node-bin-darwin-arm64 26.4.0 → 26.5.1

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (8) hide show
  1. package/CHANGELOG.md +189 -0
  2. package/README.md +5 -2
  3. package/bin/node +0 -0
  4. package/include/node/common.gypi +2 -1
  5. package/include/node/node_version.h +2 -2
  6. package/include/node/v8-promise.h +2 -2
  7. package/package.json +1 -1
  8. package/share/man/man1/node.1 +10 -5
package/CHANGELOG.md CHANGED
@@ -8,6 +8,8 @@
8
8
  </tr>
9
9
  <tr>
10
10
  <td>
11
+ <a href="#26.5.1">26.5.1</a><br/>
12
+ <a href="#26.5.0">26.5.0</a><br/>
11
13
  <a href="#26.4.0">26.4.0</a><br/>
12
14
  <a href="#26.3.1">26.3.1</a><br/>
13
15
  <a href="#26.3.0">26.3.0</a><br/>
@@ -46,6 +48,193 @@
46
48
  * [io.js](CHANGELOG_IOJS.md)
47
49
  * [Archive](CHANGELOG_ARCHIVE.md)
48
50
 
51
+ <a id="26.5.1"></a>
52
+
53
+ ## 2026-07-29, Version 26.5.1 (Current), @RafaelGSS
54
+
55
+ This is a security release.
56
+
57
+ ### Notable Changes
58
+
59
+ * (CVE-2026-56848) http2: defer rst stream while in scope (Matteo Collina) – High
60
+ * (CVE-2026-58043) permission: avoid granting radix split nodes (RafaelGSS) – High
61
+ * (CVE-2026-56850) https: distinguish PFX object-array agent keys (RafaelGSS) – Medium
62
+ * (CVE-2026-58040) https: bind identity checks to session reuse (Matteo Collina) – Medium
63
+ * (CVE-2026-58041) sqlite: invalidate tag store iterators on statement reset (Matteo Collina) – Medium
64
+ * (CVE-2026-58042) dns: handle large resolveAny address replies (RafaelGSS) – Medium
65
+ * (CVE-2026-58045) zlib: throw on out-of-bounds write buffers (RafaelGSS) – Medium
66
+ * (CVE-2026-56847) permission: enforce fs write permission for trace events (RafaelGSS) – Low
67
+ * (CVE-2026-58039) permission: check final report output path (RafaelGSS) – Low
68
+ * (CVE-2026-58044) http: reject requests exceeding max header count (Matteo Collina) – Low
69
+ * deps: update llhttp to 9.4.3 (Paolo Insogna)
70
+ * deps: update undici to 8.9.0 (Node.js GitHub Bot)
71
+
72
+ ### Commits
73
+
74
+ * \[[`af0bf96877`](https://github.com/nodejs/node/commit/af0bf96877)] - **deps**: update llhttp to 9.4.3 (Paolo Insogna) [nodejs-private/node-private#935](https://github.com/nodejs-private/node-private/pull/935)
75
+ * \[[`0354678355`](https://github.com/nodejs/node/commit/0354678355)] - **deps**: update undici to 8.9.0 (Node.js GitHub Bot) [#64712](https://github.com/nodejs/node/pull/64712)
76
+ * \[[`dbeeaeec13`](https://github.com/nodejs/node/commit/dbeeaeec13)] - **(CVE-2026-58042)** **dns**: handle large resolveAny address replies (RafaelGSS) [nodejs-private/node-private#929](https://github.com/nodejs-private/node-private/pull/929)
77
+ * \[[`064d339f56`](https://github.com/nodejs/node/commit/064d339f56)] - **(CVE-2026-58044)** **http**: reject requests exceeding max header count (Matteo Collina) [nodejs-private/node-private#922](https://github.com/nodejs-private/node-private/pull/922)
78
+ * \[[`23b94c843a`](https://github.com/nodejs/node/commit/23b94c843a)] - **(CVE-2026-56848)** **http2**: defer rst stream while in scope (Matteo Collina) [nodejs-private/node-private#921](https://github.com/nodejs-private/node-private/pull/921)
79
+ * \[[`c7ec3dc0b9`](https://github.com/nodejs/node/commit/c7ec3dc0b9)] - **(CVE-2026-58040)** **https**: bind identity checks to session reuse (Matteo Collina) [nodejs-private/node-private#904](https://github.com/nodejs-private/node-private/pull/904)
80
+ * \[[`8f666925b1`](https://github.com/nodejs/node/commit/8f666925b1)] - **(CVE-2026-56850)** **https**: distinguish PFX object-array agent keys (RafaelGSS) [nodejs-private/node-private#930](https://github.com/nodejs-private/node-private/pull/930)
81
+ * \[[`ad99d075b1`](https://github.com/nodejs/node/commit/ad99d075b1)] - **(CVE-2026-58043)** **permission**: avoid granting radix split nodes (RafaelGSS) [nodejs-private/node-private#911](https://github.com/nodejs-private/node-private/pull/911)
82
+ * \[[`61222008b7`](https://github.com/nodejs/node/commit/61222008b7)] - **(CVE-2026-58039)** **permission**: check final report output path (RafaelGSS) [nodejs-private/node-private#908](https://github.com/nodejs-private/node-private/pull/908)
83
+ * \[[`3cb607dfc4`](https://github.com/nodejs/node/commit/3cb607dfc4)] - **(CVE-2026-56847)** **permission**: enforce fs write permission for trace events (RafaelGSS) [nodejs-private/node-private#924](https://github.com/nodejs-private/node-private/pull/924)
84
+ * \[[`d08fde8a16`](https://github.com/nodejs/node/commit/d08fde8a16)] - **(CVE-2026-58041)** **sqlite**: invalidate tag store iterators on statement reset (Matteo Collina) [nodejs-private/node-private#896](https://github.com/nodejs-private/node-private/pull/896)
85
+ * \[[`b3fbb6e11f`](https://github.com/nodejs/node/commit/b3fbb6e11f)] - **(CVE-2026-58045)** **zlib**: throw on out-of-bounds write buffers (RafaelGSS) [nodejs-private/node-private#931](https://github.com/nodejs-private/node-private/pull/931)
86
+
87
+ <a id="26.5.0"></a>
88
+
89
+ ## 2026-07-08, Version 26.5.0 (Current), @richardlau
90
+
91
+ ### Notable Changes
92
+
93
+ #### New release key
94
+
95
+ Welcome to our newest releaser, [Stewart X Addison](https://github.com/sxa). Future Node.js releases may be signed with his [release key](https://github.com/nodejs/node/blob/main/README.md#release-keys), `655F3B5C1FB3FA8D1A0CA6BDE4A7D232B936D2FD`.
