) #65737
  • [de34ddcf95] - src: throw on a malformed localStorage file (Trevor Burnham) #65879
  • [6651596663] - src: reserve shared_array_buffers capacity in Message::Deserialize (agape1225) #65304
  • [74835eef19] - src: ensure Socket(fd) cannot bypass allow-net permission (James M Snell) #66117
  • [d7c720f283] - src: add a flag to keep the embedder's wasm streaming callback (Shelley Vohr) #65690
  • [68931f70d9] - src: free placeholder nodes for cppgc wrappers in MemoryTracker (Shelley Vohr) #65793
  • [13dbf1923a] - src: fix task queue deadlock when built as C++23 (Shelley Vohr) #66066
  • [0b00d5ea59] - (SEMVER-MINOR) src: let embedders exempt linked bindings from the addon permission (Shelley Vohr) #66067
  • [158f6f78d4] - stream: share webstreams async iterator methods (Matteo Collina) #66392
  • [e241cb80da] - stream: keep webstreams nil requests in fast mode (Matteo Collina) #66230
  • [62187ab707] - stream: keep consumer state in fast mode (Matteo Collina) #66266
  • [dcc8665f7e] - stream: fix pipeline function tail deadlock (Dayun) #65559
  • [247c0274c1] - stream: skip write() checks in flowing pipe (Yagiz Nizipli) #66182
  • [26102c22f2] - stream: speed up flowing pipe of buffers (Yagiz Nizipli) #66182
  • [81e4ac47a3] - stream: support ArrayBufferView in Utf8Stream write() buffer mode (agape1225) #65301
  • [f7f1116fc9] - stream: fill out stream/iter test coverage (James M Snell) #66079
  • [dca736ba05] - stream: cleanup promise uses in stream/iter (James M Snell) #66079
  • [55ef82ac0c] - stream: make classic reads wake on return/throw/abort (James M Snell) #66079
  • [4e8df7ceee] - stream: correct strict pending-write behavior & cancellation (James M Snell) #66079
  • [b44b8658d3] - stream: make stream/iter toWritable apply backpressure (James M Snell) #66079
  • [3c9f8789c4] - stream: trim per-pipe and per-tee costs in webstreams (Matteo Collina) #66154
  • [d96a80930e] - stream: update ShareImpl to retain factory abort listener (James M Snell) #66030
  • [500b56774f] - stream: make Broadcast.from() only return the Broadcast (James M Snell) #66030
  • [d40236c98e] - stream: ensure streamable protocols precede fast paths (James M Snell) #66030
  • [cdeb53e807] - stream: have broadcast clean factory listeners on cancel (James M Snell) #66030
  • [84f9031add] - stream: ensure protocol and transform accessors are called once (James M Snell) #66030
  • [1c7c0f5267] - stream: make broadcast waiters use SafeSet (James M Snell) #66030
  • [9b50b629a2] - stream: ensure nested async iterators are cancellation aware (James M Snell) #66030
  • [a16320eb15] - stream: trim per-stream costs in webstreams (Matteo Collina) #66052
  • [3a77852e34] - stream,quic: correct stream/iter writer implementations (James M Snell) #66079
  • [6c5806b53c] - test: wait for ZIP source streams to close (Filip Skokan) #66429
  • [4706cafc59] - test: mark worker init failure flaky on SmartOS (Filip Skokan) #66428
  • [c19e2cedd2] - test: deflake process timeout report cleanup (Filip Skokan) #66428
  • [1047188452] - test: split process timeout report coverage (Filip Skokan) #66428
  • [430262ecb0] - test: do not hardcode V8 serialization header (Joyee Cheung) #66442
  • [7b25cb811a] - test: make histogram external memory test less overfitting (Joyee Cheung) #66416
  • [aead8a9019] - test: cover Environments sharing an embedder-owned isolate (Shelley Vohr) #66239
  • [f63ddfafdc] - test: isolate styleText tests from the environment (Filip Skokan) #66320
  • [a3ffd40d40] - test: probe cluster workers with signal 0 (Filip Skokan) #66320
  • [f59117e5fd] - test: deflake watch cwd with isolation none (Filip Skokan) #66320
  • [f23010d837] - test: deflake esm loader http imports (Filip Skokan) #66320
  • [3f51c49ff9] - test: deflake http headers timeout keepalive (Filip Skokan) #66320
  • [a5ee59cb00] - test: deflake http server mixed request timeouts (Filip Skokan) #66320
  • [7c3463901f] - test: deflake inspector close connection test (Filip Skokan) #66320
  • [fbdca3a120] - test: deflake debugger PID attachment and cleanup (Filip Skokan) #66320
  • [534561358e] - test: deflake inspector network fetch (Filip Skokan) #66320
  • [1ff8d5c2c9] - test: use correct constructor in test-sqlite-virtual-table (René) #66401
  • [de797aa4b4] - test: check frame restore in CallbackScope (Nigro Simone) #66316
  • [886fd32693] - test: use common.PIPE in fs.cp socket tests (Maksim Romanov) #66329
  • [3c50781d10] - test: deflake fast FFI buffer tests (Filip Skokan) #66327
  • [1d8f9a2bfb] - test: use Database in sqlite virtual table test (Trivikram Kamat) #66307
  • [61a87a246f] - test: deflake sliding window histogram test (James M Snell) #66132
  • [017ff85b82] - test: split FFI call and callback coverage (Filip Skokan) #66287
  • [19d8d1992c] - test: add smoke tests for defer importing synthetic modules (Maya Lekova) #65537
  • [fb3d90a986] - test: deflake test runner timeout coverage (Filip Skokan) #66255
  • [cee8eb9c74] - test: deflake inspector async hook setup (Filip Skokan) #66255
  • [37e9397bfe] - test: deflake debugger function name extraction (Filip Skokan) #66231
  • [7b1c74eec3] - test: use spawnSync helpers in cpu-prof tests (Junhwan Choi) #65694
  • [2fd51fd5d8] - test: reduce expensive crypto test variants (Filip Skokan) #66244
  • [c155248f1b] - test: ensure fsPromises.watch rejects on abort (Jihwan) #65768
  • [42255ab9b1] - test: avoid using promise wrapped timers (James M Snell) #66079
  • [62f92a5d3d] - test: enable trace_events tests with perfetto (Chengzhong Wu) #66068
  • [f2972bf10a] - test: accept ENOTEMPTY from libc++ in test-fs-rm (Shelley Vohr) #66065
  • [e0d0c5d0e2] - test: use heapdump test for SecureContext memory tracking (Mert Can Altin) #64344
  • [953e46789d] - test: update WPT for url to c48d58747e (Node.js GitHub Bot) #66141
