net: stable blocklist by alphaleadership · Pull Request #63050 · nodejs/node

alphaleadership · 2026-04-30T13:57:33Z

No description provided.

nodejs-github-bot · 2026-04-30T13:57:39Z

Review requested:

@nodejs/net

Ethan-Arrowood · 2026-04-30T14:21:56Z

This is not how we promote a feature status.

alphaleadership · 2026-04-30T14:22:57Z

and what is the good method

Ethan-Arrowood · 2026-05-01T21:39:27Z

Look back on the history of the feature and tag the contributors / teams responsible for it in an issue or in Slack. Coordinate with them on the correct version this can be promoted to be stable in and go from there. In this case I don't think there are any necessary API changes. And then likely this should be marked as "1.2 Release Candidate" per the stabilty index: https://nodejs.org/docs/latest/api/documentation.html#stability-index

alphaleadership · 2026-05-04T12:00:41Z

@Ethan-Arrowood status corrected

alphaleadership · 2026-05-11T13:34:00Z

@Ethan-Arrowood

Signed-off-by: arbinger <alphaleadershipyt@protonmail.com>

alphaleadership · 2026-05-15T17:01:01Z

can this be merged

nodejs-github-bot · 2026-05-15T23:05:50Z

Commit Queue failed

- Loading data for nodejs/node/pull/63050
✔ Done loading data for nodejs/node/pull/63050
----------------------------------- PR info ------------------------------------
Title net: stable blocklist (#63050)
⚠ Could not retrieve the email or name of the PR author's from user's GitHub profile!
Branch alphaleadership:main -> nodejs:main
Labels semver-minor, needs-ci
Commits 1
- doc: update blockList stability status to release candidate
Committers 1
- arbinger <alphaleadershipyt@protonmail.com>
PR-URL: https://github.com/nodejs/node/pull/63050
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Ethan Arrowood <ethan@arrowood.dev>
------------------------------ Generated metadata ------------------------------
PR-URL: https://github.com/nodejs/node/pull/63050
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Ethan Arrowood <ethan@arrowood.dev>
--------------------------------------------------------------------------------
ℹ This PR was created on Thu, 30 Apr 2026 13:57:33 GMT
✔ Approvals: 2
✔ - James M Snell (@jasnell) (TSC): https://github.com/nodejs/node/pull/63050#pullrequestreview-4272409611
✔ - Ethan Arrowood (@Ethan-Arrowood): https://github.com/nodejs/node/pull/63050#pullrequestreview-4299444860
✔ Last GitHub CI successful
✘ No Jenkins CI runs detected
--------------------------------------------------------------------------------
✔ Aborted `git node land` session in /home/runner/work/node/node/.ncu

https://github.com/nodejs/node/actions/runs/25945525214

alphaleadership · 2026-05-17T06:36:42Z

Commit Queue failed
Loading data for net: stable blocklist #63050
✔ Done loading data for net: stable blocklist #63050
----------------------------------- PR info ------------------------------------
Title net: stable blocklist (net: stable blocklist #63050)
⚠ Could not retrieve the email or name of the PR author's from user's GitHub profile!
Branch alphaleadership:main -> nodejs:main
Labels semver-minor, needs-ci
Commits 1
doc: update blockList stability status to release candidate
Committers 1
arbinger alphaleadershipyt@protonmail.com
PR-URL: net: stable blocklist #63050
Reviewed-By: James M Snell jasnell@gmail.com
Reviewed-By: Ethan Arrowood ethan@arrowood.dev
------------------------------ Generated metadata ------------------------------
PR-URL: net: stable blocklist #63050
Reviewed-By: James M Snell jasnell@gmail.com
Reviewed-By: Ethan Arrowood ethan@arrowood.dev
ℹ This PR was created on Thu, 30 Apr 2026 13:57:33 GMT
✔ Approvals: 2
✔ - James M Snell (@jasnell) (TSC): #63050 (review)
✔ - Ethan Arrowood (@Ethan-Arrowood): #63050 (review)
✔ Last GitHub CI successful
✘ No Jenkins CI runs detected
✔ Aborted git node land session in /home/runner/work/node/node/.ncu
https://github.com/nodejs/node/actions/runs/25945525214

not need

Ethan-Arrowood · 2026-05-17T17:27:06Z

Please self-moderate your previous comment to respect the Node.js Code of Conduct. Thank you.

