## nodejs/node — v26.6.0…v26.7.0

_153+ commits._

### Features
- **crypto: support loading private keys through STORE loaders** (5871768)
- **doc: add RafaelGSS as last security release stewards** (16cb77c)
- **doc: add missing float32/float64 FFI type names** (7089bd9)
- **permission: add unique warning codes** (eb61b7e)
- **doc: add contributing detail for git Signed-off-by trailer** (a757e62)
- **typings: add heap_utils internalBinding types** (fd4460e)
- **test_runner: add support for --test-coverage-include-all** (a646319)
- **permission: support v8.setHeapSnapshotNearHeapLimit** (999a928)
- **doc: add MDN links for explicit resource management in fs** (a836720)
- **meta: add @nodejs/url as codeowner for node_url_pattern.*** (8e03c54)
- **doc: deprecation add more codemod** (522a28e)
- **net: support TCP handle transfer on Windows** (fffd8a7)
- **net: support AF_UNIX paths in net.BoundSocket** (fe9e0db)
- **src: add perfetto trace agent** (e018f9a)
- **lib: add perfetto support** (c1e4f73)

### Fixes
- **doc: fix grammar and punctuation in dgram documentation** (ce8b292)
- **doc: fix grammar and editorial issues in addons documentation** (1a413a6)
- **http: fix writableFinished and 'finish' after write errors** (e26891e)
- **quic: fix stop sending behaviour & callback** (7de3d09)
- **doc: fix typo in maintaining-dependencies.md** (f37de14)
- **tls: fix SNICallback certificate selection** (cafe7bf)
- **doc: fix typos in documentation** (335c28c)
- **doc: fix missing references in doc type map** (d4bed8c)
- **crypto: fix Argon2 bypassing FIPS mode** (478a719)
- **build,tools: fix shared library cross-compile** (74928ad)
- **ffi: fix crash in refCallback and unrefCallback** (428e9bc)
- **src: fix perfetto build on GetTraceFilePath** (a8ec5a9)
- **crypto: fix Argon2 validation errors** (c36bb1d)
- **doc: fix duplicated word in test snapshot docs** (70cd5df)
- **quic: fix coverage comment typo** (6289398)
- **quic: fix segfault after fragmented client hello** (01510dc)
- **ffi: fix optimized buffer conversions** (48f4cfb)
- **lib: fix AbortSignal.any() observed-composite leak** (19b9c14)
- **lib: fix typo in comment in _http_client.js** (d3cada5)
- **benchmark: fix calibrate-n option handling** (d7266cd)
- **stream: fix uncatchable error closing half-open Duplex.toWeb() writable** (fe06bf5)
- **sqlite: fix crash when a session outlives its database** (bb86521)
- **src: fix crash when writing odd-length hex string via Writev** (8725e56)
- **src: fix trace macro compatibility** (2897cc1)
- **src: fix libuv assertion on windows** (53b7d48)
- **sqlite: fix use-after-free in Exec() and ApplyChangeset()** (870f499)