  • [aaa7a7aebe] - test: deflake watch mode tests (Filip Skokan) #66232
  • [ee457cd306] - test: mark some tests flaky for now on riscv64 (Stewart X Addison) #65781
  • [9b432e97ca] - test: deflake pummel/test-timers (Filip Skokan) #66135
  • [63d32369b1] - test: update WPT for WebCryptoAPI to a6a0a0292a (Node.js GitHub Bot) #66142
  • [658951021a] - test: deflake test-bench-errors (Filip Skokan) #66153
  • [1be62ae8d5] - test: deflake test-http2-debug (Filip Skokan) #66151
  • [b9f61ea9ab] - test: deflake test-benchmark-crypto (Filip Skokan) #66151
  • [fb9aba67dd] - test: deflake long timer WPTs (Marco) #63106
  • [53b3a053a2] - test: update test426-fixtures to 9ea66b466fd37e8a4050033d23b3e1480973c3d (Node.js GitHub Bot) #66493
  • [ef1a602283] - test: update WPT for WebCryptoAPI to 3127c3a492 (Node.js GitHub Bot) #66492
  • [d573726238] - test_runner: do not crash on stdout that mimics a v8 frame (Muhammad Faizan Uddin) #66273
  • [ea2c1bbe8b] - test_runner: do not reuse a worker ID held by a running file (Vasiliy Serpokryl) #65739
  • [0f0892e59c] - tls: initialize session and SNI before connecting (Steven) #65624
  • [684cae7909] - tls: preserve CN name constraints with OpenSSL 4.1 (Filip Skokan) #65957
  • [df96c928a2] - tools: limit checkout for lint-cpp (Yuya Inoue) #66474
  • [593c96446c] - tools: limit format-cpp checkout history (Yuya Inoue) #66479
  • [4251b8b1f9] - tools: share CI and benchmark build configuration (Filip Skokan) #66351
  • [6948dd1232] - tools: fix nixpkgs updater script (Antoine du Hamel) #66337
  • [e3f861b23e] - tools: wait for test processes instead of polling (Matteo Collina) #66432
  • [14cc5877d7] - tools: avoid repeated subtree scans in must-call-assert (Yuya Inoue) #66408
  • [7fb76f9554] - tools: add cache to lint-js-and-md (Antoine du Hamel) #66412
  • [9015b992d0] - tools: bump brace-expansion in /tools/clang-format (dependabot[bot]) #66418
  • [84db29179a] - tools: bump brace-expansion from 5.0.9 to 5.0.12 in /tools/eslint (dependabot[bot]) #66417
  • [a952647d86] - tools: keep OpenSSL update PRs in draft until arch configs committed (René) #66398
  • [2d3be6adf2] - tools: update gyp-next to 0.22.3 (Node.js GitHub Bot) #66397
  • [5f54bc7763] - tools: fix Nix diff tools when pushing more than 1 commit (Antoine du Hamel) #66383
  • [2c06236669] - tools: reduce bundle size of benchmarkTools.nix (tools: reduce bundle size of benchmarkTools.nix #65388) (Antoine du Hamel) #65388
  • [b10949cdca] - tools: add deps/LIEF to the ignore list of test-shared.yml (Antoine du Hamel) #66342
  • [80cd5d8143] - tools: bump the doc group in /tools/doc with 4 updates (dependabot[bot]) #66295
  • [aaaca48ce8] - tools: check CI availability and workload (Filip Skokan) #66280
  • [0607f14c3a] - tools: enable temporal by default in Nix integration (Antoine du Hamel) #66267
  • [605938efb3] - tools: reduce source tarball compression in CI (inoway46) #66228
  • [0913452391] - tools: add lief to automated dependency updates (René) #66242
  • [63469ca078] - tools: add resume-ci label handling (Filip Skokan) #65945
  • [8e79b1fa36] - typings: wire up spawn_sync internal binding types (agape1225) #65996
  • [0845991255] - typings: share AsyncWrap and HandleWrap types (Seongeun Lee) #66150
  • [e90ba99def] - typings: add mksnapshot internal binding types (Seongeun Lee) #65901
  • [8623a13d97] - typings: wire up quic internal binding types (agape1225) #65556
  • [7202aa55a7] - url: create URLSearchParams collision map lazily (Romain Lanz) #65801
  • [aff60171cd] - util: make mime parsing faster (James M Snell) #66369
  • [83a1697f1c] - util: fix inspect indentation of detached DataView (Miodrag Obradovic) #66421
  • [33ef1780fd] - util: show SuppressedError's error/suppressed properties on inspect (agape1225) #66159
  • [dbb0e6e164] - util,assert: expose util.isPartialDeepStrictEqual() (Thomas Hunter II) #66118
  • [afb61d6ca4] - vfs: make the reserved root readable through fs (Philipp Dunkel) #66140
  • [83c0e30cd7] - vfs: drop --vfs-mount, pin the load mount point (Philipp Dunkel) #66162
  • [9656992aff] - vfs: support recursive readdir in ZipProvider (Philipp Dunkel) #66127
  • [d5b65c3b94] - vfs: validate ZipProvider parent directories (Trivikram Kamat) #65829
  • [41e9ab96cd] - watch: escape quotes and backslashes in NODE_OPTIONS (Trivikram Kamat) #66363
  • [17964bb699] - watch: detect files replaced via unlink and create (Marco) #63888
  • [be7f637d0e] - watch: strip watch flags from NODE_OPTIONS in child process (Marco) #62143
  • [6c23e21c00] - worker: discard queued messages on termination (Filip Skokan) #66354
  • [ee51b0412f] - worker: serialize messages after exit (Filip Skokan) #66354
  • [c2c5f4ccbe] - worker: preserve blob module URLs (Filip Skokan) #66354
  • [05d533ede5] - worker: convert importScripts arguments first (Filip Skokan) #66354
  • [230cd0ce43] - worker: fix postMessage overload resolution (Filip Skokan) #66354
  • [78b502a565] - worker: add Symbol.toStringTag to BroadcastChannel (Lazizbek Ergashev) #65532
  • [56e6a5c8d8] - worker: add Symbol.toStringTag to MessageChannel and MessagePort (Lazizbek Ergashev) #65532
  • [b896580c47] - worker: remove messageerror listeners on exit (Dayun) #66075
  • [19732fc576] - worker: strip types in Web Worker module entries (Hubert Walczak) #66085
  • [bb3d33e610] - zlib: fix abort with decodeStrings: false (James Ross) #66359
  • [9b350d80ff] - zlib: pledge input size in async zstdCompress() (James Ross) #66358
  • [6c927c0009] - zlib: preserve brotli params and dictionary on reset (Xia Chao) #66157
  • [54e93301a1] - zlib: reject reset after gzip/deflate emitted incomplete output (Xia Chao) #66179
  • [d84b4550e5] - zlib: reject reset while a zstd frame is incomplete (Xia Chao) #66088

