Repository navigation
chore(deps): update node.js to v26 - #1999
Conversation
![renovate-approve[bot]](https://avatars.githubusercontent.com/in/7394?s=60&v=4){kind=small}
|
Important Review skippedBot user detected. To trigger a single review, invoke the
 |
Deploying with
|
| Status | Name | Latest Commit | Preview URL | Updated (UTC) |
|---|---|---|---|---|
| ✅ Deployment successful! View logs |
ccusage-guide | ba97673 | Commit Preview URL Branch Preview URL |
Oct 31 2026, 01:15 AM |
|
Review the following changes in direct dependencies. Learn more about Socket for GitHub.
|
ccusage
@ccusage/ccusage-darwin-arm64
@ccusage/ccusage-darwin-x64
@ccusage/ccusage-linux-arm64
@ccusage/ccusage-linux-x64
@ccusage/ccusage-win32-x64
commit: |
ccusage performance comparisonPR SHA: This compares the Rust PR release binary against the configured base package on the same CI runner. Package runtime diagnosticsCompares the PR package wrapper, the installed native optional dependency binary, and the workspace release binary on the same large fixture. This identifies whether slow package results come from JavaScript wrapper overhead, the published native binary build, or the Rust core itself. Fixtures: Claude
Committed fixture performanceCommitted small fixtures for stable PR-to-PR feedback and explicit Claude/Codex command coverage. Fixtures: Claude
Large real-world-shaped fixture performanceGenerated fixtures shaped from aggregate local log statistics: thousands of JSONL files, many small sessions, and a long tail of larger sessions. No real prompts, paths, or outputs are stored in the fixtures. Fixtures: Claude
Artifact size
Lower medians and smaller artifacts are better. CI runner noise still applies; use same-run ratios as directional PR feedback, not release guarantees. |
ccusage performance comparisonPR SHA: This compares the PR package against the configured base package on the same CI runner. Package runtime diagnosticsCompares the PR package wrapper, the installed native optional dependency binary, and the workspace release binary on the same large fixture. This identifies whether slow package results come from JavaScript wrapper overhead, the published native binary build, or the Rust core itself. Fixtures: Claude
Committed fixture performanceCommitted small fixtures for stable PR-to-PR feedback and explicit Claude/Codex command coverage. Fixtures: Claude
Large real-world-shaped fixture performanceGenerated fixtures shaped from aggregate local log statistics: thousands of JSONL files, many small sessions, and a long tail of larger sessions. No real prompts, paths, or outputs are stored in the fixtures. Fixtures: Claude
Artifact size
Lower medians and smaller artifacts are better. CI runner noise still applies; use same-run ratios as directional PR feedback, not release guarantees. |
ccusage performance comparisonPR SHA: This compares the PR package against the configured base package on the same CI runner. Package runtime diagnosticsCompares the PR package wrapper, the installed native optional dependency binary, and the workspace release binary on the same large fixture. This identifies whether slow package results come from JavaScript wrapper overhead, the published native binary build, or the Rust core itself. Fixtures: Claude
Committed fixture performanceCommitted small fixtures for stable PR-to-PR feedback and explicit Claude/Codex command coverage. Fixtures: Claude
Large real-world-shaped fixture performanceGenerated fixtures shaped from aggregate local log statistics: thousands of JSONL files, many small sessions, and a long tail of larger sessions. No real prompts, paths, or outputs are stored in the fixtures. Fixtures: Claude
Artifact size
Lower medians and smaller artifacts are better. CI runner noise still applies; use same-run ratios as directional PR feedback, not release guarantees. |
ccusage performance comparisonPR SHA: This compares the Rust PR release binary against the configured base package on the same CI runner. Package runtime diagnosticsCompares the PR package wrapper, the installed native optional dependency binary, and the workspace release binary on the same large fixture. This identifies whether slow package results come from JavaScript wrapper overhead, the published native binary build, or the Rust core itself. Fixtures: Claude
Committed fixture performanceCommitted small fixtures for stable PR-to-PR feedback and explicit Claude/Codex command coverage. Fixtures: Claude
