2026-06-24, Version 26.4.0 (Current), @aduh95 — Node.js - Product release notes & changelog tool

Notable Changes

[cde0daabcc] - (SEMVER-MINOR) doc: update blockList stability status to release candidate (alphaleadership) #63050
[b78f5a7537] - (SEMVER-MINOR) fs: support caller-supplied readFile() buffers (Matteo Collina) #63634
[417aacbc36] - (SEMVER-MINOR) http: close pre-request sockets in closeIdleConnections (semimikoh) #63470
[fbb108be7d] - (SEMVER-MINOR) loader: implement package maps (Maël Nison) #62239
[45494d5a8a] - (SEMVER-MINOR) net: support TCP_KEEPINTVL and TCP_KEEPCNT in setKeepAlive (Guy Bedford) #63825
[ee29465e77] - (SEMVER-MINOR) tls: add certificateCompression option (Tim Perry) #62217
[b17817eb2b] - (SEMVER-MINOR) vfs: dispatch node:fs/promises to mounted VFS instances (Matteo Collina) #63537
[7bc93a6ac5] - (SEMVER-MINOR) vfs: add minimal node:vfs subsystem (Matteo Collina) #63115

Commits

[c7eb83b46a] - benchmark: add child_process async path baselines (Yagiz Nizipli) #63929
[066fff17a5] - benchmark: remove old alias usage in ffi benchmarks (Anna Henningsen) #63666
[509cd1b94f] - buffer: optimize Buffer.prototype.copy (Robert Nagy) #63828
[86e651bbd0] - buffer: use simdutf for two-byte utf8 byteLength (Mert Can Altin) #63639
[d3f4ed9015] - build: suppress compiler warnings for histogram (Richard Lau) #63980
[82dd7ddbe6] - build: add QUIC CI job for PRs matching QUIC related paths (Tim Perry) #63875
[1124c0652d] - build: remove redundant intermediate node_aix_shared (Chengzhong Wu) #63747
[e510ee8087] - build: build codecache and snapshot with libnode (Chengzhong Wu) #63626
[5b583dace5] - build: enable maglev by default on Linux ppc64le (Richard Lau) #63474
[a2324246b4] - build: remove duplicated node_use_sqlite and node_use_ffi conditions (Chengzhong Wu) #63629
[2a467a5f69] - Revert “build, doc: generate node.1 with doc-kit” (Antoine du Hamel) #64091
[e01dec45b8] - build, doc: generate node.1 with doc-kit (Aviv Keller) #62044
[2ab9848fe4] - child_process: pass spawn options to the binding positionally (Yagiz Nizipli) #63930
[04c04c8b5c] - child_process: serialize advanced IPC messages natively (Yagiz Nizipli) #63933
[1eef57293d] - crypto: support non-byte WebCrypto lengths and cSHAKE (Filip Skokan) #63988
[788a66e147] - crypto: share WebCrypto method and usage helpers (Filip Skokan) #63975
[f9fdce3f46] - crypto: use EVP_MAC for HMAC on OpenSSL >=3 (Filip Skokan) #63942
[7e9ca87e58] - crypto: make webcrypto aliasKeyFormat directional (Filip Skokan) #63910
[656e57ebbf] - crypto: fix unhandled error in Hash._transform (Haram Jeong) #63261
[65536f0d98] - crypto: refactor keyObject.toCryptoKey() and SubtleCrypto.getPublicKey() (Filip Skokan) #63622
[978f1d2bcc] - crypto: handle cipher context allocation failures (Tian Teng) #63542
[5551e8f773] - crypto: deduplicate X509 subject matching logic (Tobias Nießen) #63644
[57ae87640a] - crypto: fix warnings in test_node_crypto.cc (Maya Lekova) #63490
[9984b05dff] - crypto: coerce -0 to +0 before native calls (Filip Skokan) #63556
[88011a3689] - crypto,tls: do not ignore BN_get_word error (Tobias Nießen) #63895
[9a3393d14f] - debugger: lazily wait for initial break output (Trivikram Kamat) #63969
[b0bfcb9c59] - debugger: defer probe pause handling until startup (Trivikram Kamat) #63608
[8516003953] - debugger: await initialization after run and restart (Trivikram Kamat) #63607