jasnell and others added 30 commits September 27, 2026 17:26
Signed-off-by: James M Snell <jasnell@gmail.com>
Assisted-by: Opencode
PR-URL: #66030
Reviewed-By: Filip Skokan <panva.ip@gmail.com>
Reviewed-By: Trivikram Kamat <trivikr.dev@gmail.com>
Signed-off-by: James M Snell <jasnell@gmail.com>
Assisted-by: Opencode
PR-URL: #66030
Reviewed-By: Filip Skokan <panva.ip@gmail.com>
Reviewed-By: Trivikram Kamat <trivikr.dev@gmail.com>
Signed-off-by: James M Snell <jasnell@gmail.com>
Assisted-by: Opencode
PR-URL: #66030
Reviewed-By: Filip Skokan <panva.ip@gmail.com>
Reviewed-By: Trivikram Kamat <trivikr.dev@gmail.com>
Reject attempts to create archive entries beneath non-directory
parents. Cover open, mkdir, and rename in the sync and async APIs.

Signed-off-by: Kamat, Trivikram <16024985+trivikr@users.noreply.github.com>
Assisted-by: codex
PR-URL: #65829
Fixes: #65828
Reviewed-By: James M Snell <jasnell@gmail.com>
An object literal with computed symbol keys is rebuilt through the
runtime every time it is evaluated, close to a microsecond each. pipeTo,
tee and the byte tee materialized their internal read request as such
a literal once per pipe or tee, and the byte tee's BYOB path did so on
every read. The requests are now instances of one small class holding
the three step functions.

A source without pull() ran the pull bookkeeping anyway: two reaction
closures and a microtask per read whose only effect was to clear the
pulling flag. Push-style sources now skip it.

The default tee's pull algorithm was an async function and the byte
tee's returned a fresh resolved promise; both now return nothing, which
reaches the controller's pull-fulfilled step at the same microtask
position without the promise.

ReadableStreamBYOBReader.prototype.read() was an async method, so the
read request's promise was adopted through a wrapper (an extra promise
and two microtask hops per read). It now returns the request's promise
directly, as the spec does; argument errors still become rejections.

A TransformStream without start() no longer allocates the start promise
record: the sides adopt a promise that is already resolved either way.

Signed-off-by: Matteo Collina <hello@matteocollina.com>
PR-URL: #66154
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Mattias Buelens <mattias@buelens.com>
Describe signals as an iterable of AbortSignals, matching the WebIDL
sequence conversion and the existing iterable test.

Signed-off-by: haramjeong <04harams77@gmail.com>
Assisted-by: Codex
PR-URL: #66123
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
ZipProvider threw ERR_METHOD_NOT_IMPLEMENTED for readdir() with
`{ recursive: true }`, although an archive already stores every member
under its full path, so a recursive listing is the same scan of the
entry names as a flat one, keeping the whole path below the directory
instead of only its first segment.

