Repository navigation
2026-10-14, Version 26.12.0 (Current) - #66684
Open
github-actions[bot] wants to merge 106 commits into
Open
github-actions[bot] wants to merge 106 commits into
github-actions[bot] wants to merge 106 commits into
Conversation
Signed-off-by: Antoine du Hamel <duhamelantoine1995@gmail.com> PR-URL: #66626 Reviewed-By: Ulises Gascón <ulisesgascongonzalez@gmail.com> Reviewed-By: Richard Lau <richard.lau@ibm.com>
Backport the Maglev HeapNumber materialization fix to V8 14.6.
Use the existing offset constants and virtual-object slot traversal.
Original commit message:
[maglev] Materialize a fresh HeapNumber per deoptimization
This matches what Turbolev graph builder already does to Maglev.
Fixed: 547819997
Change-Id: Iafc1185ef96db8816db36b295a3a4b7e528f9863
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/8255554
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Victor Gomes <victorgomes@chromium.org>
Cr-Commit-Position: refs/heads/main@{#109347}
Refs: v8/v8@7d5eb1d
Refs: #66457
Refs: https://www.cve.org/CVERecord?id=CVE-2026-85045
Signed-off-by: inoway46 <inoueyuya416@gmail.com>
Assisted-by: Codex
PR-URL: #66566
Reviewed-By: Richard Lau <richard.lau@ibm.com>
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
The typed array Blob constructor tests expect little-endian byte order. Mark them as expected failures only on big-endian platforms, so failures on little-endian platforms remain visible. Signed-off-by: Filip Skokan <panva.ip@gmail.com> Assisted-by: Claude, Codex PR-URL: #66322 Reviewed-By: Daeyeon Jeong <daeyeon.dev@gmail.com>
Honor allow_uncaught_exception for unhandled promise rejections in both WPT worker paths. Apply setup settings before nested callbacks, preserve settings after results start, and apply promise_setup settings when its callback runs. Keep rejection failures in single_test mode. Cover both runner backends and Web Workers, and remove the flaky expectation for the Web Locks test that deliberately rejects. Refs: #59142 Signed-off-by: Filip Skokan <panva.ip@gmail.com> Assisted-by: Claude, Codex PR-URL: #66322 Reviewed-By: Daeyeon Jeong <daeyeon.dev@gmail.com>
This test was skipped after hangs with V8 11.2. The associated compiler shutdown deadlock involved NodePlatform::DrainTasks waiting for worker tasks that needed garbage collection on the blocked main thread. Since 5fb879c, DrainTasks only waits for user-blocking tasks, which excludes ordinary background compilation. Remove the obsolete skip. Refs: #47297 Signed-off-by: Filip Skokan <panva.ip@gmail.com> Assisted-by: Claude, Codex PR-URL: #66322 Reviewed-By: Daeyeon Jeong <daeyeon.dev@gmail.com>
Bumps [codecov/codecov-action](https://github.com/codecov/codecov-action) from 7.1.0 to 7.1.1. - [Release notes](https://github.com/codecov/codecov-action/releases) - [Changelog](https://github.com/codecov/codecov-action/blob/main/CHANGELOG.md) - [Commits](codecov/codecov-action@0b35c9e...303a32d) --- updated-dependencies: - dependency-name: codecov/codecov-action dependency-version: 7.1.1 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> PR-URL: #66448 Reviewed-By: Colin Ihrig <cjihrig@gmail.com> Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Bumps the eslint group in /tools/eslint with 5 updates: | Package | From | To | | --- | --- | --- | | [@babel/core](https://github.com/babel/babel/tree/HEAD/packages/babel-core) | `8.0.5` | `8.0.6` | | [@babel/eslint-parser](https://github.com/babel/babel/tree/HEAD/eslint/babel-eslint-parser) | `8.0.5` | `8.0.6` | | [eslint](https://github.com/eslint/eslint) | `10.10.0` | `10.11.0` | | [eslint-plugin-jsdoc](https://github.com/gajus/eslint-plugin-jsdoc) | `64.3.10` | `64.5.4` | | [eslint-plugin-regexp](https://github.com/ota-meshi/eslint-plugin-regexp) | `3.3.0` | `3.3.1` | Updates `@babel/core` from 8.0.5 to 8.0.6 - [Release notes](https://github.com/babel/babel/releases) - [Changelog](https://github.com/babel/babel/blob/main/CHANGELOG.md) - [Commits](https://github.com/babel/babel/commits/v8.0.6/packages/babel-core) Updates `@babel/eslint-parser` from 8.0.5 to 8.0.6 - [Release notes](https://github.com/babel/babel/releases) - [Changelog](https://github.com/babel/babel/blob/main/CHANGELOG.md) - [Commits](https://github.com/babel/babel/commits/v8.0.6/eslint/babel-eslint-parser) Updates `eslint` from 10.10.0 to 10.11.0 - [Release notes](https://github.com/eslint/eslint/releases) - [Commits](eslint/eslint@v10.10.0...v10.11.0) Updates `eslint-plugin-jsdoc` from 64.3.10 to 64.5.4 - [Release notes](https://github.com/gajus/eslint-plugin-jsdoc/releases) - [Commits](gajus/eslint-plugin-jsdoc@v64.3.10...v64.5.4) Updates `eslint-plugin-regexp` from 3.3.0 to 3.3.1 - [Release notes](https://github.com/ota-meshi/eslint-plugin-regexp/releases) - [Changelog](https://github.com/ota-meshi/eslint-plugin-regexp/blob/master/CHANGELOG.md) - [Commits](ota-meshi/eslint-plugin-regexp@v3.3.0...v3.3.1) --- updated-dependencies: - dependency-name: "@babel/core" dependency-version: 8.0.6 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: eslint - dependency-name: "@babel/eslint-parser" dependency-version: 8.0.6 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: eslint - dependency-name: eslint dependency-version: 10.11.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: eslint - dependency-name: eslint-plugin-jsdoc dependency-version: 64.5.4 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: eslint - dependency-name: eslint-plugin-regexp dependency-version: 3.3.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: eslint ... Signed-off-by: dependabot[bot] <support@github.com> PR-URL: #66445 Reviewed-By: Luigi Pinca <luigipinca@gmail.com> Reviewed-By: René <contact.9a5d6388@renegade334.me.uk> Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
The fs.createReadStream(blockedFile) and fs.lstatSync(bufferBlockedFile) assertions were each present twice in the same block with identical arguments and expectations, so the second copy added no coverage. Signed-off-by: RafaelGSS <rafael.nunu@hotmail.com> PR-URL: #66450 Reviewed-By: Luigi Pinca <luigipinca@gmail.com> Reviewed-By: Filip Skokan <panva.ip@gmail.com>
`worker.isConnected()` and `worker.isDead()` described their boolean result only in prose, so the documentation tooling had no return type for them. Signed-off-by: Daniel Pinto <1619617+Cayan@users.noreply.github.com> Assisted-by: a frontier reasoning model PR-URL: #66453 Reviewed-By: René <contact.9a5d6388@renegade334.me.uk> Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Use isArrayBuffer() instead of comparing Object.prototype.toString() output. The old check depended on Symbol.toStringTag, so a real ArrayBuffer with a custom tag was rejected, and a plain object tagged 'ArrayBuffer' passed and failed later in native code with a misleading error. Signed-off-by: Trivikram Kamat <16024985+trivikr@users.noreply.github.com> Assisted-by: claude:opus-5.5 PR-URL: #66455 Fixes: #66454 Reviewed-By: René <contact.9a5d6388@renegade334.me.uk> Reviewed-By: Paolo Insogna <paolo@cowtech.it> Reviewed-By: Anna Henningsen <anna@addaleax.net>
The test and its benchmark subprocesses allocate large histograms. Run it sequentially to reduce memory pressure on constrained CI hosts. Signed-off-by: Filip Skokan <panva.ip@gmail.com> PR-URL: #66338 Reviewed-By: Chemi Atlow <chemi@atlow.co.il>
Remove ExperimentalWarning from algorithms and methods that are on their way to an unflagged browser implementation. Signed-off-by: Filip Skokan <panva.ip@gmail.com> PR-URL: #66312 Reviewed-By: James M Snell <jasnell@gmail.com>
Port the SonicBoom tests that could not be imported directly because they depend on the third-party proxyquire module, along with the maxWriteRetries option they exercise, into the Utf8Stream module. Adds maxWriteRetries support, which bounds consecutive EAGAIN/EBUSY retry attempts and resets the counter on forward progress, plus drop-event and flush-callback edge-case coverage. Fixes: #58955 Signed-off-by: Matteo Collina <hello@matteocollina.com> Assisted-by: pi PR-URL: #66275 Reviewed-By: Paolo Insogna <paolo@cowtech.it> Reviewed-By: James M Snell <jasnell@gmail.com>
