Node.js 22: download ældre versioner

This is a security release.
Notable Changes
- (CVE-2026-105481) http: ensure agent data guard works without I/O (James M Snell)
- (CVE-2026-105482) dns: validate resolve inputs for null bytes (James M Snell)
- (CVE-2026-106069) tls: reject non-canonical IP addresses (Matteo Collina)
- (CVE-2026-106073) permission: check permission model in realpathSync (RafaelGSS)
- (CVE-2026-106074) crypto: reset random caches across snapshots (Filip Skokan)
- (CVE-2026-111497) src: expose BROTLI_DECODER_ERROR_FORMAT_BLOCK_SWITCH (Antoine du Hamel)
- (CVE-2026-111497) deps: brotli: cherry-pick 0ed4268a4401abcb44720963 (Evgenii Kliuchnikov)
- crypto: update root certificates to NSS 3.131.1 (Antoine du Hamel)
- deps: update c-ares to 1.34.9 (Node.js GitHub Bot)
- deps: update timezone to 2026e (Node.js GitHub Bot)
- deps: upgrade openssl sources to openssl-3.5.9 (Node.js GitHub Bot)
- deps: update sqlite to 3.53.4 (Node.js GitHub Bot)
- deps: update undici to 6.29.1 (Node.js GitHub Bot)
Commits
- [68fa0df6d6] - crypto: update root certificates to NSS 3.131.1 (Antoine du Hamel) #66877
- [dd6b47573b] - crypto: reset random caches across snapshots (Filip Skokan) nodejs-private/node-private#987
- [a62b7d5362] - crypto: harden X.509 conversion and formatting (Filip Skokan) nodejs-private/node-private#966
- [ec9e5e4a3e] - crypto: update root certificates to NSS 3.129 (Node.js GitHub Bot) #66496
- [a538a9515d] - deps: update c-ares to 1.34.9 (Node.js GitHub Bot) #66868
- [67d294739f] - deps: brotli: cherry-pick 0ed4268a4401abcb44720963 (Evgenii Kliuchnikov) nodejs-private/node-private#1002
- [1ab9db8a74] - deps: update timezone to 2026e (Node.js GitHub Bot) #66419
- [52b4bcab03] - deps: update timezone to 2026d (Node.js GitHub Bot) #66333
- [60f4833d41] - deps: update archs files for openssl-3.5.9 (Node.js GitHub Bot) #66396
- [05470dc308] - deps: upgrade openssl sources to openssl-3.5.9 (Node.js GitHub Bot) #66396
- [47333fe4f4] - deps: update sqlite to 3.53.4 (Node.js GitHub Bot) #64745
- [98258b855f] - deps: update sqlite to 3.53.3 (Node.js GitHub Bot) #64180
- [a8349b6408] - deps: update sqlite to 3.53.2 (Node.js GitHub Bot) #63774
- [e9e295bcc1] - deps: cherry-pick e807d4e379 from SQLite (Junsu Han) #63525
- [512a9b61f0] - deps: update sqlite to 3.53.1 (Node.js GitHub Bot) #63217
- [e708247254] - deps: update sqlite to 3.53.0 (Node.js GitHub Bot) #62699
- [857be5afa3] - deps: update undici to 6.29.1 (Node.js GitHub Bot) #66765
- [19c5056002] - dns: validate resolve inputs for null bytes (James M Snell) nodejs-private/node-private#984
- [e7b2985d59] - http: ensure agent data guard works without I/O (James M Snell) nodejs-private/node-private#983
- [50ab804edc] - permission: check permission model in realpathSync (RafaelGSS) nodejs-private/node-private#973
- [a18ec92752] - src: expose BROTLI_DECODER_ERROR_FORMAT_BLOCK_SWITCH (Antoine du Hamel) nodejs-private/node-private#1002
- [4342503fd8] - tls: reject chains containing blocked public keys (Ulises Gascon) #66871
- [d7663560ac] - tls: reject non-canonical IP addresses (Matteo Collina) nodejs-private/node-private#982
- [beb4cd4cd3] - tls: match IPv6 hosts against IP-Address SANs (Pascal Garber) #64145
- [4b42e56aaf] - tools: retry Gatekeeper check and stapling after notarization (Ryan Aslett) #66855

Notable Changes
- [fe2a6b2be8] - crypto: update root certificates to NSS 3.125 (Node.js GitHub Bot) #64746
- [871167ddfd] - deps: update corepack to 0.36.0 (Node.js GitHub Bot) #65653
- [b816fc8958] - deps: upgrade npm to 10.9.9 (npm team) #64884
- [e306521444] - deps: update icu to 78.3 (Node.js GitHub Bot) #62324
- [a9cb31129f] - deps: update OpenSSL 3.5.8 (Node.js GitHub Bot) #65542
- [2a3548e51c] - deps: update Undici to 6.28.1 (mcollina) #65790
- [3909ff2c4a] - node-api: support SharedArrayBuffer in napi_create_typedarray (Yilong Li) #62710
- [66de6349ad] - node-api: add napi_create_external_sharedarraybuffer (Ben Noordhuis) #62623
Commits
- [44cf27b8fa] - build: update binary-upload to use correct tarball name (Stewart X Addison) #65282
- [fe2a6b2be8] - crypto: update root certificates to NSS 3.125 (Node.js GitHub Bot) #64746
- [71feba6b69] - crypto: update root certificates to NSS 3.123.1 (Node.js GitHub Bot) #63527
- [871167ddfd] - deps: update corepack to 0.36.0 (Node.js GitHub Bot) #65653
- [2a3548e51c] - deps: update undici to 6.28.1 (mcollina) #65790
- [59d853a4df] - deps: update archs files for openssl-3.5.8 (Node.js GitHub Bot) #65542
- [a9cb31129f] - deps: upgrade openssl sources to openssl-3.5.8 (Node.js GitHub Bot) #65542
- [3376e27de2] - deps: V8: cherry-pick a6eaf7574109 (Camillo Bruni) #65402
- [b816fc8958] - deps: upgrade npm to 10.9.9 (npm team) #64884
- [4e4bd1b104] - deps: update timezone to 2026c (Node.js GitHub Bot) #64588
- [7d82841b4e] - deps: update c-ares to 1.34.8 (Node.js GitHub Bot) #64330
- [01855a19d3] - deps: c-ares: cherry-pick 8ba37af8e3fb (René) #64110
- [23fb398c3d] - deps: update corepack to 0.35.0 (Node.js GitHub Bot) #63375
- [5286330365] - deps: update corepack to 0.34.7 (Node.js GitHub Bot) #62810
- [6d6c3c98b1] - deps: update timezone to 2026b (Node.js GitHub Bot) #62962
- [e306521444] - deps: update icu to 78.3 (Node.js GitHub Bot) #62324
- [d9cb8468a3] - doc: clarify filter option of sqlite.database.applyChangeset (Antoine du Hamel) #63515
- [c9c5662d91] - doc: add sxa GPG key (ed25519) (Stewart X Addison) #64193
- [37f21068c4] - fs: restore fs patchability in ESM loader (Joyee Cheung) #62835
- [7c2df5dd96] - http2: avoid uaf while receiving and sending rst_stream (esgor) #64166
- [3909ff2c4a] - node-api: support SharedArrayBuffer in napi_create_typedarray (Yilong Li) #62710
- [66de6349ad] - node-api: add napi_create_external_sharedarraybuffer (Ben Noordhuis) #62623
- [ce9139107f] - src: escape Windows environment variables in task runner (Antoine du Hamel) #65217
- [839480a471] - test: fix link-local dgram scope assertion (Filip Skokan) #65629
- [40eac4a32f] - test: account for varied OpenSSL CCM final behaviours (Filip Skokan) #65542
- [75098a9e8c] - tools: update gr2m/create-or-update-pull-request-action to v1.10.1 (Mike McCready) #63065
- [08b6ac0416] - tools: revert OpenSSL update workflow to ubuntu-latest (Richard Lau) #62627
- [02cafc479f] - tools: fix commit linter for semver-major release proposals (Antoine du Hamel) #62993
- [6f6cd3768d] - tools: sync mk-ca-bundle.pl with curl (Archkon) #64753
- [bc5753d438] - tools: remove envinfo from our workflows (Antoine du Hamel) #64259
- [d68ee9f8a5] - tools: validate version number in release proposal commit message lint (Antoine du Hamel) #64070
- [38ee2e895f] - tools: avoid test/fixtures/wpt/README.md conflicts (Filip Skokan) #63938
- [fdc65e489f] - tools: use different branch for tool updates on staging branches (Antoine du Hamel) #63110
- [e5a6fde002] - tools: update gyp-next to 0.22.1 (Node.js GitHub Bot) #62961
- [5fbbad6e82] - url: handle unparsable serialized URLs in setters (Matteo Collina) #64651
- [ed019e4854] - util: preserve function names without source map names (Hiroki Osame) #65108

