## nodejs/node — v26.3.1…v26.4.0

_182+ commits._

### Features
- **crypto: support non-byte WebCrypto lengths and cSHAKE** (1eef572)
- **doc: add aduh95 to last security release steward** (65178bd)
- **lib: add lint rule to enforce use of `kEmptyObject`** (27cc4ec)
- **vfs: add minimal node:vfs subsystem** (7bc93a6)
- **tls: add certificateCompression option** (ee29465)
- **deps: update OpenSSL build config to support compression** (e44b5d4)
- **test,debugger: add test for type stripping in debugger probe mode** (3048f8d)
- **ffi: add fast support for almost all other platforms** (97aafe2)
- **dgram: add synchronous Socket connectSync()** (7591949)
- **benchmark: add child_process async path baselines** (c7eb83b)
- **ffi: add experimental fast FFI call API for AArch64 and x86_64** (f52cf5e)
- **dgram: add synchronous Socket.prototype.bindSync()** (d75222d)
- **net: support TCP_KEEPINTVL and TCP_KEEPCNT in setKeepAlive** (45494d5)
- **debugger: add --max-hit option to probe mode** (4438cb5)
- **lib: add Iterator global to primordials** (0784578)
- **deps: add ngtcp2_fmt.c to build configuration (ngtcp2.gyp)** (b1b597c)
- **fs: support caller-supplied readFile() buffers** (b78f5a7)
- **deps: V8: add CopyArrayBufferBytes API** (0bf8e12)
- **src: add cleanup hooks to `node::ObjectWrap`** (7ac3fe1)
- **doc: add webstreams to args for `pipeline` from `stream/promises`** (51cab5c)

### Fixes
- **stream: fix Writable.toWeb() desiredSize for non-object-mode** (cc29696)
- **quic: fix get_reader bug that dropped data on FIN** (484efd1)
- **lib: fix missing lazyDOMException import** (a44f51e)
- **quic: fix reader backpressure deadlock on idle connections** (b62d569)
- **doc: fix typo in util.md** (83eedfe)
- **stream: fix Utf8Stream stall after full write of multi-byte data** (06413cd)
- **inspector: fix inspector.close() documented behavior** (e611ccd)
- **doc: fix incorrect test runner mock examples** (205d0a5)
- **stream: fix dropped first chunk in Utf8Stream buffer mode** (9a83b5d)
- **util: fix scientific notation formatting** (60e83d9)
- **doc: fix typo in cli.md** (9cb15fc)
- **util: fix -0 formatting when numericSeparator is enabled** (5f7f60a)
- **crypto: fix unhandled error in Hash._transform** (656e57e)
- **quic: fix broken listEndpoints export, test callbacks & nghttp3 include** (3f1c8d7)
- **doc: fix typo in vm.md** (394d0bb)
- **doc: fix typo in packages.md** (59b7be8)
- **vm: fix property queries for proxy sandboxes** (584e752)
- **ffi: port semi-colon fix for riscv64 (and others)** (d9461fe)
- **url: fix URLSearchParams(null) to prudce null= per spec** (e883366)
- **stream: fix pipeToSync byte accounting** (792c410)
- **doc: fix a/an article typos in module, util, and dns** (33c236c)
- **test_runner: fix watch cwd with isolation none** (34433a4)
- **sqlite: fix stack-use-after-scope with function callback** (394af52)
- **doc: fix AES-OCB IV length in SubtleCrypto.supports example** (5919ba7)
- **tools: fix zlib updater script** (08437a3)
- **doc: fix "used to sent" → "used to send" in http2** (ce85b2a)