Allow providers to be layered at one mount point. Reads search layers in priority order, while writes copy lower-layer files to the first provider and deletions hide lower copies without changing them. Assisted-by: pi Signed-off-by: Matteo Collina <hello@matteocollina.com> PR-URL: #66235 Reviewed-By: James M Snell <jasnell@gmail.com> Reviewed-By: Paolo Insogna <paolo@cowtech.it>
Signed-off-by: Marco Ippolito <marcoippolito54@gmail.com> PR-URL: #66431 Reviewed-By: Matteo Collina <matteo.collina@gmail.com> Reviewed-By: Colin Ihrig <cjihrig@gmail.com> Reviewed-By: Jacob Smith <jacob@frende.me> Reviewed-By: Edy Silva <edigleyssonsilva@gmail.com> Reviewed-By: James M Snell <jasnell@gmail.com> Reviewed-By: Pietro Marchini <pietro.marchini94@gmail.com>
Signed-off-by: Marco Ippolito <marcoippolito54@gmail.com> PR-URL: #66431 Reviewed-By: Matteo Collina <matteo.collina@gmail.com> Reviewed-By: Colin Ihrig <cjihrig@gmail.com> Reviewed-By: Jacob Smith <jacob@frende.me> Reviewed-By: Edy Silva <edigleyssonsilva@gmail.com> Reviewed-By: James M Snell <jasnell@gmail.com> Reviewed-By: Pietro Marchini <pietro.marchini94@gmail.com>
Add t.assert.called(), t.assert.callCount(), t.assert.nthCalledWith() and t.assert.lastCalledWith() for asserting on mock function calls. Assisted-by: Claude Signed-off-by: Guilherme Araújo <arauujogui@gmail.com> PR-URL: #66476 Reviewed-By: Chemi Atlow <chemi@atlow.co.il> Reviewed-By: James M Snell <jasnell@gmail.com>
Add websocketMask(source, mask, output[, offset[, length]]) and websocketUnmask(buffer, mask), which XOR data with a repeating 4-byte key. This is the masking that WebSocket clients apply to every frame they send (RFC 6455, Section 5.3), and that servers undo on every frame they receive. Userland WebSocket implementations do this either with a byte-by-byte JS loop (undici, and ws without optional dependencies) or with the bufferutil native addon. bufferutil is installed for only about 3% of ws downloads and has no linux-arm64 prebuild, so almost all users run the JS loop. The signature matches bufferutil, so existing users can switch with a feature check, as ws did for buffer.isUtf8(). The implementation uses a V8 fast API call and processes 8-byte words, which the compiler vectorizes. It handles overlapping source and output views, and treats every view type as raw bytes. It is about 20x faster than the JS loop at 1 KiB and 40x faster at 64 KiB, and faster than bufferutil at every size from 32 bytes up. Signed-off-by: James M Snell <jasnell@gmail.com> Assisted-by: Opencode PR-URL: #66335 Reviewed-By: Filip Skokan <panva.ip@gmail.com> Reviewed-By: Luigi Pinca <luigipinca@gmail.com> Reviewed-By: Matthew Aitken <maitken033380023@gmail.com> Reviewed-By: Robert Nagy <ronagy@icloud.com>
The C++ option parser treats `_` and `-` as the same character in option names, so `--watch_path` is the same as `--watch-path`. Watch mode compared spellings literally when it removed its own flags from `process.execArgv` and `NODE_OPTIONS` before spawning the child. The underscore spellings got through, so each child went back into watch mode and spawned another child, and the application never ran. Normalize option names before comparing them. Forward the original arguments to the child unchanged. Signed-off-by: Trivikram Kamat <16024985+trivikr@users.noreply.github.com> Assisted-by: claude:opus-5.5 PR-URL: #66365 Fixes: #66364 Reviewed-By: Moshe Atlow <moshe@atlow.co.il>
When `setBody()` receives a promise that resolves to an unsupported body type, `configureOutbound()` throws inside the fulfillment handler. The rejection handler only covered the original promise, so the error rejected a discarded promise and crashed the process as an unhandled rejection. Catch errors thrown by `configureOutbound()` in the fulfillment handler and destroy the stream with them, as the rejection handler already does. For an unsupported resolved value, `stream.closed` now rejects with the same `ERR_INVALID_ARG_TYPE` that `setBody()` throws synchronously. Signed-off-by: Christian Aurich Zanettini Martins <christian.aurichzm@gmail.com> PR-URL: #66260 Reviewed-By: Tim Perry <pimterry@gmail.com>
