Node.js: versiuni mai vechi, descărcare

This is a security release.
Notable Changes
- (CVE-2026-106069, CVE-2026-106072) tls: reject non-canonical IP addresses (Matteo Collina) – High
- (CVE-2026-105482) dns: validate resolve inputs for null bytes (James M Snell) – High
- (CVE-2026-105483) tls: fix ip normalization regression (James M Snell) – High
- (CVE-2026-111497) src: expose BROTLI_DECODER_ERROR_FORMAT_BLOCK_SWITCH (Antoine du Hamel) – High
- (CVE-2026-111497) deps: brotli: cherry-pick 0ed4268a4401abcb44720963 (Evgenii Kliuchnikov) – High
- (CVE-2026-105481) http: ensure agent data guard works without I/O (James M Snell) – Medium
- (CVE-2026-106074) crypto: reset random caches across snapshots (Filip Skokan) – Medium
- (CVE-2026-106070) zlib: avoid caching invalid ZIP local headers (Matteo Collina) – Low
- (CVE-2026-106071) src: fix the fs permission tree node on wildcard nodes (James M Snell) – Low
- (CVE-2026-106073) permission: check permission model in realpathSync (RafaelGSS) – Low
- deps: V8: backport 93cd21e8254b (Joyee Cheung)
- crypto: update root certificates to NSS 3.131.1 (Antoine du Hamel)
- tls: reject chains containing blocked public keys (Ulises Gascon)
- deps: update c-ares to 1.34.9 (Node.js GitHub Bot)
- tools: retry Gatekeeper check and stapling after notarization (Ryan Aslett)
- crypto: harden X.509 conversion and formatting (Filip Skokan)
Commits
- [818e4ca061] - crypto: update root certificates to NSS 3.131.1 (Antoine du Hamel) #66877
- [fd3c87ed43] - crypto: harden X.509 conversion and formatting (Filip Skokan) nodejs-private/node-private#966
- [acffa610db] - crypto: reset random caches across snapshots (Filip Skokan) nodejs-private/node-private#987
- [7895a5cd2d] - deps: update undici to 8.12.2 (Node.js GitHub Bot) #66721
- [12daa54d2e] - deps: V8: backport 93cd21e8254b (Joyee Cheung) nodejs-private/node-private#999
- [6a8b3db7e2] - deps: update c-ares to 1.34.9 (Node.js GitHub Bot) #66868
- [a6040b50d9] - deps: brotli: cherry-pick 0ed4268a4401abcb44720963 (Evgenii Kliuchnikov) nodejs-private/node-private#1002
- [6b78ea171d] - dns: validate resolve inputs for null bytes (James M Snell) nodejs-private/node-private#984
- [0683ee5f7d] - http: ensure agent data guard works without I/O (James M Snell) nodejs-private/node-private#983
- [e5cae10148] - Revert "module: synchronously load most ES modules" (Antoine du Hamel) #66786
- [cc244131aa] - permission: check permission model in realpathSync (RafaelGSS) nodejs-private/node-private#973
- [0392385841] - src: expose BROTLI_DECODER_ERROR_FORMAT_BLOCK_SWITCH (Antoine du Hamel) nodejs-private/node-private#1002
- [c273a408c9] - src: fix the fs permission tree node on wildcard nodes (James M Snell) nodejs-private/node-private#986
- [a2caddd20e] - tls: reject chains containing blocked public keys (Ulises Gascon) #66871
- [ad788ccd07] - tls: reject non-canonical IP addresses (Matteo Collina) nodejs-private/node-private#982
- [cd4b05469c] - tls: fix ip normalization regression (James M Snell) nodejs-private/node-private#985
- [5fa440e0d7] - tools: retry Gatekeeper check and stapling after notarization (Ryan Aslett) #66855
- [745ad77156] - zlib: avoid caching invalid ZIP local headers (Matteo Collina) nodejs-private/node-private#981

Notable Changes
- [1ebd6d3677] - (SEMVER-MINOR) doc,lib,src: throw on missing WebAssembly or RX support (Paolo Insogna) #66533
- [7f1937d2b9] - (SEMVER-MINOR) http: add websocketMask() and websocketUnmask() (James M Snell) #66335
Commits
- [30e76bb16a] - benchmark: fix input passed to subtle.digest in webcrypto-digest (Rafael Gonzaga) #66608
- [adef72223a] - benchmark: fix buffer option in buffer read/write benchmarks (Rafael Gonzaga) #66604
- [2f498f08fe] - benchmark: add util.parseArgs benchmark (Rafael Gonzaga) #66599
- [4ce8412e18] - benchmark: fix url-searchparams-sort to sort a fresh list (RafaelGSS) #66535
- [493bd6c66e] - benchmark,tools: fix napi benchmarks on GHA (Nigro Simone) #66423
- [e4515552d6] - build: run QUIC CI for V8 changes (Yuya Inoue) #66602
- [a888e51062] - build: support Python 3.15 (Mike McCready) #65750
- [2afab9a63b] - build: do not include shared gtest in node link path (Antoine du Hamel) #66626
- [f88c2f8ec6] - build,test: enable temporal support on no-ICU and system-ICU builds (Antoine du Hamel) #66697
- [5fd03e6fdf] - child_process: propagate config-file permission flags to children (Rafael Gonzaga) #66559
- [f771134b07] - crypto: isolate provider EC PKCS8 encoding (Filip Skokan) #66413
- [4e00a293db] - crypto: remove key export and metadata locks (Filip Skokan) #66413
- [bcd8018775] - crypto: remove verify setup key locking (Filip Skokan) #66413
- [883250fee2] - crypto: remove KEM key locking (Filip Skokan) #66413
- [9d98805071] - crypto: remove RSA-OAEP key locking (Filip Skokan) #66413
- [d6293e7bb1] - crypto: skip secret key mutex allocation (Filip Skokan) #66413
- [8d8af8003e] - crypto: keep the root cert store per Environment (Shelley Vohr) #66411
- [c6f0614785] - crypto: remove select Web Crypto warnings (Filip Skokan) #66312
- [e5360b5a08] - deps: update googletest to 988ea2c1798de7779f656df2281dd36d6039a17a (Node.js GitHub Bot) #66652
- [7eb230a2c1] - deps: update acorn to 8.19.0 (Node.js GitHub Bot) #66655
- [af946ba8f3] - deps: update sqlite to 3.54.0 (Node.js GitHub Bot) #66663
- [007872a85d] - deps: V8: cherry-pick 8d14d49c4040 (Antoine du Hamel) #66627
- [f44aec4966] - deps: update simdjson to 5.0.3 (Daniel Lemire) #66620
- [1a33e914e8] - deps: V8: cherry-pick 7d5eb1df2a72 (inoway46) #66566
- [3294d51e5a] - diagnostics_channel: fix default callback context (Matteo Collina) #66481
- [5c602a5824] - doc: list futimes among fd APIs disabled by the permission model (Rafael Gonzaga) #66649
- [eaeb4736c8] - doc: add Test Runner to list of built-in diagnostic channels (Vas Sudanagunta) #66563
- [0e1c99afae] - doc: document stream/iter behaviors and Node.js extensions (James M Snell) #66483
- [846236367d] - doc: document URL and Uint8Array references in process.permission (Rafael Gonzaga) #66557
- [fc3b067be7] - doc: clarify http Agent keepSocketAlive behavior (Efe Karasakal) #66252
- [73a4e90ce2] - doc: document keepAliveTimeoutBuffer server option (Efe Karasakal) #66286
- [bb816582af] - doc: fix request.reusedSocket timeout example (Efe Karasakal) #66286
- [82223ab4d9] - doc: clarify revert PR label policy (Antoine du Hamel) #66529
- [c6f59d4e8e] - doc: clarify node binary misuse after compromise (Rafael Gonzaga) #66530
- [8904178498] - doc: document linux-x64-musl build toolchain (Issac) #66523
- [1e8247a74e] - doc: run license-builder (github-actions[bot]) #66517
- [b2773d5e4c] - doc: add missing return types in cluster.md (Daniel Pinto) #66453
- [1ebd6d3677] - (SEMVER-MINOR) doc,lib,src: throw on missing WebAssembly or RX support (Paolo Insogna) #66533
- [c1073f31de] - ffi: fix exportArrayBuffer type check (Trivikram Kamat) #66455
- [69148ee0ff] - fs: lock FileHandle on first read in pull() and pullSync() (James M Snell) #66483
- [700c60a1cd] - fs: serialize FileHandle writer() async writes (James M Snell) #66483
- [32833def1c] - http: reduce raw header name allocations (Roberto Bianchi) #66488
- [7f1937d2b9] - (SEMVER-MINOR) http: add websocketMask() and websocketUnmask() (James M Sne

Commits
- [2dc4638e85] - Revert "build: toggle doc-kit verbosity based on V" (Antoine du Hamel)
- [3febbc54ec] - Revert "build, doc: move to redesign" (Antoine du Hamel)
- [173250e2e7] - Revert "tools: bump the doc group in /tools/doc with 4 updates" (Antoine du Hamel)