nodejs-github-bot · 2026-05-17T17:43:09Z

CI: https://ci.nodejs.org/job/node-test-pull-request/73505/

alphaleadership · 2026-05-20T11:24:52Z

Need a New ci

aduh95 · 2026-06-02T13:24:34Z

Landed in 60dab8d

Signed-off-by: arbinger <alphaleadershipyt@protonmail.com> PR-URL: #63050 Reviewed-By: James M Snell <jasnell@gmail.com> Reviewed-By: Ethan Arrowood <ethan@arrowood.dev>

Notable changes: build, doc: * generate node.1 with doc-kit (Aviv Keller) #62044 deps: * (SEMVER-MINOR) update OpenSSL build config to support compression (Tim Perry) #62217 doc: * (SEMVER-MINOR) update `blockList` stability status to release candidate (alphaleadership) #63050 fs: * (SEMVER-MINOR) support caller-supplied readFile() buffers (Matteo Collina) #63634 http: * (SEMVER-MINOR) close pre-request sockets in closeIdleConnections (semimikoh) #63470 loader: * (SEMVER-MINOR) implement package maps (Maël Nison) #62239 net: * (SEMVER-MINOR) support TCP_KEEPINTVL and TCP_KEEPCNT in setKeepAlive (Guy Bedford) #63825 tls: * (SEMVER-MINOR) add certificateCompression option (Tim Perry) #62217 vfs: * (SEMVER-MINOR) dispatch fs/promises to mounted VFS instances (Matteo Collina) #63537 * (SEMVER-MINOR) add minimal node:vfs subsystem (Matteo Collina) #63115 PR-URL: #64058

Notable changes: deps: * (SEMVER-MINOR) update OpenSSL build config to support compression (Tim Perry) #62217 doc: * (SEMVER-MINOR) update `blockList` stability status to release candidate (alphaleadership) #63050 fs: * (SEMVER-MINOR) support caller-supplied `readFile()` buffers (Matteo Collina) #63634 http: * (SEMVER-MINOR) close pre-request sockets in `closeIdleConnections` (semimikoh) #63470 loader: * (SEMVER-MINOR) implement package maps (Maël Nison) #62239 net: * (SEMVER-MINOR) support `TCP_KEEPINTVL` and `TCP_KEEPCNT` in `setKeepAlive` (Guy Bedford) #63825 tls: * (SEMVER-MINOR) add `certificateCompression` option (Tim Perry) #62217 vfs: * (SEMVER-MINOR) dispatch `node:fs/promises` to mounted VFS instances (Matteo Collina) #63537 * (SEMVER-MINOR) add minimal `node:vfs` subsystem (Matteo Collina) #63115 PR-URL: #64058

Signed-off-by: arbinger <alphaleadershipyt@protonmail.com> PR-URL: #63050 Reviewed-By: James M Snell <jasnell@gmail.com> Reviewed-By: Ethan Arrowood <ethan@arrowood.dev>

Notable changes: buffer: * (SEMVER-MINOR) implement `blob.textStream()` (Matthew Aitken) #64036 deps: * (SEMVER-MINOR) update OpenSSL build config to support compression (Tim Perry) #62217 doc: * (SEMVER-MINOR) update `blockList` stability status to release candidate (alphaleadership) #63050 * mark `stream.compose` stable (Matteo Collina) #62562 esm: * (SEMVER-MINOR) add `--experimental-import-text` flag (Efe) #62300 fs: * (SEMVER-MINOR) support caller-supplied `readFile()` buffers (Matteo Collina) #63634 http: * (SEMVER-MINOR) add `httpValidation` option to configure header value validation (RajeshKumar11) #61597 net: * (SEMVER-MINOR) support `TCP_KEEPINTVL` and `TCP_KEEPCNT` in setKeepAlive (Guy Bedford) #63825 perf_hooks: * (SEMVER-MINOR) sample delay per event loop iteration (Pablo Erhard) #62935 src: * (SEMVER-MINOR) allow empty `--experimental-config-file` (Marco Ippolito) #61610 stream: * (SEMVER-MINOR) expose `ReadableStreamTee` (Matteo Collina) #64195 tls: * (SEMVER-MINOR) report negotiated TLS groups (Filip Skokan) #64119 * (SEMVER-MINOR) add `certificateCompression` option (Tim Perry) #62217 PR-URL: #64654

Signed-off-by: arbinger <alphaleadershipyt@protonmail.com> PR-URL: #63050 Reviewed-By: James M Snell <jasnell@gmail.com> Reviewed-By: Ethan Arrowood <ethan@arrowood.dev>

