Node.js — Node.js 26.1.0 (Current)

Antoine du Hamel

[2026-05-07, Version 26.1.0 (Current), @aduh95](http://nodejs.org/en/blog/release/v26.1.0#2026-05-07-version-2610-current-aduh95)

[Notable Changes](http://nodejs.org/en/blog/release/v26.1.0#notable-changes)

#### Experimental `node:ffi` module

Node.js now includes an experimental node:ffi module for loading dynamic libraries and calling native symbols from JavaScript.

The API is gated behind the --experimental-ffi flag and, when the Permission Model is enabled, requires --allow-ffi.

This API is inherently unsafe. Invalid pointers, incorrect signatures, or accessing memory after it has been freed can crash the process or corrupt memory.

Contributed by Paolo Insogna in #62072.

#### Other Notable Changes

• [`34a6454fe3`] - (SEMVER-MINOR)buffer: add end parameter (Robert Nagy) #62390
• [`073e84d7fe`] - (SEMVER-MINOR)crypto: accept key data in crypto.diffieHellman() and cleanup DH jobs (Filip Skokan) #62527
• [`5b9cb10a5f`] - (SEMVER-MINOR)crypto: implement randomUUIDv7() (nabeel378) #62553
• [`98f9becd16`] - (SEMVER-MINOR)debugger: add edit-free runtime expression probes to node inspect (Joyee Cheung) #62713
• [`06defaa2ea`] - (SEMVER-MINOR)fs: add signal option to fs.stat() (Mert Can Altin) #57775
• [`db66a963bf`] - (SEMVER-MINOR)fs: expose frsize field in statfs (Jinho Jang) #62277
• [`87adb3472b`] - (SEMVER-MINOR)http: harden ClientRequest options merge (Matteo Collina) #63082
• [`9047ec12ce`] - (SEMVER-MINOR)http: add req.signal to IncomingMessage (Akshat) #62541
• [`ab66de8eaa`] - (SEMVER-MINOR)process: throw on execve(2) failure instead of aborting (Bryan English) #62878
• [`8273682c87`] - (SEMVER-MINOR)src: allow empty --experimental-config-file (Marco Ippolito) #61610
• [`fbff28f7e6`] - (SEMVER-MINOR)stream: propagate destruction in duplexPair (Ahmed Elhor) #61098
• [`a8c773a0c7`] - (SEMVER-MINOR)test_runner: align mock timeout api (sangwook) #62820
• [`b883a5eaea`] - (SEMVER-MINOR)test_runner: add mock-timers support for AbortSignal.timeout (DeveloperViraj) #60751
• [`a21ae1771e`] - (SEMVER-MINOR)test_runner: support test order randomization (Pietro Marchini) #61747
• [`b85c73ff10`] - (SEMVER-MINOR)util: colorize text with hex colors (Guilherme Araújo) #61556

[Commits](http://nodejs.org/en/blog/release/v26.1.0#commits)

