26.11.0

Notable Changes

• [232f178825] - (SEMVER-MINOR) buffer: add isLatin1 (James M Snell) #66298
• [27778036de] - (SEMVER-MINOR) buffer: add Buffer.stringLength() (Matteo Collina) #66064
• [4f84c4bda2] - build, doc: move to redesign (Aviv Keller) #62045
• [6f6296fef9] - (SEMVER-MINOR) doc: promote Alpine Linux to tier 2 support (Stewart X Addison) #63737
• [e998d260d0] - (SEMVER-MINOR) http: add isValidHeaderName() and isValidHeaderValue() (James M Snell) #66334
• [7702a50e08] - (SEMVER-MINOR) http2: add connectionWindowSize option (Tim Perry) #65619
• [e06aa62cec] - (SEMVER-MINOR) perf_hooks: fix truncation of monitorEventLoopDelay() resolution (James M Snell) #66115
• [ee126e37e8] - (SEMVER-MINOR) perf_hooks: allow RecordableHistogram to record 0 (James M Snell) #66114
• [1fef8f54db] - (SEMVER-MINOR) perf_hooks: add histogram.diff() (James M Snell) #66099
• [f1b9758c4e] - (SEMVER-MINOR) perf_hooks: add histogram.snapshot() (James M Snell) #66099
• [291d56ea3e] - (SEMVER-MINOR) perf_hooks: harden histogram CBOR import validation (James M Snell) #66098
• [6299b09d5c] - (SEMVER-MINOR) process: graduate process.ref/unref to stable (James M Snell) #66213
• [41d6707b63] - (SEMVER-MINOR) sqlite: rename DatabaseSync and StatementSync (Guilherme Araújo) #65988
• [60d0aa0cd4] - (SEMVER-MINOR) src: add --process-timeout=N (James M Snell) #66138
• [f39916a7e3] - (SEMVER-MINOR) src: expose size and count in heap profile output (Ilyas Shabi) #65737
• [0b00d5ea59] - (SEMVER-MINOR) src: let embedders exempt linked bindings from the addon permission (Shelley Vohr) #66067

Commits

• [11c3d7115d] - benchmark: add implicit-framing case to http/set-header (Matteo Collina) #66420
• [168b764fec] - benchmark: add zstdCompress benchmark (James Ross) #66358
• [69182564a7] - benchmark: add a node::MakeCallback benchmark (Nigro Simone) #66316
• [12e540582f] - (SEMVER-MINOR) benchmark: add http header validator benchmark (James M Snell) #66334
• [e6abdf6b01] - benchmark: remove duplicate ffi string length direct (Donghoon Kang) #66278
• [480ca7cc55] - benchmark: fix shadowing that broke h=20 on incoming_headers benchmark (Tim Perry) #66257
• [c6bbc1b128] - benchmark: cover Web Crypto conversion costs (Filip Skokan) #66237
• [85a2e4e270] - benchmark: remove duplicate ffi add-64 benchmark (Soul Lee) #66121
• [d0a72f2c12] - buffer: fix negative index for large buffers (Hilary Asogwa) #66325
• [b7f6a66a9f] - (SEMVER-MINOR) buffer: add isLatin1 (James M Snell) #66298
• [232f178825] - (SEMVER-MINOR) buffer: add isLatin1 (James M Snell) #66298
• [f7d3d11c11] - buffer: fix odd UTF-16LE indexOf start (Yuya Inoue) #65960
• [27778036de] - (SEMVER-MINOR) buffer: add Buffer.stringLength() (Matteo Collina) #66064
• [9f1db461d2] - build: update common.gypi for z/OS (Gaby Baghdadi) #66449
• [0002037b3f] - build: update configure.py for z/OS (Gaby Baghdadi) #66449
• [a341ac460a] - build: fix vcbuild format-md install and exit (Ved Chaudhari) #66475
• [bec52d9103] - build: fix vcbuild lint skipping lint-md-build (Ved Chaudhari) #66467
• [9acdb5910c] - build: toggle doc-kit verbosity based on V (Brian Muenzenmeyer) #66293
• [6ee32f857a] - build: support LIEF 0.17.x and 1.x (Yuya Inoue) #66240
• [2248869955] - build: add clang support for pgo on macOS/Linux (Chengzhong Wu) #66136
• [49069529eb] - build: add GZIP_COMPRESSION Make variable (inoway46) #66228
• [9066d33aa2] - build: port make_temporal_zoneinfo_cpp to GYP (Antoine du Hamel) #66183
• [1f4a8fb1cb] - build: add v8_enable_temporal_systemicu (Steven R. Loomis) #65992
• [4f84c4bda2] - build, doc: move to redesign (Aviv Keller) #62045
