Catalog / Node.js

26.8.2

2026-09-09, Version 26.8.2 (Current), @aduh95

todaysecurityaddedchangedOriginal notes

Notable Changes

  • [616bd3fa26] - doc: deprecate Server.prototype._listen2 in node:net (Antoine du Hamel) #65593
  • [ae1801eb55] - meta: refine the security vuln posture for experimental features (James M Snell) #65438
  • [09feba74c8] - deps: update Undici to 8.10.2 (Node.js GitHub Bot) #65788
  • [7efdbe3eb9] - deps: update OpenSSL to 3.5.8 (Node.js GitHub Bot) #65542

Commits

  • [d8aedd6584] - build: skip dockit on riscv64 (Stewart X Addison) #62251
  • [1899c274eb] - build: activate correct default flags for riscv64 (Stewart X Addison) #65708
  • [ec8a3be996] - build: derive NODE_ARCH from target_cpu in the GN build (Shelley Vohr) #65491
  • [b73118a507] - build,win: remove LTO parallelisation limit (Stefan Stojanovic) #65535
  • [09feba74c8] - deps: update undici to 8.10.2 (Node.js GitHub Bot) #65788
  • [e47c432dd6] - deps: upgrade npm to 11.19.1 (npm team) #65573
  • [2fd6ce36a9] - deps: update corepack to 0.36.0 (Node.js GitHub Bot) #65653
  • [49dec2767a] - deps: update googletest to 36ba75f0ad5383a9759f17f3f72fd4661c72cb6d (Node.js GitHub Bot) #65654
  • [676174a071] - deps: update simdjson to 4.6.9 (Node.js GitHub Bot) #65655
  • [2f1b7fa0bb] - deps: update perfetto to 58.2 (Node.js GitHub Bot) #65656
  • [12acd0ad15] - deps: update zlib to 1.3.2.1-motley-5eb4d7e (Node.js GitHub Bot) #65494
  • [48631c80fb] - deps: update archs files for openssl-3.5.8 (Node.js GitHub Bot) #65542
  • [7efdbe3eb9] - deps: upgrade openssl sources to openssl-3.5.8 (Node.js GitHub Bot) #65542
  • [bdc75900ee] - doc: replace node:modules documentation header (René) #65800
  • [44c8a499ba] - doc: clarify return type of fs.mkdtemp* (Antoine du Hamel) #65743
  • [025fb5eeb0] - doc: update changelog-maker instructions for releasing (Juan José) #65707
  • [5f64847afa] - doc: add stability status to crypto.setEngine (Antoine du Hamel) #65746
  • [299dee0cb9] - doc: remove outdated TLS authorized warning (Tim Perry) #65597
  • [e97dcc0278] - doc: fix broken using link in ffi.md (Soul Lee) #65632
  • [2c9cc7d237] - doc: fix some broken links (Antoine du Hamel) #65583
  • [0c330ec329] - doc: fix stale TOC in maintaining-dependencies (greenhead) #65523
  • [9c522a3a69] - doc: refactor the AI guidelines (Joyee Cheung) #65269
  • [46cbf1bf8c] - doc: fix triggerAsyncId() comment in async_hooks example (soreavis) #64583
  • [788904ff78] - doc: fix fsPromises.watch overflow value (Matt Radbourne) #64605
  • [3d06ff19e8] - doc: clarify stream direction in options.stdio note (Avocado) #65236
  • [d334838379] - doc: clarify signal listener behavior (Som Samantray) #65243
  • [d55a2bd56a] - doc: add test reporter event lifecycle diagram (sangwook) #63780
  • [c17dfc87de] - doc: discourage AbortSignal cleanup for long-lived resources (Efe Karasakal) #64342
  • [616bd3fa26] - doc: deprecate Server.prototype._listen2 in node:net (Antoine du Hamel) #65593
  • [4e6d7e0ca6] - meta: cleanup targos emeritus changes (Antoine du Hamel) #65738
  • [a70cfe1747] - meta: bump github/codeql-action/init from 4.37.3 to 4.37.9 (dependabot[bot]) #65714
  • [e43a0ad4ce] - meta: bump github/codeql-action/autobuild from 4.37.3 to 4.37.9 (dependabot[bot]) #65717
  • [99e06288f1] - meta: bump actions/checkout from 7.0.0 to 7.0.1 (dependabot[bot]) #65718
  • [89662762b3] - meta: bump cachix/install-nix-action from 31.11.0 to 31.11.1 (dependabot[bot]) #65719
  • [6b8f078672] - meta: bump actions/setup-node from 6.4.0 to 7.0.0 (dependabot[bot]) #65720
  • [6c6fb18e63] - meta: bump step-security/harden-runner from 2.20.0 to 2.21.0 (dependabot[bot]) #65721
