Skip to content

buffer: add fast api for isUtf8 and isAscii - #64169

Merged
aduh95 merged 1 commit into
nodejs:mainfrom
gurgunday:feat/fast-api-isUtf8
Jul 6, 2026
Merged

buffer: add fast api for isUtf8 and isAscii#64169
aduh95 merged 1 commit into
nodejs:mainfrom
gurgunday:feat/fast-api-isUtf8

Conversation

@gurgunday

@gurgundaygurgunday commented Jun 27, 2026•
edited
Loading

Copy link
Copy Markdown
Member

I like V8's fast api constraints, so I'm in the process of checking if there are any easy wins that we haven't yet spotted

Benchmarks (3 run avg, M5 Pro):

 Benchmark Baseline avg New avg Delta
━━━━━━━━━━━━━━━━━━━━━━ ━━━━━━━━━━━━━━ ━━━━━━━━━━━━ ━━━━━━━━━
isAscii short 35,991,851 41,781,518 +16.09%
────────────────────── ────────────── ──────────── ─────────
isAscii long 36,288,837 41,568,699 +14.55%
────────────────────── ────────────── ──────────── ─────────
isUtf8 regular short 62,235,173 77,679,543 +24.82%
────────────────────── ────────────── ──────────── ─────────
isUtf8 unicode short 54,727,530 67,448,276 +23.24%
────────────────────── ────────────── ──────────── ─────────
isUtf8 regular long 21,936,234 23,323,246 +6.32%
────────────────────── ────────────── ──────────── ─────────
isUtf8 unicode long 1,415,756 1,424,730 +0.63%

main:

./node benchmark/run.js --filter buffer-isutf8 --filter buffer-isascii buffers
buffers/buffer-isascii.js
buffers/buffer-isascii.js input="hello world" length="short" n=20000000: 36,815,465.272773266
buffers/buffer-isascii.js input="hello world" length="long" n=20000000: 36,183,770.13174511
buffers/buffer-isascii.js input="hello world" length="short" n=20000000: 36,618,408.943863295
buffers/buffer-isascii.js input="hello world" length="long" n=20000000: 35,746,630.542265736
buffers/buffer-isascii.js input="hello world" length="short" n=20000000: 36,457,306.78481872
buffers/buffer-isascii.js input="hello world" length="long" n=20000000: 36,401,698.177805796
buffers/buffer-isutf8.js
buffers/buffer-isutf8.js input="regular string" length="short" n=20000000: 62,364,681.698319875
buffers/buffer-isutf8.js input="∀x∈ℝ: ⌈x⌉ = −⌊−x⌋" length="short" n=20000000: 55,971,859.319343686
buffers/buffer-isutf8.js input="regular string" length="long" n=20000000: 22,072,747.830241162
buffers/buffer-isutf8.js input="∀x∈ℝ: ⌈x⌉ = −⌊−x⌋" length="long" n=20000000: 1,428,668.0720477349
buffers/buffer-isutf8.js input="regular string" length="short" n=20000000: 61,692,629.901998825
buffers/buffer-isutf8.js input="∀x∈ℝ: ⌈x⌉ = −⌊−x⌋" length="short" n=20000000: 55,769,467.558882594
buffers/buffer-isutf8.js input="regular string" length="long" n=20000000: 21,656,043.985478327
buffers/buffer-isutf8.js input="∀x∈ℝ: ⌈x⌉ = −⌊−x⌋" length="long" n=20000000: 1,411,666.258768642
buffers/buffer-isutf8.js input="regular string" length="short" n=20000000: 60,205,383.199316956
buffers/buffer-isutf8.js input="∀x∈ℝ: ⌈x⌉ = −⌊−x⌋" length="short" n=20000000: 54,345,813.96273032
buffers/buffer-isutf8.js input="regular string" length="long" n=20000000: 21,706,677.55977208
buffers/buffer-isutf8.js input="∀x∈ℝ: ⌈x⌉ = −⌊−x⌋" length="long" n=20000000: 1,417,130.332308522

branch:

./node benchmark/run.js --filter buffer-isutf8 --filter buffer-isascii buffers
buffers/buffer-isascii.js
buffers/buffer-isascii.js input="hello world" length="short" n=20000000: 42,042,571.75319534
buffers/buffer-isascii.js input="hello world" length="long" n=20000000: 41,993,784.33620464
buffers/buffer-isascii.js input="hello world" length="short" n=20000000: 41,651,213.719283365
buffers/buffer-isascii.js input="hello world" length="long" n=20000000: 41,547,685.95250074
buffers/buffer-isascii.js input="hello world" length="short" n=20000000: 41,650,769.262218766
buffers/buffer-isascii.js input="hello world" length="long" n=20000000: 41,164,626.14506766
buffers/buffer-isutf8.js
buffers/buffer-isutf8.js input="regular string" length="short" n=20000000: 78,129,501.6021431
buffers/buffer-isutf8.js input="∀x∈ℝ: ⌈x⌉ = −⌊−x⌋" length="short" n=20000000: 67,884,812.56127538
buffers/buffer-isutf8.js input="regular string" length="long" n=20000000: 23,347,893.348125998
buffers/buffer-isutf8.js input="∀x∈ℝ: ⌈x⌉ = −⌊−x⌋" length="long" n=20000000: 1,438,952.7056895334
buffers/buffer-isutf8.js input="regular string" length="short" n=20000000: 78,384,482.64411178
buffers/buffer-isutf8.js input="∀x∈ℝ: ⌈x⌉ = −⌊−x⌋" length="short" n=20000000: 68,071,405.20227206
buffers/buffer-isutf8.js input="regular string" length="long" n=20000000: 23,444,653.604879595
buffers/buffer-isutf8.js input="∀x∈ℝ: ⌈x⌉ = −⌊−x⌋" length="long" n=20000000: 1,421,397.567430693
buffers/buffer-isutf8.js input="regular string" length="short" n=20000000: 76,524,646.0555287
buffers/buffer-isutf8.js input="∀x∈ℝ: ⌈x⌉ = −⌊−x⌋" length="short" n=20000000: 66,388,609.0424605
buffers/buffer-isutf8.js input="regular string" length="long" n=20000000: 23,177,192.30868906
buffers/buffer-isutf8.js input="∀x∈ℝ: ⌈x⌉ = −⌊−x⌋" length="long" n=20000000: 1,413,840.9062698097

@nodejs-github-botnodejs-github-bot added buffer Issues and PRs related to the buffer subsystem. c++ Issues and PRs that require attention from people who are familiar with C++. needs-ci PRs that need a full CI run. labels Jun 27, 2026
@gurgunday
gurgundayforce-pushed the feat/fast-api-isUtf8 branch from 9929ec2 to 0217108CompareJune 27, 2026 11:40
@gurgundaygurgunday added the performance Issues and PRs related to the performance of Node.js. label Jun 27, 2026
@gurgunday

gurgunday commented Jun 29, 2026

Copy link
Copy Markdown
MemberAuthor

Cc @nodejs/performance

@gurgundaygurgunday added the request-ci Add this label to start a Jenkins CI on a PR. label Jun 29, 2026
@github-actionsgithub-actionsBot removed the request-ci Add this label to start a Jenkins CI on a PR. label Jun 29, 2026
@nodejs-github-bot

nodejs-github-bot commented Jun 29, 2026

Copy link
Copy Markdown
Collaborator

CI: https://ci.nodejs.org/job/node-test-pull-request/74438/

addaleax
addaleax reviewed Jun 29, 2026
View reviewed changes
Comment threadsrc/node_buffer.cc Outdated
Comment threadsrc/node_buffer.cc Outdated
mcollina
mcollina approved these changes Jun 29, 2026
View reviewed changes