• [`1b959d02c2`] - assert,util: fix stale nested cycle memo entries (Ruben Bridgewater) #62509
• [`bbeb38d210`] - buffer: fix end parameter bugs in indexOf/lastIndexOf (Robert Nagy) #62711
• [`34a6454fe3`] - (SEMVER-MINOR)buffer: add end parameter (Robert Nagy) #62390
• [`8b91526cd5`] - build: track PDL files as inputs in inspector GN build (Robo) #62888
• [`da40ed7842`] - build: remove armv6 from experimental platforms (René) #63063
• [`b36e55a23e`] - build: make test-addons dependency-free (Joyee Cheung) #62388
• [`c27f3cf8f2`] - build: add --enable-all-experimentals build flag (Paolo Insogna) #62755
• [`0d73b63a76`] - build: fix cargo check when Temporal is disabled (Antoine du Hamel) #62730
• [`d8f97e6f7b`] - build: fix ffi dependency compilation (Paolo Insogna) #62731
• [`d1eb7b340f`] - build: fix stray debug string in LIEF defines (Om Ghante) #62683
• [`845283009d`] - build: remove redundant -fuse-linker-plugin from GCC LTO flags (Daniel Lando) #62667
• [`a6e99879f4`] - build,win: enable x64 PGO (Stefan Stojanovic) #62761
• [`38befee0fb`] - crypto: add JWK support for ML-KEM and SLH-DSA key types (Filip Skokan) #62706
• [`b10653ad87`] - crypto: add guards and adjust tests for BoringSSL (Filip Skokan) #62883
• [`2a7a69c6b0`] - crypto: reject unintended raw key format string input (Filip Skokan) #62974
• [`bad1e2fe6a`] - crypto: fix unsigned conversion of 4-byte RSA publicExponent (DeepView Autofix) #62839
• [`c9d5bae598`] - crypto: remove Argon2 KDF derivation from its job setup (Filip Skokan) #62863
• [`6eea52426f`] - crypto: reject duplicate ML-KEM JWK key_ops (Filip Skokan) #62905
• [`80d4836616`] - crypto: deduplicate and canonicalize CryptoKey usages (Filip Skokan) #62902
• [`8950247027`] - crypto: reject inherited key type names (Jonathan Lopes) #62875
• [`3f42f9615a`] - crypto: strengthen argument CHECKs in TurboSHAKE (Tobias Nießen) #62763
• [`28346d999b`] - crypto: guard against size_t overflow on experimental 32-bit arch (Filip Skokan) #62626
• [`d4cec263c4`] - (SEMVER-MINOR)crypto: align key argument names in docs and error messages (Filip Skokan) #62527
• [`073e84d7fe`] - (SEMVER-MINOR)crypto: accept key data in crypto.diffieHellman() and cleanup DH jobs (Filip Skokan) #62527
• [`518b578fe7`] - crypto: add memory tracking for secureContext openssl objects (Mert Can Altin) #59051
• [`5b9cb10a5f`] - (SEMVER-MINOR)crypto: implement randomUUIDv7() (nabeel378) #62553
• [`7133826053`] - debugger: move ProbeInspectorSession and helpers to separate files (Joyee Cheung) #63013
• [`98f9becd16`] - (SEMVER-MINOR)debugger: add edit-free runtime expression probes to node inspect (Joyee Cheung) #62713
• [`94ac62a2d1`] - deps: update undici to 8.2.0 (Node.js GitHub Bot) #63092
• [`ef71de87e6`] - deps: update amaro to 1.1.9 (Node.js GitHub Bot) #63090
• [`c4f0ef881a`] - deps: update llhttp to 9.4.1 (Node.js GitHub Bot) #63045
• [`d29fbc0029`] - deps: fix integration issues with the latest nghttp2 (Tim Perry) #62891
• [`537825acee`] - deps: update nghttp2 to 1.69.0 (Node.js GitHub Bot) #62891
• [`4446bf694d`] - deps: update corepack to 0.34.7 (Node.js GitHub Bot) #62810
• [`8f55327f1c`] - deps: fix libffi macos build (Paolo Insogna) #63006
• [`3dee18f72f`] - deps: patch V8 to 14.6.202.34 (Node.js GitHub Bot) #62964
• [`e281b247e6`] - deps: update timezone to 2026b (Node.js GitHub Bot) #62962
• [`4dd982df13`] - deps: upgrade npm to 11.13.0 (npm team) #62898
• [`61c0ff4a13`] - deps: cherry-pick libuv/libuv@439a54b (skooch) #62881
• [`d26ca462ae`] - deps: update undici to 8.1.0 (Node.js GitHub Bot) #62728
• [`6f08489ac9`] - deps: update sqlite to 3.53.0 (Node.js GitHub Bot) #62699
• [`713601e8bd`] - deps: update nbytes to 0.1.4 (Node.js GitHub Bot) #62698
• [`578cf1c0c1`] - deps: update archs files for openssl-3.5.6 (Node.js GitHub Bot) #62629
• [`4a4ef13c67`] - deps: upgrade openssl sources to openssl-3.5.6 (Node.js GitHub Bot) #62629
• [`2f3eca8c1e`] - deps: update perfetto to 54.0 (Chengzhong Wu) #62397
• [`944ed9b739`] - deps: add perfetto build files (Chengzhong Wu) #62397
• [`15530a7484`] - deps: update ngtcp2 to 1.22.0 (Node.js GitHub Bot) #62595
• [`b813b4c4b5`] - deps: update minimatch to 10.2.5 (Node.js GitHub Bot) #62594
• [`38e7ce58c5`] - deps: update googletest to d72f9c8aea6817cdf1ca0ac10887f328de7f3da2 (Node.js GitHub Bot) #62593
• [`b5c573ed14`] - deps: update simdjson to 4.6.1 (Node.js GitHub Bot) #62592
• [`318e2c7cd3`] - deps: libuv: cherry-pick aabb7651de (Santiago Gimeno) #62561
• [`c6ccbd742a`] - deps: libuv: reapply 3a9a6e3e6b (Andy Pan) #62561
• [`4ad07de7ae`] - diagnostics_channel: add BoundedChannel and scopes (Stephen Belanger) #61680
• [`44416ea3fd`] - doc: fix documentation history missing 25.9.0 (Antoine du Hamel) #63151
• [`5f6dfbf68e`] - doc: fix changelog for chromium numbering (Rafael Gonzaga) #63133
• [`30c4b3658c`] - doc: fix the TypeScript Execute (tsx) project link (David Thornton) #63093
• [`ca3c3097f1`] - doc: minor structural stream/iter edits (René) #63089
• [`92324aab6f`] - doc: remove typo comma from man page (Vas Sudanagunta) #63080
• [`712a15da73`] - doc: correct diagnostics_channel built-in channel names (Bryan English) #62995