Notable Changes
- [616bd3fa26] - doc: deprecate Server.prototype._listen2 in node:net (Antoine du Hamel) #65593
- [ae1801eb55] - meta: refine the security vuln posture for experimental features (James M Snell) #65438
- [09feba74c8] - deps: update Undici to 8.10.2 (Node.js GitHub Bot) #65788
- [7efdbe3eb9] - deps: update OpenSSL to 3.5.8 (Node.js GitHub Bot) #65542
Commits
- [d8aedd6584] - build: skip dockit on riscv64 (Stewart X Addison) #62251
- [1899c274eb] - build: activate correct default flags for riscv64 (Stewart X Addison) #65708
- [ec8a3be996] - build: derive NODE_ARCH from target_cpu in the GN build (Shelley Vohr) #65491
- [b73118a507] - build,win: remove LTO parallelisation limit (Stefan Stojanovic) #65535
- [09feba74c8] - deps: update undici to 8.10.2 (Node.js GitHub Bot) #65788
- [e47c432dd6] - deps: upgrade npm to 11.19.1 (npm team) #65573
- [2fd6ce36a9] - deps: update corepack to 0.36.0 (Node.js GitHub Bot) #65653
- [49dec2767a] - deps: update googletest to 36ba75f0ad5383a9759f17f3f72fd4661c72cb6d (Node.js GitHub Bot) #65654
- [676174a071] - deps: update simdjson to 4.6.9 (Node.js GitHub Bot) #65655
- [2f1b7fa0bb] - deps: update perfetto to 58.2 (Node.js GitHub Bot) #65656
- [12acd0ad15] - deps: update zlib to 1.3.2.1-motley-5eb4d7e (Node.js GitHub Bot) #65494
- [48631c80fb] - deps: update archs files for openssl-3.5.8 (Node.js GitHub Bot) #65542
- [7efdbe3eb9] - deps: upgrade openssl sources to openssl-3.5.8 (Node.js GitHub Bot) #65542
- [bdc75900ee] - doc: replace node:modules documentation header (René) #65800
- [44c8a499ba] - doc: clarify return type of fs.mkdtemp* (Antoine du Hamel) #65743
- [025fb5eeb0] - doc: update changelog-maker instructions for releasing (Juan José) #65707
- [5f64847afa] - doc: add stability status to crypto.setEngine (Antoine du Hamel) #65746
- [299dee0cb9] - doc: remove outdated TLS authorized warning (Tim Perry) #65597
- [e97dcc0278] - doc: fix broken using link in ffi.md (Soul Lee) #65632
- [2c9cc7d237] - doc: fix some broken links (Antoine du Hamel) #65583
- [0c330ec329] - doc: fix stale TOC in maintaining-dependencies (greenhead) #65523
- [9c522a3a69] - doc: refactor the AI guidelines (Joyee Cheung) #65269
- [46cbf1bf8c] - doc: fix triggerAsyncId() comment in async_hooks example (soreavis) #64583
- [788904ff78] - doc: fix fsPromises.watch overflow value (Matt Radbourne) #64605
- [3d06ff19e8] - doc: clarify stream direction in options.stdio note (Avocado) #65236
- [d334838379] - doc: clarify signal listener behavior (Som Samantray) #65243
- [d55a2bd56a] - doc: add test reporter event lifecycle diagram (sangwook) #63780
- [c17dfc87de] - doc: discourage AbortSignal cleanup for long-lived resources (Efe Karasakal) #64342
- [616bd3fa26] - doc: deprecate Server.prototype._listen2 in node:net (Antoine du Hamel) #65593
- [4e6d7e0ca6] - meta: cleanup targos emeritus changes (Antoine du Hamel) #65738
- [a70cfe1747] - meta: bump github/codeql-action/init from 4.37.3 to 4.37.9 (dependabot[bot]) #65714
- [e43a0ad4ce] - meta: bump github/codeql-action/autobuild from 4.37.3 to 4.37.9 (dependabot[bot]) #65717
- [99e06288f1] - meta: bump actions/checkout from 7.0.0 to 7.0.1 (dependabot[bot]) #65718
- [89662762b3] - meta: bump cachix/install-nix-action from 31.11.0 to 31.11.1 (dependabot[bot]) #65719
- [6b8f078672] - meta: bump actions/setup-node from 6.4.0 to 7.0.0 (dependabot[bot]) #65720
- [6c6fb18e63] - meta: bump step-security/harden-runner from 2.20.0 to 2.21.0 (dependabot[bot]) #65721
- [0e002e859f] - meta: bump github/codeql-action/upload-sarif from 4.37.3 to 4.37.9 (dependabot[bot]) #65722
- [98aaffe4b9] - meta: bump github/codeql-action/analyze from 4.37.3 to 4.37.9 (dependabot[bot]) #65723
- [d247cb2975] - meta: document collaborator automation (Filip Skokan) #65671
- [ae1801eb55] - meta: refine the security vuln posture for experimental features (James M Snell) #65438
- [fab81d15c3] - test: widen the gap in the resolver maxTimeout comparison (Shelley Vohr) #65780
- [62e2a6265c] - test:

Notable Changes
Out-of-band release to fix node --version which was reporting an alpha version.
Commits
- [ebd35a9eec] - src: revert accidental alpha designation (Antoine du Hamel) #65568
- [0b0dd87fcc] - tools: fix tools/nix/list-requisites.sh (Antoine du Hamel) #65560

This is a security release.
Notable Changes
- (CVE-2026-56848) http2: defer rst stream while in scope (Matteo Collina) – High
- (CVE-2026-58043) permission: avoid granting radix split nodes (RafaelGSS) – High
- (CVE-2026-56850) https: distinguish PFX object-array agent keys (RafaelGSS) – Medium
- (CVE-2026-58040) https: bind identity checks to session reuse (Matteo Collina) – Medium
- (CVE-2026-58041) sqlite: invalidate tag store iterators on statement reset (Matteo Collina) – Medium
- (CVE-2026-58042) dns: handle large resolveAny address replies (RafaelGSS) – Medium
- (CVE-2026-58045) zlib: throw on out-of-bounds write buffers (RafaelGSS) – Medium
- (CVE-2026-56847) permission: enforce fs write permission for trace events (RafaelGSS) – Low
- (CVE-2026-58039) permission: check final report output path (RafaelGSS) – Low
- (CVE-2026-58044) http: reject requests exceeding max header count (Matteo Collina) – Low
- deps: update llhttp to 9.4.3 (Paolo Insogna)
- deps: update undici to 8.9.0 (Node.js GitHub Bot)
Commits
- [af0bf96877] - deps: update llhttp to 9.4.3 (Paolo Insogna) nodejs-private/node-private#935
- [0354678355] - deps: update undici to 8.9.0 (Node.js GitHub Bot) #64712
- [dbeeaeec13] - (CVE-2026-58042) dns: handle large resolveAny address replies (RafaelGSS) nodejs-private/node-private#929
- [064d339f56] - (CVE-2026-58044) http: reject requests exceeding max header count (Matteo Collina) nodejs-private/node-private#922
- [23b94c843a] - (CVE-2026-56848) http2: defer rst stream while in scope (Matteo Collina) nodejs-private/node-private#921
- [c7ec3dc0b9] - (CVE-2026-58040) https: bind identity checks to session reuse (Matteo Collina) nodejs-private/node-private#904
- [8f666925b1] - (CVE-2026-56850) https: distinguish PFX object-array agent keys (RafaelGSS) nodejs-private/node-private#930
- [ad99d075b1] - (CVE-2026-58043) permission: avoid granting radix split nodes (RafaelGSS) nodejs-private/node-private#911
- [61222008b7] - (CVE-2026-58039) permission: check final report output path (RafaelGSS) nodejs-private/node-private#908
- [3cb607dfc4] - (CVE-2026-56847) permission: enforce fs write permission for trace events (RafaelGSS) nodejs-private/node-private#924
- [d08fde8a16] - (CVE-2026-58041) sqlite: invalidate tag store iterators on statement reset (Matteo Collina) nodejs-private/node-private#896
- [b3fbb6e11f] - (CVE-2026-58045) zlib: throw on out-of-bounds write buffers (RafaelGSS) nodejs-private/node-private#931

This is a security release.
Notable Changes
- (CVE-2026-48618) tls: normalize hostname for server identity checks (Matteo Collina) – High
- (CVE-2026-48933) crypto: guard WebCrypto cipher output length (Filip Skokan) – High
- (CVE-2026-48615) lib,test: redact proxy credentials in tunnel errors (Matteo Collina) – Medium
- (CVE-2026-48619) http2: cap originSet size to prevent unbounded memory growth (Matteo Collina) – Medium
- (CVE-2026-48928) tls: fix case-sensitive SNI context matching (Matteo Collina) – Medium
- (CVE-2026-48930) dns,net: reject hostnames with embedded NUL bytes (Matteo Collina) – Medium
- (CVE-2026-48934) tls: bind reusable sessions to authenticated host (Matteo Collina) – Medium
- (CVE-2026-48617) permission: handle process.chdir on writereport (RafaelGSS) – Low
- (CVE-2026-48931) http: fix response queue poisoning in http.Agent (Matteo Collina) – Low
- (CVE-2026-48935) permission: disable FileHandle utimes with permission model (RafaelGSS) – Low
- (CVE-2026-48936) permission: guard pipe open and chmod with net scope (RafaelGSS) – Low
Commits
- [98fbc89211] - (CVE-2026-48933) crypto: guard WebCrypto cipher output length (Filip Skokan) nodejs-private/node-private#878
- [110840f2c7] - deps: update llhttp to 9.4.2 (Antoine du Hamel) nodejs-private/node-private#890
- [8d36d522b2] - deps: update undici to 8.5.0 (Node.js GitHub Bot) #63903
- [2e6d03993a] - deps: update undici to 8.4.0 (Node.js GitHub Bot) #63779
- [5a17d5b07a] - deps: update archs files for openssl-3.5.7 (Node.js GitHub Bot) #63820
- [362725d4e5] - deps: upgrade openssl sources to openssl-3.5.7 (Node.js GitHub Bot) #63820
- [bd1214ab01] - (CVE-2026-48930) dns,net: reject hostnames with embedded NUL bytes (Matteo Collina) nodejs-private/node-private#868
- [bc0b53813e] - (CVE-2026-48931) http: fix response queue poisoning in http.Agent (Matteo Collina) nodejs-private/node-private#846
- [87d847bc70] - (CVE-2026-48619) http2: cap originSet size to prevent unbounded memory growth (Matteo Collina) nodejs-private/node-private#855
- [9308084fcb] - (CVE-2026-48615) lib,test: redact proxy credentials in tunnel errors (Matteo Collina) nodejs-private/node-private#867
- [a67dd46891] - (CVE-2026-48936) permission: guard pipe open and chmod with net scope (RafaelGSS) nodejs-private/node-private#885
- [7057c3f16c] - (CVE-2026-48935) permission: disable FileHandle utimes with permission model (RafaelGSS) nodejs-private/node-private#873
- [6bc17a6b51] - (CVE-2026-48617) permission: handle process.chdir on writereport (RafaelGSS) nodejs-private/node-private#870
- [c8668beff8] - test: add session reuse host verification regressions (Matteo Collina) nodejs-private/node-private#854
- [d1be630415] - (CVE-2026-48934) tls: bind reusable sessions to authenticated host (Matteo Collina) nodejs-private/node-private#854
- [a14c158bb3] - (CVE-2026-48928) tls: fix case-sensitive SNI context matching (Matteo Collina) nodejs-private/node-private#857
- [ebda73470d] - (CVE-2026-48618) tls: normalize hostname for server identity checks (Matteo Collina) nodejs-private/node-private#869