Notable changes: buffer: * (SEMVER-MINOR) implement `blob.textStream()` (Matthew Aitken) #64036 deps: * (SEMVER-MINOR) update OpenSSL build config to support compression (Tim Perry) #62217 doc: * (SEMVER-MINOR) update `blockList` stability status to release candidate (alphaleadership) #63050 * mark `stream.compose` stable (Matteo Collina) #62562 esm: * (SEMVER-MINOR) add `--experimental-import-text` flag (Efe) #62300 fs: * (SEMVER-MINOR) support caller-supplied `readFile()` buffers (Matteo Collina) #63634 http: * (SEMVER-MINOR) add `httpValidation` option to configure header value validation (RajeshKumar11) #61597 net: * (SEMVER-MINOR) support `TCP_KEEPINTVL` and `TCP_KEEPCNT` in `setKeepAlive` (Guy Bedford) #63825 perf_hooks: * (SEMVER-MINOR) sample delay per event loop iteration (Pablo Erhard) #62935 src: * (SEMVER-MINOR) allow empty `--experimental-config-file` (Marco Ippolito) #61610 stream: * (SEMVER-MINOR) expose `ReadableStreamTee` (Matteo Collina) #64195 tls: * (SEMVER-MINOR) report negotiated TLS groups (Filip Skokan) #64119 * (SEMVER-MINOR) add `certificateCompression` option (Tim Perry) #62217 PR-URL: #64654

