2026-10-14, Version 26.12.0 (Current)

.github/workflows/benchmark.yml

@@ -140,7 +140,7 @@ jobs:
             --arg withPerfetto ${{ matrix.perfetto || false }} \
             --arg ccache '(import <nixpkgs> {}).sccache' \
             --run '
-                make build-ci -j4 V=1
+                make build-ci -j4 V=1 ${{ contains(format(' {0} ', inputs.category), ' napi ') && '&& make bench-addons-build' || '' }}
             ' tools/nix/ci-shell.nix
         env:
           SCCACHE_LOCAL_RW_MODE: READ_ONLY

.github/workflows/build-tarball.yml

@@ -64,7 +64,7 @@ concurrency:
   cancel-in-progress: true
 
 env:
-  PYTHON_VERSION: '3.14'
+  PYTHON_VERSION: '3.15'
   FLAKY_TESTS: keep_retrying
   CLANG_VERSION: '19'
 

.github/workflows/coverage-linux-without-intl.yml

@@ -34,7 +34,7 @@ concurrency:
   cancel-in-progress: true
 
 env:
-  PYTHON_VERSION: '3.14'
+  PYTHON_VERSION: '3.15'
   FLAKY_TESTS: keep_retrying
   CLANG_VERSION: '19'
   CC: ${{ (github.base_ref == 'main' || github.ref_name == 'main') && 'sccache' || '' }} clang-19
@@ -85,6 +85,6 @@ jobs:
       - name: Clean tmp
         run: rm -rf coverage/tmp && rm -rf out
       - name: Upload
-        uses: codecov/codecov-action@0b35c9ecc4f0529d0eb674914510c22f85b196b4  # v7.1.0
+        uses: codecov/codecov-action@303a32d7a59b442fa8d48b6a1cc6825c09c847a5  # v7.1.1
         with:
           directory: ./coverage

.github/workflows/coverage-linux.yml

@@ -34,7 +34,7 @@ concurrency:
   cancel-in-progress: true
 
 env:
-  PYTHON_VERSION: '3.14'
+  PYTHON_VERSION: '3.15'
   FLAKY_TESTS: keep_retrying
   CLANG_VERSION: '19'
   CC: ${{ (github.base_ref == 'main' || github.ref_name == 'main') && 'sccache' || '' }} clang-19
@@ -85,6 +85,6 @@ jobs:
       - name: Clean tmp
         run: rm -rf coverage/tmp && rm -rf out
       - name: Upload
-        uses: codecov/codecov-action@0b35c9ecc4f0529d0eb674914510c22f85b196b4  # v7.1.0
+        uses: codecov/codecov-action@303a32d7a59b442fa8d48b6a1cc6825c09c847a5  # v7.1.1
         with:
           directory: ./coverage

.github/workflows/coverage-windows.yml

@@ -60,7 +60,7 @@ concurrency:
   cancel-in-progress: true
 
 env:
-  PYTHON_VERSION: '3.14'
+  PYTHON_VERSION: '3.15'
   FLAKY_TESTS: keep_retrying
   RUSTC_VERSION: '1.86'
 
@@ -101,6 +101,6 @@ jobs:
       - name: Clean tmp
         run: npx rimraf ./coverage/tmp
       - name: Upload
-        uses: codecov/codecov-action@0b35c9ecc4f0529d0eb674914510c22f85b196b4  # v7.1.0
+        uses: codecov/codecov-action@303a32d7a59b442fa8d48b6a1cc6825c09c847a5  # v7.1.1
         with:
           directory: ./coverage

.github/workflows/daily-wpt-fyi.yml

@@ -13,7 +13,7 @@ on:
     - cron: 30 0 * * *
 
 env:
-  PYTHON_VERSION: '3.14'
+  PYTHON_VERSION: '3.15'
 
 permissions:
   contents: read

.github/workflows/label-pr.yml

@@ -12,7 +12,7 @@ jobs:
     runs-on: ubuntu-slim
 
     steps:
-      - uses: nodejs/node-pr-labeler@d4cf1b8b9f23189c37917000e5e17e796c770a6b  # v1
+      - uses: nodejs/node-pr-labeler@dfe5eb3b099a487644e32567a482744620876ab3  # v1
         with:
           repo-token: ${{ secrets.GH_USER_TOKEN }}
           configuration-path: .github/label-pr-config.yml

.github/workflows/lint-release-proposal.yml

@@ -10,7 +10,7 @@ concurrency:
   cancel-in-progress: true
 
 env:
-  PYTHON_VERSION: '3.14'
+  PYTHON_VERSION: '3.15'
   NODE_VERSION: lts/*
 
 permissions:

.github/workflows/linters.yml

@@ -14,7 +14,7 @@ concurrency:
   cancel-in-progress: true
 
 env:
-  PYTHON_VERSION: '3.14'
+  PYTHON_VERSION: '3.15'
   NODE_VERSION: lts/*
 
 permissions:

.github/workflows/stress-test.yml

@@ -33,7 +33,7 @@ on:
         type: string
 
 env:
-  PYTHON_VERSION: '3.14'
+  PYTHON_VERSION: '3.15'
   XCODE_VERSION: '16.4'
   CLANG_VERSION: '19'
   RUSTC_VERSION: '1.86'