@mcollinamcollina left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

lgtm

@gurgunday

gurgunday commented Jun 29, 2026

Copy link
Copy Markdown
MemberAuthor

@addaleax PTAL, I did indeed find struct to be the cleaner here

@addaleaxaddaleax added author ready PRs that have at least one approval, no pending requests for changes, and a CI started. request-ci Add this label to start a Jenkins CI on a PR. labels Jun 30, 2026
@github-actionsgithub-actionsBot removed the request-ci Add this label to start a Jenkins CI on a PR. label Jun 30, 2026
@nodejs-github-bot

nodejs-github-bot commented Jun 30, 2026

Copy link
Copy Markdown
Collaborator

CI: https://ci.nodejs.org/job/node-test-pull-request/74447/

@addaleaxaddaleax added the request-ci Add this label to start a Jenkins CI on a PR. label Jul 2, 2026
@github-actionsgithub-actionsBot removed the request-ci Add this label to start a Jenkins CI on a PR. label Jul 2, 2026
@nodejs-github-bot

nodejs-github-bot commented Jul 2, 2026

Copy link
Copy Markdown
Collaborator

CI: https://ci.nodejs.org/job/node-test-pull-request/74510/

@gurgunday@aduh95
buffer: add fast api for isUtf8 and isAscii
c9f8721
Signed-off-by: Gürgün Dayıoğlu <hey@gurgun.day>
PR-URL: nodejs#64169
Reviewed-By: Daniel Lemire <daniel@lemire.me>
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
Reviewed-By: Anna Henningsen <anna@addaleax.net>
@aduh95
aduh95force-pushed the feat/fast-api-isUtf8 branch from 7907c52 to c9f8721CompareJuly 6, 2026 07:14
@aduh95

aduh95 commented Jul 6, 2026

Copy link
Copy Markdown
Contributor

Landed in c9f8721

@aduh95
aduh95 merged commit c9f8721 into nodejs:mainJul 6, 2026
30 checks passed
@codecov

codecovBot commented Jul 6, 2026

Copy link
Copy Markdown

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 92.04%. Comparing base (e6a8d06) to head (c9f8721).
⚠️ Report is 244 commits behind head on main.

Additional details and impacted files
@@ Coverage Diff @@## main #64169 +/- ##
==========================================
+ Coverage 92.01% 92.04% +0.03% 
==========================================
Files 379 381 +2 Lines 166972 169314 +2342 Branches 25554 25964 +410 ==========================================
+ Hits 153639 155852 +2213 - Misses 13041 13173 +132 + Partials 292 289 -3

see 105 files with indirect coverage changes

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
  • 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