Large real-world-shaped fixture performanceGenerated fixtures shaped from aggregate local log statistics: thousands of JSONL files, many small sessions, and a long tail of larger sessions. No real prompts, paths, or outputs are stored in the fixtures. Fixtures: Claude
Artifact size
Lower medians and smaller artifacts are better. CI runner noise still applies; use same-run ratios as directional PR feedback, not release guarantees. |
Upstream tip: 30b653f (2026-11-06, chore(pricing): update models.dev snapshot) Previous fork base: c76874e (the upstream commit this fork was synced to) Synced 128 upstream commits on top of c76874e: 70 automated pricing snapshot refreshes and the following meaningful ones: b24e7a7 docs: remove LINE MAN sponsor logo (ccusage#1910) a93d2fe chore: release v20.0.38 (ccusage#1938) d91f296 docs: add ccx to community projects (ccusage#1943) aa7c675 chore: release v20.0.39 (ccusage#1944) 39fefa2 fix(cli): accept --start-of-week on top-level weekly (ccusage#1945) 600b3c9 chore: release v20.0.40 (ccusage#1946) baeb991 fix(antigravity): map model ID 1402 to claude-opus-5-5 (ccusage#1948) 06347d3 chore: release v20.0.41 (ccusage#1949) 5649632 test(hermes): derive DeepSeek provider pricing from embedded snapshot (ccusage#1951) d0847af chore(deps): update node.js to >=24.22.1 (ccusage#1950) 91dfe85 chore(deps): update pullfrog/pullfrog action to v0.1.100 (ccusage#1953) f335280 chore: release v20.0.42 (ccusage#1952) b86527d chore(deps): update rust crate rustls-webpki to 0.103.16 (ccusage#1954) 5c85ca2 chore(deps): update pullfrog/pullfrog action to v0.1.101 (ccusage#1958) f268798 fix(cli): apply source-specific config in unified reports (ccusage#1959) 37a51da chore: release v20.0.43 (ccusage#1955) e302366 chore(deps): update github/codeql-action action to v4.39.1 (ccusage#1960) 7af0db6 chore(deps): update pnpm to v12.15.0 (ccusage#1961) 730c336 chore(deps): update rust crate ureq to 3.5.0 (ccusage#1964) bd1a21a fix(release): publish platform packages before the wrapper (ccusage#1965) ca33842 chore: release v20.0.44 (ccusage#1962) b2c8f8b chore: remove unused npm registry gate test (ccusage#1966) 19e71d0 chore(deps): update songmu/tagpr action to v1.21.4 (ccusage#1969) 2a84385 fix(codex): count repeated first-response snapshots once (ccusage#1971) 60227f2 chore(deps): update rust crate smallvec to 1.16.4 (ccusage#1973) 3e31edd chore(deps): update hustcer/setup-nu action to v3.29 (ccusage#1974) d93c260 feat(pricing): add gpt-6.1-terra fast/flex multipliers (ccusage#1975) 154e13b chore: release v20.0.45 (ccusage#1967) f1b50e6 chore(deps): update pullfrog/pullfrog action to v0.1.102 (ccusage#1980) 4f1f470 perf: speed up CI and local builds (ccusage#1984) 0bd3d19 refactor(rust): move binary-only report helpers out of ccusage-core (ccusage#1985) 65c5837 fix(antigravity): skip unreadable conversation databases (ccusage#1992) 6372cac chore(deps): update dependency vitepress to v2.0.0-alpha.21 (ccusage#1994) 9a42066 chore(deps): update node.js to >=24.22.2 (ccusage#1995) 87fa788 chore(deps): update pnpm to v12.16.0 (ccusage#1996) 8cb2532 fix(codex): price recorded Ultrafast requests at Ultrafast rates (ccusage#1989) 128d6a0 chore(deps): update pnpm to v12.16.1 (ccusage#1997) 5aa9d3f chore: release v20.0.46 (ccusage#1982) 4712880 chore(deps): update rust crate unicode-width to 0.2.3 (ccusage#1998) 3d59863 chore(deps): update node.js to v26 (ccusage#1999) 96e98c6 chore(deps): update dependency @types/node to v26.6.6 (ccusage#2002) 60fac54 chore(deps): update pullfrog/pullfrog action to v0.1.103 (ccusage#2003) de83d19 fix(config): let space-form command sections override generic report sections (ccusage#2006) 72b8ad4 fix(all): count OpenCode Claude Agent turns once in unified reports (ccusage#2007) 7db7a30 test(pricing): stop the alias-precedence test depending on the LiteLLM snapshot (ccusage#2009) e7a7ee4 fix(all): keep sessions last active on the --until day (ccusage#2008) 4a3da73 chore: release v20.0.47 (ccusage#2001) 8e56c11 chore(deps): update pullfrog/pullfrog action to v0.1.104 (ccusage#2010) e2eddf7 chore(deps): update pullfrog/pullfrog action to v0.1.107 (ccusage#2012) e3d2dcb chore(deps): update pullfrog/pullfrog action to v0.1.108 (ccusage#2014) 8995f3b chore: release v20.0.48 (ccusage#2011) 3977fd0 chore(deps): update pullfrog/pullfrog action to v0.1.110 (ccusage#2017) 546ae51 fix(nix): make `nix flake show` work again on nixpkgs 26.11 (ccusage#2019) 1b5e8cc chore(deps): update kesin11/actions-timeline action to v3.2.1 (ccusage#1983) 23c5d62 chore(deps): update rust crate jiff to 0.2.39 (ccusage#2024) 7b7cec0 chore(deps): update rust crate ureq to 3.5.1 (ccusage#2025) a1e4a03 chore(deps): update pullfrog/pullfrog