.github/workflows/test-internet.yml

@@ -31,7 +31,7 @@ concurrency:
   cancel-in-progress: true
 
 env:
-  PYTHON_VERSION: '3.14'
+  PYTHON_VERSION: '3.15'
   FLAKY_TESTS: keep_retrying
   CLANG_VERSION: '19'
   CC: ${{ (github.base_ref == 'main' || github.ref_name == 'main') && 'sccache' || '' }} clang-19

.github/workflows/test-linux-perfetto.yml

@@ -20,7 +20,7 @@ concurrency:
   cancel-in-progress: true
 
 env:
-  PYTHON_VERSION: '3.14'
+  PYTHON_VERSION: '3.15'
   FLAKY_TESTS: keep_retrying
   CLANG_VERSION: '19'
   CC: ${{ (github.base_ref == 'main' || github.ref_name == 'main') && 'sccache' || '' }} clang-19

.github/workflows/test-linux-quic.yml

@@ -8,6 +8,7 @@ on:
       - configure.py
       - node.gyp
       - node.gypi
+      - deps/v8/**
       - deps/ngtcp2/**
       - deps/nghttp3/**
       - deps/openssl/**
@@ -30,7 +31,7 @@ concurrency:
   cancel-in-progress: true
 
 env:
-  PYTHON_VERSION: '3.14'
+  PYTHON_VERSION: '3.15'
   FLAKY_TESTS: keep_retrying
   CLANG_VERSION: '19'
   CC: ${{ (github.base_ref == 'main' || github.ref_name == 'main') && 'sccache' || '' }} clang-19

.github/workflows/test-linux.yml

@@ -39,7 +39,7 @@ concurrency:
   cancel-in-progress: true
 
 env:
-  PYTHON_VERSION: '3.14'
+  PYTHON_VERSION: '3.15'
   FLAKY_TESTS: keep_retrying
   CLANG_VERSION: '19'
   CC: ${{ (github.base_ref == 'main' || github.ref_name == 'main') && 'sccache' || '' }} clang-19

.github/workflows/test-macos.yml

@@ -65,7 +65,7 @@ concurrency:
   cancel-in-progress: true
 
 env:
-  PYTHON_VERSION: '3.14'
+  PYTHON_VERSION: '3.15'
   XCODE_VERSION: '16.4'
   FLAKY_TESTS: keep_retrying
   RUSTC_VERSION: '1.86'

.github/workflows/tools.yml

@@ -48,7 +48,7 @@ on:
           - zstd
 
 env:
-  PYTHON_VERSION: '3.14'
+  PYTHON_VERSION: '3.15'
 
 permissions:
   contents: read

BUILDING.md

@@ -98,6 +98,12 @@ and libc version. The table below lists the support tier for each supported
 combination. A list of [supported compile toolchains](#supported-toolchains) is
 also supplied for tier 1 platforms.
 
+Some built-in functionality requires WebAssembly or runtime allocation of
+executable memory. When a capability is unavailable, Node.js does not guarantee
+an alternative implementation of the affected feature. See the
+[`--jitless` documentation](doc/api/cli.md#--jitless) and
+[FFI documentation](doc/api/ffi.md) for the corresponding limitations and errors.
+
 **For production applications, run Node.js on supported platforms only (Tier 1 or 2).**
 
 Node.js does not support a platform version if a vendor has expired support
@@ -187,6 +193,7 @@ Binaries at <https://nodejs.org/download/release/> are produced on:
 | linux-ppc64le           | RHEL 8 with Clang 20.1 and gcc-toolset-14-libatomic-devel[^6] |
 | linux-s390x             | RHEL 8 with Clang 20.1 and gcc-toolset-14-libatomic-devel[^6] |
 | linux-x64               | RHEL 8 with Clang 20.1 and gcc-toolset-14-libatomic-devel[^6] |
+| linux-x64-musl          | Alpine 3.23 with Clang 21                                     |
 | win-arm64               | Windows Server 2022 (x64) with Visual Studio 2022             |
 | win-x64                 | Windows Server 2022 (x64) with Visual Studio 2022             |
 

CHANGELOG.md

@@ -41,7 +41,8 @@ release.
 </tr>
 <tr>
   <td valign="top">
-<b><a href="doc/changelogs/CHANGELOG_V26.md#26.11.1">26.11.1</a></b><br/>
+<b><a href="doc/changelogs/CHANGELOG_V26.md#26.12.0">26.12.0</a></b><br/>
+<a href="doc/changelogs/CHANGELOG_V26.md#26.11.1">26.11.1</a><br/>
 <a href="doc/changelogs/CHANGELOG_V26.md#26.11.0">26.11.0</a><br/>
 <a href="doc/changelogs/CHANGELOG_V26.md#26.10.0">26.10.0</a><br/>
 <a href="doc/changelogs/CHANGELOG_V26.md#26.9.0">26.9.0</a><br/>

LICENSE

@@ -1184,8 +1184,8 @@ The externally maintained libraries used by Node.js are:
           same "printed page" as the copyright notice for easier
           identification within third-party archives.
 