96
+
97
+ #### Other notable changes
98
+
99
+ * \[[`55f48446c7`](https://github.com/nodejs/node/commit/55f48446c7)] - **(SEMVER-MINOR)** **buffer**: implement blob.textStream() (Matthew Aitken) [#64036](https://github.com/nodejs/node/pull/64036)
100
+ * \[[`b373202efc`](https://github.com/nodejs/node/commit/b373202efc)] - **(SEMVER-MINOR)** **esm**: add `--experimental-import-text` flag (Efe) [#62300](https://github.com/nodejs/node/pull/62300)
101
+ * \[[`39e0c14455`](https://github.com/nodejs/node/commit/39e0c14455)] - **(SEMVER-MINOR)** **perf\_hooks**: sample delay per event loop iteration (Pablo Erhard) [#62935](https://github.com/nodejs/node/pull/62935)
102
+ * \[[`999a83c937`](https://github.com/nodejs/node/commit/999a83c937)] - **(SEMVER-MINOR)** **stream**: expose ReadableStreamTee (Matteo Collina) [#64195](https://github.com/nodejs/node/pull/64195)
103
+ * \[[`4e0236dc3d`](https://github.com/nodejs/node/commit/4e0236dc3d)] - **(SEMVER-MINOR)** **tls**: report negotiated TLS groups (Filip Skokan) [#64119](https://github.com/nodejs/node/pull/64119)
104
+
105
+ ### Commits
106
+
107
+ * \[[`87648c0a6c`](https://github.com/nodejs/node/commit/87648c0a6c)] - **benchmark**: trim down the argon2 sets (Filip Skokan) [#64218](https://github.com/nodejs/node/pull/64218)
108
+ * \[[`a483bfd3f0`](https://github.com/nodejs/node/commit/a483bfd3f0)] - **buffer**: remove unreachable overflow check in atob (haramjeong) [#60161](https://github.com/nodejs/node/pull/60161)
109
+ * \[[`6d14279688`](https://github.com/nodejs/node/commit/6d14279688)] - **buffer**: add fast api for isUtf8 and isAscii (Gürgün Dayıoğlu) [#64169](https://github.com/nodejs/node/pull/64169)
110
+ * \[[`55f48446c7`](https://github.com/nodejs/node/commit/55f48446c7)] - **(SEMVER-MINOR)** **buffer**: implement blob.textStream() (Matthew Aitken) [#64036](https://github.com/nodejs/node/pull/64036)
111
+ * \[[`a67d9a7a44`](https://github.com/nodejs/node/commit/a67d9a7a44)] - **build**: allow linting node.1 (Aviv Keller) [#64157](https://github.com/nodejs/node/pull/64157)
112
+ * \[[`06c1fbc25b`](https://github.com/nodejs/node/commit/06c1fbc25b)] - **build**: enable Maglev for riscv64 (Jamie Magee) [#62605](https://github.com/nodejs/node/pull/62605)
113
+ * \[[`518309c363`](https://github.com/nodejs/node/commit/518309c363)] - **build**: suppress clang errors building libffi on Windows (René) [#64222](https://github.com/nodejs/node/pull/64222)
114
+ * \[[`6a80ab485c`](https://github.com/nodejs/node/commit/6a80ab485c)] - **build**: add manually-dispatched stress-test workflow (Joyee Cheung) [#64118](https://github.com/nodejs/node/pull/64118)
115
+ * \[[`f4e7bf1f1c`](https://github.com/nodejs/node/commit/f4e7bf1f1c)] - **build**: pin envinfo versions in github actions (Joyee Cheung) [#64117](https://github.com/nodejs/node/pull/64117)
116
+ * \[[`66f6ac0d86`](https://github.com/nodejs/node/commit/66f6ac0d86)] - **build**: support setting an emulator from configure script (Ivan Trubach) [#53899](https://github.com/nodejs/node/pull/53899)
117
+ * \[[`7f26c54aa6`](https://github.com/nodejs/node/commit/7f26c54aa6)] - **child\_process**: fix permission model propagation via NODE\_OPTIONS (Matteo Collina) [#63972](https://github.com/nodejs/node/pull/63972)
118
+ * \[[`32bb554f5b`](https://github.com/nodejs/node/commit/32bb554f5b)] - **crypto**: fix large DH generator validation (Tobias Nießen) [#64092](https://github.com/nodejs/node/pull/64092)
119
+ * \[[`0908d76ef6`](https://github.com/nodejs/node/commit/0908d76ef6)] - **crypto**: reject small-order EdDSA points during verify (Filip Skokan) [#64026](https://github.com/nodejs/node/pull/64026)
120
+ * \[[`7f7e5863c2`](https://github.com/nodejs/node/commit/7f7e5863c2)] - **deps**: update undici to 8.7.0 (Node.js GitHub Bot) [#64282](https://github.com/nodejs/node/pull/64282)
121
+ * \[[`af91029801`](https://github.com/nodejs/node/commit/af91029801)] - **deps**: update nghttp3 to 1.17.0 (Node.js GitHub Bot) [#64182](https://github.com/nodejs/node/pull/64182)
122
+ * \[[`2e500ba7b0`](https://github.com/nodejs/node/commit/2e500ba7b0)] - **deps**: update googletest to 8b53336594cc52213c6c2c7a0b29194fa896d039 (Node.js GitHub Bot) [#64181](https://github.com/nodejs/node/pull/64181)
123
+ * \[[`74e3aa24ba`](https://github.com/nodejs/node/commit/74e3aa24ba)] - **deps**: update sqlite to 3.53.3 (Node.js GitHub Bot) [#64180](https://github.com/nodejs/node/pull/64180)
124
+ * \[[`c7e57f55a7`](https://github.com/nodejs/node/commit/c7e57f55a7)] - **deps**: c-ares: cherry-pick 8ba37af8e3fb (René) [#64110](https://github.com/nodejs/node/pull/64110)
125
+ * \[[`879fdc4daf`](https://github.com/nodejs/node/commit/879fdc4daf)] - **deps**: V8: backport da20a197a7f9 (Kevin Gibbons) [#64101](https://github.com/nodejs/node/pull/64101)
126
+ * \[[`a640543a7c`](https://github.com/nodejs/node/commit/a640543a7c)] - **deps**: V8: cherry-pick 0cc9eb22c0b0 (Kevin Gibbons) [#64101](https://github.com/nodejs/node/pull/64101)
