2026-07-08, Version 26.5.0 (Current)#64329
Open
github-actions[bot] wants to merge 131 commits into
Open
Conversation
Delegate broadcast.push() and share.pull() calls with per-consumer AbortSignals through pull(), so pending next() calls reject when the signal aborts. Signed-off-by: Kamat, Trivikram <16024985+trivikr@users.noreply.github.com> Assisted-by: openai:gpt-5.5 PR-URL: #63997 Fixes: #63302 Reviewed-By: James M Snell <jasnell@gmail.com> Reviewed-By: Filip Skokan <panva.ip@gmail.com>
Use the abort-aware iterator wrapper in the no-transform pipeTo() path so a pending source read does not block AbortSignal handling. Fixes: #64014 Signed-off-by: Kamat, Trivikram <16024985+trivikr@users.noreply.github.com> Assisted-by: openai:gpt-5.5 PR-URL: #64015 Fixes: #64014 Reviewed-By: Matteo Collina <matteo.collina@gmail.com> Reviewed-By: Filip Skokan <panva.ip@gmail.com>
PR #62782 updated the keepAliveTimeout default from 5s to 65s and correctly updated server.keepAliveTimeout (line 2006), but the http.createServer() options table at line 3775 was not updated. Fix the remaining reference to reflect the current default of 65000ms. Signed-off-by: Jahanzaib iqbal <jahanzaib@gsoftconsulting.com> PR-URL: #63974 Reviewed-By: Tim Perry <pimterry@gmail.com> Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Emit the standard JUnit timestamp (ISO 8601) on <testsuite> elements, which the reporter was omitting. The suite start time is reconstructed as end-minus-duration, because the runner reports a suite's test:start lazily (when its first subtest reports), which would otherwise record a time close to the suite's end. Fixes: #64028 Signed-off-by: sangwook <rewq5991@gmail.com> PR-URL: #64029 Reviewed-By: Moshe Atlow <moshe@atlow.co.il> Reviewed-By: Jacob Smith <jacob@frende.me>
`EncodeUtf8String`, which backs `TextEncoder.prototype.encode()`, copied
the entire source string out of the V8 heap into a `MaybeStackBuffer`
(via `WriteOneByteV2`/`WriteV2`) before encoding, allocating on the heap
for strings larger than the stack buffer. `EncodeInto` already avoids
this by reading the flat content directly through
`v8::String::ValueView`.
Read the flat content via `ValueView` instead. Because `ValueView` holds
a `DisallowGarbageCollection` scope, the backing store cannot be
allocated while it is alive, so the view is used in two short scopes:
one to validate and compute the exact UTF-8 length, and one to encode
directly into the backing store after allocation. Flattening is cached
on the string, so re-acquiring the view is cheap. The rare unpaired
surrogate path still copies into a mutable buffer for in-place
`to_well_formed_utf16`.
benchmark/util/text-encoder.js (op=encode, n=1e6, 12 runs each):
len=256 len=1024 len=8192
ascii +14.1% +23.5% +43.9%
one-byte (latin1) +14.4% +22.2% +12.3%
two-byte (utf-16) +16.7% +20.4% +15.5%
len=32 uses the unchanged small-string path (~noise). The untouched
encodeInto path stayed flat (-2.0%..+0.5%) across all configurations.
Signed-off-by: Yagiz Nizipli <yagiz@nizipli.com>
PR-URL: #63897
Reviewed-By: Anna Henningsen <anna@addaleax.net>
Reviewed-By: Filip Skokan <panva.ip@gmail.com>
Signed-off-by: Matthew Aitken <maitken033380023@gmail.com> PR-URL: #64036 Refs: w3c/FileAPI@cd1d1da Refs: nodejs/undici@0d6ecc5 Reviewed-By: René <contact.9a5d6388@renegade334.me.uk> Reviewed-By: Matteo Collina <matteo.collina@gmail.com> Reviewed-By: Gürgün Dayıoğlu <hey@gurgun.day> Reviewed-By: Luigi Pinca <luigipinca@gmail.com> Reviewed-By: Mattias Buelens <mattias@buelens.com>
PR-URL: #64039 Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com> Reviewed-By: Filip Skokan <panva.ip@gmail.com> Reviewed-By: Colin Ihrig <cjihrig@gmail.com> Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Merely loading the repl builtin used to eagerly require acorn and
acorn-walk (~250KB of JS) and create an entire V8 context via
vm.runInNewContext() just to enumerate global property names, even
though both are only needed once REPL input is actually parsed or
tab-completion is used.
Require acorn and acorn-walk at their function-level use sites
instead, and wrap the global builtins set in getLazy(). The cost
moves to the first preview/completion/recoverable-error check,
where the one-time ~1ms is imperceptible.
Benchmark results (Linux x64, misc/startup-core.js, 20 runs):
require-builtins.js: +3.12% ops/s (t=3.57, p<0.01)
import-builtins.mjs: +2.20% ops/s (t=3.00, p<0.01)
In isolation, require('repl') drops from 4.64ms to 2.84ms (-39%)
and interactive `node -i` startup improves by ~13%.