### Backend
- **2026-08-05, Version 26.7.0 (Current)** (b4f23d3)
- **stream: cut per-chunk allocations in pipeTo** (1b0597b)
- **deps: upgrade npm to 11.19.0** (718cbe9)
- **deps: update ngtcp2 to 1.25.0** (657c615)
- **deps: update nghttp3 to 1.18.0** (75a1fbe)
- **stream: preserve push signal abort reason** (2632d60)
- **doc: formalize fn/name as part of TestOptions API** (63fbd59)
- **deps: update minimatch to 10.2.6** (07d7cb7)
- **deps: update simdjson to 4.6.6** (f7d5635)
- **deps: update acorn to 8.18.0** (8b06457)
- **deps: update googletest to 1b6f64d659944658a4c685b7bd9f04c1c3b8a39b** (5919d01)
- **deps: update nghttp2 to 1.70.0** (4a87ad6)
- **doc: remove references to `ca`/`crl` as per-context QuicSession options** (b263b0b)
- **sqlite: invalidate sessions when closing database** (14e802d)
- **meta: bump actions/stale from 10.3.0 to 11.0.0** (31522c4)
- **meta: bump github/codeql-action/analyze from 4.36.2 to 4.37.3** (88c8b8e)
- **meta: bump github/codeql-action/autobuild from 4.36.2 to 4.37.3** (9dcd759)
- **meta: bump actions/setup-python from 6.3.0 to 7.0.0** (82ca02d)
- **meta: bump github/codeql-action/init from 4.36.2 to 4.37.3** (848e228)
- **meta: bump Mozilla-Actions/sccache-action from 0.0.10 to 0.0.11** (ae8ad3b)
- **meta: bump cachix/install-nix-action from 31.10.6 to 31.11.0** (0b359cf)
- **tools: bump the eslint group in /tools/eslint with 4 updates** (9ee05ec)
- **meta: bump github/codeql-action/upload-sarif from 4.36.2 to 4.37.3** (3b4f980)
- **meta: bump step-security/harden-runner from 2.19.4 to 2.20.0** (d7ee9e9)
- **meta: bump ossf/scorecard-action from 2.4.3 to 2.4.4** (7e80bba)
- **http: avoid aborting IncomingMessage signal on normal close** (dfc192f)
- **crypto: preserve OpenSSL errors from KDF failures** (58d13b6)
- **tools: bump brace-expansion from 5.0.7 to 5.0.9 in /tools/eslint** (5f4b859)
- **doc: improve TestContext hook descriptions** (e71d09d)
- **stream: skip zero-byte broadcast writes** (d5358a7)
- **deps: update zlib to 1.3.2.1-motley-42c2f19** (c96d76a)
- **ffi: reject fast calls after library close** (3391210)
- **src,test: disable trace events tests when perfetto is enabled** (69d10ed)
- **doc: document stream.isDestroyed()** (8d3ae08)
- **crypto: update root certificates to NSS 3.125** (44b940e)
- **doc: mark config-file as release candidate** (3e840f4)
- **stream: honor AbortSignal in Writer.end()** (796c896)
- **crypto: clarify missing cipher error** (fde8523)
- **crypto: reuse X509 issuer result** (c604d88)
- **crypto: validate key generation options** (c68c7d0)
- **crypto: handle XOF output allocation failure** (f61408b)
- **crypto: initialize KeyObjectData mutex eagerly** (2b4053d)
- **crypto: handle DH operation failures** (4b7b2ad)
- **stream: use validateString for consumer encoding** (ff12b8e)
- **deps: V8: backport 5177b10891e6** (2b59984)
- **stream: use the ring buffer for pending BYOB pull-into descriptors** (cfad2ef)
- **doc: remove obsolete cctest node.gyp instructions** (d5f36c7)
- **vfs: speed up recursive readdir test setup** (5293abf)
- **sqlite: check database state before calling SQLite** (279547b)
- **ffi: validate fast 32-bit integer argument ranges** (b348ed7)
- **wasm: register missing SetURL function** (b6ab546)
- **fs: key glob matcher cache by platform** (b250b40)
- **doc: report proper return type on url.format** (a0bf29e)
- **doc: use ffi.suffix for library paths in examples** (e655e42)
- **http: guard invalid timeout values in checkConnections** (6794441)
- **ffi: preserve link register in ppc64 trampoline** (109ffcd)
- **doc: document --permission-audit audit mode behavior** (e0f0830)
- **doc: clarify tlsSocket.authorized on resumption** (efbede6)
- **deps: update ada to 4.0.0** (b839af9)
- **src: implement MemoryRetainer protocol for ByteSource** (6cd643a)
- **meta: remove node_crates .gitignore** (915cabb)
- **tools: use 'readonly' for EventSource global** (b5ced90)
- **async_hooks: use validateBoolean for trackPromises** (a2d3f89)
- **test_runner: wait for filtered suite build** (4368303)
- **buffer: use Clamp conversion in Blob slice** (2e64293)
- **doc: stabilize --disable-warning** (db95655)
- **deps: update sqlite to 3.53.4** (70dedef)
- **url: create URLPattern result properties in WebIDL order** (236d7ca)
- **vfs: make lchown update symlink metadata** (4345185)
- **typings: remove isDataView from types binding** (3bc0ee0)
- **deps: update Rust crates for V8 14.6.202.34-node.26** (7bc4c17)
- **deps: V8: backport 7d9b7e03141d** (308c6b2)
- **quic: serialize stream reset code as string** (dcc348a)
- **doc: mention constructor check in deepStrictEqual** (1c09165)
- **test_runner: convert to uint during deserialization** (70d1124)
- **module: implement Symbol.dispose in ModuleHooks** (11c2f9c)
- **loader: enforce path normalization before lookup** (6c21575)
- **buffer: validate copyArrayBuffer offsets against buffer length** (5fda095)
- **crypto: use user-facing error for output encoding changes** (12170c3)
- **v8: report minor mark-sweep in GCProfiler** (3def577)
- **doc: update technical priorities** (2970932)
- **debugger: preserve overlapping CDP request state** (474f06d)
- **readline: reduce createInterface overhead** (c25b8e3)
- **src: rename legacy trace event headers** (0611d44)
- **deps: V8: backport c4d06ba586f3** (8eeae28)
- **src: avoid using ToLocalChecked in crypto_hash** (d4d7172)
- **doc: run license-builder** (c40aaa6)
- **zlib: validate pledgedSrcSize as a safe integer** (f322870)
- **http: propagate highWaterMark to ClientRequest OutgoingMessage** (6879aa4)
- **ffi: preserve strings during reentrant calls** (aa3f168)
- **ffi: preserve uint8 semantics for bool fast calls** (ca60942)
- **ffi: validate fast integer argument ranges** (0fb1d2b)
- **diagnostics_channel: grow native channel storage** (bbd6fc5)
- **zlib: accept ArrayBuffer dictionary in Zstd** (44042c2)
- **http2: avoid copying the options in respond()** (72448a8)
- **http2: avoid per-write closures in kWriteGeneric** (f6692da)
- **http2: reduce per-request allocations** (3ed3715)

### Tests
- **test: unflake debugger and REPL tests** (f2919db)
- **test: ensure assertions are reached on all tests** (a1c2917)
- **test: reuse ffi.suffix instead of reimplementing it** (b9e596f)
- **test: remove test-repl-user-error-handler from flaky** (c816918)
- **test: update WPT for url to 4832db4761** (9d2f10e)
- **test: update WPT for url to b63305b743** (75b80d0)
- **test: cover worker throwing primitive values** (9a139b3)
- **test: mark test-repl-user-error-handler as flaky** (796acc8)

### Chore
- **build: run perfetto build and test on GHA** (5298db4)
- **build: fix v8_use_perfetto source scraping** (e3eac7c)
- **build: bump rustc requirement to >=1.86** (ab5f076)
- **build: perfetto-sdk** (df608e0)

_Recap by [Repo Wrapped](https://repowrapped.com/gh/nodejs/node?utm_source=github-action)._