## nodejs/node — v26.9.0…v26.10.0

_218+ commits._

### Features
- **doc: add araujogui to collaborators** (eb4fabe)
- **vfs: add --vfs-mount and --vfs-load startup flags** (16e3e7e)
- **perf_hooks: implement qrde analysis support in Histogram** (a326546)
- **crypto: add crypto.parsePKCS12()** (c0a42d2)
- **src,lib: add util.markPromiseAsHandled** (3c999ed)
- **src: support building with the V8 sandbox** (a0f99f1)
- **crypto: add Hybrid KEMs to Web Cryptography** (c58a4e0)
- **fs: add openAsBlobSync** (2b1701f)
- **benchmark: add --csv option to compare.js with --analyze** (c518831)
- **meta: add joyeecheung as v8 currency strategic initiative champion** (d03e731)
- **quic: add promise to QuicStream for pending strms** (975cac5)
- **url: add Symbol.toStringTag to URLPattern** (e51673b)
- **vfs: support renaming implicit ZIP directories** (a914909)

### Fixes
- **src: fix `-Wextra` warning in `WriteFileSync`** (1f24901)
- **trace_events: fix abort when Node.js does not own the V8 platform** (66fd788)
- **doc: fix duplicate 'the' typo in `node_platform.cc`** (2fffb38)
- **quic: fix two small bugs in HTTP/3 stream internals** (4743cd8)
- **quic: fix timeout regression from 11ed32572b3** (7cf4488)
- **inspector: fix abort when two Environments own the inspector** (9511071)
- **lib: fix AbortSignal.any() abort propagation** (cce2795)
- **quic: fix readable stream truncation on stop-sending, abort & timeout** (61a98e6)
- **http2: fix onread assert when destroying session from stream handler** (2054437)
- **src: fix crash on empty, foreign or truncated --snapshot-blob files** (a05023f)
- **test_runner: fix quote escaping in JUnit** (9b3085e)
- **stream: fix async iteration of undefined chunks** (04e5c28)
- **assert: fix TypeError on deepStrictEqual with null Map key or Set member** (2bf0824)
- **doc: fix sign-off format in AGENTS.md** (3325ded)
- **lib: fix for FileHandle.readableWebStream** (2c0ccc0)
- **stream: fix ERR_INVALID_STATE when cancelling Readable.toWeb()** (5661526)
- **src: fix external reference list race between concurrent isolates** (05f4e54)
- **zlib: fix zstd reset** (4cdcf7f)