Signed-off-by: Daijiro Wachi <daijiro.wachi@gmail.com>
PR-URL: #63879
Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com>
V8's Minor Mark-Sweep collector, enabled with the --minor-ms flag (available since Node.js 22), reports garbage collection performance entries with kind kGCTypeMinorMarkSweep (value 2). perf_hooks exposed constants for every other GC kind (major, minor, incremental, weakcb) but not this one, so consumers inspecting performanceEntry.detail.kind had no constant to compare against and saw an unmapped value. Expose it as perf_hooks.constants.NODE_PERFORMANCE_GC_MINOR_MARK_SWEEP, mirroring the existing v8::GCType mappings, and document it alongside the other GC kinds. Signed-off-by: Attila Szegedi <attila.szegedi@datadoghq.com> PR-URL: #63877 Reviewed-By: Ruben Bridgewater <ruben@bridgewater.de> Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com> Reviewed-By: Ilyas Shabi <ilyasshabi94@gmail.com> Reviewed-By: Chengzhong Wu <legendecas@gmail.com>
Signed-off-by: Antoine du Hamel <duhamelantoine1995@gmail.com> PR-URL: #64047 Reviewed-By: René <contact.9a5d6388@renegade334.me.uk> Reviewed-By: Filip Skokan <panva.ip@gmail.com> Reviewed-By: Richard Lau <richard.lau@ibm.com>
The method-proxying loop in Readable.prototype.wrap() started at index 1, silently skipping streamKeys[0] and leaving a method at the first own-enumerable key unproxied. This was introduced in ee9e2a2 when ArrayPrototypeForEach( ObjectKeys(stream), ...) — which iterates from index 0 — was rewritten as a manual for loop for performance. The faithful translation starts at 0; a sibling loop converted in the same commit correctly does so. The bug stayed hidden because keys[0] is usually _events (a non-function), which the loop's typeof guard skips anyway. Signed-off-by: Daijiro Wachi <daijiro.wachi@gmail.com> PR-URL: #64048 Reviewed-By: Matteo Collina <matteo.collina@gmail.com> Reviewed-By: Mattias Buelens <mattias@buelens.com>
Reset process.exitCode before running the coverage threshold check. This lets the test verify the exit code set by that run() call without depending on process-global state from earlier coverage runs. Signed-off-by: Kamat, Trivikram <16024985+trivikr@users.noreply.github.com> PR-URL: #64051 Refs: https://github.com/nodejs/reliability/issues?q=%22test-runner-run-coverage%22 Reviewed-By: Chemi Atlow <chemi@atlow.co.il> Reviewed-By: Filip Skokan <panva.ip@gmail.com> Reviewed-By: Luigi Pinca <luigipinca@gmail.com> Reviewed-By: Jacob Smith <jacob@frende.me>
Signed-off-by: Guilherme Araújo <arauujogui@gmail.com> PR-URL: #63702 Reviewed-By: Stephen Belanger <admin@stephenbelanger.com> Reviewed-By: Gürgün Dayıoğlu <hey@gurgun.day>
Return false for Ed25519 and Ed448 one-shot verification when the public key or signature R component is a known low-order point. This keeps key import behavior unchanged while making WebCrypto verification match WPT expectations across OpenSSL variants. Remove the stale WPT expected-failure entry and add focused regression coverage for both curves. Closes: #54572 Signed-off-by: Filip Skokan <panva.ip@gmail.com> PR-URL: #64026 Fixes: #54572 Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com> Reviewed-By: Tobias Nießen <tniessen@tnie.de>
Signed-off-by: Ijtihed Kilani <ijtihedk@gmail.com> PR-URL: #64022 Reviewed-By: Matteo Collina <matteo.collina@gmail.com> Reviewed-By: Ruben Bridgewater <ruben@bridgewater.de> Reviewed-By: Aviv Keller <me@aviv.sh>
Include the coverage filename when parsing V8 coverage data fails, and make test-runner coverage assertions report spawned child process output when the expected coverage report is missing. Signed-off-by: Kamat, Trivikram <16024985+trivikr@users.noreply.github.com> Assisted-by: openai:gpt-5.5 PR-URL: #64050 Refs: https://github.com/nodejs/reliability/issues?q=%22parallel%2Ftest-runner-coverage%22 Reviewed-By: Moshe Atlow <moshe@atlow.co.il> Reviewed-By: Chemi Atlow <chemi@atlow.co.il>