Automated mise tool upgrades from local config. Updated tools: - `action-validator` - `actionlint` - `aube` - `editorconfig-checker` - `ghalint` - `node` - `pinact` - `pipx:gh-action-pulse` - `prek` - `rumdl` - `shellcheck` - `shfmt` - `tombi` - `uv` - `yamlfmt` - `yamllint` - `zizmor` Command: `mise upgrade --bump --local action-validator actionlint aube editorconfig-checker ghalint node pinact pipx:gh-action-pulse prek rumdl shellcheck shfmt tombi uv yamlfmt yamllint zizmor` <details> <summary>Version changelog (node)</summary> | Tool | Requested | Installed | |------|-----------|-----------| | `node` | `24` → `26` | `24.18.1` → `26.5.1` | </details> <details> <summary>Release notes (1 tools)</summary> <details> <summary>node: `24.18.1` → `26.5.1` (nodejs/node)</summary> ### v25.8.2 This is a security release. ### Notable Changes * (CVE-2026-21637) wrap `SNICallback` invocation in `try`/`catch` (Matteo Collina) - High * (CVE-2026-21710) use null prototype for `headersDistinct`/`trailersDistinct` (Matteo Collina) - High * (CVE-2026-21711) include permission check to `pipe_wrap.cc` (RafaelGSS) - Medium * (CVE-2026-21712) handle url crash on different url formats (RafaelGSS) - Medium * (CVE-2026-21713) use timing-safe comparison in Web Cryptography HMAC and KMAC (Filip Skokan) - Medium * (CVE-2026-21714) handle `NGHTTP2_ERR_FLOW_CONTROL` error code (RafaelGSS) - Medium * (CVE-2026-21717) test array index hash collision (Joyee Cheung) - Medium * (CVE-2026-21715) add permission check to `realpath.native` (RafaelGSS) - Low * (CVE-2026-21716) include permission check on `lib/fs/promises` (RafaelGSS) - Low ### Commits * \[[`2086b7477b`](nodejs/node@2086b7477b)] - **(CVE-2026-21717)** **build,test**: test array index hash collision (Joyee Cheung) [nodejs-private/node-private#834](https://github.com/nodejs-private/node-private/pull/834) * \[[`0f9332a40a`](nodejs/node@0f9332a40a)] - **(CVE-2026-21713)** **crypto**: use timing-safe comparison in Web Cryptography HMAC and KMAC (Filip Skokan) [nodejs-private/node-private#822](https://github.com/nodejs-private/node-private/pull/822) * \[[`2b6937ddb2`](nodejs/node@2b6937ddb2)] - **deps**: update undici to 7.24.4 (Node.js GitHub Bot) [#62271](nodejs/node#62271) * \[[`bfb8ad5787`](nodejs/node@bfb8ad5787)] - **deps**: update undici to 7.24.3 (Node.js GitHub Bot) [#62233](nodejs/node#62233) * \[[`be6384727f`](nodejs/node@be6384727f)] - **deps**: upgrade npm to 11.11.1 (npm team) [#62216](nodejs/node#62216) * \[[`2feea5bb97`](nodejs/node@2feea5bb97)] - **deps**: V8: override… (truncated) ### v25.9.0 ### Notable Changes #### Test runner module mocking improvements `MockModuleOptions.defaultExport` and `MockModuleOptions.namedExports` have been consolidated into a single option `MockModuleOptions.exports` to align with user expectations and other test runners. A `default` property on `MockModuleOptions.exports` represents the default export, and own enumerable properties are treated as named exports. An automated migration is available to update user code: <https://github.com/nodejs/userland-migrations/tree/main/recipes/mock-module-exports> ```bash npx codemod @nodejs/mock-module-exports ``` Contributed by sangwook in [#61727](nodejs/node#61727). #### Other notable changes * \[[`312476cb84`](nodejs/node@312476cb84)] - **(SEMVER-MINOR)** **async\_hooks**: add using scopes to `AsyncLocalStorage` (Stephen Belanger) [#61674](nodejs/node#61674) * \[[`62d2cd473b`](nodejs/node@62d2cd473b)] - **(SEMVER-MINOR)** **cli**: add `--max-heap-size` option (tannal) [#58708](nodejs/node#58708) * \[[`d0ebf0e44b`](nodejs/node@d0ebf0e44b)] - **(SEMVER-MINOR)** **crypto**: add `TurboSHAKE` and `KangarooTwelve` Web Cryptography algorithms (Filip Skokan) [#62183](nodejs/node#62183) * \[[`f85b9d9fa8`](nodejs/node@f85b9d9fa8)] - **(SEMVER-MINOR)** **repl**: add customizable error handling (Anna Henningsen) [#62188](nodejs/node#62188) * \[[`67b854d407`](nodejs/node@67b854d407)] - **(SEMVER-MINOR)** **repl**: remove dependency on `node:domain` (Matteo Collina) [#61227](nodejs/node#61227) * \[[`966b700623`](nodejs/node@966b700623)] - **(SEMVER-MINOR)** **sea**: support code cache for ESM entrypoint in SEA (Joyee Cheung) [#62158](nodejs/node#62158) *… (truncated) ### v26.0.0 We're excited to announce the release of Node.js 26! Highlights include the Temporal API enabled by default, updates to the V8 JavaScript engine to 14.6, Undici to 8.0, and several important deprecations and