This is a security release.
Notable Changes
- (CVE-2026-56846) http2: retain header memory in session accounting (Matteo Collina) – High
- (CVE-2026-56848) http2: defer rst stream while in scope (Matteo Collina) – High
- (CVE-2026-58043) permission: avoid granting radix split nodes (RafaelGSS) – High
- (CVE-2026-56850) https: distinguish PFX object-array agent keys (RafaelGSS) – Medium
- (CVE-2026-58040) https: bind identity checks to session reuse (Matteo Collina) – Medium
- (CVE-2026-58042) dns: handle large resolveAny address replies (RafaelGSS) – Medium
- (CVE-2026-58045) zlib: throw on out-of-bounds write buffers (RafaelGSS) – Medium
- (CVE-2026-56847) permission: enforce fs write permission for trace events (RafaelGSS) – Low
- (CVE-2026-58039) permission: check final report output path (RafaelGSS) – Low
- (CVE-2026-58044) http: reject requests exceeding max header count (Matteo Collina) – Low
- deps: update llhttp to 9.4.3 (Paolo Insogna)
- deps: update undici to 6.28.0 (Node.js GitHub Bot)
Commits
- [4b12ac38a1] - deps: update llhttp to 9.4.3 (Paolo Insogna) nodejs-private/node-private#935
- [3fd0aa51d0] - deps: update undici to 6.28.0 (Node.js GitHub Bot) #64714
- [22efc051a3] - (CVE-2026-58042) dns: handle large resolveAny address replies (RafaelGSS) nodejs-private/node-private#929
- [c8525ac3a6] - (CVE-2026-58044) http: reject requests exceeding max header count (Matteo Collina) nodejs-private/node-private#932
- [daa6d25e3d] - (CVE-2026-56848) http2: defer rst stream while in scope (Matteo Collina) nodejs-private/node-private#921
- [f14d78b9e0] - (CVE-2026-56846) http2: retain header memory in session accounting (Matteo Collina) #63752
- [51123159fe] - (CVE-2026-58040) https: bind identity checks to session reuse (Matteo Collina) nodejs-private/node-private#934
- [acaf4266b2] - (CVE-2026-56850) https: distinguish PFX object-array agent keys (RafaelGSS) nodejs-private/node-private#930
- [440329f624] - (CVE-2026-58043) permission: avoid granting radix split nodes (RafaelGSS) nodejs-private/node-private#911
- [ed18b9cc07] - (CVE-2026-58039) permission: check final report output path (RafaelGSS) nodejs-private/node-private#926
- [0566c3cccd] - (CVE-2026-56847) permission: enforce fs write permission for trace events (RafaelGSS) nodejs-private/node-private#927
- [0d072480c3] - (CVE-2026-58045) zlib: throw on out-of-bounds write buffers (RafaelGSS) nodejs-private/node-private#931

This release includes a fix for an unexpected behavior introduced
by the recent security release (22.23.0).
Commits
- [41d2ee13be] - build: switch coverage-windows to windows-2022 (Richard Lau) #63940
- [eaa292549e] - http: avoid stream listeners on idle agent sockets (Matteo Collina) #64004