action to v0.1.111 (ccusage#2028) e84d142 chore(deps): update pnpm to v12.17.0 (ccusage#2029) Fork wins kept: the SQLite on-disk cache with its per-namespace ledger, --live-only and clear-cache, the pi adapter with replay suppression and per-path namespaces, the OpenCode V2 loader (now wrapped as LinkedEntry), the FxHash/Cow hot paths, parallel per-file loads with their single_thread seam, the table renderer, the fork CI and tag-only release workflow, and the pricing freshness, refresh and offline precompute paths. Hand-resolved conflicts: rust/adapters/claude/src/lib.rs: upstream's DedupedEntries/pruned dedupe lands beside the fork's collapse_replays and requestless replay rules; load_daily_summaries routes through load_daily_summaries_with_detection. rust/adapters/opencode/{parser,loader}.rs: upstream's V2 session_message parsing is wrapped as the fork's LinkedEntry, and the native Claude session link is read from the payload so it survives a cache hit. rust/adapters/antigravity/src/loader.rs: upstream's rewrite is taken, keeping the fork's per-database outcome reporting and file order. rust/crates/ccusage-core/src/pricing.rs: the fork's OnceLock embedded loader sits beside upstream's models.dev fallback and alias resolution. rust/crates/ccusage/src/main.rs: upstream dispatch plus the fork's ClearCache command. rust/crates/ccusage-core/src/cache.rs: the ledger is now generic over a LedgerPayload trait, so it covers plain entries and OpenCode's entry-plus-link pairs alike. rust/Cargo.toml: the fork's exact `=` pins stay; jiff 0.2.39, smallvec 1.16.4, ureq 3.5.1, unicode-width 0.2.3, rustls-webpki 0.103.16. .github/workflows/{ci,release}.yaml: the fork's design is kept. packages/ccusage-*/package.json (6 files) and rust/adapters/claude/src/daily.rs: stay deleted. rust/crates/ccusage-core/src/{home,last_window}.rs: upstream's crate split moved them to ccusage-cli and ccusage-report, with their snapshots. apps/ccusage/config-schema.json: regenerated from the merged Rust source (32 numeric minimums `0.0` -> `0`, new pi description), plus three snapshots regenerated in the fork layout for the codex and qwen tests. Fixes made while landing this sync, folded in so the merge stands green: fix(rust): decode cache blobs written before `data_session_id`. postcard encodes struct fields positionally, so a field added mid-struct made every blob the released 20.0.36 binary wrote undecodable. A failed decode is not merely slow: it drops the ledger rows of deleted source files, which no later run can rebuild. In an isolated fixture the released binary still reported 101,570,002 pi tokens after the source files were deleted; a warm build without the decoders reported 0. LegacyCachedEntry and LegacyLedgerEntry decode the old layout and reconstruct `data_session_id` as None; decode_exact requires the whole buffer, so a newer blob can no longer "decode" into an older struct as garbage. Four regression tests cover both layouts and the tail rule. fix(rust): warn once per table when a cached blob decodes as no known layout. The files table is rebuildable; the ledger table is not, so the warning says to save a copy before clear-cache. test(opencode): isolate the Claude-agent pairing test from the developer's real cache; it had been writing 'agent'/'plain' ledger rows into the opencode-db namespace. Version: take upstream's 20.0.48 in package.json, apps/ccusage/package.json and docs/package.json; the Rust workspace keeps version 0.0.0. DO NOT push a v20.0.48 tag from this fork: release.yaml would publish fork bytes under upstream identity.
Note
This PR body was truncated due to platform limits.
This PR contains the following updates:
>=24.22.2→>=26.13.0^24.19.2→^26.6.526.6.624.19.2→26.6.526.6.6Release Notes
nodejs/node (node)
v26.13.0: 2026-10-28, Version 26.13.0 'Lithium' (LTS), @richardlauCompare Source
Notable Changes
This release marks the transition of Node.js 26.x into Long Term Support (LTS)
with the codename 'Lithium'. It will continue to receive updates through to
the end of April 2029.
Other than updating metadata, such as the
process.releaseobject, to reflectthat the release is LTS, no further changes from Node.js 26.12.1 are included.
If you are updating from an earlier Long Term Support release (e.g. Node.js 24
or 22 or earlier) please note that since Node.js 25 the official binaries for
Linux are linked against libatomic, which may need to be installed separately
depending on your Linux distribution.
v26.12.1: 2026-10-21, Version 26.12.1 (Current), @aduh95 prepared by @RafaelGSSCompare Source
This is a security release.