Disable connection pooling for the client request so server.close() does not wait on an idle keep-alive socket before retrying the test. This keeps the test focused on request timeout behavior instead of HTTP keep-alive teardown timing. Signed-off-by: Kamat, Trivikram <16024985+trivikr@users.noreply.github.com> PR-URL: #64052 Refs: https://github.com/nodejs/reliability/issues?q=%22test-http-server-consumed-timeout%22 Reviewed-By: Luigi Pinca <luigipinca@gmail.com> Reviewed-By: Filip Skokan <panva.ip@gmail.com> Reviewed-By: Gürgün Dayıoğlu <hey@gurgun.day>
Signed-off-by: Rawal27 <obviouslykamal@gmail.com> PR-URL: #63912 Reviewed-By: Luigi Pinca <luigipinca@gmail.com> Reviewed-By: Trivikram Kamat <trivikr.dev@gmail.com>
The basic.any.js test compares elapsed performance.now() with elapsed Date.now(). On macos15-x64 CI, Date.now() can shift relative to the monotonic clock and exceed the test's 30 ms tolerance. Convert the status file to .cjs so the flaky expectation is scoped to macOS 15 on x64. Signed-off-by: Kamat, Trivikram <16024985+trivikr@users.noreply.github.com> PR-URL: #64054 Refs: https://github.com/nodejs/reliability/issues?q=%22wpt%2Ftest-hr-time%22 Reviewed-By: Matteo Collina <matteo.collina@gmail.com> Reviewed-By: Filip Skokan <panva.ip@gmail.com> Reviewed-By: Daijiro Wachi <daijiro.wachi@gmail.com> Reviewed-By: Jason Zhang <xzha4350@gmail.com>
Starting with Node.js 26.0.0, official binaries for AIX are built with Clang 20.1. Signed-off-by: Richard Lau <richard.lau@ibm.com> PR-URL: #64068 Reviewed-By: Chengzhong Wu <legendecas@gmail.com> Reviewed-By: Beth Griggs <bethanyngriggs@gmail.com> Reviewed-By: Luigi Pinca <luigipinca@gmail.com> Reviewed-By: Stewart X Addison <sxa@redhat.com>
Signed-off-by: parkhojeong <parkhj062@gmail.com> PR-URL: #63403 Reviewed-By: Luigi Pinca <luigipinca@gmail.com> Reviewed-By: Deokjin Kim <deokjin81.kim@gmail.com>
Signed-off-by: parkhojeong <parkhj062@gmail.com> PR-URL: #63403 Reviewed-By: Luigi Pinca <luigipinca@gmail.com> Reviewed-By: Deokjin Kim <deokjin81.kim@gmail.com>
Add a samplePerIteration option to monitorEventLoopDelay that records event loop delay from libuv event loop iterations instead of the timer interval sampler. The default remains interval-based; existing uses of monitorEventLoopDelay() keep behaving the same unless the samplePerIteration option is passed through. Signed-off-by: Pablo Erhard <pablo.erhardhernandez@datadoghq.com> PR-URL: #62935 Reviewed-By: Bryan English <bryan@bryanenglish.com> Reviewed-By: Ruben Bridgewater <ruben@bridgewater.de> Reviewed-By: James M Snell <jasnell@gmail.com>
The close fixture expects the registered object to still be reachable when the process emits exit. Keep a strong reference outside setup() so the assertion does not depend on platform-specific GC timing. Signed-off-by: Kamat, Trivikram <16024985+trivikr@users.noreply.github.com> Assisted-by: openai:gpt-5.5 PR-URL: #64085 Refs: https://github.com/nodejs/reliability/issues?q=%22test-process-finalization%22 Reviewed-By: Luigi Pinca <luigipinca@gmail.com> Reviewed-By: Gürgün Dayıoğlu <hey@gurgun.day> Reviewed-By: Stefan Stojanovic <stefan.stojanovic@janeasystems.com>
V8’s JIT infrastructure requires binaries such as mksnapshot to be run during the build. However, these binaries must have the same bit-width as the host platform (e.g. a x86_64 build platform targeting ARMv6 needs to produce a 32-bit binary). To work around this issue, allow building the binaries for the host platform and running them on the build platform with an emulator. Based on Buildroot’s nodejs-src 0001-add-qemu-wrapper-support.patch. https://gitlab.com/buildroot.org/buildroot/-/blob/c1d5eada4d4db9eeaa1c44dd1dea95a67c8a70ca/package/nodejs/nodejs-src/0001-add-qemu-wrapper-support.patch PR-URL: #53899 Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com> Reviewed-By: Aviv Keller <me@aviv.sh>