This is a security release.
Notable Changes
- (CVE-2026-48618) tls: normalize hostname for server identity checks (Matteo Collina) – High
- (CVE-2026-48933) crypto: guard WebCrypto cipher output length (Filip Skokan) – High
- (CVE-2026-48937) deps: fix integration issues with the latest nghttp2 – Medium
- (CVE-2026-48930) dns,net: reject hostnames with embedded NUL bytes (Matteo Collina) – Medium
- (CVE-2026-48619) http2: cap originSet size to prevent unbounded memory growth (Matteo Collina) – Medium
- (CVE-2026-48615) lib,test: redact proxy credentials in tunnel errors (Matteo Collina) – Medium
- (CVE-2026-48934) tls: bind reusable sessions to authenticated host (Matteo Collina) – Medium
- (CVE-2026-48928) tls: fix case-sensitive SNI context matching (Matteo Collina) – Medium
- (CVE-2026-48617) permission: handle process.chdir on writereport (RafaelGSS) – Low
- (CVE-2026-48931) http: fix response queue poisoning in http.Agent (Matteo Collina) – Low
- (CVE-2026-48935) permission: disable FileHandle utimes with permission model (RafaelGSS) – Low
Commits
- [38b4c5ed51] - (CVE-2026-48933) crypto: guard WebCrypto cipher output length (Filip Skokan) nodejs-private/node-private#878
- [ad8a10c1bb] - deps: update llhttp to 9.4.2 (Antoine du Hamel) nodejs-private/node-private#890
- [ca825a87cc] - deps: update undici to 6.27.0 (aduh95) #63711
- [a1a5bb9683] - (CVE-2026-48937) deps: fix integration issues with the latest nghttp2 (Tim Perry) #62891
- [0f48583512] - (SEMVER-MAJOR) deps: update nghttp2 to 1.69.0 (Node.js GitHub Bot) #62891
- [38c869fc05] - deps: update nghttp2 to 1.68.0 (nodejs-github-bot) #61136
- [290667c84f] - deps: update nghttp2 to 1.67.1 (nodejs-github-bot) #59790
- [c9f3da76aa] - deps: update nghttp2 to 1.66.0 (Node.js GitHub Bot) #58786
- [60890be563] - deps: update nghttp2 to 1.65.0 (Node.js GitHub Bot) #57269
- [5024c7d5d8] - deps: update archs files for openssl-3.5.7 (Node.js GitHub Bot) #63820
- [7f4eb5af2e] - deps: upgrade openssl sources to openssl-3.5.7 (Node.js GitHub Bot) #63820
- [ebb4ec78a8] - deps: fix aix implicit declaration in OpenSSL (Abdirahim Musse) #62656
- [5763d40826] - deps: update llhttp to 9.4.1 (Node.js GitHub Bot) #63045
- [c551a51d0c] - (CVE-2026-48930) dns,net: reject hostnames with embedded NUL bytes (Matteo Collina) nodejs-private/node-private#868
- [0a22d40180] - (CVE-2026-48931) http: fix response queue poisoning in http.Agent (Matteo Collina) nodejs-private/node-private#846
- [c79968e108] - (CVE-2026-48619) http2: cap originSet size to prevent unbounded memory growth (Matteo Collina) nodejs-private/node-private#855
- [0c37bff2ff] - http2: fix DEP0194 message (KaKa) #58669
- [ea5dc6b529] - (SEMVER-MAJOR) http2: remove support for priority signaling (Matteo Collina) #58293
- [9b6af26132] - (CVE-2026-48615) lib,test: redact proxy credentials in tunnel errors (Matteo Collina) nodejs-private/node-private#867
- [28dcd38864] - (CVE-2026-48935) permission: disable FileHandle utimes with permission model (RafaelGSS) nodejs-private/node-private#873
- [2f62693801] - (CVE-2026-48617) permission: handle process.chdir on writereport (RafaelGSS) nodejs-private/node-private#870
- [1662a3ea09] - test: add session reuse host verification regressions (Matteo Collina) nodejs-private/node-private#854
- [718d5d0e2c] - test: skip test-fs-utimes-y2K38 on armv7 (Richard Lau) #63836
- [041185b61f] - test: skip test-cluster-dgram-reuse on AIX 7.3 (Stewart X Addison) #62238
- [fd890ba01d] - (CVE-2026-48934) tls: bind reusable sessions to authenticated host (Matteo Collina) nodejs-private/node-private#854
- [39d1d09684] - (CVE-2026-48928) tls: fix case-sensitive SNI context matching (Matteo Collina) nodejs-private/node-private#857
- [2197a47144] - (CVE-2026-48618) tls: normalize hostname for server identity checks (Matteo Collina) nodejs-private/node-private#869

Commits
- [4f780905c5] - crypto: fix potential null pointer dereference when BIO_meth_new() fails (Nora Dossche) #61788
- [4a09efb947] - crypto: update root certificates to NSS 3.121 (Node.js GitHub Bot) #62485
- [e4c0d99839] - deps: update timezone to 2026a (Node.js GitHub Bot) #62164
- [0226c8dd7a] - deps: update simdjson to 4.5.0 (Node.js GitHub Bot) #62382
- [e742ab748c] - deps: update sqlite to 3.51.3 (Node.js GitHub Bot) #62256
- [73cac0571a] - deps: update amaro to 1.1.8 (Node.js GitHub Bot) #62151
- [ae5c162b93] - deps: update amaro to 1.1.7 (Node.js GitHub Bot) #61730
- [b819cb9977] - deps: update amaro to 1.1.6 (Node.js GitHub Bot) #61603
- [bbcce09dc7] - deps: update sqlite to 3.52.0 (Node.js GitHub Bot) #62150
- [22ff2d81ce] - deps: update simdjson to 4.3.1 (Node.js GitHub Bot) #61930
- [f49b51d75c] - deps: update acorn-walk to 8.3.5 (Node.js GitHub Bot) #61928
- [1a5cec0d49] - deps: update acorn to 8.16.0 (Node.js GitHub Bot) #61925
- [d339497688] - deps: update nbytes to 0.1.3 (Node.js GitHub Bot) #61879
- [3ff8ffd459] - deps: remove stale OpenSSL arch configs (René) #61834
- [b8ddbc1e9a] - deps: update llhttp to 9.3.1 (Node.js GitHub Bot) #61827
- [ffda97afd4] - deps: update googletest to 2461743991f9aa53e9a3625eafcbacd81a3c74cd (Node.js GitHub Bot) #62484
- [79aa32cf4f] - deps: update googletest to 73a63ea05dc8ca29ec1d2c1d66481dd0de1950f1 (Node.js GitHub Bot) #61927
- [b6957e13b6] - deps: update archs files for openssl-3.5.6 (Node.js GitHub Bot) #62629
- [3a27669063] - deps: upgrade openssl sources to openssl-3.5.6 (Node.js GitHub Bot) #62629
- [d568a1bb53] - deps: upgrade npm to 10.9.8 (npm team) #62463
- [ec11f3c1d5] - deps: V8: backport 85b390089e51 (Thibaud Michaud) #62783
- [08609712ed] - deps: V8: backport 1b27e4674f11 (Thibaud Michaud) #62783
- [dcc60d5ab2] - deps: V8: backport 9997fc013952 (Thibaud Michaud) #62783
- [1d1f4451fb] - deps: V8: cherry-pick b96e40d5ac85 (Clemens Backes) #62783
- [2268567237] - deps: V8: cherry-pick 7cb6188cf913 (Thibaud Michaud) #62783
- [92804cdbea] - deps: V8: cherry-pick e7ccf0af1bdd (Thibaud Michaud) #62783
- [eae2c27a40] - deps: V8: cherry-pick 8e214ec3ec8c (Thibaud Michaud) #62783
- [a1799a49bb] - deps: V8: backport 63b8849d73ae (Thibaud Michaud) #62783
- [a2df2d8731] - deps: V8: backport 323942700cfe (Thibaud Michaud) #62783
- [e3d65c7dca] - deps: V8: backport 89dc6eab605c (Thibaud Michaud) #62783
- [5e7db133de] - deps: V8: backport 910cb91733dc (Jakob Kummerow) #62783
- [d0c24a28af] - deps: V8: cherry-pick b8f91e510e0f (Thibaud Michaud) #62783
- [d358687824] - deps: V8: cherry-pick cf03d55db2a0 (Thibaud Michaud) #62783
- [67c8b2c349] - deps: V8: cherry-pick 692f3d526a38 (Sébastien Doeraene) #62783
- [71e5a59ffd] - deps: V8: cherry-pick c734674e03f9 (Manos Koukoutos) #62783
- [f0dbe81c7b] - deps: V8: cherry-pick b2f3aea23a01 (Thibaud Michaud) #62783
- [d333f480c3] - deps: V8: cherry-pick 5f1342c20b59 (Matthias Liedtke) #62783
- [db722725bb] - deps: use npm undici@six tag in update-undici.sh (Matteo Collina) #63012
- [9b57979d9c] - doc: add Rafael to last security release steward (Rafael Gonzaga) #62423
- [d8075585bf] - doc: add path to vulnerabilities.json mention (Rafael Gonzaga) #62355
- [6ec9a70204] - doc: clarify fs.ReadStream and fs.WriteStream are not constructable (Kit Dallege) #62208
- [1fc86fcb6e] - doc: add note (and caveat) for mock.module about customization hooks (Jacob Smith) #62075
- [491be80bd9] - doc: add efekrskl as triager (Efe) #61876
- [18558293a3] - doc: fix module.stripTypeScriptTypes indentation (René) #61992
- [8e20976522] - doc: explicitly mention Slack handle (Rafael Gonzaga) #61986
- [70b8e6b4fb] - doc: rename invalid function parameter (René) #61942
- [4045c76f6c] - doc: clarify status of feature request issues (Antoine du Hamel) #61505
- [c54652f2aa] - doc: remove incorrect mention of module in typescript.md (Rob Palmer) #61839
- [9fad6cedf5] - doc: clarify async caveats for events.once() (René) #61572
- [2f1e5733fe] - doc: update Juan's 

