chore(deps): update node.js to v26.10.0 - #54
Merged
Merged
Conversation
renovate
Bot
force-pushed
the
renovate/naude-embedded-node
branch
7 times, most recently
from
September 22, 2026 11:30
b40178b to
2bd5d9c
Compare
renovate
Bot
changed the title
renovate
Bot
force-pushed
the
renovate/naude-embedded-node
branch
6 times, most recently
from
September 25, 2026 16:27
f6fbca6 to
8a38a2a
Compare
renovate
Bot
force-pushed
the
renovate/naude-embedded-node
branch
from
September 25, 2026 23:27
8a38a2a to
7dc5191
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
26.8.1→26.10.0Warning
Some dependencies could not be looked up. Check the Dependency Dashboard for more information.
Release Notes
nodejs/node (node)
v26.10.0: 2026-09-22, Version 26.10.0 (Current), @aduh95Compare Source
Notable Changes
c0a42d23e5] - (SEMVER-MINOR) crypto: add crypto.parsePKCS12() (Brian Muenzenmeyer) #65627eb4fabe81e] - doc: add araujogui to collaborators (Guilherme Araújo) #6609064fb33d791] - (SEMVER-MINOR) ffi: load libraries from a mounted VFS (Matteo Collina) #659092b1701f810] - (SEMVER-MINOR) fs: add openAsBlobSync (greenhead) #65644080e76b3d7] - (SEMVER-MINOR) net: support sending net.BoundSocket to threads and child processes (Guy Bedford) #6472513e61f6ae6] - (SEMVER-MINOR) perf_hooks: implement SlidingWindowHistogram (James M Snell) #65825a326546094] - (SEMVER-MINOR) perf_hooks: implement qrde analysis support in Histogram (James M Snell) #658060306b0a71e] - (SEMVER-MINOR) sqlite: bind undefined to NULL (Trevor Burnham) #657093c999edef7] - (SEMVER-MINOR) src,lib: add util.markPromiseAsHandled (James M Snell) #65805f7d18ec360] - (SEMVER-MINOR) test: expand histogram test coverage (James M Snell) #658253ce4d23bbb] - (SEMVER-MINOR) util: implement util.throttle (James M Snell) #65899336f33ccc1] - (SEMVER-MINOR) util: implement debounce (James M Snell) #65899Commits
2bf082453b] - assert: fix TypeError on deepStrictEqual with null Map key or Set member (Sergey Sannikov) #64449c518831d00] - benchmark: add --csv option to compare.js with --analyze (James M Snell) #6592289bae46e68] - buffer: fix unaligned UTF-16LE decoding (Matteo Collina) #6590501cee9dcef] - build: do not use bundled simdutf when built with--shared-simdutf(Antoine du Hamel) #6589120606a4d19] - build: suppress OpenSSL asm warnings with clang (Richard Lau) #66023a76e97b5c5] - build: derive V8_LOGGING_LEVEL from dcheck_always_on (Joyee Cheung) #65744ac7fcf0cef] - build: sync cargo/rustc version warnings (Richard Lau) #65912f24a495b36] - build: fix quiet default for make builds (Shelley Vohr) #65826c4381765fe] - child_process: clear timeout timer on spawn-time error too (kishore280) #655068955781eeb] - crypto: remove redundentstd::movecall (Antoine du Hamel) #661110b88aa5a15] - crypto: read RSA-PSS restrictions from provider (Filip Skokan) #66108f90d3d3cb0] - crypto: skip private RSA parameters in key details (Filip Skokan) #6610897828d91db] - crypto: use provider EC group names (Filip Skokan) #661083de05da569] - crypto: fetch ciphers for private-key encoding (Filip Skokan) #66108ca8ee04594] - crypto: decode PKCS#1 keys through providers (Filip Skokan) #6610854a625e953] - crypto: derive keys through EVP_KDF (Filip Skokan) #66108971adece6a] - crypto: use names for asymmetric key algorithms (Filip Skokan) #65966bfb544eb00] - crypto: optimize and benchmark key preparation (Filip