[4438cb5284] - debugger: add –max-hit option to probe mode (Joyee Cheung) #63704
[238b54ed2a] - debugger: add more logs to probe mode (Joyee Cheung) #63663
[bbef54b413] - deps: libffi: cherry-pick 9ca53a19833d (Anthony Green) #64040
[9761385dbd] - deps: update libffi to 3.6.0 (Node.js GitHub Bot) #64040
[373ec2d092] - deps: update acorn to 8.17.0 (Node.js GitHub Bot) #63901
[e44b5d487e] - (SEMVER-MINOR) deps: update OpenSSL build config to support compression (Tim Perry) #62217
[3ed287a2e2] - deps: upgrade npm to 11.17.0 (npm team) #63857
[b1b597c797] - deps: add ngtcp2_fmt.c to build configuration (ngtcp2.gyp) (沈鸿飞) #63821
[0bf8e12305] - deps: V8: add CopyArrayBufferBytes API (Robert Nagy) #63828
[e49d7301a5] - deps: update ngtcp2 to 1.23.0 (Node.js GitHub Bot) #63777
[e5c079004b] - deps: update nghttp3 to 1.16.0 (Node.js GitHub Bot) #63776
[d599fa2346] - deps: update googletest to 7140cd416cecd7462a8aae488024abeee55598e4 (Node.js GitHub Bot) #63775
[bc09f1508c] - deps: update sqlite to 3.53.2 (Node.js GitHub Bot) #63774
[60787746c4] - deps: update zlib to 1.3.2.1-motley-3246f1b (Node.js GitHub Bot) #63773
[971af104f1] - deps: update amaro to 1.1.10 (Node.js GitHub Bot) #63670
[e17f665444] - deps: update googletest to 8736d2cd5c1dcba41170ed2fddca14021d4916c3 (Node.js GitHub Bot) #63669
[7591949457] - dgram: add synchronous Socket connectSync() (Guy Bedford) #63932
[d75222d7cb] - dgram: add synchronous Socket.prototype.bindSync() (Guy Bedford) #63838
[0cf8342ae2] - dns: coerce -0 to +0 in lookup and resolver inputs (Filip Skokan) #63556
[e068299320] - doc: update gcc toolchains to gcc-13 and g++-13 (Louie Llaneta) #64018
[65178bdcf3] - doc: add aduh95 to last security release steward (Antoine du Hamel) #63981
[83eedfe85b] - doc: fix typo in util.md (Daijiro Wachi) #63961
[54948c78e7] - doc: clarify callback exceptions (Matteo Collina) #63939
[205d0a57f2] - doc: fix incorrect test runner mock examples (Kimaswa Emmanuel Yusufu) #63656
[44809b176c] - doc: clarify fromReadable() duck-typed contract (Trivikram Kamat) #63682
[9cb15fcc85] - doc: fix typo in cli.md (Daijiro Wachi) #63883
[394d0bb928] - doc: fix typo in vm.md (Daijiro Wachi) #63881
[59b7be8193] - doc: fix typo in packages.md (Daijiro Wachi) #63882
[33c236cea9] - doc: fix a/an article typos in module, util, and dns (Daijiro Wachi) #63766
[30595da67b] - doc: update npm supported versions link (hojeong park) #63672
[5919ba7e97] - doc: fix AES-OCB IV length in SubtleCrypto.supports example (Anshika Jain) #63717
[51cab5cb72] - doc: add webstreams to args for pipeline from stream/promises (David Sanders) #63628
[ce85b2af88] - doc: fix “used to sent” → “used to send” in http2 (Daijiro Wachi) #63700
[298735e8df] - doc: mark Node.js 25 as End-of-Life (Antoine du Hamel) #63692
[56948518b9] - doc: clarify tty raw mode applies to input processing only (Muhammad Zeeshan) #63438
[32ff731248] - doc: add worker_threads history entries (Bob Put) #63545
[cde0daabcc] - (SEMVER-MINOR) doc: update blockList stability status to release candidate (alphaleadership) #63050
[d29483fc4f] - doc,crypto: mark argon2 and encap/decap as stable (Filip Skokan) #63924
[6e668331d9] - events: improve addAbortListener perf by caching options object (Raz Luvaton) #52367
[97aafe2519] - ffi: add fast support for almost all other platforms (Paolo Insogna) #63941