This is a security release.
Notable Changes
- (CVE-2026-21637) wrap SNICallback invocation in try/catch (Matteo Collina) - High
- (CVE-2026-21710) use null prototype for headersDistinct/trailersDistinct (Matteo Collina) - High
- (CVE-2026-21713) use timing-safe comparison in Web Cryptography HMAC (Filip Skokan) - Medium
- (CVE-2026-21714) handle NGHTTP2_ERR_FLOW_CONTROL error code (RafaelGSS) - Medium
- (CVE-2026-21717) test array index hash collision (Joyee Cheung) - Medium
- (CVE-2026-21715) add permission check to realpath.native (RafaelGSS) - Low
- (CVE-2026-21716) include permission check on lib/fs/promises (RafaelGSS) - Low
Commits
- [6f14ee5101] - (CVE-2026-21717) build,test: test array index hash collision (Joyee Cheung) nodejs-private/node-private#809
- [52a52ef619] - (CVE-2026-21713) crypto: use timing-safe comparison in Web Cryptography HMAC (Filip Skokan) nodejs-private/node-private#822
- [30a3ab11e2] - (CVE-2026-21717) deps: V8: cherry-pick aac14dd95e5b (Joyee Cheung) nodejs-private/node-private#809
- [e3f4d6a42e] - (CVE-2026-21717) deps: V8: backport 1361b2a49d02 (Joyee Cheung) nodejs-private/node-private#809
- [7dc00fa5f4] - (CVE-2026-21717) deps: V8: backport 185f0fe09b72 (Joyee Cheung) nodejs-private/node-private#809
- [076acd052d] - (CVE-2026-21717) deps: V8: backport 0a8b1cdcc8b2 (snek) nodejs-private/node-private#809
- [963c60a951] - deps: V8: override depot_tools version (Richard Lau) #62344
- [a688117d5d] - deps: upgrade npm to 10.9.7 (npm team) #62330
- [859c8c761b] - deps: update undici to v6.24.1 (Matteo Collina) #62285
- [d5ed384a2f] - deps: upgrade npm to 10.9.6 (npm team) #62215
- [a2fe9fd81a] - (CVE-2026-21710) http: use null prototype for headersDistinct/trailersDistinct (Matteo Collina) nodejs-private/node-private#821
- [73deff77c1] - lib: backport _tls_common and _tls_wrap refactors (Dario Piotrowicz) #57643
- [06fc3436f6] - (CVE-2026-21716) permission: include permission check on lib/fs/promises (RafaelGSS) nodejs-private/node-private#795
- [db48d9c675] - (CVE-2026-21715) permission: add permission check to realpath.native (RafaelGSS) nodejs-private/node-private#794
- [2a6105a63b] - (CVE-2026-21714) src: handle NGHTTP2_ERR_FLOW_CONTROL error code (RafaelGSS) nodejs-private/node-private#832
- [91b970886f] - (CVE-2026-21637) tls: wrap SNICallback invocation in try/catch (Matteo Collina) nodejs-private/node-private#819

This is a security release.
Notable Changes
lib:
- (CVE-2025-59465) add TLSSocket default error handler
- (CVE-2025-55132) disable futimes when permission model is enabled
lib,permission:
- (CVE-2025-55130) require full read and write to symlink APIs
src:
- (CVE-2025-59466) rethrow stack overflow exceptions in async_hooks
src,lib:
- (CVE-2025-55131) refactor unsafe buffer creation to remove zero-fill toggle
tls:
- (CVE-2026-21637) route callback exceptions through error handlers
Commits
- [6badf4e6f4] - deps: update c-ares to v1.34.6 (Node.js GitHub Bot) #60997
- [37509c3ff0] - deps: update undici to 6.23.0 (Matteo Collina) nodejs-private/node-private#791
- [eb8e41f8db] - (CVE-2025-59465) lib: add TLSSocket default error handler (RafaelGSS) nodejs-private/node-private#797
- [ebbf942a83] - (CVE-2025-55132) lib: disable futimes when permission model is enabled (RafaelGSS) nodejs-private/node-private#748
- [6b4849583a] - (CVE-2025-55130) lib,permission: require full read and write to symlink APIs (RafaelGSS) nodejs-private/node-private#760
- [ddadc31f09] - (CVE-2025-59466) src: rethrow stack overflow exceptions in async_hooks (Matteo Collina) nodejs-private/node-private#773
- [d4d9f3915f] - (CVE-2025-55131) src,lib: refactor unsafe buffer creation to remove zero-fill toggle (Сковорода Никита Андреевич) nodejs-private/node-private#759
- [25d6799df6] - (CVE-2026-21637) tls: route callback exceptions through error handlers (Matteo Collina) nodejs-private/node-private#796

