Skip to content

vfs: dispatch fs/promises to mounted VFS instances - #63537

Merged
nodejs-github-bot merged 1 commit into
nodejs:mainfrom
mcollina:vfs-mount-integration
May 29, 2026
Merged

nodejs-github-bot merged 1 commit into
nodejs:mainfrom
mcollina:vfs-mount-integration

Conversation

@mcollina

@mcollina mcollina commented May 24, 2026 •

Copy link
Copy Markdown
Member
  • Add mount/unmount on VirtualFileSystem plus a handler registry consulted by lib/fs.js, lib/internal/fs/promises.js, and lib/internal/fs/dir.js via vfsState.handlers.
  • Route absolute paths to the VFS that owns them, so the public fs.* and fs/promises APIs (sync, callback, promise, streams, fs.watch, opendir) dispatch to the mounted provider and fall through to the real filesystem otherwise.

Ref: #63115

@nodejs-github-bot nodejs-github-bot added lib / src Issues and PRs involving general changes in the lib/ or src/ directories. needs-ci PRs that need a full CI run. labels May 24, 2026
@codecov

codecov Bot commented May 24, 2026 •

Copy link
Copy Markdown

Codecov Report

❌ Patch coverage is 92.70440% with 116 lines in your changes missing coverage. Please review.
✅ Project coverage is 90.33%. Comparing base (74ccf38) to head (1a72c52).
⚠️ Report is 71 commits behind head on main.

Files with missing lines Patch % Lines
lib/internal/vfs/setup.js 86.68% 87 Missing and 1 partial ⚠️
lib/internal/fs/promises.js 93.29% 10 Missing and 1 partial ⚠️
lib/internal/vfs/file_system.js 93.93% 8 Missing ⚠️
lib/fs.js 99.26% 4 Missing ⚠️
lib/internal/fs/dir.js 80.95% 4 Missing ⚠️
lib/internal/vfs/router.js 97.82% 0 Missing and 1 partial ⚠️
Additional details and impacted files
@@            Coverage Diff            @@
##             main   #63537     +/-   ##
=========================================
  Coverage   90.32%   90.33%             
=========================================
  Files         730      732      +2     
  Lines      234209   236357   +2148     
  Branches    43934    44496    +562     
=========================================
+ Hits       211558   213505   +1947     
- Misses      14372    14562    +190     
- Partials     8279     8290     +11     
Files with missing lines Coverage Δ
lib/internal/fs/utils.js 98.44% <100.00%> (+<0.01%) ⬆️
lib/internal/vfs/errors.js 100.00% <100.00%> (ø)
lib/internal/vfs/router.js 97.82% <97.82%> (ø)
lib/fs.js 98.33% <99.26%> (+0.13%) ⬆️
lib/internal/fs/dir.js 93.84% <80.95%> (-0.74%) ⬇️
lib/internal/vfs/file_system.js 99.21% <93.93%> (+2.52%) ⬆️
lib/internal/fs/promises.js 92.94% <93.29%> (+0.06%) ⬆️
lib/internal/vfs/setup.js 86.68% <86.68%> (ø)

... and 80 files with indirect coverage changes

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
  • 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

@mcollina mcollina added request-ci Add this label to start a Jenkins CI on a PR. Only starts once the PR has an approving review. semver-minor PRs that contain new features and should be released in the next minor version. labels May 24, 2026
@github-actions github-actions Bot removed the request-ci Add this label to start a Jenkins CI on a PR. Only starts once the PR has an approving review. label May 24, 2026
@nodejs-github-bot

Copy link
Copy Markdown
Collaborator

@mcollina mcollina added the request-ci Add this label to start a Jenkins CI on a PR. Only starts once the PR has an approving review. label May 25, 2026
@github-actions github-actions Bot removed the request-ci Add this label to start a Jenkins CI on a PR. Only starts once the PR has an approving review. label May 25, 2026
@nodejs-github-bot

Copy link
Copy Markdown
Collaborator

@mcollina
mcollina force-pushed the vfs-mount-integration branch from fe4a688 to 708a5fa Compare May 25, 2026 17:38
@mcollina mcollina added the request-ci Add this label to start a Jenkins CI on a PR. Only starts once the PR has an approving review. label May 29, 2026
@github-actions github-actions Bot removed the request-ci Add this label to start a Jenkins CI on a PR. Only starts once the PR has an approving review. label May 29, 2026
@nodejs-github-bot

Copy link
Copy Markdown
Collaborator

@mcollina
mcollina force-pushed the vfs-mount-integration branch from 708a5fa to 7fb883a Compare May 29, 2026 10:37
Add mount/unmount lifecycle on `VirtualFileSystem`, a handler registry
that fs.js and fs/promises.js consult via `vfsState.handlers`, and a
router that maps absolute paths to the VFS that owns them. When a VFS
is mounted, the public `fs.*` and `fs/promises` APIs (including
streams, `fs.watch`, and `opendir`) dispatch to the provider for paths
under the mount point, and fall through to the real filesystem
otherwise. Includes per-method dispatch tests, error-path coverage,
multi-mount routing tests, and router unit tests.

Ref: nodejs#63115

Signed-off-by: Matteo Collina <hello@matteocollina.com>
@mcollina
mcollina force-pushed the vfs-mount-integration branch from 7fb883a to 1a72c52 Compare May 29, 2026 10:54

@ShogunPanda ShogunPanda left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM!

@mcollina mcollina added the request-ci Add this label to start a Jenkins CI on a PR. Only starts once the PR has an approving review. label May 29, 2026
@github-actions github-actions Bot removed the request-ci Add this label to start a Jenkins CI on a PR. Only starts once the PR has an approving review. label May 29, 2026
@nodejs-github-bot

Copy link
Copy Markdown
Collaborator

@nodejs-github-bot

Copy link
Copy Markdown
Collaborator

@mcollina mcollina added commit-queue PRs queued for automated landing through the Commit Queue. author ready PRs with CI started, the required approvals, and no outstanding review comments. and removed needs-ci PRs that need a full CI run. labels May 29, 2026
@nodejs-github-bot nodejs-github-bot removed the commit-queue PRs queued for automated landing through the Commit Queue. label May 29, 2026
@nodejs-github-bot
nodejs-github-bot merged commit 569369f into nodejs:main May 29, 2026
77 checks passed
@nodejs-github-bot

Copy link
Copy Markdown
Collaborator

Landed in 569369f

aduh95 pushed a commit that referenced this pull request Jun 20, 2026
Add mount/unmount lifecycle on `VirtualFileSystem`, a handler registry
that fs.js and fs/promises.js consult via `vfsState.handlers`, and a
router that maps absolute paths to the VFS that owns them. When a VFS
is mounted, the public `fs.*` and `fs/promises` APIs (including
streams, `fs.watch`, and `opendir`) dispatch to the provider for paths
under the mount point, and fall through to the real filesystem
otherwise. Includes per-method dispatch tests, error-path coverage,
multi-mount routing tests, and router unit tests.

Ref: #63115

Signed-off-by: Matteo Collina <hello@matteocollina.com>
PR-URL: #63537
Refs: #63115
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Paolo Insogna <paolo@cowtech.it>
nodejs-github-bot added a commit that referenced this pull request Jun 22, 2026
Notable changes:

build, doc:
  * generate node.1 with doc-kit (Aviv Keller) #62044
deps:
  * (SEMVER-MINOR) update OpenSSL build config to support compression (Tim Perry) #62217
doc:
  * (SEMVER-MINOR) update `blockList` stability status to release candidate (alphaleadership) #63050
fs:
  * (SEMVER-MINOR) support caller-supplied readFile() buffers (Matteo Collina) #63634
http:
  * (SEMVER-MINOR) close pre-request sockets in closeIdleConnections (semimikoh) #63470
loader:
  * (SEMVER-MINOR) implement package maps (Maël Nison) #62239
net:
  * (SEMVER-MINOR) support TCP_KEEPINTVL and TCP_KEEPCNT in setKeepAlive (Guy Bedford) #63825
tls:
  * (SEMVER-MINOR) add certificateCompression option (Tim Perry) #62217
vfs:
  * (SEMVER-MINOR) dispatch fs/promises to mounted VFS instances (Matteo Collina) #63537
  * (SEMVER-MINOR) add minimal node:vfs subsystem (Matteo Collina) #63115

PR-URL: #64058
aduh95 added a commit that referenced this pull request Jun 23, 2026
Notable changes:

deps:
  * (SEMVER-MINOR) update OpenSSL build config to support compression (Tim Perry) #62217
doc:
  * (SEMVER-MINOR) update `blockList` stability status to release candidate (alphaleadership) #63050
fs:
  * (SEMVER-MINOR) support caller-supplied `readFile()` buffers (Matteo Collina) #63634
http:
  * (SEMVER-MINOR) close pre-request sockets in `closeIdleConnections` (semimikoh) #63470
loader:
  * (SEMVER-MINOR) implement package maps (Maël Nison) #62239
net:
  * (SEMVER-MINOR) support `TCP_KEEPINTVL` and `TCP_KEEPCNT` in `setKeepAlive` (Guy Bedford) #63825
tls:
  * (SEMVER-MINOR) add `certificateCompression` option (Tim Perry) #62217
vfs:
  * (SEMVER-MINOR) dispatch `node:fs/promises` to mounted VFS instances (Matteo Collina) #63537
  * (SEMVER-MINOR) add minimal `node:vfs` subsystem (Matteo Collina) #63115

PR-URL: #64058
aduh95 added a commit that referenced this pull request Jun 24, 2026
Notable changes:

deps:
  * (SEMVER-MINOR) update OpenSSL build config to support compression (Tim Perry) #62217
doc:
  * (SEMVER-MINOR) update `blockList` stability status to release candidate (alphaleadership) #63050
fs:
  * (SEMVER-MINOR) support caller-supplied `readFile()` buffers (Matteo Collina) #63634
http:
  * (SEMVER-MINOR) close pre-request sockets in `closeIdleConnections` (semimikoh) #63470
loader:
  * (SEMVER-MINOR) implement package maps (Maël Nison) #62239
net:
  * (SEMVER-MINOR) support `TCP_KEEPINTVL` and `TCP_KEEPCNT` in `setKeepAlive` (Guy Bedford) #63825
tls:
  * (SEMVER-MINOR) add `certificateCompression` option (Tim Perry) #62217
vfs:
  * (SEMVER-MINOR) dispatch `node:fs/promises` to mounted VFS instances (Matteo Collina) #63537
  * (SEMVER-MINOR) add minimal `node:vfs` subsystem (Matteo Collina) #63115

PR-URL: #64058
jylenhof pushed a commit to jylenhof/mise-update-tool that referenced this pull request Aug 4, 2026
Automated mise tool upgrades from local config.

Updated tools:
- `action-validator`
- `actionlint`
- `aube`
- `editorconfig-checker`
- `ghalint`
- `node`
- `pinact`
- `pipx:gh-action-pulse`
- `prek`
- `rumdl`
- `shellcheck`
- `shfmt`
- `tombi`
- `uv`
- `yamlfmt`
- `yamllint`
- `zizmor`

Command: `mise upgrade --bump --local action-validator actionlint aube editorconfig-checker ghalint node pinact pipx:gh-action-pulse prek rumdl shellcheck shfmt tombi uv yamlfmt yamllint zizmor`

<details>
<summary>Version changelog (node)</summary>

| Tool | Requested | Installed |
|------|-----------|-----------|
| `node` | `24` → `26` | `24.18.1` → `26.5.1` |

</details>

<details>
<summary>Release notes (1 tools)</summary>

<details>
<summary>node: `24.18.1` → `26.5.1` (nodejs/node)</summary>

### v25.8.2

This is a security release.