List every member below the directory, and every directory their paths
pass through, whether the archive holds an entry for it or only implies
it. Names are relative to the listed directory and joined with `/`, as
MemoryProvider returns them, so VirtualFileSystem reports the right
parentPath for each Dirent. A name that is both a member and a
directory is listed once, as a directory, as a flat listing already
did.

The entries are now collected in a map rather than looked up in an
array, so listing a directory no longer takes time quadratic in the
number of its children.

Signed-off-by: Philipp Dunkel <pip@pipobscure.com>
PR-URL: #66127
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
Refresh conditional algorithm registration on FIPS changes and use the
current state for parameter restrictions.

Use per-algorithm availability checks in normalization and native named
key generation. Remove getPqcKeyTypes().

Enable supports() tests under FIPS and cover state transitions in warmed
workers.

Signed-off-by: Filip Skokan <panva.ip@gmail.com>
Assisted-by: Codex
PR-URL: #66160
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
`SetIsolateMiscHandlers()` always installs Node.js's
`WebAssembly.compileStreaming()` implementation, which is backed by the
Environment's fetch-based handler. An embedder that provides its own
streaming callback (for example one wired to its own network stack) has
to re-install it after every `SetIsolateUpForNode()` or `NewIsolate()`
call. Add `SHOULD_NOT_SET_WASM_STREAMING_CALLBACK` next to the existing
`SHOULD_NOT_SET_PROMISE_REJECTION_CALLBACK` and
`SHOULD_NOT_SET_PREPARE_STACK_TRACE_CALLBACK` flags so it can opt out
the same way.

Refs: #36447
Signed-off-by: Shelley Vohr <shelley.vohr@gmail.com>
PR-URL: #65690
Reviewed-By: Chengzhong Wu <legendecas@gmail.com>
Omit execArgv: the worker keeps the parent's CLI flags, including
--permission and --allow-*. Explicit execArgv (including []) replaces
inheritance and can drop those grants. That is intended.
Documented after #65359. No runtime change.

Refs: #65359
Signed-off-by: yunshingng <yunshingng25@gmail.com>
PR-URL: #66124
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Rafael Gonzaga <rafael.nunu@hotmail.com>
Signed-off-by: Yuki Motokane <216834584+motokaneyuki@users.noreply.github.com>
PR-URL: #66181
Refs: nodejs/doc-kit#953
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Tim Perry <pimterry@gmail.com>
Reviewed-By: Xuguang Mei <meixuguang@gmail.com>
Use isolated directories for the NODE_OPTIONS watch paths to avoid
recursively watching the repository's source and test trees. Allow a
platform-scaled 10 seconds for startup and restarts.

Remove the flaky markers for test-watch-mode and
test-watch-mode-inspect. The inspector restart race was already fixed
in f2aaf63.

Signed-off-by: Filip Skokan <panva.ip@gmail.com>
Assisted-by: Codex
PR-URL: #66232
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
Reviewed-By: Moshe Atlow <moshe@atlow.co.il>
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
PR-URL: #66141
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Aviv Keller <me@aviv.sh>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Filip Skokan <panva.ip@gmail.com>
Signed-off-by: Mert Can Altin <mertgold60@gmail.com>
PR-URL: #64344
Refs: #59051
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Joyee Cheung <joyeec9h3@gmail.com>
Reviewed-By: Gürgün Dayıoğlu <hey@gurgun.day>
Original commit message:

    Fix Temporal compilation with system or no ICU

    build: Fix Temporal compilation with system or no ICU

    Add new build flag, v8_enable_temporal_systemicu, off by default When
    on, it will remove references to the internal ICU udatamem.h header file

    Obviates CLs 7769990 / 7831715

    See: https://unicode-org.atlassian.net/browse/ICU-23400 See: Node:
    #62676 See: V8:
    https://chromium-review.googlesource.com/c/v8/v8/+/7831715 See:
    Homebrew: Homebrew/homebrew-core#281707
    Change-Id: Ibc460c68189d32e154c53eddfcda56bc7bca4fc6

    Also includes:

    fix: fix for no-icu build

    thanks @aduh95
    #62676 (comment)

    NO_IFTTT=No Temporal via Bazel

    Change-Id: Ibc460c68189d32e154c53eddfcda56bc7bca4fc6
    Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/8281487
    Reviewed-by: Toon Verwaest <verwaest@chromium.org>
    Commit-Queue: Chengzhong Wu <cwu631@bloomberg.net>
    Reviewed-by: Olivier Flückiger <olivf@chromium.org>
    Cr-Commit-Position: refs/heads/main@{#110039}

Refs: v8/v8@9fb4444
PR-URL: #65992
Fixes: #62676
Refs: srl295/v8@cd89fe6
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
Reviewed-By: Chengzhong Wu <legendecas@gmail.com>
Reviewed-By: Joyee Cheung <joyeec9h3@gmail.com>
Reviewed-By: Richard Lau <richard.lau@ibm.com>
- switch needed to enable Temporal with system-icu
- also update configure.py to no longer disable Temporal

Signed-off-by: Steven R. Loomis <srl295@gmail.com>
PR-URL: #65992
Fixes: #62676
Refs: srl295/v8@cd89fe6
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
Reviewed-By: Chengzhong Wu <legendecas@gmail.com>
Reviewed-By: Joyee Cheung <joyeec9h3@gmail.com>
Reviewed-By: Richard Lau <richard.lau@ibm.com>
Zero-length FFI memory operations accept a null pointer, but
ToArrayBuffer() and ExportBytes() call memcpy() unconditionally.
Passing a null pointer to memcpy() is undefined behavior even when
the size is zero.