richardlau pushed a commit that referenced this pull request Jul 6, 2026
@gurgunday@richardlau
buffer: add fast api for isUtf8 and isAscii
6d14279
Signed-off-by: Gürgün Dayıoğlu <hey@gurgun.day>
PR-URL: #64169
Reviewed-By: Daniel Lemire <daniel@lemire.me>
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
Reviewed-By: Anna Henningsen <anna@addaleax.net>
@github-actionsgithub-actionsBot mentioned this pull request Jul 6, 2026
Merged
@gurgunday
gurgunday deleted the feat/fast-api-isUtf8 branch July 6, 2026 18:44
@slagiewkaslagiewka mentioned this pull request Jul 8, 2026
Open
aduh95 pushed a commit that referenced this pull request Jul 8, 2026
@gurgunday@aduh95
buffer: add fast api for isUtf8 and isAscii
08a4638
Signed-off-by: Gürgün Dayıoğlu <hey@gurgun.day>
PR-URL: #64169
Reviewed-By: Daniel Lemire <daniel@lemire.me>
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
Reviewed-By: Anna Henningsen <anna@addaleax.net>
tmeijn pushed a commit to tmeijn/dotfiles that referenced this pull request Jul 9, 2026
ECG BotTyrone Meijn
build(deps): update node.js to v26.5.0
b17b6dc
This MR contains the following updates:
| Package | Update | Change |
|---|---|---|
| [node](https://nodejs.org) ([source](https://github.com/nodejs/node)) | minor | `26.3.1` → `26.5.0` |
MR created with the help of [el-capitano/tools/renovate-bot](https://gitlab.com/el-capitano/tools/renovate-bot).
**Proposed changes to behavior should be submitted there as MRs.**
---
### Release Notes
<details>
<summary>nodejs/node (node)</summary>
### [`v26.5.0`](https://github.com/nodejs/node/releases/tag/v26.5.0): 2026-07-08, Version 26.5.0 (Current), @&#8203;richardlau
[Compare Source](nodejs/node@v26.3.1...v26.5.0)
##### Notable Changes
##### New release key
Welcome to our newest releaser, [Stewart X Addison](https://github.com/sxa). Future Node.js releases may be signed with his [release key](https://github.com/nodejs/node/blob/main/README.md#release-keys), `655F3B5C1FB3FA8D1A0CA6BDE4A7D232B936D2FD`.
##### Other notable changes
- \[[`55f48446c7`](nodejs/node@55f48446c7)] - **(SEMVER-MINOR)** **buffer**: implement blob.textStream() (Matthew Aitken) [#&#8203;64036](nodejs/node#64036)
- \[[`b373202efc`](nodejs/node@b373202efc)] - **(SEMVER-MINOR)** **esm**: add `--experimental-import-text` flag (Efe) [#&#8203;62300](nodejs/node#62300)
- \[[`39e0c14455`](nodejs/node@39e0c14455)] - **(SEMVER-MINOR)** **perf\_hooks**: sample delay per event loop iteration (Pablo Erhard) [#&#8203;62935](nodejs/node#62935)
- \[[`999a83c937`](nodejs/node@999a83c937)] - **(SEMVER-MINOR)** **stream**: expose ReadableStreamTee (Matteo Collina) [#&#8203;64195](nodejs/node#64195)
- \[[`4e0236dc3d`](nodejs/node@4e0236dc3d)] - **(SEMVER-MINOR)** **tls**: report negotiated TLS groups (Filip Skokan) [#&#8203;64119](nodejs/node#64119)
##### Commits
- \[[`87648c0a6c`](nodejs/node@87648c0a6c)] - **benchmark**: trim down the argon2 sets (Filip Skokan) [#&#8203;64218](nodejs/node#64218)
- \[[`a483bfd3f0`](nodejs/node@a483bfd3f0)] - **buffer**: remove unreachable overflow check in atob (haramjeong) [#&#8203;60161](nodejs/node#60161)
- \[[`6d14279688`](nodejs/node@6d14279688)] - **buffer**: add fast api for isUtf8 and isAscii (Gürgün Dayıoğlu) [#&#8203;64169](nodejs/node#64169)
- \[[`55f48446c7`](nodejs/node@55f48446c7)] - **(SEMVER-MINOR)** **buffer**: implement blob.textStream() (Matthew Aitken) [#&#8203;64036](nodejs/node#64036)
- \[[`a67d9a7a44`](nodejs/node@a67d9a7a44)] - **build**: allow linting node.1 (Aviv Keller) [#&#8203;64157](nodejs/node#64157)
- \[[`06c1fbc25b`](nodejs/node@06c1fbc25b)] - **build**: enable Maglev for riscv64 (Jamie Magee) [#&#8203;62605](nodejs/node#62605)
- \[[`518309c363`](nodejs/node@518309c363)] - **build**: suppress clang errors building libffi on Windows (René) [#&#8203;64222](nodejs/node#64222)
- \[[`6a80ab485c`](nodejs/node@6a80ab485c)] - **build**: add manually-dispatched stress-test workflow (Joyee Cheung) [#&#8203;64118](nodejs/node#64118)
- \[[`f4e7bf1f1c`](nodejs/node@f4e7bf1f1c)] - **build**: pin envinfo versions in github actions (Joyee Cheung) [#&#8203;64117](nodejs/node#64117)
- \[[`66f6ac0d86`](nodejs/node@66f6ac0d86)] - **build**: support setting an emulator from configure script (Ivan Trubach) [#&#8203;53899](nodejs/node#53899)
- \[[`7f26c54aa6`](nodejs/node@7f26c54aa6)] - **child\_process**: fix permission model propagation via NODE\_OPTIONS (Matteo Collina) [#&#8203;63972](nodejs/node#63972)
- \[[`32bb554f5b`](nodejs/node@32bb554f5b)] - **crypto**: fix large DH generator validation (Tobias Nießen) [#&#8203;64092](nodejs/node#64092)
- \[[`0908d76ef6`](nodejs/node@0908d76ef6)] - **crypto**: reject small-order EdDSA points during verify (Filip Skokan) [#&#8203;64026](nodejs/node#64026)
- \[[`7f7e5863c2`](nodejs/node@7f7e5863c2)] - **deps**: update undici to 8.7.0 (Node.js GitHub Bot) [#&#8203;64282](nodejs/node#64282)
- \[[`af91029801`](nodejs/node@af91029801)] - **deps**: update nghttp3 to 1.17.0 (Node.js GitHub Bot) [#&#8203;64182](nodejs/node#64182)
- \[[`2e500ba7b0`](nodejs/node@2e500ba7b0)] - **deps**: update googletest to [`8b53336`](nodejs/node@8b53336) (Node.js GitHub Bot) [#&#8203;64181](nodejs/node#64181)
- \[[`74e3aa24ba`](nodejs/node@74e3aa24ba)] - **deps**: update sqlite to 3.53.3 (Node.js GitHub Bot) [#&#8203;64180](nodejs/node#64180)
- \[[`c7e57f55a7`](nodejs/node@c7e57f55a7)] - **deps**: c-ares: cherry-pick [`8ba37af`](nodejs/node@8ba37af8e3fb) (René) [#&#8203;64110](nodejs/node#64110)
- \[[`879fdc4daf`](nodejs/node@879fdc4daf)] - **deps**: V8: backport [`da20a19`](nodejs/node@da20a197a7f9) (Kevin Gibbons) [#&#8203;64101](nodejs/node#64101)
- \[[`a640543a7c`](nodejs/node@a640543a7c)] - **deps**: V8: cherry-pick [`0cc9eb2`](nodejs/node@0cc9eb22c0b0) (Kevin Gibbons) [#&#8203;64101](nodejs/node#64101)
- \[[`feefd179e5`](nodejs/node@feefd179e5)] - **deps**: V8: cherry-pick [`1a391f9`](nodejs/node@1a391f98cc7a) (Kevin Gibbons) [#&#8203;64101](nodejs/node#64101)
- \[[`8ef643d4b0`](nodejs/node@8ef643d4b0)] - **deps**: update googletest to [`0b1e895`](nodejs/node@0b1e895) (Node.js GitHub Bot) [#&#8203;64039](nodejs/node#64039)
- \[[`9e50bb0655`](nodejs/node@9e50bb0655)] - **dgram**: skip dns.lookup() for literal IP addresses (Ruben Bridgewater) [#&#8203;64133](nodejs/node#64133)
- \[[`dc052c095c`](nodejs/node@dc052c095c)] - **diagnostics\_channel**: return original thenable (Stephen Belanger) [#&#8203;62407](nodejs/node#62407)
- \[[`a22a840293`](nodejs/node@a22a840293)] - **doc**: clarify QUIC stream state wording (EduardF1) [#&#8203;63660](nodejs/node#63660)
- \[[`8d4bec2d71`](nodejs/node@8d4bec2d71)] - **doc**: update Http2SecureServer.on("timeout") default value (YuSheng Chen) [#&#8203;64187](nodejs/node#64187)
- \[[`da88f70afa`](nodejs/node@da88f70afa)] - **doc**: add note on visibility of CI failures to new contributor guide (Stewart X Addison) [#&#8203;64256](nodejs/node#64256)
- \[[`20ce359ccb`](nodejs/node@20ce359ccb)] - **doc**: clarify HTTP/1.1 response ordering (Matteo Collina) [#&#8203;64213](nodejs/node#64213)
- \[[`05eae2835c`](nodejs/node@05eae2835c)] - **doc**: recommend node-stress-single-test for flaky tests (Trivikram Kamat) [#&#8203;64223](nodejs/node#64223)