Unfortunately, `std::optional<>` implements `operator<` in such a way that this check will fail for very large generators. Since `bn_g` is unsigned, if its value does not fit into a single word, we can be certain that it is at least 2. By only checking the value if it does indeed fit into a word, the check correctly ignores very large generators. Signed-off-by: Tobias Nießen <tniessen@tnie.de> PR-URL: #64092 Reviewed-By: Filip Skokan <panva.ip@gmail.com> Reviewed-By: Anna Henningsen <anna@addaleax.net>
If the exponent does not fit into a single word, previous versions of Node.js would report an incorrect value or, recently, return `null`. Change `GetExponentString()` to handle arbitrarily large RSA public exponents properly. Signed-off-by: Tobias Nießen <tniessen@tnie.de> PR-URL: #64093 Refs: #63895 Reviewed-By: Filip Skokan <panva.ip@gmail.com> Reviewed-By: Anna Henningsen <anna@addaleax.net>
Signed-off-by: Tobias Nießen <tniessen@tnie.de> PR-URL: #64094 Reviewed-By: Juan José Arboleda <soyjuanarbol@gmail.com> Reviewed-By: Filip Skokan <panva.ip@gmail.com> Reviewed-By: Luigi Pinca <luigipinca@gmail.com> Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com> Reviewed-By: Anna Henningsen <anna@addaleax.net> Reviewed-By: Colin Ihrig <cjihrig@gmail.com> Reviewed-By: Edy Silva <edigleyssonsilva@gmail.com>
Signed-off-by: Antoine du Hamel <duhamelantoine1995@gmail.com> PR-URL: #64046 Reviewed-By: Paolo Insogna <paolo@cowtech.it> Reviewed-By: René <contact.9a5d6388@renegade334.me.uk>
Add guidance to the collaborator guide and onboarding docs recommending node-stress-single-test when fixing flaky tests, so contributors verify stability under repeated runs. Signed-off-by: Kamat, Trivikram <16024985+trivikr@users.noreply.github.com> PR-URL: #64223 Refs: https://openjs-foundation.slack.com/archives/C03BJP63CH0/p1782716150521499 Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com> Reviewed-By: Stewart X Addison <sxa@redhat.com> Reviewed-By: Richard Lau <richard.lau@ibm.com> Reviewed-By: Luigi Pinca <luigipinca@gmail.com> Reviewed-By: Ulises Gascón <ulisesgascongonzalez@gmail.com> Reviewed-By: Joyee Cheung <joyeec9h3@gmail.com>
Signed-off-by: Gürgün Dayıoğlu <hey@gurgun.day> PR-URL: #64169 Reviewed-By: Daniel Lemire <daniel@lemire.me> Reviewed-By: Matteo Collina <matteo.collina@gmail.com> Reviewed-By: Anna Henningsen <anna@addaleax.net>
Signed-off-by: avivkeller <me@aviv.sh> PR-URL: #64157 Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
Signed-off-by: Antoine du Hamel <duhamelantoine1995@gmail.com> PR-URL: #64281 Reviewed-By: René <contact.9a5d6388@renegade334.me.uk> Reviewed-By: James M Snell <jasnell@gmail.com> Reviewed-By: Colin Ihrig <cjihrig@gmail.com> Reviewed-By: Minwoo Jung <nodecorelab@gmail.com> Reviewed-By: Luigi Pinca <luigipinca@gmail.com> Reviewed-By: Darshan Sen <raisinten@gmail.com>
Co-authored-by: Antoine du Hamel <duhamelantoine1995@gmail.com> Signed-off-by: Matteo Collina <hello@matteocollina.com> PR-URL: #64213 Reviewed-By: Ulises Gascón <ulisesgascongonzalez@gmail.com> Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
Signed-off-by: Stewart X Addison <sxa@ibm.com> PR-URL: #64256 Reviewed-By: Richard Lau <richard.lau@ibm.com> Reviewed-By: Luigi Pinca <luigipinca@gmail.com> Reviewed-By: James M Snell <jasnell@gmail.com> Reviewed-By: Joyee Cheung <joyeec9h3@gmail.com> Reviewed-By: Ulises Gascón <ulisesgascongonzalez@gmail.com>
Signed-off-by: haramjeong <04harams77@gmail.com> PR-URL: #60161 Reviewed-By: René <contact.9a5d6388@renegade334.me.uk> Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com> Reviewed-By: Gürgün Dayıoğlu <hey@gurgun.day> Reviewed-By: James M Snell <jasnell@gmail.com>
The allowZero guard compared the raw value with `port === 0`, but
validatePort accepts strings and coerces them with `+port` in every
other clause. Since `'0' === 0` is false, string forms of zero
('0', ' 0 ', '00', '0x0', ...) slipped past the guard when
allowZero was false, while the numeric 0 was correctly rejected.
This is reachable via dgram's send(), connect(), and bind(), which
call validatePort(port, 'Port', false): passing '0' was silently
accepted instead of throwing ERR_SOCKET_BAD_PORT.
Coerce the value with `+port` so the zero check matches the rest of
the validation.