127
+ * \[[`feefd179e5`](https://github.com/nodejs/node/commit/feefd179e5)] - **deps**: V8: cherry-pick 1a391f98cc7a (Kevin Gibbons) [#64101](https://github.com/nodejs/node/pull/64101)
128
+ * \[[`8ef643d4b0`](https://github.com/nodejs/node/commit/8ef643d4b0)] - **deps**: update googletest to 0b1e895ba4226c2fda5ee0178c9b5b1195a741aa (Node.js GitHub Bot) [#64039](https://github.com/nodejs/node/pull/64039)
129
+ * \[[`9e50bb0655`](https://github.com/nodejs/node/commit/9e50bb0655)] - **dgram**: skip dns.lookup() for literal IP addresses (Ruben Bridgewater) [#64133](https://github.com/nodejs/node/pull/64133)
130
+ * \[[`dc052c095c`](https://github.com/nodejs/node/commit/dc052c095c)] - **diagnostics\_channel**: return original thenable (Stephen Belanger) [#62407](https://github.com/nodejs/node/pull/62407)
131
+ * \[[`a22a840293`](https://github.com/nodejs/node/commit/a22a840293)] - **doc**: clarify QUIC stream state wording (EduardF1) [#63660](https://github.com/nodejs/node/pull/63660)
132
+ * \[[`8d4bec2d71`](https://github.com/nodejs/node/commit/8d4bec2d71)] - **doc**: update Http2SecureServer.on("timeout") default value (YuSheng Chen) [#64187](https://github.com/nodejs/node/pull/64187)
133
+ * \[[`da88f70afa`](https://github.com/nodejs/node/commit/da88f70afa)] - **doc**: add note on visibility of CI failures to new contributor guide (Stewart X Addison) [#64256](https://github.com/nodejs/node/pull/64256)
134
+ * \[[`20ce359ccb`](https://github.com/nodejs/node/commit/20ce359ccb)] - **doc**: clarify HTTP/1.1 response ordering (Matteo Collina) [#64213](https://github.com/nodejs/node/pull/64213)
135
+ * \[[`05eae2835c`](https://github.com/nodejs/node/commit/05eae2835c)] - **doc**: recommend node-stress-single-test for flaky tests (Trivikram Kamat) [#64223](https://github.com/nodejs/node/pull/64223)
136
+ * \[[`3966eb67e7`](https://github.com/nodejs/node/commit/3966eb67e7)] - **doc**: fix typo in examples (Vas Sudanagunta) [#64184](https://github.com/nodejs/node/pull/64184)
137
+ * \[[`12a2b9daa3`](https://github.com/nodejs/node/commit/12a2b9daa3)] - **doc**: fix typo in node-config-schema.json (Hamid Reza Ghavami) [#64188](https://github.com/nodejs/node/pull/64188)
138
+ * \[[`0854482671`](https://github.com/nodejs/node/commit/0854482671)] - **doc**: clarify defense-in-depth issues (Matteo Collina) [#64215](https://github.com/nodejs/node/pull/64215)
139
+ * \[[`ef4915fc3a`](https://github.com/nodejs/node/commit/ef4915fc3a)] - **doc**: fix Fast FFI argument count in ffi.md (Daijiro Wachi) [#63960](https://github.com/nodejs/node/pull/63960)
140
+ * \[[`bb2eed863c`](https://github.com/nodejs/node/commit/bb2eed863c)] - **doc**: add sxa GPG key (ed25519) (Stewart X Addison) [#64193](https://github.com/nodejs/node/pull/64193)
141
+ * \[[`b7bf6e3a06`](https://github.com/nodejs/node/commit/b7bf6e3a06)] - **doc**: add guide and answers to FAQs for first-time contributors (Joyee Cheung) [#63685](https://github.com/nodejs/node/pull/63685)
142
+ * \[[`ff537ba858`](https://github.com/nodejs/node/commit/ff537ba858)] - **doc**: update `Http2Server.close` & `Http2SecureServer.close` (YuSheng Chen) [#63298](https://github.com/nodejs/node/pull/63298)
143
+ * \[[`f3db304588`](https://github.com/nodejs/node/commit/f3db304588)] - **doc**: update list of people in `SECURITY.md` (Richard Lau) [#64152](https://github.com/nodejs/node/pull/64152)
144
+ * \[[`2a126647b0`](https://github.com/nodejs/node/commit/2a126647b0)] - **doc**: clarify vfs is not a sandbox (Matteo Collina) [#64143](https://github.com/nodejs/node/pull/64143)
145
+ * \[[`85fc79dd9b`](https://github.com/nodejs/node/commit/85fc79dd9b)] - **doc**: fix broken links and duplicate stability label (Antoine du Hamel) [#64130](https://github.com/nodejs/node/pull/64130)
146
+ * \[[`189e830eb3`](https://github.com/nodejs/node/commit/189e830eb3)] - **doc**: add missing option to man page (Richard Lau) [#64156](https://github.com/nodejs/node/pull/64156)
147
+ * \[[`7a16ccccd0`](https://github.com/nodejs/node/commit/7a16ccccd0)] - **doc**: announce upcoming end of tier 2 support for macOS x64 (Antoine du Hamel) [#63931](https://github.com/nodejs/node/pull/63931)
148
+ * \[[`d5f826045f`](https://github.com/nodejs/node/commit/d5f826045f)] - **doc**: update toolchain for official AIX releases (Richard Lau) [#64068](https://github.com/nodejs/node/pull/64068)
149
+ * \[[`60abc4400f`](https://github.com/nodejs/node/commit/60abc4400f)] - **doc**: fix callback example import in fs docs (Kamal Rawal) [#63912](https://github.com/nodejs/node/pull/63912)
150
+ * \[[`e470c74a6c`](https://github.com/nodejs/node/commit/e470c74a6c)] - **doc**: fix keepAliveTimeout default in http.createServer options (Jahanzaib iqbal) [#63974](https://github.com/nodejs/node/pull/63974)
151
+ * \[[`851b460583`](https://github.com/nodejs/node/commit/851b460583)] - **esm**: improve ERR\_REQUIRE\_ASYNC\_MODULE (Joyee Cheung) [#64260](https://github.com/nodejs/node/pull/64260)