- \[[`3966eb67e7`](nodejs/node@3966eb67e7)] - **doc**: fix typo in examples (Vas Sudanagunta) [#&#8203;64184](nodejs/node#64184)
- \[[`12a2b9daa3`](nodejs/node@12a2b9daa3)] - **doc**: fix typo in node-config-schema.json (Hamid Reza Ghavami) [#&#8203;64188](nodejs/node#64188)
- \[[`0854482671`](nodejs/node@0854482671)] - **doc**: clarify defense-in-depth issues (Matteo Collina) [#&#8203;64215](nodejs/node#64215)
- \[[`ef4915fc3a`](nodejs/node@ef4915fc3a)] - **doc**: fix Fast FFI argument count in ffi.md (Daijiro Wachi) [#&#8203;63960](nodejs/node#63960)
- \[[`bb2eed863c`](nodejs/node@bb2eed863c)] - **doc**: add sxa GPG key ([`ed25519`](nodejs/node@ed25519)) (Stewart X Addison) [#&#8203;64193](nodejs/node#64193)
- \[[`b7bf6e3a06`](nodejs/node@b7bf6e3a06)] - **doc**: add guide and answers to FAQs for first-time contributors (Joyee Cheung) [#&#8203;63685](nodejs/node#63685)
- \[[`ff537ba858`](nodejs/node@ff537ba858)] - **doc**: update `Http2Server.close` & `Http2SecureServer.close` (YuSheng Chen) [#&#8203;63298](nodejs/node#63298)
- \[[`f3db304588`](nodejs/node@f3db304588)] - **doc**: update list of people in `SECURITY.md` (Richard Lau) [#&#8203;64152](nodejs/node#64152)
- \[[`2a126647b0`](nodejs/node@2a126647b0)] - **doc**: clarify vfs is not a sandbox (Matteo Collina) [#&#8203;64143](nodejs/node#64143)
- \[[`85fc79dd9b`](nodejs/node@85fc79dd9b)] - **doc**: fix broken links and duplicate stability label (Antoine du Hamel) [#&#8203;64130](nodejs/node#64130)
- \[[`189e830eb3`](nodejs/node@189e830eb3)] - **doc**: add missing option to man page (Richard Lau) [#&#8203;64156](nodejs/node#64156)
- \[[`7a16ccccd0`](nodejs/node@7a16ccccd0)] - **doc**: announce upcoming end of tier 2 support for macOS x64 (Antoine du Hamel) [#&#8203;63931](nodejs/node#63931)
- \[[`d5f826045f`](nodejs/node@d5f826045f)] - **doc**: update toolchain for official AIX releases (Richard Lau) [#&#8203;64068](nodejs/node#64068)
- \[[`60abc4400f`](nodejs/node@60abc4400f)] - **doc**: fix callback example import in fs docs (Kamal Rawal) [#&#8203;63912](nodejs/node#63912)
- \[[`e470c74a6c`](nodejs/node@e470c74a6c)] - **doc**: fix keepAliveTimeout default in http.createServer options (Jahanzaib iqbal) [#&#8203;63974](nodejs/node#63974)
- \[[`851b460583`](nodejs/node@851b460583)] - **esm**: improve ERR\_REQUIRE\_ASYNC\_MODULE (Joyee Cheung) [#&#8203;64260](nodejs/node#64260)
- \[[`0cd443df39`](nodejs/node@0cd443df39)] - **esm**: print required top-level await locations without evaluating (Joyee Cheung) [#&#8203;64154](nodejs/node#64154)
- \[[`b373202efc`](nodejs/node@b373202efc)] - **(SEMVER-MINOR)** **esm**: add `--experimental-import-text` flag (Efe) [#&#8203;62300](nodejs/node#62300)
- \[[`eacfbd0ca5`](nodejs/node@eacfbd0ca5)] - **http**: add CONNECT method handling for default Host header with proxy (Archkon) [#&#8203;64114](nodejs/node#64114)
- \[[`aeb539a383`](nodejs/node@aeb539a383)] - **http**: fix drain event with cork/uncork (David Evans) [#&#8203;64038](nodejs/node#64038)
- \[[`8e8874b216`](nodejs/node@8e8874b216)] - **http**: document and validate options.path when it's in absolute-form (Joyee Cheung) [#&#8203;64108](nodejs/node#64108)
- \[[`eb2e96bc28`](nodejs/node@eb2e96bc28)] - **inspector**: fix crash when writing to closed inspector socket (ympark2011) [#&#8203;64209](nodejs/node#64209)
- \[[`243b0e4e57`](nodejs/node@243b0e4e57)] - **lib**: reject string "0" in validatePort when allowZero is false (Daijiro Wachi) [#&#8203;64174](nodejs/node#64174)
- \[[`34a537c0ed`](nodejs/node@34a537c0ed)] - **lib**: use `__proto__: null` when calling `ObjectDefineProperty` (Antoine du Hamel) [#&#8203;64239](nodejs/node#64239)
- \[[`1f72393f19`](nodejs/node@1f72393f19)] - **lib**: lazily initialize kEvents and kHandlers maps (Guilherme Araújo) [#&#8203;63702](nodejs/node#63702)
- \[[`92a3dc3191`](nodejs/node@92a3dc3191)] - **lib,permission**: fix addon permission drop (Martin Wagner) [#&#8203;64007](nodejs/node#64007)
- \[[`87b8f2a296`](nodejs/node@87b8f2a296)] - **meta**: fix linter warning in `stale.yml` (Antoine du Hamel) [#&#8203;64281](nodejs/node#64281)
- \[[`829c4a5913`](nodejs/node@829c4a5913)] - **meta**: bump actions/cache from 5.0.5 to 6.1.0 (dependabot\[bot]) [#&#8203;64248](nodejs/node#64248)
- \[[`0808dcd31c`](nodejs/node@0808dcd31c)] - **meta**: bump github/codeql-action/autobuild from 4.36.1 to 4.36.2 (dependabot\[bot]) [#&#8203;64247](nodejs/node#64247)
- \[[`64aa17058f`](nodejs/node@64aa17058f)] - **meta**: bump github/codeql-action/analyze from 4.36.1 to 4.36.2 (dependabot\[bot]) [#&#8203;64246](nodejs/node#64246)
- \[[`873d1e0412`](nodejs/node@873d1e0412)] - **meta**: bump actions/checkout from 6.0.2 to 7.0.0 (dependabot\[bot]) [#&#8203;64245](nodejs/node#64245)
- \[[`fe460ccf0b`](nodejs/node@fe460ccf0b)] - **meta**: bump codecov/codecov-action from 6.0.1 to 7.0.0 (dependabot\[bot]) [#&#8203;64244](nodejs/node#64244)
- \[[`845c63ed50`](nodejs/node@845c63ed50)] - **meta**: bump rtCamp/action-slack-notify from 2.3.3 to 2.4.0 (dependabot\[bot]) [#&#8203;64243](nodejs/node#64243)
- \[[`2cad2d6de5`](nodejs/node@2cad2d6de5)] - **meta**: bump github/codeql-action/init from 4.36.1 to 4.36.2 (dependabot\[bot]) [#&#8203;64242](nodejs/node#64242)
- \[[`0ddde950c7`](nodejs/node@0ddde950c7)] - **meta**: bump actions/setup-python from 6.2.0 to 6.3.0 (dependabot\[bot]) [#&#8203;64241](nodejs/node#64241)
- \[[`c0a8760d2f`](nodejs/node@c0a8760d2f)] - **meta**: bump github/codeql-action/upload-sarif from 4.36.1 to 4.36.2 (dependabot\[bot]) [#&#8203;64240](nodejs/node#64240)
- \[[`f49704b9d0`](nodejs/node@f49704b9d0)] - **meta**: clarify V8 flags are outside threat model (Matteo Collina) [#&#8203;64224](nodejs/node#64224)
- \[[`6b8dc58e6e`](nodejs/node@6b8dc58e6e)] - **meta**: move one or more collaborators to emeritus (Node.js GitHub Bot) [#&#8203;64057](nodejs/node#64057)
- \[[`fe5260cca7`](nodejs/node@fe5260cca7)] - **meta**: update status of past strategic initiatives (Joyee Cheung) [#&#8203;63480](nodejs/node#63480)
- \[[`7b01040008`](nodejs/node@7b01040008)] - **meta**: speed up stale bot (Aviv Keller) [#&#8203;64075](nodejs/node#64075)
- \[[`874c46c24f`](nodejs/node@874c46c24f)] - **meta**: update sccache version in test-linux-quic (René) [#&#8203;64043](nodejs/node#64043)
- \[[`48c5c86363`](nodejs/node@48c5c86363)] - **module**: enable import support for addons by default (Chengzhong Wu) [#&#8203;64221](nodejs/node#64221)
- \[[`39e0c14455`](nodejs/node@39e0c14455)] - **(SEMVER-MINOR)** **perf\_hooks**: sample delay per event loop iteration (Pablo Erhard) [#&#8203;62935](nodejs/node#62935)
- \[[`f90f1bd032`](nodejs/node@f90f1bd032)] - **perf\_hooks**: add NODE\_PERFORMANCE\_GC\_MINOR\_MARK\_SWEEP constant (Attila Szegedi) [#&#8203;63877](nodejs/node#63877)
- \[[`bdf32628c7`](nodejs/node@bdf32628c7)] - **process**: fix finalization cleanup ref tracking (Trivikram Kamat) [#&#8203;64087](nodejs/node#64087)
- \[[`9a65b7fff4`](nodejs/node@9a65b7fff4)] - **quic**: drop version negotiation packets with oversized CIDs (Mohamed Sayed) [#&#8203;64228](nodejs/node#64228)
- \[[`2699fe4706`](nodejs/node@2699fe4706)] - **quic**: fixes undefined handle in QuicStream kInspect (Marten Richter) [#&#8203;64170](nodejs/node#64170)
- \[[`00dea28bb3`](nodejs/node@00dea28bb3)] - **repl**: lazy-load acorn and defer vm context creation (Daijiro Wachi) [#&#8203;63879](nodejs/node#63879)