Skokan) #65892c0a42d23e5] - (SEMVER-MINOR) crypto: add crypto.parsePKCS12() (Brian Muenzenmeyer) #65627c58a4e0ba7] - crypto: add Hybrid KEMs to Web Cryptography (Filip Skokan) #6575970edf90851] - crypto: avoid EC reconstruction for signature sizing (Filip Skokan) #65908fab5dddd77] - crypto: avoid EC raw export reconstruction (Filip Skokan) #65908220a499614] - crypto: export EC JWK coordinates directly (Filip Skokan) #65908f1295e11db] - crypto: read EC curve metadata directly (Filip Skokan) #65908775173a5db] - crypto: optimize private EC JWK import (Filip Skokan) #65908e44669bb7d] - crypto: validate the limit of PBKDF2 iterations (Filip Skokan) #65704cd5a7611e9] - crypto: use primordials in HKDF info validation (Filip Skokan) #6570494affce749] - Revert "deps: V8: overridedepot_toolsversion" (Richard Lau) #66110870a366c49] - deps: V8: cherry-pick95efbaf(Igor Sheludko) #66020d62a452738] - deps: V8: backporta0607c5(Antoine du Hamel) #65891e8edeffe2d] - deps: update googletest to8eff9e3(Node.js GitHub Bot) #66009eb4fabe81e] - doc: add araujogui to collaborators (Guilherme Araújo) #660902fffb3872d] - doc: fix duplicate 'the' typo innode_platform.cc(Muhammad Al-Muzahid) #66058317abb8131] - doc: clarify sub-1000ms behavior in socket.setKeepAlive (Haram Jeong) #658691c12f815c2] - doc: remove obsolete mentioning of cl.exe on windows (Chengzhong Wu) #660382cc17dd67c] - doc: note that default signal handling resets the signal mask (Shelley Vohr) #658773a69cc1bf4] - doc: clarify QUIC async write backpressure (John Finnerty) #65947549694349d] - doc: clarify permission model scope for output paths (Rafael Gonzaga) #660043325ded3a8] - doc: fix sign-off format in AGENTS.md (Filip Skokan) #6595889aa2bd10c] - doc: fill in missing zstd docs (James M Snell) #658678d1ce4d477] - doc: add inoway46 as triager (Yuya Inoue) #655659a3697c5c7] - doc: document windowsHide for child_process.fork (Christopher Buss) #6588769911bf6b5] - doc: qualify directory read ordering for native fs (Trivikram Kamat) #658682d0c3fed12] - doc: add DOMException section to errors API reference (Avocado) #65206f744023cce] - doc: expand revert commit collaborator instructions (Mike McCready) #65848412399efd3] - doc: clarify supported Python releases (Mike McCready) #6585079331f5779] - doc: note that FreeEnvironment() runs a shared event loop (Shelley Vohr) #656916ddbb9982f] - doc,test: account for OpenSSL 4.1 behaviours (Filip Skokan) #6595664fb33d791] - (SEMVER-MINOR) ffi: load libraries from a mounted VFS (Matteo Collina) #6590907fcf1ed02] - ffi: throw ERR_INVALID_ARG_TYPE for wrong-typed pointer and size (Soul Lee) #65842b7406b0a9b] - fs: coerce FileHandle.read length like fs.read (Xia Chao) #65521cb9995be4d] - fs: honor dereference for symlinks nested in cpSync trees (Christian Aurich) #657312b1701f810] - (SEMVER-MINOR) fs: add openAsBlobSync (greenhead) #656449b3f1aa03f] - fs: throw on existing dir in cpSync with errorOnExist (Daijiro Wachi) #641242b502e0798] - fs: support removing read-only files in rmSync on Windows (Sparsh :)) #6445377d8f17ab1] - http: don't destroy socket after request completes (Barath Raj) #6595246f76ed57b] - http2: settle pending write callbacks on destroy (Matteo Collina) #66016205443721d] - http2: fix onread assert when destroying session from stream handler (Sankalp Thakur) #651167e1db4724a] - inspector: report an error when DOM storage is unavailable (Avocado) #6597395110712b8] - inspector: fix abort when two Environments own the inspector (Shelley Vohr) #658779fd3e6caa4] - inspector: fix crash when the IsolateData has no platform (Shelley Vohr) #65818cce2795ad7] - lib: fix AbortSignal.any() abort propagation (Yuya Inoue) #660142c0ccc0067] - lib: fix for FileHandle.readableWebStream (Patrick Dähne) #5884228acafe6a0] - lib: avoid repeat internal receiver checks (Filip Skokan) #65910b9b0e33923] - lib: avoid unsafe array iteration in cli table (Donghoon Kang) #658387f514d3310] - lib: fix shared buffer growability validation (Filip Skokan) #658457534117e38] - lib: optimize internal Web IDL dictionaries (Filip Skokan) #65857bdacc08fbe] - lib: validate sequence iterator objects (Filip Skokan) #658445b6ac71fb2] - lib: use Web IDL interface brand checks (Filip Skokan) #65846da341e2571] - lib,src: apply multiple updates to dtls implementation (James M Snell) #6551113eb4843d5] - meta: bump step-security/harden-runner from 2.21.0 to 2.21.1 (dependabot[bot]) #660440f759174af] - meta: bump github/codeql-action/upload-sarif from 4.37.9 to 4.38.0 (dependabot[bot]) #66046c75b830082] - meta: bump cachix/cachix-action (dependabot[bot]) #660471ada7055a4] - meta: bump github/codeql-action/init from 4.37.9 to 4.38.0 (dependabot[bot]) #660481ed8b05742] - meta: bump github/codeql-action/analyze from 4.37.9 to 4.38.0 (dependabot[bot]) #660499165abe840] - meta: bump github/codeql-action/autobuild from 4.37.9 to 4.38.0 (dependabot[bot]) #66050d03e7313cf] - meta: add joyeecheung as v8 currency strategic initiative champion (Joyee Cheung) #6596553d7592378] - meta: expand on collaborator restoration process (Chengzhong Wu) #65962fa972d02b2] - meta: add web-standards as webidl owners (Filip Skokan) #65856080e76b3d7] - (SEMVER-MINOR) net: support sending net.BoundSocket to threads and child processes (Guy Bedford) #647250d14c0e507] - path: removeStringPrototypeCharCodeAtfrom some methods ofposix(Wiyeong Seo) #5466813e61f6ae6] - (SEMVER-MINOR) perf_hooks: implement SlidingWindowHistogram (James M Snell) #65825a326546094] - (SEMVER-MINOR) perf_hooks: implement qrde analysis support in Histogram (James M Snell) #6580632401c2229] - perf_hooks: reuse buffer for uv metrics (Donghoon Kang) #659855e2fbfe0e5] - perf_hooks: validate import normalization offset (Matteo Collina) #659504743cd8d33] - quic: fix two small bugs in HTTP/3 stream internals (Tim Perry) #659700df54fb38f] - quic: improve stream cleanup & lookup (Tim Perry) #659447cf448889c] - quic: fix timeout regression from11ed325(James M Snell) #6602861a98e6512] - quic: fix readable stream truncation on stop-sending, abort & timeout (Tim Perry) #63967975cac593c] - quic: add promise to QuicStream for pending strms (Marten Richter) #65862ae29cc92ea] - quic: split headers out from src/quic/stream.{h/cc} (James M Snell) #65863833c58d9dc] - quic: fix crash in onStreamClose (Marten Richter) #6586184ecb21343] - quic: reject zero addressLRUSize (Christian Aurich) #65827293e69d065] - sqlite: throw on invalid URL path instead of abort (Guilherme Araújo) #660266f5fb76d0e] - sqlite: track registered user-defined functions (Trivikram Kamat) #65896baf112b639] - sqlite: always copy changeset before applying (Trivikram Kamat) #658700306b0a71e] - (SEMVER-MINOR) sqlite: bind undefined to NULL (Trevor Burnham) #657091f24901c0c] - src: fix-Wextrawarning inWriteFileSync(Antoine du