Traceary

Catalog / Node.js

26.1.0

2026-05-07, Version 26.1.0 (Current), @aduh95

4 months agosecurityaddedfixedOriginal notes

Notable Changes

Experimental node:ffi module

Node.js now includes an experimental node:ffi module for loading dynamic libraries and calling native symbols from JavaScript.

The API is gated behind the --experimental-ffi flag and, when the Permission Model is enabled, requires --allow-ffi.

This API is inherently unsafe. Invalid pointers, incorrect signatures, or accessing memory after it has been freed can crash the process or corrupt memory.

Contributed by Paolo Insogna in #62072.

Other Notable Changes

  • [34a6454fe3] - (SEMVER-MINOR) buffer: add end parameter (Robert Nagy) #62390
  • [073e84d7fe] - (SEMVER-MINOR) crypto: accept key data in crypto.diffieHellman() and cleanup DH jobs (Filip Skokan) #62527
  • [5b9cb10a5f] - (SEMVER-MINOR) crypto: implement randomUUIDv7() (nabeel378) #62553
  • [98f9becd16] - (SEMVER-MINOR) debugger: add edit-free runtime expression probes to node inspect (Joyee Cheung) #62713
  • [06defaa2ea] - (SEMVER-MINOR) fs: add signal option to fs.stat() (Mert Can Altin) #57775
  • [db66a963bf] - (SEMVER-MINOR) fs: expose frsize field in statfs (Jinho Jang) #62277
  • [87adb3472b] - (SEMVER-MINOR) http: harden ClientRequest options merge (Matteo Collina) #63082
  • [9047ec12ce] - (SEMVER-MINOR) http: add req.signal to IncomingMessage (Akshat) #62541
  • [ab66de8eaa] - (SEMVER-MINOR) process: throw on execve(2) failure instead of aborting (Bryan English) #62878
  • [8273682c87] - (SEMVER-MINOR) src: allow empty --experimental-config-file (Marco Ippolito) #61610
  • [fbff28f7e6] - (SEMVER-MINOR) stream: propagate destruction in duplexPair (Ahmed Elhor) #61098
  • [a8c773a0c7] - (SEMVER-MINOR) test_runner: align mock timeout api (sangwook) #62820
  • [b883a5eaea] - (SEMVER-MINOR) test_runner: add mock-timers support for AbortSignal.timeout (DeveloperViraj) #60751
  • [a21ae1771e] - (SEMVER-MINOR) test_runner: support test order randomization (Pietro Marchini) #61747
  • [b85c73ff10] - (SEMVER-MINOR) util: colorize text with hex colors (Guilherme Araújo) #61556