- \[[`ce659a1cf9`](nodejs/node@ce659a1cf9)] - **src**: fix escaping of single quotes in task runner (Antoine du Hamel) [#&#8203;64089](nodejs/node#64089)
- \[[`dbb3126e5c`](nodejs/node@dbb3126e5c)] - **src**: abstract tracing agent for both legacy and perfetto (Chengzhong Wu) [#&#8203;64053](nodejs/node#64053)
- \[[`12edf1d68d`](nodejs/node@12edf1d68d)] - **src**: avoid redundant call to `std::get_if<>()` (Tobias Nießen) [#&#8203;64094](nodejs/node#64094)
- \[[`eda91b6d01`](nodejs/node@eda91b6d01)] - **src**: avoid copying source string in TextEncoder.encode (Yagiz Nizipli) [#&#8203;63897](nodejs/node#63897)
- \[[`efbbb9a03c`](nodejs/node@efbbb9a03c)] - **stream**: preserve half-open duplexes in async iteration (Efe) [#&#8203;64275](nodejs/node#64275)
- \[[`999a83c937`](nodejs/node@999a83c937)] - **(SEMVER-MINOR)** **stream**: expose ReadableStreamTee (Matteo Collina) [#&#8203;64195](nodejs/node#64195)
- \[[`ab5ed72903`](nodejs/node@ab5ed72903)] - **stream**: reject iter consumers on abort (Trivikram Kamat) [#&#8203;64066](nodejs/node#64066)
- \[[`d3fa77c5e2`](nodejs/node@d3fa77c5e2)] - **stream**: fix merge abort for pending sources (Trivikram Kamat) [#&#8203;64013](nodejs/node#64013)
- \[[`38b99140ed`](nodejs/node@38b99140ed)] - **stream**: refactor unnecessary optional chaining away (Antoine du Hamel) [#&#8203;64253](nodejs/node#64253)
- \[[`c81f894ebe`](nodejs/node@c81f894ebe)] - **stream**: cut per-chunk overhead in WHATWG streams (Matteo Collina) [#&#8203;64252](nodejs/node#64252)
- \[[`f162234f24`](nodejs/node@f162234f24)] - **stream**: normalize Broadcast.from() byte inputs (Trivikram Kamat) [#&#8203;64082](nodejs/node#64082)
- \[[`1182ad8f3b`](nodejs/node@1182ad8f3b)] - **stream**: proxy first own method in Readable.wrap() (Daijiro Wachi) [#&#8203;64048](nodejs/node#64048)
- \[[`d0b830b382`](nodejs/node@d0b830b382)] - **stream**: observe abort while awaiting pipeTo source (Trivikram Kamat) [#&#8203;64015](nodejs/node#64015)
- \[[`f7adcd8359`](nodejs/node@f7adcd8359)] - **stream**: respect iter consumer abort signals (Trivikram Kamat) [#&#8203;63997](nodejs/node#63997)
- \[[`b09e624c6f`](nodejs/node@b09e624c6f)] - **test**: make blob desiredSize assertion robust (Trivikram Kamat) [#&#8203;64106](nodejs/node#64106)
- \[[`d0d8f0c774`](nodejs/node@d0d8f0c774)] - **test**: update WPT for urlpattern to [`11a459a`](nodejs/node@11a459a2b1) (Node.js GitHub Bot) [#&#8203;64037](nodejs/node#64037)
- \[[`ff9122c20c`](nodejs/node@ff9122c20c)] - **test**: improve lcov reporter snapshot diagnostics (Trivikram Kamat) [#&#8203;64049](nodejs/node#64049)
- \[[`570952d4f3`](nodejs/node@570952d4f3)] - **test**: keep finalization close fixture ref alive (Trivikram Kamat) [#&#8203;64085](nodejs/node#64085)
- \[[`1b4f213380`](nodejs/node@1b4f213380)] - **test**: fix typo from overriden to overridden (parkhojeong) [#&#8203;63403](nodejs/node#63403)
- \[[`4c91090b8b`](nodejs/node@4c91090b8b)] - **test**: fix typo from funciton to function (parkhojeong) [#&#8203;63403](nodejs/node#63403)
- \[[`bf080c7917`](nodejs/node@bf080c7917)] - **test**: mark hr-time WPT flaky on macos15-x64 (Trivikram Kamat) [#&#8203;64054](nodejs/node#64054)
- \[[`24e32098c5`](nodejs/node@24e32098c5)] - **test**: use one-off agent in http consumed timeout test (Trivikram Kamat) [#&#8203;64052](nodejs/node#64052)
- \[[`3229886de2`](nodejs/node@3229886de2)] - **test**: fix flaky test-runner coverage threshold test (Trivikram Kamat) [#&#8203;64051](nodejs/node#64051)
- \[[`83b91ea6ec`](nodejs/node@83b91ea6ec)] - **test\_runner**: filter execArgv fallback for child tests (Trivikram Kamat) [#&#8203;64056](nodejs/node#64056)
- \[[`269b609a3d`](nodejs/node@269b609a3d)] - **test\_runner**: improve coverage failure diagnostics (Trivikram Kamat) [#&#8203;64050](nodejs/node#64050)
- \[[`0342744c34`](nodejs/node@0342744c34)] - **test\_runner**: add timestamp to JUnit reporter testsuites (sangwook) [#&#8203;64029](nodejs/node#64029)
- \[[`086741d121`](nodejs/node@086741d121)] - **timers**: reuse Timeout objects in setStreamTimeout (Matteo Collina) [#&#8203;64254](nodejs/node#64254)
- \[[`4e0236dc3d`](nodejs/node@4e0236dc3d)] - **(SEMVER-MINOR)** **tls**: report negotiated TLS groups (Filip Skokan) [#&#8203;64119](nodejs/node#64119)
- \[[`3bdd7e20be`](nodejs/node@3bdd7e20be)] - **tls**: handle large RSA exponents in X.509 cert (Tobias Nießen) [#&#8203;64093](nodejs/node#64093)
- \[[`c96c838977`](nodejs/node@c96c838977)] - **tools**: update RUSTC\_VERSION for remaining GHA workflows (René) [#&#8203;64325](nodejs/node#64325)
- \[[`ee873b7aaf`](nodejs/node@ee873b7aaf)] - **tools**: bump `temporal_rs` version (Antoine du Hamel) [#&#8203;63281](nodejs/node#63281)
- \[[`ea3b870155`](nodejs/node@ea3b870155)] - **tools**: remove `envinfo` from our workflows (Antoine du Hamel) [#&#8203;64259](nodejs/node#64259)
- \[[`d940f02e8b`](nodejs/node@d940f02e8b)] - **tools**: bump the eslint group in /tools/eslint with 8 updates (dependabot\[bot]) [#&#8203;64249](nodejs/node#64249)
- \[[`fe0ea2bb5d`](nodejs/node@fe0ea2bb5d)] - **tools**: bump [@&#8203;node-core/doc-kit](https://github.com/node-core/doc-kit) (dependabot\[bot]) [#&#8203;64010](nodejs/node#64010)
- \[[`4dceefde1e`](nodejs/node@4dceefde1e)] - **tools**: bump undici from 6.24.1 to 6.27.0 in /tools/doc (dependabot\[bot]) [#&#8203;64031](nodejs/node#64031)
- \[[`6e187db7d7`](nodejs/node@6e187db7d7)] - **tools**: update c-ares updater script (Antoine du Hamel) [#&#8203;64194](nodejs/node#64194)
- \[[`657a35f5a2`](nodejs/node@657a35f5a2)] - **tools**: validate version number in release proposal commit message lint (Antoine du Hamel) [#&#8203;64070](nodejs/node#64070)
- \[[`17228a861c`](nodejs/node@17228a861c)] - **tools**: add GHA benchmark runner (Antoine du Hamel) [#&#8203;60293](nodejs/node#60293)
- \[[`6d11a71d91`](nodejs/node@6d11a71d91)] - **tools**: update `build-shared/action.yml` to a reusable workflow (Antoine du Hamel) [#&#8203;64059](nodejs/node#64059)
- \[[`7a17c50b7f`](nodejs/node@7a17c50b7f)] - **tools**: update libffi updater script (Antoine du Hamel) [#&#8203;64046](nodejs/node#64046)
- \[[`28047a3e71`](nodejs/node@28047a3e71)] - **tools**: exclude `libffi` changes from `test-shared` GHA CI (Antoine du Hamel) [#&#8203;64047](nodejs/node#64047)
- \[[`58d9685acc`](nodejs/node@58d9685acc)] - **typings**: add typing for crypto (Filip Skokan) [#&#8203;64122](nodejs/node#64122)
- \[[`7a9dcad44d`](nodejs/node@7a9dcad44d)] - **util**: fix OOM in inspect color stack formatting (Ijtihed Kilani) [#&#8203;64022](nodejs/node#64022)
- \[[`d5f01bbbde`](nodejs/node@d5f01bbbde)] - **vfs**: reject rename into descendant directory (Trivikram Kamat) [#&#8203;64285](nodejs/node#64285)
- \[[`0b6af91081`](nodejs/node@0b6af91081)] - **vfs**: handle current-position sentinel in memory files (Trivikram Kamat) [#&#8203;64163](nodejs/node#64163)
- \[[`322230d641`](nodejs/node@322230d641)] - **vfs**: support writeFileSync with virtual fds (Trivikram Kamat) [#&#8203;64165](nodejs/node#64165)
- \[[`9395d209c7`](nodejs/node@9395d209c7)] - **vfs**: avoid recursive readdir symlink cycles (Matteo Collina) [#&#8203;64168](nodejs/node#64168)