• [`c92cb6fe0d`] - doc: use mjs/cjs blocks for callbackify null reason example (Daijiro Wachi) #62884
• [`020776d4d6`] - doc: fix typo in test.md (Rich Trott) #62960
• [`7d52f2061e`] - doc: correct typo in PR contribution instructions (Mike McCready) #62738
• [`70e8944676`] - doc: fix duplicate word "of of" in postMessageToThread (Daijiro Wachi) #62917
• [`11c6c29284`] - doc: fix duplicate word "to to" in util.styleText (Daijiro Wachi) #62917
• [`242adab671`] - doc: fix duplicate word "for for" in compile cache (Daijiro Wachi) #62917
• [`b9f3abd63e`] - doc: fix doubled word typo in stream_iter.md (Daijiro Wachi) #62916
• [`7a52fd0448`] - doc: fix typo in dns.lookup options description (Daijiro Wachi) #62882
• [`acd7e18a8c`] - doc: fix Argon2 parameter bounds (Tobias Nießen) #62868
• [`b43ecf40bb`] - doc: trust FFI in the threat model (Paolo Insogna) #62852
• [`981ce96b03`] - doc: fix typos and inconsistencies in crypto.md and webcrypto.md (Filip Skokan) #62828
• [`acc52ef257`] - doc: clarify diffieHellman.generateKeys recomputes same key (Kit Dallege) #62205
• [`ae87597c07`] - doc: remove Ayase-252 and meixg from triagger team (Antoine du Hamel) #62841
• [`1cd3694a5f`] - doc: clarify dns.lookup() callback signature when all is true (eungi) #62800
• [`40a4337d65`] - doc: add experimental modules lifetime policy (Paolo Insogna) #62753
• [`46f48222f8`] - doc: clarify process._debugProcess() in Permission Model (Fahad Khan) #62537
• [`6eb9917497`] - doc: fix typo in devcontainer guide (Rohan Santhosh Kumar) #62687
• [`3826c5ed7e`] - doc: clarify Backport-PR-URL metadata added automatically (Mike McCready) #62668
• [`5d7e0dbbd8`] - doc: update WPT test runner README.md (Filip Skokan) #62680
• [`e9d76b2a75`] - doc: fix spelling in release announcement guidance (Rohan Santhosh Kumar) #62663
• [`1ae41cebb0`] - doc: note GCC >= 14 requirement for native riscv64 builds (Jamie Magee) #62607
• [`9b29be6a28`] - doc: note non-monotonic clock in crypto.randomUUIDv7 (nabeel378) #62600
• [`5ae59553f6`] - doc: update bug bounty program (Rafael Gonzaga) #62590
• [`ce3f4c85dd`] - doc: document TransformStream transformer.cancel option (Tom Pereira) #62566
• [`08a9ba73e4`] - doc: mention test runner retry attemp is zero based (Moshe Atlow) #62504
• [`32f2169ede`] - doc,src,test: fix dead inspector help URL (semimikoh) #62745
• [`870c1cd3f4`] - doc,test: mem protection must be observed in ffi (Bryan English) #62818
• [`3d5cf171dc`] - esm: add ERR_REQUIRE_ESM_RACE_CONDITION (Antoine du Hamel) #62462
• [`2004d8d6db`] - ffi: make FFIFunctionInfo a BaseObject subclass (Anna Henningsen) #63071
• [`53eb7abeba`] - ffi: prevent premature GC of DynamicLibrary (semimikoh) #63024
• [`58dc92f502`] - ffi: support Symbol.dispose on DynamicLibrary (Matteo Collina) #62925
• [`528f8b2bae`] - ffi: add shared-buffer fast path for numeric and pointer signatures (Bryan English) #62918
• [`42ac8b9ae7`] - fs: add followSymlinks option to glob (Matteo Collina) #62695
• [`873c2bca70`] - fs: restore fs patchability in ESM loader (Joyee Cheung) #62835
• [`349c7502c3`] - fs: validate position argument before length === 0 early return (Edy Silva) #62674
• [`06defaa2ea`] - (SEMVER-MINOR)fs: add signal option to fs.stat() (Mert Can Altin) #57775
• [`db66a963bf`] - (SEMVER-MINOR)fs: expose frsize field in statfs (Jinho Jang) #62277
• [`3191d2936a`] - http: emit 'drain' on OutgoingMessage only after buffers drain (Robert Nagy) #62936
• [`87adb3472b`] - (SEMVER-MINOR)http: harden ClientRequest options merge (Matteo Collina) #63082
• [`e0b79633f6`] - http: fix leaked error listener on sync HTTP req create + destroy (Tim Perry) #62872
• [`70c5491f53`] - http: fix no_proxy leading-dot suffix matching (Daijiro Wachi) #62333
• [`60a585e68a`] - http: cleanup pipeline queue (Robert Nagy) #62534
• [`9047ec12ce`] - (SEMVER-MINOR)http: add req.signal to IncomingMessage (Akshat) #62541
• [`01eed5901b`] - http2: expose writable stream state on compat response (T) #63003
• [`19b7adf3ba`] - inspector: fix absolute URLs in network http (bugyaluwang) #62955
• [`4d10823fbb`] - inspector: coerce key and value to string in webstorage events (Ali Hassan) #62616
• [`9a3ac66cc5`] - inspector: return errors when CDP protocol event emission fails (Ryuhei Shima) #62162
• [`c89501c6e5`] - inspector: auto collect webstorage data (Ryuhei Shima) #62145
• [`ef08c5016a`] - lib: refactor internal webidl converters (Filip Skokan) #62979
• [`d0744c6a99`] - lib: add Temporal to frozen intrinsics (René) #63029
• [`6d81cb17b3`] - lib: avoid quadratic shift() in startup snapshot callback (Daijiro Wachi) #62914
• [`3491f73051`] - lib: fix FLOAT_32 and FLOAT_64 type constants in ffi (Daijiro Wachi) #62892
• [`c4ca303b36`] - lib: harden kKeyOps lookup with null prototype (Filip Skokan) #62877
• [`2e612fe070`] - lib: short-circuit WebIDL BufferSource SAB check (Filip Skokan) #62833
• [`e850ee9c69`] - lib: add new methods and error codes (Paolo Insogna) #62762
• [`e21b873589`] - lib: use js-only implementation of isDataView() (René) #62780
• [`f454d1719d`] - lib: fix lint in internal/webstreams/util.js (Filip Skokan) #62806
• [`fbd8ededba`] - lib: fix sequence argument handling in Blob constructor (Ms2ger) #62179
