build: enable Temporal by default by richardlau · Pull Request #61806 · nodejs/node

richardlau · 2026-02-13T18:36:01Z

Enabling Temporal support requires cargo and rustc, which are new build toolchain requirements.

Add a --v8-disable-temporal-support option to configure.py to explicitly opt-out of Temporal support (i.e. no need for Rust).

If the existing --v8-enable-temporal-support option is not explicitly passed to configure.py:

Attempt to detect cargo and rustc.
If neither cargo and rustc are detected, print a warning and disable Temporal support.
If both cargo and rustc are detected, enable Temporal support.

If --v8-enable-temporal-support is passed to configure.py, then the build will error and stop if cargo and/or rustc are not detected.

To avoid ambiguity, configure.py will error and stop if both --v8-disable-temporal-support and --v8-enable-temporal-support are used.

Fixes: #57127

Blocked on either of the V8 updates (14.4 or 14.5) landing first.

Autodetecting this way allows us to roll out Rust onto the CI machines gradually (the aim is for Node.js 26).

targos · 2026-02-13T18:41:02Z

If neither cargo and rustc are detected, print a warning and disable Temporal support.

If both cargo and rustc are detected, enable Temporal support.

Does it mean that we might inadvertently introduce or remove Temporal in releases by touching release machines (i.e. after system updates)?

richardlau · 2026-02-13T19:25:19Z

If neither cargo and rustc are detected, print a warning and disable Temporal support.

If both cargo and rustc are detected, enable Temporal support.

Does it mean that we might inadvertently introduce or remove Temporal in releases by touching release machines (i.e. after system updates)?

A regular system update should not put either cargo or rustc on it if it is not already there (at least on a Linux distribution) but a system upgrade might.

If consensus is to remove the autodetection (i.e. the default build will fail in environments where rust is not available) then enabling Temporal in Node.js by default will be blocked until all of the test and release infrastructure for Node.js 26 is updated.

legendecas · 2026-02-13T20:02:31Z

Can we specify --v8-enable-temporal-support on release machine on platforms that we are determined to enable the support? So configure.py will error out if somehow the rustc/cargo is missing.

richardlau · 2026-02-13T20:16:51Z

Can we specify --v8-enable-temporal-support on release machine on platforms that we are determined to enable the support? So configure.py will error out if somehow the rustc/cargo is missing.

It can be done but the job is generic for all release lines so would be a little untidy (basically a conditional based on the major version as otherwise configure will fail on earlier release lines with --v8-enable-temporal-support).

mcollina

lgtm

github-actions · 2026-02-20T14:11:46Z

The notable-change PRs with changes that should be highlighted in changelogs. label has been added by @mcollina.

Please suggest a text for the release notes if you'd like to include a more detailed summary, then proceed to update the PR description with the text or a link to the notable change suggested text comment. Otherwise, the commit will be placed in the Other Notable Changes section.

legendecas · 2026-03-11T15:33:07Z

(Removing unnecessary labels I added earlier, given that this is already semver-major)

avivkeller

🙌

PR-URL: #61806 Fixes: #57127 Reviewed-By: Matteo Collina <matteo.collina@gmail.com> Reviewed-By: Colin Ihrig <cjihrig@gmail.com> Reviewed-By: Michaël Zasso <targos@protonmail.com> Reviewed-By: Chengzhong Wu <legendecas@gmail.com> Reviewed-By: Anna Henningsen <anna@addaleax.net> Reviewed-By: Juan José Arboleda <soyjuanarbol@gmail.com> Reviewed-By: James M Snell <jasnell@gmail.com> Reviewed-By: Aviv Keller <me@aviv.sh> Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com> (cherry picked from commit 79c9149)

Enabling Temporal support requires `cargo` and `rustc`, which are new build toolchain requirements. Add a `--v8-disable-temporal-support` option to `configure.py` to explicitly opt-out of Temporal support (i.e. no need for Rust). If the existing `--v8-enable-temporal-support` option is not explicitly passed to `configure.py`: - Attempt to detect `cargo` and `rustc`. - If neither `cargo` and `rustc` are detected, print a warning and disable Temporal support. - If both `cargo` and `rustc` are detected, enable Temporal support. If `--v8-enable-temporal-support` is passed to `configure.py`, then the build will error and stop if `cargo` and/or `rustc` are not detected. To avoid ambiguity, `configure.py` will error and stop if both `--v8-disable-temporal-support` and `--v8-enable-temporal-support` are used. Signed-off-by: Richard Lau <richard.lau@ibm.com> PR-URL: #61806 Fixes: #57127 Reviewed-By: Matteo Collina <matteo.collina@gmail.com> Reviewed-By: Colin Ihrig <cjihrig@gmail.com> Reviewed-By: Michaël Zasso <targos@protonmail.com> Reviewed-By: Chengzhong Wu <legendecas@gmail.com> Reviewed-By: Anna Henningsen <anna@addaleax.net> Reviewed-By: Juan José Arboleda <soyjuanarbol@gmail.com> Reviewed-By: James M Snell <jasnell@gmail.com> Reviewed-By: Aviv Keller <me@aviv.sh> Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com> (cherry picked from commit fc4b334)

assert: * (SEMVER-MAJOR) allow printf-style messages as assertion error (Ruben Bridgewater) #58849 build: * (SEMVER-MAJOR) bump GCC requirement to 13.2 (Michaël Zasso) #62555 * (SEMVER-MAJOR) enable Temporal by default (Richard Lau) #61806 * (SEMVER-MAJOR) enable V8_VERIFY_WRITE_BARRIERS in debug build (Joyee Cheung) #61898 * (SEMVER-MAJOR) reset embedder string to "-node.0" (Michaël Zasso) #61898 * (SEMVER-MAJOR) target Power 9 for AIX/IBM i (Richard Lau) #62296 * (SEMVER-MAJOR) drop support for Python 3.9 (Mike McCready) #61177 * (SEMVER-MAJOR) enable maglev for Linux on s390x (Richard Lau) #60863 * (SEMVER-MAJOR) reset embedder string to "-node.0" (Michaël Zasso) #60488 * (SEMVER-MAJOR) reset embedder string to "-node.0" (Michaël Zasso) #60111 build,test: * (CVE-2026-21717) (SEMVER-MAJOR) test array index hash collision (Joyee Cheung) #61898 build,win: * (SEMVER-MAJOR) fix Temporal build (StefanStojanovic) #61806 crypto: * (SEMVER-MAJOR) unify asymmetric key import through KeyObjectHandle::Init (Filip Skokan) #62499 * (SEMVER-MAJOR) runtime-deprecate DEP0203 and DEP0204 (Filip Skokan) #62453 * (SEMVER-MAJOR) decorate async crypto job errors with OpenSSL error details (Filip Skokan) #62348 * (SEMVER-MAJOR) default ML-KEM and ML-DSA pkcs8 export to seed-only format (Filip Skokan) #62178 * (SEMVER-MAJOR) move DEP0182 to End-of-Life (Tobias Nießen) #61084 * (SEMVER-MAJOR) fix DOMException name for non-extractable key error (Filip Skokan) #60830 deps: * (SEMVER-MAJOR) fix V8 race condition for AIX (Abdirahim Musse) #61898 * (SEMVER-MAJOR) V8: cherry-pick cd2c216e7658 (LuYahan) #61898 * (SEMVER-MAJOR) V8: backport 088b7112e7ab (Igor Sheludko) #61898 * (SEMVER-MAJOR) V8: cherry-pick 00f6e834029f (Joyee Cheung) #61898 * (SEMVER-MAJOR) V8: backport bef0d9c1bc90 (Joyee Cheung) #61898 * (SEMVER-MAJOR) V8: cherry-pick cf1bce40a5ef (Richard Lau) #61898 * (SEMVER-MAJOR) V8: cherry-pick daf4656ba85e (Milad Fa) #61898 * (SEMVER-MAJOR) V8: cherry-pick d83f479604c8 (Joyee Cheung) #61898 * (SEMVER-MAJOR) V8: cherry-pick edeb0a4fa181 (Joyee Cheung) #61898 * (SEMVER-MAJOR) V8: cherry-pick aa0b288f87cc (Richard Lau) #61898 * (SEMVER-MAJOR) patch V8 to fix Windows build (StefanStojanovic) #61898 * (SEMVER-MAJOR) V8: cherry-pick highway@989a498fdf3 (Richard Lau) #61898 * (SEMVER-MAJOR) support madvise(3C) across ALL illumos revisions (Dan McDonald) #61898 * (SEMVER-MAJOR) patch V8 for illumos (Dan McDonald) #61898 * (SEMVER-MAJOR) remove problematic comment from v8-internal (Michaël Zasso) #61898 * (SEMVER-MAJOR) define V8_PRESERVE_MOST as no-op on Windows (Stefan Stojanovic) #61898 * (SEMVER-MAJOR) patch V8 to avoid duplicated zlib symbol (Michaël Zasso) #61898 * (SEMVER-MAJOR) update V8 to 14.6.202.33 (Michaël Zasso) #61898 * (SEMVER-MAJOR) update undici to 8.0.2 (Node.js GitHub Bot) #62384 * (SEMVER-MAJOR) V8: backport 151d0a44a1b2 (Abdirahim Musse) #60488 * (SEMVER-MAJOR) V8: cherry-pick 47800791b35c (Jakob Kummerow) #60488 * (SEMVER-MAJOR) patch V8 for illumos (Dan McDonald) #59805 * (SEMVER-MAJOR) use std::map in MSVC STL for EphemeronRememberedSet (Joyee Cheung) #58070 * (SEMVER-MAJOR) remove problematic comment from v8-internal (Michaël Zasso) #58070 * (SEMVER-MAJOR) patch V8 to avoid duplicated zlib symbol (Michaël Zasso) #54077 * (SEMVER-MAJOR) update V8 to 14.3.127.12 (Michaël Zasso) #60488 * (SEMVER-MAJOR) V8: cherry-pick ff34ae20c8e3 (Chengzhong Wu) #60111 * (SEMVER-MAJOR) V8: backport fed47445bbdd (Abdirahim Musse) #60111 * (SEMVER-MAJOR) patch V8 for illumos (Dan McDonald) #59805 * (SEMVER-MAJOR) use std::map in MSVC STL for EphemeronRememberedSet (Joyee Cheung) #58070 * (SEMVER-MAJOR) remove problematic comment from v8-internal (Michaël Zasso) #58070 * (SEMVER-MAJOR) patch V8 to avoid duplicated zlib symbol (Michaël Zasso) #54077 * (SEMVER-MAJOR) update V8 to 14.2.231.9 (Michaël Zasso) #60111 diagnostics_channel: * (SEMVER-MAJOR) ensure tracePromise consistency with non-Promises (René) #61766 doc: * (SEMVER-MAJOR) remove extensionless CJS exception for type:module packages (Matteo Collina) #62176 * (SEMVER-MAJOR) update supported Windows SDK version to 11 (Mike McCready) #61973 * (SEMVER-MAJOR) drop p8 and z13 support (Milad Fa) #61005 http: * (SEMVER-MAJOR) move writeHeader to end-of-life (Sebastian Beltran) #60635 * (SEMVER-MAJOR) fix handling of HTTP upgrades with bodies (Tim Perry) #60016 lib: * (SEMVER-MAJOR) return undefined for localStorage without file (Matteo Collina) #61333 lib,src: * (SEMVER-MAJOR) implement QuotaExceededError as DOMException-derived interface (Filip Skokan) #62293 module: * (SEMVER-MAJOR) runtime-deprecate module.register() (Geoffrey Booth) #62401 * (SEMVER-MAJOR) remove --experimental-transform-types (Marco Ippolito) #61803 src: * (SEMVER-MAJOR) replace uses of deprecated v8::External APIs (gahaas) #61898 * (SEMVER-MAJOR) stop using `v8::PropertyCallbackInfo<T>::This()` (Igor Sheludko) #61898 * (SEMVER-MAJOR) avoid deprecated Wasm API (Clemens Backes) #61898 * (SEMVER-MAJOR) avoid deprecated `FixedArray::Get` (Clemens Backes) #61898 * (SEMVER-MAJOR) update NODE_MODULE_VERSION to 147 (Michaël Zasso) #61898 * (SEMVER-MAJOR) remove deprecated and unused isolate fields (Michaël Zasso) #60488 * (SEMVER-MAJOR) update NODE_MODULE_VERSION to 144 (Michaël Zasso) #60488 * (SEMVER-MAJOR) include `node_api_types.h` instead of `node_api.h` in `node.h` (Anna Henningsen) #60496 * (SEMVER-MAJOR) update NODE_MODULE_VERSION to 142 (Michaël Zasso) #60111 stream: * (SEMVER-MAJOR) promote DEP0201 to runtime deprecation (René) #62173 * (SEMVER-MAJOR) move _stream_* to end-of-life (Sebastian Beltran) #60657 * (SEMVER-MAJOR) readable read one buffer at a time (Robert Nagy) #60441 * (SEMVER-MAJOR) preserve AsyncLocalStorage on finished only when needed (avcribl) #59873 test: * (SEMVER-MAJOR) skip wasm allocation tests in workers (Michaël Zasso) #61898 * (SEMVER-MAJOR) update wpt Wasm jsapi expectations (Michaël Zasso) #61898 * (SEMVER-MAJOR) support presence of Temporal global (Michaël Zasso) #61898 * (SEMVER-MAJOR) add type tags to uses of v8::External (gahaas) #61898 * (SEMVER-MAJOR) fix test-linux-perf-logger for V8 14.3 (Michaël Zasso) #60488 tools: * (SEMVER-MAJOR) remove v8_initializers_slow workaround from v8.gyp (Michaël Zasso) #61898 * (SEMVER-MAJOR) add Rust args to `tools/make-v8.sh` (Richard Lau) #61898 * (SEMVER-MAJOR) update V8 gypfiles for 14.6 (Michaël Zasso) #61898 * (SEMVER-MAJOR) update V8 gypfiles for 14.5 (Michaël Zasso) #61898 * (SEMVER-MAJOR) update V8 gypfiles for 14.4 (Michaël Zasso) #61898 util: * (SEMVER-MAJOR) mark proxied objects as such when inspecting them (Ruben Bridgewater) #61029 * (SEMVER-MAJOR) reduce TextEncoder.encodeInto function size (Yagiz Nizipli) #60339 PR-URL: #62526

