chore(deps): update node.js to v26.9.0 - #907
Merged
Merged
Conversation
Codecov Report✅ All modified and coverable lines are covered by tests. 🚀 New features to boost your workflow:
|
renovate
Bot
force-pushed
the
renovate/node-26.x
branch
from
September 17, 2026 05:02
12e886f to
13f79a7
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
26.8.2→26.9.0Release Notes
nodejs/node (node)
v26.9.0: 2026-09-16, Version 26.9.0 (Current), @aduh95Compare Source
Notable Changes
d414624dce] - (SEMVER-MINOR) crypto: add a generic MAC API (Filip Skokan) #655537ac458f802] - (SEMVER-MINOR) crypto: discover ciphers from OpenSSL providers (Filip Skokan) #654847c7e95a3bd] - (SEMVER-MINOR) crypto: discover hashes from OpenSSL providers (Filip Skokan) #654842d2f4f6d1a] - (SEMVER-MINOR) ffi: enable module by default (Matteo Collina) #65475657415c6df] - (SEMVER-MINOR) lib: implementnode:bench(James M Snell) #65606ebcfec2f0c] - (SEMVER-MINOR) perf_hooks: implement HistogrammeanCIAPI (James M Snell) #65606e1913630c3] - (SEMVER-MINOR) perf_hooks: add CBOR export/import for histogram exchange (James M Snell) #654348e9151c9f2] - (SEMVER-MINOR) src: let embedders supply a builtin code cache without a snapshot (Shelley Vohr) #65352889854f18b] - (SEMVER-MINOR) src,lib: implement experimental DTLS API (James M Snell) #631825198142c59] - (SEMVER-MINOR) vfs: integrate with CJS and ESM module loaders (Matteo Collina) #636535af9d72e7f] - (SEMVER-MINOR) worker: add support for Web Workers (Aviv Keller) #64894Commits
59dcad3f44] - (SEMVER-MINOR) benchmark: implement node:bench version of bench tools (James M Snell) #656066bdb6dd8fa] - benchmark: fix max-regressions detection in compare.js (James M Snell) #6558749d40091ba] - benchmark: add --analyze option to benchmark/scatter.js (James M Snell) #65594bd40a9a19a] - benchmark: add crypto class benchmarks (Filip Skokan) #655186bff2238f5] - buffer: pad aligned allocations by a multiple of 8 (Lazizbek Ergashev) #6560537d12946dd] - buffer: prevent abort on indexOf with lone surrogate needle (Rafael Gonzaga) #6543002f8eb3b2d] - build: add--shared-perfettoflag (Antoine du Hamel) #65614fe7032ec41] - build: enable V8 gdb/lldb plugin support (Chengzhong Wu) #65786109f2caf80] - build: allow linking shared dependencies in the GN build (Shelley Vohr) #6579755213fd8a8] - build: enable the V8 sandbox in shared-cage builds (Shelley Vohr) #62237120929a1b3] - build: add--shared-highwayconfigure flag (Antoine du Hamel) #65686c99af0942b] - build: add--shared-abseilconfigure flag (Antoine du Hamel) #65682431c2bf0eb] - build: define V8_CONTIGUOUS_COMPRESSED_RO_SPACE for shared cage (Shelley Vohr) #65464b6b5764c6e] - build: remove obsolete configure flags (Chengzhong Wu) #65456a623ee29d9] - build,src: make --use-largepages a no-op (Joyee Cheung) #653892f494cb7aa] - crypto: fix multi-prime RSA JWKs (Filip Skokan) #65649501d8ac815] - crypto: cache valid ECDH key pairs (Filip Skokan) #656153fd905ea8f] - crypto: add strict mode to --force-fips (Filip Skokan) #6564554b3cdb805] - crypto: add FIPS indicator diagnostics channel (Filip Skokan) #656453e6e931fc9] - crypto: fix public PKCS8 export error (한국) #65609d414624dce] - (SEMVER-MINOR) crypto: add a generic MAC API (Filip Skokan) #65553eef579047c] - crypto: validate JWK usages before key_ops (Filip Skokan) #655509a9b137a24] - crypto: fix private SPKI export error (Filip Skokan) #655509941fb5dab] - crypto: fix RSA-PSS oversized salt handling (Filip Skokan) #6555009b431596a] - crypto: correct CCM decryption FIPS error message (kyungrae) #65450e6b34e6f7a] - crypto: harden X509Certificate state (Filip Skokan) #65518a884b6ccbc] - crypto: optimize key slot caching (Filip Skokan) #65518fb512086d3] - crypto: add null checks for OPENSSL_INIT_new() (Nora Dossche) #63457656504ffc0] - crypto: prevent Hmac.digest() from returning uninitialized memory (Matteo