Commits
- [af33e8e668] - benchmark: remove unused variable from util/priority-queue (Bruno Rodrigues) #59872
- [6764ce8756] - benchmark: update count to n in permission startup (Bruno Rodrigues) #59872
- [4e8d99f0dc] - benchmark: update num to n in dgram offset-length (Bruno Rodrigues) #59872
- [af0a8ba7f8] - benchmark: adjust dgram offset-length len values (Bruno Rodrigues) #59708
- [78efd1be4a] - benchmark: update num to n in dgram offset-length (Bruno Rodrigues) #59708
- [df72dc96e9] - console,util: improve array inspection performance (Ruben Bridgewater) #60037
- [ef67d09f50] - http: improve writeEarlyHints by avoiding for-of loop (Haram Jeong) #59958
- [23468fd76b] - http2: fix allowHttp1+Upgrade, broken by shouldUpgradeCallback (Tim Perry) #59924
- [56abc4ac76] - lib: optimize priority queue (Gürgün Dayıoğlu) #60039
- [ea5cfd98c5] - lib: implement passive listener behavior per spec (BCD1me) #59995
- [c2dd6eed2f] - process: fix wrong asyncContext under unhandled-rejections=strict (Shima Ryuhei) #60103
- [81a3055710] - process: fix default env for process.execve (Richard Lau) #60029
- [fe492c7ace] - process: fix hrtime fast call signatures (Renegade334) #59600
- [76b4cab8fc] - src: bring permissions macros in line with general C/C++ standards (Anna Henningsen) #60053
- [21970970c7] - src: remove AnalyzeTemporaryDtors option from .clang-tidy (iknoom) #60008
- [609c063e81] - src: remove unused variables from report (Moonki Choi) #60047
- [987841a773] - src: avoid unnecessary string allocations in SPrintF impl (Anna Henningsen) #60052
- [6e386c0632] - src: make ToLower/ToUpper input args more flexible (Anna Henningsen) #60052
- [c3be1226c7] - src: allow std::string_view arguments to SPrintF() and friends (Anna Henningsen) #60058
- [764d35647d] - src: remove unnecessary std::string error messages (Anna Henningsen) #60057
- [1289ef89ec] - src: remove unnecessary shadowed functions on Utf8Value & BufferValue (Anna Henningsen) #60056
- [d1fb8a538d] - src: avoid unnecessary string → char* → string round trips (Anna Henningsen) #60055
- [54b439fb5a] - src: fill options_args, options_env after vectors are finalized (iknoom) #59945
- [c7c597e2ca] - src: use RAII for uv_process_options_t (iknoom) #59945
- [b928ea9716] - test: ensure that the message event is fired (Luigi Pinca) #59952
- [e4b95a5158] - test: replace diagnostics_channel stackframe in output snapshots (Chengzhong Wu) #60024
- [4206406694] - test: mark test-web-locks skip on IBM i (SRAVANI GUNDEPALLI) #59996
- [26394cd5bf] - test: expand tls-check-server-identity coverage (Diango Gavidia) #60002
- [b58df47995] - test: fix typo of test-benchmark-readline.js (Deokjin Kim) #59993
- [af3a59dba8] - test: verify tracing channel doesn't swallow unhandledRejection (Gerhard Stöbich) #59974
- [cee362242b] - timers: fix binding fast call signatures (Renegade334) #59600
- [40fea57fdd] - tools: add message on auto-fixing js lint issues in gh workflow (Dario Piotrowicz) #59128
- [aac90d351b] - tools: verify signatures when updating nghttp* (Antoine du Hamel) #60113
- [9fae03c7d9] - tools: use dependabot cooldown and move tools/doc (Rafael Gonzaga) #59978
- [81548abdf6] - wasi: fix WasiFunction fast call signature (Renegade334) #59600

Notable Changes
- [1486fedea1] - (SEMVER-MINOR) cli: add --use-env-proxy (Joyee Cheung) #59151
- [bedaaa11fc] - (SEMVER-MINOR) http: support http proxy for fetch under NODE_USE_ENV_PROXY (Joyee Cheung) #57165
- [af8b5fa29d] - (SEMVER-MINOR) http: add shouldUpgradeCallback to let servers control HTTP upgrades (Tim Perry) #59824
- [42102594b1] - (SEMVER-MINOR) http,https: add built-in proxy support in http/https.request and Agent (Joyee Cheung) #58980
- [686ac49b82] - (SEMVER-MINOR) src: add percentage support to --max-old-space-size (Asaf Federman) #59082
Commits
- [a71dd592e3] - benchmark: calibrate config dgram multi-buffer (Bruno Rodrigues) #59696
- [16c4b466f4] - benchmark: calibrate config cluster/echo.js (Nam Yooseong) #59836
- [53cb9f3b6c] - build: add the missing macro definitions for OpenHarmony (hqzing) #59804
- [ec5290fe01] - build: do not include custom ESLint rules testing in tarball (Antoine du Hamel) #59809
- [1486fedea1] - (SEMVER-MINOR) cli: add --use-env-proxy (Joyee Cheung) #59151
- [1f93913446] - crypto: use return await when returning Promises from async functions (Renegade334) #59841
- [f488b2ff73] - crypto: use async functions for non-stub Promise-returning functions (Renegade334) #59841
- [aed9fd5ac4] - crypto: avoid calls to promise.catch() (Renegade334) #59841
- [37c2d186f0] - deps: update amaro to 1.1.4 (pmarchini) #60044
- [28aea13419] - deps: update archs files for openssl-3.5.4 (Node.js GitHub Bot) #60101
- [ddbc1aa0bb] - deps: upgrade openssl sources to openssl-3.5.4 (Node.js GitHub Bot) #60101
- [badbba2da9] - deps: update googletest to 50b8600 (Node.js GitHub Bot) #59955
- [48aaf98a08] - deps: update archs files for openssl-3.5.3 (Node.js GitHub Bot) #59901
- [e02a562ea6] - deps: upgrade openssl sources to openssl-3.5.3 (Node.js GitHub Bot) #59901
- [7e0e86cb92] - deps: upgrade npm to 10.9.4 (npm team) #60074
- [91dda5facf] - deps: update undici to 6.22.0 (Matteo Collina) #60112
- [3a3220a2f0] - dgram: restore buffer optimization in fixBufferList (Yoo) #59934
- [09bdcce6b8] - diagnostics_channel: fix race condition with diagnostics_channel and GC (Ugaitz Urien) #59910
- [b3eeb3bd13] - doc: provide alternative to url.parse() using WHATWG URL (Steven) #59736
- [1ddaab1904] - doc: mention reverse proxy and include simple example (Steven) #59736
- [3b3b71e99c] - doc: mark .env files support as stable (Santeri Hiltunen) #59925
- [d37f67d1bd] - doc: remove optional title prefixes (Aviv Keller) #60087
- [ca2dff63f9] - doc: fix typo on child_process.md (Angelo Gazzola) #60114
- [3fca564a05] - doc: add automated migration info to deprecations (Augustin Mauroy) #60022
- [4bc366fc16] - doc: use "WebAssembly" instead of "Web Assembly" (Tobias Nießen) #59954
- [4808dbdd9a] - doc: fix typo in section on microtask order (Tobias Nießen) #59932
- [d6e303d645] - doc: update V8 fast API guidance (René) #58999
- [0a3a3f729e] - doc: add security escalation policy (Ulises Gascón) #59806
- [8fd669c70d] - doc: type improvement of file http.md (yusheng chen) #58189
- [9833dc6060] - doc: rephrase dynamic import() description (Nam Yooseong) #59224
- [2870a73681] - doc,crypto: update subtle.generateKey and subtle.importKey (Filip Skokan) #59851
- [85818db93c] - fs,win: do not add a second trailing slash in readdir (Gerhard Stöbich) #59847
- [bedaaa11fc] - (SEMVER-MINOR) http: support http proxy for fetch under NODE_USE_ENV_PROXY (Joyee Cheung) #57165
- [af8b5fa29d] - (SEMVER-MINOR) http: add shouldUpgradeCallback to let servers control HTTP upgrades (Tim Perry) #59824
- [758271ae66] - http: optimize checkIsHttpToken for short strings (방진혁) #59832
- [42102594b1] - (SEMVER-MINOR) http,https: add built-in proxy support in http/https.request and Agent (Joyee Cheung) #58980
- [a33ed9bf96] - inspector: ensure adequate memory allocation for Binary::toBase64 (René) #59870
- [34c686be2b] - lib: update inspect output format for subclasses (Miguel Marcondes Filho) #59687
- [12e553529c] - lib: add source map support for assert message