`session.close()` and `session.destroy()` only checked that `options.code` was a bigint or a number. Numbers were then converted to `uint64_t` unchecked, so fractions were truncated and negative, non-finite or too large values were undefined behavior. Bigints were only checked to fit in 64 bits, but QUIC error codes are variable-length integers limited to 62 bits, so larger codes cannot be encoded in the `CONNECTION_CLOSE` frame. Reject codes that are not integers between `0` and `2n ** 62n - 1n`, the range `QuicError` already enforces, before any close or destroy side effects. Signed-off-by: Christian Aurich Zanettini Martins <christian.aurichzm@gmail.com> PR-URL: #66302 Reviewed-By: Tim Perry <pimterry@gmail.com>
Signed-off-by: Geoffrey Booth <webadmin@geoffreybooth.com> PR-URL: #62530 Reviewed-By: Matteo Collina <matteo.collina@gmail.com> Reviewed-By: Jacob Smith <jacob@frende.me> Reviewed-By: Filip Skokan <panva.ip@gmail.com> Reviewed-By: Marco Ippolito <marcoippolito54@gmail.com> Reviewed-By: Joyee Cheung <joyeec9h3@gmail.com> Reviewed-By: Gürgün Dayıoğlu <hey@gurgun.day>
PR-URL: #66517 Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com> Reviewed-By: Marco Ippolito <marcoippolito54@gmail.com> Reviewed-By: Moshe Atlow <moshe@atlow.co.il> Reviewed-By: Richard Lau <richard.lau@ibm.com> Reviewed-By: Luigi Pinca <luigipinca@gmail.com> Reviewed-By: James M Snell <jasnell@gmail.com>
Several conversions from SQLite text to V8 strings passed a length of -1 to String::NewFromUtf8(). With that length, V8 skips its length check and aborts the process when the UTF-8 text exceeds String::kMaxLength. SQLite error messages embed the offending identifier or token, so CreateSQLiteErrorImpl() could hit this. NullableSQLiteStringToValue(), used for setAuthorizer() callback arguments and statement.columns() metadata, had the same problem, and the authorizer also called ToLocalChecked() on each argument. Convert error messages with Utf8StringMaybeOneByte(), and check the length up front in NullableSQLiteStringToValue(), so oversized strings throw ERR_STRING_TOO_LONG as column values already do. In the authorizer, deny the action and let the pending error reach the caller. Signed-off-by: Trivikram Kamat <16024985+trivikr@users.noreply.github.com> Assisted-by: claude:opus-5.5 PR-URL: #66521 Fixes: #66520 Fixes: #66522 Reviewed-By: Guilherme Araújo <arauujogui@gmail.com> Reviewed-By: Aviv Keller <me@aviv.sh> Reviewed-By: James M Snell <jasnell@gmail.com>
Add the build platform and compiler for official musl binaries. Signed-off-by: Ji Hoon Kang <ivory.ma9ic@gmail.com> Assisted-by: Codex PR-URL: #66523 Fixes: #66506 Reviewed-By: Richard Lau <richard.lau@ibm.com> Reviewed-By: Luigi Pinca <luigipinca@gmail.com> Reviewed-By: James M Snell <jasnell@gmail.com>
`enableDefensive()` updated only the live connection, so after `close()` and `open()` the defensive flag went back to the value passed to the constructor. Store the new value in the open configuration so that `open()` applies it again. Signed-off-by: Trivikram Kamat <16024985+trivikr@users.noreply.github.com> Assisted-by: claude:opus-5.5 PR-URL: #66404 Fixes: #66403 Reviewed-By: Guilherme Araújo <arauujogui@gmail.com>
HdrHistogram_c 0.12.0 added a private header, src/hdr_histogram_internal.h, which src/hdr_tests.h now includes. update-histogram.sh copies a fixed list of files, so the automated update to 0.12.0 would leave deps/histogram without it and fail to compile. Add the header to the list. Signed-off-by: fcostaoliveira <filipe@redis.com> PR-URL: #66528 Reviewed-By: Richard Lau <richard.lau@ibm.com> Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com> Reviewed-By: James M Snell <jasnell@gmail.com> Reviewed-By: Luigi Pinca <luigipinca@gmail.com> Reviewed-By: Chengzhong Wu <legendecas@gmail.com>