### Backend
- **2026-06-24, Version 26.4.0 (Current)** (2022edf)
- **Revert "build, doc: generate node.1 with doc-kit"** (2a467a5)
- **deps: libffi: cherry-pick 9ca53a19833d** (bbef54b)
- **deps: update libffi to 3.6.0** (9761385)
- **debugger: lazily wait for initial break output** (9a3393d)
- **watch: print name of changed file that triggers restart** (a926e72)
- **doc: update gcc toolchains to `gcc-13` and `g++-13`** (e068299)
- **tools: bump piscina from 5.1.4 to 5.2.0 in /tools/doc** (d2dc6f8)
- **fs: do not treat EPERM as ENOTEMPTY on Windows** (4c8402e)
- **net: early TCP binding via synchronous net.BoundSocket** (c71c85b)
- **quic: expose QUIC certificates as JS X509Certificate, not raw handles** (04a17fe)
- **tools: update sccache to v0.16.0** (b0c418f)
- **src: omit unconvertible names in cjs_lexer::Parse** (10f03e5)
- **src: keep global list of addon-provided cleanup hooks** (1723773)
- **tools: bump js-yaml from 4.1.1 to 4.2.0 in /tools/lint-md** (2af8433)
- **tools: bump js-yaml from 4.1.1 to 4.2.0 in /tools/eslint** (8ba5b85)
- **child_process: pass spawn options to the binding positionally** (2ab9848)
- **deps: update acorn to 8.17.0** (373ec2d)
- **http: avoid stream listeners on idle agent sockets** (6577d3b)
- **stream: handle falsy push writer fail reasons** (d9967a2)
- **vfs: dispatch fs/promises to mounted VFS instances** (b17817e)
- **tools: enforce iterator result property order** (325087b)
- **stream: reduce allocations on WHATWG streams hot paths** (b53f8f7)
- **crypto: share WebCrypto method and usage helpers** (788a66e)
- **stream: handle setEncoding after buffered data** (315ca42)
- **build, doc: generate node.1 with doc-kit** (e01dec4)
- **src: guard OpenSSL compression header include** (ef12e9e)
- **stream: keep overlapping broadcast reads pending** (a9f9a3d)
- **crypto,tls: do not ignore BN_get_word error** (88011a3)
- **tools: update the llhttp updater script** (314f417)
- **crypto: use EVP_MAC for HMAC on OpenSSL >=3** (f9fdce3)
- **child_process: serialize advanced IPC messages natively** (04c04c8)
- **doc: clarify callback exceptions** (54948c7)
- **tools: avoid test/fixtures/wpt/README.md conflicts** (c6e4f5a)
- **debugger: defer probe pause handling until startup** (b0bfcb9)
- **tls: route event listener exceptions through error handlers** (57d060e)
- **stream: refine the stream/iter backpressure** (009cca1)
- **doc,crypto: mark argon2 and encap/decap as stable** (d29483f)
- **module: enable existing machinery for deferred import of static modules** (b97c7be)
- **sqlite: do not leave database open after failed open** (2bce35b)
- **crypto: make webcrypto aliasKeyFormat directional** (7e9ca87)
- **stream: only pass the expected number of parameters to callbacks** (3f81dcf)
- **debugger: await initialization after run and restart** (8516003)
- **doc: clarify fromReadable() duck-typed contract** (44809b1)
- **stream: remove transform-writer handling in pipeTo** (0bdf5ad)
- **src: handle empty MaybeLocal in cjs_lexer::Parse** (48af8a6)
- **src: fast path empty native immediate drain** (2a672ee)
- **src: do not track weak `BaseObject`s as childrens of `Realm`s** (db6a31d)
- **src: allow tracking children in `MemoryTracker` with weak edges** (5fb837f)
- **deps: upgrade npm to 11.17.0** (3ed287a)
- **lib: improve control abstraction coverage in frozen intrinsics** (7ee31b0)
- **test_runner: remove unused shuffleArrayWithSeed** (9485caa)
- **buffer: optimize Buffer.prototype.copy** (509cd1b)
- **loader: implement package maps** (fbb108b)
- **tools: align Bash snippets in GHA with `lint-sh` conventions** (363912a)
- **quic: impl. cb for http/3 settings/app. options** (d8538b9)
- **crypto: refactor keyObject.toCryptoKey() and SubtleCrypto.getPublicKey()** (65536f0)
- **util: remove style caches from styleText slow path** (af1a11e)
- **stream: check done before backpressure in stream reader** (10272a9)
- **fs: prevent spurious recursive watch events on prefix siblings** (3d0097d)
- **deps: update ngtcp2 to 1.23.0** (e49d730)
- **deps: update nghttp3 to 1.16.0** (e5c0790)
- **deps: update googletest to 7140cd416cecd7462a8aae488024abeee55598e4** (d599fa2)
- **deps: update sqlite to 3.53.2** (bc09f15)
- **deps: update zlib to 1.3.2.1-motley-3246f1b** (6078774)
- **lib: remove source map deadcode in type stripping** (58837dc)
- **events: improve `addAbortListener` perf by caching options object** (6e66833)
- **tools: bump @node-core/doc-kit in /tools/doc in the doc group** (cfd16e9)
- **http2: retain header memory in session accounting** (b7fd13a)
- **stream: reject pull() reads on abort** (3cfafbc)
- **src: use C++14 deprecated attribute for `NODE_DEPRECATED`** (6d22d37)
- **doc: update npm supported versions link** (30595da)
- **meta: bump github/codeql-action from 4.35.3 to 4.36.1** (ea0b8e1)
- **meta: bump actions/cache from 5.0.4 to 5.0.5** (ac90719)
- **buffer: use simdutf for two-byte utf8 byteLength** (86e651b)
- **meta: bump actions/checkout from 6.0.2 to 6.0.3** (3ed3de3)
- **meta: bump codecov/codecov-action from 6.0.0 to 6.0.1** (d08d57b)
- **http: close pre-request sockets in closeIdleConnections** (417aacb)
- **tools: bump the eslint group in /tools/eslint with 7 updates** (1566872)
- **meta: bump cachix/cachix-action** (e748d19)
- **meta: bump actions/stale from 10.2.0 to 10.3.0** (10554eb)
- **meta: bump step-security/harden-runner from 2.19.0 to 2.19.4** (791885f)
- **meta: bump cachix/install-nix-action from 31.10.5 to 31.10.6** (32d9a40)
- **watch: cancel pending restart on shutdown** (32a2621)
- **module: use file: URL as sourceURL for type-stripped CommonJS** (4becad2)
- **stream: fast-path stateless transform flush results** (640a8ce)
- **crypto: handle cipher context allocation failures** (978f1d2)
- **doc: mark Node.js 25 as End-of-Life** (298735e)