Signed-off-by: Daijiro Wachi <daijiro.wachi@gmail.com>
PR-URL: #64174
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Richard Lau <richard.lau@ibm.com>
Signed-off-by: YuSheng Chen <samuel871211@gmail.com> PR-URL: #64187 Reviewed-By: Tim Perry <pimterry@gmail.com> Reviewed-By: James M Snell <jasnell@gmail.com> Reviewed-By: Stephen Belanger <admin@stephenbelanger.com> Reviewed-By: Ulises Gascón <ulisesgascongonzalez@gmail.com>
Signed-off-by: Mohamed Sayed <k@3zrv.com> PR-URL: #64228 Reviewed-By: James M Snell <jasnell@gmail.com> Reviewed-By: Stephen Belanger <admin@stephenbelanger.com> Reviewed-By: Anna Henningsen <anna@addaleax.net>
When the body option is omitted, no FIN is sent immediately and the stream's outgoing side remains writable. The stream can still be written later via stream.setBody() or the writer. Avoid describing the outgoing stream itself as half-closed, since the outgoing side is one half of the stream state. Fixes: #63655 Signed-off-by: EduardF1 <50618110+EduardF1@users.noreply.github.com> PR-URL: #63660 Reviewed-By: Stephen Belanger <admin@stephenbelanger.com> Reviewed-By: James M Snell <jasnell@gmail.com>
ProtocolHandler::WriteRaw() dereferences tcp_ without a null check. When the remote end disconnects, OnEof() resets tcp_ to nullptr, but queued messages from the uv_async callback can still trigger Write() on the same event loop iteration, causing a null pointer dereference crash (EXCEPTION_ACCESS_VIOLATION on Windows). Additionally, ParseWsFrames() can call OnEof() internally (on compressed or error frames), which resets tcp_ mid-loop in OnData(). If the delegate callback triggered by OnWsFrame() then calls Write(), it would also hit the null tcp_ crash. Add null guards in: - WsHandler::OnData: stop parsing loop when tcp_ becomes null - WsHandler::Write: early return before frame encoding - ProtocolHandler::WriteRaw: defensive fallback for all write paths Fixes: #34833 Signed-off-by: piaoyingmin <piaoyingmin@bytedance.com> PR-URL: #64209 Reviewed-By: Anna Henningsen <anna@addaleax.net> Reviewed-By: Chengzhong Wu <legendecas@gmail.com> Reviewed-By: Stefan Stojanovic <stefan.stojanovic@janeasystems.com>
PR-URL: #64282 Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com> Reviewed-By: Richard Lau <richard.lau@ibm.com>
MemoryProvider allowed renaming a directory into its own descendant, which detached the subtree from the root. Reject this case with EINVAL before mutating the tree. Signed-off-by: Kamat, Trivikram <16024985+trivikr@users.noreply.github.com> Assisted-by: openai:gpt-5.5 PR-URL: #64285 Fixes: #64284 Reviewed-By: James M Snell <jasnell@gmail.com> Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
BrotliCompress/Decompress.flush(kind) forwarded any value to the native layer, causing a 100% CPU hang for kinds outside the brotli operation range (e.g. Z_FINISH). Validate against [0, 3] and throw ERR_OUT_OF_RANGE on invalid input. Fixes: #63701 Signed-off-by: Ic3b3rg <s.ceccarini94@gmail.com> PR-URL: #63746 Reviewed-By: Anna Henningsen <anna@addaleax.net> Reviewed-By: James M Snell <jasnell@gmail.com>
Signed-off-by: Efe Karasakal <hi@efe.dev> PR-URL: #64275 Reviewed-By: James M Snell <jasnell@gmail.com> Reviewed-By: Jake Yuesong Li <jake.yuesong@gmail.com>
Rearm the stream's existing Timeout object instead of allocating a new Timeout and a bound callback on every setTimeout() call. The HTTP server disarms and rearms the keep-alive timeout twice per request, so this saves two allocations and the associated async resource churn on every request over a keep-alive connection. The async resource is re-initialized on reuse, so async_hooks observes the same init/destroy sequence as before. A microbenchmark of the setTimeout(msecs)/setTimeout(0) cycle improves by 2.2x (205.9ns to 92.8ns), and benchmark/http/simple.js (type=buffer len=1024 chunks=1 chunkedEnc=0 c=50) improves by 3.70% (t=2.15, 40 samples per binary with server and load generator pinned to disjoint CPU sets). Assisted-by: Claude Fable 5 (Claude Code) Signed-off-by: Matteo Collina <hello@matteocollina.com> PR-URL: #64254 Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com> Reviewed-By: James M Snell <jasnell@gmail.com> Reviewed-By: Minwoo Jung <nodecorelab@gmail.com>