152
+ * \[[`0cd443df39`](https://github.com/nodejs/node/commit/0cd443df39)] - **esm**: print required top-level await locations without evaluating (Joyee Cheung) [#64154](https://github.com/nodejs/node/pull/64154)
153
+ * \[[`b373202efc`](https://github.com/nodejs/node/commit/b373202efc)] - **(SEMVER-MINOR)** **esm**: add `--experimental-import-text` flag (Efe) [#62300](https://github.com/nodejs/node/pull/62300)
154
+ * \[[`eacfbd0ca5`](https://github.com/nodejs/node/commit/eacfbd0ca5)] - **http**: add CONNECT method handling for default Host header with proxy (Archkon) [#64114](https://github.com/nodejs/node/pull/64114)
155
+ * \[[`aeb539a383`](https://github.com/nodejs/node/commit/aeb539a383)] - **http**: fix drain event with cork/uncork (David Evans) [#64038](https://github.com/nodejs/node/pull/64038)
156
+ * \[[`8e8874b216`](https://github.com/nodejs/node/commit/8e8874b216)] - **http**: document and validate options.path when it's in absolute-form (Joyee Cheung) [#64108](https://github.com/nodejs/node/pull/64108)
157
+ * \[[`eb2e96bc28`](https://github.com/nodejs/node/commit/eb2e96bc28)] - **inspector**: fix crash when writing to closed inspector socket (ympark2011) [#64209](https://github.com/nodejs/node/pull/64209)
158
+ * \[[`243b0e4e57`](https://github.com/nodejs/node/commit/243b0e4e57)] - **lib**: reject string "0" in validatePort when allowZero is false (Daijiro Wachi) [#64174](https://github.com/nodejs/node/pull/64174)
159
+ * \[[`34a537c0ed`](https://github.com/nodejs/node/commit/34a537c0ed)] - **lib**: use `__proto__: null` when calling `ObjectDefineProperty` (Antoine du Hamel) [#64239](https://github.com/nodejs/node/pull/64239)
160
+ * \[[`1f72393f19`](https://github.com/nodejs/node/commit/1f72393f19)] - **lib**: lazily initialize kEvents and kHandlers maps (Guilherme Araújo) [#63702](https://github.com/nodejs/node/pull/63702)
161
+ * \[[`92a3dc3191`](https://github.com/nodejs/node/commit/92a3dc3191)] - **lib,permission**: fix addon permission drop (Martin Wagner) [#64007](https://github.com/nodejs/node/pull/64007)
162
+ * \[[`87b8f2a296`](https://github.com/nodejs/node/commit/87b8f2a296)] - **meta**: fix linter warning in `stale.yml` (Antoine du Hamel) [#64281](https://github.com/nodejs/node/pull/64281)
163
+ * \[[`829c4a5913`](https://github.com/nodejs/node/commit/829c4a5913)] - **meta**: bump actions/cache from 5.0.5 to 6.1.0 (dependabot\[bot]) [#64248](https://github.com/nodejs/node/pull/64248)
164
+ * \[[`0808dcd31c`](https://github.com/nodejs/node/commit/0808dcd31c)] - **meta**: bump github/codeql-action/autobuild from 4.36.1 to 4.36.2 (dependabot\[bot]) [#64247](https://github.com/nodejs/node/pull/64247)
165
+ * \[[`64aa17058f`](https://github.com/nodejs/node/commit/64aa17058f)] - **meta**: bump github/codeql-action/analyze from 4.36.1 to 4.36.2 (dependabot\[bot]) [#64246](https://github.com/nodejs/node/pull/64246)
166
+ * \[[`873d1e0412`](https://github.com/nodejs/node/commit/873d1e0412)] - **meta**: bump actions/checkout from 6.0.2 to 7.0.0 (dependabot\[bot]) [#64245](https://github.com/nodejs/node/pull/64245)
167
+ * \[[`fe460ccf0b`](https://github.com/nodejs/node/commit/fe460ccf0b)] - **meta**: bump codecov/codecov-action from 6.0.1 to 7.0.0 (dependabot\[bot]) [#64244](https://github.com/nodejs/node/pull/64244)
168
+ * \[[`845c63ed50`](https://github.com/nodejs/node/commit/845c63ed50)] - **meta**: bump rtCamp/action-slack-notify from 2.3.3 to 2.4.0 (dependabot\[bot]) [#64243](https://github.com/nodejs/node/pull/64243)
169
+ * \[[`2cad2d6de5`](https://github.com/nodejs/node/commit/2cad2d6de5)] - **meta**: bump github/codeql-action/init from 4.36.1 to 4.36.2 (dependabot\[bot]) [#64242](https://github.com/nodejs/node/pull/64242)
170
+ * \[[`0ddde950c7`](https://github.com/nodejs/node/commit/0ddde950c7)] - **meta**: bump actions/setup-python from 6.2.0 to 6.3.0 (dependabot\[bot]) [#64241](https://github.com/nodejs/node/pull/64241)
171
+ * \[[`c0a8760d2f`](https://github.com/nodejs/node/commit/c0a8760d2f)] - **meta**: bump github/codeql-action/upload-sarif from 4.36.1 to 4.36.2 (dependabot\[bot]) [#64240](https://github.com/nodejs/node/pull/64240)
172
+ * \[[`f49704b9d0`](https://github.com/nodejs/node/commit/f49704b9d0)] - **meta**: clarify V8 flags are outside threat model (Matteo Collina) [#64224](https://github.com/nodejs/node/pull/64224)
173
+ * \[[`6b8dc58e6e`](https://github.com/nodejs/node/commit/6b8dc58e6e)] - **meta**: move one or more collaborators to emeritus (Node.js GitHub Bot) [#64057](https://github.com/nodejs/node/pull/64057)
174
+ * \[[`fe5260cca7`](https://github.com/nodejs/node/commit/fe5260cca7)] - **meta**: update status of past strategic initiatives (Joyee Cheung) [#63480](https://github.com/nodejs/node/pull/63480)
175
+ * \[[`7b01040008`](https://github.com/nodejs/node/commit/7b01040008)] - **meta**: speed up stale bot (Aviv Keller) [#64075](https://github.com/nodejs/node/pull/64075)
176