PR-URL: #61806 Fixes: #57127 Reviewed-By: Matteo Collina <matteo.collina@gmail.com> Reviewed-By: Colin Ihrig <cjihrig@gmail.com> Reviewed-By: Michaël Zasso <targos@protonmail.com> Reviewed-By: Chengzhong Wu <legendecas@gmail.com> Reviewed-By: Anna Henningsen <anna@addaleax.net> Reviewed-By: Juan José Arboleda <soyjuanarbol@gmail.com> Reviewed-By: James M Snell <jasnell@gmail.com> Reviewed-By: Aviv Keller <me@aviv.sh> Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com> (cherry picked from commit 79c9149)

Enabling Temporal support requires `cargo` and `rustc`, which are new build toolchain requirements. Add a `--v8-disable-temporal-support` option to `configure.py` to explicitly opt-out of Temporal support (i.e. no need for Rust). If the existing `--v8-enable-temporal-support` option is not explicitly passed to `configure.py`: - Attempt to detect `cargo` and `rustc`. - If neither `cargo` and `rustc` are detected, print a warning and disable Temporal support. - If both `cargo` and `rustc` are detected, enable Temporal support. If `--v8-enable-temporal-support` is passed to `configure.py`, then the build will error and stop if `cargo` and/or `rustc` are not detected. To avoid ambiguity, `configure.py` will error and stop if both `--v8-disable-temporal-support` and `--v8-enable-temporal-support` are used. Signed-off-by: Richard Lau <richard.lau@ibm.com> PR-URL: #61806 Fixes: #57127 Reviewed-By: Matteo Collina <matteo.collina@gmail.com> Reviewed-By: Colin Ihrig <cjihrig@gmail.com> Reviewed-By: Michaël Zasso <targos@protonmail.com> Reviewed-By: Chengzhong Wu <legendecas@gmail.com> Reviewed-By: Anna Henningsen <anna@addaleax.net> Reviewed-By: Juan José Arboleda <soyjuanarbol@gmail.com> Reviewed-By: James M Snell <jasnell@gmail.com> Reviewed-By: Aviv Keller <me@aviv.sh> Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com> (cherry picked from commit fc4b334)

assert: * (SEMVER-MAJOR) allow printf-style messages as assertion error (Ruben Bridgewater) #58849 build: * (SEMVER-MAJOR) bump GCC requirement to 13.2 (Michaël Zasso) #62555 * (SEMVER-MAJOR) enable Temporal by default (Richard Lau) #61806 * (SEMVER-MAJOR) enable V8_VERIFY_WRITE_BARRIERS in debug build (Joyee Cheung) #61898 * (SEMVER-MAJOR) reset embedder string to "-node.0" (Michaël Zasso) #61898 * (SEMVER-MAJOR) target Power 9 for AIX/IBM i (Richard Lau) #62296 * (SEMVER-MAJOR) drop support for Python 3.9 (Mike McCready) #61177 * (SEMVER-MAJOR) enable maglev for Linux on s390x (Richard Lau) #60863 * (SEMVER-MAJOR) reset embedder string to "-node.0" (Michaël Zasso) #60488 * (SEMVER-MAJOR) reset embedder string to "-node.0" (Michaël Zasso) #60111 build,test: * (CVE-2026-21717) (SEMVER-MAJOR) test array index hash collision (Joyee Cheung) #61898 build,win: * (SEMVER-MAJOR) fix Temporal build (StefanStojanovic) #61806 crypto: * (SEMVER-MAJOR) unify asymmetric key import through KeyObjectHandle::Init (Filip Skokan) #62499 * (SEMVER-MAJOR) runtime-deprecate DEP0203 and DEP0204 (Filip Skokan) #62453 * (SEMVER-MAJOR) decorate async crypto job errors with OpenSSL error details (Filip Skokan) #62348 * (SEMVER-MAJOR) default ML-KEM and ML-DSA pkcs8 export to seed-only format (Filip Skokan) #62178 * (SEMVER-MAJOR) move DEP0182 to End-of-Life (Tobias Nießen) #61084 * (SEMVER-MAJOR) fix DOMException name for non-extractable key error (Filip Skokan) #60830 deps: * (SEMVER-MAJOR) fix V8 race condition for AIX (Abdirahim Musse) #61898 * (SEMVER-MAJOR) V8: cherry-pick cd2c216e7658 (LuYahan) #61898 * (SEMVER-MAJOR) V8: backport 088b7112e7ab (Igor Sheludko) #61898 * (SEMVER-MAJOR) V8: cherry-pick 00f6e834029f (Joyee Cheung) #61898 * (SEMVER-MAJOR) V8: backport bef0d9c1bc90 (Joyee Cheung) #61898 * (SEMVER-MAJOR) V8: cherry-pick cf1bce40a5ef (Richard Lau) #61898 * (SEMVER-MAJOR) V8: cherry-pick daf4656ba85e (Milad Fa) #61898 * (SEMVER-MAJOR) V8: cherry-pick d83f479604c8 (Joyee Cheung) #61898 * (SEMVER-MAJOR) V8: cherry-pick edeb0a4fa181 (Joyee Cheung) #61898 * (SEMVER-MAJOR) V8: cherry-pick aa0b288f87cc (Richard Lau) #61898 * (SEMVER-MAJOR) patch V8 to fix Windows build (StefanStojanovic) #61898 * (SEMVER-MAJOR) V8: cherry-pick highway@989a498fdf3 (Richard Lau) #61898 * (SEMVER-MAJOR) support madvise(3C) across ALL illumos revisions (Dan McDonald) #61898 * (SEMVER-MAJOR) patch V8 for illumos (Dan McDonald) #61898 * (SEMVER-MAJOR) remove problematic comment from v8-internal (Michaël Zasso) #61898 * (SEMVER-MAJOR) define V8_PRESERVE_MOST as no-op on Windows (Stefan Stojanovic) #61898 * (SEMVER-MAJOR) patch V8 to avoid duplicated zlib symbol (Michaël Zasso) #61898 * (SEMVER-MAJOR) update V8 to 14.6.202.33 (Michaël Zasso) #61898 * (SEMVER-MAJOR) update undici to 8.0.2 (Node.js GitHub Bot) #62384 * (SEMVER-MAJOR) V8: backport 151d0a44a1b2 (Abdirahim Musse) #60488 * (SEMVER-MAJOR) V8: cherry-pick 47800791b35c (Jakob Kummerow) #60488 * (SEMVER-MAJOR) patch V8 for illumos (Dan McDonald) #59805 * (SEMVER-MAJOR) use std::map in MSVC STL for EphemeronRememberedSet (Joyee Cheung) #58070 * (SEMVER-MAJOR) remove problematic comment from v8-internal (Michaël Zasso) #58070 * (SEMVER-MAJOR) patch V8 to avoid duplicated zlib symbol (Michaël Zasso) #54077 * (SEMVER-MAJOR) update V8 to 14.3.127.12 (Michaël Zasso) #60488 * (SEMVER-MAJOR) V8: cherry-pick ff34ae20c8e3 (Chengzhong Wu) #60111 * (SEMVER-MAJOR) V8: backport fed47445bbdd (Abdirahim Musse) #60111 * (SEMVER-MAJOR) patch V8 for illumos (Dan McDonald) #59805 * (SEMVER-MAJOR) use std::map in MSVC STL for EphemeronRememberedSet (Joyee Cheung) #58070 * (SEMVER-MAJOR) remove problematic comment from v8-internal (Michaël Zasso) #58070 * (SEMVER-MAJOR) patch V8 to avoid duplicated zlib symbol (Michaël Zasso) #54077 * (SEMVER-MAJOR) update V8 to 14.2.231.9 (Michaël Zasso) #60111 diagnostics_channel: * (SEMVER-MAJOR) ensure tracePromise consistency with non-Promises (René) #61766 doc: * (SEMVER-MAJOR) remove extensionless CJS exception for type:module packages (Matteo Collina) #62176 * (SEMVER-MAJOR) update supported Windows SDK version to 11 (Mike McCready) #61973 * (SEMVER-MAJOR) drop p8 and z13 support (Milad Fa) #61005 http: * (SEMVER-MAJOR) move writeHeader to end-of-life (Sebastian Beltran) #60635 * (SEMVER-MAJOR) fix handling of HTTP upgrades with bodies (Tim Perry) #60016 lib: * (SEMVER-MAJOR) return undefined for localStorage without file (Matteo Collina) #61333 lib,src: * (SEMVER-MAJOR) implement QuotaExceededError as DOMException-derived interface (Filip Skokan) #62293 module: * (SEMVER-MAJOR) runtime-deprecate module.register() (Geoffrey Booth) #62401 * (SEMVER-MAJOR) remove --experimental-transform-types (Marco Ippolito) #61803 src: * (SEMVER-MAJOR) replace uses of deprecated v8::External APIs (gahaas) #61898 * (SEMVER-MAJOR) stop using `v8::PropertyCallbackInfo<T>::This()` (Igor Sheludko) #61898 * (SEMVER-MAJOR) avoid deprecated Wasm API (Clemens Backes) #61898 * (SEMVER-MAJOR) avoid deprecated `FixedArray::Get` (Clemens Backes) #61898 * (SEMVER-MAJOR) update NODE_MODULE_VERSION to 147 (Michaël Zasso) #61898 * (SEMVER-MAJOR) remove deprecated and unused isolate fields (Michaël Zasso) #60488 * (SEMVER-MAJOR) update NODE_MODULE_VERSION to 144 (Michaël Zasso) #60488 * (SEMVER-MAJOR) include `node_api_types.h` instead of `node_api.h` in `node.h` (Anna Henningsen) #60496 * (SEMVER-MAJOR) update NODE_MODULE_VERSION to 142 (Michaël Zasso) #60111 stream: * (SEMVER-MAJOR) promote DEP0201 to runtime deprecation (René) #62173 * (SEMVER-MAJOR) move _stream_* to end-of-life (Sebastian Beltran) #60657 * (SEMVER-MAJOR) readable read one buffer at a time (Robert Nagy) #60441 * (SEMVER-MAJOR) preserve AsyncLocalStorage on finished only when needed (avcribl) #59873 test: * (SEMVER-MAJOR) skip wasm allocation tests in workers (Michaël Zasso) #61898 * (SEMVER-MAJOR) update wpt Wasm jsapi expectations (Michaël Zasso) #61898 * (SEMVER-MAJOR) support presence of Temporal global (Michaël Zasso) #61898 * (SEMVER-MAJOR) add type tags to uses of v8::External (gahaas) #61898 * (SEMVER-MAJOR) fix test-linux-perf-logger for V8 14.3 (Michaël Zasso) #60488 tools: * (SEMVER-MAJOR) remove v8_initializers_slow workaround from v8.gyp (Michaël Zasso) #61898 * (SEMVER-MAJOR) add Rust args to `tools/make-v8.sh` (Richard Lau) #61898 * (SEMVER-MAJOR) update V8 gypfiles for 14.6 (Michaël Zasso) #61898 * (SEMVER-MAJOR) update V8 gypfiles for 14.5 (Michaël Zasso) #61898 * (SEMVER-MAJOR) update V8 gypfiles for 14.4 (Michaël Zasso) #61898 util: * (SEMVER-MAJOR) mark proxied objects as such when inspecting them (Ruben Bridgewater) #61029 * (SEMVER-MAJOR) reduce TextEncoder.encodeInto function size (Yagiz Nizipli) #60339 PR-URL: #62526