• [a0e7141ffc] - child_process: build the default env block in one native pass (Shelley Vohr) #65325
• [9fa31096d4] - crypto: improve random synchronous number generation performance (Mert Can Altin) #66348
• [53cde9d1f8] - crypto: fix raw key export error for wrong key type (한국) #66217
• [32ba6d5ada] - crypto: use backend cSHAKE and KMAC (Filip Skokan) #66237
• [67ccff6434] - crypto: separate conversion from validation (Filip Skokan) #66237
• [ceeb37173d] - crypto: verify empty KMAC outputs (Filip Skokan) #66237
• [359b07a641] - crypto: check EC coordinate conversion results (Filip Skokan) #66237
• [e4d746c4a5] - crypto: map JWK export failures to OperationError (Filip Skokan) #66237
• [a851dda86a] - crypto: include EC public keys in PKCS8 exports (Filip Skokan) #66237
• [7f58476ed1] - crypto: use the public CryptoKey prototype (Filip Skokan) #66237
• [75870623ad] - crypto: split hybrid keys without species (Filip Skokan) #66237
• [a1bea87c6a] - crypto: report actual RSA modulus lengths (Filip Skokan) #66237
• [5e04680036] - crypto: derive Argon2 without worker threads (Filip Skokan) #66237
• [fe09120a0e] - crypto: create key usage arrays without species (Filip Skokan) #66237
• [44a2965f5f] - crypto: minimize RSA public exponent metadata (Filip Skokan) #66237
• [2f3e6dff9d] - crypto: copy derived bits without species (Filip Skokan) #66237
• [d54a2b2049] - crypto: handle PBKDF2 iteration limits (Filip Skokan) #66237
• [2ef6046f11] - crypto: reject duplicate unknown key usages (Filip Skokan) #66237
• [2e25ae4a7a] - crypto: check RSA JWK alg with SHA-3 hashes (Filip Skokan) #66237
• [0370e02e2a] - crypto: copy parameters without array species (Filip Skokan) #66237
• [e042d35ca5] - crypto: convert importKey data as a union (Filip Skokan) #66237
• [ff86606768] - crypto: copy detached parameters as empty (Filip Skokan) #66237
• [1314d277b2] - crypto: resolve supports overloads by type (Filip Skokan) #66237
• [a855a46aeb] - crypto: allow unbound SubtleCrypto.supports (Filip Skokan) #66237
• [4a72c1d690] - crypto: allow short AES-GCM IVs (Filip Skokan) #66237
• [2d84b7ed49] - crypto: validate normalized hash names (Filip Skokan) #66237
• [6bfd3924ff] - crypto: convert getRandomValues views (Filip Skokan) #66237
• [529bd18c1a] - crypto: isolate cipher job errors (Filip Skokan) #66237
• [d4af11e171] - crypto: reject short AES-KW inputs (Filip Skokan) #66237
• [78374c8af0] - crypto: match algorithm names as ASCII (Filip Skokan) #66237
• [ab9a3f2b01] - crypto: use internal random buffer bounds (Filip Skokan) #66237
• [7c9b2df87a] - crypto: use current FIPS state for availability (Filip Skokan) #66160
• [55af1dcded] - crypto: update root certificates to NSS 3.129 (Node.js GitHub Bot) #66496
• [4387cb46d2] - deps: update timezone to 2026e (Node.js GitHub Bot) #66419
• [150c96ef3f] - deps: V8: cherry-pick c795f5948568 (Aviv Keller) #66380
• [6b5ac2ab5d] - deps: update archs files for openssl-3.5.9 (Node.js GitHub Bot) #66396
• [bee7e2403c] - deps: upgrade openssl sources to openssl-3.5.9 (Node.js GitHub Bot) #66396
• [7a715495f2] - deps: update lief to 1.0.0 (Node.js GitHub Bot) #66345
• [f9da04958a] - deps: update zlib to 1.3.2.1-motley-456ae73 (Node.js GitHub Bot) #66330
• [5c34dd970d] - deps: update undici to 8.11.2 (Node.js GitHub Bot) #66332
• [fdf0572cd1] - deps: update timezone to 2026d (Node.js GitHub Bot) #66333
• [6c924ee1b0] - deps: upgrade npm to 11.20.0 (npm team) #66259
• [2653b2617d] - deps: V8: backport 786c1c2d88d4 (Eliau Elkouby) #66249