Skip the copy when the length is zero, matching what Buffer::Copy()
already does for the same case.

An isolated reproduction compiled with -fsanitize=undefined reports
"null pointer passed as argument 1, which is declared to never be
null". The added test covers the reachable zero-length paths, but it
passes without the fix: libc does not fault on memcpy(NULL, NULL, 0),
and --enable-ubsan does not set -fno-sanitize-recover, so UBSan
reports the call without failing the process.

Signed-off-by: Christian Aurich Zanettini Martins <christian.aurichzm@gmail.com>
PR-URL: #66200
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
Reviewed-By: Trivikram Kamat <trivikr.dev@gmail.com>
Reviewed-By: Rafael Gonzaga <rafael.nunu@hotmail.com>
Signed-off-by: Antoine du Hamel <duhamelantoine1995@gmail.com>
PR-URL: #66206
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
Signed-off-by: Filip Skokan <panva.ip@gmail.com>
Assisted-by: Codex
PR-URL: #65945
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
fs.rmSync() is implemented with std::filesystem::remove_all(). When a
read-only directory has a child, libc++ before LLVM 23 drops the
child's EACCES and reports the ENOTEMPTY it then gets for the parent
instead. The test pinned that behavior to macOS, but it depends on the
C++ standard library rather than on the OS: a Linux build against
libc++ fails the test when run as non-root, and macOS will start
reporting EACCES once it ships the fixed libc++. Accept either code
for that case on all POSIX platforms.

Refs: llvm/llvm-project#197104
Refs: #57103
Signed-off-by: Shelley Vohr <shelley.vohr@gmail.com>
PR-URL: #66065
Reviewed-By: Xuguang Mei <meixuguang@gmail.com>
Signed-off-by: RafaelGSS <rafael.nunu@hotmail.com>
PR-URL: #66208
Reviewed-By: Santiago Gimeno <santiago.gimeno@gmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
Signed-off-by: Chengzhong Wu <cwu631@bloomberg.net>
PR-URL: #66068
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
These have been shipped and stable since v22/v23

Signed-off-by: James M Snell <jasnell@gmail.com>
PR-URL: #66213
Reviewed-By: Gürgün Dayıoğlu <hey@gurgun.day>
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
Signed-off-by: James M Snell <jasnell@gmail.com>
Assisted-by: Opencode
PR-URL: #66079
Reviewed-By: Trivikram Kamat <trivikr.dev@gmail.com>
Signed-off-by: James M Snell <jasnell@gmail.com>
Assisted-by: Opencode
PR-URL: #66079
Reviewed-By: Trivikram Kamat <trivikr.dev@gmail.com>
Signed-off-by: James M Snell <jasnell@gmail.com>
Assisted-by: Opencode
PR-URL: #66079
Reviewed-By: Trivikram Kamat <trivikr.dev@gmail.com>
Signed-off-by: James M Snell <jasnell@gmail.com>
Assisted-by: Opencode
PR-URL: #66079
Reviewed-By: Trivikram Kamat <trivikr.dev@gmail.com>
Signed-off-by: James M Snell <jasnell@gmail.com>
Assisted-by: Opencode
PR-URL: #66079
Reviewed-By: Trivikram Kamat <trivikr.dev@gmail.com>
Signed-off-by: James M Snell <jasnell@gmail.com>
PR-URL: #66079
Reviewed-By: Trivikram Kamat <trivikr.dev@gmail.com>
Just say no to `new Promise(() => timer(...))` use
promisified timers

Signed-off-by: James M Snell <jasnell@gmail.com>
PR-URL: #66079
Reviewed-By: Trivikram Kamat <trivikr.dev@gmail.com>
vedchaudhari and others added 9 commits October 6, 2026 01:42
Install the Markdown linter before formatting and exit afterwards.

Assisted-by: Claude Code
Signed-off-by: vedchaudhari <vedc2853@gmail.com>
PR-URL: #66475
Refs: #66467
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Stefan Stojanovic <stefan.stojanovic@janeasystems.com>
Signed-off-by: Gaby Baghdadi <baghdadi@ca.ibm.com>
PR-URL: #66449
Reviewed-By: Richard Lau <richard.lau@ibm.com>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
- Don't use icu data file on z/OS; use libnode's bundled ICU data.
- Include required defines, cflags, ldflags, and remove unsupported
  ones, following switch to clang compiler.
- Remove _ALL_SOURCE, as _POSIX_C_SOURCE and _POSIX_SOURCE already
  enable all required library functions (in deps/uv/CMakeLists.txt, only
  _OPEN_SYS is required to enable setgroups (in grp.h) instead of
  _ALL_SOURCE); also remove dup _OPEN_SYS_SOCK_IPV6.
- Add -D_EXT to defines (for setenv, and vsam.js' `__KEY_*` macros).
- Add _POSIX_C_SOURCE=200809L to enable at least `utimensat`.
- Add clang option -mzos-target=zosv2r5 also to ldflags, otherwise the
  default LE dataset is used that may not be for the current target.
- Add -m64 to ldflags, otherwise ld passes `AMODE=31,LIST,..` to
  the binder, causing unresolved symbols if the non-64 suffixed version
  of the compiler was used (e.g. ibm-clang instead of ibm-clang64).
- Add zoslib/include-wrappers/c++ in include_dirs for custom aligned new
  and delete operators.