### Notable Changes

* (CVE-2026-21637) wrap `SNICallback` invocation in `try`/`catch` (Matteo Collina) - High
* (CVE-2026-21710) use null prototype for `headersDistinct`/`trailersDistinct` (Matteo Collina) - High
* (CVE-2026-21711) include permission check to `pipe_wrap.cc` (RafaelGSS) - Medium
* (CVE-2026-21712) handle url crash on different url formats (RafaelGSS) - Medium
* (CVE-2026-21713) use timing-safe comparison in Web Cryptography HMAC and KMAC (Filip Skokan) - Medium
* (CVE-2026-21714) handle `NGHTTP2_ERR_FLOW_CONTROL` error code (RafaelGSS) - Medium
* (CVE-2026-21717) test array index hash collision (Joyee Cheung) - Medium
* (CVE-2026-21715) add permission check to `realpath.native` (RafaelGSS) - Low
* (CVE-2026-21716) include permission check on `lib/fs/promises` (RafaelGSS) - Low

### Commits

* \[[`2086b7477b`](nodejs/node@2086b7477b)] - **(CVE-2026-21717)** **build,test**: test array index hash collision (Joyee Cheung) [nodejs-private/node-private#834](https://github.com/nodejs-private/node-private/pull/834)
* \[[`0f9332a40a`](nodejs/node@0f9332a40a)] - **(CVE-2026-21713)** **crypto**: use timing-safe comparison in Web Cryptography HMAC and KMAC (Filip Skokan) [nodejs-private/node-private#822](https://github.com/nodejs-private/node-private/pull/822)
* \[[`2b6937ddb2`](nodejs/node@2b6937ddb2)] - **deps**: update undici to 7.24.4 (Node.js GitHub Bot) [#62271](nodejs/node#62271)
* \[[`bfb8ad5787`](nodejs/node@bfb8ad5787)] - **deps**: update undici to 7.24.3 (Node.js GitHub Bot) [#62233](nodejs/node#62233)
* \[[`be6384727f`](nodejs/node@be6384727f)] - **deps**: upgrade npm to 11.11.1 (npm team) [#62216](nodejs/node#62216)
* \[[`2feea5bb97`](nodejs/node@2feea5bb97)] - **deps**: V8: override… (truncated)

### v25.9.0

### Notable Changes

#### Test runner module mocking improvements

`MockModuleOptions.defaultExport` and `MockModuleOptions.namedExports` have been
consolidated into a single option `MockModuleOptions.exports` to align with user
expectations and other test runners.

A `default` property on `MockModuleOptions.exports`  represents the default
export, and own enumerable properties are treated as named exports.

An automated migration is available to update user code:
<https://github.com/nodejs/userland-migrations/tree/main/recipes/mock-module-exports>

```bash
npx codemod @​nodejs/mock-module-exports
```

Contributed by sangwook in [#61727](nodejs/node#61727).

#### Other notable changes

* \[[`312476cb84`](nodejs/node@312476cb84)] - **(SEMVER-MINOR)** **async\_hooks**: add using scopes to `AsyncLocalStorage` (Stephen Belanger) [#61674](nodejs/node#61674)
* \[[`62d2cd473b`](nodejs/node@62d2cd473b)] - **(SEMVER-MINOR)** **cli**: add `--max-heap-size` option (tannal) [#58708](nodejs/node#58708)
* \[[`d0ebf0e44b`](nodejs/node@d0ebf0e44b)] - **(SEMVER-MINOR)** **crypto**: add `TurboSHAKE` and `KangarooTwelve` Web Cryptography algorithms (Filip Skokan) [#62183](nodejs/node#62183)
* \[[`f85b9d9fa8`](nodejs/node@f85b9d9fa8)] - **(SEMVER-MINOR)** **repl**: add customizable error handling (Anna Henningsen) [#62188](nodejs/node#62188)
* \[[`67b854d407`](nodejs/node@67b854d407)] - **(SEMVER-MINOR)** **repl**: remove dependency on `node:domain` (Matteo Collina) [#61227](nodejs/node#61227)
* \[[`966b700623`](nodejs/node@966b700623)] - **(SEMVER-MINOR)** **sea**: support code cache for ESM entrypoint in SEA (Joyee Cheung) [#62158](nodejs/node#62158)
*… (truncated)

### v26.0.0

We're excited to announce the release of Node.js 26! Highlights include the Temporal API enabled by default,
updates to the V8 JavaScript engine to 14.6, Undici to 8.0, and several important deprecations and removals
as we continue to modernize the platform.

As a reminder, Node.js 26 will enter long-term support (LTS) in October, but until then, it will be the "Current" release for the next six months.
We encourage you to explore the new features and benefits offered by this latest release and evaluate their potential impact on your applications.

### Notable Changes

#### Temporal API

The Temporal API is now enabled by default in Node.js 26. Temporal is a modern date/time API for JavaScript
that provides a more robust and feature-rich alternative to the legacy `Date` object.

Contributed by Richard Lau in [#61806](nodejs/node#61806).

#### V8 14.6

The V8 engine is updated to version 14.6.202.33, which is part of Chromium 134.

This version also includes:

* Upsert (<https://github.com/tc39/proposal-upsert>): `[Weak]Map.prototype.getOrInsert()`, `[Weak]Map.prototype.getOrInsertComputed()`
* Iterator sequencing (<https://github.com/tc39/proposal-iterator-sequencing>): `Iterator.concat()`

Contributed by Michaël Zasso in [#61898](nodejs/node#61898).

#### Undici 8

Undici has been updated to version 8.0.2, bringing new features and improvements to Node.js's HTTP client implementation.

#### Deprecations and Removals

* \[[`dff46c07c3`](nodejs/node@dff46c07c3)] - **(SEMVER-MAJOR)** **crypto**: move DEP0182 to End-of-Life (Tobias Nießen) [#61084](nodejs/node#61084)
* \[[`93c25815ee`](nodejs/node@93c25815ee)] - **(SEMVER-MAJOR)** **http**: move writeHeader to end-of-life (Sebastian Beltran) [#60635](nodejs/node#60635)

`http.Server.prototype.writeHeader()` is now fully removed. Use `http.Server.prototype.write… (truncated)

### v26.1.0

### Notable Changes

#### Experimental `node:ffi` module

Node.js now includes an experimental `node:ffi` module for loading dynamic
libraries and calling native symbols from JavaScript.

The API is gated behind the `--experimental-ffi` flag and, when the Permission
Model is enabled, requires `--allow-ffi`.

This API is inherently unsafe. Invalid pointers, incorrect signatures, or accessing memory
after it has been freed can crash the process or corrupt memory.

Contributed by Paolo Insogna in [#62072](nodejs/node#62072).

#### Other Notable Changes

* \[[`34a6454fe3`](nodejs/node@34a6454fe3)] - **(SEMVER-MINOR)** **buffer**: add `end` parameter (Robert Nagy) [#62390](nodejs/node#62390)
* \[[`073e84d7fe`](nodejs/node@073e84d7fe)] - **(SEMVER-MINOR)** **crypto**: accept key data in `crypto.diffieHellman()` and cleanup DH jobs (Filip Skokan) [#62527](nodejs/node#62527)
* \[[`5b9cb10a5f`](nodejs/node@5b9cb10a5f)] - **(SEMVER-MINOR)** **crypto**: implement `randomUUIDv7()` (nabeel378) [#62553](nodejs/node#62553)
* \[[`98f9becd16`](nodejs/node@98f9becd16)] - **(SEMVER-MINOR)** **debugger**: add edit-free runtime expression probes to `node inspect` (Joyee Cheung) [#62713](nodejs/node#62713)
* \[[`06defaa2ea`](nodejs/node@06defaa2ea)] - **(SEMVER-MINOR)** **fs**: add `signal` option to `fs.stat()` (Mert Can Altin) [#57775](nodejs/node#57775)
* \[[`db66a963bf`](nodejs/node@db66a963bf)] - **(SEMVER-MINOR)** **fs**: expose `frsize` field in `statfs` (Jinho Jang) [#62277](nodejs/node#62277)
* \[[`87adb3472b`](nodejs/node@87adb3472b)] - **(SEMVER-MINOR)** **http**: harden `ClientRequest` options merge (Matteo Collina) [#6… (truncated)

### v26.2.0

### Notable Changes

* \[[`189d43a193`](nodejs/node@189d43a193)] - **doc**: mark `stream.compose` stable (Matteo Collina) [#62562](nodejs/node#62562)
* \[[`f858c6140e`](nodejs/node@f858c6140e)] - **(SEMVER-MINOR)** **fs**: add `Temporal.Instant` support to `Stats` and `BigIntStats` (Livia Medeiros) [#60789](nodejs/node#60789)
* \[[`0cbb3895df`](nodejs/node@0cbb3895df)] - **(SEMVER-MINOR)** **http**: add `writeInformation` to send arbitrary 1xx status codes (Tim Perry) [#63155](nodejs/node#63155)

### Commits

* \[[`9a394bab84`](nodejs/node@9a394bab84)] - **benchmark**: respect stream/iter broadcast backpressure (Trivikram Kamat) [#63314](nodejs/node#63314)
* \[[`ad98b4620b`](nodejs/node@ad98b4620b)] - **crypto**: align verifyOneShot accepted types (Anshika Jain) [#63280](nodejs/node#63280)
* \[[`ba0736a847`](nodejs/node@ba0736a847)] - **crypto**: wire ML-DSA and ML-KEM for use when using BoringSSL (Filip Skokan) [#63255](nodejs/node#63255)
* \[[`5573a6a4a8`](nodejs/node@5573a6a4a8)] - **crypto**: wire ChaCha20-Poly1305 in Web Cryptography when using BoringSSL (Filip Skokan) [#63255](nodejs/node#63255)
* \[[`7dc563b8d6`](nodejs/node@7dc563b8d6)] - **crypto**: wire AES-KW in Web Cryptography when using BoringSSL (Filip Skokan) [#63255](nodejs/node#63255)
* \[[`b55e2b1f4d`](nodejs/node@b55e2b1f4d)] - **crypto**: improve system certificate enumeration logic on macOS (Robo) [#62576](nodejs/node#62576)
* \[[`fd509a755a`](nodejs/node@fd509a755a)] - **crypto**: harden CryptoKey algorithm slots… (truncated)

### v26.3.0

### Notable Changes

#### Potential changes to macOS Universal Binary availability

With Apple and its ecosystem progressively dropping support for Intel-based
architectures, it has become apparent that the Node.js project may not be able
to maintain the universal binaries we currently distribute for the full lifetime
of Node.js 26. This change serves to communicate that risk. At present, our
intention remains to continue shipping universal binaries supporting both Apple
Silicon and Intel-based Macs for as long as practical.

Contributed by Antoine du Hamel in [#63055](nodejs/node#63055).

#### Other notable changes

* \[[`a2a4b33dd8`](nodejs/node@a2a4b33dd8)] - **(SEMVER-MINOR)** **buffer**: increase `Buffer.poolSize` default to 64 KiB (Matteo Collina) [#63597](nodejs/node#63597)
* \[[`051a2152f7`](nodejs/node@051a2152f7)] - **crypto**: update root certificates to NSS 3.123.1 (Node.js GitHub Bot) [#63527](nodejs/node#63527)
* \[[`49462eca37`](nodejs/node@49462eca37)] - **(SEMVER-MINOR)** **http**: add `httpValidation` option to configure header value validation (RajeshKumar11) [#61597](nodejs/node#61597)
* \[[`97b7ab19bd`](nodejs/node@97b7ab19bd)] - **(SEMVER-MINOR)** **inspector**: expose precise coverage start to JS runtime (sangwook) [#63079](nodejs/node#63079)
* \[[`cfb80a2103`](nodejs/node@cfb80a2103)] - **(SEMVER-MINOR)** **lib,permission**: add `permission.drop` (Rafael Gonzaga) [#62672](nodejs/node#62672)

### Commits

* \[[`a2a4b33dd8`](nodejs/node@a2a4b33dd8)] - **(SEMVER-MINOR)** **buffer**: increase Buffer.poolSize default to 64 KiB (Matteo Collina) [#63597](nodejs/node#63597)
* \[[`0eff3e23b9`](https://github.com/nodejs/n… (truncated)

### v26.3.1

This is a security release.