- \[[`bbdd7643b6`](nodejs/node@bbdd7643b6)] - **vfs**: read RealFSProvider files from open fd (Trivikram Kamat) [#&#8203;64104](nodejs/node#64104)
- \[[`92859b8097`](nodejs/node@92859b8097)] - **vm**: fix copying PropertyDescriptor (Chengzhong Wu) [#&#8203;64073](nodejs/node#64073)
- \[[`9046035475`](nodejs/node@9046035475)] - **zlib**: validate flush king for all streams (Ic3b3rg) [#&#8203;63746](nodejs/node#63746)
- \[[`98be4304a3`](nodejs/node@98be4304a3)] - **zlib**: validate flush kind for brotli streams (Ic3b3rg) [#&#8203;63746](nodejs/node#63746)
- \[[`90007a59a9`](nodejs/node@90007a59a9)] - **zlib**: expose rejectGarbageAfterEnd option (Filip Skokan) [#&#8203;64023](nodejs/node#64023)
- \[[`5933516066`](nodejs/node@5933516066)] - **zlib**: reject trailing gzip members in web streams (Filip Skokan) [#&#8203;64023](nodejs/node#64023)
</details>
---
### Configuration
📅 **Schedule**: (UTC)
- Branch creation
- At any time (no schedule defined)
- Automerge
- At any time (no schedule defined)
🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied.
♻ **Rebasing**: Whenever MR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 **Ignore**: Close this MR and you won't be reminded about this update again.
---
- [ ] <!-- rebase-check -->If you want to rebase/retry this MR, check this box
---
This MR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4yNTYuMCIsInVwZGF0ZWRJblZlciI6IjQzLjI1Ni4wIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJSZW5vdmF0ZSBCb3QiLCJhdXRvbWF0aW9uOmJvdC1hdXRob3JlZCIsImRlcGVuZGVuY3ktdHlwZTo6bWlub3IiXX0=-->
@github-actionsgithub-actionsBot mentioned this pull request Jul 21, 2026
Merged
aduh95 pushed a commit that referenced this pull request Jul 21, 2026
@gurgunday@aduh95
buffer: add fast api for isUtf8 and isAscii
6a57c8c
Signed-off-by: Gürgün Dayıoğlu <hey@gurgun.day>
PR-URL: #64169
Reviewed-By: Daniel Lemire <daniel@lemire.me>
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
Reviewed-By: Anna Henningsen <anna@addaleax.net>
aduh95 pushed a commit that referenced this pull request Jul 22, 2026
@gurgunday@aduh95
buffer: add fast api for isUtf8 and isAscii
3ca1d87
Signed-off-by: Gürgün Dayıoğlu <hey@gurgun.day>
PR-URL: #64169
Reviewed-By: Daniel Lemire <daniel@lemire.me>
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
Reviewed-By: Anna Henningsen <anna@addaleax.net>
@ghappforreleasepleaseghappforreleasepleaseBot mentioned this pull request Jul 27, 2026
Closed
aduh95 pushed a commit that referenced this pull request Jul 30, 2026
@gurgunday@aduh95
buffer: add fast api for isUtf8 and isAscii
081c41e
Signed-off-by: Gürgün Dayıoğlu <hey@gurgun.day>
PR-URL: #64169
Reviewed-By: Daniel Lemire <daniel@lemire.me>
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
Reviewed-By: Anna Henningsen <anna@addaleax.net>
@ghappforreleasepleaseghappforreleasepleaseBot mentioned this pull request Aug 3, 2026
Closed
jylenhof pushed a commit to jylenhof/mise-update-tool that referenced this pull request Aug 4, 2026
@github-actions@jylenhof
chore(mise): upgrade local tools
edf69b4
Automated mise tool upgrades from local config.
Updated tools:
- `action-validator`
- `actionlint`
- `aube`
- `editorconfig-checker`
- `ghalint`
- `node`
- `pinact`
- `pipx:gh-action-pulse`
- `prek`
- `rumdl`
- `shellcheck`
- `shfmt`
- `tombi`
- `uv`
- `yamlfmt`
- `yamllint`
- `zizmor`
Command: `mise upgrade --bump --local action-validator actionlint aube editorconfig-checker ghalint node pinact pipx:gh-action-pulse prek rumdl shellcheck shfmt tombi uv yamlfmt yamllint zizmor`
<details>
<summary>Version changelog (node)</summary>
| Tool | Requested | Installed |
|------|-----------|-----------|
| `node` | `24` → `26` | `24.18.1` → `26.5.1` |
</details>
<details>
<summary>Release notes (1 tools)</summary>
<details>
<summary>node: `24.18.1` → `26.5.1` (nodejs/node)</summary>
### v25.8.2
This is a security release.
### Notable Changes
* (CVE-2026-21637) wrap `SNICallback` invocation in `try`/`catch` (Matteo Collina) - High
* (CVE-2026-21710) use null prototype for `headersDistinct`/`trailersDistinct` (Matteo Collina) - High
* (CVE-2026-21711) include permission check to `pipe_wrap.cc` (RafaelGSS) - Medium
* (CVE-2026-21712) handle url crash on different url formats (RafaelGSS) - Medium
* (CVE-2026-21713) use timing-safe comparison in Web Cryptography HMAC and KMAC (Filip Skokan) - Medium
* (CVE-2026-21714) handle `NGHTTP2_ERR_FLOW_CONTROL` error code (RafaelGSS) - Medium
* (CVE-2026-21717) test array index hash collision (Joyee Cheung) - Medium
* (CVE-2026-21715) add permission check to `realpath.native` (RafaelGSS) - Low
* (CVE-2026-21716) include permission check on `lib/fs/promises` (RafaelGSS) - Low
### Commits
* \[[`2086b7477b`](nodejs/node@2086b7477b)] - **(CVE-2026-21717)** **build,test**: test array index hash collision (Joyee Cheung) [nodejs-private/node-private#834](https://github.com/nodejs-private/node-private/pull/834)
* \[[`0f9332a40a`](nodejs/node@0f9332a40a)] - **(CVE-2026-21713)** **crypto**: use timing-safe comparison in Web Cryptography HMAC and KMAC (Filip Skokan) [nodejs-private/node-private#822](https://github.com/nodejs-private/node-private/pull/822)
* \[[`2b6937ddb2`](nodejs/node@2b6937ddb2)] - **deps**: update undici to 7.24.4 (Node.js GitHub Bot) [#62271](nodejs/node#62271)
* \[[`bfb8ad5787`](nodejs/node@bfb8ad5787)] - **deps**: update undici to 7.24.3 (Node.js GitHub Bot) [#62233](nodejs/node#62233)
* \[[`be6384727f`](nodejs/node@be6384727f)] - **deps**: upgrade npm to 11.11.1 (npm team) [#62216](nodejs/node#62216)
* \[[`2feea5bb97`](nodejs/node@2feea5bb97)] - **deps**: V8: override… (truncated)
### v25.9.0
### Notable Changes
#### Test runner module mocking improvements
`MockModuleOptions.defaultExport` and `MockModuleOptions.namedExports` have been
consolidated into a single option `MockModuleOptions.exports` to align with user
expectations and other test runners.
A `default` property on `MockModuleOptions.exports` represents the default
export, and own enumerable properties are treated as named exports.
An automated migration is available to update user code:
<https://github.com/nodejs/userland-migrations/tree/main/recipes/mock-module-exports>
```bash
npx codemod @​nodejs/mock-module-exports
```
Contributed by sangwook in [#61727](nodejs/node#61727).
#### Other notable changes
* \[[`312476cb84`](nodejs/node@312476cb84)] - **(SEMVER-MINOR)** **async\_hooks**: add using scopes to `AsyncLocalStorage` (Stephen Belanger) [#61674](nodejs/node#61674)
* \[[`62d2cd473b`](nodejs/node@62d2cd473b)] - **(SEMVER-MINOR)** **cli**: add `--max-heap-size` option (tannal) [#58708](nodejs/node#58708)
* \[[`d0ebf0e44b`](nodejs/node@d0ebf0e44b)] - **(SEMVER-MINOR)** **crypto**: add `TurboSHAKE` and `KangarooTwelve` Web Cryptography algorithms (Filip Skokan) [#62183](nodejs/node#62183)
* \[[`f85b9d9fa8`](nodejs/node@f85b9d9fa8)] - **(SEMVER-MINOR)** **repl**: add customizable error handling (Anna Henningsen) [#62188](nodejs/node#62188)
* \[[`67b854d407`](nodejs/node@67b854d407)] - **(SEMVER-MINOR)** **repl**: remove dependency on `node:domain` (Matteo Collina) [#61227](nodejs/node#61227)
* \[[`966b700623`](nodejs/node@966b700623)] - **(SEMVER-MINOR)** **sea**: support code cache for ESM entrypoint in SEA (Joyee Cheung) [#62158](nodejs/node#62158)