Notable Changes
BROTLI_DECODER_ERROR_FORMAT_BLOCK_SWITCH(Antoine du Hamel) – High0ed4268(Evgenii Kliuchnikov) – High93cd21e(Joyee Cheung)Commits
818e4ca061] - crypto: update root certificates to NSS 3.131.1 (Antoine du Hamel) #66877fd3c87ed43] - crypto: harden X.509 conversion and formatting (Filip Skokan) nodejs-private/node-private#966acffa610db] - crypto: reset random caches across snapshots (Filip Skokan) nodejs-private/node-private#9877895a5cd2d] - deps: update undici to 8.12.2 (Node.js GitHub Bot) #6672112daa54d2e] - deps: V8: backport93cd21e(Joyee Cheung) nodejs-private/node-private#9996a8b3db7e2] - deps: update c-ares to 1.34.9 (Node.js GitHub Bot) #66868a6040b50d9] - deps: brotli: cherry-pick0ed4268(Evgenii Kliuchnikov) nodejs-private/node-private#10026b78ea171d] - dns: validate resolve inputs for null bytes (James M Snell) nodejs-private/node-private#9840683ee5f7d] - http: ensure agent data guard works without I/O (James M Snell) nodejs-private/node-private#983e5cae10148] - Revert "module: synchronously load most ES modules" (Antoine du Hamel) #66786cc244131aa] - permission: check permission model in realpathSync (RafaelGSS) nodejs-private/node-private#9730392385841] - src: exposeBROTLI_DECODER_ERROR_FORMAT_BLOCK_SWITCH(Antoine du Hamel) nodejs-private/node-private#1002c273a408c9] - src: fix the fs permission tree node on wildcard nodes (James M Snell) nodejs-private/node-private#986a2caddd20e] - tls: reject chains containing blocked public keys (Ulises Gascon) #66871ad788ccd07] - tls: reject non-canonical IP addresses (Matteo Collina) nodejs-private/node-private#982cd4b05469c] - tls: fix ip normalization regression (James M Snell) nodejs-private/node-private#9855fa440e0d7] - tools: retry Gatekeeper check and stapling after notarization (Ryan Aslett) #66855745ad77156] - zlib: avoid caching invalid ZIP local headers (Matteo Collina) nodejs-private/node-private#981v26.12.0: 2026-10-14, Version 26.12.0 (Current), @richardlauCompare Source
Notable Changes
1ebd6d3677] - (SEMVER-MINOR) doc,lib,src: throw on missing WebAssembly or RX support (Paolo Insogna) #665337f1937d2b9] - (SEMVER-MINOR) http: add websocketMask() and websocketUnmask() (James M Snell) #66335Commits
30e76bb16a] - benchmark: fix input passed to subtle.digest in webcrypto-digest (Rafael Gonzaga) #66608adef72223a] - benchmark: fix buffer option in buffer read/write benchmarks (Rafael Gonzaga) #666042f498f08fe] - benchmark: add util.parseArgs benchmark (Rafael Gonzaga) #665994ce8412e18] - benchmark: fix url-searchparams-sort to sort a fresh list (RafaelGSS) #66535493bd6c66e] - benchmark,tools: fix napi benchmarks on GHA (Nigro Simone) #66423e4515552d6] - build: run QUIC CI for V8 changes (Yuya Inoue) #66602a888e51062] - build: support Python 3.15 (Mike McCready) #657502afab9a63b] - build: do not include shared gtest innodelink path (Antoine du Hamel) #66626f88c2f8ec6] - build,test: enable temporal support on no-ICU and system-ICU builds (Antoine du Hamel) #666975fd03e6fdf] - child_process: propagate config-file permission flags to children (Rafael Gonzaga) #66559f771134b07] - crypto: isolate provider EC PKCS8 encoding (Filip Skokan) #664134e00a293db] - crypto: remove key export and metadata locks (Filip Skokan) #66413bcd8018775] - crypto: remove verify setup key locking (Filip Skokan) #66413883250fee2] - crypto: remove KEM key locking (Filip Skokan) #664139d98805071] - crypto: remove RSA-OAEP key locking (Filip Skokan) #66413d6293e7bb1] - crypto: skip secret key mutex allocation (Filip Skokan) #664138d8af8003e] - crypto: keep the root cert store per Environment (Shelley Vohr) #66411c6f0614785] - crypto: remove select Web Crypto warnings (Filip Skokan) #66312e5360b5a08] - deps: update googletest to988ea2c(Node.js GitHub Bot) #666527eb230a2c1] - deps: update acorn to 8.19.0 (Node.js GitHub Bot) #66655af946ba8f3] - deps: update sqlite to 3.54.0 (Node.js GitHub Bot) #66663007872a85d] - deps: V8: cherry-pick8d14d49(Antoine du Hamel) #66627f44aec4966] - deps: update simdjson to 5.0.3 (Daniel Lemire) #666201a33e914e8] - deps: V8: cherry-pick7d5eb1d(inoway46) #665663294d51e5a] - diagnostics_channel: fix default callback context (Matteo Collina) #664815c602a5824] - doc: list futimes among fd APIs disabled by the permission model (Rafael Gonzaga) #66649eaeb4736c8] - doc: add Test Runner to list of built-in diagnostic channels (Vas Sudanagunta) #665630e1c99afae] - doc: document stream/iter behaviors and Node.js extensions (James M Snell) #66483846236367d] - doc: document URL and Uint8Array references in process.permission (Rafael Gonzaga) #66557fc3b067be7] - doc: clarify http Agent keepSocketAlive behavior (Efe Karasakal) #6625273a4e90ce2] - doc: document keepAliveTimeoutBuffer server option (Efe Karasakal) #66286bb816582af] - doc: fix request.reusedSocket timeout example (Efe Karasakal) #6628682223ab4d9] - doc: clarify revert PR label policy (Antoine du Hamel) #66529c6f59d4e8e] - doc: clarify node binary misuse after compromise (Rafael Gonzaga) #665308904178498] - doc: document linux-x64-musl build toolchain (Issac) #665231e8247a74e] - doc: run license-builder (github-actions[bot]) #66517b2773d5e4c] - doc: add missing return types in cluster.md (Daniel Pinto) #664531ebd6d3677] - (SEMVER-MINOR) doc,lib,src: throw on missing WebAssembly or RX support (Paolo Insogna) #66533c1073f31de] - ffi: fix exportArrayBuffer type check (Trivikram Kamat) #6645569148ee0ff] - fs: lock FileHandle on first read in pull() and pullSync() (James M Snell) #66483700c60a1cd] - fs: serialize FileHandle writer() async writes (James M Snell) #6648332833def1c] - http: reduce raw header name allocations (Roberto Bianchi) #664887f1937d2b9] - (SEMVER-MINOR) http: add websocketMask() and websocketUnmask() (James M Snell) #66335115731dda7] - http2: speed up response getHeaders (Roberto Bianchi) #66592447c36cb45] - lib: fix AbortSignal.any() nested composite leak (Darius) #666171722ced4b4] - lib: add --allow-fs-vfs to permission available flags (Rafael Gonzaga) #66554062ece77fc] - lib: fix benchmark record acknowledgement race (Filip Skokan) #6643005d0b14438] - lib: set exit code on failed node:bench run() (RafaelGSS) #665342cab299471] - lib: default node:bench warmup to 10 invocations (RafaelGSS) #6653683f507845d] - meta: bump nodejs/node-pr-labeler todfe5eb3(Soul Lee) #666066fbffd5ee5] - meta: bump codecov/codecov-action from 7.1.0 to 7.1.1 (dependabot[bot]) #66448bd567f8bd6] - module: fix require of imports with package map (Lazizbek Ergashev) #66565c442f471a5] - module: synchronously load most ES modules (Geoffrey Booth) #6253051f66f0134] - permission: keep explicit fs grants when dropping a covering directory (Rafael Gonzaga) #665561aa10d80e2] - process: mark process.finalization as release candidate (Matteo Collina) #66436dd4715a6ba] - querystring: fix value decoding after encoded keys (Ved Chaudhari) #665539648a6ba8e] - quic: reject closed stream writer writes with a TypeError (James M Snell) #66483d6f566baf8] - quic: give each BindingData its own allocator state (Shelley Vohr) #66411c3204c15bd] - quic: validate session close error codes (Christian Aurich Zanettini Martins) #663025b87354f5a] - quic: destroy stream on invalid promise body (Christian Aurich Zanettini Martins) #662609ef698c781] - sqlite: validate aggregate() name and options (Guilherme Araújo) #66463bbf41f8cfb] - sqlite: persist enableDefensive() across reopen (Trivikram Kamat) #6640454867cd25e] - sqlite: throw on oversized strings instead of aborting (Trivikram Kamat) #665214314cde48b] - src: release uv_fs_t in permission WildcardIfDir (Rafael Gonzaga) #665550e58916f08] - src: stop including simdjson.h from env.h (Daniel Lemire) #6662006f56a55bb] - src: use native CopyArrayBufferBytes for webstream buffer copy (René) #664002e3dd5bb63] - src: fix config file handling (Marco Ippolito) #66431cd86506bc2] - src: mark config file as stable (Marco Ippolito) #6643115ff9884e4] - stream: skip idle webstreams start and watchers (Matteo Collina) #664243f75c89fb8] - stream: add pipeToSync() failOnIncompleteClose option (James M Snell) #664836cecf140e7] - stream: do not fail the writer when pipeToSync() cannot close (James M Snell) #6648316833534b6] - stream: fix fromSync() async