### Notable Changes

* (CVE-2026-48618) tls: normalize hostname for server identity checks (Matteo Collina) – High
* (CVE-2026-48933) crypto: guard WebCrypto cipher output length (Filip Skokan) – High
* (CVE-2026-48615) lib,test: redact proxy credentials in tunnel errors (Matteo Collina) – Medium
* (CVE-2026-48619) http2: cap originSet size to prevent unbounded memory growth (Matteo Collina) – Medium
* (CVE-2026-48928) tls: fix case-sensitive SNI context matching (Matteo Collina) – Medium
* (CVE-2026-48930) dns,net: reject hostnames with embedded NUL bytes (Matteo Collina) – Medium
* (CVE-2026-48934) tls: bind reusable sessions to authenticated host (Matteo Collina) – Medium
* (CVE-2026-48617) permission: handle process.chdir on writereport (RafaelGSS) – Low
* (CVE-2026-48931) http: fix response queue poisoning in http.Agent (Matteo Collina) – Low
* (CVE-2026-48935) permission: disable FileHandle utimes with permission model (RafaelGSS) – Low
* (CVE-2026-48936) permission: guard pipe open and chmod with net scope (RafaelGSS) – Low

### Commits

* \[[`98fbc89211`](nodejs/node@98fbc89211)] - **(CVE-2026-48933)** **crypto**: guard WebCrypto cipher output length (Filip Skokan) [nodejs-private/node-private#878](https://github.com/nodejs-private/node-private/pull/878)
* \[[`110840f2c7`](nodejs/node@110840f2c7)] - **deps**: update llhttp to 9.4.2 (Antoine du Hamel) [nodejs-private/node-private#890](https://github.com/nodejs-private/node-private/pull/890)
* \[[`8d36d522b2`](nodejs/node@8d36d522b2)] - **deps**: update undici to 8.5.0 (Node.js GitHub Bot) [#63903](nodejs/node#63903)
* \[[`2e6d03993a`](nodejs/node@2e6d03993a)] - **deps**: update undici to 8.4.0 (Node.js GitHub Bot) [#63779](nodejs/node#63779)
* \[[`5a17d5b07a`](nodejs/node@5a17d5b07a)] - **deps… (truncated)

### v26.4.0

### Notable Changes

* \[[`cde0daabcc`](nodejs/node@cde0daabcc)] - **(SEMVER-MINOR)** **doc**: update `blockList` stability status to release candidate (alphaleadership) [#63050](nodejs/node#63050)
* \[[`b78f5a7537`](nodejs/node@b78f5a7537)] - **(SEMVER-MINOR)** **fs**: support caller-supplied `readFile()` buffers (Matteo Collina) [#63634](nodejs/node#63634)
* \[[`417aacbc36`](nodejs/node@417aacbc36)] - **(SEMVER-MINOR)** **http**: close pre-request sockets in `closeIdleConnections` (semimikoh) [#63470](nodejs/node#63470)
* \[[`fbb108be7d`](nodejs/node@fbb108be7d)] - **(SEMVER-MINOR)** **loader**: implement package maps (Maël Nison) [#62239](nodejs/node#62239)
* \[[`45494d5a8a`](nodejs/node@45494d5a8a)] - **(SEMVER-MINOR)** **net**: support `TCP_KEEPINTVL` and `TCP_KEEPCNT` in `setKeepAlive` (Guy Bedford) [#63825](nodejs/node#63825)
* \[[`ee29465e77`](nodejs/node@ee29465e77)] - **(SEMVER-MINOR)** **tls**: add certificateCompression option (Tim Perry) [#62217](nodejs/node#62217)
* \[[`b17817eb2b`](nodejs/node@b17817eb2b)] - **(SEMVER-MINOR)** **vfs**: dispatch `node:fs/promises` to mounted VFS instances (Matteo Collina) [#63537](nodejs/node#63537)
* \[[`7bc93a6ac5`](nodejs/node@7bc93a6ac5)] - **(SEMVER-MINOR)** **vfs**: add minimal `node:vfs` subsystem (Matteo Collina) [#63115](nodejs/node#63115)

### Commits

* \[[`c7eb83b46a`](nodejs/node@c7eb83b46a)] - **benchmark**: add child\_process async path baselines (Yagiz Nizipli) [#63929](nodejs/node#63929)
* \[[`066fff17a5`](https://github.com/nodejs/node/commit/066f… (truncated)

### v26.5.0

### Notable Changes

#### New release key

Welcome to our newest releaser, [Stewart X Addison](https://github.com/sxa). Future Node.js releases may be signed with his [release key](https://github.com/nodejs/node/blob/main/README.md#release-keys), `655F3B5C1FB3FA8D1A0CA6BDE4A7D232B936D2FD`.

#### Other notable changes

* \[[`55f48446c7`](nodejs/node@55f48446c7)] - **(SEMVER-MINOR)** **buffer**: implement blob.textStream() (Matthew Aitken) [#64036](nodejs/node#64036)
* \[[`b373202efc`](nodejs/node@b373202efc)] - **(SEMVER-MINOR)** **esm**: add `--experimental-import-text` flag (Efe) [#62300](nodejs/node#62300)
* \[[`39e0c14455`](nodejs/node@39e0c14455)] - **(SEMVER-MINOR)** **perf\_hooks**: sample delay per event loop iteration (Pablo Erhard) [#62935](nodejs/node#62935)
* \[[`999a83c937`](nodejs/node@999a83c937)] - **(SEMVER-MINOR)** **stream**: expose ReadableStreamTee (Matteo Collina) [#64195](nodejs/node#64195)
* \[[`4e0236dc3d`](nodejs/node@4e0236dc3d)] - **(SEMVER-MINOR)** **tls**: report negotiated TLS groups (Filip Skokan) [#64119](nodejs/node#64119)

### Commits

* \[[`87648c0a6c`](nodejs/node@87648c0a6c)] - **benchmark**: trim down the argon2 sets (Filip Skokan) [#64218](nodejs/node#64218)
* \[[`a483bfd3f0`](nodejs/node@a483bfd3f0)] - **buffer**: remove unreachable overflow check in atob (haramjeong) [#60161](nodejs/node#60161)
* \[[`6d14279688`](nodejs/node@6d14279688)] - **buffer**: add fast api for isUtf8 and isAscii (Gürgün Dayıoğlu) [#64169](nodejs/node#64169)
* \[[`55f48446c7`](nodejs/node@55f48446c7)] -… (truncated)

### v26.5.1

This is a security release.

### Notable Changes

* (CVE-2026-56848) http2: defer rst stream while in scope (Matteo Collina) – High
* (CVE-2026-58043) permission: avoid granting radix split nodes (RafaelGSS) – High
* (CVE-2026-56850) https: distinguish PFX object-array agent keys (RafaelGSS) – Medium
* (CVE-2026-58040) https: bind identity checks to session reuse (Matteo Collina) – Medium
* (CVE-2026-58041) sqlite: invalidate tag store iterators on statement reset (Matteo Collina) – Medium
* (CVE-2026-58042) dns: handle large resolveAny address replies (RafaelGSS) – Medium
* (CVE-2026-58045) zlib: throw on out-of-bounds write buffers (RafaelGSS) – Medium
* (CVE-2026-56847) permission: enforce fs write permission for trace events (RafaelGSS) – Low
* (CVE-2026-58039) permission: check final report output path (RafaelGSS) – Low
* (CVE-2026-58044) http: reject requests exceeding max header count (Matteo Collina) – Low
* deps: update llhttp to 9.4.3 (Paolo Insogna)
* deps: update undici to 8.9.0 (Node.js GitHub Bot)

### Commits

* \[[`af0bf96877`](nodejs/node@af0bf96877)] - **deps**: update llhttp to 9.4.3 (Paolo Insogna) [nodejs-private/node-private#935](https://github.com/nodejs-private/node-private/pull/935)
* \[[`0354678355`](nodejs/node@0354678355)] - **deps**: update undici to 8.9.0 (Node.js GitHub Bot) [#64712](nodejs/node#64712)
* \[[`dbeeaeec13`](nodejs/node@dbeeaeec13)] - **(CVE-2026-58042)** **dns**: handle large resolveAny address replies (RafaelGSS) [nodejs-private/node-private#929](https://github.com/nodejs-private/node-private/pull/929)
* \[[`064d339f56`](nodejs/node@064d339f56)] - **(CVE-2026-58044)** **http**: reject requests exceeding max header count (Matteo Collina) [nodejs-private/node-private#922](https://github.com/nodejs-private/node-private/pull/922)
* \[[`23b94c843a`](https://github.… (truncated)

_Omitted 12 older releases._

</details>

</details>

Modified files:
- `.mise.toml`
jylenhof pushed a commit to jylenhof/mise-update-tool that referenced this pull request Aug 10, 2026
Automated mise tool upgrades from local config.

Updated tools:
- `action-validator`
- `actionlint`
- `aube`
- `editorconfig-checker`
- `ghalint`
- `node`
- `pinact`
- `pipx:gh-action-pulse`
- `prek`
- `rumdl`
- `shellcheck`
- `shfmt`
- `tombi`
- `uv`
- `yamlfmt`
- `yamllint`
- `zizmor`

Command: `mise upgrade --bump --local action-validator actionlint aube editorconfig-checker ghalint node pinact pipx:gh-action-pulse prek rumdl shellcheck shfmt tombi uv yamlfmt yamllint zizmor`

<details>
<summary>Version changelog (6 tools)</summary>

| Tool | Requested | Installed |
|------|-----------|-----------|
| `editorconfig-checker` | `3.8.0` → `3.11.1` | `3.8.0` → `3.11.1` |
| `node` | `24` → `26` | `24.19.0` → `26.7.0` |
| `prek` | `0.4.11` → `0.4.12` | `0.4.11` → `0.4.12` |
| `rumdl` | `0.2.49` → `0.2.52` | `0.2.49` → `0.2.52` |
| `tombi` | `1.2.6` → `1.2.7` | `1.2.6` → `1.2.7` |
| `uv` | `0.12.1` → `0.12.3` | `0.12.1` → `0.12.3` |

</details>

<details>
<summary>Release notes (6 tools)</summary>

<details>
<summary>editorconfig-checker: `3.8.0` → `3.11.1` (editorconfig-checker/editorconfig-checker)</summary>

### v3.9.0

## [3.9.0](editorconfig-checker/editorconfig-checker@v3.8.0...v3.9.0) (2026-07-31)

### Features

* enable immutable releases ([6865c06](editorconfig-checker/editorconfig-checker@6865c06))

### v3.10.0

## editorconfig-checker v3.10.0 (2026-08-07T23:27:59Z)

Welcome to this new release of editorconfig-checker!

## Changelog
### Others
* 77a3415d6127cc892376837b85fd2a4b5c98d40d: Revert "feat(immutable-releases): set release-please to create draft releases" (@​klaernie)
* a85cd6ab82397f19bdd9bfa30730a487ead1ec74: chore(deps): bump docker/login-action from 4.5.2 to 4.6.0 (#590) (@​dependabot[bot])
* 74cd03a2e91c1c42deff2bec2d120c06ff1be3e8: chore(main): release 3.10.0 (#588) (@​editorconfig-checker-bot)
* 8d4f96e7a838bfb0d8b98a40e66ce8cbd8c1e075: chore: allow triggering release-please manually (@​klaernie)
* a685b542509d0349ce6215adf6088a242fa93d84: feat(immutable-release): tell release-please to create draft releases (@​klaernie)
* 912f4a986b7da0b22cfa3a055cc24a355dee7cbc: feat(immutable-releases): ensure that despite the release being a draft the tag is created (@​klaernie)
* 2d48c2ecae1743614cefa660c2796e14cefd7520: feat(immutable-releases): set release-please to create draft releases (@​klaernie)

## Thanks!

Those were the changes on v3.10.0!

### v3.11.0

## editorconfig-checker v3.11.0 (2026-08-08T10:40:38Z)

Welcome to this new release of editorconfig-checker!

## Changelog
### Others
* 174c5809baf06f2d8e82c1d2de1f6433cc569a1d: chore(main): release 3.11.0 (#592) (@​editorconfig-checker-bot)
* e9f143bc9d6cc5bb29030843ec42eae2a94b4dda: chore: replace deprecated goreleaser option with its current form (@​klaernie)
* 4c08f2ccd339734ff92f2f04d146cd91af02d225: feat(immutable-release): goreleaser should publish its release (@​klaernie)

## Thanks!

Those were the changes on v3.11.0!