[f52cf5eeaa] - ffi: add experimental fast FFI call API for AArch64 and x86_64 (Paolo Insogna) #63068
[d9461fee05] - ffi: port semi-colon fix for riscv64 (and others) (Stewart X Addison) #63794
[4c8402e0a8] - fs: do not treat EPERM as ENOTEMPTY on Windows (Kirill Saied) #63709
[b78f5a7537] - (SEMVER-MINOR) fs: support caller-supplied readFile() buffers (Matteo Collina) #63634
[3d0097d489] - fs: prevent spurious recursive watch events on prefix siblings (Marco) #63095
[14d829cb3c] - fs: ignore deleted dirs in recursive watch scan (Trivikram Kamat) #63686
[ceba08a1ea] - fs: coerce -0 to +0 in mode flags and watch intervals (Filip Skokan) #63556
[6577d3b282] - http: avoid stream listeners on idle agent sockets (Matteo Collina) #64004
[417aacbc36] - (SEMVER-MINOR) http: close pre-request sockets in closeIdleConnections (semimikoh) #63470
[b7fd13a59a] - http2: retain header memory in session accounting (Matteo Collina) #63752
[e611ccd167] - inspector: fix inspector.close() documented behavior (Chengzhong Wu) #63837
[a44f51eef3] - lib: fix missing lazyDOMException import (Filip Skokan) #64033
[27cc4ec598] - lib: add lint rule to enforce use of kEmptyObject (Antoine du Hamel) #63790
[7ee31b0bf4] - lib: improve control abstraction coverage in frozen intrinsics (Renegade334) #63698
[078457839a] - lib: add Iterator global to primordials (Renegade334) #63698
[58837dc4dd] - lib: remove source map deadcode in type stripping (Chengzhong Wu) #63738
[e7513a8b9e] - lib: make Navigator#language getter throw on invalid this (Mohamed Sayed) #63601
[fbb108be7d] - (SEMVER-MINOR) loader: implement package maps (Maël Nison) #62239
[ea0b8e1dc2] - meta: bump github/codeql-action from 4.35.3 to 4.36.1 (dependabot[bot]) #63724
[ac90719532] - meta: bump actions/cache from 5.0.4 to 5.0.5 (dependabot[bot]) #62847
[3ed3de3062] - meta: bump actions/checkout from 6.0.2 to 6.0.3 (dependabot[bot]) #63726
[d08d57bf70] - meta: bump codecov/codecov-action from 6.0.0 to 6.0.1 (dependabot[bot]) #63725
[e748d192cf] - meta: bump cachix/cachix-action (dependabot[bot]) #63729
[10554eb131] - meta: bump actions/stale from 10.2.0 to 10.3.0 (dependabot[bot]) #63728
[791885f2af] - meta: bump step-security/harden-runner from 2.19.0 to 2.19.4 (dependabot[bot]) #63727
[32d9a407d9] - meta: bump cachix/install-nix-action from 31.10.5 to 31.10.6 (dependabot[bot]) #63723
[b97c7bed07] - module: enable existing machinery for deferred import of static modules (Maya Lekova) #63712
[4becad2117] - module: use file: URL as sourceURL for type-stripped CommonJS (Joyee Cheung) #63705
[c71c85b95f] - net: early TCP binding via synchronous net.BoundSocket (Guy Bedford) #63951
[45494d5a8a] - (SEMVER-MINOR) net: support TCP_KEEPINTVL and TCP_KEEPCNT in setKeepAlive (Guy Bedford) #63825
[3988efa1f3] - net: coerce -0 to +0 in BlockList prefixes (Filip Skokan) #63556
[484efd1c44] - quic: fix get_reader bug that dropped data on FIN (Tim Perry) #63946
[04a17fe6f0] - quic: expose QUIC certificates as JS X509Certificate, not raw handles (Tim Perry) #63191
[b62d5696dc] - quic: fix reader backpressure deadlock on idle connections (Tim Perry) #63950
[3f1c8d7453] - quic: fix broken listEndpoints export, test callbacks & nghttp3 include (Tim Perry) #63874
[d8538b9deb] - quic: impl. cb for http/3 settings/app. options (Marten Richter) #63558
[643b19716e] - quic: add listEndpoints API (James M Snell) #63536