This is a security release.
Notable Changes
- (CVE-2026-21637) wrap SNICallback invocation in try/catch (Matteo Collina) - High
- (CVE-2026-21710) use null prototype for headersDistinct/trailersDistinct (Matteo Collina) - High
- (CVE-2026-21711) include permission check to pipe_wrap.cc (RafaelGSS) - Medium
- (CVE-2026-21712) handle url crash on different url formats (RafaelGSS) - Medium
- (CVE-2026-21713) use timing-safe comparison in Web Cryptography HMAC and KMAC (Filip Skokan) - Medium
- (CVE-2026-21714) handle NGHTTP2_ERR_FLOW_CONTROL error code (RafaelGSS) - Medium
- (CVE-2026-21717) test array index hash collision (Joyee Cheung) - Medium
- (CVE-2026-21715) add permission check to realpath.native (RafaelGSS) - Low
- (CVE-2026-21716) include permission check on lib/fs/promises (RafaelGSS) - Low
Commits
- [2086b7477b] - (CVE-2026-21717) build,test: test array index hash collision (Joyee Cheung) nodejs-private/node-private#834
- [0f9332a40a] - (CVE-2026-21713) crypto: use timing-safe comparison in Web Cryptography HMAC and KMAC (Filip Skokan) nodejs-private/node-private#822
- [2b6937ddb2] - deps: update undici to 7.24.4 (Node.js GitHub Bot) #62271
- [bfb8ad5787] - deps: update undici to 7.24.3 (Node.js GitHub Bot) #62233
- [be6384727f] - deps: upgrade npm to 11.11.1 (npm team) #62216
- [2feea5bb97] - deps: V8: override depot_tools version (Richard Lau) #62344
- [86c04784dd] - (CVE-2026-21710) http: use null prototype for headersDistinct/trailersDistinct (Matteo Collina) nodejs-private/node-private#821
- [5197a56a34] - (CVE-2026-21711) permission: include permission check to pipe_wrap.cc (RafaelGSS) nodejs-private/node-private#820
- [04a886c735] - (CVE-2026-21716) permission: include permission check on lib/fs/promises (RafaelGSS) nodejs-private/node-private#795
- [9a7f80f2b0] - (CVE-2026-21715) permission: add permission check to realpath.native (RafaelGSS) nodejs-private/node-private#794
- [d9c9b628cf] - (CVE-2026-21714) src: handle NGHTTP2_ERR_FLOW_CONTROL error code (RafaelGSS) nodejs-private/node-private#832
- [45b55dc786] - (CVE-2026-21712) src: handle url crash on different url formats (RafaelGSS) nodejs-private/node-private#816
- [4bfda307c0] - (CVE-2026-21637) tls: wrap SNICallback invocation in try/catch (Matteo Collina) nodejs-private/node-private#819

Notable Changes
- [ea87eea71a] - module: fix extensionless CJS files in "type": "module" packages (Matteo Collina) #62083
Commits
- [bab750d1b3] - build: do not depend on V8 deps on --without-bundled-v8 builds (Antoine du Hamel) #62033
- [b26d1c7fcb] - crypto: make --use-system-ca per-env rather than per-process (Aditi) #60678
- [e362635abf] - crypto: add missing AES dictionaries (Filip Skokan) #62099
- [6f975db8af] - crypto: fix importKey required argument count check (Filip Skokan) #62099
- [3beaf9c5fc] - deps: update amaro to 1.1.8 (Node.js GitHub Bot) #62151
- [53afb0edd8] - deps: update sqlite to 3.52.0 (Node.js GitHub Bot) #62150
- [a13ed052a1] - deps: update merve to 1.2.0 (Node.js GitHub Bot) #62149
- [2c850577b7] - deps: patch resb crate (Richard Lau) #62138
- [37862a6728] - deps: V8: cherry-pick aa0b288f87cc (Richard Lau) #62136
- [09191ad8b4] - deps: update ada to 3.4.3 (Node.js GitHub Bot) #62049
- [8d63a178fd] - doc: copyedit addons.md (Antoine du Hamel) #62071
- [83719ffb64] - doc: correct util.convertProcessSignalToExitCode validation behavior (René) #62134
- [eeee7c7fb1] - doc: add efekrskl as triager (Efe) #61876
- [db150b2e69] - doc: fix markdown for expectFailure values (Jacob Smith) #62100
- [d55a441e60] - doc: add title to index (Aviv Keller) #62046
- [cc46204b48] - doc: include url.resolve() in DEP0169 application deprecation (Mike McCready) #62002
- [1d91a7261e] - doc,module: add missing doc for syncHooks.deregister() (Joyee Cheung) #61959
- [5198573bee] - http: fix use-after-free when freeParser is called during llhttp_execute (Gerhard Stöbich) #62095
- [f8793f80df] - lib: fix source map url parse in dynamic imports (Chengzhong Wu) #61990
- [5439d0e0cf] - meta: bump actions/download-artifact from 7.0.0 to 8.0.0 (dependabot[bot]) #62063
- [27fd21943a] - meta: bump actions/upload-artifact from 6.0.0 to 7.0.0 (dependabot[bot]) #62062
- [5b266f3295] - meta: bump step-security/harden-runner from 2.14.2 to 2.15.0 (dependabot[bot]) #62064
- [ea87eea71a] - module: fix extensionless CJS files in "type": "module" packages (Matteo Collina) #62083
- [851228cd60] - sqlite: handle stmt invalidation (Guilherme Araújo) #61877
- [19efe60548] - src: expose async context frame debugging helper to JS (Anna Henningsen) #62103
- [0257e8072f] - src: make AsyncWrap subclass internal field counts explicit (Anna Henningsen) #62103
- [975dafbe3b] - src: release context frame in AsyncWrap::EmitDestroy (Gerhard Stöbich) #61995
- [f2c08c7888] - src: use validate_ascii_with_errors instead of validate_ascii (Сковорода Никита Андреевич) #61122
- [0278461d83] - stream: optimize webstreams pipeTo (Mattias Buelens) #62079
- [4d62e95bfa] - stream: fix brotli error handling in web compression streams (Filip Skokan) #62107
- [4bdcaf2865] - stream: improve Web Compression spec compliance (Filip Skokan) #62107
- [a5b1be2045] - stream: fix UTF-8 character corruption in fast-utf8-stream (Matteo Collina) #61745
- [5632446c4e] - stream: fix TransformStream race on cancel with pending write (Marco) #62040
- [f90fa9cd1a] - stream: accept ArrayBuffer in CompressionStream and DecompressionStream (조수민) #61913
- [00319eaa3a] - test: update WPT for url to c928b19ab0 (Node.js GitHub Bot) #62148
- [456abc7d20] - test: update WPT for WebCryptoAPI to c9e955840a (Node.js GitHub Bot) #62147
- [82770cb7d3] - test: improve WPT report runner (Filip Skokan) #62107
- [cfc847d233] - test: update WPT compression to ae05f5cb53 (Filip Skokan) #62107
- [80f78f2737] - test: update WPT for WebCryptoAPI to 42e47329fd (Node.js GitHub Bot) #62048
- [8048e0508c] - test: fix skipping behavior for test-runner-run-files-undefined (Antoine du Hamel) #62026
- [699a6214c6] - tools: revert timezone update GHA workflow to ubuntu-latest (Richard Lau) #62140
- [1a453b550c] - tools: improve error handling in test426 update script (Rich Trott) #62121
- [710dde5ee2] - tools: fix --node-builtin-modules-path value in shell.nix (Antoine du Hamel) #62102
- [dcb1cbb21f] - tools: bump the eslin