assert: * (SEMVER-MAJOR) allow printf-style messages as assertion error (Ruben Bridgewater) #58849 build: * (SEMVER-MAJOR) bump GCC requirement to 13.2 (Michaël Zasso) #62555 * (SEMVER-MAJOR) enable Temporal by default (Richard Lau) #61806 * (SEMVER-MAJOR) enable V8_VERIFY_WRITE_BARRIERS in debug build (Joyee Cheung) #61898 * (SEMVER-MAJOR) reset embedder string to "-node.0" (Michaël Zasso) #61898 * (SEMVER-MAJOR) target Power 9 for AIX/IBM i (Richard Lau) #62296 * (SEMVER-MAJOR) drop support for Python 3.9 (Mike McCready) #61177 * (SEMVER-MAJOR) enable maglev for Linux on s390x (Richard Lau) #60863 * (SEMVER-MAJOR) reset embedder string to "-node.0" (Michaël Zasso) #60488 * (SEMVER-MAJOR) reset embedder string to "-node.0" (Michaël Zasso) #60111 build,test: * (CVE-2026-21717) (SEMVER-MAJOR) test array index hash collision (Joyee Cheung) #61898 build,win: * (SEMVER-MAJOR) fix Temporal build (StefanStojanovic) #61806 crypto: * (SEMVER-MAJOR) unify asymmetric key import through KeyObjectHandle::Init (Filip Skokan) #62499 * (SEMVER-MAJOR) runtime-deprecate DEP0203 and DEP0204 (Filip Skokan) #62453 * (SEMVER-MAJOR) decorate async crypto job errors with OpenSSL error details (Filip Skokan) #62348 * (SEMVER-MAJOR) default ML-KEM and ML-DSA pkcs8 export to seed-only format (Filip Skokan) #62178 * (SEMVER-MAJOR) move DEP0182 to End-of-Life (Tobias Nießen) #61084 * (SEMVER-MAJOR) fix DOMException name for non-extractable key error (Filip Skokan) #60830 deps: * (SEMVER-MAJOR) V8: cherry-pick 0f024d4e66e0 (ishabi) #62408 * (SEMVER-MAJOR) fix V8 race condition for AIX (Abdirahim Musse) #61898 * (SEMVER-MAJOR) V8: cherry-pick cd2c216e7658 (LuYahan) #61898 * (SEMVER-MAJOR) V8: backport 088b7112e7ab (Igor Sheludko) #61898 * (SEMVER-MAJOR) V8: cherry-pick 00f6e834029f (Joyee Cheung) #61898 * (SEMVER-MAJOR) V8: backport bef0d9c1bc90 (Joyee Cheung) #61898 * (SEMVER-MAJOR) V8: cherry-pick cf1bce40a5ef (Richard Lau) #61898 * (SEMVER-MAJOR) V8: cherry-pick daf4656ba85e (Milad Fa) #61898 * (SEMVER-MAJOR) V8: cherry-pick d83f479604c8 (Joyee Cheung) #61898 * (SEMVER-MAJOR) V8: cherry-pick edeb0a4fa181 (Joyee Cheung) #61898 * (SEMVER-MAJOR) V8: cherry-pick aa0b288f87cc (Richard Lau) #61898 * (SEMVER-MAJOR) patch V8 to fix Windows build (StefanStojanovic) #61898 * (SEMVER-MAJOR) V8: cherry-pick highway@989a498fdf3 (Richard Lau) #61898 * (SEMVER-MAJOR) support madvise(3C) across ALL illumos revisions (Dan McDonald) #61898 * (SEMVER-MAJOR) patch V8 for illumos (Dan McDonald) #61898 * (SEMVER-MAJOR) remove problematic comment from v8-internal (Michaël Zasso) #61898 * (SEMVER-MAJOR) define V8_PRESERVE_MOST as no-op on Windows (Stefan Stojanovic) #61898 * (SEMVER-MAJOR) patch V8 to avoid duplicated zlib symbol (Michaël Zasso) #61898 * (SEMVER-MAJOR) update V8 to 14.6.202.33 (Michaël Zasso) #61898 * (SEMVER-MAJOR) update undici to 8.0.2 (Node.js GitHub Bot) #62384 * (SEMVER-MAJOR) V8: backport 151d0a44a1b2 (Abdirahim Musse) #60488 * (SEMVER-MAJOR) V8: cherry-pick 47800791b35c (Jakob Kummerow) #60488 * (SEMVER-MAJOR) patch V8 for illumos (Dan McDonald) #59805 * (SEMVER-MAJOR) use std::map in MSVC STL for EphemeronRememberedSet (Joyee Cheung) #58070 * (SEMVER-MAJOR) remove problematic comment from v8-internal (Michaël Zasso) #58070 * (SEMVER-MAJOR) patch V8 to avoid duplicated zlib symbol (Michaël Zasso) #54077 * (SEMVER-MAJOR) update V8 to 14.3.127.12 (Michaël Zasso) #60488 * (SEMVER-MAJOR) V8: cherry-pick ff34ae20c8e3 (Chengzhong Wu) #60111 * (SEMVER-MAJOR) V8: backport fed47445bbdd (Abdirahim Musse) #60111 * (SEMVER-MAJOR) patch V8 for illumos (Dan McDonald) #59805 * (SEMVER-MAJOR) use std::map in MSVC STL for EphemeronRememberedSet (Joyee Cheung) #58070 * (SEMVER-MAJOR) remove problematic comment from v8-internal (Michaël Zasso) #58070 * (SEMVER-MAJOR) patch V8 to avoid duplicated zlib symbol (Michaël Zasso) #54077 * (SEMVER-MAJOR) update V8 to 14.2.231.9 (Michaël Zasso) #60111 diagnostics_channel: * (SEMVER-MAJOR) ensure tracePromise consistency with non-Promises (René) #61766 doc: * (SEMVER-MAJOR) remove extensionless CJS exception for type:module packages (Matteo Collina) #62176 * (SEMVER-MAJOR) update supported Windows SDK version to 11 (Mike McCready) #61973 * (SEMVER-MAJOR) drop p8 and z13 support (Milad Fa) #61005 http: * (SEMVER-MAJOR) move writeHeader to end-of-life (Sebastian Beltran) #60635 * (SEMVER-MAJOR) fix handling of HTTP upgrades with bodies (Tim Perry) #60016 lib: * (SEMVER-MAJOR) return undefined for localStorage without file (Matteo Collina) #61333 lib,src: * (SEMVER-MAJOR) implement QuotaExceededError as DOMException-derived interface (Filip Skokan) #62293 module: * (SEMVER-MAJOR) runtime-deprecate module.register() (Geoffrey Booth) #62401 * (SEMVER-MAJOR) remove --experimental-transform-types (Marco Ippolito) #61803 src: * (SEMVER-MAJOR) replace uses of deprecated v8::External APIs (gahaas) #61898 * (SEMVER-MAJOR) stop using `v8::PropertyCallbackInfo<T>::This()` (Igor Sheludko) #61898 * (SEMVER-MAJOR) avoid deprecated Wasm API (Clemens Backes) #61898 * (SEMVER-MAJOR) avoid deprecated `FixedArray::Get` (Clemens Backes) #61898 * (SEMVER-MAJOR) update NODE_MODULE_VERSION to 147 (Michaël Zasso) #61898 * (SEMVER-MAJOR) remove deprecated and unused isolate fields (Michaël Zasso) #60488 * (SEMVER-MAJOR) update NODE_MODULE_VERSION to 144 (Michaël Zasso) #60488 * (SEMVER-MAJOR) include `node_api_types.h` instead of `node_api.h` in `node.h` (Anna Henningsen) #60496 * (SEMVER-MAJOR) update NODE_MODULE_VERSION to 142 (Michaël Zasso) #60111 stream: * (SEMVER-MAJOR) promote DEP0201 to runtime deprecation (René) #62173 * (SEMVER-MAJOR) move _stream_* to end-of-life (Sebastian Beltran) #60657 * (SEMVER-MAJOR) readable read one buffer at a time (Robert Nagy) #60441 * (SEMVER-MAJOR) preserve AsyncLocalStorage on finished only when needed (avcribl) #59873 test: * (SEMVER-MAJOR) skip wasm allocation tests in workers (Michaël Zasso) #61898 * (SEMVER-MAJOR) update wpt Wasm jsapi expectations (Michaël Zasso) #61898 * (SEMVER-MAJOR) support presence of Temporal global (Michaël Zasso) #61898 * (SEMVER-MAJOR) add type tags to uses of v8::External (gahaas) #61898 * (SEMVER-MAJOR) fix test-linux-perf-logger for V8 14.3 (Michaël Zasso) #60488 tools: * (SEMVER-MAJOR) remove v8_initializers_slow workaround from v8.gyp (Michaël Zasso) #61898 * (SEMVER-MAJOR) add Rust args to `tools/make-v8.sh` (Richard Lau) #61898 * (SEMVER-MAJOR) update V8 gypfiles for 14.6 (Michaël Zasso) #61898 * (SEMVER-MAJOR) update V8 gypfiles for 14.5 (Michaël Zasso) #61898 * (SEMVER-MAJOR) update V8 gypfiles for 14.4 (Michaël Zasso) #61898 util: * (SEMVER-MAJOR) mark proxied objects as such when inspecting them (Ruben Bridgewater) #61029 * (SEMVER-MAJOR) reduce TextEncoder.encodeInto function size (Yagiz Nizipli) #60339 PR-URL: #62526

Dustin4444

#62572

Note the default-on status of Temporal support in Node.js 26 and document the --v8-enable-temporal-support and --v8-disable-temporal-support options along with the cargo and rustc auto-detection behavior introduced in nodejs#61806. Refs: nodejs#63225 Signed-off-by: ChrisJr404 <chris@hacknow.com>

Note the default-on status of Temporal support in Node.js 26 and document the --v8-enable-temporal-support and --v8-disable-temporal-support options along with the cargo and rustc auto-detection behavior introduced in #61806. Refs: #63225 Signed-off-by: ChrisJr404 <chris@hacknow.com> PR-URL: #63248 Reviewed-By: Stewart X Addison <sxa@redhat.com> Reviewed-By: Richard Lau <richard.lau@ibm.com> Reviewed-By: Stefan Stojanovic <stefan.stojanovic@janeasystems.com> Reviewed-By: Rafael Gonzaga <rafael.nunu@hotmail.com>