[2bce35bea4] - sqlite: do not leave database open after failed open (Yagiz Nizipli) #63854
[394af52abb] - sqlite: fix stack-use-after-scope with function callback (ndossche) #63640
[10f03e5958] - src: omit unconvertible names in cjs_lexer::Parse (Yagiz Nizipli) #63943
[1723773d41] - src: keep global list of addon-provided cleanup hooks (Anna Henningsen) #63985
[ef12e9ea44] - src: guard OpenSSL compression header include (Filip Skokan) #64009
[48af8a6d8d] - src: handle empty MaybeLocal in cjs_lexer::Parse (Yagiz Nizipli) #63885
[2a672ee9e8] - src: fast path empty native immediate drain (Gürgün Dayıoğlu) #62969
[db6a31d1a1] - src: do not track weak BaseObjects as childrens of Realms (Anna Henningsen) #63842
[5fb837ff46] - src: allow tracking children in MemoryTracker with weak edges (Anna Henningsen) #63842
[6d22d373a9] - src: use C++14 deprecated attribute for NODE_DEPRECATED (Anna Henningsen) #63755
[7ac3fe1992] - src: add cleanup hooks to node::ObjectWrap (Anna Henningsen) #63642
[d82d369155] - src: fix edge case when deflateInit2() fails with Z_VERSION_ERROR (Nora Dossche) #63476
[03858d152b] - src: remove redundant handle_ field in ffi (Anna Henningsen) #63665
[1682264f6b] - src: add Latin1 fast path in StringBytes::Encode utf8 (Mert Can Altin) #63385
[cc29696acf] - stream: fix Writable.toWeb() desiredSize for non-object-mode (Matteo Collina) #62986
[d9967a25b2] - stream: handle falsy push writer fail reasons (Trivikram Kamat) #63569
[b53f8f75c9] - stream: reduce allocations on WHATWG streams hot paths (Matteo Collina) #63876
[315ca426d8] - stream: handle setEncoding after buffered data (Matteo Collina) #63973
[06413cd6bd] - stream: fix Utf8Stream stall after full write of multi-byte data (Daijiro Wachi) #63964
[a9f9a3dafa] - stream: keep overlapping broadcast reads pending (Trivikram Kamat) #63500
[009cca11bd] - stream: refine the stream/iter backpressure (James M Snell) #63697
[3f81dcfc99] - stream: only pass the expected number of parameters to callbacks (Antoine du Hamel) #63909
[9a83b5d1fe] - stream: fix dropped first chunk in Utf8Stream buffer mode (Daijiro Wachi) #63833
[0bdf5adea9] - stream: remove transform-writer handling in pipeTo (Trivikram Kamat) #63684
[10272a94b6] - stream: check done before backpressure in stream reader (Daijiro Wachi) #63699
[792c410631] - stream: fix pipeToSync byte accounting (Trivikram Kamat) #63564
[3cfafbc54b] - stream: reject pull() reads on abort (Trivikram Kamat) #63498
[640a8cede5] - stream: fast-path stateless transform flush results (Trivikram Kamat) #63605
[ece4477872] - stream: optimize pipeTo promise handling (Matteo Collina) #63572
[2cb84c2daf] - stream: handle sync writev completion in pipeTo (Trivikram Kamat) #63561
[7d9fdda5fa] - stream: settle pending broadcast reads on return (Trivikram Kamat) #63603
[e2aea3aac7] - test: tolerate duplicate watch change events (Trivikram Kamat) #63937
[ea6300593a] - test: mark test-debugger-run-after-quit-restart as flaky on macOS (Matteo Collina) #64006
[be1b204fa4] - test: update WPT for url to d4598eba09 (Node.js GitHub Bot) #63899
[b3d0d05b05] - test: update WPT for WebCryptoAPI to 03a1476844 (Node.js GitHub Bot) #63900
[046af2609f] - test: update WPT for urlpattern to 23aac92784 (Node.js GitHub Bot) #63898
[562b831a98] - test: add tests for 3 methods in utils (Daijiro Wachi) #63765