removals as we continue to modernize the platform. As a reminder, Node.js 26 will enter long-term support (LTS) in October, but until then, it will be the "Current" release for the next six months. We encourage you to explore the new features and benefits offered by this latest release and evaluate their potential impact on your applications. ### Notable Changes #### Temporal API The Temporal API is now enabled by default in Node.js 26. Temporal is a modern date/time API for JavaScript that provides a more robust and feature-rich alternative to the legacy `Date` object. Contributed by Richard Lau in [#61806](nodejs/node#61806). #### V8 14.6 The V8 engine is updated to version 14.6.202.33, which is part of Chromium 134. This version also includes: * Upsert (<https://github.com/tc39/proposal-upsert>): `[Weak]Map.prototype.getOrInsert()`, `[Weak]Map.prototype.getOrInsertComputed()` * Iterator sequencing (<https://github.com/tc39/proposal-iterator-sequencing>): `Iterator.concat()` Contributed by Michaël Zasso in [#61898](nodejs/node#61898). #### Undici 8 Undici has been updated to version 8.0.2, bringing new features and improvements to Node.js's HTTP client implementation. #### Deprecations and Removals * \[[`dff46c07c3`](nodejs/node@dff46c07c3)] - **(SEMVER-MAJOR)** **crypto**: move DEP0182 to End-of-Life (Tobias Nießen) [#61084](nodejs/node#61084) * \[[`93c25815ee`](nodejs/node@93c25815ee)] - **(SEMVER-MAJOR)** **http**: move writeHeader to end-of-life (Sebastian Beltran) [#60635](nodejs/node#60635) `http.Server.prototype.writeHeader()` is now fully removed. Use `http.Server.prototype.write… (truncated) ### v26.1.0 ### Notable Changes #### Experimental `node:ffi` module Node.js now includes an experimental `node:ffi` module for loading dynamic libraries and calling native symbols from JavaScript. The API is gated behind the `--experimental-ffi` flag and, when the Permission Model is enabled, requires `--allow-ffi`. This API is inherently unsafe. Invalid pointers, incorrect signatures, or accessing memory after it has been freed can crash the process or corrupt memory. Contributed by Paolo Insogna in [#62072](nodejs/node#62072). #### Other Notable Changes * \[[`34a6454fe3`](nodejs/node@34a6454fe3)] - **(SEMVER-MINOR)** **buffer**: add `end` parameter (Robert Nagy) [#62390](nodejs/node#62390) * \[[`073e84d7fe`](nodejs/node@073e84d7fe)] - **(SEMVER-MINOR)** **crypto**: accept key data in `crypto.diffieHellman()` and cleanup DH jobs (Filip Skokan) [#62527](nodejs/node#62527) * \[[`5b9cb10a5f`](nodejs/node@5b9cb10a5f)] - **(SEMVER-MINOR)** **crypto**: implement `randomUUIDv7()` (nabeel378) [#62553](nodejs/node#62553) * \[[`98f9becd16`](nodejs/node@98f9becd16)] - **(SEMVER-MINOR)** **debugger**: add edit-free runtime expression probes to `node inspect` (Joyee Cheung) [#62713](nodejs/node#62713) * \[[`06defaa2ea`](nodejs/node@06defaa2ea)] - **(SEMVER-MINOR)** **fs**: add `signal` option to `fs.stat()` (Mert Can Altin) [#57775](nodejs/node#57775) * \[[`db66a963bf`](nodejs/node@db66a963bf)] - **(SEMVER-MINOR)** **fs**: expose `frsize` field in `statfs` (Jinho Jang) [#62277](nodejs/node#62277) * \[[`87adb3472b`](nodejs/node@87adb3472b)] - **(SEMVER-MINOR)** **http**: harden `ClientRequest` options merge (Matteo Collina) [#6… (truncated) ### v26.2.0 ### Notable Changes * \[[`189d43a193`](nodejs/node@189d43a193)] - **doc**: mark `stream.compose` stable (Matteo Collina) [#62562](nodejs/node#62562) * \[[`f858c6140e`](nodejs/node@f858c6140e)] - **(SEMVER-MINOR)** **fs**: add `Temporal.Instant` support to `Stats` and `BigIntStats` (Livia Medeiros) [#60789](nodejs/node#60789) * \[[`0cbb3895df`](nodejs/node@0cbb3895df)] - **(SEMVER-MINOR)** **http**: add `writeInformation` to send arbitrary 1xx status codes (Tim Perry) [#63155](nodejs/node#63155) ### Commits * \[[`9a394bab84`](nodejs/node@9a394bab84)] - **benchmark**: respect stream/iter broadcast backpressure (Trivikram Kamat) [#63314](nodejs/node#63314) * \[[`ad98b4620b`](nodejs/node@ad98b4620b)] - **crypto**: align verifyOneShot accepted types (Anshika Jain) [#63280](nodejs/node#63280) * \[[`ba0736a847`](nodejs/node@ba0736a847)] - **crypto**: wire ML-DSA and ML-KEM for use when using BoringSSL (Filip Skokan) [#63255](nodejs/node#63255) * \[[`5573a6a4a8`](nodejs/node@5573a6a4a8)] - **crypto**: wire ChaCha20-Poly1305 in Web Cryptography when using BoringSSL (Filip Skokan) [#63255](nodejs/node#63255) * \[[`7dc563b8d6`](nodejs/node@7dc563b8d6)] - **crypto**: wire AES-KW in Web Cryptography when using BoringSSL (Filip Skokan) [#63255](nodejs/node#63255) * \[[`b55e2b1f4d`](nodejs/node@b55e2b1f4d)] - **crypto**: improve system certificate enumeration logic on macOS (Robo) [#62576](nodejs/node#62576) * \[[`fd509a755a`](nodejs/node@fd509a755a)] - **crypto**: harden CryptoKey algorithm slots… (truncated) ### v26.3.0 ### Notable Changes #### Potential changes to macOS Universal Binary availability With Apple and its ecosystem progressively dropping support for Intel-based architectures, it has become apparent that the Node.js project may not be able to maintain the universal binaries we currently distribute for the full lifetime of Node.js 26. This change serves to communicate that risk. At present, our intention remains to continue shipping universal binaries supporting both Apple Silicon and Intel-based Macs for as long as practical. Contributed by Antoine du Hamel in [#63055](nodejs/node#63055). #### Other notable changes * \[[`a2a4b33dd8`](nodejs/node@a2a4b33dd8)] - **(SEMVER-MINOR)** **buffer**: increase `Buffer.poolSize` default to 64 KiB (Matteo Collina) [#63597](nodejs/node#63597) * \[[`051a2152f7`](nodejs/node@051a2152f7)] - **crypto**: update root certificates to NSS 3.123.1 (Node.js GitHub Bot) [#63527](nodejs/node#63527) * \[[`49462eca37`](nodejs/node@49462eca37)] - **(SEMVER-MINOR)** **http**: add `httpValidation` option to configure header value validation (RajeshKumar11) [#61597](nodejs/node#61597) * \[[`97b7ab19bd`](nodejs/node@97b7ab19bd)] - **(SEMVER-MINOR)** **inspector**: expose precise coverage start to JS runtime (sangwook) [#63079](nodejs/node#63079) * \[[`cfb80a2103`](nodejs/node@cfb80a2103)] - **(SEMVER-MINOR)** **lib,permission**: add `permission.drop` (Rafael Gonzaga) [#62672](nodejs/node#62672) ### Commits * \[[`a2a4b33dd8`](nodejs/node@a2a4b33dd8)] - **(SEMVER-MINOR)** **buffer**: increase Buffer.poolSize default to 64 KiB (Matteo Collina) [#63597](nodejs/node#63597) * \[[`0eff3e23b9`](https://github.com/nodejs/n… (truncated) ### v26.3.1 This is a security release. ### Notable Changes * (CVE-2026-48618) tls: normalize hostname for server identity checks (Matteo Collina) – High * (CVE-2026-48933) crypto: guard WebCrypto cipher output length (Filip Skokan) – High * (CVE-2026-48615) lib,test: redact proxy credentials in tunnel errors (Matteo Collina) – Medium * (CVE-2026-48619) http2: cap originSet size to prevent unbounded memory growth (Matteo Collina) – Medium * (CVE-2026-48928) tls: fix case-sensitive SNI context matching (Matteo Collina) – Medium * (CVE-2026-48930) dns,net: reject hostnames with embedded NUL bytes (Matteo Collina) – Medium * (CVE-2026-48934) tls: bind reusable sessions to authenticated host (Matteo Collina) – Medium * (CVE-2026-48617) permission: handle process.chdir on writereport (RafaelGSS) – Low * (CVE-2026-48931) http: fix response queue poisoning in http.Agent (Matteo Collina) – Low * (CVE-2026-48935) permission: disable FileHandle utimes with permission model (RafaelGSS) – Low * (CVE-2026-48936) permission: guard pipe open and chmod with net scope (RafaelGSS) – Low ### Commits * \[[`98fbc89211`](nodejs/node@98fbc89211)] - **(CVE-2026-48933)** **crypto**: guard WebCrypto cipher output length (Filip Skokan) [nodejs-private/node-private#878](https://github.com/nodejs-private/node-private/pull/878) * \[[`110840f2c7`](nodejs/node@110840f2c7)] - **deps**: update llhttp to 9.4.2 (Antoine du Hamel) [nodejs-private/node-private#890](https://github.com/nodejs-private/node-private/pull/890) * \[[`8d36d522b2`](nodejs/node@8d36d522b2)] - **deps**: update undici to 8.5.0 (Node.js GitHub Bot) [#63903](nodejs/node#63903) * \[[`2e6d03993a`](nodejs/node@2e6d03993a)] - **deps**: update undici to 8.4.0 (Node.js GitHub Bot) [#63779](nodejs/node#63779) * \[[`5a17d5b07a`](nodejs/node@5a17d5b07a)] - **deps… (truncated) ### v26.4.0 ### Notable Changes * \[[`cde0daabcc`](nodejs/node@cde0daabcc)] - **(SEMVER-MINOR)** **doc**: update `blockList` stability status to release candidate (alphaleadership) [#63050](nodejs/node#63050) * \[[`b78f5a7537`](nodejs/node@b78f5a7537)] - **(SEMVER-MINOR)** **fs**: support caller-supplied `readFile()` buffers (Matteo Collina) [#63634](nodejs/node#63634) * \[[`417aacbc36`](nodejs/node@417aacbc36)] - **(SEMVER-MINOR)** **http**: close pre-request sockets in `closeIdleConnections` (semimikoh) [#63470](nodejs/node#63470) * \[[`fbb108be7d`](nodejs/node@fbb108be7d)] - **(SEMVER-MINOR)** **loader**: implement package maps (Maël Nison) [#62239](nodejs/node#62239) * \[[`45494d5a8a`](nodejs/node@45494d5a8a)] - **(SEMVER-MINOR)** **net**: support `TCP_KEEPINTVL` and `TCP_KEEPCNT` in `setKeepAlive` (Guy Bedford) [#63825](nodejs/node#63825) * \[[`ee29465e77`](nodejs/node@ee29465e77)] - **(SEMVER-MINOR)** **tls**: add certificateCompression option (Tim Perry) [#62217](nodejs/node#62217) * \[[`b17817eb2b`](nodejs/node@b17817eb2b)] - **(SEMVER-MINOR)** **vfs**: dispatch `node:fs/promises` to mounted VFS instances (Matteo Collina) [#63537](nodejs/node#63537) * \[[`7bc93a6ac5`](nodejs/node@7bc93a6ac5)] - **(SEMVER-MINOR)** **vfs**: add minimal `node:vfs` subsystem (Matteo Collina) [#63115](nodejs/node#63115) ### Commits * \[[`c7eb83b46a`](nodejs/node@c7eb83b46a)] - **benchmark**: add child\_process async path baselines (Yagiz Nizipli) [#63929](nodejs/node#63929) * \[[`066fff17a5`](https://github.com/nodejs/node/commit/066f… (truncated) ### v26.5.0 ### Notable Changes #### New release key Welcome to our newest releaser, [Stewart X Addison](https://github.com/sxa). Future Node.js releases may be signed with his [release key](https://github.com/nodejs/node/blob/main/README.md#release-keys), `655F3B5C1FB3FA8D1A0CA6BDE4A7D232B936D2FD`. #### Other notable changes * \[[`55f48446c7`](nodejs/node@55f48446c7)] - **(SEMVER-MINOR)** **buffer**: implement blob.textStream() (Matthew Aitken) [#64036](nodejs/node#64036) * \[[`b373202efc`](nodejs/node@b373202efc)] - **(SEMVER-MINOR)** **esm**: add `--experimental-import-text` flag (Efe) [#62300](nodejs/node#62300) * \[[`39e0c14455`](nodejs/node@39e0c14455)] - **(SEMVER-MINOR)** **perf\_hooks**: sample delay per event loop iteration (Pablo Erhard) [#62935](nodejs/node#62935) * \[[`999a83c937`](nodejs/node@999a83c937)] - **(SEMVER-MINOR)** **stream**: expose ReadableStreamTee (Matteo Collina) [#64195](nodejs/node#64195) * \[[`4e0236dc3d`](nodejs/node@4e0236dc3d)] - **(SEMVER-MINOR)** **tls**: report negotiated TLS groups (Filip Skokan) [#64119](nodejs/node#64119) ### Commits * \[[`87648c0a6c`](nodejs/node@87648c0a6c)] - **benchmark**: trim down the argon2 sets (Filip Skokan) [#64218](nodejs/node#64218) * \[[`a483bfd3f0`](nodejs/node@a483bfd3f0)] - **buffer**: remove unreachable overflow check in atob (haramjeong) [#60161](nodejs/node#60161) * \[[`6d14279688`](nodejs/node@6d14279688)] - **buffer**: add fast api for isUtf8 and isAscii (Gürgün Dayıoğlu) [#64169](nodejs/node#64169) * \[[`55f48446c7`](nodejs/node@55f48446c7)] -… (truncated) ### v26.5.1 This is a security release. ### Notable Changes * (CVE-2026-56848) http2: defer rst stream while in scope (Matteo Collina) – High * (CVE-2026-58043) permission: avoid granting radix split nodes (RafaelGSS) – High * (CVE-2026-56850) https: distinguish PFX object-array agent keys (RafaelGSS) – Medium * (CVE-2026-58040) https: bind identity checks to session reuse (Matteo Collina) – Medium * (CVE-2026-58041) sqlite: invalidate tag store iterators on statement reset (Matteo Collina) – Medium * (CVE-2026-58042) dns: handle large resolveAny address replies (RafaelGSS) – Medium * (CVE-2026-58045) zlib: throw on out-of-bounds write buffers (RafaelGSS) – Medium * (CVE-2026-56847) permission: enforce fs write permission for trace events (RafaelGSS) – Low * (CVE-2026-58039) permission: check final report output path (RafaelGSS) – Low * (CVE-2026-58044) http: reject requests exceeding max header count (Matteo Collina) – Low * deps: update llhttp to 9.4.3 (Paolo Insogna) * deps: update undici to 8.9.0 (Node.js GitHub Bot) ### Commits * \[[`af0bf96877`](nodejs/node@af0bf96877)] - **deps**: update llhttp to 9.4.3 (Paolo Insogna) [nodejs-private/node-private#935](https://github.com/nodejs-private/node-private/pull/935) * \[[`0354678355`](nodejs/node@0354678355)] - **deps**: update undici to 8.9.0 (Node.js GitHub Bot) [#64712](nodejs/node#64712) * \[[`dbeeaeec13`](nodejs/node@dbeeaeec13)] - **(CVE-2026-58042)** **dns**: handle large resolveAny address replies (RafaelGSS) [nodejs-private/node-private#929](https://github.com/nodejs-private/node-private/pull/929) * \[[`064d339f56`](nodejs/node@064d339f56)] - **(CVE-2026-58044)** **http**: reject requests exceeding max header count (Matteo Collina) [nodejs-private/node-private#922](https://github.com/nodejs-private/node-private/pull/922) * \[[`23b94c843a`](https://github.… (truncated) _Omitted 12 older releases._ </details> </details> Modified files: - `.mise.toml`