Automated mise tool upgrades from local config. Updated tools: - `action-validator` - `actionlint` - `aube` - `editorconfig-checker` - `ghalint` - `node` - `pinact` - `pipx:gh-action-pulse` - `prek` - `rumdl` - `shellcheck` - `shfmt` - `tombi` - `uv` - `yamlfmt` - `yamllint` - `zizmor` Command: `mise upgrade --bump --local action-validator actionlint aube editorconfig-checker ghalint node pinact pipx:gh-action-pulse prek rumdl shellcheck shfmt tombi uv yamlfmt yamllint zizmor` <details> <summary>Version changelog (node)</summary> | Tool | Requested | Installed | |------|-----------|-----------| | `node` | `24` → `26` | `24.18.1` → `26.5.1` | </details> <details> <summary>Release notes (1 tools)</summary> <details> <summary>node: `24.18.1` → `26.5.1` (nodejs/node)</summary> ### v25.8.2 This is a security release. ### Notable Changes * (CVE-2026-21637) wrap `SNICallback` invocation in `try`/`catch` (Matteo Collina) - High * (CVE-2026-21710) use null prototype for `headersDistinct`/`trailersDistinct` (Matteo Collina) - High * (CVE-2026-21711) include permission check to `pipe_wrap.cc` (RafaelGSS) - Medium * (CVE-2026-21712) handle url crash on different url formats (RafaelGSS) - Medium * (CVE-2026-21713) use timing-safe comparison in Web Cryptography HMAC and KMAC (Filip Skokan) - Medium * (CVE-2026-21714) handle `NGHTTP2_ERR_FLOW_CONTROL` error code (RafaelGSS) - Medium * (CVE-2026-21717) test array index hash collision (Joyee Cheung) - Medium * (CVE-2026-21715) add permission check to `realpath.native` (RafaelGSS) - Low * (CVE-2026-21716) include permission check on `lib/fs/promises` (RafaelGSS) - Low ### Commits * \[[`2086b7477b`](nodejs/node@2086b7477b)] - **(CVE-2026-21717)** **build,test**: test array index hash collision (Joyee Cheung) [nodejs-private/node-private#834](https://github.com/nodejs-private/node-private/pull/834) * \[[`0f9332a40a`](nodejs/node@0f9332a40a)] - **(CVE-2026-21713)** **crypto**: use timing-safe comparison in Web Cryptography HMAC and KMAC (Filip Skokan) [nodejs-private/node-private#822](https://github.com/nodejs-private/node-private/pull/822) * \[[`2b6937ddb2`](nodejs/node@2b6937ddb2)] - **deps**: update undici to 7.24.4 (Node.js GitHub Bot) [#62271](nodejs/node#62271) * \[[`bfb8ad5787`](nodejs/node@bfb8ad5787)] - **deps**: update undici to 7.24.3 (Node.js GitHub Bot) [#62233](nodejs/node#62233) * \[[`be6384727f`](nodejs/node@be6384727f)] - **deps**: upgrade npm to 11.11.1 (npm team) [#62216](nodejs/node#62216) * \[[`2feea5bb97`](nodejs/node@2feea5bb97)] - **deps**: V8: override… (truncated) ### v25.9.0 ### Notable Changes #### Test runner module mocking improvements `MockModuleOptions.defaultExport` and `MockModuleOptions.namedExports` have been consolidated into a single option `MockModuleOptions.exports` to align with user expectations and other test runners. A `default` property on `MockModuleOptions.exports` represents the default export, and own enumerable properties are treated as named exports. An automated migration is available to update user code: <https://github.com/nodejs/userland-migrations/tree/main/recipes/mock-module-exports> ```bash npx codemod @nodejs/mock-module-exports ``` Contributed by sangwook in [#61727](nodejs/node#61727). #### Other notable changes * \[[`312476cb84`](nodejs/node@312476cb84)] - **(SEMVER-MINOR)** **async\_hooks**: add using scopes to `AsyncLocalStorage` (Stephen Belanger) [#61674](nodejs/node#61674) * \[[`62d2cd473b`](nodejs/node@62d2cd473b)] - **(SEMVER-MINOR)** **cli**: add `--max-heap-size` option (tannal) [#58708](nodejs/node#58708) * \[[`d0ebf0e44b`](nodejs/node@d0ebf0e44b)] - **(SEMVER-MINOR)** **crypto**: add `TurboSHAKE` and `KangarooTwelve` Web Cryptography algorithms (Filip Skokan) [#62183](nodejs/node#62183) * \[[`f85b9d9fa8`](nodejs/node@f85b9d9fa8)] - **(SEMVER-MINOR)** **repl**: add customizable error handling (Anna Henningsen) [#62188](nodejs/node#62188) * \[[`67b854d407`](nodejs/node@67b854d407)] - **(SEMVER-MINOR)** **repl**: remove dependency on `node:domain` (Matteo Collina) [#61227](nodejs/node#61227) * \[[`966b700623`](nodejs/node@966b700623)] - **(SEMVER-MINOR)** **sea**: support code cache for ESM entrypoint in SEA (Joyee Cheung) [#62158](nodejs/node#62158) *… (truncated) ### v26.0.0 We're excited to announce the release of Node.js 26! Highlights include the Temporal API enabled by default, updates to the V8 JavaScript engine to 14.6, Undici to 8.0, and several important deprecations and removals as we continue to modernize the platform. As a reminder, Node.js 26 will enter long-term support (LTS) in October, but until then, it will be the "Current" release for the next six months. We encourage you to explore the new features and benefits offered by this latest release and evaluate their potential impact on your applications. ### Notable Changes #### Temporal API The Temporal API is now enabled by default in Node.js 26. Temporal is a modern date/time API for JavaScript that provides a more robust and feature-rich alternative to the legacy `Date` object. Contributed by Richard Lau in [#61806](nodejs/node#61806). #### V8 14.6 The V8 engine is updated to version 14.6.202.33, which is part of Chromium 134. This version also includes: * Upsert (<https://github.com/tc39/proposal-upsert>): `[Weak]Map.prototype.getOrInsert()`, `[Weak]Map.prototype.getOrInsertComputed()` * Iterator sequencing (<https://github.com/tc39/proposal-iterator-sequencing>): `Iterator.concat()` Contributed by Michaël Zasso in [#61898](nodejs/node#61898). #### Undici 8 Undici has been updated to version 8.0.2, bringing new features and improvements to Node.js's HTTP client implementation. #### Deprecations and Removals * \[[`dff46c07c3`](nodejs/node@dff46c07c3)] - **(SEMVER-MAJOR)** **crypto**: move DEP0182 to End-of-Life (Tobias Nießen) [#61084](nodejs/node#61084) * \[[`93c25815ee`](nodejs/node@93c25815ee)] - **(SEMVER-MAJOR)** **http**: move writeHeader to end-of-life (Sebastian Beltran) [#60635](nodejs/node#60635) `http.Server.prototype.writeHeader()` is now fully removed. Use `http.Server.prototype.write… (truncated) ### v26.1.0 ### Notable Changes #### Experimental `node:ffi` module Node.js now includes an experimental `node:ffi` module for loading dynamic libraries and calling native symbols from JavaScript. The API is gated behind the `--experimental-ffi` flag and, when the Permission Model is enabled, requires `--allow-ffi`. This API is inherently unsafe. Invalid pointers, incorrect signatures, or accessing memory after it has been freed can crash the process or corrupt memory. Contributed by Paolo Insogna in [#62072](nodejs/node#62072). #### Other Notable Changes * \[[`34a6454fe3`](nodejs/node@34a6454fe3)] - **(SEMVER-MINOR)** **buffer**: add `end` parameter (Robert Nagy) [#62390](nodejs/node#62390) * \[[`073e84d7fe`](nodejs/node@073e84d7fe)] - **(SEMVER-MINOR)** **crypto**: accept key data in `crypto.diffieHellman()` and cleanup DH jobs (Filip Skokan) [#62527](nodejs/node#62527) * \[[`5b9cb10a5f`](nodejs/node@5b9cb10a5f)] - **(SEMVER-MINOR)** **crypto**: implement `randomUUIDv7()` (nabeel378) [#62553](nodejs/node#62553) * \[[`98f9becd16`](nodejs/node@98f9becd16)] - **(SEMVER-MINOR)** **debugger**: add edit-free runtime expression probes to `node inspect` (Joyee Cheung) [#62713](nodejs/node#62713) * \[[`06defaa2ea`](nodejs/node@06defaa2ea)] - **(SEMVER-MINOR)** **fs**: add `signal` option to `fs.stat()` (Mert Can Altin) [#57775](nodejs/node#57775) * \[[`db66a963bf`](nodejs/node@db66a963bf)] - **(SEMVER-MINOR)** **fs**: expose `frsize` field in `statfs` (Jinho Jang) [#62277](nodejs/node#62277) * \[[`87adb3472b`](nodejs/node@87adb3472b)] - **(SEMVER-MINOR)** **http**: harden `ClientRequest` options merge (Matteo Collina) [#6… (truncated) ### v26.2.0 ### Notable Changes * \[[`189d43a193`](nodejs/node@189d43a193)] - **doc**: mark `stream.compose` stable (Matteo Collina) [#62562](nodejs/node#62562) * \[[`f858c6140e`](nodejs/node@f858c6140e)] - **(SEMVER-MINOR)** **fs**: add `Temporal.Instant` support to `Stats` and `BigIntStats` (Livia Medeiros) [#60789](nodejs/node#60789) * \[[`0cbb3895df`](nodejs/node@0cbb3895df)] - **(SEMVER-MINOR)** **http**: add `writeInformation` to send arbitrary 1xx status codes (Tim Perry) [#63155](nodejs/node#63155) ### Commits * \[[`9a394bab84`](nodejs/node@9a394bab84)] - **benchmark**: respect stream/iter broadcast backpressure (Trivikram Kamat) [#63314](nodejs/node#63314) * \[[`ad98b4620b`](nodejs/node@ad98b4620b)] - **crypto**: align verifyOneShot accepted types (Anshika Jain) [#63280](nodejs/node#63280) * \[[`ba0736a847`](nodejs/node@ba0736a847)] - **crypto**: wire ML-DSA and ML-KEM for use when using BoringSSL (Filip Skokan) [#63255](nodejs/node#63255) * \[[`5573a6a4a8`](nodejs/node@5573a6a4a8)] - **crypto**: wire ChaCha20-Poly1305 in Web Cryptography when using BoringSSL (Filip Skokan) [#63255](nodejs/node#63255) * \[[`7dc563b8d6`](nodejs/node@7dc563b8d6)] - **crypto**: wire AES-KW in Web Cryptography when using BoringSSL (Filip Skokan) [#63255](nodejs/node#63255) * \[[`b55e2b1f4d`](nodejs/node@b55e2b1f4d)] - **crypto**: improve system certificate enumeration logic on macOS (Robo) [#62576](nodejs/node#62576) * \[[`fd509a755a`](nodejs/node@fd509a755a)] - **crypto**: harden CryptoKey algorithm slots… (truncated) ### v26.3.0 ### Notable Changes #### Potential changes to macOS Universal Binary availability With Apple and its ecosystem progressively dropping support for Intel-based architectures, it has become apparent that the Node.js project may not be able to maintain the universal binaries we currently distribute for the full lifetime of Node.js 26. This change serves to communicate that risk. At present, our intention remains to continue shipping universal binaries supporting both Apple Silicon and Intel-based Macs for as long as practical. Contributed by Antoine du Hamel in [#63055](nodejs/node#63055). #### Other notable changes * \[[`a2a4b33dd8`](nodejs/node@a2a4b33dd8)] - **(SEMVER-MINOR)** **buffer**: increase `Buffer.poolSize` default to 64 KiB (Matteo Collina) [#63597](nodejs/node#63597) * \[[`051a2152f7`](nodejs/node@051a2152f7)] - **crypto**: update root certificates to NSS 3.123.1 (Node.js GitHub Bot) [#63527](nodejs/node#63527) * \[[`49462eca37`](nodejs/node@49462eca37)] - **(SEMVER-MINOR)** **http**: add `httpValidation` option to configure header value validation (RajeshKumar11) [#61597](nodejs/node#61597) * \[[`97b7ab19bd`](nodejs/node@97b7ab19bd)] - **(SEMVER-MINOR)** **inspector**: expose precise coverage start to JS runtime (sangwook) [#63079](nodejs/node#63079) * \[[`cfb80a2103`](nodejs/node@cfb80a2103)] - **(SEMVER-MINOR)** **lib,permission**: add `permission.drop` (Rafael Gonzaga) [#62672](nodejs/node#62672) ### Commits * \[[`a2a4b33dd8`](nodejs/node@a2a4b33dd8)] - **(SEMVER-MINOR)** **buffer**: increase Buffer.poolSize default to 64 KiB (Matteo Collina) [#63597](nodejs/node#63597) * \[[`0eff3e23b9`](https://github.com/nodejs/n… (truncated) ### v26.3.1 This is a security release. ### Notable Changes * (CVE-2026-48618) tls: normalize hostname for server identity checks (Matteo Collina) – High * (CVE-2026-48933) crypto: guard WebCrypto cipher output length (Filip Skokan) – High * (CVE-2026-48615) lib,test: redact proxy credentials in tunnel errors (Matteo Collina) – Medium * (CVE-2026-48619) http2: cap originSet size to prevent unbounded memory growth (Matteo Collina) – Medium * (CVE-2026-48928) tls: fix case-sensitive SNI context matching (Matteo Collina) – Medium * (CVE-2026-48930) dns,net: reject hostnames with embedded NUL bytes (Matteo Collina) – Medium * (CVE-2026-48934) tls: bind reusable sessions to authenticated host (Matteo Collina) – Medium * (CVE-2026-48617) permission: handle process.chdir on writereport (RafaelGSS) – Low * (CVE-2026-48931) http: fix response queue poisoning in http.Agent (Matteo Collina) – Low * (CVE-2026-48935) permission: disable FileHandle utimes with permission model (RafaelGSS) – Low * (CVE-2026-48936) permission: guard pipe open and chmod with net scope (RafaelGSS) – Low ### Commits * \[[`98fbc89211`](nodejs/node@98fbc89211)] - **(CVE-2026-48933)** **crypto**: guard WebCrypto cipher output length (Filip Skokan) [nodejs-private/node-private#878](https://github.com/nodejs-private/node-private/pull/878) * \[[`110840f2c7`](nodejs/node@110840f2c7)] - **deps**: update llhttp to 9.4.2 (Antoine du Hamel) [nodejs-private/node-private#890](https://github.com/nodejs-private/node-private/pull/890) * \[[`8d36d522b2`](nodejs/node@8d36d522b2)] - **deps**: update undici to 8.5.0 (Node.js GitHub Bot) [#63903](nodejs/node#63903) * \[[`2e6d03993a`](nodejs/node@2e6d03993a)] - **deps**: update undici to 8.4.0 (Node.js GitHub Bot) [#63779](nodejs/node#63779) * \[[`5a17d5b07a`](nodejs/node@5a17d5b07a)] - **deps… (truncated) ### v26.4.0 ### Notable Changes * \[[`cde0daabcc`](nodejs/node@cde0daabcc)] - **(SEMVER-MINOR)** **doc**: update `blockList` stability status to release candidate (alphaleadership) [#63050](nodejs/node#63050) * \[[`b78f5a7537`](nodejs/node@b78f5a7537)] - **(SEMVER-MINOR)** **fs**: support caller-supplied `readFile()` buffers (Matteo Collina) [#63634](nodejs/node#63634) * \[[`417aacbc36`](nodejs/node@417aacbc36)] - **(SEMVER-MINOR)** **http**: close pre-request sockets in `closeIdleConnections` (semimikoh) [#63470](nodejs/node#63470) * \[[`fbb108be7d`](nodejs/node@fbb108be7d)] - **(SEMVER-MINOR)** **loader**: implement package maps (Maël Nison) [#62239](nodejs/node#62239) * \[[`45494d5a8a`](nodejs/node@45494d5a8a)] - **(SEMVER-MINOR)** **net**: support `TCP_KEEPINTVL` and `TCP_KEEPCNT` in `setKeepAlive` (Guy Bedford) [#63825](nodejs/node#63825) * \[[`ee29465e77`](nodejs/node@ee29465e77)] - **(SEMVER-MINOR)** **tls**: add certificateCompression option (Tim Perry) [#62217](nodejs/node#62217) * \[[`b17817eb2b`](nodejs/node@b17817eb2b)] - **(SEMVER-MINOR)** **vfs**: dispatch `node:fs/promises` to mounted VFS instances (Matteo Collina) [#63537](nodejs/node#63537) * \[[`7bc93a6ac5`](nodejs/node@7bc93a6ac5)] - **(SEMVER-MINOR)** **vfs**: add minimal `node:vfs` subsystem (Matteo Collina) [#63115](nodejs/node#63115) ### Commits * \[[`c7eb83b46a`](nodejs/node@c7eb83b46a)] - **benchmark**: add child\_process async path baselines (Yagiz Nizipli) [#63929](nodejs/node#63929) * \[[`066fff17a5`](https://github.com/nodejs/node/commit/066f… (truncated) ### v26.5.0 ### Notable Changes #### New release key Welcome to our newest releaser, [Stewart X Addison](https://github.com/sxa). Future Node.js releases may be signed with his [release key](https://github.com/nodejs/node/blob/main/README.md#release-keys), `655F3B5C1FB3FA8D1A0CA6BDE4A7D232B936D2FD`. #### Other notable changes * \[[`55f48446c7`](nodejs/node@55f48446c7)] - **(SEMVER-MINOR)** **buffer**: implement blob.textStream() (Matthew Aitken) [#64036](nodejs/node#64036) * \[[`b373202efc`](nodejs/node@b373202efc)] - **(SEMVER-MINOR)** **esm**: add `--experimental-import-text` flag (Efe) [#62300](nodejs/node#62300) * \[[`39e0c14455`](nodejs/node@39e0c14455)] - **(SEMVER-MINOR)** **perf\_hooks**: sample delay per event loop iteration (Pablo Erhard) [#62935](nodejs/node#62935) * \[[`999a83c937`](nodejs/node@999a83c937)] - **(SEMVER-MINOR)** **stream**: expose ReadableStreamTee (Matteo Collina) [#64195](nodejs/node#64195) * \[[`4e0236dc3d`](nodejs/node@4e0236dc3d)] - **(SEMVER-MINOR)** **tls**: report negotiated TLS groups (Filip Skokan) [#64119](nodejs/node#64119) ### Commits * \[[`87648c0a6c`](nodejs/node@87648c0a6c)] - **benchmark**: trim down the argon2 sets (Filip Skokan) [#64218](nodejs/node#64218) * \[[`a483bfd3f0`](nodejs/node@a483bfd3f0)] - **buffer**: remove unreachable overflow check in atob (haramjeong) [#60161](nodejs/node#60161) * \[[`6d14279688`](nodejs/node@6d14279688)] - **buffer**: add fast api for isUtf8 and isAscii (Gürgün Dayıoğlu) [#64169](nodejs/node#64169) * \[[`55f48446c7`](nodejs/node@55f48446c7)] -… (truncated) ### v26.5.1 This is a security release. ### Notable Changes * (CVE-2026-56848) http2: defer rst stream while in scope (Matteo Collina) – High * (CVE-2026-58043) permission: avoid granting radix split nodes (RafaelGSS) – High * (CVE-2026-56850) https: distinguish PFX object-array agent keys (RafaelGSS) – Medium * (CVE-2026-58040) https: bind identity checks to session reuse (Matteo Collina) – Medium * (CVE-2026-58041) sqlite: invalidate tag store iterators on statement reset (Matteo Collina) – Medium * (CVE-2026-58042) dns: handle large resolveAny address replies (RafaelGSS) – Medium * (CVE-2026-58045) zlib: throw on out-of-bounds write buffers (RafaelGSS) – Medium * (CVE-2026-56847) permission: enforce fs write permission for trace events (RafaelGSS) – Low * (CVE-2026-58039) permission: check final report output path (RafaelGSS) – Low * (CVE-2026-58044) http: reject requests exceeding max header count (Matteo Collina) – Low * deps: update llhttp to 9.4.3 (Paolo Insogna) * deps: update undici to 8.9.0 (Node.js GitHub Bot) ### Commits * \[[`af0bf96877`](nodejs/node@af0bf96877)] - **deps**: update llhttp to 9.4.3 (Paolo Insogna) [nodejs-private/node-private#935](https://github.com/nodejs-private/node-private/pull/935) * \[[`0354678355`](nodejs/node@0354678355)] - **deps**: update undici to 8.9.0 (Node.js GitHub Bot) [#64712](nodejs/node#64712) * \[[`dbeeaeec13`](nodejs/node@dbeeaeec13)] - **(CVE-2026-58042)** **dns**: handle large resolveAny address replies (RafaelGSS) [nodejs-private/node-private#929](https://github.com/nodejs-private/node-private/pull/929) * \[[`064d339f56`](nodejs/node@064d339f56)] - **(CVE-2026-58044)** **http**: reject requests exceeding max header count (Matteo Collina) [nodejs-private/node-private#922](https://github.com/nodejs-private/node-private/pull/922) * \[[`23b94c843a`](https://github.… (truncated) _Omitted 12 older releases._ </details> </details> Modified files: - `.mise.toml`