Notable Changes
- [e55eddea2a] - build, doc: use new api doc tooling (flakey5) #57343
- [4c181e2277] - (SEMVER-MINOR) sqlite: add limits property to DatabaseSync (Mert Can Altin) #61298
- [46ee1eddd7] - (SEMVER-MINOR) src: add C++ support for diagnostics channels (RafaelGSS) #61869
- [9ddd1a9c27] - (SEMVER-MINOR) src,permission: add --permission-audit (RafaelGSS) #61869
- [0d97ec4044] - (SEMVER-MINOR) test_runner: expose worker ID for concurrent test execution (Ali Hassan) #61394
Commits
- [940b58c8c1] - buffer: optimize buffer.concat performance (Mert Can Altin) #61721
- [0589b0e5a1] - build: fix GN for new merve dep (Shelley Vohr) #61984
- [f3d3968dcd] - Revert "build: add temporal test on GHA windows" (Antoine du Hamel) #61810
- [e55eddea2a] - build, doc: use new api doc tooling (flakey5) #57343
- [b7715292f8] - child_process: add tracing channel for spawn (Marco) #61836
- [a32a598748] - crypto: fix missing nullptr check on RSA_new() (ndossche) #61888
- [dc384f95b3] - crypto: fix handling of null BUF_MEM* in ToV8Value() (Nora Dossche) #61885
- [3337b095db] - crypto: fix potential null pointer dereference when BIO_meth_new() fails (Nora Dossche) #61788
- [51ded81139] - deps: update undici to 7.22.0 (Node.js GitHub Bot) #62035
- [8aa2fde931] - deps: update minimatch to 10.2.4 (Node.js GitHub Bot) #62016
- [57dc092eaf] - deps: upgrade npm to 11.11.0 (npm team) #61994
- [705bbd60a9] - deps: update simdjson to 4.3.1 (Node.js GitHub Bot) #61930
- [4d411d72e5] - deps: update acorn-walk to 8.3.5 (Node.js GitHub Bot) #61928
- [f53a32ab84] - deps: update acorn to 8.16.0 (Node.js GitHub Bot) #61925
- [9b483fbb27] - deps: update minimatch to 10.2.2 (Node.js GitHub Bot) #61830
- [4e54c103cb] - doc: separate in-types and out-types in SQLite conversion docs (René) #62034
- [ca78ebbeaa] - doc: fix small logic error in DETECT_MODULE_SYNTAX (René) #62025
- [e6b131f3fe] - doc: fix module.stripTypeScriptTypes indentation (René) #61992
- [7508540e19] - doc: update DEP0040 (punycode) to application type deprecation (Mike McCready) #61916
- [33a364cb62] - doc: explicitly mention Slack handle (Rafael Gonzaga) #61986
- [46a61922bd] - doc: support toolchain Visual Studio 2022 & 2026 + Windows 11 SDK (Mike McCready) #61864
- [dc12a257aa] - doc: rename invalid function parameter (René) #61942
- [dafdc0a5b8] - http: validate headers in writeEarlyHints (Richard Clarke) #61897
- [3c94b56fa6] - inspector: unwrap internal/debugger/inspect imports (René) #61974
- [8a24c17648] - lib: improve argument handling in Blob constructor (Ms2ger) #61980
- [21d4baf256] - meta: bump github/codeql-action from 4.32.0 to 4.32.4 (dependabot[bot]) #61911
- [59a726a8e3] - meta: bump step-security/harden-runner from 2.14.1 to 2.14.2 (dependabot[bot]) #61909
- [0072b7f991] - meta: bump actions/stale from 10.1.1 to 10.2.0 (dependabot[bot]) #61908
- [999bf22f47] - repl: keep reference count for process.on('newListener') (Anna Henningsen) #61895
- [4c181e2277] - (SEMVER-MINOR) sqlite: add limits property to DatabaseSync (Mert Can Altin) #61298
- [aee2a18257] - src: fix flags argument offset in JSUdpWrap (Weixie Cui) #61948
- [46ee1eddd7] - (SEMVER-MINOR) src: add C++ support for diagnostics channels (RafaelGSS) #61869
- [9ddd1a9c27] - (SEMVER-MINOR) src,permission: add --permission-audit (RafaelGSS) #61869
- [ea2df2a16f] - stream: fix pipeTo to defer writes per WHATWG spec (Matteo Collina) #61800
- [aa0c7b09e0] - test: remove unnecessary process.exit calls from test files (Antoine du Hamel) #62020
- [ad96a6578f] - test: skip test-url on --shared-ada builds (Antoine du Hamel) #62019
- [7c72a31e4b] - test: skip strace test with shared openssl (Richard Lau) #61987
- [604456c163] - test: avoid flaky debugger restart waits (Yuya Inoue) #61773
- [4890d6bd43] - test_runner: run afterEach on runtime skip (Igor Shevelenkov) #61525
- [fce2930110] - test_runner: expose expectFailure message (sangwook) #61563
- [0d97ec4044] - (SEMVER-MINOR) test_runner: expose worker ID for concurrent test e

Notable Changes
- [b0a79b10f0] - (SEMVER-MINOR) http2: add http1Options for HTTP/1 fallback configuration (Amol Yadav) #61713
- [2d874dfb8e] - (SEMVER-MINOR) sea: support ESM entry point in SEA (Joyee Cheung) #61813
- [ee59127664] - sqlite: mark as release candidate (Matteo Collina) #61262
- [608736e19e] - (SEMVER-MINOR) stream: rename Duplex.toWeb() type option to readableType (René) #61632
- [a43375999f] - (SEMVER-MINOR) test_runner: show interrupted test on SIGINT (Matteo Collina) #61676
Commits
- [ab4375e141] - benchmark: add startup benchmark for ESM entrypoint (Joyee Cheung) #61769
- [8d83d8026b] - build: add temporal test on GHA windows (Chengzhong Wu) #61810
- [aab153eec3] - build: skip sscache action on non-main branches (Joyee Cheung) #61790
- [9e40fb93bc] - build: use path-ignore in GHA coverage-windows.yml (Chengzhong Wu) #61811
- [4896653361] - build: generate_config_gypi.py generates valid JSON (Shelley Vohr) #61791
- [bb82b44de0] - build: build with v8 gdbjit support on supported platform (Joyee Cheung) #61010
- [e7173a093a] - build: show cc outputs when version detection failed (Chengzhong Wu) #61700
- [848050d38f] - build,win: add WinGet Visual Studio 2022 Build Tools Edition config (Mike McCready) #61652
- [938841e1cd] - crypto: always return certificate serial numbers as uppercase (Anna Henningsen) #61752
- [dba9001d6f] - deps: upgrade npm to 11.10.1 (npm team) #61892
- [75c8e18d2f] - deps: update nbytes to 0.1.3 (Node.js GitHub Bot) #61879
- [4ca1597f25] - deps: remove stale OpenSSL arch configs (René) #61834
- [c4f298c729] - deps: update llhttp to 9.3.1 (Node.js GitHub Bot) #61827
- [7d63a2df93] - deps: V8: cherry-pick 64b36b441179 (Rafael Magrin) #61712
- [241a6b7088] - deps: update googletest to 5a9c3f9e8d9b90bbbe8feb32902146cb8f7c1757 (Node.js GitHub Bot) #61731
- [eec896c0e0] - deps: V8: backport 6a0a25abaed3 (Vivian Wang) #61666
- [5a9874af09] - doc: clarify status of feature request issues (Antoine du Hamel) #61505
- [0648ac64aa] - doc: add esm and cjs examples to node:vm (Alfredo González) #61498
- [8b38718294] - doc: clarify build environment is trusted in threat model (Matteo Collina) #61865
- [10e86818ee] - doc: remove incorrect mention of module in typescript.md (Rob Palmer) #61839
- [b50376f527] - doc: simplify addAbortListener example (Chemi Atlow) #61842
- [dea0e7a856] - doc: fix typo in --disable-wasm-trap-handler description (Dmytro Semchuk) #61820
- [57ac1f5aa0] - doc: clean up globals.md (René) #61822
- [4c30d2bb4d] - doc: remove obsolete Boxstarter automated install (Mike McCready) #61785
- [db610b9e32] - doc: clarify async caveats for events.once() (René) #61572
- [b4a826b11c] - doc: update Juan's security steward info (Juan José) #61754
- [7d9cc5dc54] - doc: fix methods being documented as properties in process.md (Antoine du Hamel) #61765
- [aa0362c26a] - doc: add riscv64 info into platform list (Lu Yahan) #42251
- [9b0101b65b] - doc: fix dropdown menu being obscured at <600px due to stacking context (Jeff) #61735
- [df2c65b3e4] - doc: fix spacing in process message event (Aviv Keller) #61756
- [01018559f5] - doc: move describe/it aliases section before expectFailure (Luca Raveri) #61567
- [49443583af] - doc: fix broken links of net.md (YuSheng Chen) #61673
- [af7c927a2a] - doc: clean up Windows code snippet in child_process.md (reillylm) #61422
- [221648a687] - esm: update outdated FIXME comment in translators.js (Karan Mangtani) #61715
- [4484e14a31] - events: don't call resume after close (Сковорода Никита Андреевич) #60548
- [4cecbe1f53] - fs: add throwIfNoEntry option for fs.stat and fs.promises.stat (Juan José) #61178
- [2c94967684] - http: remove redundant keepAliveTimeoutBuffer assignment (Efe) #61743
- [435f3dd8e4] - http: attach error handler to socket synchronously in onSocket (RajeshKumar11) #61770
- [ce0ebd853d] - http: fix keep-alive socket reuse race in requestOnFinish (Martin Slota) #61710
- [8103a78b6a] - http2: add strictSingleValueFields option to relax header valid

