## nodejs/node — v26.4.0…v26.5.0

_132 commits._

### Features
- **doc: add note on visibility of CI failures to new contributor guide** (da88f70)
- **buffer: add fast api for isUtf8 and isAscii** (6d14279)
- **http: add CONNECT method handling for default Host header with proxy** (eacfbd0)
- **module: enable import support for addons by default** (48c5c86)
- **vfs: support writeFileSync with virtual fds** (322230d)
- **doc: add sxa GPG key (ed25519)** (bb2eed8)
- **doc: add guide and answers to FAQs for first-time contributors** (b7bf6e3)
- **tools: add GHA benchmark runner** (17228a8)
- **typings: add typing for crypto** (58d9685)
- **doc: add missing option to man page** (189e830)
- **esm: add `--experimental-import-text` flag** (b373202)
- **doc: announce upcoming end of tier 2 support for macOS x64** (7a16ccc)
- **perf_hooks: add NODE_PERFORMANCE_GC_MINOR_MARK_SWEEP constant** (f90f1bd)
- **test_runner: add timestamp to JUnit reporter testsuites** (0342744)

### Fixes
- **inspector: fix crash when writing to closed inspector socket** (eb2e96b)
- **meta: fix linter warning in `stale.yml`** (87b8f2a)
- **stream: fix merge abort for pending sources** (d3fa77c)
- **doc: fix typo in examples** (3966eb6)
- **src: fix escaping of single quotes in task runner** (ce659a1)
- **doc: fix typo in node-config-schema.json** (12a2b9d)
- **child_process: fix permission model propagation via NODE_OPTIONS** (7f26c54)
- **http: fix drain event with cork/uncork** (aeb539a)
- **lib,permission: fix addon permission drop** (92a3dc3)
- **doc: fix Fast FFI argument count in ffi.md** (ef4915f)
- **process: fix finalization cleanup ref tracking** (bdf3262)
- **vm: fix copying PropertyDescriptor** (92859b8)
- **doc: fix broken links and duplicate stability label** (85fc79d)
- **crypto: fix large DH generator validation** (32bb554)
- **doc: fix callback example import in fs docs** (60abc44)
- **util: fix OOM in inspect color stack formatting** (7a9dcad)
- **doc: fix keepAliveTimeout default in http.createServer options** (e470c74)