Commits

  • [1b959d02c2] - assert,util: fix stale nested cycle memo entries (Ruben Bridgewater) #62509
  • [bbeb38d210] - buffer: fix end parameter bugs in indexOf/lastIndexOf (Robert Nagy) #62711
  • [34a6454fe3] - (SEMVER-MINOR) buffer: add end parameter (Robert Nagy) #62390
  • [8b91526cd5] - build: track PDL files as inputs in inspector GN build (Robo) #62888
  • [da40ed7842] - build: remove armv6 from experimental platforms (René) #63063
  • [b36e55a23e] - build: make test-addons dependency-free (Joyee Cheung) #62388
  • [c27f3cf8f2] - build: add --enable-all-experimentals build flag (Paolo Insogna) #62755
  • [0d73b63a76] - build: fix cargo check when Temporal is disabled (Antoine du Hamel) #62730
  • [d8f97e6f7b] - build: fix ffi dependency compilation (Paolo Insogna) #62731
  • [d1eb7b340f] - build: fix stray debug string in LIEF defines (Om Ghante) #62683
  • [845283009d] - build: remove redundant -fuse-linker-plugin from GCC LTO flags (Daniel Lando) #62667
  • [a6e99879f4] - build,win: enable x64 PGO (Stefan Stojanovic) #62761
  • [38befee0fb] - crypto: add JWK support for ML-KEM and SLH-DSA key types (Filip Skokan) #62706
  • [b10653ad87] - crypto: add guards and adjust tests for BoringSSL (Filip Skokan) #62883
  • [2a7a69c6b0] - crypto: reject unintended raw key format string input (Filip Skokan) #62974
  • [bad1e2fe6a] - crypto: fix unsigned conversion of 4-byte RSA publicExponent (DeepView Autofix) #62839
  • [c9d5bae598] - crypto: remove Argon2 KDF derivation from its job setup (Filip Skokan) #62863
  • [6eea52426f] - crypto: reject duplicate ML-KEM JWK key_ops (Filip Skokan) #62905
  • [80d4836616] - crypto: deduplicate and canonicalize CryptoKey usages (Filip Skokan) #62902
  • [8950247027] - crypto: reject inherited key type names (Jonathan Lopes) #62875
  • [3f42f9615a] - crypto: strengthen argument CHECKs in TurboSHAKE (Tobias Nießen) #62763
  • [28346d999b] - crypto: guard against size_t overflow on experimental 32-bit arch (Filip Skokan) #62626
  • [d4cec263c4] - (SEMVER-MINOR) crypto: align key argument names in docs and error messages (Filip Skokan) #62527
  • [073e84d7fe] - (SEMVER-MINOR) crypto: accept key data in crypto.diffieHellman() and cleanup DH jobs (Filip Skokan) #62527
  • [518b578fe7] - crypto: add memory tracking for secureContext openssl objects (Mert Can Altin) #59051
  • [5b9cb10a5f] - (SEMVER-MINOR) crypto: implement randomUUIDv7() (nabeel378) #62553
  • [7133826053] - debugger: move ProbeInspectorSession and helpers to separate files (Joyee Cheung) #63013
  • [98f9becd16] - (SEMVER-MINOR) debugger: add edit-free runtime expression probes to node inspect (Joyee Cheung) #62713
  • [94ac62a2d1] - deps: update undici to 8.2.0 (Node.js GitHub Bot) #63092
  • [ef71de87e6] - deps: update amaro to 1.1.9 (Node.js GitHub Bot) #63090
  • [c4f0ef881a] - deps: update llhttp to 9.4.1 (Node.js GitHub Bot) #63045
  • [d29fbc0029] - deps: fix integration issues with the latest nghttp2 (Tim Perry) #62891
  • [537825acee] - deps: update nghttp2 to 1.69.0 (Node.js GitHub Bot) #62891
  • [4446bf694d] - deps: update corepack to 0.34.7 (Node.js GitHub Bot) #62810
  • [8f55327f1c] - deps: fix libffi macos build (Paolo Insogna) #63006
  • [3dee18f72f] - deps: patch V8 to 14.6.202.34 (Node.js GitHub Bot) #62964
  • [e281b247e6] - deps: update timezone to 2026b (Node.js GitHub Bot) #62962
  • [4dd982df13] - deps: upgrade npm to 11.13.0 (npm team) #62898
  • [61c0ff4a13] - deps: cherry-pick libuv/libuv@439a54b (skooch) #62881
  • [d26ca462ae] - deps: update undici to 8.1.0 (Node.js GitHub Bot) #62728
  • [6f08489ac9] - deps: update sqlite to 3.53.0 (Node.js GitHub Bot) #62699
  • [713601e8bd] - deps: update nbytes to 0.1.4 (Node.js GitHub Bot) #62698
  • [578cf1c0c1] - deps: update archs files for openssl-3.5.6 (Node.js GitHub Bot) #62629
  • [4a4ef13c67] - deps: upgrade openssl sources to openssl-3.5.6 (Node.js GitHub Bot) #62629
  • [2f3eca8c1e] - deps: update perfetto to 54.0 (Chengzhong Wu) #62397
  • [944ed9b739] - deps: add perfetto build files (Chengzhong Wu) #62397
  • [15530a7484] - deps: update ngtcp2 to 1.22.0 (Node.js GitHub Bot) #62595
  • [b813b4c4b5] - deps: update minimatch to 10.2.5 (Node.js GitHub Bot) #62594
  • [38e7ce58c5] - deps: update googletest to d72f9c8aea6817cdf1ca0ac10887f328de7f3da2 (Node.js GitHub Bot) #62593