• [`16860e6abd`] - lib: improve Web Cryptography key validation ordering (Filip Skokan) #62749
• [`ba3f3e1753`] - lib: reject SharedArrayBuffer in web APIs per spec (Ali Hassan) #62632
• [`d065e996bb`] - lib: defer AbortSignal.any() following (sangwook) #62367
• [`2a711f4b0c`] - (SEMVER-MINOR)lib,src,test,doc: add node:ffi module (Colin Ihrig) #62072
• [`d578343582`] - meta: bump github/codeql-action from 4.35.1 to 4.35.3 (dependabot[bot]) #63074
• [`1b4b90d544`] - meta: bump Mozilla-Actions/sccache-action from 0.0.9 to 0.0.10 (dependabot[bot]) #63073
• [`1477349e47`] - meta: bump actions/upload-artifact from 7.0.0 to 7.0.1 (dependabot[bot]) #63072
• [`ecb7de271a`] - meta: bump cachix/install-nix-action from 31.10.3 to 31.10.5 (dependabot[bot]) #62846
• [`fb91408312`] - meta: bump actions/upload-artifact from 7.0.0 to 7.0.1 (dependabot[bot]) #62850
• [`7eb9a6be68`] - meta: add automation policy (Chengzhong Wu) #62871
• [`6f053a4cb8`] - meta: update CODEOWNERS for FFI (Paolo Insogna) #62853
• [`88fe50a725`] - meta: move VoltrexKeyva to emeritus (Matteo Collina) #62895
• [`42e770bdd0`] - meta: bump peter-evans/create-pull-request from 8.1.0 to 8.1.1 (dependabot[bot]) #62845
• [`952d005233`] - meta: bump step-security/harden-runner from 2.16.1 to 2.19.0 (dependabot[bot]) #62844
• [`1bd19d9768`] - meta: bump actions/github-script from 8.0.0 to 9.0.0 (dependabot[bot]) #62843
• [`386244a7dd`] - meta: bump actions/setup-node from 6.3.0 to 6.4.0 (dependabot[bot]) #62842
• [`16b2c41f70`] - meta: broaden stale bot (Aviv Keller) #62658
• [`41e7a4ba82`] - meta: pass release version to release worker (flakey5) #62777
• [`632821db85`] - meta: add QUIC to CODEOWNERS (Tim Perry) #62652
• [`4a7ad93ed8`] - meta: move Michael to emeritus (Michael Dawson) #62536
• [`44d5a33efb`] - meta: populate apt list for slim runner in update-openssl workflow (René) #62628
• [`d874596aa3`] - meta: bump cachix/install-nix-action from 31.9.1 to 31.10.3 (dependabot[bot]) #62551
• [`1631b27e2b`] - meta: bump step-security/harden-runner from 2.15.0 to 2.16.1 (dependabot[bot]) #62550
• [`4de376894d`] - meta: bump actions/download-artifact from 8.0.0 to 8.0.1 (dependabot[bot]) #62549
• [`39da4d7bd6`] - meta: bump actions/setup-node from 6.2.0 to 6.3.0 (dependabot[bot]) #62548
• [`62e3aa55ad`] - meta: bump github/codeql-action from 4.32.4 to 4.35.1 (dependabot[bot]) #62547
• [`83986de8a2`] - meta: bump codecov/codecov-action from 5.5.2 to 6.0.0 (dependabot[bot]) #62545
• [`18e56861dc`] - meta: bump cachix/cachix-action from 16 to 17 (dependabot[bot]) #62544
• [`d4e49d567a`] - meta: bump actions/cache from 5.0.3 to 5.0.4 (dependabot[bot]) #62543
• [`2c5a914af4`] - meta: require DCO signoff in commit message guidelines (James M Snell) #62510
• [`f21039ce59`] - meta: expand memory leak DoS criteria to all DoS (Joyee Cheung) #62505
• [`824ac6b5bf`] - module: exclude node:ffi from builtinModules when not enabled (Jordan Harband) #63158
• [`bb6293ab7c`] - module: remove duplicated checks from _resolveFilename (Antoine du Hamel) #62729
• [`34ec8c9f5c`] - module,win: fix long subpath import (Stefan Stojanovic) #62101
• [`de46e68918`] - node-api: update libuv ABI stability note (Chengzhong Wu) #62789
• [`78c7d77bbf`] - node-api: add napi_create_external_sharedarraybuffer (Ben Noordhuis) #62623
• [`a0ccf94f61`] - node-api: execute tsfn finalizer after queue drains when aborted (Kevin Eady) #61956
• [`ab66de8eaa`] - (SEMVER-MINOR)process: throw on execve(2) failure instead of aborting (Bryan English) #62878
• [`20151be8cb`] - process: handle rejections only when needed (Gürgün Dayıoğlu) #62919
• [`9b24a815a2`] - quic: add QuicEndpoint.listening & QuicStream.destroy() and tests (Tim Perry) #62648
• [`761a96740c`] - quic: fixup token verification to handle zero expiration (James M Snell) #62620
• [`4ade02ac85`] - quic: support multiple ALPN negotiation (James M Snell) #62620
• [`b2e2e648e4`] - quic: apply multiple TLS context improvements and SNI support (James M Snell) #62620
• [`56b941af4a`] - quic: implement rapidhash for hashing improvements (James M Snell) #62620
• [`7cda4300b8`] - quic: use arena allocation for packets (James M Snell) #62589
• [`1e8fa2f1bd`] - sqlite: use OneByte for ASCII text and internalize col names (Ali Hassan) #61954
• [`3af44ee508`] - sqlite: add serialize() and deserialize() (Ali Hassan) #62579
• [`6386914b4b`] - src: decouple KeyObject and CryptoKey and move CryptoKey to src (Filip Skokan) #62924
• [`2dc1d205ee`] - src: replace uses of deprecated v8::External APIs (gahaas) #61898
• [`cb33a794a5`] - src: remove license headers for new node_profiling files (Chengzhong Wu) #63066
• [`59860eb798`] - src: swap dotenv and config file parsing order (Marco Ippolito) #63035
• [`fda439cb58`] - src: use unique_ptr for ffi memory management (Anna Henningsen) #63071
• [`56917afc57`] - src: split profiling helpers from util (Ilyas Shabi) #63008
• [`fca56a409d`] - src: add missing <cstdlib> for abort() declaration (Charles Kerr) #63001
• [`d49c89e915`] - src: make node.config.json throw at unknown fields (Marco Ippolito) #62992
• [`e89c8e9b68`] - src: fix crash in GetErrorSource() for invalid using syntax (semimikoh) #62770