[28e3629dd3] - test: mark SEA tests flaky on linux arm debug (Trivikram Kamat) #63743
[243aa846de] - test: validate ERR_INVALID_THIS for scheduler methods (Daijiro Wachi) #63764
[6bd07df2bc] - test: add coverage outside SEA (Daijiro Wachi) #63744
[bd67c9d11b] - test: update WPT for urlpattern to 2f28df545c (Node.js GitHub Bot) #63771
[e40bfe7081] - test: make Brotli 16GB test wait for backpressure (Trivikram Kamat) #63389
[444c03fd3b] - test: add regression test for using ObjectWrap in worker (Mohamed Akram) #63642
[771230df78] - test: accept SIGILL aborts in async-hooks tests (Trivikram Kamat) #63687
[0b3cd8e5e6] - test: add more test cases for pathToFileURL (Rafael Gonzaga) #63293
[0cbc77c60e] - test: update test426-fixtures to 2965987bf4c96afa400c9356c8e620cb340aaee (Node.js GitHub Bot) #63668
[f53dee5fe4] - test: update WPT for WebCryptoAPI to 0c413fb56b (Node.js GitHub Bot) #63647
[3048f8dc1a] - test,debugger: add test for type stripping in debugger probe mode (Joyee Cheung) #63748
[9485caa97e] - test_runner: remove unused shuffleArrayWithSeed (Daijiro Wachi) #63847
[34433a4a87] - test_runner: fix watch cwd with isolation none (Trivikram Kamat) #63690
[2e7da29b7c] - test_runner: avoid recompiling coverage globs for every file (sangwook) #63675
[205295a31e] - test_runner: cache shouldSkipFileCoverage result per URL (sangwook) #63675
[ee29465e77] - (SEMVER-MINOR) tls: add certificateCompression option (Tim Perry) #62217
[57d060ed2b] - tls: route event listener exceptions through error handlers (Antoine du Hamel) #63822
[d2dc6f8506] - tools: bump piscina from 5.1.4 to 5.2.0 in /tools/doc (dependabot[bot]) #64002
[b0c418f605] - tools: update sccache to v0.16.0 (Michaël Zasso) #63078
[2af8433bef] - tools: bump js-yaml from 4.1.1 to 4.2.0 in /tools/lint-md (dependabot[bot]) #63948
[8ba5b8574b] - tools: bump js-yaml from 4.1.1 to 4.2.0 in /tools/eslint (dependabot[bot]) #63947
[325087be5b] - tools: enforce iterator result property order (Trivikram Kamat) #63526
[314f417db7] - tools: update the llhttp updater script (Antoine du Hamel) #63819
[c6e4f5a4fe] - tools: avoid test/fixtures/wpt/README.md conflicts (Filip Skokan) #63938
[363912acc3] - tools: align Bash snippets in GHA with lint-sh conventions (Antoine du Hamel) #63829
[cfd16e973c] - tools: bump @node-core/doc-kit in /tools/doc in the doc group (dependabot[bot]) #63760
[1566872706] - tools: bump the eslint group in /tools/eslint with 7 updates (dependabot[bot]) #63730
[08437a3a5b] - tools: fix zlib updater script (Antoine du Hamel) #63707
[e883366172] - url: fix URLSearchParams(null) to prudce null= per spec (Marco) #63782
[60e83d9bfd] - util: fix scientific notation formatting (Daijiro Wachi) #63823
[5f7f60ac36] - util: fix -0 formatting when numericSeparator is enabled (Daijiro Wachi) #63815
[af1a11e0dd] - util: remove style caches from styleText slow path (Guilherme Araújo) #63706
[b17817eb2b] - (SEMVER-MINOR) vfs: dispatch fs/promises to mounted VFS instances (Matteo Collina) #63537
[7bc93a6ac5] - (SEMVER-MINOR) vfs: add minimal node:vfs subsystem (Matteo Collina) #63115
[584e7527c4] - vm: fix property queries for proxy sandboxes (Brian Meek) #63742
[a926e72eaf] - watch: print name of changed file that triggers restart (Marco) #63781
[32a2621ca4] - watch: cancel pending restart on shutdown (Trivikram Kamat) #63383
[692215d1b1] - zlib: coerce -0 to +0 for crc32 seeds (Filip Skokan) #63556