  • [b5c573ed14] - deps: update simdjson to 4.6.1 (Node.js GitHub Bot) #62592
  • [318e2c7cd3] - deps: libuv: cherry-pick aabb7651de (Santiago Gimeno) #62561
  • [c6ccbd742a] - deps: libuv: reapply 3a9a6e3e6b (Andy Pan) #62561
  • [4ad07de7ae] - diagnostics_channel: add BoundedChannel and scopes (Stephen Belanger) #61680
  • [44416ea3fd] - doc: fix documentation history missing 25.9.0 (Antoine du Hamel) #63151
  • [5f6dfbf68e] - doc: fix changelog for chromium numbering (Rafael Gonzaga) #63133
  • [30c4b3658c] - doc: fix the TypeScript Execute (tsx) project link (David Thornton) #63093
  • [ca3c3097f1] - doc: minor structural stream/iter edits (René) #63089
  • [92324aab6f] - doc: remove typo comma from man page (Vas Sudanagunta) #63080
  • [712a15da73] - doc: correct diagnostics_channel built-in channel names (Bryan English) #62995
  • [c92cb6fe0d] - doc: use mjs/cjs blocks for callbackify null reason example (Daijiro Wachi) #62884
  • [020776d4d6] - doc: fix typo in test.md (Rich Trott) #62960
  • [7d52f2061e] - doc: correct typo in PR contribution instructions (Mike McCready) #62738
  • [70e8944676] - doc: fix duplicate word "of of" in postMessageToThread (Daijiro Wachi) #62917
  • [11c6c29284] - doc: fix duplicate word "to to" in util.styleText (Daijiro Wachi) #62917
  • [242adab671] - doc: fix duplicate word "for for" in compile cache (Daijiro Wachi) #62917
  • [b9f3abd63e] - doc: fix doubled word typo in stream_iter.md (Daijiro Wachi) #62916
  • [7a52fd0448] - doc: fix typo in dns.lookup options description (Daijiro Wachi) #62882
  • [acd7e18a8c] - doc: fix Argon2 parameter bounds (Tobias Nießen) #62868
  • [b43ecf40bb] - doc: trust FFI in the threat model (Paolo Insogna) #62852
  • [981ce96b03] - doc: fix typos and inconsistencies in crypto.md and webcrypto.md (Filip Skokan) #62828
  • [acc52ef257] - doc: clarify diffieHellman.generateKeys recomputes same key (Kit Dallege) #62205
  • [ae87597c07] - doc: remove Ayase-252 and meixg from triagger team (Antoine du Hamel) #62841
  • [1cd3694a5f] - doc: clarify dns.lookup() callback signature when all is true (eungi) #62800
  • [40a4337d65] - doc: add experimental modules lifetime policy (Paolo Insogna) #62753
  • [46f48222f8] - doc: clarify process._debugProcess() in Permission Model (Fahad Khan) #62537
  • [6eb9917497] - doc: fix typo in devcontainer guide (Rohan Santhosh Kumar) #62687
  • [3826c5ed7e] - doc: clarify Backport-PR-URL metadata added automatically (Mike McCready) #62668
  • [5d7e0dbbd8] - doc: update WPT test runner README.md (Filip Skokan) #62680
  • [e9d76b2a75] - doc: fix spelling in release announcement guidance (Rohan Santhosh Kumar) #62663
  • [1ae41cebb0] - doc: note GCC >= 14 requirement for native riscv64 builds (Jamie Magee) #62607
  • [9b29be6a28] - doc: note non-monotonic clock in crypto.randomUUIDv7 (nabeel378) #62600
  • [5ae59553f6] - doc: update bug bounty program (Rafael Gonzaga) #62590
  • [ce3f4c85dd] - doc: document TransformStream transformer.cancel option (Tom Pereira) #62566
  • [08a9ba73e4] - doc: mention test runner retry attemp is zero based (Moshe Atlow) #62504
  • [32f2169ede] - doc,src,test: fix dead inspector help URL (semimikoh) #62745
  • [870c1cd3f4] - doc,test: mem protection must be observed in ffi (Bryan English) #62818
  • [3d5cf171dc] - esm: add ERR_REQUIRE_ESM_RACE_CONDITION (Antoine du Hamel) #62462
  • [2004d8d6db] - ffi: make FFIFunctionInfo a BaseObject subclass (Anna Henningsen) #63071
  • [53eb7abeba] - ffi: prevent premature GC of DynamicLibrary (semimikoh) #63024
  • [58dc92f502] - ffi: support Symbol.dispose on DynamicLibrary (Matteo Collina) #62925
  • [528f8b2bae] - ffi: add shared-buffer fast path for numeric and pointer signatures (Bryan English) #62918
  • [42ac8b9ae7] - fs: add followSymlinks option to glob (Matteo Collina) #62695
  • [873c2bca70] - fs: restore fs patchability in ESM loader (Joyee Cheung) #62835
  • [349c7502c3] - fs: validate position argument before length === 0 early return (Edy Silva) #62674
  • [06defaa2ea] - (SEMVER-MINOR) fs: add signal option to fs.stat() (Mert Can Altin) #57775
  • [db66a963bf] - (SEMVER-MINOR) fs: expose frsize field in statfs (Jinho Jang) #62277
  • [3191d2936a] - http: emit 'drain' on OutgoingMessage only after buffers drain (Robert Nagy) #62936