+ * \[[`874c46c24f`](https://github.com/nodejs/node/commit/874c46c24f)] - **meta**: update sccache version in test-linux-quic (René) [#64043](https://github.com/nodejs/node/pull/64043)
177
+ * \[[`48c5c86363`](https://github.com/nodejs/node/commit/48c5c86363)] - **module**: enable import support for addons by default (Chengzhong Wu) [#64221](https://github.com/nodejs/node/pull/64221)
178
+ * \[[`39e0c14455`](https://github.com/nodejs/node/commit/39e0c14455)] - **(SEMVER-MINOR)** **perf\_hooks**: sample delay per event loop iteration (Pablo Erhard) [#62935](https://github.com/nodejs/node/pull/62935)
179
+ * \[[`f90f1bd032`](https://github.com/nodejs/node/commit/f90f1bd032)] - **perf\_hooks**: add NODE\_PERFORMANCE\_GC\_MINOR\_MARK\_SWEEP constant (Attila Szegedi) [#63877](https://github.com/nodejs/node/pull/63877)
180
+ * \[[`bdf32628c7`](https://github.com/nodejs/node/commit/bdf32628c7)] - **process**: fix finalization cleanup ref tracking (Trivikram Kamat) [#64087](https://github.com/nodejs/node/pull/64087)
181
+ * \[[`9a65b7fff4`](https://github.com/nodejs/node/commit/9a65b7fff4)] - **quic**: drop version negotiation packets with oversized CIDs (Mohamed Sayed) [#64228](https://github.com/nodejs/node/pull/64228)
182
+ * \[[`2699fe4706`](https://github.com/nodejs/node/commit/2699fe4706)] - **quic**: fixes undefined handle in QuicStream kInspect (Marten Richter) [#64170](https://github.com/nodejs/node/pull/64170)
183
+ * \[[`00dea28bb3`](https://github.com/nodejs/node/commit/00dea28bb3)] - **repl**: lazy-load acorn and defer vm context creation (Daijiro Wachi) [#63879](https://github.com/nodejs/node/pull/63879)
184
+ * \[[`ce659a1cf9`](https://github.com/nodejs/node/commit/ce659a1cf9)] - **src**: fix escaping of single quotes in task runner (Antoine du Hamel) [#64089](https://github.com/nodejs/node/pull/64089)
185
+ * \[[`dbb3126e5c`](https://github.com/nodejs/node/commit/dbb3126e5c)] - **src**: abstract tracing agent for both legacy and perfetto (Chengzhong Wu) [#64053](https://github.com/nodejs/node/pull/64053)
186
+ * \[[`12edf1d68d`](https://github.com/nodejs/node/commit/12edf1d68d)] - **src**: avoid redundant call to `std::get_if<>()` (Tobias Nießen) [#64094](https://github.com/nodejs/node/pull/64094)
187
+ * \[[`eda91b6d01`](https://github.com/nodejs/node/commit/eda91b6d01)] - **src**: avoid copying source string in TextEncoder.encode (Yagiz Nizipli) [#63897](https://github.com/nodejs/node/pull/63897)
188
+ * \[[`efbbb9a03c`](https://github.com/nodejs/node/commit/efbbb9a03c)] - **stream**: preserve half-open duplexes in async iteration (Efe) [#64275](https://github.com/nodejs/node/pull/64275)
189
+ * \[[`999a83c937`](https://github.com/nodejs/node/commit/999a83c937)] - **(SEMVER-MINOR)** **stream**: expose ReadableStreamTee (Matteo Collina) [#64195](https://github.com/nodejs/node/pull/64195)
190
+ * \[[`ab5ed72903`](https://github.com/nodejs/node/commit/ab5ed72903)] - **stream**: reject iter consumers on abort (Trivikram Kamat) [#64066](https://github.com/nodejs/node/pull/64066)
191
+ * \[[`d3fa77c5e2`](https://github.com/nodejs/node/commit/d3fa77c5e2)] - **stream**: fix merge abort for pending sources (Trivikram Kamat) [#64013](https://github.com/nodejs/node/pull/64013)
192
+ * \[[`38b99140ed`](https://github.com/nodejs/node/commit/38b99140ed)] - **stream**: refactor unnecessary optional chaining away (Antoine du Hamel) [#64253](https://github.com/nodejs/node/pull/64253)
193
+ * \[[`c81f894ebe`](https://github.com/nodejs/node/commit/c81f894ebe)] - **stream**: cut per-chunk overhead in WHATWG streams (Matteo Collina) [#64252](https://github.com/nodejs/node/pull/64252)
194
+ * \[[`f162234f24`](https://github.com/nodejs/node/commit/f162234f24)] - **stream**: normalize Broadcast.from() byte inputs (Trivikram Kamat) [#64082](https://github.com/nodejs/node/pull/64082)
195
+ * \[[`1182ad8f3b`](https://github.com/nodejs/node/commit/1182ad8f3b)] - **stream**: proxy first own method in Readable.wrap() (Daijiro Wachi) [#64048](https://github.com/nodejs/node/pull/64048)
196
+ * \[[`d0b830b382`](https://github.com/nodejs/node/commit/d0b830b382)] - **stream**: observe abort while awaiting pipeTo source (Trivikram Kamat) [#64015](https://github.com/nodejs/node/pull/64015)
197
+ * \[[`f7adcd8359`](https://github.com/nodejs/node/commit/f7adcd8359)] - **stream**: respect iter consumer abort signals (Trivikram Kamat) [#63997](https://github.com/nodejs/node/pull/63997)
198
+ * \[[`b09e624c6f`](https://github.com/nodejs/node/commit/b09e624c6f)] - **test**: make blob desiredSize assertion robust (Trivikram Kamat) [#64106](https://github.com/nodejs/node/pull/64106)
199
+ * \[[`d0d8f0c774`](https://github.com/nodejs/node/commit/d0d8f0c774)] - **test**: update WPT for urlpattern to 11a459a2b1 (Node.js GitHub Bot) [#64037](https://github.com/nodejs/node/pull/64037)
200
+ * \[[`ff9122c20c`](https://github.com/nodejs/node/commit/ff9122c20c)] - **test**: improve lcov reporter snapshot diagnostics (Trivikram Kamat) [#64049](https://github.com/nodejs/node/pull/64049)