input error messages (James M Snell) #66483af41622ad8] - stream: reject closed fromWritable() writes with a TypeError (James M Snell) #664834b83c6c38e] - stream: accept explicit stream/iter budgets below 16384 (James M Snell) #66483f302fbd04a] - stream: reduce per-chunk overhead in stream/iter consumers (James M Snell) #664837ba60dcdbe] - stream: keep the original error when writer.fail() throws (James M Snell) #66483dcac51a7db] - stream: align pull() abort handling with the spec (James M Snell) #66483995dee6b6b] - stream: honor stream/iter protocols on function objects (James M Snell) #664836eaf91353a] - stream: do not hold back nested async data in from() (James M Snell) #6648369d44aedb4] - stream: bound pre-batched async values in from() (James M Snell) #664836b1e7c4cf1] - stream: guard shareSync() against re-entrant source reads (James M Snell) #664838a47365425] - stream: split oversized share batches under drop-oldest (James M Snell) #6648330cbc4e643] - stream: reject drop-newest backpressure in shareSync() (James M Snell) #6648342ae08594e] - stream: detach shareSync consumers on strict budget errors (James M Snell) #66483fa49de9ba6] - stream: keep share buffer when all consumers detach (James M Snell) #66483e6662cb904] - stream: fix Utf8Stream flush handling (James M Snell) #6647393596b1a9e] - stream: add dump()/dumpSync() for stream/iter (Ethan Arrowood) #655984ba6ce1b0c] - stream: port remaining SonicBoom tests for Utf8Stream (Matteo Collina) #66275cd8b5fa5b0] - test: tolerate async block count updates in test-fs-stat-bigint (Rafael Gonzaga) #6657630814ce991] - test: replace discard loops with dump() (Ethan Arrowood) #6559820441b8fc0] - test: run node-bench tools test sequentially (Filip Skokan) #663389618da6fe3] - test: remove duplicated cases in permission fs-read fixture (Rafael Gonzaga) #66450c348a4cb46] - test: run instantiateStreaming-bad-imports WPT (Filip Skokan) #663227d4fda6ba7] - test: honor allowed WPT promise rejections (Filip Skokan) #66322d4c87eb086] - test: scope Blob WPT failures to big-endian (Filip Skokan) #663227309ddf204] - test_runner: rerun failing todo tests in suites (Barak) #66605da908b3072] - test_runner: report load errors with --test-isolation=none (Lazizbek Ergashev) #66550b18e121625] - test_runner: add mock call assertions to t.assert (Guilherme Araújo) #664763d691ab75e] - tools: restore Python 3.14 for daily WPT (Filip Skokan) #66699714aca1ef6] - tools: switch to PGP and SHA256 in ICU updater (Antoine du Hamel) #66469fa9fca45e4] - tools: lint thread_local in src (Shelley Vohr) #66411dbc3e97847] - tools: copy hdr_histogram_internal.h in update-histogram.sh (Filipe Oliveira (Redis)) #665284760c27904] - tools: bump the eslint group in /tools/eslint with 5 updates (dependabot[bot]) #6644563c20ee58e] - vfs: add ComposableProvider for layered mounts (Matteo Collina) #66235ab057989af] - watch: strip underscore aliases of watch flags (Trivikram Kamat) #66365v26.11.1: 2026-10-07, Version 26.11.1 (Current), @aduh95Compare Source
Commits
2dc4638e85] - Revert "build: toggle doc-kit verbosity based on V" (Antoine du Hamel)3febbc54ec] - Revert "build, doc: move to redesign" (Antoine du Hamel)173250e2e7] - Revert "tools: bump the doc group in /tools/doc with 4 updates" (Antoine du Hamel)v26.11.0: 2026-10-07, Version 26.11.0 (Current), @aduh95Compare Source
Notable Changes
232f178825] - (SEMVER-MINOR) buffer: addisLatin1(James M Snell) #6629827778036de] - (SEMVER-MINOR) buffer: addBuffer.stringLength()(Matteo Collina) #660644f84c4bda2] - build, doc: move to redesign (Aviv Keller) #620456f6296fef9] - (SEMVER-MINOR) doc: promote Alpine Linux to tier 2 support (Stewart X Addison) #63737e998d260d0] - (SEMVER-MINOR) http: addisValidHeaderName()and isValidHeaderValue() (James M Snell) #663347702a50e08] - (SEMVER-MINOR) http2: addconnectionWindowSizeoption (Tim Perry) #65619e06aa62cec] - (SEMVER-MINOR) perf_hooks: fix truncation ofmonitorEventLoopDelay()resolution (James M Snell) #66115ee126e37e8] - (SEMVER-MINOR) perf_hooks: allowRecordableHistogramto record 0 (James M Snell) #661141fef8f54db] - (SEMVER-MINOR) perf_hooks: addhistogram.diff()(James M Snell) #66099f1b9758c4e] - (SEMVER-MINOR) perf_hooks: addhistogram.snapshot()(James M Snell) #66099291d56ea3e] - (SEMVER-MINOR) perf_hooks: harden histogram CBOR import validation (James M Snell) #660986299b09d5c] - (SEMVER-MINOR) process: graduateprocess.ref/unrefto stable (James M Snell) #6621341d6707b63] - (SEMVER-MINOR) sqlite: renameDatabaseSyncandStatementSync(Guilherme Araújo) #6598860d0aa0cd4] - (SEMVER-MINOR) src: add--process-timeout=N(James M Snell) #66138f39916a7e3] - (SEMVER-MINOR) src: expose size and count in heap profile output (Ilyas Shabi) #657370b00d5ea59] - (SEMVER-MINOR) src: let embedders exempt linked bindings from the addon permission (Shelley Vohr) #66067Commits
11c3d7115d] - benchmark: add implicit-framing case to http/set-header (Matteo Collina) #66420168b764fec] - benchmark: add zstdCompress benchmark (James Ross) #6635869182564a7] - benchmark: add a node::MakeCallback benchmark (Nigro Simone) #6631612e540582f] - (SEMVER-MINOR) benchmark: add http header validator benchmark (James M Snell) #66334e6abdf6b01] - benchmark: remove duplicate ffi string length direct (Donghoon Kang) #66278480ca7cc55] - benchmark: fix shadowing that broke h=20 on incoming_headers benchmark (Tim Perry) #66257c6bbc1b128] - benchmark: cover Web Crypto conversion costs (Filip Skokan) #6623785a2e4e270] - benchmark: remove duplicate ffi add-64 benchmark (Soul Lee) #66121d0a72f2c12] - buffer: fix negative index for large buffers (Hilary Asogwa) #66325b7f6a66a9f] - (SEMVER-MINOR) buffer: add isLatin1 (James M Snell) #66298232f178825] - (SEMVER-MINOR) buffer: add isLatin1 (James M Snell) #66298f7d3d11c11] - buffer: fix odd UTF-16LE indexOf start (Yuya Inoue) #6596027778036de] - (SEMVER-MINOR) buffer: add Buffer.stringLength() (Matteo Collina) #660649f1db461d2] - build: update common.gypi for z/OS (Gaby Baghdadi) #664490002037b3f] - build: update configure.py for z/OS (Gaby Baghdadi) #66449a341ac460a] - build: fix vcbuild format-md install and exit (Ved Chaudhari) #66475bec52d9103] - build: fix vcbuild lint skipping lint-md-build (Ved Chaudhari) #664679acdb5910c] - build: toggle doc-kit verbosity based on V (Brian Muenzenmeyer) #662936ee32f857a] - build: support LIEF 0.17.x and 1.x (Yuya Inoue) #662402248869955] - build: add clang support for pgo on macOS/Linux (Chengzhong Wu) #6613649069529eb] - build: add GZIP_COMPRESSION Make variable (inoway46) #662289066d33aa2] - build: portmake_temporal_zoneinfo_cppto GYP (Antoine du Hamel) #661831f4a8fb1cb] - build: addv8_enable_temporal_systemicu(Steven R. Loomis) #659924f84c4bda2] - build, doc: move to redesign (Aviv Keller) #62045a0e7141ffc] - child_process: build the default env block in one native pass (Shelley Vohr) #653259fa31096d4] - crypto: improve random synchronous number generation performance (Mert Can Altin) #6634853cde9d1f8] - crypto: fix raw key export error for wrong key type (한국) #6621732ba6d5ada] - crypto: use backend cSHAKE and KMAC (Filip Skokan) #6623767ccff6434] - crypto: separate conversion from validation (Filip Skokan) #66237ceeb37173d] - crypto: verify empty KMAC outputs (Filip Skokan) #66237359b07a641] - crypto: check EC coordinate conversion results (Filip Skokan) #66237e4d746c4a5] - crypto: map JWK export failures to OperationError (Filip Skokan) #66237a851dda86a] - crypto: include EC public keys in PKCS8 exports (Filip Skokan) #662377f58476ed1] - crypto: use the public CryptoKey prototype (Filip Skokan) #6623775870623ad] - crypto: split hybrid keys without species (Filip Skokan) #66237a1bea87c6a] - crypto: report actual RSA modulus lengths (Filip Skokan) #662375e04680036] - crypto: derive Argon2 without worker threads (Filip Skokan) #66237fe09120a0e] - crypto: create key usage arrays without species (Filip Skokan) #6623744a2965f5f] - crypto: minimize RSA public exponent metadata (Filip Skokan) #662372f3e6dff9d] - crypto: copy derived bits without species (Filip Skokan) #66237d54a2b2049] - crypto: handle PBKDF2 iteration limits (Filip Skokan) #662372ef6046f11] - crypto: reject duplicate unknown key usages (Filip