Collina) #6511215e7884732] - crypto: avoid throwing CryptoKey brand checks (Filip Skokan) #655033302bec74a] - crypto: avoid throwing KeyObject brand checks (Filip Skokan) #655037ac458f802] - (SEMVER-MINOR) crypto: discover ciphers from OpenSSL providers (Filip Skokan) #654847c7e95a3bd] - (SEMVER-MINOR) crypto: discover hashes from OpenSSL providers (Filip Skokan) #654840539e90110] - deps: update googletest to283c175(Node.js GitHub Bot) #65833e34af820da] - deps: update simdjson to 4.6.11 (Node.js GitHub Bot) #658345fb7ffebc2] - deps: update zlib to 1.3.2.1-motley-285e94b (Node.js GitHub Bot) #6583505cdf1db62] - deps: V8: backport1a00890(Jakob Linke) #657648910f7914a] - deps: V8: backportc9c0abf(Jakob Linke) #65764e7fd388424] - deps: V8: backportebd1578(Marja Hölttä) #6576482715158b8] - deps: V8: backportf3d4d45(Olivier Flückiger) #657027003159885] - diagnostics_channel: lazily create tracing context (Romain Lanz) #65513a97def782f] - doc: clarify node:bench significance policy (James M Snell) #65631c74091647d] - doc: clarify isolation modes for node:bench (James M Snell) #656313ef81a676c] - doc: clarify measurement integrity details of node:bench (James M Snell) #656316b565d7b2c] - doc: clarify security triage dispositions and permission boundaries (Rafael Gonzaga) #65436724981287c] - (SEMVER-MINOR) doc: move histogram.burnRate to correct location in doc (James M Snell) #65434f8b627c09b] - doc: fix default limit of maxHeadersCount (Aryn H) #65472aa3d94fc1d] - doc: fix return types for sync methods (Chiang Fong Lee) #58575fe9f452ddd] - doc: document REPL DEP0185 throws and uncaught-exception behavior (Adrián Estrada) #649936b84ee66fa] - errors: validate constructor name (Christian Aurich) #65607ed1b629901] - events: fix weak listener retention overwrite (Aryan) #640247b4c17f723] - ffi: throw on missing memory helper arguments (Soul Lee) #65500cf78d4260e] - ffi: include SharedArrayBuffer in error message (Donghoon Kang) #657352d2f4f6d1a] - (SEMVER-MINOR) ffi: enable module by default (Matteo Collina) #65475bdcb6def4e] - ffi: validate DynamicLibrary getter receivers (Trivikram Kamat) #654155d24a8fe37] - fs: copy directory trees for fs.cp() on the thread pool (Shelley Vohr) #6548840bdf32d91] - fs: give directories created by cpSync the source directory's mode (Shelley Vohr) #654886ac1bc040f] - fs: write files in one thread pool round trip (Shelley Vohr) #65489b4b89c08c1] - fs: handle recursive watch setup races (Filip Skokan) #6569954a1311d9e] - fs: apply nocase to literal glob exclude patterns (Yusuke Hayashi) #648172130460831] - fs: improve performance of recursive directory read (Aviv Keller) #65524ab7f4c88b7] - fs: do not descend into symlinks for ** unless following symlinks (RafaelGSS) #65435e990324e7a] - fs: watch directories, not files, in recursive fs.watch fallback (Shelley Vohr) #65486b6db21972a] - fs: preserve directory timestamps in cp (Abhinandan Kumar) #65540d418ca140e] - fs: fix recursive watch error handling (Filip Skokan) #65635ea372bf9c9] - fs: cancel in-flight stat on abort (Mert Can Altin) #63142458664073e] - fs: fix rmSync error messages for non-ASCII paths (Yeaseen) #6123334b38235c3] - fs: add maxDepth option to glob (Alexander Lichter) #64003e3cc0d9313] - http: fast-forward teardown of unread messages (Matteo Collina) #65732f9175a212c] - http: coalesce chunked writes during auto-corking (GetThatCookie) #64987b4a7cd3efb] - http2: fix write deadlock exposed by larger window sizes (Tim Perry) #65440b7e97f6cfd] - http2: error for incomplete reads on RST, auto-drain, deprecate aborted (Tim Perry) #63249d62989dbdf] - http2: fix async context loss when trailers carry END_STREAM (Orgad Shaneh) #638148aba314f87] - https: limit proxy CONNECT response headers (Matteo Collina) #64545bea74e1cb5] - lib: put node:bench behind an --experimental-bench flag (James M Snell) #659202835523960] - lib: fixup node:bench