The root cert store and the certificates set through tls.setDefaultCACertificates() were thread_local, with a cleanup hook on whichever Environment used TLS first. When several Environments share a thread, setting the default CA certificates in one of them replaced the trusted CAs of the others. Keep both on the Environment, next to its other OpenSSL state. Signed-off-by: Shelley Vohr <shelley.vohr@gmail.com> PR-URL: #66411 Refs: #66239 Reviewed-By: Anna Henningsen <anna@addaleax.net>
The ngtcp2 and nghttp3 allocators shared one thread_local state whose BindingData pointer was set by the last BindingData that handed out an allocator. With several Environments on a thread, memory allocated for a session in one Environment was accounted against another's BindingData and failed a CHECK when freed. Give each BindingData its own heap-allocated state. nghttp3 buffers backing external strings can be freed after the BindingData is gone, so the state counts live allocations and is deleted once the BindingData has been destroyed and the last of them is freed. Signed-off-by: Shelley Vohr <shelley.vohr@gmail.com> PR-URL: #66411 Refs: #66239 Reviewed-By: Anna Henningsen <anna@addaleax.net>
Several Environments can share a thread, so state in src/ that belongs to one of them cannot be kept in a thread_local. Add a cpplint rule that rejects thread_local in src/ unless the declaration is marked with NOLINTNEXTLINE(runtime/thread_local), and mark the existing uses, which are per-thread by design. Signed-off-by: Shelley Vohr <shelley.vohr@gmail.com> PR-URL: #66411 Refs: #66239 Reviewed-By: Anna Henningsen <anna@addaleax.net>
Add deps/v8/** to the QUIC workflow's pull request path filter so V8 updates trigger its build and tests. Assisted-by: Codex Signed-off-by: inoway46 <inoueyuya416@gmail.com> PR-URL: #66602 Refs: #66537 Refs: https://github.com/nodejs/node/actions/runs/37675498427/job/112978479932 Reviewed-By: Richard Lau <richard.lau@ibm.com> Reviewed-By: Tim Perry <pimterry@gmail.com>
Signed-off-by: Vas Sudanagunta <vas@commonkarma.org> PR-URL: #66563 Reviewed-By: Moshe Atlow <moshe@atlow.co.il> Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reuse the values array instead of allocating a second result array. Signed-off-by: Roberto Bianchi <roberto.bianchi@spendesk.com> PR-URL: #66488 Reviewed-By: Gürgün Dayıoğlu <hey@gurgun.day> Reviewed-By: Tim Perry <pimterry@gmail.com>
PR-URL: #66663 Reviewed-By: Jiawen Geng <technicalcute@gmail.com> Reviewed-By: Xuguang Mei <meixuguang@gmail.com>
PR-URL: #66655 Reviewed-By: Colin Ihrig <cjihrig@gmail.com> Reviewed-By: Chemi Atlow <chemi@atlow.co.il> Reviewed-By: Luigi Pinca <luigipinca@gmail.com> Reviewed-By: Xuguang Mei <meixuguang@gmail.com>
richardlau
force-pushed
the
v26.12.0-proposal
branch
from
October 12, 2026 18:10
13aa82f to
7ad17f5
Compare
richardlau
approved these changes
Oct 12, 2026
Collaborator
|
CI: https://ci.nodejs.org/job/node-test-pull-request/78345/ CITGM v26.x: https://ci.nodejs.org/job/citgm-smoker/3793/ ncu-ci citgm 3793 3794Running subset to confirm: https://ci.nodejs.org/job/citgm-smoker/3795/ |
Codecov Report❌ Patch coverage is Additional details and impacted files@@ Coverage Diff @@
## v26.x #66684 +/- ##
==========================================
+ Coverage 90.73% 90.80% +0.06%
==========================================
Files 774 775 +1
Lines 271787 273312 +1525
Branches 52061 52454 +393
==========================================
+ Hits 246609 248183 +1574
+ Misses 16067 16025 -42
+ Partials 9111 9104 -7
🚀 New features to boost your workflow:
|
Collaborator
In the non-default parse() path, a key with more than one percent escape could corrupt non-ASCII characters in its value. Keep key characters out of the value's encoding check. Assisted-by: claude:opus-5.5 Signed-off-by: vedchaudhari <vedc2853@gmail.com> PR-URL: #66553 Refs: #66175 Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com>