Automated mise tool upgrades from local config. Updated tools: - `action-validator` - `actionlint` - `aube` - `editorconfig-checker` - `ghalint` - `node` - `pinact` - `pipx:gh-action-pulse` - `prek` - `rumdl` - `shellcheck` - `shfmt` - `tombi` - `uv` - `yamlfmt` - `yamllint` - `zizmor` Command: `mise upgrade --bump --local action-validator actionlint aube editorconfig-checker ghalint node pinact pipx:gh-action-pulse prek rumdl shellcheck shfmt tombi uv yamlfmt yamllint zizmor` <details> <summary>Version changelog (6 tools)</summary> | Tool | Requested | Installed | |------|-----------|-----------| | `editorconfig-checker` | `3.8.0` → `3.11.1` | `3.8.0` → `3.11.1` | | `node` | `24` → `26` | `24.19.0` → `26.7.0` | | `prek` | `0.4.11` → `0.4.12` | `0.4.11` → `0.4.12` | | `rumdl` | `0.2.49` → `0.2.52` | `0.2.49` → `0.2.52` | | `tombi` | `1.2.6` → `1.2.7` | `1.2.6` → `1.2.7` | | `uv` | `0.12.1` → `0.12.3` | `0.12.1` → `0.12.3` | </details> <details> <summary>Release notes (6 tools)</summary> <details> <summary>editorconfig-checker: `3.8.0` → `3.11.1` (editorconfig-checker/editorconfig-checker)</summary> ### v3.9.0 ## [3.9.0](editorconfig-checker/editorconfig-checker@v3.8.0...v3.9.0) (2026-07-31) ### Features * enable immutable releases ([6865c06](editorconfig-checker/editorconfig-checker@6865c06)) ### v3.10.0 ## editorconfig-checker v3.10.0 (2026-08-07T23:27:59Z) Welcome to this new release of editorconfig-checker! ## Changelog ### Others * 77a3415d6127cc892376837b85fd2a4b5c98d40d: Revert "feat(immutable-releases): set release-please to create draft releases" (@klaernie) * a85cd6ab82397f19bdd9bfa30730a487ead1ec74: chore(deps): bump docker/login-action from 4.5.2 to 4.6.0 (#590) (@dependabot[bot]) * 74cd03a2e91c1c42deff2bec2d120c06ff1be3e8: chore(main): release 3.10.0 (#588) (@editorconfig-checker-bot) * 8d4f96e7a838bfb0d8b98a40e66ce8cbd8c1e075: chore: allow triggering release-please manually (@klaernie) * a685b542509d0349ce6215adf6088a242fa93d84: feat(immutable-release): tell release-please to create draft releases (@klaernie) * 912f4a986b7da0b22cfa3a055cc24a355dee7cbc: feat(immutable-releases): ensure that despite the release being a draft the tag is created (@klaernie) * 2d48c2ecae1743614cefa660c2796e14cefd7520: feat(immutable-releases): set release-please to create draft releases (@klaernie) ## Thanks! Those were the changes on v3.10.0! ### v3.11.0 ## editorconfig-checker v3.11.0 (2026-08-08T10:40:38Z) Welcome to this new release of editorconfig-checker! ## Changelog ### Others * 174c5809baf06f2d8e82c1d2de1f6433cc569a1d: chore(main): release 3.11.0 (#592) (@editorconfig-checker-bot) * e9f143bc9d6cc5bb29030843ec42eae2a94b4dda: chore: replace deprecated goreleaser option with its current form (@klaernie) * 4c08f2ccd339734ff92f2f04d146cd91af02d225: feat(immutable-release): goreleaser should publish its release (@klaernie) ## Thanks! Those were the changes on v3.11.0! ### v3.11.1 ## [3.11.1](editorconfig-checker/editorconfig-checker@v3.11.0...v3.11.1) (2026-08-08) ### Features * **immutable-release:** tell goreleaser to use the existing draft release ([a8e6136](editorconfig-checker/editorconfig-checker@a8e6136)) </details> <details> <summary>node: `24.19.0` → `26.7.0` (nodejs/node)</summary> ### v26.0.0 We're excited to announce the release of Node.js 26! Highlights include the Temporal API enabled by default, updates to the V8 JavaScript engine to 14.6, Undici to 8.0, and several important deprecations and removals as we continue to modernize the platform. As a reminder, Node.js 26 will enter long-term support (LTS) in October, but until then, it will be the "Current" release for the next six months. We encourage you to explore the new features and benefits offered by this latest release and evaluate their potential impact on your applications. ### Notable Changes #### Temporal API The Temporal API is now enabled by default in Node.js 26. Temporal is a modern date/time API for JavaScript that provides a more robust and feature-rich alternative to the legacy `Date` object. Contributed by Richard Lau in [#61806](nodejs/node#61806). #### V8 14.6 The V8 engine is updated to version 14.6.202.33, which is part of Chromium 134. This version also includes: * Upsert (<https://github.com/tc39/proposal-upsert>): `[Weak]Map.prototype.getOrInsert()`, `[Weak]Map.prototype.getOrInsertComputed()` * Iterator sequencing (<https://github.com/tc39/proposal-iterator-sequencing>): `Iterator.concat()` Contributed by Michaël Zasso in [#61898](nodejs/node#61898). #### Undici 8 Undici has been updated to version 8.0.2, bringing new features and improvements to Node.js's HTTP client implementation. #### Deprecations and Removals * \[[`dff46c07c3`](nodejs/node@dff46c07c3)] - **(SEMVER-MAJOR)** **crypto**: move DEP0182 to End-of-Life (Tobias Nießen) [#61084](nodejs/node#61084) * \[[`93c25815ee`](nodejs/node@93c25815ee)] - **(SEMVER-MAJOR)** **http**: move writeHeader to end-of-life (Sebastian Beltran) [#60635](nodejs/node#60635) `http.Server.prototype.writeHeader()` is now fully removed. Use `http.Server.prototype.write… (truncated) ### v26.1.0 ### Notable Changes #### Experimental `node:ffi` module Node.js now includes an experimental `node:ffi` module for loading dynamic libraries and calling native symbols from JavaScript. The API is gated behind the `--experimental-ffi` flag and, when the Permission Model is enabled, requires `--allow-ffi`. This API is inherently unsafe. Invalid pointers, incorrect signatures, or accessing memory after it has been freed can crash the process or corrupt memory. Contributed by Paolo Insogna in [#62072](nodejs/node#62072). #### Other Notable Changes * \[[`34a6454fe3`](nodejs/node@34a6454fe3)] - **(SEMVER-MINOR)** **buffer**: add `end` parameter (Robert Nagy) [#62390](nodejs/node#62390) * \[[`073e84d7fe`](nodejs/node@073e84d7fe)] - **(SEMVER-MINOR)** **crypto**: accept key data in `crypto.diffieHellman()` and cleanup DH jobs (Filip Skokan) [#62527](nodejs/node#62527) * \[[`5b9cb10a5f`](nodejs/node@5b9cb10a5f)] - **(SEMVER-MINOR)** **crypto**: implement `randomUUIDv7()` (nabeel378) [#62553](nodejs/node#62553) * \[[`98f9becd16`](nodejs/node@98f9becd16)] - **(SEMVER-MINOR)** **debugger**: add edit-free runtime expression probes to `node inspect` (Joyee Cheung) [#62713](nodejs/node#62713) * \[[`06defaa2ea`](nodejs/node@06defaa2ea)] - **(SEMVER-MINOR)** **fs**: add `signal` option to `fs.stat()` (Mert Can Altin) [#57775](nodejs/node#57775) * \[[`db66a963bf`](nodejs/node@db66a963bf)] - **(SEMVER-MINOR)** **fs**: expose `frsize` field in `statfs` (Jinho Jang) [#62277](nodejs/node#62277) * \[[`87adb3472b`](nodejs/node@87adb3472b)] - **(SEMVER-MINOR)** **http**: harden `ClientRequest` options merge (Matteo Collina) [#6… (truncated) ### v26.2.0 ### Notable Changes * \[[`189d43a193`](nodejs/node@189d43a193)] - **doc**: mark `stream.compose` stable (Matteo Collina) [#62562](nodejs/node#62562) * \[[`f858c6140e`](nodejs/node@f858c6140e)] - **(SEMVER-MINOR)** **fs**: add `Temporal.Instant` support to `Stats` and `BigIntStats` (Livia Medeiros) [#60789](nodejs/node#60789) * \[[`0cbb3895df`](nodejs/node@0cbb3895df)] - **(SEMVER-MINOR)** **http**: add `writeInformation` to send arbitrary 1xx status codes (Tim Perry) [#63155](nodejs/node#63155) ### Commits * \[[`9a394bab84`](nodejs/node@9a394bab84)] - **benchmark**: respect stream/iter broadcast backpressure (Trivikram Kamat) [#63314](nodejs/node#63314) * \[[`ad98b4620b`](nodejs/node@ad98b4620b)] - **crypto**: align verifyOneShot accepted types (Anshika Jain) [#63280](nodejs/node#63280) * \[[`ba0736a847`](nodejs/node@ba0736a847)] - **crypto**: wire ML-DSA and ML-KEM for use when using BoringSSL (Filip Skokan) [#63255](nodejs/node#63255) * \[[`5573a6a4a8`](nodejs/node@5573a6a4a8)] - **crypto**: wire ChaCha20-Poly1305 in Web Cryptography when using BoringSSL (Filip Skokan) [#63255](nodejs/node#63255) * \[[`7dc563b8d6`](nodejs/node@7dc563b8d6)] - **crypto**: wire AES-KW in Web Cryptography when using BoringSSL (Filip Skokan) [#63255](nodejs/node#63255) * \[[`b55e2b1f4d`](nodejs/node@b55e2b1f4d)] - **crypto**: improve system certificate enumeration logic on macOS (Robo) [#62576](nodejs/node#62576) * \[[`fd509a755a`](nodejs/node@fd509a755a)] - **crypto**: harden CryptoKey algorithm slots… (truncated) ### v26.3.0 ### Notable Changes #### Potential changes to macOS Universal Binary availability With Apple and its ecosystem progressively dropping support for Intel-based architectures, it has become apparent that the Node.js project may not be able to maintain the universal binaries we currently distribute for the full lifetime of Node.js 26. This change serves to communicate that risk. At present, our intention remains to continue shipping universal binaries supporting both Apple Silicon and Intel-based Macs for as long as practical. Contributed by Antoine du Hamel in [#63055](nodejs/node#63055). #### Other notable changes * \[[`a2a4b33dd8`](nodejs/node@a2a4b33dd8)] - **(SEMVER-MINOR)** **buffer**: increase `Buffer.poolSize` default to 64 KiB (Matteo Collina) [#63597](nodejs/node#63597) * \[[`051a2152f7`](nodejs/node@051a2152f7)] - **crypto**: update root certificates to NSS 3.123.1 (Node.js GitHub Bot) [#63527](nodejs/node#63527) * \[[`49462eca37`](nodejs/node@49462eca37)] - **(SEMVER-MINOR)** **http**: add `httpValidation` option to configure header value validation (RajeshKumar11) [#61597](nodejs/node#61597) * \[[`97b7ab19bd`](nodejs/node@97b7ab19bd)] - **(SEMVER-MINOR)** **inspector**: expose precise coverage start to JS runtime (sangwook) [#63079](nodejs/node#63079) * \[[`cfb80a2103`](nodejs/node@cfb80a2103)] - **(SEMVER-MINOR)** **lib,permission**: add `permission.drop` (Rafael Gonzaga) [#62672](nodejs/node#62672) ### Commits * \[[`a2a4b33dd8`](nodejs/node@a2a4b33dd8)] - **(SEMVER-MINOR)** **buffer**: increase Buffer.poolSize default to 64 KiB (Matteo Collina) [#63597](nodejs/node#63597) * \[[`0eff3e23b9`](https://github.com/nodejs/n… (truncated) ### v26.3.1 This is a security