• [`d89f719ce0`] - src: remove outdated comments in contextify (Chengzhong Wu) #62932
• [`5117a3e52b`] - src: simplify TCPWrap::Connect signature (Anna Henningsen) #62929
• [`41bd288ec7`] - src: align FFI error handling with Node.js source (Anna Henningsen) #62858
• [`faaccfb9df`] - src: simplify and fix FFI ArrayBuffer accesses (Anna Henningsen) #62857
• [`43bf39c350`] - src: use DCHECK in AsyncWrap::MakeCallback instead emiting a warning (Gerhard Stöbich) #62795
• [`da52b09859`] - src: fix MaybeStackBuffer char_traits deprecation warning (om-ghante) #62507
• [`2b12bca317`] - src: use context-free V8 message column getters (René) #62778
• [`7efc2ce7b3`] - src: clean up experimental flag variables (Antoine du Hamel) #62759
• [`8273682c87`] - (SEMVER-MINOR)src: allow empty --experimental-config-file (Marco Ippolito) #61610
• [`b844c24395`] - src: coerce spawnSync args to string once (Antoine du Hamel) #62633
• [`28679d76c4`] - src: use stack allocation for small string encoding (Ali Hassan) #62431
• [`144ef93735`] - src: add contextify interceptor debug logs (Chengzhong Wu) #62460
• [`d34cfb512e`] - stream: remove redundant method check from iter.pipeToSync (René) #63099
• [`a95830b72a`] - stream: copyedit webstreams/adapter.js (Antoine du Hamel) #63034
• [`4bf3e1e084`] - stream: remove duplicated utility (Antoine du Hamel) #63031
• [`214a8c197b`] - stream: simplify setPromiseHandled utility (Antoine du Hamel) #63032
• [`c12a767ff2`] - stream: validate ReadableStream.from iterator objects (Daeyeon Jeong) #62911
• [`b09953d2d4`] - stream: reject duplicate nested transferables (Daeyeon Jeong) #62831
• [`b9929622f3`] - stream: ensuring cross-destruction in _duplexify to prevent leaks (Daijiro Wachi) #62824
• [`c51a39b3ec`] - stream: simplify readableStreamFromIterable (Antoine du Hamel) #62651
• [`36078574b9`] - stream: fix nested compose error propagation (Matteo Collina) #62556
• [`e1928cd481`] - stream: allow shared array buffer sources in writable webstream adapter (René) #62163
• [`450e0519d9`] - stream: simplify createPromiseCallback (Antoine du Hamel) #62650
• [`57e59ea070`] - stream: fix writev unhandled rejection in fromWeb (sangwook) #62297
• [`958373413c`] - stream: noop pause/resume on destroyed streams (Robert Nagy) #62557
• [`ee38d2c43d`] - stream: refactor duplexify to be less suceptible to prototype pollution (Antoine du Hamel) #62559
• [`fbff28f7e6`] - (SEMVER-MINOR)stream: propagate destruction in duplexPair (Ahmed Elhor) #61098
• [`d7317f4f90`] - stream: add stream/iter to classic stream adapters (James M Snell) #62469
• [`55298c443f`] - test: accept OpenSSL 4 generic internal error for DH key-type mismatches (Filip Skokan) #62805
• [`96581bccc7`] - test: update WPT for url to 258f285de0 (Node.js GitHub Bot) #63087
• [`c73aba07fb`] - test: run Temporal presence checks without V8 flag (René) #63028
• [`9c94dce55b`] - test: export isRiscv64 from common module (Jamie Magee) #62609
• [`33c5f7fdbf`] - test: normalize known inspector crash as completion (Joyee Cheung) #62851
• [`8146a97bc3`] - test: update WPT for streams to f8f26a372f (Node.js GitHub Bot) #62864
• [`7c77c301c9`] - test: account for RFC 7919 FFDHE negotiation in OpenSSL 4.0 (Filip Skokan) #62805
• [`9bf7604eb6`] - test: skip tls-deprecated secp256k1 on OpenSSL 4.0 (Filip Skokan) #62805
• [`d173604b53`] - test: use an always invalid cipher and cover OpenSSL 4.0 behaviours (Filip Skokan) #62805
• [`72f52163b4`] - test: use valid DER OCSP responses (Filip Skokan) #62805
• [`e242394ad9`] - test: skip test-tls-error-stack when engines are unsupported (Filip Skokan) #62805
• [`9bff52ebf8`] - test: accept renamed OpenSSL 4.0 error code and reason (Filip Skokan) #62805
• [`d9b8cc1b68`] - test: update test/addons/openssl-binding for OpenSSL 4.0 (Filip Skokan) #62805
• [`960fb16287`] - test: mark test-snapshot-reproducible flaky (Filip Skokan) #62808
• [`7a12dd58cf`] - test: check contextify contextual store behavior in strict mode (René) #62571
• [`c73c8e603f`] - test: skip test-temporal-with-zoneinfo on system-icu builds (Antoine du Hamel) #62754
• [`48a3ca303e`] - test: generate localstorage.db in a temp dir (Chengzhong Wu) #62660
• [`1a41c2c5db`] - test: update tls junk data error expectations (Filip Skokan) #62629
• [`115e8c2052`] - test: ensure WPT report is in out/wpt (Filip Skokan) #62637
• [`cb07b918bd`] - test: improve WPT runner summary (Filip Skokan) #62636
• [`7f48438380`] - test: skip url WPT subtests instead of modifying test script (Filip Skokan) #62635
• [`4097fb95d7`] - test: capture negative utimes mtime at call time (Yuya Inoue) #62490
• [`e29f46df81`] - test: allow skipping individual WPT subtests (Filip Skokan) #62517
• [`4d546886c3`] - test: use on-disk fixture for test-npm-install (Joyee Cheung) #62584
• [`5b35eb02ec`] - test: update WPT for url to 7a3645b79a (Node.js GitHub Bot) #62591
• [`7a8610835d`] - test_runner: fix failing suite hooks when marked with todo (Moshe Atlow) #63097
• [`a8c773a0c7`] - (SEMVER-MINOR)test_runner: align mock timeout api (sangwook) #62820
• [`dc0d757c8a`] - test_runner: fix suite rerun edge case (Moshe Atlow) #62860
• [`b883a5eaea`] - (SEMVER-MINOR)test_runner: add mock-timers support for AbortSignal.timeout (DeveloperViraj) #60751