A source without pull() has nothing observable left to do in its post-start step, since the started flag only gates calls into the pull algorithm. Set the flag right away instead of from a microtask, so a push-style ReadableStream allocates neither the closure nor the task and is not kept alive until the next microtask checkpoint. pipeTo and tee hold the only references to their reader and writer, so their [[closedPromise]] records are never observed as promises. Install the watchers as the records themselves, as pipeTo's ready hook already does, instead of materializing a promise plus reaction per side, and hand the erroring/release probes one shared pending promise. The tee's cancel promise is likewise materialized by the first branch cancel. Microtask ordering is unchanged: each hook enqueues its watcher at the position the promise reaction would have had. node benchmark/compare.js --runs 20 over benchmark/webstreams (46 rows, all others within the confidence interval): webstreams/creation.js kind='ReadableStream' *** +172.40% webstreams/creation.js kind='ReadableStream.tee' *** +20.47% webstreams/creation.js kind='ReadableStreamBYOBReader' *** +15.66% webstreams/creation.js kind='ReadableStreamDefaultReader' *** +14.53% webstreams/lifecycle.js kind='pipe-to' (40 runs) ** +10.98% Signed-off-by: Matteo Collina <hello@matteocollina.com> PR-URL: #66424 Reviewed-By: Paolo Insogna <paolo@cowtech.it> Reviewed-By: Gürgün Dayıoğlu <hey@gurgun.day> Reviewed-By: James M Snell <jasnell@gmail.com>
PR-URL: #66652 Reviewed-By: Colin Ihrig <cjihrig@gmail.com> Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Signed-off-by: RafaelGSS <rafael.nunu@hotmail.com> PR-URL: #66649 Reviewed-By: Luigi Pinca <luigipinca@gmail.com> Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
Call uv_fs_req_cleanup() before returning for directories, otherwise the path buffer allocated by uv_fs_stat() leaks on Windows. Signed-off-by: RafaelGSS <rafael.nunu@hotmail.com> PR-URL: #66555 Reviewed-By: Ulises Gascón <ulisesgascongonzalez@gmail.com>
Python 3.15 removed CGIHTTPRequestHandler, which WPT pywebsocket3 still uses. This breaks host configuration in the current undici WPT action. Signed-off-by: Filip Skokan <panva.ip@gmail.com> PR-URL: #66699 Reviewed-By: Mike McCready <66998419+MikeMcC399@users.noreply.github.com> Reviewed-By: Richard Lau <richard.lau@ibm.com>
Signed-off-by: RafaelGSS <rafael.nunu@hotmail.com> PR-URL: #66556 Reviewed-By: Ulises Gascón <ulisesgascongonzalez@gmail.com>
richardlau
force-pushed
the
v26.12.0-proposal
branch
from
October 13, 2026 17:02
7ad17f5 to
26e72d8
Compare
richardlau
approved these changes
Oct 13, 2026
aduh95
approved these changes
Oct 13, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
20 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
2026-10-14, Version 26.12.0 (Current), @richardlau
Notable Changes
1ebd6d3677] - (SEMVER-MINOR) doc,lib,src: throw on missing WebAssembly or RX support (Paolo Insogna) #665337f1937d2b9] - (SEMVER-MINOR) http: add websocketMask() and websocketUnmask() (James M Snell) #66335Commits
30e76bb16a] - benchmark: fix input passed to subtle.digest in webcrypto-digest (Rafael Gonzaga) #66608adef72223a] - benchmark: fix buffer option in buffer read/write benchmarks (Rafael Gonzaga) #666042f498f08fe] - benchmark: add util.parseArgs benchmark (Rafael Gonzaga) #665994ce8412e18] - benchmark: fix url-searchparams-sort to sort a fresh list (RafaelGSS) #66535493bd6c66e] - benchmark,tools: fix napi benchmarks on GHA (Nigro Simone) #66423e4515552d6] - build: run QUIC CI for V8 changes (Yuya Inoue) #66602a888e51062] - build: support Python 3.15 (Mike McCready) #657502afab9a63b] - build: do not include shared gtest innodelink path (Antoine du Hamel) #66626f88c2f8ec6] - build,test: enable temporal support on no-ICU and system-ICU builds (Antoine du Hamel) #666975fd03e6fdf] - child_process: propagate config-file permission flags to children (Rafael Gonzaga) #66559f771134b07] - crypto: isolate provider EC PKCS8 encoding (Filip Skokan) #664134e00a293db] - crypto: remove key export and metadata locks (Filip Skokan) #66413bcd8018775] - crypto: remove verify setup key locking (Filip Skokan) #66413883250fee2] - crypto: remove KEM key locking (Filip Skokan) #664139d98805071] - crypto: remove RSA-OAEP key locking (Filip Skokan) #66413d6293e7bb1] - crypto: skip secret key mutex allocation (Filip Skokan) #664138d8af8003e] - crypto: keep the root cert store per Environment (Shelley Vohr) #66411c6f0614785] - crypto: remove select Web Crypto warnings (Filip Skokan) #66312e5360b5a08] - deps: update googletest to 988ea2c1798de7779f656df2281dd36d6039a17a (Node.js GitHub Bot) #666527eb230a2c1] - deps: update acorn to 8.19.0 (Node.js GitHub Bot) #66655af946ba8f3] - deps: update sqlite to 3.54.0 (Node.js GitHub Bot) #66663007872a85d] - deps: V8: cherry-pick 8d14d49c4040 (Antoine du Hamel) #66627f44aec4966] - deps: update simdjson to 5.0.3 (Daniel Lemire) #666201a33e914e8] - deps: V8: cherry-pick 7d5eb1df2a72 (inoway46) #665663294d51e5a] - diagnostics_channel: fix default callback context (Matteo Collina) #664815c602a5824] - doc: list futimes among fd APIs disabled by the permission model (Rafael Gonzaga) #66649eaeb4736c8] - doc: add Test Runner to list of built-in diagnostic channels (Vas Sudanagunta) #665630e1c99afae] - doc: document stream/iter behaviors and Node.js extensions (James M Snell) #66483846236367d] - doc: document URL and Uint8Array references in process.permission (Rafael Gonzaga) #66557fc3b067be7] - doc: clarify http Agent keepSocketAlive behavior (Efe Karasakal) #6625273a4e90ce2] - doc: document keepAliveTimeoutBuffer server option (Efe Karasakal) #66286bb816582af] - doc: fix request.reusedSocket timeout example (Efe Karasakal) #6628682223ab4d9] - doc: clarify revert PR label policy (Antoine du Hamel) #66529c6f59d4e8e] - doc: clarify node binary misuse after compromise (Rafael Gonzaga) #665308904178498] - doc: document linux-x64-musl build toolchain (Issac) #665231e8247a74e] - doc: run license-builder (github-actions[bot]) #66517b2773d5e4c] - doc: add missing return types in cluster.md (Daniel Pinto) #664531ebd6d3677] - (SEMVER-MINOR) doc,lib,src: throw on missing WebAssembly or RX support (Paolo Insogna) #66533c1073f31de] - ffi: fix exportArrayBuffer type check (Trivikram Kamat) #6645569148ee0ff] - fs: lock FileHandle on first read in pull() and pullSync() (James M Snell) #66483700c60a1cd] - fs: serialize FileHandle writer() async writes (James M Snell) #6648332833def1c] - http: reduce raw header name allocations (Roberto Bianchi) #664887f1937d2b9] - (SEMVER-MINOR) http: add websocketMask() and websocketUnmask() (James M Snell) #66335115731dda7] - http2: speed up response getHeaders (Roberto Bianchi) #66592447c36cb45] - lib: fix AbortSignal.any() nested composite leak (Darius) #666171722ced4b4] - lib: add --allow-fs-vfs to permission available flags (Rafael Gonzaga) #66554062ece77fc] - lib: fix benchmark record acknowledgement race (Filip Skokan) #6643005d0b14438] - lib: set exit code on failed node:bench run() (RafaelGSS) #665342cab299471] - lib: default node:bench warmup to 10 invocations (RafaelGSS) #6653683f507845d] - meta: bump nodejs/node-pr-labeler to dfe5eb3 (Soul Lee) #666066fbffd5ee5] - meta: bump codecov/codecov-action from 7.1.0 to 7.1.1 (dependabot[bot]) #66448bd567f8bd6] - module: fix require of imports with package map (Lazizbek Ergashev) #66565c442f471a5] - module: synchronously load most ES modules (Geoffrey Booth) #6253051f66f0134] - permission: keep explicit fs grants when dropping a covering directory (Rafael Gonzaga) #665561aa10d80e2] - process: mark process.finalization as release candidate (Matteo Collina) #66436dd4715a6ba] - querystring: fix value decoding after encoded keys (Ved Chaudhari) #665539648a6ba8e] - quic: reject closed stream writer writes with a TypeError (James M Snell) #66483d6f566baf8] - quic: give each BindingData its own allocator state (Shelley Vohr) #66411c3204c15bd] - quic: validate session close error codes (Christian Aurich Zanettini