Notable Changes
- [47df4328d7] - build,deps: replace cjs-module-lexer with merve (Yagiz Nizipli) #61456
Commits
- [47df4328d7] - build,deps: replace cjs-module-lexer with merve (Yagiz Nizipli) #61456
- [a727054503] - deps: upgrade npm to 11.9.0 (npm team) #61685
- [c78c49ed6b] - deps: update amaro to 1.1.7 (Node.js GitHub Bot) #61730
- [4790816d9b] - deps: update minimatch to 10.1.2 (Node.js GitHub Bot) #61732
- [8c71740e8a] - deps: update undici to 7.21.0 (Node.js GitHub Bot) #61683
- [e559ef6ab1] - deps: update googletest to 56efe3983185e3f37e43415d1afa97e3860f187f (Node.js GitHub Bot) #61605
- [300de2bb5a] - deps: update amaro to 1.1.6 (Node.js GitHub Bot) #61603
- [e71e9505ef] - dns: fix Windows SRV ECONNREFUSED by adjusting c-ares fallback detection (notvivek12) #61453
- [439b816bc7] - doc: clarify EventEmitter error handling in threat model (Matteo Collina) #61701
- [c1c6641f23] - doc: mention default option for test runner env (Steven) #61659
- [41ec451f98] - doc: fix --inspect security warning section (Tim Perry) #61675
- [bb90ef2356] - doc: document url.format(urlString) as deprecated under DEP0169 (René) #61644
- [513df82e6f] - doc: update to Visual Studio 2026 manual install (Mike McCready) #61655
- [9409d30736] - doc: deprecation add more codemod (Augustin Mauroy) #61642
- [75a7a67151] - doc: fix grammatical error in README.md (ayj8201) #61653
- [821e59e884] - doc: correct tools README Boxstarter link (Mike McCready) #61638
- [4998f539a0] - doc: update server.dropMaxConnection link (YuSheng Chen) #61584
- [9383ac4ab7] - http: implement slab allocation for HTTP header parsing (Mert Can Altin) #61375
- [e90eb1d561] - meta: persist sccache daemon until end of build workflows (René) #61639
- [ade36ac367] - meta: bump github/codeql-action from 4.31.9 to 4.32.0 (dependabot[bot]) #61622
- [26638bd67f] - meta: bump step-security/harden-runner from 2.14.0 to 2.14.1 (dependabot[bot]) #61621
- [eaa9a96cb6] - meta: bump actions/setup-python from 6.1.0 to 6.2.0 (dependabot[bot]) #61627
- [fd98187828] - meta: bump cachix/cachix-action (dependabot[bot]) #61626
- [820c1d021c] - meta: bump actions/setup-node from 6.1.0 to 6.2.0 (dependabot[bot]) #61625
- [72a4136bd5] - meta: bump actions/cache from 5.0.1 to 5.0.3 (dependabot[bot]) #61624
- [e3ef6cb3bc] - meta: bump peter-evans/create-pull-request from 8.0.0 to 8.1.0 (dependabot[bot]) #61623
- [020a836202] - meta: bump actions/stale from 10.1.0 to 10.1.1 (dependabot[bot]) #61620
- [0df72f07c8] - meta: bump actions/checkout from 6.0.1 to 6.0.2 (dependabot[bot]) #61619
- [d147c08b83] - module: do not invoke resolve hooks twice for imported cjs (Joyee Cheung) #61529
- [a2843f8556] - net: defer synchronous destroy calls in internalConnect (RajeshKumar11) #61658
- [7fb7030781] - repl: fix flaky test-repl-programmatic-history (Matteo Collina) #61614
- [d4c9b5cf5b] - sqlite: avoid extra copy for large text binds (Ali Hassan) #61580
- [aa1b3661d9] - sqlite: use DictionaryTemplate for run() result (Mert Can Altin) #61432
- [9c8ad7e881] - src: elide heap allocation in structured clone implementation (Anna Henningsen) #61703
- [c4ecfef93d] - src: use simdutf for one-byte string UTF-8 write in stringBytes (Mert Can Altin) #61696
- [28905b9734] - src: consolidate C++ ReadFileSync/WriteFileSync utilities (Joyee Cheung) #61662
- [e90cec2f69] - test: restraint version replacement pattern in snapshots (Chengzhong Wu) #61748
- [adce20c0a1] - test: print stack immediately avoiding GC interleaving (Chengzhong Wu) #61699
- [7643bc8999] - test: fix case-insensitive path matching on Windows (Matteo Collina) #61682
- [23d1ecf66f] - test: fix flaky test-performance-eventloopdelay (Matteo Collina) #61629
- [99012a88ed] - test: remove duplicate wpt tests (Filip Skokan) #61617
- [a8b32b8ce1] - test: fix race condition in watch mode tests (Matteo Collina) #61615
- [086a5a5a25] - test: update WPT for url to e3c46fdf55 (Node.js GitHub Bot) #61602
- [f0574fd419] - test: use the skipIfNoWatch() utility function (Lu

Notable Changes
- [796ff46ae6] - (SEMVER-MINOR) async_hooks: add trackPromises option to createHook() (Joyee Cheung) #61415
- [4cf94fae17] - (SEMVER-MINOR) net: add setTOS and getTOS to Socket (Amol Yadav) #61503
- [dce657071e] - (SEMVER-MINOR) src: add initial support for ESM in embedder API (Joyee Cheung) #61548
- [e62608bbcf] - src: improve TextEncoder encode performance with simdutf (Mert Can Altin) #61496
- [93938a4738] - (SEMVER-MINOR) stream: add bytes() method to node:stream/consumers (wantaek) #60426
- [5fe2582329] - (SEMVER-MINOR) test_runner: add env option to run function (Ethan Arrowood) #61367
- [a181d0c43d] - url: update Ada to v3.4.2 and support Unicode 17 (Yagiz Nizipli) #61593
Commits
- [9c8d1b0278] - assert: fix loose deepEqual arrays with undefined and null failing (Ruben Bridgewater) #61587
- [796ff46ae6] - (SEMVER-MINOR) async_hooks: add trackPromises option to createHook() (Joyee Cheung) #61415
- [d23ee89693] - benchmark: add streaming TextDecoder benchmark (Сковорода Никита Андреевич) #61549
- [8759db9d21] - buffer: disallow ArrayBuffer transfer on pooled buffer (Chengzhong Wu) #61372
- [b2fb82946b] - build: add --shared-lief configure flag (Antoine du Hamel) #61536
- [0ef99de9da] - build: aix: deoptimize implementation-visitor.cc with --shared (Stewart X Addison) #61550
- [8f2083e73a] - build: enable -DV8_ENABLE_CHECKS flag (Ryuhei Shima) #61327
- [150910da70] - build,test: add tests for binary linked with shared libnode (Joyee Cheung) #61463
- [fb7868ba98] - build,win: fix vs2022 compilation (Stefan Stojanovic) #61530
- [2c39a9234c] - deps: update undici to 7.19.2 (Node.js GitHub Bot) #61566
- [2a74379367] - deps: update archs files for openssl-3.5.5 (Node.js GitHub Bot) #61547
- [9e26a15c29] - deps: upgrade openssl sources to openssl-3.5.5 (Node.js GitHub Bot) #61547
- [f16b532e97] - deps: update corepack to 0.34.6 (Node.js GitHub Bot) #61510
- [780e65c5c5] - deps: V8: cherry-pick c5ff7c4d6cde (Chengzhong Wu) #61372
- [2eb8e9d760] - deps: update nghttp3 to 1.15.0 (Node.js GitHub Bot) #61512
- [a999edd8fd] - deps: update ngtcp2 to 1.20.0 (Node.js GitHub Bot) #61511
- [eedd3bb6b6] - deps: update undici to 7.19.1 (Node.js GitHub Bot) #61514
- [7d2bd59984] - deps: update undici to 7.19.0 (Node.js GitHub Bot) #61470
- [3ad4d9b11b] - doc: align Buffer.concat documentation with behavior (Gürgün Dayıoğlu) #60405
- [7e3eab5963] - doc: fix node-config-schema (Сковорода Никита Андреевич) #61596
- [cbcfaf9a35] - doc: update IBM/Red Hat volunteers with dedicated project time (Beth Griggs) #61588
- [3d68811d1a] - doc: regenerate node.1 using doc-kit (Aviv Keller) #61535
- [71702c581a] - doc: restore @ChALkeR to collaborators (Сковорода Никита Андреевич) #61553
- [0ceb8cad59] - doc: added requestOCSP option to tls.connect (ikeyan) #61064
- [da93e2178c] - doc: move Security-Team from TSC to SECURITY (Rafael Gonzaga) #61495
- [4bea821b4c] - lib: use utf8 fast path for streaming TextDecoder (Сковорода Никита Андреевич) #61549
- [f05bad91d8] - lib: recycle queues (Robert Nagy) #61461
- [44b1927938] - lib: use StringPrototypeStartsWith from primordials in locks (Taejin Kim) #61492
- [a78259828a] - lib: unify ICU and no-ICU TextDecoder (Сковорода Никита Андреевич) #61409
- [a28ddd4594] - module: do not wrap module._load when tracing is not enabled (Joyee Cheung) #61479
- [4cf94fae17] - (SEMVER-MINOR) net: add setTOS and getTOS to Socket (Amol Yadav) #61503
- [b861451d57] - process: do not truncate long strings in --print (Mohamed Akram) #61497
- [4a2e184753] - sea: print error information when fs operations fail (Joyee Cheung) #61581
- [45d25c47da] - sqlite: change approach to fix segfault SQLTagStore (Bart Louwers) #60462
- [6993386320] - sqlite: reserve vectors space (Guilherme Araújo) #61540
- [dce657071e] - (SEMVER-MINOR) src: add initial support for ESM in embedder API (Joyee Cheung) #61548
- [e62608bbcf] - src: improve textEncoder encode performance with simdutf (Mert Can Altin) #61496
- [0fce52d22c] - src: expose 