*… (truncated)
### v26.0.0
We're excited to announce the release of Node.js 26! Highlights include the Temporal API enabled by default,
updates to the V8 JavaScript engine to 14.6, Undici to 8.0, and several important deprecations and removals
as we continue to modernize the platform.
As a reminder, Node.js 26 will enter long-term support (LTS) in October, but until then, it will be the "Current" release for the next six months.
We encourage you to explore the new features and benefits offered by this latest release and evaluate their potential impact on your applications.
### Notable Changes
#### Temporal API
The Temporal API is now enabled by default in Node.js 26. Temporal is a modern date/time API for JavaScript
that provides a more robust and feature-rich alternative to the legacy `Date` object.
Contributed by Richard Lau in [#61806](nodejs/node#61806).
#### V8 14.6
The V8 engine is updated to version 14.6.202.33, which is part of Chromium 134.
This version also includes:
* Upsert (<https://github.com/tc39/proposal-upsert>): `[Weak]Map.prototype.getOrInsert()`, `[Weak]Map.prototype.getOrInsertComputed()`
* Iterator sequencing (<https://github.com/tc39/proposal-iterator-sequencing>): `Iterator.concat()`
Contributed by Michaël Zasso in [#61898](nodejs/node#61898).
#### Undici 8
Undici has been updated to version 8.0.2, bringing new features and improvements to Node.js's HTTP client implementation.
#### Deprecations and Removals
* \[[`dff46c07c3`](nodejs/node@dff46c07c3)] - **(SEMVER-MAJOR)** **crypto**: move DEP0182 to End-of-Life (Tobias Nießen) [#61084](nodejs/node#61084)
* \[[`93c25815ee`](nodejs/node@93c25815ee)] - **(SEMVER-MAJOR)** **http**: move writeHeader to end-of-life (Sebastian Beltran) [#60635](nodejs/node#60635)
`http.Server.prototype.writeHeader()` is now fully removed. Use `http.Server.prototype.write… (truncated)
### v26.1.0
### Notable Changes
#### Experimental `node:ffi` module
Node.js now includes an experimental `node:ffi` module for loading dynamic
libraries and calling native symbols from JavaScript.
The API is gated behind the `--experimental-ffi` flag and, when the Permission
Model is enabled, requires `--allow-ffi`.
This API is inherently unsafe. Invalid pointers, incorrect signatures, or accessing memory
after it has been freed can crash the process or corrupt memory.
Contributed by Paolo Insogna in [#62072](nodejs/node#62072).
#### Other Notable Changes
* \[[`34a6454fe3`](nodejs/node@34a6454fe3)] - **(SEMVER-MINOR)** **buffer**: add `end` parameter (Robert Nagy) [#62390](nodejs/node#62390)
* \[[`073e84d7fe`](nodejs/node@073e84d7fe)] - **(SEMVER-MINOR)** **crypto**: accept key data in `crypto.diffieHellman()` and cleanup DH jobs (Filip Skokan) [#62527](nodejs/node#62527)
* \[[`5b9cb10a5f`](nodejs/node@5b9cb10a5f)] - **(SEMVER-MINOR)** **crypto**: implement `randomUUIDv7()` (nabeel378) [#62553](nodejs/node#62553)
* \[[`98f9becd16`](nodejs/node@98f9becd16)] - **(SEMVER-MINOR)** **debugger**: add edit-free runtime expression probes to `node inspect` (Joyee Cheung) [#62713](nodejs/node#62713)
* \[[`06defaa2ea`](nodejs/node@06defaa2ea)] - **(SEMVER-MINOR)** **fs**: add `signal` option to `fs.stat()` (Mert Can Altin) [#57775](nodejs/node#57775)
* \[[`db66a963bf`](nodejs/node@db66a963bf)] - **(SEMVER-MINOR)** **fs**: expose `frsize` field in `statfs` (Jinho Jang) [#62277](nodejs/node#62277)
* \[[`87adb3472b`](nodejs/node@87adb3472b)] - **(SEMVER-MINOR)** **http**: harden `ClientRequest` options merge (Matteo Collina) [#6… (truncated)
### v26.2.0
### Notable Changes
* \[[`189d43a193`](nodejs/node@189d43a193)] - **doc**: mark `stream.compose` stable (Matteo Collina) [#62562](nodejs/node#62562)
* \[[`f858c6140e`](nodejs/node@f858c6140e)] - **(SEMVER-MINOR)** **fs**: add `Temporal.Instant` support to `Stats` and `BigIntStats` (Livia Medeiros) [#60789](nodejs/node#60789)
* \[[`0cbb3895df`](nodejs/node@0cbb3895df)] - **(SEMVER-MINOR)** **http**: add `writeInformation` to send arbitrary 1xx status codes (Tim Perry) [#63155](nodejs/node#63155)
### Commits
* \[[`9a394bab84`](nodejs/node@9a394bab84)] - **benchmark**: respect stream/iter broadcast backpressure (Trivikram Kamat) [#63314](nodejs/node#63314)
* \[[`ad98b4620b`](nodejs/node@ad98b4620b)] - **crypto**: align verifyOneShot accepted types (Anshika Jain) [#63280](nodejs/node#63280)
* \[[`ba0736a847`](nodejs/node@ba0736a847)] - **crypto**: wire ML-DSA and ML-KEM for use when using BoringSSL (Filip Skokan) [#63255](nodejs/node#63255)
* \[[`5573a6a4a8`](nodejs/node@5573a6a4a8)] - **crypto**: wire ChaCha20-Poly1305 in Web Cryptography when using BoringSSL (Filip Skokan) [#63255](nodejs/node#63255)
* \[[`7dc563b8d6`](nodejs/node@7dc563b8d6)] - **crypto**: wire AES-KW in Web Cryptography when using BoringSSL (Filip Skokan) [#63255](nodejs/node#63255)
* \[[`b55e2b1f4d`](nodejs/node@b55e2b1f4d)] - **crypto**: improve system certificate enumeration logic on macOS (Robo) [#62576](nodejs/node#62576)
* \[[`fd509a755a`](nodejs/node@fd509a755a)] - **crypto**: harden CryptoKey algorithm slots… (truncated)
### v26.3.0
### Notable Changes
#### Potential changes to macOS Universal Binary availability
With Apple and its ecosystem progressively dropping support for Intel-based
architectures, it has become apparent that the Node.js project may not be able
to maintain the universal binaries we currently distribute for the full lifetime
of Node.js 26. This change serves to communicate that risk. At present, our
intention remains to continue shipping universal binaries supporting both Apple
Silicon and Intel-based Macs for as long as practical.
Contributed by Antoine du Hamel in [#63055](nodejs/node#63055).
#### Other notable changes
* \[[`a2a4b33dd8`](nodejs/node@a2a4b33dd8)] - **(SEMVER-MINOR)** **buffer**: increase `Buffer.poolSize` default to 64 KiB (Matteo Collina) [#63597](nodejs/node#63597)
* \[[`051a2152f7`](nodejs/node@051a2152f7)] - **crypto**: update root certificates to NSS 3.123.1 (Node.js GitHub Bot) [#63527](nodejs/node#63527)
* \[[`49462eca37`](nodejs/node@49462eca37)] - **(SEMVER-MINOR)** **http**: add `httpValidation` option to configure header value validation (RajeshKumar11) [#61597](nodejs/node#61597)
* \[[`97b7ab19bd`](nodejs/node@97b7ab19bd)] - **(SEMVER-MINOR)** **inspector**: expose precise coverage start to JS runtime (sangwook) [#63079](nodejs/node#63079)
* \[[`cfb80a2103`](nodejs/node@cfb80a2103)] - **(SEMVER-MINOR)** **lib,permission**: add `permission.drop` (Rafael Gonzaga) [#62672](nodejs/node#62672)
### Commits
* \[[`a2a4b33dd8`](nodejs/node@a2a4b33dd8)] - **(SEMVER-MINOR)** **buffer**: increase Buffer.poolSize default to 64 KiB (Matteo Collina) [#63597](nodejs/node#63597)
* \[[`0eff3e23b9`](https://github.com/nodejs/n… (truncated)
### v26.3.1
This is a security release.
### Notable Changes
* (CVE-2026-48618) tls: normalize hostname for server identity checks (Matteo Collina) – High
* (CVE-2026-48933) crypto: guard WebCrypto cipher output length (Filip Skokan) – High
* (CVE-2026-48615) lib,test: redact proxy credentials in tunnel errors (Matteo Collina) – Medium
* (CVE-2026-48619) http2: cap originSet size to prevent unbounded memory growth (Matteo Collina) – Medium
* (CVE-2026-48928) tls: fix case-sensitive SNI context matching (Matteo Collina) – Medium