release. ### Notable Changes * (CVE-2026-48618) tls: normalize hostname for server identity checks (Matteo Collina) – High * (CVE-2026-48933) crypto: guard WebCrypto cipher output length (Filip Skokan) – High * (CVE-2026-48615) lib,test: redact proxy credentials in tunnel errors (Matteo Collina) – Medium * (CVE-2026-48619) http2: cap originSet size to prevent unbounded memory growth (Matteo Collina) – Medium * (CVE-2026-48928) tls: fix case-sensitive SNI context matching (Matteo Collina) – Medium * (CVE-2026-48930) dns,net: reject hostnames with embedded NUL bytes (Matteo Collina) – Medium * (CVE-2026-48934) tls: bind reusable sessions to authenticated host (Matteo Collina) – Medium * (CVE-2026-48617) permission: handle process.chdir on writereport (RafaelGSS) – Low * (CVE-2026-48931) http: fix response queue poisoning in http.Agent (Matteo Collina) – Low * (CVE-2026-48935) permission: disable FileHandle utimes with permission model (RafaelGSS) – Low * (CVE-2026-48936) permission: guard pipe open and chmod with net scope (RafaelGSS) – Low ### Commits * \[[`98fbc89211`](nodejs/node@98fbc89211)] - **(CVE-2026-48933)** **crypto**: guard WebCrypto cipher output length (Filip Skokan) [nodejs-private/node-private#878](https://github.com/nodejs-private/node-private/pull/878) * \[[`110840f2c7`](nodejs/node@110840f2c7)] - **deps**: update llhttp to 9.4.2 (Antoine du Hamel) [nodejs-private/node-private#890](https://github.com/nodejs-private/node-private/pull/890) * \[[`8d36d522b2`](nodejs/node@8d36d522b2)] - **deps**: update undici to 8.5.0 (Node.js GitHub Bot) [#63903](nodejs/node#63903) * \[[`2e6d03993a`](nodejs/node@2e6d03993a)] - **deps**: update undici to 8.4.0 (Node.js GitHub Bot) [#63779](nodejs/node#63779) * \[[`5a17d5b07a`](nodejs/node@5a17d5b07a)] - **deps… (truncated) ### v26.4.0 ### Notable Changes * \[[`cde0daabcc`](nodejs/node@cde0daabcc)] - **(SEMVER-MINOR)** **doc**: update `blockList` stability status to release candidate (alphaleadership) [#63050](nodejs/node#63050) * \[[`b78f5a7537`](nodejs/node@b78f5a7537)] - **(SEMVER-MINOR)** **fs**: support caller-supplied `readFile()` buffers (Matteo Collina) [#63634](nodejs/node#63634) * \[[`417aacbc36`](nodejs/node@417aacbc36)] - **(SEMVER-MINOR)** **http**: close pre-request sockets in `closeIdleConnections` (semimikoh) [#63470](nodejs/node#63470) * \[[`fbb108be7d`](nodejs/node@fbb108be7d)] - **(SEMVER-MINOR)** **loader**: implement package maps (Maël Nison) [#62239](nodejs/node#62239) * \[[`45494d5a8a`](nodejs/node@45494d5a8a)] - **(SEMVER-MINOR)** **net**: support `TCP_KEEPINTVL` and `TCP_KEEPCNT` in `setKeepAlive` (Guy Bedford) [#63825](nodejs/node#63825) * \[[`ee29465e77`](nodejs/node@ee29465e77)] - **(SEMVER-MINOR)** **tls**: add certificateCompression option (Tim Perry) [#62217](nodejs/node#62217) * \[[`b17817eb2b`](nodejs/node@b17817eb2b)] - **(SEMVER-MINOR)** **vfs**: dispatch `node:fs/promises` to mounted VFS instances (Matteo Collina) [#63537](nodejs/node#63537) * \[[`7bc93a6ac5`](nodejs/node@7bc93a6ac5)] - **(SEMVER-MINOR)** **vfs**: add minimal `node:vfs` subsystem (Matteo Collina) [#63115](nodejs/node#63115) ### Commits * \[[`c7eb83b46a`](nodejs/node@c7eb83b46a)] - **benchmark**: add child\_process async path baselines (Yagiz Nizipli) [#63929](nodejs/node#63929) * \[[`066fff17a5`](https://github.com/nodejs/node/commit/066f… (truncated) ### v26.5.0 ### Notable Changes #### New release key Welcome to our newest releaser, [Stewart X Addison](https://github.com/sxa). Future Node.js releases may be signed with his [release key](https://github.com/nodejs/node/blob/main/README.md#release-keys), `655F3B5C1FB3FA8D1A0CA6BDE4A7D232B936D2FD`. #### Other notable changes * \[[`55f48446c7`](nodejs/node@55f48446c7)] - **(SEMVER-MINOR)** **buffer**: implement blob.textStream() (Matthew Aitken) [#64036](nodejs/node#64036) * \[[`b373202efc`](nodejs/node@b373202efc)] - **(SEMVER-MINOR)** **esm**: add `--experimental-import-text` flag (Efe) [#62300](nodejs/node#62300) * \[[`39e0c14455`](nodejs/node@39e0c14455)] - **(SEMVER-MINOR)** **perf\_hooks**: sample delay per event loop iteration (Pablo Erhard) [#62935](nodejs/node#62935) * \[[`999a83c937`](nodejs/node@999a83c937)] - **(SEMVER-MINOR)** **stream**: expose ReadableStreamTee (Matteo Collina) [#64195](nodejs/node#64195) * \[[`4e0236dc3d`](nodejs/node@4e0236dc3d)] - **(SEMVER-MINOR)** **tls**: report negotiated TLS groups (Filip Skokan) [#64119](nodejs/node#64119) ### Commits * \[[`87648c0a6c`](nodejs/node@87648c0a6c)] - **benchmark**: trim down the argon2 sets (Filip Skokan) [#64218](nodejs/node#64218) * \[[`a483bfd3f0`](nodejs/node@a483bfd3f0)] - **buffer**: remove unreachable overflow check in atob (haramjeong) [#60161](nodejs/node#60161) * \[[`6d14279688`](nodejs/node@6d14279688)] - **buffer**: add fast api for isUtf8 and isAscii (Gürgün Dayıoğlu) [#64169](nodejs/node#64169) * \[[`55f48446c7`](nodejs/node@55f48446c7)] -… (truncated) ### v26.5.1 This is a security release. ### Notable Changes * (CVE-2026-56848) http2: defer rst stream while in scope (Matteo Collina) – High * (CVE-2026-58043) permission: avoid granting radix split nodes (RafaelGSS) – High * (CVE-2026-56850) https: distinguish PFX object-array agent keys (RafaelGSS) – Medium * (CVE-2026-58040) https: bind identity checks to session reuse (Matteo Collina) – Medium * (CVE-2026-58041) sqlite: invalidate tag store iterators on statement reset (Matteo Collina) – Medium * (CVE-2026-58042) dns: handle large resolveAny address replies (RafaelGSS) – Medium * (CVE-2026-58045) zlib: throw on out-of-bounds write buffers (RafaelGSS) – Medium * (CVE-2026-56847) permission: enforce fs write permission for trace events (RafaelGSS) – Low * (CVE-2026-58039) permission: check final report output path (RafaelGSS) – Low * (CVE-2026-58044) http: reject requests exceeding max header count (Matteo Collina) – Low * deps: update llhttp to 9.4.3 (Paolo Insogna) * deps: update undici to 8.9.0 (Node.js GitHub Bot) ### Commits * \[[`af0bf96877`](nodejs/node@af0bf96877)] - **deps**: update llhttp to 9.4.3 (Paolo Insogna) [nodejs-private/node-private#935](https://github.com/nodejs-private/node-private/pull/935) * \[[`0354678355`](nodejs/node@0354678355)] - **deps**: update undici to 8.9.0 (Node.js GitHub Bot) [#64712](nodejs/node#64712) * \[[`dbeeaeec13`](nodejs/node@dbeeaeec13)] - **(CVE-2026-58042)** **dns**: handle large resolveAny address replies (RafaelGSS) [nodejs-private/node-private#929](https://github.com/nodejs-private/node-private/pull/929) * \[[`064d339f56`](nodejs/node@064d339f56)] - **(CVE-2026-58044)** **http**: reject requests exceeding max header count (Matteo Collina) [nodejs-private/node-private#922](https://github.com/nodejs-private/node-private/pull/922) * \[[`23b94c843a`](https://github.… (truncated) ### v26.6.0 ### Notable Changes * \[[`5a36018abc`](nodejs/node@5a36018abc)] - **doc**: add MikeMcC399 as collaborator (Mike McCready) [#64656](nodejs/node#64656) * \[[`9b04f82d7b`](nodejs/node@9b04f82d7b)] - **(SEMVER-MINOR)** **ffi**: add `getCurrentEventLoop` (Paolo Insogna) [#64323](nodejs/node#64323) * \[[`bb51f2c960`](nodejs/node@bb51f2c960)] - **(SEMVER-MINOR)** **test\_runner**: add `context.log()` and `test:log` event (Moshe Atlow) [#64389](nodejs/node#64389) * \[[`56ce83b3ee`](nodejs/node@56ce83b3ee)] - **(SEMVER-MINOR)** **test\_runner**: report `entryFile` in `TestStream` events (Moshe Atlow) [#64309](nodejs/node#64309) ### Commits * \[[`248ff9fa5c`](nodejs/node@248ff9fa5c)] - **assert,util**: fix TypeError on Maps with null keys (Paul Bouchon) [#64441](nodejs/node#64441) * \[[`3b5baceafe`](nodejs/node@3b5baceafe)] - **benchmark**: add bytes variant to webstreams async-iterator (Matteo Collina) [#64291](nodejs/node#64291) * \[[`0a46d1ef66`](nodejs/node@0a46d1ef66)] - **buffer**: normalize lone "\r" in Blob native line endings (Daijiro Wachi) [#64115](nodejs/node#64115) * \[[`d9ada18b70`](nodejs/node@d9ada18b70)] - **buffer**: fix Blob.stream() leaking source buffer (semimikoh) [#63577](nodejs/node#63577) * \[[`d05993bcf6`](nodejs/node@d05993bcf6)] - **build**: merge multiple on download artifact (Chengzhong Wu) [#64633](nodejs/node#64633) * \[[`6c25ac909a`](nodejs/node@6c25ac909a)] - **build**: extract temporal\_capi crate directory name into gyp variable (René) [#64482](https://githu… (truncated) ### v26.7.0 ### Notable Changes * \[[`58717685a1`](nodejs/node@58717685a1)] - **(SEMVER-MINOR)** **crypto**: support loading private keys through STORE loaders (Filip Skokan) [#63949](nodejs/node#63949) * \[[`44b940ee8c`](nodejs/node@44b940ee8c)] - **crypto**: update root certificates to NSS 3.125 (Node.js GitHub Bot) [#64746](nodejs/node#64746) * \[[`c1e4f7365e`](nodejs/node@c1e4f7365e)] - **(SEMVER-MINOR)** **lib**: add perfetto support (Chengzhong Wu) [#64565](nodejs/node#64565) * \[[`11c2f9c642`](nodejs/node@11c2f9c642)] - **(SEMVER-MINOR)** **module**: implement `Symbol.dispose` in `ModuleHooks` (Remco Haszing) [#63928](nodejs/node#63928) * \[[`a646319f61`](nodejs/node@a646319f61)] - **(SEMVER-MINOR)** **test\_runner**: add support for `--test-coverage-include-all` (avivkeller) [#64830](nodejs/node#64830) ### Commits * \[[`a2d3f891d3`](nodejs/node@a2d3f891d3)] - **async\_hooks**: use validateBoolean for trackPromises (Soul Lee) [#64731](nodejs/node#64731) * \[[`d7266cdd99`](nodejs/node@d7266cdd99)] - **benchmark**: fix calibrate-n option handling (Luan Muniz) [#64146](nodejs/node#64146) * \[[`2e64293e3f`](nodejs/node@2e64293e3f)] - **buffer**: use Clamp conversion in Blob slice (Donghoon Kang) [#64739](nodejs/node#64739) * \[[`5fda0958bd`](nodejs/node@5fda0958bd)] - **buffer**: validate copyArrayBuffer offsets against buffer length (Ilia Alshanetsky) [#63904](nodejs/node#63904) * \[[`5298db40f9`](nodejs/node@5298db40f9)] - **build**: run perfetto build and test on GHA (Chengzhong Wu) [#6472… (truncated) _Omitted 14 older releases._ </details> <details> <summary>prek: `0.4.11` → `0.4.12` (j178/prek)</summary> ### v0.4.12 ## Release Notes Released