### v3.11.1

## [3.11.1](editorconfig-checker/editorconfig-checker@v3.11.0...v3.11.1) (2026-08-08)

### Features

* **immutable-release:** tell goreleaser to use the existing draft release ([a8e6136](editorconfig-checker/editorconfig-checker@a8e6136))

</details>
<details>
<summary>node: `24.19.0` → `26.7.0` (nodejs/node)</summary>

### v26.0.0

We're excited to announce the release of Node.js 26! Highlights include the Temporal API enabled by default,
updates to the V8 JavaScript engine to 14.6, Undici to 8.0, and several important deprecations and removals
as we continue to modernize the platform.

As a reminder, Node.js 26 will enter long-term support (LTS) in October, but until then, it will be the "Current" release for the next six months.
We encourage you to explore the new features and benefits offered by this latest release and evaluate their potential impact on your applications.

### Notable Changes

#### Temporal API

The Temporal API is now enabled by default in Node.js 26. Temporal is a modern date/time API for JavaScript
that provides a more robust and feature-rich alternative to the legacy `Date` object.

Contributed by Richard Lau in [#61806](nodejs/node#61806).

#### V8 14.6

The V8 engine is updated to version 14.6.202.33, which is part of Chromium 134.

This version also includes:

* Upsert (<https://github.com/tc39/proposal-upsert>): `[Weak]Map.prototype.getOrInsert()`, `[Weak]Map.prototype.getOrInsertComputed()`
* Iterator sequencing (<https://github.com/tc39/proposal-iterator-sequencing>): `Iterator.concat()`

Contributed by Michaël Zasso in [#61898](nodejs/node#61898).

#### Undici 8

Undici has been updated to version 8.0.2, bringing new features and improvements to Node.js's HTTP client implementation.

#### Deprecations and Removals

* \[[`dff46c07c3`](nodejs/node@dff46c07c3)] - **(SEMVER-MAJOR)** **crypto**: move DEP0182 to End-of-Life (Tobias Nießen) [#61084](nodejs/node#61084)
* \[[`93c25815ee`](nodejs/node@93c25815ee)] - **(SEMVER-MAJOR)** **http**: move writeHeader to end-of-life (Sebastian Beltran) [#60635](nodejs/node#60635)

`http.Server.prototype.writeHeader()` is now fully removed. Use `http.Server.prototype.write… (truncated)

### v26.1.0

### Notable Changes

#### Experimental `node:ffi` module

Node.js now includes an experimental `node:ffi` module for loading dynamic
libraries and calling native symbols from JavaScript.

The API is gated behind the `--experimental-ffi` flag and, when the Permission
Model is enabled, requires `--allow-ffi`.

This API is inherently unsafe. Invalid pointers, incorrect signatures, or accessing memory
after it has been freed can crash the process or corrupt memory.

Contributed by Paolo Insogna in [#62072](nodejs/node#62072).

#### Other Notable Changes

* \[[`34a6454fe3`](nodejs/node@34a6454fe3)] - **(SEMVER-MINOR)** **buffer**: add `end` parameter (Robert Nagy) [#62390](nodejs/node#62390)
* \[[`073e84d7fe`](nodejs/node@073e84d7fe)] - **(SEMVER-MINOR)** **crypto**: accept key data in `crypto.diffieHellman()` and cleanup DH jobs (Filip Skokan) [#62527](nodejs/node#62527)
* \[[`5b9cb10a5f`](nodejs/node@5b9cb10a5f)] - **(SEMVER-MINOR)** **crypto**: implement `randomUUIDv7()` (nabeel378) [#62553](nodejs/node#62553)
* \[[`98f9becd16`](nodejs/node@98f9becd16)] - **(SEMVER-MINOR)** **debugger**: add edit-free runtime expression probes to `node inspect` (Joyee Cheung) [#62713](nodejs/node#62713)
* \[[`06defaa2ea`](nodejs/node@06defaa2ea)] - **(SEMVER-MINOR)** **fs**: add `signal` option to `fs.stat()` (Mert Can Altin) [#57775](nodejs/node#57775)
* \[[`db66a963bf`](nodejs/node@db66a963bf)] - **(SEMVER-MINOR)** **fs**: expose `frsize` field in `statfs` (Jinho Jang) [#62277](nodejs/node#62277)
* \[[`87adb3472b`](nodejs/node@87adb3472b)] - **(SEMVER-MINOR)** **http**: harden `ClientRequest` options merge (Matteo Collina) [#6… (truncated)

### v26.2.0

### Notable Changes

* \[[`189d43a193`](nodejs/node@189d43a193)] - **doc**: mark `stream.compose` stable (Matteo Collina) [#62562](nodejs/node#62562)
* \[[`f858c6140e`](nodejs/node@f858c6140e)] - **(SEMVER-MINOR)** **fs**: add `Temporal.Instant` support to `Stats` and `BigIntStats` (Livia Medeiros) [#60789](nodejs/node#60789)
* \[[`0cbb3895df`](nodejs/node@0cbb3895df)] - **(SEMVER-MINOR)** **http**: add `writeInformation` to send arbitrary 1xx status codes (Tim Perry) [#63155](nodejs/node#63155)

### Commits

* \[[`9a394bab84`](nodejs/node@9a394bab84)] - **benchmark**: respect stream/iter broadcast backpressure (Trivikram Kamat) [#63314](nodejs/node#63314)
* \[[`ad98b4620b`](nodejs/node@ad98b4620b)] - **crypto**: align verifyOneShot accepted types (Anshika Jain) [#63280](nodejs/node#63280)
* \[[`ba0736a847`](nodejs/node@ba0736a847)] - **crypto**: wire ML-DSA and ML-KEM for use when using BoringSSL (Filip Skokan) [#63255](nodejs/node#63255)
* \[[`5573a6a4a8`](nodejs/node@5573a6a4a8)] - **crypto**: wire ChaCha20-Poly1305 in Web Cryptography when using BoringSSL (Filip Skokan) [#63255](nodejs/node#63255)
* \[[`7dc563b8d6`](nodejs/node@7dc563b8d6)] - **crypto**: wire AES-KW in Web Cryptography when using BoringSSL (Filip Skokan) [#63255](nodejs/node#63255)
* \[[`b55e2b1f4d`](nodejs/node@b55e2b1f4d)] - **crypto**: improve system certificate enumeration logic on macOS (Robo) [#62576](nodejs/node#62576)
* \[[`fd509a755a`](nodejs/node@fd509a755a)] - **crypto**: harden CryptoKey algorithm slots… (truncated)

### v26.3.0

### Notable Changes

#### Potential changes to macOS Universal Binary availability

With Apple and its ecosystem progressively dropping support for Intel-based
architectures, it has become apparent that the Node.js project may not be able
to maintain the universal binaries we currently distribute for the full lifetime
of Node.js 26. This change serves to communicate that risk. At present, our
intention remains to continue shipping universal binaries supporting both Apple
Silicon and Intel-based Macs for as long as practical.

Contributed by Antoine du Hamel in [#63055](nodejs/node#63055).

#### Other notable changes

* \[[`a2a4b33dd8`](nodejs/node@a2a4b33dd8)] - **(SEMVER-MINOR)** **buffer**: increase `Buffer.poolSize` default to 64 KiB (Matteo Collina) [#63597](nodejs/node#63597)
* \[[`051a2152f7`](nodejs/node@051a2152f7)] - **crypto**: update root certificates to NSS 3.123.1 (Node.js GitHub Bot) [#63527](nodejs/node#63527)
* \[[`49462eca37`](nodejs/node@49462eca37)] - **(SEMVER-MINOR)** **http**: add `httpValidation` option to configure header value validation (RajeshKumar11) [#61597](nodejs/node#61597)
* \[[`97b7ab19bd`](nodejs/node@97b7ab19bd)] - **(SEMVER-MINOR)** **inspector**: expose precise coverage start to JS runtime (sangwook) [#63079](nodejs/node#63079)
* \[[`cfb80a2103`](nodejs/node@cfb80a2103)] - **(SEMVER-MINOR)** **lib,permission**: add `permission.drop` (Rafael Gonzaga) [#62672](nodejs/node#62672)

### Commits

* \[[`a2a4b33dd8`](nodejs/node@a2a4b33dd8)] - **(SEMVER-MINOR)** **buffer**: increase Buffer.poolSize default to 64 KiB (Matteo Collina) [#63597](nodejs/node#63597)
* \[[`0eff3e23b9`](https://github.com/nodejs/n… (truncated)

### v26.3.1

This is a security release.

### Notable Changes

* (CVE-2026-48618) tls: normalize hostname for server identity checks (Matteo Collina) – High
* (CVE-2026-48933) crypto: guard WebCrypto cipher output length (Filip Skokan) – High
* (CVE-2026-48615) lib,test: redact proxy credentials in tunnel errors (Matteo Collina) – Medium
* (CVE-2026-48619) http2: cap originSet size to prevent unbounded memory growth (Matteo Collina) – Medium
* (CVE-2026-48928) tls: fix case-sensitive SNI context matching (Matteo Collina) – Medium
* (CVE-2026-48930) dns,net: reject hostnames with embedded NUL bytes (Matteo Collina) – Medium
* (CVE-2026-48934) tls: bind reusable sessions to authenticated host (Matteo Collina) – Medium
* (CVE-2026-48617) permission: handle process.chdir on writereport (RafaelGSS) – Low
* (CVE-2026-48931) http: fix response queue poisoning in http.Agent (Matteo Collina) – Low
* (CVE-2026-48935) permission: disable FileHandle utimes with permission model (RafaelGSS) – Low
* (CVE-2026-48936) permission: guard pipe open and chmod with net scope (RafaelGSS) – Low

### Commits

* \[[`98fbc89211`](nodejs/node@98fbc89211)] - **(CVE-2026-48933)** **crypto**: guard WebCrypto cipher output length (Filip Skokan) [nodejs-private/node-private#878](https://github.com/nodejs-private/node-private/pull/878)
* \[[`110840f2c7`](nodejs/node@110840f2c7)] - **deps**: update llhttp to 9.4.2 (Antoine du Hamel) [nodejs-private/node-private#890](https://github.com/nodejs-private/node-private/pull/890)
* \[[`8d36d522b2`](nodejs/node@8d36d522b2)] - **deps**: update undici to 8.5.0 (Node.js GitHub Bot) [#63903](nodejs/node#63903)
* \[[`2e6d03993a`](nodejs/node@2e6d03993a)] - **deps**: update undici to 8.4.0 (Node.js GitHub Bot) [#63779](nodejs/node#63779)
* \[[`5a17d5b07a`](nodejs/node@5a17d5b07a)] - **deps… (truncated)

### v26.4.0

### Notable Changes

* \[[`cde0daabcc`](nodejs/node@cde0daabcc)] - **(SEMVER-MINOR)** **doc**: update `blockList` stability status to release candidate (alphaleadership) [#63050](nodejs/node#63050)
* \[[`b78f5a7537`](nodejs/node@b78f5a7537)] - **(SEMVER-MINOR)** **fs**: support caller-supplied `readFile()` buffers (Matteo Collina) [#63634](nodejs/node#63634)
* \[[`417aacbc36`](nodejs/node@417aacbc36)] - **(SEMVER-MINOR)** **http**: close pre-request sockets in `closeIdleConnections` (semimikoh) [#63470](nodejs/node#63470)
* \[[`fbb108be7d`](nodejs/node@fbb108be7d)] - **(SEMVER-MINOR)** **loader**: implement package maps (Maël Nison) [#62239](nodejs/node#62239)
* \[[`45494d5a8a`](nodejs/node@45494d5a8a)] - **(SEMVER-MINOR)** **net**: support `TCP_KEEPINTVL` and `TCP_KEEPCNT` in `setKeepAlive` (Guy Bedford) [#63825](nodejs/node#63825)
* \[[`ee29465e77`](nodejs/node@ee29465e77)] - **(SEMVER-MINOR)** **tls**: add certificateCompression option (Tim Perry) [#62217](nodejs/node#62217)
* \[[`b17817eb2b`](nodejs/node@b17817eb2b)] - **(SEMVER-MINOR)** **vfs**: dispatch `node:fs/promises` to mounted VFS instances (Matteo Collina) [#63537](nodejs/node#63537)
* \[[`7bc93a6ac5`](nodejs/node@7bc93a6ac5)] - **(SEMVER-MINOR)** **vfs**: add minimal `node:vfs` subsystem (Matteo Collina) [#63115](nodejs/node#63115)

### Commits

* \[[`c7eb83b46a`](nodejs/node@c7eb83b46a)] - **benchmark**: add child\_process async path baselines (Yagiz Nizipli) [#63929](nodejs/node#63929)
* \[[`066fff17a5`](https://github.com/nodejs/node/commit/066f… (truncated)

### v26.5.0

### Notable Changes

#### New release key

Welcome to our newest releaser, [Stewart X Addison](https://github.com/sxa). Future Node.js releases may be signed with his [release key](https://github.com/nodejs/node/blob/main/README.md#release-keys), `655F3B5C1FB3FA8D1A0CA6BDE4A7D232B936D2FD`.