Signed-off-by: Renegade334 <contact.9a5d6388@renegade334.me.uk> PR-URL: #64325 Refs: #63281 Reviewed-By: Michaël Zasso <targos@protonmail.com> Reviewed-By: Richard Lau <richard.lau@ibm.com> Reviewed-By: Marco Ippolito <marcoippolito54@gmail.com> Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
nodejs-github-bot
added a commit
that referenced
this pull request
Jul 6, 2026
Notable changes: buffer: * (SEMVER-MINOR) implement blob.textStream() (Matthew Aitken) #64036 esm: * (SEMVER-MINOR) add `--experimental-import-text` flag (Efe) #62300 perf_hooks: * (SEMVER-MINOR) sample delay per event loop iteration (Pablo Erhard) #62935 stream: * (SEMVER-MINOR) expose ReadableStreamTee (Matteo Collina) #64195 tls: * (SEMVER-MINOR) report negotiated TLS groups (Filip Skokan) #64119 PR-URL: #64329
github-actions
Bot
added
release
Collaborator
|
Review requested:
|
Notable changes: buffer: * (SEMVER-MINOR) implement blob.textStream() (Matthew Aitken) #64036 esm: * (SEMVER-MINOR) add `--experimental-import-text` flag (Efe) #62300 perf_hooks: * (SEMVER-MINOR) sample delay per event loop iteration (Pablo Erhard) #62935 stream: * (SEMVER-MINOR) expose ReadableStreamTee (Matteo Collina) #64195 tls: * (SEMVER-MINOR) report negotiated TLS groups (Filip Skokan) #64119 PR-URL: #64329 Signed-off-by: Richard Lau <richard.lau@ibm.com>
richardlau
force-pushed
the
v26.5.0-proposal
branch
from
fd5de7c to
bebd1b8
Compare
richardlau
approved these changes
Jul 6, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
20 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
2026-07-08, Version 26.5.0 (Current), @richardlau
Notable Changes
New release key
Welcome to our newest releaser, Stewart X Addison. Future Node.js releases may be signed with his release key,
655F3B5C1FB3FA8D1A0CA6BDE4A7D232B936D2FD.Other notable changes
55f48446c7] - (SEMVER-MINOR) buffer: implement blob.textStream() (Matthew Aitken) #64036b373202efc] - (SEMVER-MINOR) esm: add--experimental-import-textflag (Efe) #6230039e0c14455] - (SEMVER-MINOR) perf_hooks: sample delay per event loop iteration (Pablo Erhard) #62935999a83c937] - (SEMVER-MINOR) stream: expose ReadableStreamTee (Matteo Collina) #641954e0236dc3d] - (SEMVER-MINOR) tls: report negotiated TLS groups (Filip Skokan) #64119Commits
87648c0a6c] - benchmark: trim down the argon2 sets (Filip Skokan) #64218a483bfd3f0] - buffer: remove unreachable overflow check in atob (haramjeong) #601616d14279688] - buffer: add fast api for isUtf8 and isAscii (Gürgün Dayıoğlu) #6416955f48446c7] - (SEMVER-MINOR) buffer: implement blob.textStream() (Matthew Aitken) #64036a67d9a7a44] - build: allow linting node.1 (Aviv Keller) #6415706c1fbc25b] - build: enable Maglev for riscv64 (Jamie Magee) #62605518309c363] - build: suppress clang errors building libffi on Windows (René) #642226a80ab485c] - build: add manually-dispatched stress-test workflow (Joyee Cheung) #64118f4e7bf1f1c] - build: pin envinfo versions in github actions (Joyee Cheung) #6411766f6ac0d86] - build: support setting an emulator from configure script (Ivan Trubach) #538997f26c54aa6] - child_process: fix permission model propagation via NODE_OPTIONS (Matteo Collina) #6397232bb554f5b] - crypto: fix large DH generator validation (Tobias Nießen) #640920908d76ef6] - crypto: reject small-order EdDSA points during verify (Filip Skokan) #640267f7e5863c2] - deps: update undici to 8.7.0 (Node.js GitHub Bot) #64282af91029801] - deps: update nghttp3 to 1.17.0 (Node.js GitHub Bot) #641822e500ba7b0] - deps: update googletest to 8b53336594cc52213c6c2c7a0b29194fa896d039 (Node.js GitHub Bot) #6418174e3aa24ba] - deps: update sqlite to 3.53.3 (Node.js GitHub Bot) #64180c7e57f55a7] - deps: c-ares: cherry-pick 8ba37af8e3fb (René) #64110879fdc4daf] - deps: V8: backport da20a197a7f9 (Kevin Gibbons) #64101a640543a7c] - deps: V8: cherry-pick 0cc9eb22c0b0 (Kevin Gibbons) #64101feefd179e5] - deps: V8: cherry-pick 1a391f98cc7a (Kevin Gibbons) #641018ef643d4b0] - deps: update googletest to 0b1e895ba4226c2fda5ee0178c9b5b1195a741aa (Node.js GitHub Bot) #640399e50bb0655] - dgram: skip dns.lookup() for literal IP addresses (Ruben Bridgewater) #64133dc052c095c] - diagnostics_channel: return original thenable (Stephen Belanger) #62407a22a840293] - doc: clarify QUIC stream state wording (EduardF1) #636608d4bec2d71] - doc: update Http2SecureServer.on("timeout") default value (YuSheng Chen) #64187da88f70afa] - doc: add note on visibility of CI failures to new contributor guide (Stewart X Addison) #6425620ce359ccb] - doc: clarify HTTP/1.1 response ordering (Matteo Collina) #6421305eae2835c] - doc: recommend node-stress-single-test for flaky tests (Trivikram Kamat) #642233966eb67e7] - doc: fix typo in examples (Vas Sudanagunta) #6418412a2b9daa3] - doc: fix typo in node-config-schema.json (Hamid Reza Ghavami) #641880854482671] - doc: clarify defense-in-depth issues (Matteo Collina) #64215ef4915fc3a] - doc: fix Fast FFI argument count in ffi.md (Daijiro Wachi) #63960bb2eed863c] - doc: add sxa GPG key (ed25519) (Stewart X Addison) #64193b7bf6e3a06] - doc: add guide and answers to FAQs for first-time contributors (Joyee Cheung) #63685ff537ba858] - doc: updateHttp2Server.close&Http2SecureServer.close(YuSheng Chen) #63298f3db304588] - doc: update list of people inSECURITY.md(Richard Lau) #641522a126647b0] - doc: clarify vfs is not a sandbox (Matteo Collina) #6414385fc79dd9b] - doc: fix broken links and duplicate stability label (Antoine du Hamel) #64130189e830eb3] - doc: add missing option to man page (Richard Lau) #641567a16ccccd0] - doc: announce upcoming end of tier 2 support for macOS x64 (Antoine du Hamel) #63931d5f826045f] - doc: update toolchain for official AIX releases (Richard Lau) #6406860abc4400f] - doc: fix callback example import in fs docs (Kamal Rawal) #63912e470c74a6c] - doc: fix keepAliveTimeout default in http.createServer options (Jahanzaib iqbal) #63974851b460583] - esm: improve ERR_REQUIRE_ASYNC_MODULE (Joyee Cheung) #642600cd443df39] - esm: print required top-level await locations without evaluating (Joyee Cheung) #64154b373202efc] - (SEMVER-MINOR) esm: add--experimental-import-textflag (Efe) #62300eacfbd0ca5] - http: add CONNECT method handling for default Host header with proxy (Archkon) #64114aeb539a383] - http: fix drain event with cork/uncork (David Evans) #640388e8874b216] - http: document and validate options.path when it's in absolute-form (Joyee Cheung) #64108eb2e96bc28] - inspector: fix crash when writing to closed inspector socket (ympark2011) #64209243b0e4e57] - lib: reject string "0" in validatePort when allowZero is false (Daijiro Wachi) #6417434a537c0ed] - lib: use__proto__: nullwhen callingObjectDefineProperty(Antoine du Hamel) #642391f72393f19] - lib: lazily initialize kEvents and kHandlers maps (Guilherme Araújo) #6370292a3dc3191] - lib,permission: fix addon permission drop (Martin Wagner) #6400787b8f2a296] - meta: fix linter warning instale.yml(Antoine du Hamel) #64281829c4a5913] - meta: bump actions/cache from 5.0.5 to 6.1.0 (dependabot[bot]) #642480808dcd31c] - meta: bump github/codeql-action/autobuild from 4.36.1 to 4.36.2 (dependabot[bot]) #6424764aa17058f] - meta: bump github/codeql-action/analyze from 4.36.1 to 4.36.2 (dependabot[bot]) #64246873d1e0412] - meta: bump actions/checkout from 6.0.2 to 7.0.0 (dependabot[bot]) #64245fe460ccf0b] - meta: bump codecov/codecov-action from 6.0.1 to 7.0.0 (dependabot[bot]) #64244845c63ed50] - meta: bump rtCamp/action-slack-notify from 2.3.3 to 2.4.0 (dependabot[bot]) #642432cad2d6de5] - meta: bump github/codeql-action/init from 4.36.1 to 4.36.2 (dependabot[bot]) #642420ddde950c7] - meta: bump actions/setup-python from 6.2.0 to 6.3.0 (dependabot[bot]) #64241c0a8760d2f] - meta: bump github/codeql-action/upload-sarif from 4.36.1 to 4.36.2 (dependabot[bot]) #64240f49704b9d0] - meta: clarify V8 flags are outside threat model (Matteo Collina) #642246b8dc58e6e] - meta: move one or more collaborators to emeritus (Node.js GitHub Bot) #64057fe5260cca7] - meta: update status of past strategic initiatives (Joyee Cheung) #634807b01040008] - meta: speed up stale bot (Aviv Keller) #64075874c46c24f] - meta: update sccache version in test-linux-quic (René) #6404348c5c86363] - module: enable import support for addons by default (Chengzhong Wu) #6422139e0c14455] - (SEMVER-MINOR) perf_hooks: sample delay per event loop iteration (Pablo Erhard) #62935f90f1bd032] - perf_hooks: add NODE_PERFORMANCE_GC_MINOR_MARK_SWEEP constant (Attila Szegedi) #63877bdf32628c7] - process: fix finalization cleanup ref tracking (Trivikram Kamat) #640879a65b7fff4] - quic: drop version negotiation packets with oversized CIDs (Mohamed Sayed) #642282699fe4706] - quic: fixes undefined handle in QuicStream kInspect (Marten Richter) #6417000dea28bb3] - repl: lazy-load acorn and defer vm context creation (Daijiro Wachi) #63879ce659a1cf9] - src: fix escaping of single quotes in task runner (Antoine du Hamel) #64089dbb3126e5c] - src: abstract tracing agent for both legacy and perfetto (Chengzhong Wu) #6405312edf1d68d] - src: avoid redundant call tostd::get_if<>()(Tobias Nießen) #64094eda91b6d01] - src: avoid copying source string in TextEncoder.encode (Yagiz Nizipli) #63897efbbb9a03c] - stream: preserve half-open duplexes in async iteration (Efe) #64275999a83c937] - (SEMVER-MINOR) stream: expose ReadableStreamTee (Matteo Collina) #64195ab5ed72903] - stream: reject iter consumers on abort (Trivikram Kamat) #64066d3fa77c5e2] - stream: fix merge abort for pending sources (Trivikram Kamat) #6401338b99140ed] - stream: refactor unnecessary optional chaining away (Antoine du Hamel) #64253c81f894ebe] - stream: cut per-chunk overhead in WHATWG streams (Matteo Collina) #64252f162234f24] - stream: normalize Broadcast.from() byte inputs (Trivikram Kamat) #640821182ad8f3b] - stream: proxy first own method in Readable.wrap() (Daijiro Wachi) #64048d0b830b382] - stream: observe abort while awaiting pipeTo source (Trivikram Kamat) #64015f7adcd8359] - stream: respect iter consumer abort signals (Trivikram Kamat) #63997b09e624c6f] - test: make blob desiredSize assertion robust (Trivikram Kamat) #64106d0d8f0c774] - test: update WPT for urlpattern to 11a459a2b1 (Node.js GitHub Bot) #64037ff9122c20c] - test: improve lcov reporter snapshot diagnostics (Trivikram Kamat) #64049570952d4f3] - test: keep finalization close fixture ref alive (Trivikram Kamat) #640851b4f213380] - test: fix typo from overriden to overridden (parkhojeong) #634034c91090b8b] - test: fix typo from funciton to function (parkhojeong) #63403bf080c7917] - test: mark hr-time WPT flaky on macos15-x64 (Trivikram Kamat) #6405424e32098c5] - test: use one-off agent in http consumed timeout test (Trivikram Kamat) #640523229886de2] - test: fix flaky test-runner coverage threshold test (Trivikram Kamat) #6405183b91ea6ec] - test_runner: filter execArgv fallback for child tests (Trivikram Kamat) #64056269b609a3d] - test_runner: improve coverage failure diagnostics (Trivikram Kamat) #640500342744c34] - test_runner: add timestamp to JUnit reporter testsuites (sangwook) #64029086741d121] - timers: reuse Timeout objects in setStreamTimeout (Matteo Collina) #642544e0236dc3d] - (SEMVER-MINOR) tls: report negotiated TLS groups (Filip Skokan) #641193bdd7e20be] - tls: handle large RSA exponents in X.509 cert (Tobias Nießen) #64093c96c838977] - tools: update RUSTC_VERSION for remaining GHA workflows (René) #64325ee873b7aaf] - tools: bumptemporal_rsversion (Antoine du Hamel) #63281ea3b870155] - tools: removeenvinfofrom our workflows (Antoine du Hamel) #64259d940f02e8b] - tools: bump the eslint group in /tools/eslint with 8 updates (dependabot[bot]) #64249fe0ea2bb5d] - tools: bump @node-core/doc-kit (dependabot[bot]) #640104dceefde1e] - tools: bump undici from 6.24.1 to 6.27.0 in /tools/doc (dependabot[bot]) #640316e187db7d7] - tools: update c-ares updater script (Antoine du Hamel) #64194657a35f5a2] - tools: validate version number in release proposal commit message lint (Antoine du Hamel) #6407017228a861c] - tools: add GHA benchmark runner (Antoine du Hamel) #602936d11a71d91] - tools: updatebuild-shared/action.ymlto a reusable workflow (Antoine du Hamel) #640597a17c50b7f] - tools: update libffi updater script (Antoine du Hamel) #6404628047a3e71] - tools: excludelibffichanges fromtest-sharedGHA CI (Antoine du Hamel) #6404758d9685acc] - typings: add typing for crypto (Filip Skokan) #641227a9dcad44d] - util: fix OOM in inspect color stack formatting (Ijtihed Kilani) #64022d5f01bbbde] - vfs: reject rename into descendant directory (Trivikram Kamat) #642850b6af91081] - vfs: handle current-position sentinel in memory files (Trivikram Kamat) #64163322230d641] - vfs: support writeFileSync with virtual fds (Trivikram Kamat) #641659395d209c7] - vfs: avoid recursive readdir symlink cycles (Matteo Collina) #64168bbdd7643b6] - vfs: read RealFSProvider files from open fd (Trivikram Kamat) #6410492859b8097] - vm: fix copying PropertyDescriptor (Chengzhong Wu) #640739046035475] - zlib: validate flush king for all streams (Ic3b3rg) #6374698be4304a3] - zlib: validate flush kind for brotli streams (Ic3b3rg) #6374690007a59a9] - zlib: expose rejectGarbageAfterEnd option (Filip Skokan) #640235933516066] - zlib: reject trailing gzip members in web streams (Filip Skokan) #64023