This is a security release.
Notable Changes
lib:
- (CVE-2025-59465) add TLSSocket default error handler (RafaelGSS) https://github.com/nodejs-private/node-private/pull/750
permission:
- (CVE-2026-21636) add network check on pipe_wrap connect (RafaelGSS) https://github.com/nodejs-private/node-private/pull/784
- (CVE-2025-55130) require full read and write to symlink APIs (RafaelGSS) https://github.com/nodejs-private/node-private/pull/760
- (CVE-2025-55132) disable futimes when permission model is enabled (RafaelGSS) https://github.com/nodejs-private/node-private/pull/748
src:
- (CVE-2025-59466) rethrow stack overflow exceptions in async_hooks (Matteo Collina) https://github.com/nodejs-private/node-private/pull/773
src,lib:
- (CVE-2025-55131) refactor unsafe buffer creation to remove zero-fill toggle (Сковорода Никита Андреевич) https://github.com/nodejs-private/node-private/pull/759
tls:
- (CVE-2026-21637) route callback exceptions through error handlers (Matteo Collina) https://github.com/nodejs-private/node-private/pull/790
Commits
- [a6a74b89a7] - deps: update c-ares to v1.34.6 (Node.js GitHub Bot) #60997
- [5100614e26] - deps: update undici to 7.18.2 (Node.js GitHub Bot) #61283
- [f0a8916887] - (CVE-2025-59465) lib: add TLSSocket default error handler (RafaelGSS) nodejs-private/node-private#750
- [b4b887c5f7] - (CVE-2025-55132) lib: disable futimes when permission model is enabled (RafaelGSS) nodejs-private/node-private#748
- [26be208039] - (CVE-2025-55130) lib,permission: require full read and write to symlink APIs (RafaelGSS) nodejs-private/node-private#760
- [bdf5873d44] - (CVE-2026-21636) permission: add network check on pipe_wrap connect (RafaelGSS) nodejs-private/node-private#784
- [0578e3e921] - (CVE-2025-59466) src: rethrow stack overflow exceptions in async_hooks (Matteo Collina) nodejs-private/node-private#773
- [4d6b55a6d1] - (CVE-2025-55131) src,lib: refactor unsafe buffer creation to remove zero-fill toggle (Сковорода Никита Андреевич) nodejs-private/node-private#759
- [c357a39e14] - (CVE-2026-21637) tls: route callback exceptions through error handlers (Matteo Collina) nodejs-private/node-private#790

This release reverts the spec-compliant behavior of sometimes throwing on localStorage
access. We received feedback that this change on an experimental API was too breaking
for a semver-minor release, so we decided to push it back for Node.js 26.0.0.
Commits
- [ff89b7b6c7] - crypto: ensure documented RSA-PSS saltLength default is used (Filip Skokan) #60662
- [5316b580eb] - deps: V8: backport 2e4c5cf9b112 (Michaël Zasso) #60654
- [ca878bc90e] - doc,src,lib: clarify experimental status of Web Storage support (Antoine du Hamel) #60708
- [a4dee613fd] - Revert "lib: throw from localStorage getter on missing storage path" (Antoine du Hamel) #60750

Notable Changes
- [9b043a9096] - (SEMVER-MINOR) http: add shouldUpgradeCallback to let servers control HTTP upgrades (Tim Perry) #59824
- [a6456ab90a] - (SEMVER-MINOR) sqlite: cleanup ERM support and export Session class (James M Snell) #58378
- [5563361d22] - (SEMVER-MINOR) sqlite: add tagged template (0hm☘️) #58748
- [04013ee933] - (SEMVER-MINOR) worker: add heap profile API (theanarkh) #59846
Commits
- [cbec4fd6de] - benchmark: calibrate config dgram multi-buffer (Bruno Rodrigues) #59696
- [9a4bbdc3c5] - benchmark: calibrate config cluster/echo.js (Nam Yooseong) #59836
- [0b284d86e8] - build: add the missing macro definitions for OpenHarmony (hqzing) #59804
- [43e6e54d66] - build: do not include custom ESLint rules testing in tarball (Antoine du Hamel) #59809
- [039ac19154] - crypto: expose signatureAlgorithm on X509Certificate (Patrick Costa) #59235
- [647c332704] - crypto: use return await when returning Promises from async functions (Renegade334) #59841
- [8ed4587cf0] - crypto: use async functions for non-stub Promise-returning functions (Renegade334) #59841
- [bb051c56ef] - crypto: avoid calls to promise.catch() (Renegade334) #59841
- [05e560dd25] - deps: update googletest to 50b8600 (Node.js GitHub Bot) #59955
- [fa40d3a785] - deps: update archs files for openssl-3.5.3 (Node.js GitHub Bot) #59901
- [8c85570d18] - deps: upgrade openssl sources to openssl-3.5.3 (Node.js GitHub Bot) #59901
- [b71125664e] - deps: update undici to 7.16.0 (Node.js GitHub Bot) #59830
- [dea5dd7077] - dgram: restore buffer optimization in fixBufferList (Yoo) #59934
- [b0c1e67532] - diagnostics_channel: fix race condition with diagnostics_channel and GC (Ugaitz Urien) #59910
- [0b37b594c3] - doc: use "WebAssembly" instead of "Web Assembly" (Tobias Nießen) #59954
- [1e723f9c6b] - doc: fix typo in section on microtask order (Tobias Nießen) #59932
- [a28962a85c] - doc: update V8 fast API guidance (René) #58999
- [bd767c5d1b] - doc: add security escalation policy (Ulises Gascón) #59806
- [9df91e59e1] - doc: type improvement of file http.md (yusheng chen) #58189
- [e4f571680b] - doc: deprecate closing fs.Dir on garbage collection (Livia Medeiros) #59839
- [e9cb986fa5] - doc: rephrase dynamic import() description (Nam Yooseong) #59224
- [026d4e33f7] - doc,crypto: update subtle.generateKey and subtle.importKey (Filip Skokan) #59851
- [2b2591db52] - esm: make hasAsyncGraph non-enumerable (Joyee Cheung) #59905
- [993f05d323] - fs,win: do not add a second trailing slash in readdir (Gerhard Stöbich) #59847
- [7aec53b607] - (SEMVER-MINOR) http: add shouldUpgradeCallback to let servers control HTTP upgrades (Tim Perry) #59824
- [83ae6102e7] - http: optimize checkIsHttpToken for short strings (방진혁) #59832
- [6695067636] - http,https: handle IPv6 with proxies (Joyee Cheung) #59894
- [c5d910a0a9] - http2: fix allowHttp1+Upgrade, broken by shouldUpgradeCallback (Tim Perry) #59924
- [acada1fb82] - inspector: ensure adequate memory allocation for Binary::toBase64 (René) #59870
- [396cc8ec65] - lib: update inspect output format for subclasses (Miguel Marcondes Filho) #59687
- [fed1dac8de] - lib: update isDeepStrictEqual to support options (Miguel Marcondes Filho) #59762
- [d785929fd7] - lib: add source map support for assert messages (Chengzhong Wu) #59751
- [ff13d1d61e] - lib,src: cache ModuleWrap.hasAsyncGraph (Chengzhong Wu) #59703
- [b200cd8470] - lib,src: refactor assert to load error source from memory (Chengzhong Wu) #59751
- [e94c57301b] - meta: add .npmrc with ignore-scripts=true (Joyee Cheung) #59914
- [728472a57b] - module: only put directly require-d ESM into require.cache (Joyee Cheung) #59874
- [be48760b93] - node-api: added SharedArrayBuffer api (Mert Can Altin) #59071
- [f006a14522] - node-api: make napi_delete_reference use node_api_basic_env (Jeetu Suthar) #59684
- [0f46c1c3b0] - repl: fix cpu overhead pasting big strings to the REPL (Ruben Bridgewater) #59857
- [3eeb7b47ea] - sqlite: fix crash session extension callbacks with workers (Bart Louwe