### Tests
- **test: tolerate duplicate watch change events** (e2aea3a)
- **test: mark test-debugger-run-after-quit-restart as flaky on macOS** (ea63005)
- **test: update WPT for url to d4598eba09** (be1b204)
- **test: update WPT for WebCryptoAPI to 03a1476844** (b3d0d05)
- **test: update WPT for urlpattern to 23aac92784** (046af26)
- **test: add tests for 3 methods in utils** (562b831)
- **test: mark SEA tests flaky on linux arm debug** (28e3629)
- **test: validate ERR_INVALID_THIS for scheduler methods** (243aa84)
- **test: add coverage outside SEA** (6bd07df)
- **test: update WPT for urlpattern to 2f28df545c** (bd67c9d)
- **test: make Brotli 16GB test wait for backpressure** (e40bfe7)
- **test: add regression test for using `ObjectWrap` in worker** (444c03f)
- **test: accept SIGILL aborts in async-hooks tests** (771230d)

### Chore
- **build: suppress compiler warnings for histogram** (d3f4ed9)
- **build: add QUIC CI job for PRs matching QUIC related paths** (82dd7dd)
- **build: remove redundant intermediate node_aix_shared** (1124c06)

_Recap by [Repo Wrapped](https://repowrapped.com/gh/nodejs/node?utm_source=github-action)._