This is a security release.
Notable Changes
- (CVE-2025-27210) Windows Device Names (CON, PRN, AUX) Bypass Path Traversal Protection in path.normalize()
Commits
- [8cf5d66ab7] - (CVE-2025-27210) lib: handle all windows reserved driver name (RafaelGSS) nodejs-private/node-private#721
- [9c0cb487ec] - win,build: fix MSVS v17.14 compilation issue (StefanStojanovic) #58902

This is a security release.
Notable Changes
- CVE-2025-23083 - src,loader,permission: throw on InternalWorker use when permission model is enabled (High)
- CVE-2025-23085 - src: fix HTTP2 mem leak on premature close and ERR_PROTO (Medium)
- CVE-2025-23084 - path: fix path traversal in normalize() on Windows (Medium)
Dependency update:
- CVE-2025-22150 - Use of Insufficiently Random Values in undici fetch() (Medium)
Commits
- [520da342e0] - (CVE-2025-22150) deps: update undici to v6.21.1 (Matteo Collina) nodejs-private/node-private#662
- [99f217369f] - (CVE-2025-23084) path: fix path traversal in normalize() on Windows (Tobias Nießen) nodejs-private/node-private#555
- [984f735e35] - (CVE-2025-23085) src: fix HTTP2 mem leak on premature close and ERR_PROTO (RafaelGSS) nodejs-private/node-private#650
- [2446870618] - (CVE-2025-23083) src,loader,permission: throw on InternalWorker use (RafaelGSS) nodejs-private/node-private#651

Notable Changes
This release marks the transition of Node.js 22.x into Long Term Support (LTS) with the codename 'Jod'. The 22.x release line now moves into "Active LTS" and will remain so until October 2025. After that time, it will move into "Maintenance" until end of life in April 2027.
Other than updating metadata, such as the process.release object, to reflect that the release is LTS, no further changes from Node.js 22.10.0 are included.

OpenSSL 3.x
Official binaries for Node.js 22.x currently include OpenSSL 3.0.x (more specifically, the quictls OpenSSL fork). OpenSSL 3.0.x is the currently designated long term support version that is scheduled to be supported until 7th September 2026, which is within the expected lifetime of Node.js 22.x. We are expecting upstream OpenSSL to announce a successor long term support version prior to that date and since OpenSSL now follows a semantic versioning-like versioning scheme we expect to be able to update to the next long term supported version of OpenSSL during the lifetime of Node.js 22.x.

Notable Changes
New "module-sync" exports condition
This release introduces a "module-sync" exports condition that's enabled when require(esm) is enabled, so packages can supply a synchronous ES module to the Node.js module loader, no matter if it's being required or imported. This is similar to the "module" condition that bundlers have been using to support require(esm) in Node.js, and allows dual-package authors to opt into ESM-first only on newer versions of Node.js that supports require(esm) to avoid the dual-package hazard.
Or if the package is only meant to be run on Node.js and wants to fallback to CJS on older versions that don't have require(esm):

For package authors:
this only serves as a feature-detection mechanism for packages that wish to support both CJS and ESM users during the period when some active Node.js LTS versions support require(esm) while some older ones don't. When all active Node.js LTS lines support require(esm), packages can simplify their distributions by bumping the major version, dropping their CJS exports, and removing the module-sync exports condition (with only main or default targetting the ESM exports). If the package needs to support both bundlers and being run unbundled on Node.js during the transition period, use both module-sync and module and point them to the same ESM file. If the package already doesn't want to support older versions of Node.js that doesn't support require(esm), don't use this export condition.

For bundlers/tools:
they should avoid implementing this stop-gap condition. Most existing bundlers implement the de-facto bundler standard module exports condition, and that should be enough to support users who want to bundle ESM from CJS consumers. Users who want both bundlers and Node.js to recognize the ESM exports can use both module/module-sync conditions during the transition period, and can drop module-sync+module when they no longer need to support older versions of Node.js. If tools do want to support this condition, it's recommended to make the resolution rules in the graph pointed by this condition match the Node.js native ESM rules to avoid divergence.
We ended up implementing a condition with a different name instead of reusing "module", because existing code in the ecosystem using the "module" condition sometimes also expect the module resolution for these ESM files to work in CJS style, which is supported by bundlers, but the native Node.js loader has intentionally made ESM resolution different from CJS resolution (e.g. forbidding import './noext' or import './directory'), so it would be breaking to implement a "module" condition without implementing the forbidden ESM resolution rules. For now, this just implements a new condition as semver-minor so it can be backported to older LTS.
Contributed by Joyee Cheung in #54648.

node --run is now stable
This CLI flag runs a specified command from a package.json's "scripts" object.
You can run node --run test and that would start the test suite.
Contributed by Yagiz Nizipli in #53763.

Other notable changes
- [f0b441230a] - (SEMVER-MINOR) crypto: add KeyObject.prototype.toCryptoKey (Filip Skokan) #55262
- [349d2ed07b] - (SEMVER-MINOR) crypto: add Date fields for validTo and validFrom (Andrew Moon) #54159
- [bebc95ed58] - doc: add abmusse to collaborators (Abdirahim Musse) #55086
- [914db60159] - (SEMVER-MINOR) http2: expose nghttp2_option_set_stream_reset_rate_limit as an option (Maël Nison) #54875
- [f7c3b03759] - (SEMVER-MINOR) lib: propagate aborted state to dependent signals before firing events (jazelly) #54826
- [32261fc98a] - (SEMVER-MINOR) module: support loading entrypoint as url (RedYetiDev) #54933
- [06957ff355] - (SEMVER-MINOR) module: implement flushCompileCache() (Joyee Cheung) #54971
- [2dcf70c347] - (SEMVER-MINOR) module: throw when invalid argument is passed to enableCompileCache() (Joyee Cheung) #54971
- [f9b19d7c44] - (SEMVER-MINOR) module: write compile cache to temporary file and then rename it 

New API to retrieve execution Stack Trace
A new API getCallSite has been introduced to the util module. This API allows users to retrieve the stacktrace of the current execution.
Thanks to Rafael Gonzaga for making this work on #54380.