• [`6fa62b7d58`] - test_runner: add testId to test events (Moshe Atlow) #62772
• [`39e08340ff`] - test_runner: publish to TracingChannel for OTel instrumentation (Moshe Atlow) #62502
• [`a21ae1771e`] - (SEMVER-MINOR)test_runner: support test order randomization (Pietro Marchini) #61747
• [`cf0edeb65d`] - test_runner: add passed, attempt, and diagnostic to SuiteContext (Moshe Atlow) #62504
• [`644e2399d6`] - test_runner: add getTestContext() (Moshe Atlow) #62501
• [`480d538830`] - tools: use npm ci in Undici update script (Antoine du Hamel) #63098
• [`9afb013edd`] - tools: update nixpkgs-unstable to c6d65881c5624c9cae5ea6cedef24699b0c (Node.js GitHub Bot) #63091
• [`b9f2f5a90a`] - tools: bump postcss from 8.5.8 to 8.5.10 in /tools/doc (dependabot[bot]) #62966
• [`09e4f4caca`] - tools: use LTS Node.js in notify-on-push workflow (Nenad Spasenic) #63084
• [`2af4c89774`] - tools: implements a few nits on build-aarch64-linux-v8 (Antoine du Hamel) #63048
• [`cf9c1849ca`] - tools: update gr2m/create-or-update-pull-request-action to v1.10.1 (Mike McCready) #63065
• [`96370a57ed`] - tools: simplify update-undici.sh (Antoine du Hamel) #63044
• [`b90486edd8`] - tools: do not run test-linux on unrelated tools changes (Antoine du Hamel) #63037
• [`ac49e7c9fc`] - tools: migrate from openssl-matrix.json to openssl-matrix.nix (Antoine du Hamel) #63036
• [`a9df3e37fd`] - tools: update labels for nixpkgs pin bumps (Antoine du Hamel) #62994
• [`cee0154af8`] - tools: reuse V8 builds even without Cachix on test-shared (Antoine du Hamel) #62980
• [`78c183da6b`] - tools: do not include HTML docs in slim tarball (Antoine du Hamel) #62989
• [`04ce9df084`] - tools: bump the eslint group in /tools/eslint with 4 updates (dependabot[bot]) #62848
• [`4d2952c00a`] - tools: update nixpkgs-unstable to 01fbdeef22b76df85ea168fbfe1bfd9e636 (Node.js GitHub Bot) #62963
• [`555ad12f27`] - tools: update gyp-next to 0.22.1 (Node.js GitHub Bot) #62961
• [`f92cbc2c81`] - tools: fix commit linter for semver-major release proposals (Antoine du Hamel) #62993
• [`3b5bb4d758`] - tools: consolidate and simplify .editorconfig deps section (Daijiro Wachi) #62887
• [`027bef4f3e`] - tools: add non-default OpenSSL versions to the test-shared workflow (Filip Skokan) #62862
• [`fdcd7752de`] - tools: set bot as author of tools-deps-update PRs (Antoine du Hamel) #62856
• [`ab7be6d987`] - tools: bump brace-expansion from 5.0.4 to 5.0.5 in /tools/eslint (dependabot[bot]) #62458
• [`82281ffd59`] - tools: bump brace-expansion in /tools/clang-format (dependabot[bot]) #62467
• [`48bb51b3d7`] - tools: update nixpkgs-unstable to ab72be9733b41190ea34f1422a3e4e243ed (Node.js GitHub Bot) #62821
• [`67baa3254b`] - tools: bump @node-core/doc-kit in /tools/doc in the doc group (dependabot[bot]) #62512
• [`bdee0a859d`] - tools: exclude @node-core/doc-kit from dependabot cooldown (Levi Zim) #62775
• [`9e19f55214`] - tools: re-enable undici WPTs in daily wpt.fyi job (Filip Skokan) #62677
• [`1eedbdded9`] - tools: use upstream version of OpenSSL in test-shared (Antoine du Hamel) #62679
• [`3490c1fba1`] - tools: pass the Temporal disable flag when disabled in shell.nix (Antoine du Hamel) #62733
• [`3a29dafd2d`] - tools: fix --shared-ffi compilation on macOS (Antoine du Hamel) #62737
• [`5cb9108b9c`] - tools: update nixpkgs-unstable to 13043924aaa7375ce482ebe2494338e0582 (Node.js GitHub Bot) #62700
• [`757cd21ea0`] - tools: update gyp-next to 0.22.0 (Node.js GitHub Bot) #62697
• [`fad51c2f03`] - tools: add a check for clean git tree after tests (Antoine du Hamel) #62661
• [`d1c517fd61`] - tools: improve backport review script (Antoine du Hamel) #62573
• [`6d169c75f7`] - tools: make v8.nix more stable (Antoine du Hamel) #62508
• [`1587a60bf8`] - tools: add perfetto updater (Chengzhong Wu) #62397
• [`f54d74a5e7`] - tools: improve output for unexpected passes in WTP tests (Antoine du Hamel) #62587
• [`a86c96333c`] - tools: revert OpenSSL update workflow to ubuntu-latest (Richard Lau) #62627
• [`c9860f5800`] - tools: update nixpkgs-unstable to a6522db5b947cd7026a40d02acc3ca26136 (Node.js GitHub Bot) #62596
• [`ae41e2a141`] - tools: bump the eslint group in /tools/eslint with 2 updates (dependabot[bot]) #62552
• [`e2ba824407`] - tools: allow triagers to queue a PR for CI until it's reviewed (Antoine du Hamel) #62524
• [`899d780f15`] - tools: do not run commit-lint on release proposals (Antoine du Hamel) #62523
• [`102da27b4e`] - url: process crash via malformed UNC hostname in pathToFileURL() (Nicola Del Gobbo) #62574
• [`3abd78c3e5`] - url: optimize URLSearchParams set/delete duplicate handling (Gürgün Dayıoğlu) #62266
• [`fd3bf3830b`] - url: align default argument handling for URLPattern with webidl (Filip Skokan) #62719
• [`b85c73ff10`] - (SEMVER-MINOR)util: colorize text with hex colors (Guilherme Araújo) #61556
• [`c1d6b3db73`] - v8: add cpu profile options (Ilyas Shabi) #62684
• [`717d9a7fda`] - v8: add heap profile API (Ilyas Shabi) #62273
• [`2b885667a9`] - watch: track worker entry files in watch mode (SudhansuBandha) #62368
• [`457fb55193`] - watch: fix --env-file-if-exists crashing on linux if the file is missing (Efe) #61870