handling of --require option (James M Snell) #65631aae83d87a4] - lib: improve diagnostic message support (James M Snell) #65631ba7baed423] - lib: have runFile honor permissions and accept URL/Buffer paths (James M Snell) #6563155103db988] - lib: add runFile api to node:bench (James M Snell) #656310a4c50eb76] - lib: add context.diagnostic api to node:bench (James M Snell) #65631476e25e864] - lib: addbench:planevent tonode:bench(James M Snell) #6563167cf0e556f] - lib: clarify mean in node:bench docs (James M Snell) #65631f85f72ad42] - lib: improve node:bench stream handling (James M Snell) #65631b32b09f56b] - lib: add runId, fileRunId, entryFile, namePath to node:bench (James M Snell) #656314b9b53f958] - (SEMVER-MINOR) lib: addnode:benchexplicit createRunner (James M Snell) #65606d9f18171f0] - (SEMVER-MINOR) lib: complete the implementation of node:bench and cli (James M Snell) #65606c39e20e9ca] - (SEMVER-MINOR) lib: implement bench/reporters (James M Snell) #65606657415c6df] - (SEMVER-MINOR) lib: implement node:bench (James M Snell) #6560646863a7f9c] - lib: useFloat16Arrayfrom primordials (Antoine du Hamel) #65702cbd0948138] - lib: defer source map payload decoding until first use (Shelley Vohr) #654901ddb1c8934] - lib: optimize async context frame activation (Tim Perry) #6551902f6feef7e] - lib: use validateArray for array arguments (JunHwan Choi) #65344962795ab8c] - lib: apply minor dtls cleanups (James M Snell) #63539c07b2ab8a9] - lib,benchmark: address multiple review issues (James M Snell) #6563154a5e25f72] - module: derive builtinModules from enabled builtin set (Jungwon Sohn) #65418c93a90cf12] - net: fix BlockList.fromJSON for IPv4-mapped IPv6 rules (Daijiro Wachi) #64125506d23b76f] - net: recognize bare IPv6 loopback addresses in isLoopback (Daijiro Wachi) #6361981cd6d7b78] - net: improve dtls cert verification (James M Snell) #6431451d094e26b] - node-api: make object property arrays const (Yilong Li) #65621875c7ecee2] - node-api: enter env context for async callbacks (Shelley Vohr) #65406ebcfec2f0c] - (SEMVER-MINOR) perf_hooks: implement Histogram meanCI API (James M Snell) #6560609b333bcc5] - perf_hooks: add missing resource timing attributes (greenhead) #65017e1913630c3] - (SEMVER-MINOR) perf_hooks: add CBOR export/import for histogram exchange (James M Snell) #6543467a78317dd] - permission: do not enforce fs and addons in audit mode (Issac) #6565919e69e5f72] - permission: support URL and Uint8Array as has()/drop() reference (Seungmin Nam) #65492168af4d8d7] - permission: block FileHandle fsync and fdatasync (Rafael Gonzaga) #65431855fff682f] - quic: stop guarding ngtcp2_recv_stop_sending callback field (René) #65688d30df2a3e1] - quic: reuse TLS pause machinery to drop event deferral & improve 0RTT (Tim Perry) #65522fce1b6a482] - quic: remove unused fin flag from blob reader wakeup (trivenay) #65315c721aabfb7] - quic: apply multiple fixes to flow control signaling (James M Snell) #653092c552cd32c] - quic: release stream arenas before cleanup (Trivikram Kamat) #65410487662717b] - sea: mount bundled assets as a virtual file system (Matteo Collina) #656750ec15a2a54] - sea: keep ELF segments on separate pages in --build-sea output (Shelley Vohr) #655641627fd6561] - sqlite: re-validate database state after reading options (Trevor Burnham) #6559518c3867d19] - sqlite: run backup completion in callback scope (Filip Skokan) #65666a77d738683] - sqlite: copy changeset before applying it (Matteo Collina) #65286b5f0558c84] - sqlite: reject closing a session from a callback (Trevor Burnham) #654545f95032859] - sqlite: keep sessions alive across SQLite callbacks (Trevor Burnham) #654652ce0e2eb10] - sqlite: throw on disposal of an in-use session (Guilherme Araújo) #65449f66ed89136] - src: fix use-after-free in CleanupHookThunkRun (Caleb Everett) #6563014613fdc3e] - (SEMVER-MINOR) src: fixup histogram and