  • [87adb3472b] - (SEMVER-MINOR) http: harden ClientRequest options merge (Matteo Collina) #63082
  • [e0b79633f6] - http: fix leaked error listener on sync HTTP req create + destroy (Tim Perry) #62872
  • [70c5491f53] - http: fix no_proxy leading-dot suffix matching (Daijiro Wachi) #62333
  • [60a585e68a] - http: cleanup pipeline queue (Robert Nagy) #62534
  • [9047ec12ce] - (SEMVER-MINOR) http: add req.signal to IncomingMessage (Akshat) #62541
  • [01eed5901b] - http2: expose writable stream state on compat response (T) #63003
  • [19b7adf3ba] - inspector: fix absolute URLs in network http (bugyaluwang) #62955
  • [4d10823fbb] - inspector: coerce key and value to string in webstorage events (Ali Hassan) #62616
  • [9a3ac66cc5] - inspector: return errors when CDP protocol event emission fails (Ryuhei Shima) #62162
  • [c89501c6e5] - inspector: auto collect webstorage data (Ryuhei Shima) #62145
  • [ef08c5016a] - lib: refactor internal webidl converters (Filip Skokan) #62979
  • [d0744c6a99] - lib: add Temporal to frozen intrinsics (René) #63029
  • [6d81cb17b3] - lib: avoid quadratic shift() in startup snapshot callback (Daijiro Wachi) #62914
  • [3491f73051] - lib: fix FLOAT_32 and FLOAT_64 type constants in ffi (Daijiro Wachi) #62892
  • [c4ca303b36] - lib: harden kKeyOps lookup with null prototype (Filip Skokan) #62877
  • [2e612fe070] - lib: short-circuit WebIDL BufferSource SAB check (Filip Skokan) #62833
  • [e850ee9c69] - lib: add new methods and error codes (Paolo Insogna) #62762
  • [e21b873589] - lib: use js-only implementation of isDataView() (René) #62780
  • [f454d1719d] - lib: fix lint in internal/webstreams/util.js (Filip Skokan) #62806
  • [fbd8ededba] - lib: fix sequence argument handling in Blob constructor (Ms2ger) #62179
  • [16860e6abd] - lib: improve Web Cryptography key validation ordering (Filip Skokan) #62749
  • [ba3f3e1753] - lib: reject SharedArrayBuffer in web APIs per spec (Ali Hassan) #62632
  • [d065e996bb] - lib: defer AbortSignal.any() following (sangwook) #62367
  • [2a711f4b0c] - (SEMVER-MINOR) lib,src,test,doc: add node:ffi module (Colin Ihrig) #62072
  • [d578343582] - meta: bump github/codeql-action from 4.35.1 to 4.35.3 (dependabot[bot]) #63074
  • [1b4b90d544] - meta: bump Mozilla-Actions/sccache-action from 0.0.9 to 0.0.10 (dependabot[bot]) #63073
  • [1477349e47] - meta: bump actions/upload-artifact from 7.0.0 to 7.0.1 (dependabot[bot]) #63072
  • [ecb7de271a] - meta: bump cachix/install-nix-action from 31.10.3 to 31.10.5 (dependabot[bot]) #62846
  • [fb91408312] - meta: bump actions/upload-artifact from 7.0.0 to 7.0.1 (dependabot[bot]) #62850
  • [7eb9a6be68] - meta: add automation policy (Chengzhong Wu) #62871
  • [6f053a4cb8] - meta: update CODEOWNERS for FFI (Paolo Insogna) #62853
  • [88fe50a725] - meta: move VoltrexKeyva to emeritus (Matteo Collina) #62895
  • [42e770bdd0] - meta: bump peter-evans/create-pull-request from 8.1.0 to 8.1.1 (dependabot[bot]) #62845
  • [952d005233] - meta: bump step-security/harden-runner from 2.16.1 to 2.19.0 (dependabot[bot]) #62844
  • [1bd19d9768] - meta: bump actions/github-script from 8.0.0 to 9.0.0 (dependabot[bot]) #62843
  • [386244a7dd] - meta: bump actions/setup-node from 6.3.0 to 6.4.0 (dependabot[bot]) #62842
  • [16b2c41f70] - meta: broaden stale bot (Aviv Keller) #62658
  • [41e7a4ba82] - meta: pass release version to release worker (flakey5) #62777
  • [632821db85] - meta: add QUIC to CODEOWNERS (Tim Perry) #62652
  • [4a7ad93ed8] - meta: move Michael to emeritus (Michael Dawson) #62536
  • [44d5a33efb] - meta: populate apt list for slim runner in update-openssl workflow (René) #62628
  • [d874596aa3] - meta: bump cachix/install-nix-action from 31.9.1 to 31.10.3 (dependabot[bot]) #62551
  • [1631b27e2b] - meta: bump step-security/harden-runner from 2.15.0 to 2.16.1 (dependabot[bot]) #62550
  • [4de376894d] - meta: bump actions/download-artifact from 8.0.0 to 8.0.1 (dependabot[bot]) #62549
  • [39da4d7bd6] - meta: bump actions/setup-node from 6.2.0 to 6.3.0 (dependabot[bot]) #62548
  • [62e3aa55ad] - meta: bump github/codeql-action from 4.32.4 to 4.35.1 (dependabot[bot]) #62547
  • [

These notes run past the length kept in the archive. The rest is on the publisher’s page.