Windows 64-bit Installer: https://nodejs.org/dist/v26.1.0/node-v26.1.0-x64.msi

Windows ARM 64-bit Installer: https://nodejs.org/dist/v26.1.0/node-v26.1.0-arm64.msi

Windows 64-bit Binary: https://nodejs.org/dist/v26.1.0/win-x64/node.exe

Windows ARM 64-bit Binary: https://nodejs.org/dist/v26.1.0/win-arm64/node.exe

macOS 64-bit Installer: https://nodejs.org/dist/v26.1.0/node-v26.1.0.pkg

macOS Apple Silicon 64-bit Binary: https://nodejs.org/dist/v26.1.0/node-v26.1.0-darwin-arm64.tar.gz

macOS Intel 64-bit Binary: https://nodejs.org/dist/v26.1.0/node-v26.1.0-darwin-x64.tar.gz

Linux 64-bit Binary: https://nodejs.org/dist/v26.1.0/node-v26.1.0-linux-x64.tar.xz

Linux PPC LE 64-bit Binary: https://nodejs.org/dist/v26.1.0/node-v26.1.0-linux-ppc64le.tar.xz

Linux s390x 64-bit Binary: https://nodejs.org/dist/v26.1.0/node-v26.1.0-linux-s390x.tar.xz

AIX 64-bit Binary: https://nodejs.org/dist/v26.1.0/node-v26.1.0-aix-ppc64.tar.gz

ARMv8 64-bit Binary: https://nodejs.org/dist/v26.1.0/node-v26.1.0-linux-arm64.tar.xz

Source Code: https://nodejs.org/dist/v26.1.0/node-v26.1.0.tar.gz

Other release files: https://nodejs.org/dist/v26.1.0/

Documentation: https://nodejs.org/docs/v26.1.0/api/

[SHASUMS](http://nodejs.org/en/blog/release/v26.1.0#shasums)