PR-URL: #66449
Reviewed-By: Richard Lau <richard.lau@ibm.com>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Signed-off-by: Gaby Baghdadi <baghdadi@ca.ibm.com>
Signed-off-by: Richard Lau <richard.lau@ibm.com>
Skip the V8 and OpenSSL vendored trees when checking out sources for
lint-cpp. Keep other paths included so new directories are checked out
by default.

Assisted-by: Codex
Signed-off-by: inoway46 <inoueyuya416@gmail.com>
PR-URL: #66474
Reviewed-By: Filip Skokan <panva.ip@gmail.com>
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Bumps [github/codeql-action/upload-sarif](https://github.com/github/codeql-action) from 4.38.0 to 4.38.2.
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](github/codeql-action@b96794f...2892aa5)

---
updated-dependencies:
- dependency-name: github/codeql-action/upload-sarif
  dependency-version: 4.38.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
PR-URL: #66447
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Trivikram Kamat <trivikr.dev@gmail.com>
Bumps [github/codeql-action/init](https://github.com/github/codeql-action) from 4.38.0 to 4.38.2.
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](github/codeql-action@b96794f...2892aa5)

---
updated-dependencies:
- dependency-name: github/codeql-action/init
  dependency-version: 4.38.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
PR-URL: #66446
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Trivikram Kamat <trivikr.dev@gmail.com>
Bumps [github/codeql-action/autobuild](https://github.com/github/codeql-action) from 4.38.0 to 4.38.2.
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](github/codeql-action@b96794f...2892aa5)

---
updated-dependencies:
- dependency-name: github/codeql-action/autobuild
  dependency-version: 4.38.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
PR-URL: #66444
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Trivikram Kamat <trivikr.dev@gmail.com>
Bumps [github/codeql-action/analyze](https://github.com/github/codeql-action) from 4.38.0 to 4.38.2.
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](github/codeql-action@b96794f...2892aa5)

---
updated-dependencies:
- dependency-name: github/codeql-action/analyze
  dependency-version: 4.38.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
PR-URL: #66443
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Trivikram Kamat <trivikr.dev@gmail.com>
When stripping watch flags, NODE_OPTIONS is tokenized and rejoined
for the child process. Values were only re-quoted if they contained
a space, and nothing inside the quotes was escaped. A value with a
double quote made the child fail with "unterminated string", and a
backslash inside a quoted value was silently dropped.

Quote values that contain a space or a double quote, and escape
backslashes and double quotes inside the quotes, so the child
tokenizes the string back to the same values.

Signed-off-by: Trivikram Kamat <16024985+trivikr@users.noreply.github.com>
Assisted-by: claude:opus-5.5
PR-URL: #66363
Fixes: #66362
Reviewed-By: Moshe Atlow <moshe@atlow.co.il>
@github-actions github-actions Bot added release Issues and PRs related to Node.js releases. v26.x Issues that can be reproduced on v26.x or PRs targeting the v26.x-staging branch. labels Oct 5, 2026
@nodejs-github-bot

Copy link
Copy Markdown
Collaborator

Review requested:

  • @nodejs/actions
  • @nodejs/performance
  • @nodejs/security-wg
  • @nodejs/tsc

nodejs-github-bot added a commit that referenced this pull request Oct 5, 2026
Notable changes:

benchmark:
  * (SEMVER-MINOR) add http header validator benchmark (James M Snell) #66334
buffer:
  * (SEMVER-MINOR) add isLatin1 (James M Snell) #66298
  * (SEMVER-MINOR) add isLatin1 (James M Snell) #66298
  * (SEMVER-MINOR) add Buffer.stringLength() (Matteo Collina) #66064
build, doc:
  * move to redesign (Aviv Keller) #62045
http:
  * (SEMVER-MINOR) add isValidHeaderName() and isValidHeaderValue() (James M Snell) #66334
http2:
  * (SEMVER-MINOR) add new connectionWindowSize option (Tim Perry) #65619
lib:
  * (SEMVER-MINOR) fix stream loading bug in node:bench (James M Snell) #66114
perf_hooks:
  * (SEMVER-MINOR) fix truncation of monitorEventLoopDelay() resolution (James M Snell) #66115
  * (SEMVER-MINOR) allow RecordableHistogram to record 0 (James M Snell) #66114
  * (SEMVER-MINOR) add histogram.diff() (James M Snell) #66099
  * (SEMVER-MINOR) report histogram memory to V8 (James M Snell) #66099
  * (SEMVER-MINOR) add histogram.snapshot() (James M Snell) #66099
  * (SEMVER-MINOR) add histogram export format version 2 (James M Snell) #66098
  * (SEMVER-MINOR) harden histogram CBOR import validation (James M Snell) #66098
process:
  * (SEMVER-MINOR) graduate process.ref/unref from experimental (James M Snell) #66213
sqlite:
  * (SEMVER-MINOR) rename DatabaseSync and StatementSync (Guilherme Araújo) #65988
src:
  * (SEMVER-MINOR) add --process-timeout=N (James M Snell) #66138
  * (SEMVER-MINOR) expose size and count in heap profile output (Ilyas Shabi) #65737
  * (SEMVER-MINOR) let embedders exempt linked bindings from the addon permission (Shelley Vohr) #66067
test:
  * deflake sliding window histogram test (James M Snell) #66132

PR-URL: #66546
@nodejs-github-bot

nodejs-github-bot commented Oct 6, 2026 •

Copy link
Copy Markdown
Collaborator

This is the certdata.txt[0] from NSS 3.129.

This is the version of NSS that shipped in Firefox 157.0 on 2026-09-29.