options linting issues (James M Snell) #656066db3f662cf] - src: fix startup snapshot reproducibility of InternalFieldInfo (Chengzhong Wu) #656848e9151c9f2] - (SEMVER-MINOR) src: let embedders supply a builtin code cache without a snapshot (Shelley Vohr) #65352760337aa5b] - src: fix live lock between environments with blocked requests (Ilyas Shabi) #65520f2a588c385] - src: apply IsolateSettings when using a snapshot (Shelley Vohr) #654072fd50ae915] - src: add re-entrancy guard to TriggerUncaughtException (Temuulen Undrakhbayar) #64327e260fd146c] - src: reuse cached strings in CompileSerializeMain (agape1225) #654530650dca863] - src: add missing vector include (Filip Skokan) #656226e9d44d1fe] - src: disable V8 external memory reasonable size check (Paul Bouchon) #655899c46e56303] - src: report libuv error when openAsBlob cannot stat (Paul Bouchon) #65517a0aaff6b07] - src: list scripts when--runhas no command (James Ross) #64606469590c155] - src: fixup manual new/delete usages (James M Snell) #653485902acf031] - src: make the options structs smaller with packed bits (James M Snell) #651450c24639a5a] - (SEMVER-MINOR) src, lib: add stats to dtls (James M Snell) #63182652fbc286e] - (SEMVER-MINOR) src,lib: add dtls interop tests (James M Snell) #63182889854f18b] - (SEMVER-MINOR) src,lib: implement experimental DTLS API (James M Snell) #6318276538d519c] - stream: use webidl validation semantics for args (James M Snell) #65658649a4aba93] - stream: ensure that stateful transforms preserve this (James M Snell) #6565823220992c0] - stream: fix nested async flushing with infinite sources (James M Snell) #656583ad1338139] - stream: ensure from() observes returned rejecting promise correctly (James M Snell) #65658cafdee6369] - stream: apply source normalization once at call time (James M Snell) #65658edb83cb620] - stream: make consumer signals on longer alter source precedence (James M Snell) #6565856bdd765df] - stream: make pipeTo source normalization independent of Writer (James M Snell) #65658037c07af2b] - stream: pre-aborted pipeTo now applies dest failure handling (James M Snell) #656587308492d48] - stream: ensure pre-existing writes drain before EOF and end() waits (James M Snell) #65658756773477b] - stream: ensure async dispoal after endSync awaits for drain (James M Snell) #65658042b951312] - stream: ensure factory signals remain active through closing (James M Snell) #656582dc09ca9ca] - stream: canWrite and ondrain now reflect physical capacity (James M Snell) #656589192fbb6dd] - stream: skip unobserved 'readable' emission at EOF (Matteo Collina) #65749dc25a61e7a] - stream: avoid per-chunk promises in webstream adapters (Matteo Collina) #6554882ae196af6] - stream: address stream/iter review feedback (James M Snell) #656523b37b48592] - stream: replace object sentinel with symbol (James M Snell) #65652b6424b6612] - stream: ensure pipeToSync requires synchronous close (James M Snell) #65652830fc81acf] - stream: cancel active stream/iter pulls (James M Snell) #6565230606908de] - stream: fix merge settlement tagging and falsy error tracking (James M Snell) #656527319198755] - stream: ensure full-close semantics when closed (James M Snell) #65652bf5acb783f] - stream: defend against re-entrancy in writev (James M Snell) #65652b01594f93a] - stream: ensure stability of stored metadata (James M Snell) #656527bfd81ab09] - stream: fixup writer to terminate on consumer return/throw (James M Snell) #65652dc2483c38d] - stream: ensure iterator cleanup on done, reject, etc (James M Snell) #65652f6fac6f7f0] - stream: fixup cancelation handling in pull() (James M Snell) #65652dfe0617e71] - stream: fix early drain after Utf8Stream reopen (Matteo Collina) #65633900fae0a24] - test: split test-bench-cli to try deflaking it (James M Snell) #6591931f4bd73b2] - test: make node:bench test samples survive a coarse clock (Shelley