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

67808a758620e6c9cc075b5c9c77600a3793c7be6d4610c7066ae6794e91db0b  node-v26.1.0-aix-ppc64.tar.gz
1b16ac3cc9ba73efdb65f1b2b39ddb746e55c3affc9684c1b6f10ecefb25639c  node-v26.1.0-arm64.msi
91063f665c2f5d6e69e4f8fcb66d3d476bc2785ace82267274bf4da789985ceb  node-v26.1.0-darwin-arm64.tar.gz
c4b028b1ab7c01e4a526524d732522f71b0ea08e8859e29514d535ce2e17d443  node-v26.1.0-darwin-arm64.tar.xz
33519b28a352de668ab0a2a64366db032a45cb629d5353f86e4576e2780f4fcf  node-v26.1.0-darwin-x64.tar.gz
6cbc3e8f528abaceca02d65e9f7df787ee7a49c245708d5bca6bc9c7c3cbf71f  node-v26.1.0-darwin-x64.tar.xz
ffae4d3d81ba3a5e88579fa36aecb3ba9b4d5ed59dbe35233df7dce035402bb0  node-v26.1.0-headers.tar.gz
3147480b0957fcd4a515078c1b16948512a273264b018b159e1896e075852a1d  node-v26.1.0-headers.tar.xz
fcb4c339eef70c909cae72091008a6497278e2d0fcd221c0653068cf4ea4f0c7  node-v26.1.0-linux-arm64.tar.gz
058f00fe6c84f804b4b96aab377f76ed57dd0be5f10af4dcc0fded172746f366  node-v26.1.0-linux-arm64.tar.xz
f3ee72a29d3d25a626bae1672667a500b12c284fcfc00f5d6162e3762ebf173f  node-v26.1.0-linux-ppc64le.tar.gz
dbe65c537c7ce339a6e193c0aa9ac5b092b92589e1c1f12c3ac8eef4f18742ff  node-v26.1.0-linux-ppc64le.tar.xz
6e381e4a3b353f335d297abfe4c7d9485459247519df10445b17cc89d8c7f7a5  node-v26.1.0-linux-s390x.tar.gz
d484cea6da8b734986786b8711652da927ba7508c044930401c66206d55577a3  node-v26.1.0-linux-s390x.tar.xz
62d555c329e05e3625109f2e3a8b5195b368d5ef38266292469d32f63cd98ffd  node-v26.1.0-linux-x64.tar.gz
9fc6f21b6c4a62439727123e510e9c39febb2f563738f4927cd3e0b288c9b3c9  node-v26.1.0-linux-x64.tar.xz
c48f0cd097575dd3fcac777421fb427cc2076895990163cb4fc0de0b9eefddaf  node-v26.1.0-win-arm64.7z
0b913d67ccef3e7e62edcecd2daf31de5fd9551936501ccd3cd5c027ada089ee  node-v26.1.0-win-arm64.zip
645eb4944098148c58fb1864e9084610ede8e630eaa36d203f0883489ca56a93  node-v26.1.0-win-x64.7z
089a02c4c687451c9f0b7f1bfd252dae85a7ba27df0295a14096bdcc956fdc92  node-v26.1.0-win-x64.zip
64a9313ae5334a3ce3e482b92d79ae4f9d62764c69d90849ec83c22854f7b0da  node-v26.1.0-x64.msi
1cf43d1e8cba1f407ddb6a683e79ccb648d2465c1c0486943b00b3dabdaa021a  node-v26.1.0.pkg
ccaf9bfea12ec3d2beb36f5a1d54483f2620ad9de007e551fb8640ed82d29989  node-v26.1.0.tar.gz
779a1364889575d44e0215adc381806bbd0d9437557b59893e172f5b9d35a990  node-v26.1.0.tar.xz
d2da4369f98ca3333f3374128237916e91bd4c9a42cfa952e085a6b42e94f41a  win-arm64/node.exe
376eb35054756d8493adc1f26495fba0b7bda7365cdb7c132130044a622d6c31  win-arm64/node.lib
703253747a04e5660756d42a4c49760a67e029cc433bf47ff5363a2291d1e3af  win-arm64/node_pdb.7z
80ef6b8b87a28f041fec9ff0bb1a4f8eaa3af457ff550361c4360c7acfb894aa  win-arm64/node_pdb.zip
35ebb74da6acb56fdf570de64f1ae510d6d18ca09da494a3e1ac87edd32d263b  win-x64/node.exe
9c236a87f9c50a26099d74f35883c28c6b279585ccc5849aa640ff23de7be9b8  win-x64/node.lib
154c4f86083a255aabe3a95dea05b2557a04674505a9c00542ecf239539c5d6d  win-x64/node_pdb.7z
28d09820ad0228f3b7e1085ade8ae38895b76ea96baee12e020c2fd88c4d1c50  win-x64/node_pdb.zip

-----BEGIN PGP SIGNATURE-----

iHUEARYIAB0WIQRb6KP2yKXAHRBsCtggsaOQsWjTVgUCafxkYgAKCRAgsaOQsWjT
VqUsAQDS9Mx+1Igqr9+8eUuVZoEqwb/Ps9JetNgrC2xonjB4JQD/Xi9Snnbu+88Z
mkEFu14+D5hcDCmaGgkUjoYU7bsPGQg=
=Be6F
-----END PGP SIGNATURE-----