[0] https://raw.githubusercontent.com/nss-dev/nss/refs/tags/NSS_3_129_RTM/lib/ckfw/builtins/certdata.txt

PR-URL: #66496
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Moshe Atlow <moshe@atlow.co.il>
PR-URL: #66494
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
PR-URL: #66492
Reviewed-By: Filip Skokan <panva.ip@gmail.com>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
PR-URL: #66493
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Jake Yuesong Li <jake.yuesong@gmail.com>
@aduh95
aduh95 force-pushed the v26.11.0-proposal branch from 7f68d75 to 6023800 Compare October 6, 2026 10:42
aduh95 pushed a commit that referenced this pull request Oct 6, 2026
Notable changes:

buffer:
  * (SEMVER-MINOR) add isLatin1 (James M Snell) #66298
  * (SEMVER-MINOR) add Buffer.stringLength() (Matteo Collina) #66064
build, doc:
  * move to redesign (Aviv Keller) #62045
http:
  * (SEMVER-MINOR) add isValidHeaderName() and isValidHeaderValue() (James M Snell) #66334
http2:
  * (SEMVER-MINOR) add new connectionWindowSize option (Tim Perry) #65619
perf_hooks:
  * (SEMVER-MINOR) fix truncation of monitorEventLoopDelay() resolution (James M Snell) #66115
  * (SEMVER-MINOR) allow RecordableHistogram to record 0 (James M Snell) #66114
  * (SEMVER-MINOR) add histogram.diff() (James M Snell) #66099
  * (SEMVER-MINOR) report histogram memory to V8 (James M Snell) #66099
  * (SEMVER-MINOR) add histogram.snapshot() (James M Snell) #66099
  * (SEMVER-MINOR) add histogram export format version 2 (James M Snell) #66098
  * (SEMVER-MINOR) harden histogram CBOR import validation (James M Snell) #66098
process:
  * (SEMVER-MINOR) graduate process.ref/unref from experimental (James M Snell) #66213
sqlite:
  * (SEMVER-MINOR) rename DatabaseSync and StatementSync (Guilherme Araújo) #65988
src:
  * (SEMVER-MINOR) add --process-timeout=N (James M Snell) #66138
  * (SEMVER-MINOR) expose size and count in heap profile output (Ilyas Shabi) #65737
  * (SEMVER-MINOR) let embedders exempt linked bindings from the addon permission (Shelley Vohr) #66067

PR-URL: #66546
@aduh95
aduh95 marked this pull request as ready for review October 6, 2026 10:44
@github-actions

This comment was marked as outdated.

@nodejs-github-bot

This comment was marked as outdated.

sxa and others added 2 commits October 6, 2026 13:14
kernel >= 6.12, musl >= 1.2.5 updated to align with
lowest supported version Alpine Linux 3.21
see https://alpinelinux.org/releases/
see https://alpinelinux.org/posts/Alpine-3.21.0-released.html

Alpine 3.22 listed as example version

Signed-off-by: Stewart X Addison <sxa@ibm.com>
PR-URL: #63737
Backport-PR-URL: #66353
Reviewed-By: Stewart X Addison <sxa@redhat.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Richard Lau <richard.lau@ibm.com>
Notable changes:

buffer:
  * (SEMVER-MINOR) add isLatin1 (James M Snell) #66298
  * (SEMVER-MINOR) add Buffer.stringLength() (Matteo Collina) #66064
build, doc:
  * move to redesign (Aviv Keller) #62045
doc:
  * promote Alpine Linux to tier 2 support (Stewart X Addison) #63737
http:
  * (SEMVER-MINOR) add isValidHeaderName() and isValidHeaderValue() (James M Snell) #66334
http2:
  * (SEMVER-MINOR) add new connectionWindowSize option (Tim Perry) #65619
perf_hooks:
  * (SEMVER-MINOR) fix truncation of monitorEventLoopDelay() resolution (James M Snell) #66115
  * (SEMVER-MINOR) allow RecordableHistogram to record 0 (James M Snell) #66114
  * (SEMVER-MINOR) add histogram.diff() (James M Snell) #66099
  * (SEMVER-MINOR) add histogram.snapshot() (James M Snell) #66099
  * (SEMVER-MINOR) harden histogram CBOR import validation (James M Snell) #66098
process:
  * (SEMVER-MINOR) graduate process.ref/unref from experimental (James M Snell) #66213
sqlite:
  * (SEMVER-MINOR) rename DatabaseSync and StatementSync (Guilherme Araújo) #65988
src:
  * (SEMVER-MINOR) add --process-timeout=N (James M Snell) #66138
  * (SEMVER-MINOR) expose size and count in heap profile output (Ilyas Shabi) #65737
  * (SEMVER-MINOR) let embedders exempt linked bindings from the addon permission (Shelley Vohr) #66067