#### Other notable changes

* \[[`55f48446c7`](nodejs/node@55f48446c7)] - **(SEMVER-MINOR)** **buffer**: implement blob.textStream() (Matthew Aitken) [#64036](nodejs/node#64036)
* \[[`b373202efc`](nodejs/node@b373202efc)] - **(SEMVER-MINOR)** **esm**: add `--experimental-import-text` flag (Efe) [#62300](nodejs/node#62300)
* \[[`39e0c14455`](nodejs/node@39e0c14455)] - **(SEMVER-MINOR)** **perf\_hooks**: sample delay per event loop iteration (Pablo Erhard) [#62935](nodejs/node#62935)
* \[[`999a83c937`](nodejs/node@999a83c937)] - **(SEMVER-MINOR)** **stream**: expose ReadableStreamTee (Matteo Collina) [#64195](nodejs/node#64195)
* \[[`4e0236dc3d`](nodejs/node@4e0236dc3d)] - **(SEMVER-MINOR)** **tls**: report negotiated TLS groups (Filip Skokan) [#64119](nodejs/node#64119)

### Commits

* \[[`87648c0a6c`](nodejs/node@87648c0a6c)] - **benchmark**: trim down the argon2 sets (Filip Skokan) [#64218](nodejs/node#64218)
* \[[`a483bfd3f0`](nodejs/node@a483bfd3f0)] - **buffer**: remove unreachable overflow check in atob (haramjeong) [#60161](nodejs/node#60161)
* \[[`6d14279688`](nodejs/node@6d14279688)] - **buffer**: add fast api for isUtf8 and isAscii (Gürgün Dayıoğlu) [#64169](nodejs/node#64169)
* \[[`55f48446c7`](nodejs/node@55f48446c7)] -… (truncated)

### v26.5.1

This is a security release.

### Notable Changes

* (CVE-2026-56848) http2: defer rst stream while in scope (Matteo Collina) – High
* (CVE-2026-58043) permission: avoid granting radix split nodes (RafaelGSS) – High
* (CVE-2026-56850) https: distinguish PFX object-array agent keys (RafaelGSS) – Medium
* (CVE-2026-58040) https: bind identity checks to session reuse (Matteo Collina) – Medium
* (CVE-2026-58041) sqlite: invalidate tag store iterators on statement reset (Matteo Collina) – Medium
* (CVE-2026-58042) dns: handle large resolveAny address replies (RafaelGSS) – Medium
* (CVE-2026-58045) zlib: throw on out-of-bounds write buffers (RafaelGSS) – Medium
* (CVE-2026-56847) permission: enforce fs write permission for trace events (RafaelGSS) – Low
* (CVE-2026-58039) permission: check final report output path (RafaelGSS) – Low
* (CVE-2026-58044) http: reject requests exceeding max header count (Matteo Collina) – Low
* deps: update llhttp to 9.4.3 (Paolo Insogna)
* deps: update undici to 8.9.0 (Node.js GitHub Bot)

### Commits

* \[[`af0bf96877`](nodejs/node@af0bf96877)] - **deps**: update llhttp to 9.4.3 (Paolo Insogna) [nodejs-private/node-private#935](https://github.com/nodejs-private/node-private/pull/935)
* \[[`0354678355`](nodejs/node@0354678355)] - **deps**: update undici to 8.9.0 (Node.js GitHub Bot) [#64712](nodejs/node#64712)
* \[[`dbeeaeec13`](nodejs/node@dbeeaeec13)] - **(CVE-2026-58042)** **dns**: handle large resolveAny address replies (RafaelGSS) [nodejs-private/node-private#929](https://github.com/nodejs-private/node-private/pull/929)
* \[[`064d339f56`](nodejs/node@064d339f56)] - **(CVE-2026-58044)** **http**: reject requests exceeding max header count (Matteo Collina) [nodejs-private/node-private#922](https://github.com/nodejs-private/node-private/pull/922)
* \[[`23b94c843a`](https://github.… (truncated)

### v26.6.0

### Notable Changes

* \[[`5a36018abc`](nodejs/node@5a36018abc)] - **doc**: add MikeMcC399 as collaborator (Mike McCready) [#64656](nodejs/node#64656)
* \[[`9b04f82d7b`](nodejs/node@9b04f82d7b)] - **(SEMVER-MINOR)** **ffi**: add `getCurrentEventLoop` (Paolo Insogna) [#64323](nodejs/node#64323)
* \[[`bb51f2c960`](nodejs/node@bb51f2c960)] - **(SEMVER-MINOR)** **test\_runner**: add `context.log()` and `test:log` event (Moshe Atlow) [#64389](nodejs/node#64389)
* \[[`56ce83b3ee`](nodejs/node@56ce83b3ee)] - **(SEMVER-MINOR)** **test\_runner**: report `entryFile` in `TestStream` events (Moshe Atlow) [#64309](nodejs/node#64309)

### Commits

* \[[`248ff9fa5c`](nodejs/node@248ff9fa5c)] - **assert,util**: fix TypeError on Maps with null keys (Paul Bouchon) [#64441](nodejs/node#64441)
* \[[`3b5baceafe`](nodejs/node@3b5baceafe)] - **benchmark**: add bytes variant to webstreams async-iterator (Matteo Collina) [#64291](nodejs/node#64291)
* \[[`0a46d1ef66`](nodejs/node@0a46d1ef66)] - **buffer**: normalize lone "\r" in Blob native line endings (Daijiro Wachi) [#64115](nodejs/node#64115)
* \[[`d9ada18b70`](nodejs/node@d9ada18b70)] - **buffer**: fix Blob.stream() leaking source buffer (semimikoh) [#63577](nodejs/node#63577)
* \[[`d05993bcf6`](nodejs/node@d05993bcf6)] - **build**: merge multiple on download artifact (Chengzhong Wu) [#64633](nodejs/node#64633)
* \[[`6c25ac909a`](nodejs/node@6c25ac909a)] - **build**: extract temporal\_capi crate directory name into gyp variable (René) [#64482](https://githu… (truncated)

### v26.7.0

### Notable Changes

* \[[`58717685a1`](nodejs/node@58717685a1)] - **(SEMVER-MINOR)** **crypto**: support loading private keys through STORE loaders (Filip Skokan) [#63949](nodejs/node#63949)
* \[[`44b940ee8c`](nodejs/node@44b940ee8c)] - **crypto**: update root certificates to NSS 3.125 (Node.js GitHub Bot) [#64746](nodejs/node#64746)
* \[[`c1e4f7365e`](nodejs/node@c1e4f7365e)] - **(SEMVER-MINOR)** **lib**: add perfetto support (Chengzhong Wu) [#64565](nodejs/node#64565)
* \[[`11c2f9c642`](nodejs/node@11c2f9c642)] - **(SEMVER-MINOR)** **module**: implement `Symbol.dispose` in `ModuleHooks` (Remco Haszing) [#63928](nodejs/node#63928)
* \[[`a646319f61`](nodejs/node@a646319f61)] - **(SEMVER-MINOR)** **test\_runner**: add support for `--test-coverage-include-all` (avivkeller) [#64830](nodejs/node#64830)

### Commits

* \[[`a2d3f891d3`](nodejs/node@a2d3f891d3)] - **async\_hooks**: use validateBoolean for trackPromises (Soul Lee) [#64731](nodejs/node#64731)
* \[[`d7266cdd99`](nodejs/node@d7266cdd99)] - **benchmark**: fix calibrate-n option handling (Luan Muniz) [#64146](nodejs/node#64146)
* \[[`2e64293e3f`](nodejs/node@2e64293e3f)] - **buffer**: use Clamp conversion in Blob slice (Donghoon Kang) [#64739](nodejs/node#64739)
* \[[`5fda0958bd`](nodejs/node@5fda0958bd)] - **buffer**: validate copyArrayBuffer offsets against buffer length (Ilia Alshanetsky) [#63904](nodejs/node#63904)
* \[[`5298db40f9`](nodejs/node@5298db40f9)] - **build**: run perfetto build and test on GHA (Chengzhong Wu) [#6472… (truncated)

_Omitted 14 older releases._

</details>
<details>
<summary>prek: `0.4.11` → `0.4.12` (j178/prek)</summary>

### v0.4.12

## Release Notes

Released on 2026-08-03.

### Enhancements

- Add `--require-group` for hook group intersections ([#2472](j178/prek#2472))
- Align fast-path and builtin pre-commit hooks ([#2433](j178/prek#2433))
- Do not shuffle file list for verbose output ([#2431](j178/prek#2431))
- Improve top-level command descriptions ([#2429](j178/prek#2429))
- Install `uv` from Astral CDN and drop source racing ([#2455](j178/prek#2455))
- Make `prek install --force` bypass external hooks paths ([#2437](j178/prek#2437))
- Show builtin hook flags in verbose list output ([#2427](j178/prek#2427))
- Verify uv release archive checksums ([#2456](j178/prek#2456))

### Performance

- Precompute file tags in parallel ([#2440](j178/prek#2440))
- Skip diffs after known hook modifications ([#2447](j178/prek#2447))
- Skip worktree diffs for read-only languages ([#2432](j178/prek#2432))
- Track builtin hook file changes directly ([#2404](j178/prek#2404))

### Bug fixes

- Use full object IDs in diff snapshots ([#2448](j178/prek#2448))

### Documentation

- Add a multi-repository configuration example ([#2434](j178/prek#2434))
- Rewrite benchmark documentation ([#2469](j178/prek#2469))

### Contributors

- @​j178
- @​BitWeaverDev
- @​allanlewis

## Install prek 0.4.12

### Install prebuilt binaries via shell script

```sh
curl --proto '=https' --tlsv1.2 -LsSf https://github.com/j178/prek/releases/download/v0.4.12/prek-installer.sh | sh
```

### Install prebuilt binaries via powershell script

```sh
powershell -ExecutionPolicy Bypass -c "irm https://github.com/j178/prek/releases/download/v0.4.12/prek-installer.ps1 | iex"
```… (truncated)

</details>
<details>
<summary>rumdl: `0.2.49` → `0.2.52` (rvben/rumdl)</summary>

### v0.2.50

### Added

- **md077**: support fixed continuation indent config (#786) ([fea6322](rvben/rumdl@fea6322))

### Fixed

- **md065**: leave markers alone inside a block that hides its content ([2654364](rvben/rumdl@2654364))
- **md065**: report thematic breaks written with spaces between markers ([1d29236](rvben/rumdl@1d29236))
- **md076**: ask the parser whether a list item's block is really fenced ([fd616c2](rvben/rumdl@fd616c2))
- **md022**: require a blank line below a heading above a spaced thematic break ([27120f2](rvben/rumdl@27120f2))
- **MD076**: preserve fenced list item spacing (#788) ([2d60067](rvben/rumdl@2d60067))
- **md022**: use the same list test below a heading in check and fix (#790) ([ef926b7](rvben/rumdl@ef926b7))
- **md040**: locate the fence a list marker holds instead of assuming the indent ([6099a6c](rvben/rumdl@6099a6c))
- **md077**: keep the strict-flavor minimum as a floor under a configured indent ([cfaad2e](rvben/rumdl@cfaad2e))
- **md077**: reject a configured indent of 0 ([1ac97a3](rvben/rumdl@1ac97a3))
- **md077**: accept the indent option instead of reporting it as unknown ([cba175c](rvben/rumdl@cba175c))
- **md013**: stop exempting a complete link followed by a parenthesized aside ([722fad6](rvben/rumdl@722fad6))
- **md013**: ke… (truncated)