201
+ * \[[`570952d4f3`](https://github.com/nodejs/node/commit/570952d4f3)] - **test**: keep finalization close fixture ref alive (Trivikram Kamat) [#64085](https://github.com/nodejs/node/pull/64085)
202
+ * \[[`1b4f213380`](https://github.com/nodejs/node/commit/1b4f213380)] - **test**: fix typo from overriden to overridden (parkhojeong) [#63403](https://github.com/nodejs/node/pull/63403)
203
+ * \[[`4c91090b8b`](https://github.com/nodejs/node/commit/4c91090b8b)] - **test**: fix typo from funciton to function (parkhojeong) [#63403](https://github.com/nodejs/node/pull/63403)
204
+ * \[[`bf080c7917`](https://github.com/nodejs/node/commit/bf080c7917)] - **test**: mark hr-time WPT flaky on macos15-x64 (Trivikram Kamat) [#64054](https://github.com/nodejs/node/pull/64054)
205
+ * \[[`24e32098c5`](https://github.com/nodejs/node/commit/24e32098c5)] - **test**: use one-off agent in http consumed timeout test (Trivikram Kamat) [#64052](https://github.com/nodejs/node/pull/64052)
206
+ * \[[`3229886de2`](https://github.com/nodejs/node/commit/3229886de2)] - **test**: fix flaky test-runner coverage threshold test (Trivikram Kamat) [#64051](https://github.com/nodejs/node/pull/64051)
207
+ * \[[`83b91ea6ec`](https://github.com/nodejs/node/commit/83b91ea6ec)] - **test\_runner**: filter execArgv fallback for child tests (Trivikram Kamat) [#64056](https://github.com/nodejs/node/pull/64056)
208
+ * \[[`269b609a3d`](https://github.com/nodejs/node/commit/269b609a3d)] - **test\_runner**: improve coverage failure diagnostics (Trivikram Kamat) [#64050](https://github.com/nodejs/node/pull/64050)
209
+ * \[[`0342744c34`](https://github.com/nodejs/node/commit/0342744c34)] - **test\_runner**: add timestamp to JUnit reporter testsuites (sangwook) [#64029](https://github.com/nodejs/node/pull/64029)
210
+ * \[[`086741d121`](https://github.com/nodejs/node/commit/086741d121)] - **timers**: reuse Timeout objects in setStreamTimeout (Matteo Collina) [#64254](https://github.com/nodejs/node/pull/64254)
211
+ * \[[`4e0236dc3d`](https://github.com/nodejs/node/commit/4e0236dc3d)] - **(SEMVER-MINOR)** **tls**: report negotiated TLS groups (Filip Skokan) [#64119](https://github.com/nodejs/node/pull/64119)
212
+ * \[[`3bdd7e20be`](https://github.com/nodejs/node/commit/3bdd7e20be)] - **tls**: handle large RSA exponents in X.509 cert (Tobias Nießen) [#64093](https://github.com/nodejs/node/pull/64093)
213
+ * \[[`c96c838977`](https://github.com/nodejs/node/commit/c96c838977)] - **tools**: update RUSTC\_VERSION for remaining GHA workflows (René) [#64325](https://github.com/nodejs/node/pull/64325)
214
+ * \[[`ee873b7aaf`](https://github.com/nodejs/node/commit/ee873b7aaf)] - **tools**: bump `temporal_rs` version (Antoine du Hamel) [#63281](https://github.com/nodejs/node/pull/63281)
215
+ * \[[`ea3b870155`](https://github.com/nodejs/node/commit/ea3b870155)] - **tools**: remove `envinfo` from our workflows (Antoine du Hamel) [#64259](https://github.com/nodejs/node/pull/64259)
216
+ * \[[`d940f02e8b`](https://github.com/nodejs/node/commit/d940f02e8b)] - **tools**: bump the eslint group in /tools/eslint with 8 updates (dependabot\[bot]) [#64249](https://github.com/nodejs/node/pull/64249)
217
+ * \[[`fe0ea2bb5d`](https://github.com/nodejs/node/commit/fe0ea2bb5d)] - **tools**: bump @node-core/doc-kit (dependabot\[bot]) [#64010](https://github.com/nodejs/node/pull/64010)
218
+ * \[[`4dceefde1e`](https://github.com/nodejs/node/commit/4dceefde1e)] - **tools**: bump undici from 6.24.1 to 6.27.0 in /tools/doc (dependabot\[bot]) [#64031](https://github.com/nodejs/node/pull/64031)
219
+ * \[[`6e187db7d7`](https://github.com/nodejs/node/commit/6e187db7d7)] - **tools**: update c-ares updater script (Antoine du Hamel) [#64194](https://github.com/nodejs/node/pull/64194)
220
+ * \[[`657a35f5a2`](https://github.com/nodejs/node/commit/657a35f5a2)] - **tools**: validate version number in release proposal commit message lint (Antoine du Hamel) [#64070](https://github.com/nodejs/node/pull/64070)
221
+ * \[[`17228a861c`](https://github.com/nodejs/node/commit/17228a861c)] - **tools**: add GHA benchmark runner (Antoine du Hamel) [#60293](https://github.com/nodejs/node/pull/60293)
222
+ * \[[`6d11a71d91`](https://github.com/nodejs/node/commit/6d11a71d91)] - **tools**: update `build-shared/action.yml` to a reusable workflow (Antoine du Hamel) [#64059](https://github.com/nodejs/node/pull/64059)
223
+ * \[[`7a17c50b7f`](https://github.com/nodejs/node/commit/7a17c50b7f)] - **tools**: update libffi updater script (Antoine du Hamel) [#64046](https://github.com/nodejs/node/pull/64046)
224
+ * \[[`28047a3e71`](https://github.com/nodejs/node/commit/28047a3e71)] - **tools**: exclude `libffi` changes from `test-shared` GHA CI (Antoine du Hamel) [#64047](https://github.com/nodejs/node/pull/64047)
225
+ * \[[`58d9685acc`](https://github.com/nodejs/node/commit/58d9685acc)] - **typings**: add typing for crypto (Filip Skokan) [#64122](https://github.com/nodejs/node/pull/64122)