Notable Changes
- [471fe712b3] - (SEMVER-MINOR) cli: add NODE_USE_SYSTEM_CA=1 (Joyee Cheung) #59276
- [38aedfbf73] - (SEMVER-MINOR) crypto: support ML-DSA KeyObject, sign, and verify (Filip Skokan) #59259
- [201304537e] - (SEMVER-MINOR) zlib: add dictionary support to zstdCompress and zstdDecompress (lluisemper) #59240
- [e79c93a5d0] - (SEMVER-MINOR) http: add server.keepAliveTimeoutBuffer option (Haram Jeong) #59243
- [c144d69efc] - lib: docs deprecate _http_* (Sebastian Beltran) #59293
- [aeb4de55a7] - (SEMVER-MINOR) fs: port SonicBoom module to fs module as Utf8Stream (James M Snell) #58897
Commits
- [f7484575ff] - assert: change utils to use index instead of for...of (방진혁) #59278
- [269cd16185] - benchmark: remove deprecated _extend from benchmark (Rafael Gonzaga) #59228
- [848e49c20b] - benchmark: add fs warmup to writefile-promises (Bruno Rodrigues) #59215
- [8c609be1b1] - benchmark: add calibrate-n script (Rafael Gonzaga) #59186
- [6a3bf772d8] - build: fix node_use_sqlite for GN builds (Shelley Vohr) #59017
- [471fe712b3] - (SEMVER-MINOR) cli: add NODE_USE_SYSTEM_CA=1 (Joyee Cheung) #59276
- [38aedfbf73] - (SEMVER-MINOR) crypto: support ML-DSA KeyObject, sign, and verify (Filip Skokan) #59259
- [a312e706cf] - crypto: prepare webcrypto key import/export for modern algorithms (Filip Skokan) #59284
- [3a7c2c3a47] - deps: update ada to 3.2.7 (Node.js GitHub Bot) #59336
- [8d9ceeaf6a] - deps: update archs files for openssl-3.5.2 (Node.js GitHub Bot) #59371
- [33b06df354] - deps: upgrade openssl sources to openssl-3.5.2 (Node.js GitHub Bot) #59371
- [fa70f1af77] - deps: support madvise(3C) across ALL illumos revisions (Dan McDonald) #58237
- [f834a6be59] - deps: update undici to 7.13.0 (Node.js GitHub Bot) #59338
- [db2417487e] - deps: update sqlite to 3.50.4 (Node.js GitHub Bot) #59337
- [41978adb08] - deps: V8: backport 493cb53691be (Chengzhong Wu) #59238
- [05667991ca] - deps: V8: backport 1c3e018e7d48 (Renegade334) #58818
- [fd61588bb4] - doc: rename x509.extKeyUsage to x509.keyUsage (Filip Skokan) #59332
- [a271ae4360] - doc: fix Pbkdf2Params hash attribute heading (Filip Skokan) #59395
- [72cfff165b] - doc: fix missing reference links for server.keepAliveTimeoutBuffer (Lee Jiho) #59356
- [8341916772] - doc: fix grammar in global dispatcher usage (Eng Zer Jun) #59344
- [e3e489706b] - doc: run license-builder (github-actions[bot]) #59343
- [46527e8cea] - doc: correct orthography eg. → e.g. (Jacob Smith) #59329
- [d140c3713e] - doc: clarify the need of compiler compatible with c++20 (Rafael Gonzaga) #59297
- [95e9cabf9d] - doc: clarify release candidate stability index (Filip Skokan) #59295
- [a056dd36d2] - doc: add WDYT to glossary (btea) #59280
- [1e2c52f5c4] - doc: add manpage entry for --use-system-ca (Joyee Cheung) #59273
- [31a46fdeb4] - doc: add path.join and path.normalize clarification (Rafael Gonzaga) #59262
- [cff3725ff9] - doc: fix typo in test/common/README.md (Yoo) #59180
- [31a9283591] - doc: add note on process memoryUsage (fengmk2) #59026
- [5a98bff6b8] - doc: format safely for doc-kit (Aviv Keller) #59229
- [95b8b7ea5c] - domain: remove deprecated API call (Alex Yang) #59339
- [2990f178bd] - fs: fix glob TypeError on restricted dirs (Sylphy-0xd3ac) #58674
- [e2fb4caf9c] - fs: correct error message when FileHandle is transferred (Alex Yang) #59156
- [aeb4de55a7] - (SEMVER-MINOR) fs: port SonicBoom module to fs module as Utf8Stream (James M Snell) #58897
- [e79c93a5d0] - (SEMVER-MINOR) http: add server.keepAliveTimeoutBuffer option (Haram Jeong) #59243
- [0fb005a53f] - http2: set Http2Stream#sentHeaders for raw headers (Darshan Sen) #59244
- [e055539604] - lib: add trace-sigint APIs (theanarkh) #59040
- [d2183d860a] - lib: optimize writable stream buffer clearing (Yoo) #59406
- [47543a7e17] - lib: handle windows reserved device names on UNC (Rafael Gonzaga) #59286
- [c6911f0717] - lib: do not modify prototype deprecated asyncResource (RafaelGSS) #59195
- [3c88b769bb] - lib: restructure assert to become a cl

This is a security release.
Notable Changes
- (CVE-2025-27209) HashDoS in V8 with new RapidHash algorithm
- (CVE-2025-27210) Windows Device Names (CON, PRN, AUX) Bypass Path Traversal Protection in path.normalize()
Commits
- [c33223f1a5] - (CVE-2025-27209) deps: V8: revert rapidhash commits (Michaël Zasso) nodejs-private/node-private#713
- [56f9db2aaa] - (CVE-2025-27210) lib: handle all windows reserved driver name (RafaelGSS) nodejs-private/node-private#721

Notable Changes
- [22b60e8a57] - (SEMVER-MINOR) crypto: support outputLength option in crypto.hash for XOF functions (Aditi) #58121
- [80dec9849d] - (SEMVER-MINOR) doc: add all watch-mode related flags to node.1 (Dario Piotrowicz) #58719
- [87f4d078b3] - (SEMVER-MINOR) fs: add disposable mkdtempSync (Kevin Gibbons) #58516
- [9623c50b53] - (SEMVER-MINOR) permission: propagate permission model flags on spawn (Rafael Gonzaga) #58853
- [797ec4da04] - (SEMVER-MINOR) sqlite: add support for readBigInts option in db connection level (Miguel Marcondes Filho) #58697
- [ed966a0215] - (SEMVER-MINOR) src,permission: add support to permission.has(addon) (Rafael Gonzaga) #58951
- [fe17f5d285] - (SEMVER-MINOR) watch: add --watch-kill-signal flag (Dario Piotrowicz) #58719
Commits
- [a118bfc536] - assert: remove dead code (Yoshiya Hinosawa) #58760
- [31252b9af1] - benchmark: add source map and source map cache (Miguel Marcondes Filho) #58125
- [4170359bcd] - bootstrap: initialize http proxy after user module loader setup (Joyee Cheung) #58938
- [c76585d10e] - build: disable v8_enable_pointer_compression_shared_cage on non-64bit (Shelley Vohr) #58867
- [049c838609] - build: option to use custom inspector_protocol path (Shelley Vohr) #58839
- [22b60e8a57] - (SEMVER-MINOR) crypto: support outputLength option in crypto.hash for XOF functions (Aditi) #58121
- [77712ae2a1] - crypto: fix SHAKE128/256 breaking change introduced with OpenSSL 3.4 (Filip Skokan) #58942
- [93e1a33b81] - crypto: fix inclusion of OPENSSL_IS_BORINGSSL define (Shelley Vohr) #58845
- [573171deb0] - deps: V8: cherry-pick 0ce2edb7adfd (Levi Zim) #58773
- [bf66291382] - deps: V8: cherry-pick 1d7159580156 (Michaël Zasso) #58749
- [f735b8b8d0] - deps: update sqlite to 3.50.2 (Node.js GitHub Bot) #58882
- [8e9622e494] - deps: update undici to 7.11.0 (Node.js GitHub Bot) #58859
- [8741da81c7] - deps: update googletest to 35b75a2 (Node.js GitHub Bot) #58710
- [028ce40e25] - deps: update minimatch to 10.0.3 (Node.js GitHub Bot) #58712
- [3afb15b715] - dns: fix parse memory leaky (theanarkh) #58973
- [f40ac32f3e] - dns: set timeout to 1000ms when timeout < 0 (theanarkh) #58441
- [921b563999] - doc: remove broken link to permission model source code (Juan José) #58972
- [78628d6158] - doc: clarify details of TSC public and private meetings (James M Snell) #58925
- [ab834a8b94] - doc: mark stability markers consistent in globals.md (Antoine du Hamel) #58932
- [8d4f6a0016] - doc: move "Core Promise APIs" to "Completed initiatives" (Antoine du Hamel) #58934
- [94725fced5] - doc: fix fetch subsections in globals.md (Antoine du Hamel) #58933
- [a7a4870014] - doc: add missing Class: mentions (Antoine du Hamel) #58931
- [98f29fa2fd] - doc: remove myself from security steward rotation (Michael Dawson) #58927
- [710e13d436] - doc: add ovflowd back to core collaborators (Claudio W.) #58911
- [8b93008dc0] - doc: update email address for Richard Lau (Richard Lau) #58910
- [9ff81d21ed] - doc: update vm doc links (Chengzhong Wu) #58885
- [ff2efd266d] - doc: fix links in test.md (Vas Sudanagunta) #58876
- [5e854e1f61] - doc: add missing comma in child_process.md (ronijames008) #58862
- [48f5d6d686] - doc: add guidelines for introduction of ERM support (James M Snell) #58526
- [80dec9849d] - (SEMVER-MINOR) doc: add all watch-mode related flags to node.1 (Dario Piotrowicz) #58719
- [b36fa0fda1] - doc: fix jsdoc definition of assert.ifError() fn in lib/assert.js (jesh) #58573
- [cebb93ea12] - doc: add array type in http request headers (Michael Henrique) #58049
- [6e6b373da1] - doc: add missing colon to headers in globals.md (Aviv Keller) #58825
- [1519b75191] - doc: fix stream.md section order (Antoine du Hamel) #58811
- [87f4d078b3] - (SEMVER-MINOR) fs: add disposable mkdtempSync (Kevin Gibbons) #58516
- [b378fc3ac0] - fs: close dir before throwing if options.bufferSize is invalid (Livia Medeiros) #58856
- [23bd4d1867] - fs: special input -1 on chown, lchown and fchown (Alex Yang) #58836
- [d07ce8e90c] 