### v0.2.51

### Added

- **md088**: normalize quotes and dashes to ASCII (#763) ([52e9844](rvben/rumdl@52e9844))

### Fixed

- **config**: keep a file's per-file-ignores out of the workspace index it feeds ([2bb0ce7](rvben/rumdl@2bb0ce7))
- **md051**: validate cross-file link fragments for a document read from stdin ([e215c65](rvben/rumdl@e215c65))
- **md051**: report a broken fragment on a query-string destination once ([7c8390f](rvben/rumdl@7c8390f))
- **md088**: leave modifier letters and math notation alone ([56dbf0f](rvben/rumdl@56dbf0f))
- **config**: report the effective rule lists from `config get global.*` ([5db8f0c](rvben/rumdl@5db8f0c))
- **config**: answer `config get` for every key rumdl accepts ([ecce820](rvben/rumdl@ecce820))
- **md035**: publish the horizontal rule style the rule enforces ([77c8c65](rvben/rumdl@77c8c65))
- **config**: accept every config key a rule actually reads ([8ec7bba](rvben/rumdl@8ec7bba))
- **lsp**: identify documents by the same resolved path as the index ([78f4aa0](rvben/rumdl@78f4aa0))
- **lsp**: keep frontmatter values out of find-references results ([499b005](rvben/rumdl@499b005))
- **md051**: index cross-file links independently of frontmatter config ([ca7b93e](rvben/rumdl@ca7b93e))
- **lsp**: build the workspace index from t… (truncated)

### v0.2.52

### Fixed

- **md012**: report blank lines before a code block that ends the document (#791) ([e897556](rvben/rumdl@e897556))
- **rules**: treat a template shortcode tag as opaque markup ([6962184](rvben/rumdl@6962184))
- **cli**: report a piped document's findings on stdout like every other run ([47f8a50](rvben/rumdl@47f8a50))

## Downloads

| File | Platform | Checksum |
|------|----------|----------|
| [rumdl-v0.2.52-x86_64-unknown-linux-gnu.tar.gz](https://github.com/rvben/rumdl/releases/download/v0.2.52/rumdl-v0.2.52-x86_64-unknown-linux-gnu.tar.gz) | Linux x86_64 | [checksum](https://github.com/rvben/rumdl/releases/download/v0.2.52/rumdl-v0.2.52-x86_64-unknown-linux-gnu.tar.gz.sha256) |
| [rumdl-v0.2.52-x86_64-unknown-linux-musl.tar.gz](https://github.com/rvben/rumdl/releases/download/v0.2.52/rumdl-v0.2.52-x86_64-unknown-linux-musl.tar.gz) | Linux x86_64 (musl) | [checksum](https://github.com/rvben/rumdl/releases/download/v0.2.52/rumdl-v0.2.52-x86_64-unknown-linux-musl.tar.gz.sha256) |
| [rumdl-v0.2.52-aarch64-unknown-linux-gnu.tar.gz](https://github.com/rvben/rumdl/releases/download/v0.2.52/rumdl-v0.2.52-aarch64-unknown-linux-gnu.tar.gz) | Linux ARM64 | [checksum](https://github.com/rvben/rumdl/releases/download/v0.2.52/rumdl-v0.2.52-aarch64-unknown-linux-gnu.tar.gz.sha256) |
| [rumdl-v0.2.52-aarch64-unknown-linux-musl.tar.gz](https://github.com/rvben/rumdl/releases/download/v0.2.52/rumdl-v0.2.52-aarch64-unknown-linux-musl.tar.gz) | Linux ARM64 (musl) | [checksum](https://github.com/rvben/rumdl/releases/download/v0.2.52/rumdl-v0.2.52-aarch64-unknown-linux-musl.tar.gz.sha256) |
| [rumdl-v0.2.52-x86_64-apple-darwin.tar.gz](https://github.com/rvben/rumdl/releases/download/v0.2.52/rumdl-v0.2.52-x86_64-apple-darwin.tar.gz) | macOS x86_64 | [checksum](https://github.com/rvben/r… (truncated)

</details>
<details>
<summary>tombi: `1.2.6` → `1.2.7` (tombi-toml/tombi)</summary>

### v1.2.7

<!-- Release notes generated using configuration in .github/release.yml at v1.2.7 -->

## What's Changed
### 🦅 New Features
* feat(config): support per-schema strict mode by @​ya7010 in tombi-toml/tombi#2061
### 🛠️ Other Changes
* fix: improve config file load error reporting by @​ya7010 in tombi-toml/tombi#2062

**Full Changelog**: tombi-toml/tombi@v1.2.6...v1.2.7

</details>
<details>
<summary>uv: `0.12.1` → `0.12.3` (astral-sh/uv)</summary>

### 0.12.2

## Release Notes

Released on 2026-08-05.

### Python

- Add CPython 3.15.0rc1 ([#20948](astral-sh/uv#20948))
- Add CPython 3.14.7 ([#20971](astral-sh/uv#20971))

### Enhancements

- Ensure diagnostic hints end with a newline to prevent malformed terminal output ([#20959](astral-sh/uv#20959))

### Preview features

- Audit one or all installed tools with `uv tool audit` ([#20921](astral-sh/uv#20921))
- Report physically reclaimed disk space during cache cleanup with the `cache-physical-space` preview feature ([#20925](astral-sh/uv#20925))

### Configuration

- Add `UV_RUN_RLIMIT_NOFILE` to set the open-file limit for commands launched by `uv run` ([#20926](astral-sh/uv#20926))

### Performance

- Speed up `uv.lock` parsing for wheel entries ([#20881](astral-sh/uv#20881))
- Speed up `uv.lock` parsing for source distribution entries ([#20882](astral-sh/uv#20882))
- Speed up filename extraction from distribution URLs ([#20879](astral-sh/uv#20879))
- Reduce filesystem metadata lookups during bytecode compilation ([#20928](astral-sh/uv#20928))
- Reuse file metadata when building source distributions ([#20927](astral-sh/uv#20927))

### Bug fixes

- Preserve compatibility with older uv versions when recording artifact sizes in cached wheels and source distributions ([#20963](astral-sh/uv#20963))
- Avoid including workspace-root default dependency groups when syncing or exporting a selected workspace member unless explicitly requested ([#20930](astral-sh/uv#20930))

### Documentation

- Separate build and publish jobs in the GitHub Actions publishing guide ([#20946](astral-sh/uv#20946))
- Ensure the GitHub Actions publishing exampl… (truncated)

### 0.12.3

## Release Notes

Released on 2026-08-07.

### Python

- Add CPython 3.13.15 ([#20997](astral-sh/uv#20997))

### Preview features

- Add `--output-format` to select automatic, human-readable, or raw-byte output for `uv cache size` ([#20992](astral-sh/uv#20992))
- Preserve JSON output from `uv workspace metadata --quiet` while suppressing diagnostics ([#20991](astral-sh/uv#20991))
- Reduce memory usage for large workspaces by streaming `uv workspace metadata` JSON output ([#20990](astral-sh/uv#20990))

### Performance

- Reduce Linux startup latency by initializing the workspace cache before spawning another thread ([#20989](astral-sh/uv#20989))
- Reuse compiled workspace exclusion patterns during workspace discovery ([#20988](astral-sh/uv#20988))
- Speed up conflict-heavy resolutions by avoiding materialized range complements ([#20982](astral-sh/uv#20982))
- Avoid slow procfs reads during Python interpreter discovery on Linux ([#20987](astral-sh/uv#20987))

### Documentation

- Add PEP 740 attestations to the GitHub Actions publishing example ([#20986](astral-sh/uv#20986))
- Restrict the GitHub Actions publishing example to Python version tags ([#20973](astral-sh/uv#20973))
- Correct `--python-pin` to `--pin-python` in the `uv init --bare` example ([#20876](astral-sh/uv#20876))

## Install uv 0.12.3

### Install prebuilt binaries via shell script

```sh
curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/uv/releases/download/0.12.3/uv-installer.sh | sh
```

### Install prebuilt binaries via powershell script

```sh
powershell -ExecutionPolicy Bypass -c "irm https://releases.astral.sh/github/uv/releases/download/0.12.3/uv-installer.ps1 | iex"
```

## Download uv 0.12.3

|  Fi… (truncated)

</details>

</details>

Modified files:
- `.mise.toml`
jkleinsc pushed a commit to electron/electron that referenced this pull request Oct 29, 2026
Node.js 26 adds an experimental virtual file system that fs functions
consult (vfsState.handlers) before the real one. The asar wrapper walks
recursive readdir itself and never asked it, so with a VFS mounted
fs.readdir(..., { recursive: true }) and its sync and promise forms
listed the real path behind the mount (parallel/test-vfs-reserved-root,
parallel/test-vfs-zip-provider-readdir-recursive failed with ENOTDIR).
Ask the VFS first, as Node does.

Ref: nodejs/node#63537

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Vf2yMuJ7XxvNktpKuiMPzU
MarshallOfSound pushed a commit to electron/electron that referenced this pull request Oct 30, 2026
* chore: bump node in DEPS to v26.12.1

* chore: bump node in DEPS to v26.13.0

* fix(patch): build: add simdutf dir to include path in GN build

Keep upstream's simdutf include dir in the node_js2c include_dirs and
add "tools" next to it. The patch's FixedArray::Get(context, i) change
in node_builtins.cc is no longer needed: upstream made the same change
in nodejs/node#61898.

Ref: nodejs/node#65382

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Vf2yMuJ7XxvNktpKuiMPzU

* fix(patch): vfs: integrate with CJS and ESM module loaders

Upstream moved the native legacyMainResolve call from esm/resolve.js
into the loaderMethods table in internal/modules/helpers.js, so pass the
asar-aware fileExists callback from there instead.

Ref: nodejs/node#63653

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Vf2yMuJ7XxvNktpKuiMPzU

* fix(patch): src: let embedders supply a builtin code cache without a snapshot

BuiltinLoader::RefreshCodeCache() now merges with insert_or_assign
upstream, so drop that hunk from the patch.

Ref: nodejs/node#65352

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Vf2yMuJ7XxvNktpKuiMPzU

* fix(patch): src: move import.meta initializer to native land

PathHelpersLazyGetter moved from node_modules.cc to module_wrap.cc and
gained a sibling ImportMetaResolveLazyGetter; switch both to Holder().
Also follow the DatabaseSyncLimits -> DatabaseLimits rename in
node_sqlite.cc (nodejs/node#65988) and the
Null(isolate) cleanup in node_constants.cc
(nodejs/node#59805).

Ref: nodejs/node#60603

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Vf2yMuJ7XxvNktpKuiMPzU

* fix(patch): src: fix usage of deprecated V8 API

Upstream switched to Get/SetContinuationPreservedEmbedderDataV2(), which
Chromium's V8 marks deprecated in favor of the unsuffixed names. Use the
unsuffixed getter and setter.

Ref: nodejs/node#60174

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Vf2yMuJ7XxvNktpKuiMPzU

* fix(patch): src: rename legacy trace event headers

The TRACING_CATEGORY_NODE* macros moved from node_internals.h to
tracing/trace_event.h, so define NODE_TRACE_CATEGORY_ENABLED there.
Agent::CreateDefault() picks the legacy agent again when V8_USE_PERFETTO
is unset (nodejs/node#64053), so only the
Perfetto branch is gated on NODE_USE_PERFETTO_SDK.

node.gyp now lists the Perfetto sources in
node_tracing_perfetto_sources. Add them, with V8's tracing target and
config, to the GN libnode target. The removed perfetto backport patch
used to carry that wiring.

Ref: nodejs/node#64565

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Vf2yMuJ7XxvNktpKuiMPzU

* fix(patch): src: let embedders exempt linked bindings from the addon permission

Upstream added EnvironmentFlags::kNoAddonPermissionForLinkedBindings
around the same check. Keep the electron_* exemption alongside it and
note in the patch description that the patch can be dropped once
Electron sets the new flag.