• [1d68f23e08] - deps: update googletest to 4267679b6887f349f17b01ccd70c9e3483689b25 (Node.js GitHub Bot) #66145
• [c507c5ad12] - deps: V8: backport 9fb4444bfc46 (Steven R. Loomis) #65992
• [8c556ab2b6] - deps: update histogram to 0.12.0 (Node.js GitHub Bot) #66494
• [d3f55c7487] - diagnostics_channel: replace using with try-finally (Ayush Chaudhary) #64251
• [510dfd899e] - doc: update FreeEnvironment() notes for sibling Environments (Shelley Vohr) #66239
• [db2665ba17] - doc: add indexed Array.prototype properties to primordial exclusions (René) #66234
• [b692079e3a] - doc: fixup and cleanup stream/iter docs (James M Snell) #66079
• [9b191141a2] - doc: fix casing in util.markPromiseAsHandled section (Antoine du Hamel) #66206
• [8e8c9762a8] - doc: add return type to Blocklist.isBlocklist (yuki motokane) #66181
• [6c7fc98d7f] - doc: clarify Worker execArgv vs Permission Model grants (yunshingng) #66124
• [9fd0a10b1e] - doc: document iterable input for AbortSignal.any (Haram Jeong) #66123
• [c4508fd4c7] - doc: restore XadillaX to collaborators (Khaidi Chu) #66063
• [b4ad8354f0] - doc: use Type for performanceNodeTiming.uvMetricsInfo (James M Snell) #66094
• [50bc27f3c3] - doc: document the node:ffi call paths (Soul Lee) #66086
• [a74a0ee748] - doc,src,test: fix typos in code comments (Noah) #66218
• [6f6296fef9] - (SEMVER-MINOR) doc: promote Alpine Linux to tier 2 support (Stewart X Addison) #63737
• [215639d6ce] - events: fix addAbortListener for aborted signals (Lazizbek Ergashev) #65640
• [021f7d8d98] - ffi: accept safe integer numbers for 64-bit arguments (Donghoon Kang) #66197
• [53fd8e7ebb] - ffi: remove permission checks from dlclose and dlsym (Trivikram Kamat) #66426
• [fa7efaf782] - ffi: validate pointer ranges in optimized calls (Trivikram Kamat) #66371
• [11f80798ba] - ffi: throw on allocation failure in toArrayBuffer() (Trivikram Kamat) #66406
• [c65a333648] - ffi: do not abort when a Worker stops in a callback (Trivikram Kamat) #66389
• [9bdab1eca0] - ffi: reject unsafe integers as length or offset (Christian Aurich Zanettini Martins) #66216
• [343a5c2915] - ffi: fix use-after-free in PrepareFunction (Trivikram Kamat) #66368
• [51daf16244] - ffi: reject non-boolean copy arguments (Christian Aurich Zanettini Martins) #66219
• [b901b97cbf] - ffi: use type errors for invalid signatures (Donghoon Kang) #66222
• [0f6cdce998] - ffi: allocate string argument storage lazily (Soul Lee) #66178
• [ee84a36f12] - ffi: avoid memcpy() with a null pointer (Christian Aurich Zanettini Martins) #66200
• [da32c79034] - fs: keep timestamps of files skipped by cpSync (Christian Aurich Zanettini Martins) #66305
• [e7121be408] - fs: stop recursive mkdir from retrying ENOENT forever (Marco) #66340
• [99a78b0d83] - fs: fix crash on negative zero file descriptor (Christian Aurich Zanettini Martins) #65888
• [8b24247be1] - fs: validate falsy openAsBlob type option (Christian Aurich Zanettini Martins) #66125
• [e7d5352fa6] - fs: close file streams with fd 0 (greenhead) #66131
• [f38768f0fa] - fs: close fd 0 on discarded FileHandle transfer (Christian Aurich Zanettini Martins) #66095
• [6487d36873] - http: avoid dictionary-mode objects in responses (Matteo Collina) #66420
• [f8d30110b6] - http: cache parser callbacks (Matteo Collina) #66152
• [e998d260d0] - (SEMVER-MINOR) http: add isValidHeaderName() and isValidHeaderValue() (James M Snell) #66334
• [0bb98027e5] - http: avoid toLowerCase on the server hot path (Yagiz Nizipli) #66120
• [9819b0c432] - http: normalize CONNECT request paths (Efe Karasakal) #64876
• [ab93a3d51b] - http: preserve socket errors as response error causes (Khaidi Chu) #66061