226
+ * \[[`7a9dcad44d`](https://github.com/nodejs/node/commit/7a9dcad44d)] - **util**: fix OOM in inspect color stack formatting (Ijtihed Kilani) [#64022](https://github.com/nodejs/node/pull/64022)
227
+ * \[[`d5f01bbbde`](https://github.com/nodejs/node/commit/d5f01bbbde)] - **vfs**: reject rename into descendant directory (Trivikram Kamat) [#64285](https://github.com/nodejs/node/pull/64285)
228
+ * \[[`0b6af91081`](https://github.com/nodejs/node/commit/0b6af91081)] - **vfs**: handle current-position sentinel in memory files (Trivikram Kamat) [#64163](https://github.com/nodejs/node/pull/64163)
229
+ * \[[`322230d641`](https://github.com/nodejs/node/commit/322230d641)] - **vfs**: support writeFileSync with virtual fds (Trivikram Kamat) [#64165](https://github.com/nodejs/node/pull/64165)
230
+ * \[[`9395d209c7`](https://github.com/nodejs/node/commit/9395d209c7)] - **vfs**: avoid recursive readdir symlink cycles (Matteo Collina) [#64168](https://github.com/nodejs/node/pull/64168)
231
+ * \[[`bbdd7643b6`](https://github.com/nodejs/node/commit/bbdd7643b6)] - **vfs**: read RealFSProvider files from open fd (Trivikram Kamat) [#64104](https://github.com/nodejs/node/pull/64104)
232
+ * \[[`92859b8097`](https://github.com/nodejs/node/commit/92859b8097)] - **vm**: fix copying PropertyDescriptor (Chengzhong Wu) [#64073](https://github.com/nodejs/node/pull/64073)
233
+ * \[[`9046035475`](https://github.com/nodejs/node/commit/9046035475)] - **zlib**: validate flush king for all streams (Ic3b3rg) [#63746](https://github.com/nodejs/node/pull/63746)
234
+ * \[[`98be4304a3`](https://github.com/nodejs/node/commit/98be4304a3)] - **zlib**: validate flush kind for brotli streams (Ic3b3rg) [#63746](https://github.com/nodejs/node/pull/63746)
235
+ * \[[`90007a59a9`](https://github.com/nodejs/node/commit/90007a59a9)] - **zlib**: expose rejectGarbageAfterEnd option (Filip Skokan) [#64023](https://github.com/nodejs/node/pull/64023)
236
+ * \[[`5933516066`](https://github.com/nodejs/node/commit/5933516066)] - **zlib**: reject trailing gzip members in web streams (Filip Skokan) [#64023](https://github.com/nodejs/node/pull/64023)
237
+
49
238
  <a id="26.4.0"></a>
50
239
 
51
240
  ## 2026-06-24, Version 26.4.0 (Current), @aduh95
package/README.md CHANGED
@@ -405,8 +405,6 @@ For information about the governance of the Node.js project, see
405
405
  **Tim Perry** <<pimterry@gmail.com>> (he/him)
406
406
  * [pmarchini](https://github.com/pmarchini) -
407
407
  **Pietro Marchini** <<pietro.marchini94@gmail.com>> (he/him)
408
- * [puskin](https://github.com/puskin) -
409
- **Giovanni Bucci** <<github@puskin.it>> (he/him)
410
408
  * [Qard](https://github.com/Qard) -
411
409
  **Stephen Belanger** <<admin@stephenbelanger.com>> (he/him)
412
410
  * [RafaelGSS](https://github.com/RafaelGSS) -
@@ -653,6 +651,8 @@ For information about the governance of the Node.js project, see
653
651
  **Prince John Wesley** <<princejohnwesley@gmail.com>>
654
652
  * [psmarshall](https://github.com/psmarshall) -
655
653
  **Peter Marshall** <<petermarshall@chromium.org>> (he/him)
654
+ * [puskin](https://github.com/puskin) -
655
+ **Giovanni Bucci** <<github@puskin.it>> (he/him)
656
656
  * [puzpuzpuz](https://github.com/puzpuzpuz) -
657
657
  **Andrey Pechkurov** <<apechkurov@gmail.com>> (he/him)
658
658
  * [refack](https://github.com/refack) -
@@ -785,6 +785,8 @@ Primary GPG keys for Node.js Releasers (some Releasers sign with subkeys):
785
785
  `C82FA3AE1CBEDC6BE46B9360C43CEC45C17AB93C`
786
786
  * **Ruy Adorno** <<ruyadorno@hotmail.com>>
787
787
  `108F52B48DB57BB0CC439B2997B01419BD92F80A`
788
+ * **Stewart X Addison** <<sxa@ibm.com>>
789
+ `655F3B5C1FB3FA8D1A0CA6BDE4A7D232B936D2FD`
788
790
  * **Ulises Gascón** <<ulisesgascongonzalez@gmail.com>>
789
791
  `A363A499291CBBC940DD62E41F10027AF002F8B0`
790
792
 
@@ -802,6 +804,7 @@ gpg --keyserver hkps://keys.openpgp.org --recv-keys 8FCCA13FEF1D0C2E91008E09770F
802
804
  gpg --keyserver hkps://keys.openpgp.org --recv-keys 890C08DB8579162FEE0DF9DB8BEAB4DFCF555EF4 # Rafael Gonzaga
803
805
  gpg --keyserver hkps://keys.openpgp.org --recv-keys C82FA3AE1CBEDC6BE46B9360C43CEC45C17AB93C # Richard Lau
804
806
  gpg --keyserver hkps://keys.openpgp.org --recv-keys 108F52B48DB57BB0CC439B2997B01419BD92F80A # Ruy Adorno
807
+ gpg --keyserver hkps://keys.openpgp.org --recv-keys 655F3B5C1FB3FA8D1A0CA6BDE4A7D232B936D2FD # Stewart X Addison
805
808
  gpg --keyserver hkps://keys.openpgp.org --recv-keys A363A499291CBBC940DD62E41F10027AF002F8B0 # Ulises Gascón
806
809
  ```
807
810
 
package/bin/node CHANGED
Binary file
package/include/node/common.gypi CHANGED
@@ -14,6 +14,7 @@
14
14
  'enable_pgo_use%': '0',
15
15
  'clang_profile_lib%': '',
16
16
  'python%': 'python',
17
+ 'emulator%': [],
17
18
 
18
19
  'node_shared%': 'false',
19
20
  'node_enable_experimentals%': 'false',
@@ -40,7 +41,7 @@
40
41
 