Martins) #663025b87354f5a] - quic: destroy stream on invalid promise body (Christian Aurich Zanettini Martins) #662609ef698c781] - sqlite: validate aggregate() name and options (Guilherme Araújo) #66463bbf41f8cfb] - sqlite: persist enableDefensive() across reopen (Trivikram Kamat) #6640454867cd25e] - sqlite: throw on oversized strings instead of aborting (Trivikram Kamat) #665214314cde48b] - src: release uv_fs_t in permission WildcardIfDir (Rafael Gonzaga) #665550e58916f08] - src: stop including simdjson.h from env.h (Daniel Lemire) #6662006f56a55bb] - src: use native CopyArrayBufferBytes for webstream buffer copy (René) #664002e3dd5bb63] - src: fix config file handling (Marco Ippolito) #66431cd86506bc2] - src: mark config file as stable (Marco Ippolito) #6643115ff9884e4] - stream: skip idle webstreams start and watchers (Matteo Collina) #664243f75c89fb8] - stream: add pipeToSync() failOnIncompleteClose option (James M Snell) #664836cecf140e7] - stream: do not fail the writer when pipeToSync() cannot close (James M Snell) #6648316833534b6] - stream: fix fromSync() async input error messages (James M Snell) #66483af41622ad8] - stream: reject closed fromWritable() writes with a TypeError (James M Snell) #664834b83c6c38e] - stream: accept explicit stream/iter budgets below 16384 (James M Snell) #66483f302fbd04a] - stream: reduce per-chunk overhead in stream/iter consumers (James M Snell) #664837ba60dcdbe] - stream: keep the original error when writer.fail() throws (James M Snell) #66483dcac51a7db] - stream: align pull() abort handling with the spec (James M Snell) #66483995dee6b6b] - stream: honor stream/iter protocols on function objects (James M Snell) #664836eaf91353a] - stream: do not hold back nested async data in from() (James M Snell) #6648369d44aedb4] - stream: bound pre-batched async values in from() (James M Snell) #664836b1e7c4cf1] - stream: guard shareSync() against re-entrant source reads (James M Snell) #664838a47365425] - stream: split oversized share batches under drop-oldest (James M Snell) #6648330cbc4e643] - stream: reject drop-newest backpressure in shareSync() (James M Snell) #6648342ae08594e] - stream: detach shareSync consumers on strict budget errors (James M Snell) #66483fa49de9ba6] - stream: keep share buffer when all consumers detach (James M Snell) #66483e6662cb904] - stream: fix Utf8Stream flush handling (James M Snell) #6647393596b1a9e] - stream: add dump()/dumpSync() for stream/iter (Ethan Arrowood) #655984ba6ce1b0c] - stream: port remaining SonicBoom tests for Utf8Stream (Matteo Collina) #66275cd8b5fa5b0] - test: tolerate async block count updates in test-fs-stat-bigint (Rafael Gonzaga) #6657630814ce991] - test: replace discard loops with dump() (Ethan Arrowood) #6559820441b8fc0] - test: run node-bench tools test sequentially (Filip Skokan) #663389618da6fe3] - test: remove duplicated cases in permission fs-read fixture (Rafael Gonzaga) #66450c348a4cb46] - test: run instantiateStreaming-bad-imports WPT (Filip Skokan) #663227d4fda6ba7] - test: honor allowed WPT promise rejections (Filip Skokan) #66322d4c87eb086] - test: scope Blob WPT failures to big-endian (Filip Skokan) #663227309ddf204] - test_runner: rerun failing todo tests in suites (Barak) #66605da908b3072] - test_runner: report load errors with --test-isolation=none (Lazizbek Ergashev) #66550b18e121625] - test_runner: add mock call assertions to t.assert (Guilherme Araújo) #664763d691ab75e] - tools: restore Python 3.14 for daily WPT (Filip Skokan) #66699714aca1ef6] - tools: switch to PGP and SHA256 in ICU updater (Antoine du Hamel) #66469fa9fca45e4] - tools: lint thread_local in src (Shelley Vohr) #66411dbc3e97847] - tools: copy hdr_histogram_internal.h in update-histogram.sh (Filipe Oliveira (Redis)) #665284760c27904] - tools: bump the eslint group in /tools/eslint with 5 updates (dependabot[bot]) #6644563c20ee58e] - vfs: add ComposableProvider for layered mounts (Matteo Collina) #66235ab057989af] - watch: strip underscore aliases of watch flags (Trivikram Kamat) #66365