on 2026-08-03. ### Enhancements - Add `--require-group` for hook group intersections ([#2472](j178/prek#2472)) - Align fast-path and builtin pre-commit hooks ([#2433](j178/prek#2433)) - Do not shuffle file list for verbose output ([#2431](j178/prek#2431)) - Improve top-level command descriptions ([#2429](j178/prek#2429)) - Install `uv` from Astral CDN and drop source racing ([#2455](j178/prek#2455)) - Make `prek install --force` bypass external hooks paths ([#2437](j178/prek#2437)) - Show builtin hook flags in verbose list output ([#2427](j178/prek#2427)) - Verify uv release archive checksums ([#2456](j178/prek#2456)) ### Performance - Precompute file tags in parallel ([#2440](j178/prek#2440)) - Skip diffs after known hook modifications ([#2447](j178/prek#2447)) - Skip worktree diffs for read-only languages ([#2432](j178/prek#2432)) - Track builtin hook file changes directly ([#2404](j178/prek#2404)) ### Bug fixes - Use full object IDs in diff snapshots ([#2448](j178/prek#2448)) ### Documentation - Add a multi-repository configuration example ([#2434](j178/prek#2434)) - Rewrite benchmark documentation ([#2469](j178/prek#2469)) ### Contributors - @j178 - @BitWeaverDev - @allanlewis ## Install prek 0.4.12 ### Install prebuilt binaries via shell script ```sh curl --proto '=https' --tlsv1.2 -LsSf https://github.com/j178/prek/releases/download/v0.4.12/prek-installer.sh | sh ``` ### Install prebuilt binaries via powershell script ```sh powershell -ExecutionPolicy Bypass -c "irm https://github.com/j178/prek/releases/download/v0.4.12/prek-installer.ps1 | iex" ```… (truncated) </details> <details> <summary>rumdl: `0.2.49` → `0.2.52` (rvben/rumdl)</summary> ### v0.2.50 ### Added - **md077**: support fixed continuation indent config (#786) ([fea6322](rvben/rumdl@fea6322)) ### Fixed - **md065**: leave markers alone inside a block that hides its content ([2654364](rvben/rumdl@2654364)) - **md065**: report thematic breaks written with spaces between markers ([1d29236](rvben/rumdl@1d29236)) - **md076**: ask the parser whether a list item's block is really fenced ([fd616c2](rvben/rumdl@fd616c2)) - **md022**: require a blank line below a heading above a spaced thematic break ([27120f2](rvben/rumdl@27120f2)) - **MD076**: preserve fenced list item spacing (#788) ([2d60067](rvben/rumdl@2d60067)) - **md022**: use the same list test below a heading in check and fix (#790) ([ef926b7](rvben/rumdl@ef926b7)) - **md040**: locate the fence a list marker holds instead of assuming the indent ([6099a6c](rvben/rumdl@6099a6c)) - **md077**: keep the strict-flavor minimum as a floor under a configured indent ([cfaad2e](rvben/rumdl@cfaad2e)) - **md077**: reject a configured indent of 0 ([1ac97a3](rvben/rumdl@1ac97a3)) - **md077**: accept the indent option instead of reporting it as unknown ([cba175c](rvben/rumdl@cba175c)) - **md013**: stop exempting a complete link followed by a parenthesized aside ([722fad6](rvben/rumdl@722fad6)) - **md013**: ke… (truncated) ### v0.2.51 ### Added - **md088**: normalize quotes and dashes to ASCII (#763) ([52e9844](rvben/rumdl@52e9844)) ### Fixed - **config**: keep a file's per-file-ignores out of the workspace index it feeds ([2bb0ce7](rvben/rumdl@2bb0ce7)) - **md051**: validate cross-file link fragments for a document read from stdin ([e215c65](rvben/rumdl@e215c65)) - **md051**: report a broken fragment on a query-string destination once ([7c8390f](rvben/rumdl@7c8390f)) - **md088**: leave modifier letters and math notation alone ([56dbf0f](rvben/rumdl@56dbf0f)) - **config**: report the effective rule lists from `config get global.*` ([5db8f0c](rvben/rumdl@5db8f0c)) - **config**: answer `config get` for every key rumdl accepts ([ecce820](rvben/rumdl@ecce820)) - **md035**: publish the horizontal rule style the rule enforces ([77c8c65](rvben/rumdl@77c8c65)) - **config**: accept every config key a rule actually reads ([8ec7bba](rvben/rumdl@8ec7bba)) - **lsp**: identify documents by the same resolved path as the index ([78f4aa0](rvben/rumdl@78f4aa0)) - **lsp**: keep frontmatter values out of find-references results ([499b005](rvben/rumdl@499b005)) - **md051**: index cross-file links independently of frontmatter config ([ca7b93e](rvben/rumdl@ca7b93e)) - **lsp**: build the workspace index from t… (truncated) ### v0.2.52 ### Fixed - **md012**: report blank lines before a code block that ends the document (#791) ([e897556](rvben/rumdl@e897556)) - **rules**: treat a template shortcode tag as opaque markup ([6962184](rvben/rumdl@6962184)) - **cli**: report a piped document's findings on stdout like every other run ([47f8a50](rvben/rumdl@47f8a50)) ## Downloads | File | Platform | Checksum | |------|----------|----------| | [rumdl-v0.2.52-x86_64-unknown-linux-gnu.tar.gz](https://github.com/rvben/rumdl/releases/download/v0.2.52/rumdl-v0.2.52-x86_64-unknown-linux-gnu.tar.gz) | Linux x86_64 | [checksum](https://github.com/rvben/rumdl/releases/download/v0.2.52/rumdl-v0.2.52-x86_64-unknown-linux-gnu.tar.gz.sha256) | | [rumdl-v0.2.52-x86_64-unknown-linux-musl.tar.gz](https://github.com/rvben/rumdl/releases/download/v0.2.52/rumdl-v0.2.52-x86_64-unknown-linux-musl.tar.gz) | Linux x86_64 (musl) | [checksum](https://github.com/rvben/rumdl/releases/download/v0.2.52/rumdl-v0.2.52-x86_64-unknown-linux-musl.tar.gz.sha256) | | [rumdl-v0.2.52-aarch64-unknown-linux-gnu.tar.gz](https://github.com/rvben/rumdl/releases/download/v0.2.52/rumdl-v0.2.52-aarch64-unknown-linux-gnu.tar.gz) | Linux ARM64 | [checksum](https://github.com/rvben/rumdl/releases/download/v0.2.52/rumdl-v0.2.52-aarch64-unknown-linux-gnu.tar.gz.sha256) | | [rumdl-v0.2.52-aarch64-unknown-linux-musl.tar.gz](https://github.com/rvben/rumdl/releases/download/v0.2.52/rumdl-v0.2.52-aarch64-unknown-linux-musl.tar.gz) | Linux ARM64 (musl) | [checksum](https://github.com/rvben/rumdl/releases/download/v0.2.52/rumdl-v0.2.52-aarch64-unknown-linux-musl.tar.gz.sha256) | | [rumdl-v0.2.52-x86_64-apple-darwin.tar.gz](https://github.com/rvben/rumdl/releases/download/v0.2.52/rumdl-v0.2.52-x86_64-apple-darwin.tar.gz) | macOS x86_64 | [checksum](https://github.com/rvben/r… (truncated) </details> <details> <summary>tombi: `1.2.6` → `1.2.7` (tombi-toml/tombi)</summary> ### v1.2.7  ## What's Changed ### 🦅 New Features * feat(config): support per-schema strict mode by @ya7010 in tombi-toml/tombi#2061 ### 🛠️ Other Changes * fix: improve config file load error reporting by @ya7010 in tombi-toml/tombi#2062 **Full Changelog**: tombi-toml/tombi@v1.2.6...v1.2.7 </details> <details> <summary>uv: `0.12.1` → `0.12.3` (astral-sh/uv)</summary> ### 0.12.2 ## Release Notes Released on 2026-08-05. ### Python - Add CPython 3.15.0rc1 ([#20948](astral-sh/uv#20948)) - Add CPython 3.14.7 ([#20971](astral-sh/uv#20971)) ### Enhancements - Ensure diagnostic hints end with a newline to prevent malformed terminal output ([#20959](astral-sh/uv#20959)) ### Preview features - Audit one or all installed tools with `uv tool audit` ([#20921](astral-sh/uv#20921)) - Report physically reclaimed disk space during cache cleanup with the `cache-physical-space` preview feature ([#20925](astral-sh/uv#20925)) ### Configuration - Add `UV_RUN_RLIMIT_NOFILE` to set the open-file limit for commands launched by `uv run` ([#20926](astral-sh/uv#20926)) ### Performance - Speed up `uv.lock` parsing for wheel entries ([#20881](astral-sh/uv#20881)) - Speed up `uv.lock` parsing for source distribution entries ([#20882](astral-sh/uv#20882)) - Speed up filename extraction from distribution URLs ([#20879](astral-sh/uv#20879)) - Reduce filesystem metadata lookups during bytecode compilation ([#20928](astral-sh/uv#20928)) - Reuse file metadata when building source distributions ([#20927](astral-sh/uv#20927)) ### Bug fixes - Preserve compatibility with older uv versions when recording artifact sizes in cached wheels and source distributions ([#20963](astral-sh/uv#20963)) - Avoid including workspace-root default dependency groups when syncing or exporting a selected workspace member unless explicitly requested ([#20930](astral-sh/uv#20930)) ### Documentation - Separate build and publish jobs in the GitHub Actions publishing guide ([#20946](astral-sh/uv#20946)) - Ensure the GitHub Actions publishing exampl… (truncated) ### 0.12.3 ## Release Notes Released on 2026-08-07. ### Python - Add CPython 3.13.15 ([#20997](astral-sh/uv#20997)) ### Preview features - Add `--output-format` to select automatic, human-readable, or raw-byte output for `uv cache size` ([#20992](astral-sh/uv#20992)) - Preserve JSON output from `uv workspace metadata --quiet` while suppressing diagnostics ([#20991](astral-sh/uv#20991)) - Reduce memory usage for large workspaces by streaming `uv workspace metadata` JSON output ([#20990](astral-sh/uv#20990)) ### Performance - Reduce Linux startup latency by initializing the workspace cache before spawning another thread ([#20989](astral-sh/uv#20989)) - Reuse compiled workspace exclusion patterns during workspace discovery ([#20988](astral-sh/uv#20988)) - Speed up conflict-heavy resolutions by avoiding materialized range complements ([#20982](astral-sh/uv#20982)) - Avoid slow procfs reads during Python interpreter discovery on Linux ([#20987](astral-sh/uv#20987)) ### Documentation - Add PEP 740 attestations to the GitHub Actions publishing example ([#20986](astral-sh/uv#20986)) - Restrict the GitHub Actions publishing example to Python version tags ([#20973](astral-sh/uv#20973)) - Correct `--python-pin` to `--pin-python` in the `uv init --bare` example ([#20876](astral-sh/uv#20876)) ## Install uv 0.12.3 ### Install prebuilt binaries via shell script ```sh curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/uv/releases/download/0.12.3/uv-installer.sh | sh ``` ### Install prebuilt binaries via powershell script ```sh powershell -ExecutionPolicy Bypass -c "irm https://releases.astral.sh/github/uv/releases/download/0.12.3/uv-installer.ps1 | iex" ``` ## Download uv 0.12.3 | Fi… (truncated) </details> </details> Modified files: - `.mise.toml`