41
42
  # Reset this number to 0 on major V8 upgrades.
42
43
  # Increment by one for each non-official patch applied to deps/v8.
43
- 'v8_embedder_string': '-node.21',
44
+ 'v8_embedder_string': '-node.24',
44
45
 
45
46
  ##### V8 defaults for Node.js #####
46
47
 
package/include/node/node_version.h CHANGED
@@ -23,8 +23,8 @@
23
23
  #define SRC_NODE_VERSION_H_
24
24
 
25
25
  #define NODE_MAJOR_VERSION 26
26
- #define NODE_MINOR_VERSION 4
27
- #define NODE_PATCH_VERSION 0
26
+ #define NODE_MINOR_VERSION 5
27
+ #define NODE_PATCH_VERSION 1
28
28
 
29
29
  #define NODE_VERSION_IS_LTS 0
30
30
  #define NODE_VERSION_LTS_CODENAME ""
package/include/node/v8-promise.h CHANGED
@@ -158,8 +158,8 @@ using PromiseHook = void (*)(PromiseHookType type, Local<Promise> promise,
158
158
  enum PromiseRejectEvent {
159
159
  kPromiseRejectWithNoHandler = 0,
160
160
  kPromiseHandlerAddedAfterReject = 1,
161
- kPromiseRejectAfterResolved = 2,
162
- kPromiseResolveAfterResolved = 3,
161
+ kDeprecatedPromiseRejectAfterResolved V8_DEPRECATED("Removed event") = 2,
162
+ kDeprecatedPromiseResolveAfterResolved V8_DEPRECATED("Removed event") = 3,
163
163
  };
164
164
 
165
165
  class PromiseRejectMessage {
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "node-bin-darwin-arm64",
3
- "version": "26.4.0",
3
+ "version": "26.5.1",
4
4
  "description": "node",
5
5
  "repository": {
6
6
  "url": "git+https://github.com/aredridel/node-bin-gen.git"
package/share/man/man1/node.1 CHANGED
@@ -147,7 +147,7 @@ The valid arguments for the \fB--allow-fs-read\fR flag are:
147
147
  \fB*\fR - To allow all \fBFileSystemRead\fR operations.
148
148
  .It
149
149
  Multiple paths can be allowed using multiple \fB--allow-fs-read\fR flags.
150
- Example \fB--allow-fs-read=/folder1/ --allow-fs-read=/folder1/\fR
150
+ Example \fB--allow-fs-read=/folder1/ --allow-fs-read=/folder2/\fR
151
151
  .El
152
152
  Examples can be found in the File System Permissions documentation.
153
153
  The initializer module and custom \fB--require\fR modules has a implicit
@@ -175,7 +175,7 @@ The valid arguments for the \fB--allow-fs-write\fR flag are:
175
175
  \fB*\fR - To allow all \fBFileSystemWrite\fR operations.
176
176
  .It
177
177
  Multiple paths can be allowed using multiple \fB--allow-fs-write\fR flags.
178
- Example \fB--allow-fs-write=/folder1/ --allow-fs-write=/folder1/\fR
178
+ Example \fB--allow-fs-write=/folder1/ --allow-fs-write=/folder2/\fR
179
179
  .El
180
180
  Paths delimited by comma (\fB,\fR) are no longer allowed.
181
181
  When passing a single flag with a comma a warning will be displayed.
@@ -741,6 +741,10 @@ Enable experimental \fBimport.meta.resolve()\fR parent URL support, which allows
741
741
  passing a second \fBparentURL\fR argument for contextual resolution.
742
742
  Previously gated the entire \fBimport.meta.resolve\fR feature.
743
743
  .
744
+ .It Fl -experimental-import-text
745
+ Enable experimental support for importing modules with
746
+ \fBwith { type: 'text' }\fR.
747
+ .
744
748
  .It Fl -experimental-inspector-network-resource
745
749
  Enable experimental support for inspector network resources.
746
750
  .
@@ -764,9 +768,8 @@ See Package maps for details on the configuration file format and
764
768
  resolution algorithm.
765
769
  .
766
770
  .It Fl -experimental-print-required-tla
767
- If the ES module being \fBrequire()\fR'd contains top-level \fBawait\fR, this flag
768
- allows Node.js to evaluate the module, try to locate the
769
- top-level awaits, and print their location to help users find them.
771
+ If the ES module graph cannot be \fBrequire()\fR'd because it contains any top-level \fBawait\fR,
772
+ this flag allows Node.js to locate and print their locations.
770
773
  .
771
774
  .It Fl -experimental-quic
772
775
  Enable experimental support for the QUIC protocol.
@@ -1952,6 +1955,8 @@ one is included in the list below.
1952
1955
  .It
1953
1956
  \fB--experimental-import-meta-resolve\fR
1954
1957
  .It
1958
+ \fB--experimental-import-text\fR
1959
+ .It
1955
1960
  \fB--experimental-json-modules\fR
1956
1961
  .It
1957
1962
  \fB--experimental-loader\fR