Ref: nodejs/node#66067

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Vf2yMuJ7XxvNktpKuiMPzU

* chore: remove upstreamed patches

* support_v8_sandboxed_pointers.patch
  Ref: nodejs/node#62237
* refactor_attach_cppgc_heap_on_v8_isolate_creation.patch
  Ref: nodejs/node#58070
* test_accomodate_v8_thenable_stack_trace_change_in_snapshot.patch
  Ref: nodejs/node#59805
* api_remove_deprecated_getisolate.patch
  Ref: nodejs/node#59805
  Ref: nodejs/node#60223
* api_delete_deprecated_fields_on_v8_isolate.patch
  Ref: nodejs/node#60488
* api_promote_deprecation_of_v8_context_and_v8_object_api_methods.patch
  Ref: nodejs/node#60602
* src_refactor_module_wrap_cc_to_update_fixedarray_get_params.patch
  Ref: nodejs/node#61898
* src_refactor_wasmstreaming_finish_to_accept_a_callback.patch
  Ref: nodejs/node#61898
* src_stop_using_v8_propertycallbackinfo_t_this.patch
  Ref: nodejs/node#61898
* fix_add_externalpointertypetag_to_v8_external_api_calls.patch
  Ref: nodejs/node#61898
* src_stop_using_removed_v8_promise_reject_events.patch
  Ref: nodejs/node#62336
* src_backport_the_perfetto_trace_agent.patch
  Ref: nodejs/node#64565
  Ref: nodejs/node#64721
* test_account_for_libc_rm_error_on_electron_linux.patch
  Ref: nodejs/node#66065
* fix_do_not_pass_removed_jspi_v8_flag.patch
  Ref: nodejs/node#60014
* test_drop_removed_wasm_rab_integration_flag.patch
  The v26 version of nodejs/node#65845 never
  added the flag.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Vf2yMuJ7XxvNktpKuiMPzU

* chore: update patches (trivial only)

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Vf2yMuJ7XxvNktpKuiMPzU

* chore: bump @types/node to v26

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Vf2yMuJ7XxvNktpKuiMPzU

* chore: update filenames.auto.gni

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Vf2yMuJ7XxvNktpKuiMPzU

* chore: remove deleted specs

Upstream deleted parallel/test-promise-swallowed-event and
parallel/test-warn-multipleResolves when the multipleResolves event
reached end-of-life.

Ref: nodejs/node#58707

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Vf2yMuJ7XxvNktpKuiMPzU

* test: clear crash dumps with fs.rmSync instead of recursive rmdir

Node.js v25 moved the fs.rmdir recursive option to end-of-life, so
fs.rmdirSync(dir, { recursive: true }) now throws and @types/node v26
no longer accepts the option.

Ref: nodejs/node#58616

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Vf2yMuJ7XxvNktpKuiMPzU

* test: listen on IncomingMessage unions through EventEmitter

With @types/node v26, http.IncomingMessage declares typed `on`
overloads that do not unify with Electron.IncomingMessage's, so
collectStreamBodyBuffer() no longer type-checks when calling `on` on
the union.

Ref: Unable to locate reference

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Vf2yMuJ7XxvNktpKuiMPzU

* fix: pass an ArrayBuffer-backed view to subtle.digest in asar wrapper

@types/node v26 types webcrypto's BufferSource as views over an
ArrayBuffer only, so a Uint8Array<ArrayBufferLike> no longer
type-checks. Archive reads never use a SharedArrayBuffer, so narrow the
type at the call site.

Ref: Unable to locate reference

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Vf2yMuJ7XxvNktpKuiMPzU

* node#64565: src: rename legacy trace event headers

Node.js renamed src/tracing/trace_event_common.h to trace_event_legacy.h
and moved the legacy trace macros out of trace_event.h into
trace_event_legacy_inl.h, so feed both to electron_generate_node_defines
instead of the removed header. The generated push/undef set matches the
previous one apart from header guards, NODE_TRACE_CATEGORY_ENABLED and
INTERNAL_DECLARE_SET_TRACE_VALUE_INT, which Node.js no longer defines.

Ref: nodejs/node#64565

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Vf2yMuJ7XxvNktpKuiMPzU

* fix(patch): src: add perfetto trace agent

Upstream's trace_event_perfetto.h includes the amalgamated "perfetto.h"
SDK header, which Chromium's Perfetto does not provide, so libnode fails
to compile. Include the Perfetto public headers Chromium ships instead
(as the removed backport patch did), add the tracing/trace_config
includes agent_perfetto.h relied on, and skip Node's TrackEvent category
definitions when Chromium's built-in categories are already in scope.

Ref: nodejs/node#64565

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Vf2yMuJ7XxvNktpKuiMPzU

* fix(patch): src: handle indexed properties in `process.env`

Upstream added indexed interceptors for process.env. Migrate the new
EnvSetterIndexed and EnvDefinerIndexed callbacks to
PropertyCallbackInfo<Boolean> like their named counterparts, since
Chromium's V8 only accepts the Boolean-returning indexed setter and
definer callbacks.

Ref: nodejs/node#60826

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Vf2yMuJ7XxvNktpKuiMPzU

* test: read the whole heap snapshot stream

Since Node.js 26, readable.read() returns one buffered chunk at a time
instead of concatenating everything buffered, so takeHeapSnapshot()
parsed only the first 64 KiB of the snapshot. Read readableLength bytes,
as upstream test/common/heap.js now does.

Ref: nodejs/node#60441

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Vf2yMuJ7XxvNktpKuiMPzU

* test: use --trace-warnings in the node-options-parsing crash case

Node.js 26 throws ERR_MISSING_OPTION('--permission') when a boolean
permission flag such as --allow-addons is set without --permission
(previously only the fs flags were checked), so the utility process in
this fixture exited before reaching options.js. Repeat --trace-warnings
instead; the case still checks that disallowed NODE_OPTIONS are stripped
from a list with repeated options.

Ref: nodejs/node#62072

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Vf2yMuJ7XxvNktpKuiMPzU

* fix(patch): restore user timing trace events

The usertiming.js hunk that emits node.perf.usertiming trace events for
performance.mark() and performance.measure() lived in the perfetto
backport patch, which was removed as upstreamed. Upstream Node.js never
had it (Electron added it in #50591), so carry it in
fix_use_embedder_perfetto_client_when_available.patch.

Ref: #50591

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Vf2yMuJ7XxvNktpKuiMPzU

* test: trigger the V8 sandbox fatal error from V8 directly

Since Node.js 26, node::Buffer::New() copies memory allocated outside
the V8 sandbox into it instead of handing it to
v8::ArrayBuffer::NewBackingStore(), so the external-ab addon no longer
crashed the utility process and "emits 'error' when fatal error is
triggered from V8" timed out. Call NewBackingStore() from the addon so
the same v8_ArrayBuffer_NewBackingStore fatal error is still raised.

Ref: nodejs/node#62237

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Vf2yMuJ7XxvNktpKuiMPzU

* test: delete directories with rm instead of recursive rmdir

Node.js 26 removed the recursive option of fs.rmdir(), fs.rmdirSync()
and fsPromises.rmdir() (DEP0147), so they now throw
ERR_INVALID_ARG_VALUE. Use rmSync() and promises.rm(), and put an
archive in the directory so the tests delete what their titles say.

Ref: nodejs/node#58616

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Vf2yMuJ7XxvNktpKuiMPzU

* node#64894: worker: add support for Web Workers

Node.js 26 adds a Web Worker API and its pre-execution deletes
globalThis.Worker unless --experimental-web-worker is set, without
checking noBrowserGlobals, so renderers and web workers with Node
integration lost Blink's Worker. Pass the flag in those processes, as
is already done for --experimental-eventsource; Node's own Worker is not
installed under kNoBrowserGlobals.

Ref: nodejs/node#64894

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Vf2yMuJ7XxvNktpKuiMPzU

* node#61803: module: remove --experimental-transform-types

Node.js 26 removed the flag, so passing it now fails with "bad option"
(exit code 9). Stop forwarding it to Node.js, drop it from the
command-line switch docs, document the removal as a 46.0 breaking
change, and remove the spec and fixture that exercised it. The spec
that checks TypeScript-only syntax is not transformed stays.

Ref: nodejs/node#61803

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Vf2yMuJ7XxvNktpKuiMPzU

* node#65589: src: disable V8 external memory reasonable size check

Node.js now passes --external-memory-max-reasonable-size=0 to V8 in
every process that initializes it, which changes FlagList::Hash() and
so the code-cache key. Add the flag to the build-time js2c code cache
flavors that initialize Node.js and to electron_xcache's default flags,
so their caches keep being accepted (xcache.spec.ts failed on the flag
hash).

Ref: nodejs/node#65589

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Vf2yMuJ7XxvNktpKuiMPzU

* fix: route Node.js 26's one-shot fs jobs through the asar wrapper

Node.js 26 writes files (fs.writeFile, fs.appendFile and their
fsPromises versions) with a native WriteFileJob, and copies directory
trees for fs.cp() / fsPromises.cp() with a native CpDirJob, instead of
going through binding.open() and the fs.promises walk the asar wrapper
already handles. Writes into archives therefore failed with ENOTDIR
instead of EACCES (and missed unpacked entries), and fs.cp() of an
archive directory failed with ENOTDIR.

Give binding.WriteFileJob the same archive checks as open(), wrap
fs.writeFile() for archive paths since lib/fs.js captured the native
job at startup, and copy archive trees for CpDirJob with the walk
cpSync() already uses, which now also stamps directories with
preserveTimestamps like the native walk.

Ref: nodejs/node#65489
Ref: nodejs/node#65488

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Vf2yMuJ7XxvNktpKuiMPzU

* fix(patch): do not leak NodePlatform's default TracingController

The NodePlatform hunk that owns the v8::TracingController it creates
when the embedder passes none lived in the perfetto backport patch,
which was removed as upstreamed, but upstream still allocates it with a
bare new. With the perfetto agent, ELECTRON_RUN_AS_NODE passes no
controller, so LeakSanitizer failed every run-as-node spec on ASan
builds. Carry the hunk in
fix_use_embedder_perfetto_client_when_available.patch.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Vf2yMuJ7XxvNktpKuiMPzU

* fix: keep fsPromises.stat() and lstat() native outside archives

The asar wrapper replaced fsPromises.stat() and fsPromises.lstat() with
promisified callback versions for every path, so they ran as callback
requests (FSREQCALLBACK) instead of fsPromises' own. Node.js 26's
fsPromises.cp() checks its paths with them before handing the copy to a
native job, and parallel/test-fs-cp-async-destination-appears-late
tells the two apart. Use the wrapper only for paths inside archives.

Ref: nodejs/node#65488

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Vf2yMuJ7XxvNktpKuiMPzU

* fix: match Node.js 26 recursive readdir in the asar wrapper

Node.js 26 accepts Buffer paths for recursive readdir, keeps parentPath
a Buffer for them and for the 'buffer' encoding, and walks the tree
breadth-first, following links to directories without stat()ing every
entry. The asar wrapper's own walks (which also descend into archives)
broke on Buffer paths and differed in order and parentPath, failing the
new parallel/test-fs-readdir-recursive-* tests. Replace the three walks
with one breadth-first walk shaped like Node's, which still lists and
descends into archives as directories, and lets errors from any
directory reach the caller.

Ref: nodejs/node#65487

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Vf2yMuJ7XxvNktpKuiMPzU

* node#66138: src: add --process-timeout=N

Node.js starts the --process-timeout watchdog in
NodeMainInstance::Run(), which ELECTRON_RUN_AS_NODE does not use, so
the option was accepted but never applied: parallel/test-process-timeout-*
failed, and the fixtures that block the main thread hung the Node.js
test job until it was cancelled. Start and stop the watchdog around the
event loop in NodeMain() the same way.

Ref: nodejs/node#66138

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Vf2yMuJ7XxvNktpKuiMPzU

* test: close the FileHandle in the stale asar descriptor spec

Node.js 26 made closing a FileHandle on garbage collection an error
(DEP0137 end-of-life). The 'handle' variant of "does not capture a
descriptor number that was closed behind its back" dropped its
FileHandle, so the renderer running the asar specs later died with an
uncaught ERR_INVALID_STATE and every remaining asar spec failed with
"Render frame was disposed". Close the handle like the other variants
close their descriptors.