Skokan) #662372e25ae4a7a] - crypto: check RSA JWK alg with SHA-3 hashes (Filip Skokan) #662370370e02e2a] - crypto: copy parameters without array species (Filip Skokan) #66237e042d35ca5] - crypto: convert importKey data as a union (Filip Skokan) #66237ff86606768] - crypto: copy detached parameters as empty (Filip Skokan) #662371314d277b2] - crypto: resolve supports overloads by type (Filip Skokan) #66237a855a46aeb] - crypto: allow unbound SubtleCrypto.supports (Filip Skokan) #662374a72c1d690] - crypto: allow short AES-GCM IVs (Filip Skokan) #662372d84b7ed49] - crypto: validate normalized hash names (Filip Skokan) #662376bfd3924ff] - crypto: convert getRandomValues views (Filip Skokan) #66237529bd18c1a] - crypto: isolate cipher job errors (Filip Skokan) #66237d4af11e171] - crypto: reject short AES-KW inputs (Filip Skokan) #6623778374c8af0] - crypto: match algorithm names as ASCII (Filip Skokan) #66237ab9a3f2b01] - crypto: use internal random buffer bounds (Filip Skokan) #662377c9b2df87a] - crypto: use current FIPS state for availability (Filip Skokan) #6616055af1dcded] - crypto: update root certificates to NSS 3.129 (Node.js GitHub Bot) #664964387cb46d2] - deps: update timezone to 2026e (Node.js GitHub Bot) #66419150c96ef3f] - deps: V8: cherry-pickc795f59(Aviv Keller) #663806b5ac2ab5d] - deps: update archs files for openssl-3.5.9 (Node.js GitHub Bot) #66396bee7e2403c] - deps: upgrade openssl sources to openssl-3.5.9 (Node.js GitHub Bot) #663967a715495f2] - deps: update lief to 1.0.0 (Node.js GitHub Bot) #66345f9da04958a] - deps: update zlib to 1.3.2.1-motley-456ae73 (Node.js GitHub Bot) #663305c34dd970d] - deps: update undici to 8.11.2 (Node.js GitHub Bot) #66332fdf0572cd1] - deps: update timezone to 2026d (Node.js GitHub Bot) #663336c924ee1b0] - deps: upgrade npm to 11.20.0 (npm team) #662592653b2617d] - deps: V8: backport786c1c2(Eliau Elkouby) #662491d68f23e08] - deps: update googletest to4267679(Node.js GitHub Bot) #66145c507c5ad12] - deps: V8: backport9fb4444(Steven R. Loomis) #659928c556ab2b6] - deps: update histogram to 0.12.0 (Node.js GitHub Bot) #66494d3f55c7487] - diagnostics_channel: replace using with try-finally (Ayush Chaudhary) #64251510dfd899e] - doc: update FreeEnvironment() notes for sibling Environments (Shelley Vohr) #66239db2665ba17] - doc: add indexedArray.prototypeproperties to primordial exclusions (René) #66234b692079e3a] - doc: fixup and cleanup stream/iter docs (James M Snell) #660799b191141a2] - doc: fix casing inutil.markPromiseAsHandledsection (Antoine du Hamel) #662068e8c9762a8] - doc: add return type to Blocklist.isBlocklist (yuki motokane) #661816c7fc98d7f] - doc: clarify Worker execArgv vs Permission Model grants (yunshingng) #661249fd0a10b1e] - doc: document iterable input for AbortSignal.any (Haram Jeong) #66123c4508fd4c7] - doc: restore XadillaX to collaborators (Khaidi Chu) #66063b4ad8354f0] - doc: use Type for performanceNodeTiming.uvMetricsInfo (James M Snell) #6609450bc27f3c3] - doc: document the node:ffi call paths (Soul Lee) #66086a74a0ee748] - doc,src,test: fix typos in code comments (Noah) #662186f6296fef9] - (SEMVER-MINOR) doc: promote Alpine Linux to tier 2 support (Stewart X Addison) #63737215639d6ce] - events: fix addAbortListener for aborted signals (Lazizbek Ergashev) #65640021f7d8d98] - ffi: accept safe integer numbers for 64-bit arguments (Donghoon Kang) #6619753fd8e7ebb] - ffi: remove permission checks from dlclose and dlsym (Trivikram Kamat) #66426fa7efaf782] - ffi: validate pointer ranges in optimized calls (Trivikram Kamat) #6637111f80798ba] - ffi: throw on allocation failure in toArrayBuffer() (Trivikram Kamat) #66406c65a333648] - ffi: do not abort when a Worker stops in a callback (Trivikram Kamat) #663899bdab1eca0] - ffi: reject unsafe integers as length or offset (Christian Aurich Zanettini Martins) #66216343a5c2915] - ffi: fix use-after-free in PrepareFunction (Trivikram Kamat) [#66368](httpConfiguration
📅 Schedule: (UTC)
🚦 Automerge: Enabled.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about these updates again.
This PR was generated by Mend Renovate. View the repository job log.