  • [0e002e859f] - meta: bump github/codeql-action/upload-sarif from 4.37.3 to 4.37.9 (dependabot[bot]) #65722
  • [98aaffe4b9] - meta: bump github/codeql-action/analyze from 4.37.3 to 4.37.9 (dependabot[bot]) #65723
  • [d247cb2975] - meta: document collaborator automation (Filip Skokan) #65671
  • [ae1801eb55] - meta: refine the security vuln posture for experimental features (James M Snell) #65438
  • [fab81d15c3] - test: widen the gap in the resolver maxTimeout comparison (Shelley Vohr) #65780
  • [62e2a6265c] - test: fix the thread-spawn handshake in the WASI threads fixture (Shelley Vohr) #65780
  • [7eb20b1810] - test: only count restarts after the write in watch emit-restarted test (Shelley Vohr) #65780
  • [14c3a77bc5] - test: ignore tunnel resets in proxy invalid-char-in-url test (Shelley Vohr) #65780
  • [ebc99e0560] - test: handle EPIPE in closed channel test (Christian Aurich) #65770
  • [5e73a2ca79] - test: deflake test-permission-net-udp-handle (Christian Aurich) #65767
  • [beb669f7de] - test: deflake test-runner-coverage (Christian Aurich) #65728
  • [ef4b6bfa62] - test: set type=none on IBM i for empty source (Abdirahim Musse) #65545
  • [027eef0691] - test: deflake WASI poll timing checks (Filip Skokan) #65672
  • [a352b0e2fe] - test: skip fs-watch-recursive-delete-race on AIX (Antoine du Hamel) #65698
  • [f9ce35aa43] - test: deflake test-inspect-async-hook-setup-at-inspect (Christian Aurich) #65584
  • [32281cec7b] - test: deflake test-watch-mode-restart-esm-loading-error (Christian Aurich) #65623
  • [79be5d61be] - test: avoid orphaned child on Windows abort test (Kirill Saied) #65451
  • [8972b8540b] - test: fix link-local dgram scope assertion (Filip Skokan) #65629
  • [b7cd1d96de] - test: riscv64: skip node-api sea test (Stewart X Addison) #65569
  • [7eeb9d0e57] - test: mark platform-specific tests as flaky (Filip Skokan) #65562
  • [649ac82bda] - test: account for varied OpenSSL CCM final behaviours (Filip Skokan) #65542
  • [050fb1a15d] - tools: bump @humanfs/node from 0.16.7 to 0.16.8 in /tools/eslint (dependabot[bot]) #65757
  • [5314dda396] - tools: bump browserslist from 4.28.4 to 4.28.8 in /tools/eslint (dependabot[bot]) #65758
  • [5938a08929] - tools: do not hardcode yamllint path (Antoine du Hamel) #65747
  • [d8408f7415] - tools: refine contributor guidance workflow (Filip Skokan) #65745
  • [196e372b69] - tools: bump the eslint group in /tools/eslint with 4 updates (dependabot[bot]) #65716
  • [7e986b09f6] - tools: do not flag force push as invalid message (Antoine du Hamel) #65700
  • [837ce2ccef] - tools: do not hardcode path to Ruff (Antoine du Hamel) #65681
  • [1c7149a96a] - tools: retry first-time contributor query (Filip Skokan) #65648
  • [bd310a2bea] - tools: query first-time contributor status (Filip Skokan) #65592
  • [ab7b57e547] - tools: offset GitHub crons by 3 minutes (Michaël Zasso) #65612
  • [62ece28eae] - tools: label PRs lacking second approval (Filip Skokan) #65538
  • [68227b4029] - tools: welcome first-time contributors (Filip Skokan) #65533
  • [490dc93e37] - tools: enable concurrency for eslint (Huáng Jùnliàng) #62352
  • [d794676217] - typings: fix fs_event_wrap start filename type (leah-1ee) #65661
  • [29e2b5a325] - typings: add fs_event_wrap internal binding types (leah-1ee) #65661
  • [6357c8f56e] - typings: add stream_pipe internal binding types (Seongeun Lee) #65664
  • [569720ac7f] - typings: add profiler internal binding types (Seongeun Lee) #65660
  • [52ae89c69d] - typings: add ffi internal binding types (Donghoon Kang) #65734
  • [22c7469062] - typings: update zlib binding declarations (이혜미) #65639