nodejs-github-bot added the needs-ci PRs that need a full CI run. label Apr 30, 2026

doc: update blockList stability status to release candidate
e5356c5
Signed-off-by: arbinger <alphaleadershipyt@protonmail.com>

alphaleadership force-pushed the main branch from c941992 to e5356c5Compare May 12, 2026 11:45

jasnell approved these changes May 12, 2026
View reviewed changes

mertcanaltin approved these changes May 12, 2026
View reviewed changes

Ethan-Arrowood approved these changes May 15, 2026
View reviewed changes

jasnell added semver-minor PRs that contain new features and should be released in the next minor version. commit-queue Add this label to land a pull request using GitHub Actions. labels May 15, 2026

nodejs-github-bot added commit-queue-failed An error occurred while landing this pull request using GitHub Actions. and removed commit-queue Add this label to land a pull request using GitHub Actions. labels May 15, 2026

Ethan-Arrowood added request-ci Add this label to start a Jenkins CI on a PR. and removed commit-queue-failed An error occurred while landing this pull request using GitHub Actions. labels May 17, 2026

github-actionsBot removed the request-ci Add this label to start a Jenkins CI on a PR. label May 17, 2026

alphaleadership requested review from Ethan-Arrowood and jasnell May 27, 2026 14:56

aduh95 added author ready PRs that have at least one approval, no pending requests for changes, and a CI started. and removed needs-ci PRs that need a full CI run. labels Jun 2, 2026

aduh95 merged commit 60dab8d into nodejs:mainJun 2, 2026
55 of 59 checks passed

github-actionsBot mentioned this pull request Jun 22, 2026
2026-06-23, Version 26.4.0 (Current) #64058
Merged

github-actionsBot mentioned this pull request Jul 21, 2026
2026-07-22, Version 24.19.0 'Krypton' (LTS) #64654
Merged

ghappforreleasepleaseBot mentioned this pull request Jul 27, 2026
chore(mise): upgrade local tools jylenhof/mise-update-tool#18
Closed

ghappforreleasepleaseBot mentioned this pull request Aug 3, 2026
chore(mise): upgrade local tools jylenhof/mise-update-tool#23
Closed

Uh oh!

Uh oh!

Conversation

alphaleadership commented Apr 30, 2026

Uh oh!

nodejs-github-bot commented Apr 30, 2026

Uh oh!

Ethan-Arrowood commented Apr 30, 2026

Uh oh!

alphaleadership commented Apr 30, 2026

Uh oh!

Ethan-Arrowood commented May 1, 2026

Uh oh!

alphaleadership commented May 4, 2026• edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

alphaleadership commented May 11, 2026

Uh oh!

alphaleadership commented May 15, 2026

Uh oh!

nodejs-github-bot commented May 15, 2026

Uh oh!

alphaleadership commented May 17, 2026• edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

ℹ This PR was created on Thu, 30 Apr 2026 13:57:33 GMT ✔ Approvals: 2 ✔ - James M Snell (@jasnell) (TSC): #63050 (review) ✔ - Ethan Arrowood (@Ethan-Arrowood): #63050 (review) ✔ Last GitHub CI successful ✘ No Jenkins CI runs detected

Uh oh!

Ethan-Arrowood commented May 17, 2026

Uh oh!

nodejs-github-bot commented May 17, 2026

Uh oh!

alphaleadership commented May 20, 2026

Uh oh!

Uh oh!

aduh95 commented Jun 2, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

6 participants

alphaleadership commented May 4, 2026•
edited
Loading

alphaleadership commented May 17, 2026•
edited
Loading

ℹ This PR was created on Thu, 30 Apr 2026 13:57:33 GMT
✔ Approvals: 2
✔ - James M Snell (@jasnell) (TSC): #63050 (review)
✔ - Ethan Arrowood (@Ethan-Arrowood): #63050 (review)
✔ Last GitHub CI successful
✘ No Jenkins CI runs detected