Vohr) #65780e0fa1893c3] - test: do not dump core in external memory limit test (Shelley Vohr) #6578000ad283b8d] - test: zero-fill buffers before the string length limit check (Christian Aurich) #6575570763fcc46] - test: expand test coverage of node:bench (James M Snell) #656315a38e6b115] - (SEMVER-MINOR) test: fix node:bench test timing (James M Snell) #65606536ae0e24b] - (SEMVER-MINOR) test: improve node:bench test coverage (James M Snell) #65606eec66d529c] - (SEMVER-MINOR) test: update bench tests to not fail on no-crypto (James M Snell) #65606ce7b349de5] - test: bump WPT webidl and interfaces (Filip Skokan) #65679ec96f8dc23] - test: update WPT for url toc23755a(Node.js GitHub Bot) #65651ebe2ac248b] - test: fix recursive fs.watch error fixture (Filip Skokan) #65683a19912ee8f] - test: update streams WPT (Jeong SeokChan) #6563814b5dfc63d] - test: removeconsole.logcall innode_run_list(Antoine du Hamel) #655723f67df139c] - test: expect node:ffi to be enabled by default (Matteo Collina) #65636b9ee2e67bf] - (SEMVER-MINOR) test: use native builder for legacy SEA tests (Filip Skokan) #6555353a29d0894] - test: use common spawnSync helpers in more tests (greenhead) #655525c680a50f4] - test: add coverage for removeEventListener boolean capture (Lazizbek Ergashev) #652456f99474912] - test: deflake fastutf8stream destroy and reopen tests (Christian Aurich) #655542342b2bf30] - test: cover Readable.from() sync iterator errors (jakecastelli) #655151e455a4ffe] - test: support inspecting WPTs in child processes (Filip Skokan) #655101f7cab588e] - test: document WPT runner workflows (Filip Skokan) #65510d39a902cec] - test: simplify test-worker-heap-profile.js (Donghoon Kang) #6537290d1b863f7] - test: keep WPT backend checks alive (Filip Skokan) #65320be60c34b52] - (SEMVER-MINOR) test: enable multi-global WPTs (Filip Skokan) #64894d04cfcda8e] - (SEMVER-MINOR) test: add opt-in process WPT runner (Filip Skokan) #64894715c21f805] - (SEMVER-MINOR) test: accomodate multi-global tests in WPT{Runner,TestSpec,Report} (Filip Skokan) #648949aa8489a01] - test: fix lint in dtls tests (Matteo Collina) #649026a3d8a6d9f] - tls: read the peer certificate chain without consuming it (Tony Gies) #656022e519f8fef] - tls,quic: commonize TLS cert handling between tls, dtls & quic (Tim Perry) #647112266c14051] - tools: add GHA workflow to test vendored Perfetto (Antoine du Hamel) #6561419779f121f] - tools: fix the list of globals in ESLint config files (Antoine du Hamel) #65281b57db8dfd3] - typings: add types for performance binding (Jungwon Sohn) #65574371e2260f4] - typings: add encodeIntoResults to EncodingBinding (greenhead) #65350417cdd8a77] - typings: add typing for permission binding (Seungmin Nam) #65385a82cc7097f] - url: align URLPatternInit dictionary conversion with WebIDL (Piyush Yadav) #654980e8f7b96b0] - util: canonicalize namespaced tags in inspect() (René) #63257acd2bb10ce] - v8: add setHeapProfileNearHeapLimit (Ilyas Shabi) #64676d0535b1041] - vfs: load native addons from a mounted file system (Philipp Dunkel) #65680ea6f70ba41] - vfs: fix rename over non-empty directory (Christian Aurich) #65613b4f6b3798a] - vfs: add ZipProvider (Philipp Dunkel) #649155198142c59] - (SEMVER-MINOR) vfs: integrate with CJS and ESM module loaders (Matteo Collina) #6365338192126e2] - worker: start worker threads from the built-in snapshot (Shelley Vohr) #6533656144ea80a] - worker: add ref/unref to web workers (Aviv Keller) #655077231c13b8a] - (SEMVER-MINOR) worker: add wpt tests for Web Workers (Aviv Keller) #648945af9d72e7f] - (SEMVER-MINOR) worker: add support for Web Workers (Aviv Keller) #64894069a1b1200] - zlib: avoid waiting for paused ZIP iterators (Trivikram Kamat) #65278Configuration
📅 Schedule: (UTC)
🚦 Automerge: Enabled.
♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR was generated by Mend Renovate. View the repository job log.