-       Copyright 2017 - 2025 R. Thomas
-       Copyright 2017 - 2025 Quarkslab
+       Copyright 2017 - 2026 R. Thomas
+       Copyright 2017 - 2026 Quarkslab
 
        Licensed under the Apache License, Version 2.0 (the "License");
        you may not use this file except in compliance with the License.

SECURITY.md

@@ -264,7 +264,12 @@ then untrusted input must not lead to arbitrary JavaScript code execution.
 
 * The developers and infrastructure that run it.
 * The operating system that Node.js is running under and its configuration,
-  along with anything under the control of the operating system.
+  along with anything under the control of the operating system. An attacker
+  who can already run commands on the host and uses an official, signed
+  Node.js binary to execute malicious JavaScript does not exploit a
+  vulnerability in Node.js. A code signature identifies the publisher of the
+  Node.js binary; it is not a statement about the trustworthiness of the
+  scripts that binary executes.
 * The deployment network environment for the privacy of traffic and routing
   decisions, including internal networks through which Node.js traffic passes
   and configured HTTP(S) proxy servers. Built-in proxy support is intended to

android-configure

@@ -4,6 +4,7 @@
 # Note that the mix of single and double quotes is intentional,
 # as is the fact that the ] goes on a new line.
 _=[ 'exec' '/bin/sh' '-c' '''
+command -v python3.15 >/dev/null && exec python3.15 "$0" "$@"
 command -v python3.14 >/dev/null && exec python3.14 "$0" "$@"
 command -v python3.13 >/dev/null && exec python3.13 "$0" "$@"
 command -v python3.12 >/dev/null && exec python3.12 "$0" "$@"
@@ -22,7 +23,14 @@ except ImportError:
   from distutils.spawn import find_executable as which
 
 print('Node.js android configure: Found Python {}.{}.{}...'.format(*sys.version_info))
-acceptable_pythons = ((3, 14), (3, 13), (3, 12), (3, 11), (3, 10))
+acceptable_pythons = (
+  (3, 15),
+  (3, 14),
+  (3, 13),
+  (3, 12),
+  (3, 11),
+  (3, 10),
+)
 if sys.version_info[:2] in acceptable_pythons:
   import android_configure
 else:

benchmark/buffers/buffer-read-with-byteLength.js

@@ -10,14 +10,14 @@ const types = [
 ];
 
 const bench = common.createBenchmark(main, {
-  buffer: ['fast'],
+  buffer: ['fast', 'slow'],
   type: types,
   n: [1e6],
-  byteLength: [1, 2, 3, 4, 5, 6],
+  byteLength: [1, 2, 4, 6],
 });
 
-function main({ n, buf, type, byteLength }) {
-  const buff = buf === 'fast' ?
+function main({ n, buffer, type, byteLength }) {
+  const buff = buffer === 'fast' ?
     Buffer.alloc(8) :
     Buffer.allocUnsafeSlow(8);
   const fn = `read${type}`;

benchmark/buffers/buffer-read.js

@@ -20,13 +20,13 @@ const types = [
 ];
 
 const bench = common.createBenchmark(main, {
-  buffer: ['fast'],
+  buffer: ['fast', 'slow'],
   type: types,
   n: [1e6],
 });
 
-function main({ n, buf, type }) {
-  const buff = buf === 'fast' ?
+function main({ n, buffer, type }) {
+  const buff = buffer === 'fast' ?
     Buffer.alloc(8) :
     Buffer.allocUnsafeSlow(8);
   const fn = `read${type}`;

benchmark/buffers/buffer-write.js

@@ -27,7 +27,7 @@ const types = [
 ];
 
 const bench = common.createBenchmark(main, {
-  buffer: ['fast'],
+  buffer: ['fast', 'slow'],
   type: types,
   n: [1e6],
 });
@@ -70,8 +70,8 @@ const byteLength = {
   writeIntBE: 6,
 };
 
-function main({ n, buf, type }) {
-  const buff = buf === 'fast' ?
+function main({ n, buffer, type }) {
+  const buff = buffer === 'fast' ?
     Buffer.alloc(8) :
     Buffer.allocUnsafeSlow(8);
   const fn = `write${type}`;

benchmark/common.js

@@ -441,7 +441,11 @@ module.exports = {
       return process.binding(bindingName);
     }
   },
-  buildType: process.features.debug ? 'Debug' : 'Release',
+  // As in test/common: a --debug-node build is still a Release build, and its
+  // addons are in build/Release.
+  buildType: process.config.target_defaults ?
+    process.config.target_defaults.default_configuration :
+    'Release',
   createBenchmark(fn, configs, options) {
     return new Benchmark(fn, configs, options);
   },

benchmark/crypto/webcrypto-digest.js

@@ -33,8 +33,6 @@ function measureLegacy(n, data, method) {
 }
 
 function measureSubtle(n, data, method) {
-  const ec = new TextEncoder();
-  data = ec.encode(data);
   const jobs = new Array(n);
   bench.start();
   for (let i = 0; i < n; i++)