Hamel) #66020b98787fe2d] - src: reuse crypto GetCipherInfo in DTLS session (Ilyas Shabi) #66022410093dbf7] - src: avoid union type-punning in trace values (Khaidi Chu) #659339ec030b1e7] - src: print exception thrown during primordial initialization (Joyee Cheung) #65991a0f99f1d6c] - src: support building with the V8 sandbox (Shelley Vohr) #6223727c62235d0] - src: ffi: create fast-call metadata Symbols lazily (Matteo Collina) #660155a5abd8fd0] - src: avoid copying SEA snapshot data (Colin McDonnell) #65876a05023f331] - src: fix crash on empty, foreign or truncated --snapshot-blob files (Shelley Vohr) #659554141e22606] - src: don't kill own process group on failed spawn (Lazizbek Ergashev) #6505405f4e54eda] - src: fix external reference list race between concurrent isolates (Shelley Vohr) #657791518b7d67f] - src: keep the first snapshot blob alive for later isolates (Shelley Vohr) #6577962e2bf025c] - src: detach cppgc wrappers from their Realm before it is freed (Shelley Vohr) #65778afc3e559d2] - src: fix Stop() terminating the next Environment on the isolate (Shelley Vohr) #65819f245e53b29] - src: seed V8 from the OS CSPRNG instead of OpenSSL's DRBG (Colin McDonnell) #65796830ca7df7a] - src: fix null pointer call when running without a startup snapshot (Shelley Vohr) #6582048158fba8c] - src: stop leaking a CppHeap in CommonEnvironmentSetup (Shelley Vohr) #657923c999edef7] - (SEMVER-MINOR) src,lib: add util.markPromiseAsHandled (James M Snell) #65805e5d2a336bd] - stream: destroy half-open sockets after iteration (Matteo Collina) #659864075161405] - stream: destroy Duplex.from async function on early return (Aman Chadha(IVIXMMI)) #659637d245cfd8d] - stream: fixup stream/iter to drop at most one entry per share call (James M Snell) #6602830e1f7651c] - stream: reject unbounded at SyncShare construction (James M Snell) #660280372056cd8] - stream: make share budget failures detach before throwing (James M Snell) #6602836cc238dce] - stream: make Broadcast.from abort its background pump (James M Snell) #660283134ca6f8e] - stream: update broadcast to retain buffered data with zero consumers (James M Snell) #6602804e5c282a1] - stream: fix async iteration of undefined chunks (Caleb Everett) #65969f81a1483b3] - stream: avoid promise allocation for parked transform writes (Matteo Collina) #65625aec01c5ae1] - stream: keep webstream stream states in fast-mode objects (Matteo Collina) #65625898cd55bdf] - stream: reject closed only after sink abort settles (Lazizbek Ergashev) #657275661526006] - stream: fix ERR_INVALID_STATE when cancelling Readable.toWeb() (Richard Scarrott) #62773fb8a97f46b] - stream: improve handling of falsy errors in stream/iter (James M Snell) #65864cfee7fa3d9] - stream: amortize writable buffer compaction (Gürgün Dayıoğlu) #6584715605210f8] - stream: create write request objects lazily (Matteo Collina) #64455619470a9ae] - stream: allocate stream read buffers from a slab (Matteo Collina) #644557e79c33354] - test: consolidate crypto provider cache coverage (Filip Skokan) #66108dcc9c3c02a] - test: avoid call tochmodSyncintest-fs-cp-async-file-modes(Antoine du Hamel) #66104dda22c06d7] - test: deflake test-run-watch-cwd-isolation-none-* (Antoine du Hamel) #66035d63928dda0] - test: move permission FFI test to native suite (Yuya Inoue) #6605980c1bf7fb5] - test: deflake user timing WPT assertions (Filip Skokan) #6603612116d1d70] - test: unskiptest-watch-create-isolation-none(Antoine du Hamel) #66041e90575cb4d] - test: deflake util.throttle tests (Filip Skokan) #66034f7d18ec360] - (SEMVER-MINOR) test: expand histogram test coverage (James M Snell) #65825bfa6d49b5c] - test: implement low-risk test optimizations (James M Snell) #65926c3307ebddf] - test: update WPT for WebCryptoAPI to55ce71b(Node.js GitHub Bot) #65813ee29c56993] - test: prevent parser reuse across close scenarios (Filip Skokan) #660178a27474044] - test: cover cpSync fast path timestamp preservation (Abhinandan Kumar) #6567889297305c0] - test: fix stderr Buffer assertion in exec encoding test (greenhead) #66008d4cb916624] - test: skip test-vfs-real-provider-watch.js on IBM i (SRAVANI GUNDEPALLI) #659876515db8ab6] - test: fix RSA/DSA wrong-passphrase flake (Filip Skokan) #65983fa19ecad9d] - test: improve sequential test performance (James M Snell) #659283666d6a238] - test: schedule WPT variants individually (Filip Skokan) #65984f2aa27d82d] - test: overlap SLH-DSA signature checks (Filip Skokan) #659802170207253] - test: unref cancelled broadcast source timer (Filip Skokan) #6598071a54aaf5f] - test: collect timeout signals explicitly (Filip Skokan) #659801a15aff897] - test: skip retries in DNS timeout coverage (Filip Skokan) #659805c7e6b4a6e] - test: synchronize ordered runner events (Filip Skokan) #6598037f24eddc9] - test: reuse fixed primes in DH tests (Filip Skokan) #65980831ec42bcc] - test: avoid idle HTTP/HTTPS connections (Filip Skokan) #65980f523342bcd] - test: close WebAssembly test HTTP servers (Filip Skokan) #65980f23847a122] - test: use named parameters in DH stress test (Filip Skokan) #659807131e3b437] - test: reduce ZIP64 stress test I/O (Filip Skokan) #65980e4ca72a984] - test: avoid allocations in external memory test (Filip Skokan) #659757fe64727a2] - test: cover experimental stream iterator builtins (Jungwon Sohn) #6596488ba17bae2] - test: deflake node-api test-free-called (Christian Aurich) #659486eee01fbae] - test: fix flaky common WPT inspector test (Yuya Inoue) #65937858702e51c] - test: skip C++ symbols in tick-processor-arguments (Philipp Dunkel) #65906472215ff9b] - test: try fixing windows build replacing WMIC (James M Snell) #659497f5168149c] - test: fix flaky test-bench-stream (Matteo Collina) #658749f2d544576] - test: move sqlite length validation out of the reentry test (Trevor Burnham) #6576975a9fa65ac] - test: fix flaky cleanup in http2 test (Tim Perry) #65701f8cdf05586] - test,benchmark: use OpenSSL feature helpers (Filip Skokan) #6576288b12c03cd] - test_runner: avoid reusing v8 serializers (Yuya Inoue) #659519b3085e660] - test_runner: fix quote escaping in JUnit (Jihwan) #6597102c2302c31] - tls: propagate singleUse to the secure context (Carlos Vinicius) #660252a8b5d9269] - tls: load all CRLs from a PEM bundle (Lazizbek Ergashev) #65577d141ddb8dc] - tls: defer re-entrant calls to SSL state machine from JS (Tim Perry) #65105b7fe779632] - tools: updatetools/v8for Python 3.13 (Richard Lau) #661096105b37a3d] - tools: bump eslint-plugin-jsdoc in /tools/eslint in the eslint group (dependabot[bot]) #66102060ed69df9] - tools: disable fortify warnings intest-shared(Antoine du Hamel) #66020f8b7a2ff41] - tools: clean up handling of shared libs inshell.nix(Antoine du Hamel) #658913c9586c1fc] - tools: group CodeQL GHA updates (Antoine du Hamel) #66057aa531a34f7] - tools: summarize auto-start-ci failures (Filip Skokan) #65979b7eef15f59] - tools: bump the eslint group in /tools/eslint with 6 updates (dependabot[bot]) #660458914947d7c] - tools: update pgo build doc for linux (Chengzhong Wu) #66024a5b1659d5b] - tools: avoid workflow shell interpolation (Filip Skokan) #66013caf0ee0d7b] - tools: use self-repository references (Filip Skokan) #66013d5880dcb05] - tools: correct Slack action version comments (Filip Skokan) #6601366f182f565] - tools: make checkout credential use explicit (Filip Skokan) #66013287ece3f22] - tools: pass author to commit message validator (Filip Skokan) #660126314ccf93b] - tools: reduce test runner timing overhead (Filip Skokan) #65980441350a867] - tools: do not download build tools when linting Nix files (Antoine du Hamel) #6596115f2549f74] - tools: bump js-yaml from 4.3.1 to 4.3.2 in /tools/eslint (dependabot[bot]) #659310e449d02a6] - tools: bump js-yaml from 4.3.1 to 4.3.2 in /tools/lint-md (dependabot[bot]) #6593281eba460b5] - tools: fix commit queue error summary matching (Filip Skokan) #65913e5bbcfdd78] - tools: lint PR commit messages without approval (Filip Skokan) #6587507ae602005] - tools: unlabel author ready on base branch conflicts (Filip Skokan) #65872e3ad68289a] - tools: improve benchmark build cache reuse (Filip Skokan) #6585946ddc0220d] - tools: apply feedback to and simplify contributor guidance workflow (Filip Skokan) #6578566fd78803d] - trace_events: fix abort when Node.js does not own the V8 platform (Shelley Vohr) #659543cb3c23a19] - typings: add task_queue internal binding types (Seongeun Lee) #65662c5c7036e7b] - typings: add timeoutInfo to TimersBinding (greenhead) #6581162fe96c166] - typings: add missing sea binding properties (이혜미) #65815e51673b4ed] - url: add Symbol.toStringTag to URLPattern (Khaidi Chu) #659253ce4d23bbb] - (SEMVER-MINOR) util: implement util.throttle (James M Snell) #65899336f33ccc1] - (SEMVER-MINOR) util: implement debounce (James M Snell) #6589916e3e7eff3] - vfs: add --vfs-mount and --vfs-load startup flags (Philipp Dunkel) #65748c50cb9a553] - vfs: write RealFSProvider files to open fd (Christian Aurich) #658851bbc5488a5] - vfs: close the fs hook gaps for mounted paths (Philipp Dunkel) #65852816790e0e5] - vfs: resolve symlinks when checking rename descendants (Trivikram Kamat) #65904a9149093df] - vfs: support renaming implicit ZIP directories (Trivikram Kamat) #65752cf5d4a8fe6] - vfs: reject statfs for missing paths (Trivikram Kamat) #65693de552bd044] - vfs: return FileHandle from fs.promises.open (Trivikram Kamat) #6573008f96f142e] - vfs: give ZipProvider option bags a null prototype (Philipp Dunkel) #658535c4d319028] - vfs: commit ZipProvider handles the way open(2) does (Philipp Dunkel) #6585329d3406b6c] - vfs: apply open(2) effects to ZipProvider handles (Philipp Dunkel) #65853e379c26a92] - vfs: align virtual file handles with open(2) (Philipp Dunkel) #658547cdf5f014a] - vfs: answer for unowned paths under reserved root (Philipp Dunkel) #658145e55085bc1] - zlib: reject invalid zstd dictionaries (James M Snell) #658674cdcf7f6a4] - zlib: fix zstd reset (James M Snell) #65867678ff3561a] - zlib: improve zstd decoding across chunk boundaries (James M Snell) #65865Configuration
📅 Schedule: (UTC)
🚦 Automerge: Enabled.
♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR was generated by Mend Renovate. View the repository job log.