richardlau added the blocked PRs that are blocked by other issues or PRs. label Feb 13, 2026

nodejs-github-bot added build Issues and PRs related to build files or the CI. needs-ci PRs that need a full CI run. labels Feb 13, 2026

richardlau added the semver-major PRs that contain breaking changes and should be released in the next major version. label Feb 13, 2026

mcollina approved these changes Feb 13, 2026

View reviewed changes

legendecas mentioned this pull request Feb 13, 2026

build: use path-ignore in GHA coverage-windows.yml #61811

Merged

cjihrig approved these changes Feb 14, 2026

View reviewed changes

targos approved these changes Feb 14, 2026

View reviewed changes

legendecas approved these changes Feb 14, 2026

View reviewed changes

legendecas added dont-land-on-v20.x dont-land-on-v22.x PRs that should not land on the v22.x-staging branch and should not be released in v22.x. dont-land-on-v24.x PRs that should not land on the v24.x-staging branch and should not be released in v24.x. labels Feb 14, 2026

addaleax approved these changes Feb 20, 2026

View reviewed changes

mcollina added the notable-change PRs with changes that should be highlighted in changelogs. label Feb 20, 2026

filecage mentioned this pull request Feb 23, 2026

Refactor Date to use Temporal instead filecage/ical-ts#8

Open

juanarbol approved these changes Feb 24, 2026

View reviewed changes

legendecas removed dont-land-on-v20.x dont-land-on-v22.x PRs that should not land on the v22.x-staging branch and should not be released in v22.x. dont-land-on-v24.x PRs that should not land on the v24.x-staging branch and should not be released in v24.x. labels Mar 11, 2026

louwers approved these changes Mar 18, 2026

View reviewed changes

jasnell approved these changes Mar 19, 2026

View reviewed changes

avivkeller approved these changes Mar 19, 2026

View reviewed changes

richardlau mentioned this pull request Apr 27, 2026

2026-05-05, Version 26.0.0 (Current) #62526

Merged

richardlau mentioned this pull request Apr 29, 2026

build: add rust target for macOS cross compiles #63015

Merged

Dustin4444 reviewed May 5, 2026

View reviewed changes

GunniBusch mentioned this pull request May 8, 2026

node: enable Temporal support Homebrew/homebrew-core#281626

Closed

MikeMcC399 mentioned this pull request May 10, 2026

Missing updates in BUILDING for Temporal as default in Node.js >=26 #63225

Closed

4 tasks

ChrisJr404 mentioned this pull request May 11, 2026

doc: document Temporal configure flags in BUILDING.md #63248

Merged

MikeMcC399 mentioned this pull request May 23, 2026

Build from source on Windows - Cargo error without Rust toolchain #63451

Open

coderabbitai Bot mentioned this pull request Jun 10, 2026

Release/v3.0.x magmacomputing/magma#38

Merged

This was referenced Jul 27, 2026

chore(mise): upgrade local tools jylenhof/mise-update-tool#18

Closed

chore(mise): upgrade local tools jylenhof/mise-update-tool#23

Closed

ghappforreleaseplease Bot mentioned this pull request Aug 10, 2026

chore(mise): upgrade local tools jylenhof/mise-update-tool#28

Closed

Navigation Menu

Uh oh!

Uh oh!

build: enable Temporal by default - #61806

build: enable Temporal by default#61806
richardlau wants to merge 2 commits into
nodejs:mainfrom
richardlau:enable-temporal

richardlau commented Feb 13, 2026

Uh oh!

targos commented Feb 13, 2026

Uh oh!

richardlau commented Feb 13, 2026

Uh oh!

legendecas commented Feb 13, 2026 •

edited

Loading

Uh oh!

richardlau commented Feb 13, 2026

Uh oh!

mcollina left a comment

Uh oh!

github-actions Bot commented Feb 20, 2026

Uh oh!

legendecas commented Mar 11, 2026

Uh oh!

avivkeller left a comment

Uh oh!

Dustin4444 left a comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

14 participants

Uh oh!

Uh oh!

Conversation

richardlau commented Feb 13, 2026

Uh oh!

targos commented Feb 13, 2026

Uh oh!

richardlau commented Feb 13, 2026

Uh oh!

legendecas commented Feb 13, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

richardlau commented Feb 13, 2026

Uh oh!

mcollina left a comment

Choose a reason for hiding this comment

Uh oh!

github-actions Bot commented Feb 20, 2026

Uh oh!

legendecas commented Mar 11, 2026

Uh oh!

avivkeller left a comment

Choose a reason for hiding this comment

Uh oh!

Dustin4444 left a comment

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

14 participants

legendecas commented Feb 13, 2026 •

edited

Loading