* (CVE-2026-48930) dns,net: reject hostnames with embedded NUL bytes (Matteo Collina) – Medium
* (CVE-2026-48934) tls: bind reusable sessions to authenticated host (Matteo Collina) – Medium
* (CVE-2026-48617) permission: handle process.chdir on writereport (RafaelGSS) – Low
* (CVE-2026-48931) http: fix response queue poisoning in http.Agent (Matteo Collina) – Low
* (CVE-2026-48935) permission: disable FileHandle utimes with permission model (RafaelGSS) – Low
* (CVE-2026-48936) permission: guard pipe open and chmod with net scope (RafaelGSS) – Low
### Commits
* \[[`98fbc89211`](nodejs/node@98fbc89211)] - **(CVE-2026-48933)** **crypto**: guard WebCrypto cipher output length (Filip Skokan) [nodejs-private/node-private#878](https://github.com/nodejs-private/node-private/pull/878)
* \[[`110840f2c7`](nodejs/node@110840f2c7)] - **deps**: update llhttp to 9.4.2 (Antoine du Hamel) [nodejs-private/node-private#890](https://github.com/nodejs-private/node-private/pull/890)
* \[[`8d36d522b2`](nodejs/node@8d36d522b2)] - **deps**: update undici to 8.5.0 (Node.js GitHub Bot) [#63903](nodejs/node#63903)
* \[[`2e6d03993a`](nodejs/node@2e6d03993a)] - **deps**: update undici to 8.4.0 (Node.js GitHub Bot) [#63779](nodejs/node#63779)
* \[[`5a17d5b07a`](nodejs/node@5a17d5b07a)] - **deps… (truncated)
### v26.4.0
### Notable Changes
* \[[`cde0daabcc`](nodejs/node@cde0daabcc)] - **(SEMVER-MINOR)** **doc**: update `blockList` stability status to release candidate (alphaleadership) [#63050](nodejs/node#63050)
* \[[`b78f5a7537`](nodejs/node@b78f5a7537)] - **(SEMVER-MINOR)** **fs**: support caller-supplied `readFile()` buffers (Matteo Collina) [#63634](nodejs/node#63634)
* \[[`417aacbc36`](nodejs/node@417aacbc36)] - **(SEMVER-MINOR)** **http**: close pre-request sockets in `closeIdleConnections` (semimikoh) [#63470](nodejs/node#63470)
* \[[`fbb108be7d`](nodejs/node@fbb108be7d)] - **(SEMVER-MINOR)** **loader**: implement package maps (Maël Nison) [#62239](nodejs/node#62239)
* \[[`45494d5a8a`](nodejs/node@45494d5a8a)] - **(SEMVER-MINOR)** **net**: support `TCP_KEEPINTVL` and `TCP_KEEPCNT` in `setKeepAlive` (Guy Bedford) [#63825](nodejs/node#63825)
* \[[`ee29465e77`](nodejs/node@ee29465e77)] - **(SEMVER-MINOR)** **tls**: add certificateCompression option (Tim Perry) [#62217](nodejs/node#62217)
* \[[`b17817eb2b`](nodejs/node@b17817eb2b)] - **(SEMVER-MINOR)** **vfs**: dispatch `node:fs/promises` to mounted VFS instances (Matteo Collina) [#63537](nodejs/node#63537)
* \[[`7bc93a6ac5`](nodejs/node@7bc93a6ac5)] - **(SEMVER-MINOR)** **vfs**: add minimal `node:vfs` subsystem (Matteo Collina) [#63115](nodejs/node#63115)
### Commits
* \[[`c7eb83b46a`](nodejs/node@c7eb83b46a)] - **benchmark**: add child\_process async path baselines (Yagiz Nizipli) [#63929](nodejs/node#63929)
* \[[`066fff17a5`](https://github.com/nodejs/node/commit/066f… (truncated)
### v26.5.0
### Notable Changes
#### New release key
Welcome to our newest releaser, [Stewart X Addison](https://github.com/sxa). Future Node.js releases may be signed with his [release key](https://github.com/nodejs/node/blob/main/README.md#release-keys), `655F3B5C1FB3FA8D1A0CA6BDE4A7D232B936D2FD`.
#### Other notable changes
* \[[`55f48446c7`](nodejs/node@55f48446c7)] - **(SEMVER-MINOR)** **buffer**: implement blob.textStream() (Matthew Aitken) [#64036](nodejs/node#64036)
* \[[`b373202efc`](nodejs/node@b373202efc)] - **(SEMVER-MINOR)** **esm**: add `--experimental-import-text` flag (Efe) [#62300](nodejs/node#62300)
* \[[`39e0c14455`](nodejs/node@39e0c14455)] - **(SEMVER-MINOR)** **perf\_hooks**: sample delay per event loop iteration (Pablo Erhard) [#62935](nodejs/node#62935)
* \[[`999a83c937`](nodejs/node@999a83c937)] - **(SEMVER-MINOR)** **stream**: expose ReadableStreamTee (Matteo Collina) [#64195](nodejs/node#64195)
* \[[`4e0236dc3d`](nodejs/node@4e0236dc3d)] - **(SEMVER-MINOR)** **tls**: report negotiated TLS groups (Filip Skokan) [#64119](nodejs/node#64119)
### Commits
* \[[`87648c0a6c`](nodejs/node@87648c0a6c)] - **benchmark**: trim down the argon2 sets (Filip Skokan) [#64218](nodejs/node#64218)
* \[[`a483bfd3f0`](nodejs/node@a483bfd3f0)] - **buffer**: remove unreachable overflow check in atob (haramjeong) [#60161](nodejs/node#60161)
* \[[`6d14279688`](nodejs/node@6d14279688)] - **buffer**: add fast api for isUtf8 and isAscii (Gürgün Dayıoğlu) [#64169](nodejs/node#64169)
* \[[`55f48446c7`](nodejs/node@55f48446c7)] -… (truncated)
### v26.5.1
This is a security release.
### Notable Changes
* (CVE-2026-56848) http2: defer rst stream while in scope (Matteo Collina) – High
* (CVE-2026-58043) permission: avoid granting radix split nodes (RafaelGSS) – High
* (CVE-2026-56850) https: distinguish PFX object-array agent keys (RafaelGSS) – Medium
* (CVE-2026-58040) https: bind identity checks to session reuse (Matteo Collina) – Medium
* (CVE-2026-58041) sqlite: invalidate tag store iterators on statement reset (Matteo Collina) – Medium
* (CVE-2026-58042) dns: handle large resolveAny address replies (RafaelGSS) – Medium
* (CVE-2026-58045) zlib: throw on out-of-bounds write buffers (RafaelGSS) – Medium
* (CVE-2026-56847) permission: enforce fs write permission for trace events (RafaelGSS) – Low
* (CVE-2026-58039) permission: check final report output path (RafaelGSS) – Low
* (CVE-2026-58044) http: reject requests exceeding max header count (Matteo Collina) – Low
* deps: update llhttp to 9.4.3 (Paolo Insogna)
* deps: update undici to 8.9.0 (Node.js GitHub Bot)
### Commits
* \[[`af0bf96877`](nodejs/node@af0bf96877)] - **deps**: update llhttp to 9.4.3 (Paolo Insogna) [nodejs-private/node-private#935](https://github.com/nodejs-private/node-private/pull/935)
* \[[`0354678355`](nodejs/node@0354678355)] - **deps**: update undici to 8.9.0 (Node.js GitHub Bot) [#64712](nodejs/node#64712)
* \[[`dbeeaeec13`](nodejs/node@dbeeaeec13)] - **(CVE-2026-58042)** **dns**: handle large resolveAny address replies (RafaelGSS) [nodejs-private/node-private#929](https://github.com/nodejs-private/node-private/pull/929)
* \[[`064d339f56`](nodejs/node@064d339f56)] - **(CVE-2026-58044)** **http**: reject requests exceeding max header count (Matteo Collina) [nodejs-private/node-private#922](https://github.com/nodejs-private/node-private/pull/922)
* \[[`23b94c843a`](https://github.… (truncated)
_Omitted 12 older releases._
</details>
</details>
Modified files:
- `.mise.toml`
Sign up for freeto join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@mcollinamcollinamcollina approved these changes
@lemirelemirelemire approved these changes
@addaleaxaddaleaxaddaleax approved these changes
+1 more reviewer
@mertcanaltinmertcanaltinmertcanaltin approved these changes
Reviewers whose approvals may not affect merge requirements

Assignees

No one assigned

Labels

author readyPRs that have at least one approval, no pending requests for changes, and a CI started.bufferIssues and PRs related to the buffer subsystem.c++Issues and PRs that require attention from people who are familiar with C++.needs-ciPRs that need a full CI run.performanceIssues and PRs related to the performance of Node.js.

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

7 participants

@gurgunday@nodejs-github-bot@aduh95@mcollina@lemire@addaleax@mertcanaltin