### Backend
- **2026-07-08, Version 26.5.0 (Current)** (bebd1b8)
- **tools: update RUSTC_VERSION for remaining GHA workflows** (c96c838)
- **timers: reuse Timeout objects in setStreamTimeout** (086741d)
- **stream: preserve half-open duplexes in async iteration** (efbbb9a)
- **zlib: validate flush king for all streams** (9046035)
- **zlib: validate flush kind for brotli streams** (98be430)
- **vfs: reject rename into descendant directory** (d5f01bb)
- **deps: update undici to 8.7.0** (7f7e586)
- **doc: clarify QUIC stream state wording** (a22a840)
- **quic: drop version negotiation packets with oversized CIDs** (9a65b7f)
- **doc: update Http2SecureServer.on("timeout") default value** (8d4bec2)
- **lib: reject string "0" in validatePort when allowZero is false** (243b0e4)
- **buffer: remove unreachable overflow check in atob** (a483bfd)
- **doc: clarify HTTP/1.1 response ordering** (20ce359)
- **doc: recommend node-stress-single-test for flaky tests** (05eae28)
- **tools: bump `temporal_rs` version** (ee873b7)
- **stream: expose ReadableStreamTee** (999a83c)
- **stream: reject iter consumers on abort** (ab5ed72)
- **stream: refactor unnecessary optional chaining away** (38b9914)
- **esm: improve ERR_REQUIRE_ASYNC_MODULE** (851b460)
- **tools: remove `envinfo` from our workflows** (ea3b870)
- **vfs: handle current-position sentinel in memory files** (0b6af91)
- **stream: cut per-chunk overhead in WHATWG streams** (c81f894)
- **tools: bump the eslint group in /tools/eslint with 8 updates** (d940f02)
- **meta: bump actions/cache from 5.0.5 to 6.1.0** (829c4a5)
- **meta: bump github/codeql-action/autobuild from 4.36.1 to 4.36.2** (0808dcd)
- **meta: bump github/codeql-action/analyze from 4.36.1 to 4.36.2** (64aa170)
- **meta: bump actions/checkout from 6.0.2 to 7.0.0** (873d1e0)
- **meta: bump codecov/codecov-action from 6.0.1 to 7.0.0** (fe460cc)
- **meta: bump rtCamp/action-slack-notify from 2.3.3 to 2.4.0** (845c63e)
- **meta: bump github/codeql-action/init from 4.36.1 to 4.36.2** (2cad2d6)
- **meta: bump actions/setup-python from 6.2.0 to 6.3.0** (0ddde95)
- **meta: bump github/codeql-action/upload-sarif from 4.36.1 to 4.36.2** (c0a8760)
- **esm: print required top-level await locations without evaluating** (0cd443d)
- **lib: use `__proto__: null` when calling `ObjectDefineProperty`** (34a537c)
- **meta: clarify V8 flags are outside threat model** (f49704b)
- **benchmark: trim down the argon2 sets** (87648c0)
- **quic: fixes undefined handle in QuicStream kInspect** (2699fe4)
- **doc: clarify defense-in-depth issues** (0854482)
- **tools: bump @node-core/doc-kit** (fe0ea2b)
- **tools: bump undici from 6.24.1 to 6.27.0 in /tools/doc** (4dceefd)
- **http: document and validate options.path when it's in absolute-form** (8e8874b)
- **tools: update c-ares updater script** (6e187db)
- **tls: report negotiated TLS groups** (4e0236d)
- **dgram: skip dns.lookup() for literal IP addresses** (9e50bb0)
- **vfs: avoid recursive readdir symlink cycles** (9395d20)
- **stream: normalize Broadcast.from() byte inputs** (f162234)
- **deps: update nghttp3 to 1.17.0** (af91029)
- **deps: update googletest to 8b53336594cc52213c6c2c7a0b29194fa896d039** (2e500ba)
- **deps: update sqlite to 3.53.3** (74e3aa2)
- **meta: move one or more collaborators to emeritus** (6b8dc58)
- **tools: validate version number in release proposal commit message lint** (657a35f)
- **src: abstract tracing agent for both legacy and perfetto** (dbb3126)
- **meta: update status of past strategic initiatives** (fe5260c)
- **doc: update `Http2Server.close` & `Http2SecureServer.close`** (ff537ba)
- **test_runner: filter execArgv fallback for child tests** (83b91ea)
- **doc: update list of people in `SECURITY.md`** (f3db304)
- **doc: clarify vfs is not a sandbox** (2a12664)
- **meta: speed up stale bot** (7b01040)
- **zlib: expose rejectGarbageAfterEnd option** (90007a5)
- **zlib: reject trailing gzip members in web streams** (5933516)
- **vfs: read RealFSProvider files from open fd** (bbdd764)
- **deps: c-ares: cherry-pick 8ba37af8e3fb** (c7e57f5)
- **diagnostics_channel: return original thenable** (dc052c0)
- **deps: V8: backport da20a197a7f9** (879fdc4)
- **deps: V8: cherry-pick 0cc9eb22c0b0** (a640543)
- **deps: V8: cherry-pick 1a391f98cc7a** (feefd17)
- **tools: update `build-shared/action.yml` to a reusable workflow** (6d11a71)
- **tools: update libffi updater script** (7a17c50)
- **src: avoid redundant call to `std::get_if<>()`** (12edf1d)
- **tls: handle large RSA exponents in X.509 cert** (3bdd7e2)
- **perf_hooks: sample delay per event loop iteration** (39e0c14)
- **doc: update toolchain for official AIX releases** (d5f8260)
- **test_runner: improve coverage failure diagnostics** (269b609)
- **crypto: reject small-order EdDSA points during verify** (0908d76)
- **lib: lazily initialize kEvents and kHandlers maps** (1f72393)
- **stream: proxy first own method in Readable.wrap()** (1182ad8)
- **tools: exclude `libffi` changes from `test-shared` GHA CI** (28047a3)
- **meta: update sccache version in test-linux-quic** (874c46c)
- **repl: lazy-load acorn and defer vm context creation** (00dea28)
- **deps: update googletest to 0b1e895ba4226c2fda5ee0178c9b5b1195a741aa** (8ef643d)
- **buffer: implement blob.textStream()** (55f4844)
- **src: avoid copying source string in TextEncoder.encode** (eda91b6)
- **stream: observe abort while awaiting pipeTo source** (d0b830b)
- **stream: respect iter consumer abort signals** (f7adcd8)
- **Working on v26.4.1** (70e7541)

### Tests
- **test: make blob desiredSize assertion robust** (b09e624)
- **test: update WPT for urlpattern to 11a459a2b1** (d0d8f0c)
- **test: improve lcov reporter snapshot diagnostics** (ff9122c)
- **test: keep finalization close fixture ref alive** (570952d)
- **test: fix typo from overriden to overridden** (1b4f213)
- **test: fix typo from funciton to function** (4c91090)
- **test: mark hr-time WPT flaky on macos15-x64** (bf080c7)
- **test: use one-off agent in http consumed timeout test** (24e3209)
- **test: fix flaky test-runner coverage threshold test** (3229886)

### Chore
- **build: allow linting node.1** (a67d9a7)
- **build: enable Maglev for riscv64** (06c1fbc)
- **build: suppress clang errors building libffi on Windows** (518309c)
- **build: add manually-dispatched stress-test workflow** (6a80ab4)
- **build: pin envinfo versions in github actions** (f4e7bf1)
- **build: support setting an emulator from configure script** (66f6ac0)

_Recap by [Repo Wrapped](https://repowrapped.com/gh/nodejs/node?utm_source=github-action)._