Disable V8 Maglev
We have seen several crashes/unexpected JS behaviors with maglev on v22 (which ships V8 v12.4). The bugs lie in the codegen so it would be difficult for users to work around them or even figure out where the bugs are coming from. Some bugs are fixed in the upstream while some others probably remain.
As v22 will get stuck with V8 v12.4 as LTS, it will be increasingly difficult to backport patches for them even if the bugs are fixed. So disable it by default on v22 to reduce the churn and troubles for users.
Thanks to Joyee Cheung for making this work on #54384

Exposes X509_V_FLAG_PARTIAL_CHAIN to tls.createSecureContext
This releases introduces a new option to the API tls.createSecureContext. For now on users can use tls.createSecureContext({ allowPartialTrustChain: true }) to treat intermediate (non-self-signed) certificates in the trust CA certificate list as trusted.
Thanks to Anna Henningsen for making this work on #54790

Other Notable Changes
- [5c9599af5a] - src: create handle scope in FastInternalModuleStat (Joyee Cheung) #54384
- [e2307d87e8] - (SEMVER-MINOR) stream: relocate the status checking code in the onwritecomplete (YoonSoo_Shin) #54032

Deprecations
- [8433032948] - repl: doc-deprecate instantiating node:repl classes without new (Aviv Keller) #54842
- [8c4c85cf31] - zlib: deprecate instantiating classes without new (Yagiz Nizipli) #54708

New JS API for compile cache
This release adds a new API module.enableCompileCache() that can be used to enable on-disk code caching of all modules loaded after this API is called.
Previously this could only be enabled by the NODE_COMPILE_CACHE environment variable, so it could only set by end-users.
This API allows tooling and library authors to enable caching of their own code.
This is a built-in alternative to the v8-compile-cache/v8-compile-cache-lib packages, but have better performance and supports ESM.
Thanks to Joyee Cheung for working on this.

New option for vm.createContext() to create a context with a freezable globalThis
Node.js implements a flavor of vm.createContext() and friends that creates a context without contextifying its global object when vm.constants.DONT_CONTEXTIFY is used. This is suitable when users want to freeze the context (impossible when the global is contextified i.e. has interceptors installed) or speed up the global access if they don't need the interceptor behavior.
Thanks to Joyee Cheung for working on this.

Support to coverage thresholds
Node.js now supports requiring code coverage to meet a specific threshold before the process exits successfully.
To use this feature, you need to enable the --experimental-test-coverage flag.
You can set thresholds for the following types of coverage:
- Branch coverage: Use --test-coverage-branches=<threshold>
- Function coverage: Use --test-coverage-functions=<threshold>
- Line coverage: Use --test-coverage-lines=<threshold>
<threshold> should be an integer between 0 and 100. If an invalid value is provided, a TypeError will be thrown.
If the code coverage fails to meet the specified thresholds for any category, the process will exit with code 1.
For instance, to enforce a minimum of 80% line coverage and 60% branch coverage, you can run:
$ node --experimental-test-coverage --test-coverage-lines=80 --test-coverage-branches=60 example.js
Thanks Aviv Keller for working on this.

Other Notable Changes
- [1f2cc2fa47] - (SEMVER-MINOR) src,lib: add performance.uvMetricsInfo (Rafael Gonzaga) #54413
- [1e01bdc0d0] - (SEMVER-MINOR) net: exclude ipv6 loopback addresses from server.listen (Giovanni Bucci) #54264
- [97fa075c2e] - (SEMVER-MINOR) test_runner: support running tests in process (Colin Ihrig) #53927
- [858b583c88] - (SEMVER-MINOR) test_runner: defer inheriting hooks until run() (Colin Ihrig) #53927

Experimental transform types support
With the new flag --experimental-transform-types it is possible to enable the transformation of TypeScript-only syntax into JavaScript code.
This feature allows Node.js to support TypeScript syntax such as Enum and namespace.
Thanks to Marco Ippolito for making this work on #54283.

Module syntax detection is now enabled by default.
Module syntax detection (the --experimental-detect-module flag) is now enabled by default. Use --no-experimental-detect-module to disable it if needed.
Syntax detection attempts to run ambiguous files as CommonJS, and if the module fails to parse as CommonJS due to ES module syntax, Node.js tries again and runs the file as an ES module.
Ambiguous files are those with a .js or no extension, where the nearest parent package.json has no "type" field (either "type": "module" or "type": "commonjs").
Syntax detection should have no performance impact on CommonJS modules, but it incurs a slight performance penalty for ES modules; add "type": "module" to the nearest parent package.json file to eliminate the performance cost.
A use case unlocked by this feature is the ability to use ES module syntax in extensionless scripts with no nearby package.json.
Thanks to Geoffrey Booth for making this work on #53619.

Performance Improvements to Buffer
Performance of Node.js Buffers have been optimized through multiple PR's with significant improvements to the Buffer.copy and Buffer.write methods. These are used throughout the codebase and should give a nice boost across the board.
Thanks to Robert Nagy for making this work on #54311, #54324, and #54087.

Other Notable Changes
- [911de7dd6d] - (SEMVER-MINOR) inspector: support Network.loadingFailed event (Kohei Ueno) #54246
- [9ee4b16bd8] - (SEMVER-MINOR) lib: rewrite AsyncLocalStorage without async_hooks (Stephen Belanger) #48528

Experimental TypeScript support via strip types
Node.js introduces the --experimental-strip-types flag for initial TypeScript support. This feature strips type annotations from .ts files, allowing them to run without transforming TypeScript-specific syntax.
Current limitations include:
- Supports only inline type annotations, not features like enums or namespaces.
- Requires explicit file extensions in import and require statements.
- Enforces the use of the type keyword for type imports to avoid runtime errors.
- Disabled for TypeScript in node_modules by default.
Thanks Marco Ippolito for working on this.

Experimental Network Inspection Support in Node.js
This update introduces the initial support for network inspection in Node.js. Currently, this is an experimental feature, so you need to enable it using the --experimental-network-inspection flag. With this feature enabled, you can inspect network activities occurring within a JavaScript application.
To use network inspection, start your Node.js application with the following command:
$ node --inspect-wait --experimental-network-inspection index.js
Please note that the network inspection capabilities are in active development. We are actively working on enhancing this feature and will continue to expand its functionality in future updates.
- Network inspection is limited to the http and https modules only.
- The Network tab in Chrome DevTools will not be available until the feature request on the Chrome DevTools side is addressed.
Thanks Kohei Ueno for working on this.