### Backend
- **2026-09-22, Version 26.10.0 (Current)** (151845a)
- **crypto: remove redundent `std::move` call** (8955781)
- **Revert "deps: V8: override `depot_tools` version"** (94affce)
- **tools: update `tools/v8` for Python 3.13** (b7fe779)
- **crypto: read RSA-PSS restrictions from provider** (0b88aa5)
- **crypto: skip private RSA parameters in key details** (f90d3d3)
- **crypto: use provider EC group names** (97828d9)
- **crypto: fetch ciphers for private-key encoding** (3de05da)
- **crypto: decode PKCS#1 keys through providers** (ca8ee04)
- **crypto: derive keys through EVP_KDF** (54a625e)
- **tools: bump eslint-plugin-jsdoc in /tools/eslint in the eslint group** (6105b37)
- **tools: disable fortify warnings in `test-shared`** (060ed69)
- **deps: V8: cherry-pick 95efbaf92a0d** (870a366)
- **tools: clean up handling of shared libs in `shell.nix`** (f8b7a2f)
- **deps: V8: backport a0607c5006b8** (d62a452)
- **meta: bump step-security/harden-runner from 2.21.0 to 2.21.1** (13eb484)
- **meta: bump github/codeql-action/upload-sarif from 4.37.9 to 4.38.0** (0f75917)
- **tools: group CodeQL GHA updates** (3c9586c)
- **src: reuse crypto GetCipherInfo in DTLS session** (b98787f)
- **tools: summarize auto-start-ci failures** (aa531a3)
- **doc: clarify sub-1000ms behavior in socket.setKeepAlive** (317abb8)
- **inspector: report an error when DOM storage is unavailable** (7e1db47)
- **stream: destroy half-open sockets after iteration** (e5d2a33)
- **child_process: clear timeout timer on spawn-time error too** (c438176)
- **fs: coerce FileHandle.read length like fs.read** (b7406b0)
- **stream: destroy Duplex.from async function on early return** (4075161)
- **fs: honor dereference for symlinks nested in cpSync trees** (cb9995b)
- **sqlite: throw on invalid URL path instead of abort** (293e69d)
- **tools: bump the eslint group in /tools/eslint with 6 updates** (b7eef15)
- **meta: bump cachix/cachix-action** (c75b830)
- **meta: bump github/codeql-action/init from 4.37.9 to 4.38.0** (1ada705)
- **meta: bump github/codeql-action/analyze from 4.37.9 to 4.38.0** (1ed8b05)
- **meta: bump github/codeql-action/autobuild from 4.37.9 to 4.38.0** (9165abe)
- **crypto: use names for asymmetric key algorithms** (971adec)
- **tools: update pgo build doc for linux** (8914947)
- **quic: improve stream cleanup & lookup** (0df54fb)
- **doc: remove obsolete mentioning of cl.exe on windows** (1c12f81)
- **src: avoid union type-punning in trace values** (410093d)
- **stream: fixup stream/iter to drop at most one entry per share call** (7d245cf)
- **stream: reject unbounded at SyncShare construction** (30e1f76)
- **stream: make share budget failures detach before throwing** (0372056)
- **stream: make Broadcast.from abort its background pump** (36cc238)
- **stream: update broadcast to retain buffered data with zero consumers** (3134ca6)
- **tls: propagate singleUse to the secure context** (02c2302)
- **vfs: write RealFSProvider files to open fd** (c50cb9a)
- **src: print exception thrown during primordial initialization** (9ec030b)
- **crypto: optimize and benchmark key preparation** (bfb544e)
- **lib,src: apply multiple updates to dtls implementation** (da341e2)
- **http2: settle pending write callbacks on destroy** (46f76ed)
- **util: implement util.throttle** (3ce4d23)
- **util: implement debounce** (336f33c)
- **perf_hooks: implement SlidingWindowHistogram** (13e61f6)
- **doc,test: account for OpenSSL 4.1 behaviours** (6ddbb99)
- **test,benchmark: use OpenSSL feature helpers** (f8cdf05)
- **http: don't destroy socket after request completes** (77d8f17)
- **doc: note that default signal handling resets the signal mask** (2cc17dd)
- **vfs: close the fs hook gaps for mounted paths** (1bbc548)
- **src: ffi: create fast-call metadata Symbols lazily** (27c6223)
- **deps: update googletest to 8eff9e336692fc95961e096564f1044c600b881d** (e8edeff)
- **doc: clarify QUIC async write backpressure** (3a69cc1)
- **tools: avoid workflow shell interpolation** (a5b1659)
- **tools: use self-repository references** (caf0ee0)
- **tools: correct Slack action version comments** (d5880dc)
- **tools: make checkout credential use explicit** (66f182f)
- **ffi: load libraries from a mounted VFS** (64fb33d)
- **tools: pass author to commit message validator** (287ece3)
- **perf_hooks: reuse buffer for uv metrics** (32401c2)
- **doc: clarify permission model scope for output paths** (5496943)
- **test_runner: avoid reusing v8 serializers** (88b12c0)
- **src: avoid copying SEA snapshot data** (5a5abd8)
- **tools: reduce test runner timing overhead** (6314ccf)
- **meta: expand on collaborator restoration process** (53d7592)
- **tools: do not download build tools when linting Nix files** (441350a)
- **stream: avoid promise allocation for parked transform writes** (f81a148)
- **stream: keep webstream stream states in fast-mode objects** (aec01c5)
- **perf_hooks: validate import normalization offset** (5e2fbfe)
- **stream: reject closed only after sink abort settles** (898cd55)
- **src: don't kill own process group on failed spawn** (4141e22)
- **vfs: resolve symlinks when checking rename descendants** (816790e)
- **fs: throw on existing dir in cpSync with errorOnExist** (9b3f1aa)
- **tls: load all CRLs from a PEM bundle** (2a8b5d9)
- **ffi: throw ERR_INVALID_ARG_TYPE for wrong-typed pointer and size** (07fcf1e)
- **tls: defer re-entrant calls to SSL state machine from JS** (d141ddb)
- **src: keep the first snapshot blob alive for later isolates** (1518b7d)
- **zlib: reject invalid zstd dictionaries** (5e55085)
- **doc: fill in missing zstd docs** (89aa2bd)

### Tests
- **test: consolidate crypto provider cache coverage** (7e79c33)
- **test: avoid call to `chmodSync` in `test-fs-cp-async-file-modes`** (dcc9c3c)
- **test: deflake test-run-watch-cwd-isolation-none-*** (dda22c0)
- **test: move permission FFI test to native suite** (d63928d)
- **test: deflake user timing WPT assertions** (80c1bf7)
- **test: unskip `test-watch-create-isolation-none`** (12116d1)
- **test: deflake util.throttle tests** (e90575c)
- **test: expand histogram test coverage** (f7d18ec)
- **test: implement low-risk test optimizations** (bfa6d49)
- **test: update WPT for WebCryptoAPI to 55ce71bb9d** (c3307eb)
- **test: prevent parser reuse across close scenarios** (ee29c56)
- **test: cover cpSync fast path timestamp preservation** (8a27474)
- **test: fix stderr Buffer assertion in exec encoding test** (8929730)
- **test: skip test-vfs-real-provider-watch.js on IBM i** (d4cb916)
- **test: fix RSA/DSA wrong-passphrase flake** (6515db8)
- **test: improve sequential test performance** (fa19eca)
- **test: schedule WPT variants individually** (3666d6a)
- **test: overlap SLH-DSA signature checks** (f2aa27d)
- **test: unref cancelled broadcast source timer** (2170207)
- **test: collect timeout signals explicitly** (71a54aa)
- **test: skip retries in DNS timeout coverage** (1a15aff)
- **test: synchronize ordered runner events** (5c7e6b4)
- **test: reuse fixed primes in DH tests** (37f24ed)
- **test: avoid idle HTTP/HTTPS connections** (831ec42)
- **test: close WebAssembly test HTTP servers** (f523342)
- **test: use named parameters in DH stress test** (f23847a)
- **test: reduce ZIP64 stress test I/O** (7131e3b)
- **test: avoid allocations in external memory test** (e4ca72a)
- **test: cover experimental stream iterator builtins** (7fe6472)
- **test: deflake node-api test-free-called** (88ba17b)

### Chore
- **build: do not use bundled simdutf when built with `--shared-simdutf`** (01cee9d)
- **build: suppress OpenSSL asm warnings with clang** (20606a4)
- **build: derive V8_LOGGING_LEVEL from dcheck_always_on** (a76e97b)

_Recap by [Repo Wrapped](https://repowrapped.com/gh/nodejs/node?utm_source=github-action)._