Notable Changes
- [841609ac1c] - doc: add islandryu to collaborators (Shima Ryuhei) #58714
- [839964ece8] - (SEMVER-MINOR) fs: allow correct handling of burst in fs-events with AsyncIterator (Philipp Dunkel) #58490
- [9b28f40834] - (SEMVER-MINOR) module: remove experimental warning from type stripping (Marco Ippolito) #58643
- [7cdda927fa] - test: fix test-timeout-flag after revert of auto subtest wait (Pietro Marchini) #58282
- [dce1995c55] - Revert "test_runner: remove promises returned by t.test()" (Romain Menke) #58282
- [8b0c5edbb6] - Revert "test_runner: remove promises returned by test()" (Romain Menke) #58282
- [713fbad7b6] - (SEMVER-MINOR) test_runner: support object property mocking (Idan Goshen) #58438
- [ef0230abaf] - (SEMVER-MINOR) url: add fileURLToPathBuffer API (James M Snell) #58700
Commits
- [2ba2c93dee] - build: fix typo 'Stoage' to 'Storage' in help text (ganglike) #58777
- [11811c15da] - deps: update nghttp2 to 1.66.0 (Node.js GitHub Bot) #58786
- [7643ce9322] - deps: update acorn to 8.15.0 (Node.js GitHub Bot) #58711
- [4b61f10eb6] - deps: V8: cherry-pick e3df60f3f5ab (Chengzhong Wu) #58691
- [fa6854f083] - deps: update amaro to 1.1.0 (Node.js GitHub Bot) #58754
- [68671f4314] - deps: upgrade npm to 11.4.2 (npm team) #58696
- [450f4815b3] - deps: update amaro to 1.0.0 (Node.js GitHub Bot) #58639
- [3aa2762e96] - deps: update sqlite to 3.50.1 (Node.js GitHub Bot) #58630
- [80eac147e6] - deps: update simdjson to 3.13.0 (Node.js GitHub Bot) #58629
- [dc1023878c] - deps: update zlib to 1.3.1-470d3a2 (Node.js GitHub Bot) #58628
- [97fbfd82af] - doc: fix stability 1.x links excluding the decimal digit (Dario Piotrowicz) #58783
- [e2e88d4971] - doc: fix wrong RFC number in http2 (Deokjin Kim) #58753
- [7bb1246c8f] - doc: add history entry for TS support in hooks (Antoine du Hamel) #58732
- [f125310d3a] - doc: run license-builder (github-actions[bot]) #58722
- [841609ac1c] - doc: add islandryu to collaborators (Shima Ryuhei) #58714
- [1cc77c7ee6] - doc: punctuation fix for Node-API versioning clarification (Jiacai Liu) #58599
- [d59680348e] - doc: add path rules and validation for export targets in package.json (0hm☘️) #58604
- [b6760b3379] - esm: syncify default path of ModuleLoader.load (Jacob Smith) #57419
- [96c78d726c] - fs: make Dir disposers idempotent (René) #58692
- [62b5879d88] - fs: avoid computing time coefficient constants in runtime (Livia Medeiros) #58728
- [af18c0e81a] - fs: remove IIFE in glob (LiviaMedeiros) #58418
- [fb4378b72e] - fs: add UV_ENOSPC to list of things to pass to err directly (Jacky Zhao) #56918
- [839964ece8] - (SEMVER-MINOR) fs: allow correct handling of burst in fs-events with AsyncIterator (Philipp Dunkel) #58490
- [c9dc0a8903] - http: fix keep-alive not timing out after post-request empty line (Shima Ryuhei) #58178
- [b11da1115e] - http2: fix DEP0194 message (KaKa) #58669
- [b1f60d2f18] - http2: add diagnostics channel 'http2.server.stream.close' (Darshan Sen) #58602
- [be93091694] - inspector: add protocol methods retrieving sent/received data (Chengzhong Wu) #58645
- [20089e2a2e] - lib: rename validateInternalField into validateThisInternalField (LiviaMedeiros) #58765
- [74983832f9] - lib: make validateInternalField() throw ERR_INVALID_THIS (LiviaMedeiros) #58765
- [081c70878f] - lib: make domexception a native error (Chengzhong Wu) #58691
- [6390f70da2] - lib,src: support DOMException ser-des (Chengzhong Wu) #58649
- [4c2c100f63] - meta: add @nodejs/inspector as codeowner (Chengzhong Wu) #58790
- [ff8a3691c4] - module: fix typescript import.meta.main (Marco Ippolito) #58661
- [45f7d160ed] - module: refactor commonjs typescript loader (Marco Ippolito) #58657
- [9b28f40834] - (SEMVER-MINOR) module: remove experimental warning from type stripping (Marco Ippolito) #58643
- [a3c7a63c73] - module: allow cycles in require() in the CJS handling in ESM loader (Joyee Cheung) #58598
- [d0e42ffa58] - repl: avoid deprecated require.extensions in tab completion (baki gul) #58653
- [82b1

Notable Changes
- [9d35b4ce95] - doc: add JonasBa to collaborators (Jonas Badalic) #58355
- [b7d1bfa7b4] - doc: add puskin to collaborators (Giovanni Bucci) #58308
- [fcead7c28e] - (SEMVER-MINOR) fs: add to Dir support for explicit resource management (Antoine du Hamel) #58206
- [f7041b9369] - Revert "test_runner: change ts default glob" (Théo LUDWIG) #58202
Commits
- [b33e8d2a71] - async_hooks: ensure AsyncLocalStore instances work isolated (Gerhard Stöbich) #58149
- [a1b078b18c] - buffer: give names to Buffer.prototype.*Write() functions (Livia Medeiros) #58258
- [4c967b73c3] - buffer: use constexpr where possible (Yagiz Nizipli) #58141
- [327095a928] - build: fix uvwasi pkgname (Antoine du Hamel) #58270
- [2e54653d3d] - build: use FILE_OFFSET_BITS=64 esp. on 32-bit arch (RafaelGSS) #58090
- [7e4453fe93] - build: escape > metachar in vcbuild (Gerhard Stöbich) #58157
- [7dabf079b1] - child_process: give names to promisified exec() and execFile() (LiviaMedeiros) #57916
- [a896eff1f2] - crypto: handle missing OPENSSL_TLS_SECURITY_LEVEL (Shelley Vohr) #58103
- [6403aa458f] - crypto: merge CipherBase.initiv into constructor (Tobias Nießen) #58166
- [30897d915c] - deps: V8: backport 1d3362c55396 (Shu-yu Guo) #58230
- [63f5d69d2b] - deps: V8: cherry-pick 4f38995c8295 (Shu-yu Guo) #58230
- [5a5f6bb1d4] - deps: V8: cherry-pick 044b9b6f589d (Rezvan Mahdavi Hezaveh) #58230
- [db57f0a4c0] - deps: patch V8 to 13.6.233.10 (Michaël Zasso) #58230
- [f54a7a44ab] - Revert "deps: patch V8 to support compilation with MSVC" (Michaël Zasso) #58187
- [e3193eeca4] - Revert "deps: always define V8_EXPORT_PRIVATE as no-op" (Michaël Zasso) #58187
- [e75ecf8ad1] - Revert "deps: disable V8 concurrent sparkplug compilation" (Michaël Zasso) #58187
- [a0ca15558d] - deps: update llhttp to 9.3.0 (Fedor Indutny) #58144
- [90d4c11992] - deps: update amaro to 0.5.3 (Node.js GitHub Bot) #58174
- [9d35b4ce95] - doc: add JonasBa to collaborators (Jonas Badalic) #58355
- [2676ca0cf5] - doc: add latest security release steward (Rafael Gonzaga) #58339
- [c35cc1bdd9] - doc: document default test-reporter change (Nico Jansen) #58302
- [2bb433d4a5] - doc: fix CryptoKey.algorithm type and other interfaces in webcrypto.md (Filip Skokan) #58294
- [f04f09d783] - doc: mark the callback argument of crypto.generatePrime as mandatory (Allon Murienik) #58299
- [3b9b010844] - doc: remove comma delimiter mention on permissions doc (Rafael Gonzaga) #58297
- [f0cf1a028d] - doc: make Stability labels not sticky in Stability index (Livia Medeiros) #58291
- [a1b937bdee] - doc: update commit-queue documentation (Dario Piotrowicz) #58275
- [b7d1bfa7b4] - doc: add puskin to collaborators (Giovanni Bucci) #58308
- [fc30cdd8d2] - doc: update stability status for diagnostics_channel to experimental (Idan Goshen) #58261
- [290a5ab8ca] - doc: clarify napi_get_value_string_* for bufsize 0 (Tobias Nießen) #58158
- [c26863a683] - doc: fix typo of file http.md, outgoingMessage.setTimeout section (yusheng chen) #58188
- [62dbd36dcb] - doc: update return types for eventNames method in EventEmitter (Yukihiro Hasegawa) #58083
- [130c135f38] - fs: add support for URL for fs.glob's cwd option (Antoine du Hamel) #58182
- [fcead7c28e] - (SEMVER-MINOR) fs: add to Dir support for explicit resource management (Antoine du Hamel) #58206
- [655326ba9f] - fs: glob is stable, so should not emit experimental warnings (Théo LUDWIG) #58236
- [6ebcce7625] - fs: ensure dir.read() does not throw synchronously (Antoine du Hamel) #58228
- [7715722323] - http: remove unused functions and add todos (Yagiz Nizipli) #58143
- [74a807e31f] - http,https: give names to anonymous or misnamed functions (Livia Medeiros) #58180
- [24a9aefb08] - http2: add diagnostics channel 'http2.client.stream.start' (Darshan Sen) #58292
- [2cb86a3cd6] - http2: add diagnostics channel 'http2.client.stream.created' (Darshan Sen) #58246
- [8f1aee90d9] - http2: give name to promisified connect() (LiviaMedeiros) #57916
- [b66f1b0be6] - inspector: supp