Other Notable Changes
- [15a94e67b1] - lib,src: drop --experimental-network-imports (Rafael Gonzaga) #53822
- [68e444d2d8] - (SEMVER-MINOR) http: add diagnostics channel http.client.request.error (Kohei Ueno) #54054
- [2d982d3dee] - (SEMVER-MINOR) deps: V8: backport 7857eb34db42 (Stephen Belanger) #53997
- [15816bd0dd] - (SEMVER-MINOR) stream: expose DuplexPair API (Austin Wright) #34111
- [893c864542] - (SEMVER-MINOR) test_runner: fix support watch with run(), add globPatterns option (Matteo Collina) #53866
- [048d421ad1] - meta: add jake to collaborators (jakecastelli) #54004
- [6ad6e01bf3] - (SEMVER-MINOR) test_runner: refactor snapshots to get file from context (Colin Ihrig) #53853
- [698e44f8e7] - (SEMVER-MINOR) test_runner: add context.filePath (Colin Ihrig) #53853

Notable Changes
This release fixes a regression introduced in Node.js 22.5.0. The problem is known to display the following symptoms:
- Crash with FATAL ERROR: v8::Object::GetCreationContextChecked No creation context available #53902
- npm errors with npm error Exit handler never called! npm/cli#7657
- yarn hangs or outputs Usage Error: Couldn't find the node_modules state file - running an install might help (findPackageLocation) yarnpkg/berry#6398

Notable Changes
- [1367c5558e] - (SEMVER-MINOR) http: expose websockets (Natalia Venditto) #53721
- [b31394920d] - (SEMVER-MINOR) lib: add node:sqlite module (Colin Ihrig) #53752
- [aa7df9551d] - module: add __esModule to require()'d ESM (Joyee Cheung) #52166
- [8743c4d65a] - (SEMVER-MINOR) path: add matchesGlob method (Aviv Keller) #52881
- [77936c3d24] - (SEMVER-MINOR) process: port on-exit-leak-free to core (Vinicius Lourenço) #53239
- [82d88a83f8] - (SEMVER-MINOR) stream: pipeline wait for close before calling the callback (jakecastelli) #53462
- [3a0fcbb17a] - test_runner: support glob matching coverage files (Aviv Keller) #53553
- [22ca334090] - (SEMVER-MINOR) worker: add postMessageToThread (Paolo Insogna) #53682

This is a security release.

Notable Changes
- CVE-2024-36138 - Bypass incomplete fix of CVE-2024-27980 (High)
- CVE-2024-22020 - Bypass network import restriction via data URL (Medium)
- CVE-2024-22018 - fs.lstat bypasses permission model (Low)
- CVE-2024-36137 - fs.fchown/fchmod bypasses permission model (Low)
- CVE-2024-37372 - Permission model improperly processes UNC paths (Low)

Notable Changes
Experimental Web Storage API
[9e30724b53] - (SEMVER-MINOR) deps,lib,src: add experimental web storage (Colin Ihrig) #52435

API stability updates
[201266706b] - doc: move node --run stability to rc (Yagiz Nizipli) #53433
[16c0884d48] - doc: mark WebSocket as stable (Matthew Aitken) #53352
[cf375e73c1] - doc: mark --heap-prof and related flags stable (Joyee Cheung) #53343
[0160745057] - doc: mark --cpu-prof and related flags stable (Joyee Cheung) #53343

Other Notable Changes
[df4762722c] - doc: doc-only deprecate OpenSSL engine-based APIs (Richard Lau) #53329
[ad5282e196] - inspector: fix disable async hooks on Debugger.setAsyncCallStackDepth (Joyee Cheung) #53473
[e95af740fc] - (SEMVER-MINOR) lib: add diagnostics_channel events to module loading (RafaelGSS) #44340
[50733a1abe] - (SEMVER-MINOR) util: support --no- for argument with boolean type for parseArgs (Zhenwei Jin) #53107

Notable Changes
[5a41bcf9ca] - (SEMVER-MINOR) src: traverse parent folders while running --run (Yagiz Nizipli) #53154
[1d5934524b] - (SEMVER-MINOR) buffer: add .bytes() method to Blob (Matthew Aitken) #53221
[75e5612fae] - (SEMVER-MINOR) src,permission: --allow-wasi & prevent WASI exec (Rafael Gonzaga) #53124
[b5c30e2f5e] - (SEMVER-MINOR) module: print amount of load time of a cjs module (Vinicius Lourenço) #52213
[8c6dffc269] - (SEMVER-MINOR) test_runner: add snapshot testing (Colin Ihrig) #53169
[048478d351] - (SEMVER-MINOR) doc: add context.assert docs (Colin Ihrig) #53169
[f6d2af8ee7] - (SEMVER-MINOR) test_runner: add context.fullName (Colin Ihrig) #53169
[a0766bdf0e] - (SEMVER-MINOR) net: add new net.server.listen tracing channel (Paolo Insogna) #53136
[374743cd4e] - (SEMVER-MINOR) process: add process.getBuiltinModule(id) (Joyee Cheung) #52762
[1eb55f3550] - (SEMVER-MINOR) doc: improve explanation about built-in modules (Joyee Cheung) #52762
[6165894774] - fs: mark recursive cp methods as stable (Théo LUDWIG) #53127
[db5dd0c6df] - doc: add StefanStojanovic to collaborators (StefanStojanovic) #53118
[cfcde78513] - (SEMVER-MINOR) cli: add NODE_RUN_PACKAGE_JSON_PATH env (Yagiz Nizipli) #53058
[7a67ecf161] - (SEMVER-MINOR) test_runner: support module mocking (Colin Ihrig) #52848
[ee56aecced] - (SEMVER-MINOR) lib: add EventSource Client (Aras Abbasi) #51575
[6413769bc7] - (SEMVER-MINOR) lib: replace MessageEvent with undici's (Matthew Aitken) #52370
[c70b2f7a76] - (SEMVER-MINOR) cli: add NODE_RUN_SCRIPT_NAME env to node --run (Yagiz Nizipli) #53032
[badec0c38b] - doc: add Marco Ippolito to TSC (Rafael Gonzaga) #53008

We're excited to announce the release of Node.js 22!
Highlights include require()ing ESM graphs, WebSocket client, updates of the V8 JavaScript engine, and more!
As a reminder, Node.js 22 will enter long-term support (LTS) in October, but until then, it will be the "Current" release for the next six months.
We encourage you to explore the new features and benefits offered by this latest release and evaluate their potential impact on your applications.