• [15184e8212] - http: reduce per-request allocations in the server (Matteo Collina) #65802
• [7702a50e08] - (SEMVER-MINOR) http2: add new connectionWindowSize option (Tim Perry) #65619
• [33e4ba358b] - https: handle invalid TLS options in proxied requests (Christian Aurich Zanettini Martins) #66096
• [6f610a836b] - inspector: throw ERR_INSPECTOR_NOT_AVAILABLE without an agent (Shelley Vohr) #66239
• [697980b6fc] - inspector: fix connectToMainThread() abort without parent inspector (Shelley Vohr) #65976
• [37b3db91eb] - (SEMVER-MINOR) lib: fix stream loading bug in node:bench (James M Snell) #66114
• [46a8a5dd65] - lib: add primitive fast path to structuredClone (Guilherme Araújo) #64190
• [bec7c53400] - meta: bump github/codeql-action/analyze from 4.38.0 to 4.38.2 (dependabot[bot]) #66443
• [39d721abed] - meta: bump github/codeql-action/autobuild from 4.38.0 to 4.38.2 (dependabot[bot]) #66444
• [963804db4d] - meta: bump github/codeql-action/init from 4.38.0 to 4.38.2 (dependabot[bot]) #66446
• [5837ef8608] - meta: bump github/codeql-action/upload-sarif from 4.38.0 to 4.38.2 (dependabot[bot]) #66447
• [d8109f9831] - meta: label permission model changes correctly (Rafael Gonzaga) #66208
• [27f20dcaea] - meta: bump codecov/codecov-action from 7.0.0 to 7.1.0 (dependabot[bot]) #66103
• [dc6ef03ab6] - module: centralize builtin exposure policies (Jungwon Sohn) #66292
• [f36efeb350] - module: avoid allocating a cache key string for every require() (Samuel Attard) #63884
• [9baea33509] - module: normalize package map paths (Hilary Asogwa) #66054
• [354c2cc867] - net: speed up BlockList.check for strings (Yagiz Nizipli) #66166
• [995a67a5ff] - net: skip IPv6 regex when the string has no colon (Yagiz Nizipli) #66165
• [1c7b4feebb] - node-api: do not crash on module version mismatch (Alexey Karimov) #66019
• [e06aa62cec] - (SEMVER-MINOR) perf_hooks: fix truncation of monitorEventLoopDelay() resolution (James M Snell) #66115
• [ee126e37e8] - (SEMVER-MINOR) perf_hooks: allow RecordableHistogram to record 0 (James M Snell) #66114
• [1fef8f54db] - (SEMVER-MINOR) perf_hooks: add histogram.diff() (James M Snell) #66099
• [a6dfb3bcfd] - (SEMVER-MINOR) perf_hooks: report histogram memory to V8 (James M Snell) #66099
• [f1b9758c4e] - (SEMVER-MINOR) perf_hooks: add histogram.snapshot() (James M Snell) #66099
• [e2ae016df8] - (SEMVER-MINOR) perf_hooks: add histogram export format version 2 (James M Snell) #66098
• [291d56ea3e] - (SEMVER-MINOR) perf_hooks: harden histogram CBOR import validation (James M Snell) #66098
• [70c269aadc] - perf_hooks: restore GC tracking after snapshot deserialization (James M Snell) #66097
• [c545d044ee] - perf_hooks: track GC callback installation natively (James M Snell) #66097
• [0bd9905959] - perf_hooks: fix PerformanceObserver observer count leaks (James M Snell) #66097
• [8ec2a940c5] - perf_hooks: add performanceNodeTiming.uvMetricsInfoBigInt (James M Snell) #66094
• [829891da14] - perf_hooks: fix truncation of uvMetricsInfo counters (James M Snell) #66094
• [afa02fb69c] - process: use a class for nextTick resources (Matteo Collina) #66415
• [6299b09d5c] - (SEMVER-MINOR) process: graduate process.ref/unref from experimental (James M Snell) #66213
• [0965b28252] - querystring: speed up default parse and unescape (Yagiz Nizipli) #66175
• [bd547c1176] - quic: cleanly tear down QUIC after worker.terminate() (Tim Perry) #66093
• [52bbf8cb15] - report: skip unresponsive workers on process timeout (Trivikram Kamat) #66304
• [702c744643] - sea: add test and update docs for import() with code