PR-URL: #66546
@aduh95
aduh95 force-pushed the v26.11.0-proposal branch from 6023800 to 49072a0 Compare October 6, 2026 11:30
@nodejs-github-bot

nodejs-github-bot commented Oct 6, 2026 •

Copy link
Copy Markdown
Collaborator

@github-actions

github-actions Bot commented Oct 6, 2026

Copy link
Copy Markdown
Contributor Author
Platform Number of requisites Proportion of new derivations
x86_64-linux 511 -> 513 => +2 5 / 513 = 0.9%
aarch64-linux 512 -> 514 => +2 5 / 514 = 0.9%
x86_64-darwin 448 -> 451 => +3 5 / 451 = 1.1%
aarch64-darwin 450 -> 453 => +3 5 / 453 = 1.1%
Total 1921 -> 1931 => +10 20 / 1931 = 1.0%
Changelog
@@ -394,2 +393,0 @@
-/nix/store/zds441j554l2dfpda4q42jk9jd5zzmsb-glibc-locales-2.42-61 (aarch64-linux)
-/nix/store/lh5ljhh7xn7p3yy8blh0kjk14kni0zb7-glibc-locales-2.42-61 (x86_64-linux)
@@ -870,0 +869,4 @@
+/nix/store/jqg0r6vr1q1lsl0683lc46s5hkxr23h5-linenoise-2.0 (aarch64-darwin)
+/nix/store/r7b18r48ha0bav7mhspza2r439ycnwrj-linenoise-2.0 (aarch64-linux)
+/nix/store/2h4fm3mzpf1190nl3anqgzi289gxhzqv-linenoise-2.0 (x86_64-darwin)
+/nix/store/s8jk7hankv4ng5d5pqz7kjzxwqy0kmzv-linenoise-2.0 (x86_64-linux)
@@ -1339,8 +1341,16 @@
-/nix/store/b27xnafjjpy07dr7qjiwj04agaf704yk-perfetto-sdk-58.2 (aarch64-darwin)
-/nix/store/kiwsc84kxcg8n465nkd5k2hbkyqv555q-perfetto-sdk-58.2 (aarch64-linux)
-/nix/store/s7l1dywyvb5hj4zgmkm5156h06lqwa9w-perfetto-sdk-58.2 (x86_64-darwin)
-/nix/store/bal0a4hdwd9x32vmfgzbkhbr3f80ygid-perfetto-sdk-58.2 (x86_64-linux)
-/nix/store/dm9p6rnr204982vw5vw6q55j16w4vqkq-perfetto-sdk-58.2-dev (aarch64-darwin)
-/nix/store/pxfrag2k2pxmxc48wr9gdpzmqg9mas0m-perfetto-sdk-58.2-dev (aarch64-linux)
-/nix/store/w2c535v3i80mk2nn4lg2by23m1lz6842-perfetto-sdk-58.2-dev (x86_64-darwin)
-/nix/store/si74y3znclrxhd43pj3qi445iz08rz9j-perfetto-sdk-58.2-dev (x86_64-linux)
+/nix/store/73i4z3r0f7rnp5wwdjzpwvn4i4yrqsv8-perfetto-58.3 (aarch64-darwin)
+/nix/store/3386dmy0168f1yjp4r21n3wj4brcgjgg-perfetto-58.3 (aarch64-linux)
+/nix/store/yvqmjh9kqq6qxwjncgxqni30pdgwpb8m-perfetto-58.3 (x86_64-darwin)
+/nix/store/yqijlkmjdigx0g9gbh7nidqw9m5y5s5q-perfetto-58.3 (x86_64-linux)
+/nix/store/bq9mhrais2jiy79y6jk50ac50py0c7h1-perfetto-58.3-tools (aarch64-darwin)
+/nix/store/4swvlsxwmnplz62vf5hir5cjy0id6ksx-perfetto-58.3-tools (aarch64-linux)
+/nix/store/zz4lmdcy46apy7sp1d07akwa2wgkfg3f-perfetto-58.3-tools (x86_64-darwin)
+/nix/store/64ysqd0p2q3i238zcy2z65qz5pamq2rf-perfetto-58.3-tools (x86_64-linux)
+/nix/store/a18p9b70wgwvvq06a2xh9npdww0pibkg-perfetto-sdk-58.3 (aarch64-darwin)
+/nix/store/9x36vyk7rjz0zr0fb8iymx1665qa62rg-perfetto-sdk-58.3 (aarch64-linux)
+/nix/store/3gyxiw1h086vk5phlyi9aswp93gbjq5c-perfetto-sdk-58.3 (x86_64-darwin)
+/nix/store/n02r987wc2lgcya77zfsixq4rbjqzk1r-perfetto-sdk-58.3 (x86_64-linux)
+/nix/store/5s2kldlzh7hky4qwjb6nvvn8j7nw9vw0-perfetto-sdk-58.3-dev (aarch64-darwin)
+/nix/store/rkjwnhs63hbrxry1hmjszmar2n4wyfyv-perfetto-sdk-58.3-dev (aarch64-linux)
+/nix/store/d8lw7v5p5dfn9mppn8mpdbggnbb1yjga-perfetto-sdk-58.3-dev (x86_64-darwin)
+/nix/store/z3nbz3mzvs852pls5fj9cg84vaxaz66m-perfetto-sdk-58.3-dev (x86_64-linux)

@codecov

codecov Bot commented Oct 6, 2026

Copy link
Copy Markdown

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 90.73%. Comparing base (151845a) to head (49072a0).
⚠️ Report is 1 commits behind head on v26.x.

Additional details and impacted files
@@            Coverage Diff             @@
##            v26.x   #66546      +/-   ##
==========================================
+ Coverage   90.57%   90.73%   +0.15%     
==========================================
  Files         775      774       -1     
  Lines      268123   271787    +3664     
  Branches    51114    52069     +955     
==========================================
+ Hits       242863   246601    +3738     
+ Misses      16201    16072     -129     
- Partials     9059     9114      +55     

see 192 files with indirect coverage changes

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
  • 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

release Issues and PRs related to Node.js releases. v26.x Issues that can be reproduced on v26.x or PRs targeting the v26.x-staging branch.

Projects

None yet

Development

Successfully merging this pull request may close these issues.