Ref: nodejs/node#58536

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Vf2yMuJ7XxvNktpKuiMPzU

* fix: allow ArrayBuffers above 2 GiB in Node.js-enabled isolates

Node.js 26 allocates Buffer.allocUnsafe(), Buffer.allocUnsafeSlow() and
the copies made by AdoptIntoBackingStore() through the isolate's
ArrayBuffer::Allocator (nodejs/node#61480, nodejs/node#62237). Electron's
sandboxed-pointers patch for Node.js 24 sent those through
ArrayBuffer::Allocator::NewDefaultAllocator() instead, which reaches
Electron's in-sandbox allocator, and that serves requests beyond
PartitionAlloc's single-allocation cap (2 GiB - 2 MiB) from sandbox
pages. The isolates of the browser process, the utility-process node
service and ELECTRON_RUN_AS_NODE use gin's ArrayBufferAllocator, which
has no such fallback, so with Node.js 26 a Buffer.allocUnsafe() of more
than 2 GiB - 2 MiB in those processes failed with
ERR_MEMORY_ALLOCATION_FAILED, where Electron 45 and 46 allowed up to
32 GiB - 1 (parallel/test-fs-write-buffer-large).

Give those isolates an allocator that delegates to gin's partition up to
the cap and serves larger requests from sandbox pages, sharing the page
bookkeeping with the in-sandbox allocator. Buffer.alloc() and
new ArrayBuffer() above the cap now work there as well. The page map is
only locked while a page allocation is live. Renderers are unaffected:
Blink's isolate allocator already allows giga allocations.

Ref: nodejs/node#61480

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Vf2yMuJ7XxvNktpKuiMPzU

* fix: include node_watchdog.h only where --process-timeout is wired

node_watchdog.h chooses between its POSIX and Windows members with
Node's __POSIX__ define, which Node's own targets set but Electron's do
not, so including it from node_includes.h broke every electron_lib
source on Linux ("unknown type name 'BOOL'"). Include it in node_main.cc
alone, with __POSIX__ set around it on POSIX so the class matches Node's
own build.

Ref: nodejs/node#66138

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Vf2yMuJ7XxvNktpKuiMPzU

* fix: let Node.js 26's virtual file system answer recursive readdir

Node.js 26 adds an experimental virtual file system that fs functions
consult (vfsState.handlers) before the real one. The asar wrapper walks
recursive readdir itself and never asked it, so with a VFS mounted
fs.readdir(..., { recursive: true }) and its sync and promise forms
listed the real path behind the mount (parallel/test-vfs-reserved-root,
parallel/test-vfs-zip-provider-readdir-recursive failed with ENOTDIR).
Ask the VFS first, as Node does.

Ref: nodejs/node#63537

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Vf2yMuJ7XxvNktpKuiMPzU

* fix: do not log terminated Electron init scripts as errors

CompileAndCall() logged an error whenever running one of Electron's
bundled init scripts threw, including when execution was terminated
because the environment was being torn down. A Worker that is stopped,
or whose process exits, while it is still bootstrapping is not an
error. On Node.js 26 the unref()'d Worker spawned by
module-hooks/test-async-loader-hooks-with-worker-permission-allowed
reaches that point while node_init runs, and the log line broke the
test's empty-stderr check. Only log real exceptions.

Ref: Unable to locate reference

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Vf2yMuJ7XxvNktpKuiMPzU

* fix(patch): expect the Wasm Global setter WPT to pass with Chromium V8

Chromium's V8 passes "Calling setter without argument" in the Wasm
jsapi WPT global/value-get-set.any.js, which Node's own V8 still fails
and lists as an expected failure, so the run failed on an unexpected
pass.

Ref: Unable to locate reference

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Vf2yMuJ7XxvNktpKuiMPzU

* fix: honor --no-node-snapshot under ELECTRON_RUN_AS_NODE

ELECTRON_RUN_AS_NODE accepted --no-node-snapshot but always created its
isolate from the embedded Node startup snapshot, and Node worker
threads inherit that snapshot from their parent. Since Node.js 26 a
worker deserializes the whole bootstrapped context from it, so
parallel/test-worker-nearheaplimit-deadlock, which passes
--no-node-snapshot so that its 0 MB-heap worker does not run out of
memory during that deserialization, crashed with SIGSEGV. Skip the
snapshot when Node's options turn it off, as node::Start() does; the
process then boots from the V8 context snapshot like a build without a
Node snapshot. The browser process and the node service parse Node's
options only after creating their isolate, so they are unaffected.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Vf2yMuJ7XxvNktpKuiMPzU

* build: fetch Perfetto trace_processor_shell for the Node.js tests

nodejs/node#66068 (test: enable trace_events tests with perfetto) moved
the trace_events tests from test/parallel into a new test/trace_events
suite. When Node.js is built with Perfetto (process.config.variables
.v8_use_perfetto, which Electron's build sets), those tests write binary
.pftrace files and convert them back to JSON with Perfetto's
trace_processor_shell, through test/common/trace_events.js. Without the
tool, all 17 trace_events/* tests in nn-test fail with
"trace_processor_shell is missing".

The same PR added tools/perfetto/get_trace_processor, which upstream's
Makefile and CI use to fetch it. Run that script in the Node.js test job.
It downloads the Perfetto release matching the vendored
deps/perfetto/VERSION (v58.2) from Perfetto's GitHub releases to
tools/perfetto/trace_processor_shell, which is the default path the test
helper resolves, so TRACE_PROCESSOR_SHELL_PATH is not needed. Cache the
binary keyed on that VERSION file. Upstream pins only the version, not a
checksum.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Vf2yMuJ7XxvNktpKuiMPzU

* test: disable Node.js source phase import and process-timeout report tests

Electron always passes --no-js-source-phase-imports. In renderers Blink
owns that V8 flag and freezes it before Node.js starts, and the other
process types match it, so the flag is consistent across processes and
the embedded code cache, which is keyed on V8's flag hash, stays valid.
nodejs/node#60364 made Node.js honour that opt-out instead of always
enabling the flag. The es-module/test-esm-wasm-*source-phase* tests are
already disabled for the same reason. Node.js 26 brings more tests that
need source phase imports:

- es-module/test-esm-wasm-jitless (nodejs/node#66533) calls
  import.source() and fails with "SyntaxError: Unexpected identifier
  'source'".
- The wasm/jsapi WPT suite, test/wpt/test-wasm-jsapi.mjs
  (nodejs/node#59034), is new to Electron with this upgrade. Its
  esm-integration/source-phase*.tentative cases use import.source() and
  fail with the same SyntaxError. Its module/moduleSource.tentative cases
  expect the %AbstractModuleSource% intrinsic, which V8 only installs
  when the flag is on. Each case runs as an .any.html and an .any.worker.html
  variant, so that is 8 entries.

nodejs/node#66138 added --process-timeout and
report/test-report-process-timeout. nodejs/node#66428 split out
report/test-report-process-timeout-worker. Both validate the generated
report with test/common/report.js, which expects
header.componentVersions to equal process.versions. In Electron,
process.versions also has chrome and electron, so the comparison fails.
The other report tests that use this helper are already disabled for
the same reason. The process timeout itself works, and both tests get
as far as the report check.

The WPT cases are listed as wpt/<test file>/<case id>, which is how
tools/test.py names them and matches --skip-tests. Teach
--validateDisabled to check the test file for these entries.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Vf2yMuJ7XxvNktpKuiMPzU

* test: resolve V8's NewBackingStore by Electron's export name on Windows

The external-ab addon now calls v8::ArrayBuffer::NewBackingStore()
itself, but on Windows it is built with MSVC's standard library while
Electron is built with Chromium's libc++, and MSVC mangles return types
into symbol names. electron.exe exports the function as returning
std::__Cr::unique_ptr, so the addon's import of the std::unique_ptr
variant never resolved, the utility process died without a V8 fatal
error and "emits 'error' when fatal error is triggered from V8" timed
out on windows-x64. Look the function up by Electron's exported name
there instead.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Vf2yMuJ7XxvNktpKuiMPzU

* test: only reference std-free V8 exports from the external-ab addon

On macOS and Linux the addon is built against a different libc++ ABI
namespace than Electron's std::__Cr, so v8::ArrayBuffer::New(isolate,
std::shared_ptr<BackingStore>) is an import that cannot bind. It only
went unnoticed because NewBackingStore() raises the fatal error first.
Stop after NewBackingStore(), whose mangled name has no standard
library types, and throw if it ever returns, as on Windows.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Vf2yMuJ7XxvNktpKuiMPzU

* Revert "build: fetch Perfetto trace_processor_shell for the Node.js tests"

This reverts commit 8920a7c.

Node.js uses trace_processor_shell only to read back the trace file that
a process started with --trace-event-categories writes. Electron never
writes that file: Chromium owns tracing, and Electron does not start
Node.js's file-based tracing agent. Every trace_events/* test fails
before it reaches trace_processor_shell, because no trace file exists
or, in test-trace-events-api, because getEnabledCategories() is
undefined in the child. Those tests are disabled again in the next
commit, so no Node.js test needs trace_processor_shell, and downloading
it would only add a network fetch to the job.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Vf2yMuJ7XxvNktpKuiMPzU

* test: disable the Node.js trace_events tests in their new directory

nodejs/node#66068 (test: enable trace_events tests with perfetto) moved
17 test-trace-events-* tests out of test/parallel into a new
test/trace_events suite. That took them out from under Electron's
"parallel/test-trace-events" entry, which --skip-tests matches as a
substring. Electron has never run these tests. They were disabled one by
one when Electron started running the Node.js tests (1d06f67) and
folded into the parallel/ prefix in #49467.

They start Node.js with --trace-event-categories and read back the trace
file it writes. Electron does not start Node.js's file-based tracing
agent, because Chromium owns tracing, so no trace file is ever written.
In nn-test, all 17 fail on a missing trace file, and
test-trace-events-api also finds getEnabledCategories() undefined in its
child.

Add the matching "trace_events/test-trace-events" prefix. It covers all
17 files in test/trace_events. Keep the parallel/ entry, which still
matches the 13 test-trace-events-* tests that stayed in test/parallel.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Vf2yMuJ7XxvNktpKuiMPzU

* fix: copy directory trees out of archives without blocking fs.cp()

nodejs/node#65488 (fs: copy directory trees for fs.cp() on the thread
pool) made fs.cp() and fsPromises.cp() copy a new destination directory
with a native CpDirJob. The job walks the tree on the thread pool and
calls ondone once. Electron's override for archive sources ran the
synchronous fs.cpSync() walk in a single process.nextTick, so an
asynchronous cp of a directory out of an archive blocked the event loop
until the whole tree had been copied.

Give the job an asynchronous version of the walk. It goes through the
fs.promises overrides, so packed files use the existing asynchronous
copyFile path, and it keeps the same ordering, force/errorOnExist,
symlink and preserveTimestamps handling and errors as the sync walk.
The job still reports through ondone exactly once. fs.cpSync() keeps
the synchronous walk.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Vf2yMuJ7XxvNktpKuiMPzU

* test: trigger the utility process V8 fatal error from the testing binding

The utilityProcess 'error' event from #43774 reports any V8 fatal error.
Its spec raised one with the external-ab native addon, which handed V8
memory from outside the sandbox. Node.js 26 makes every Buffer site
sandbox compatible, so that no longer happens through Node.js APIs. The
earlier commits on this branch made the addon call V8 directly, and
that needed ABI workarounds on Windows and for libc++.

As Deepak suggested in review, drop the addon and its workspace entries.
Add triggerV8FatalError() to the electron_common_testing binding, which
is only built when DCHECKs are on. It fails a V8 API check by setting an
internal field on a plain object, so it does not depend on the V8
sandbox. The spec keeps #43774's checks on the event type, location and
report trigger, also checks the report's event message, and now runs
wherever the testing binding exists, including Windows on Arm.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Vf2yMuJ7XxvNktpKuiMPzU

* test: wait for the utility process exit only after its 'error' event

events.once(emitter, 'exit') also listens for 'error' and rejects with
its first argument. The previous commit started waiting for 'exit'
before the 'error' event arrived, so the utility process's
'FatalError' rejected that promise and the spec failed with
"Unknown Error: FatalError". Wait for 'exit' after 'error' has been
received, as the spec from #43774 did.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Vf2yMuJ7XxvNktpKuiMPzU

* refactor: use one d8-style PartitionAlloc allocator inside the V8 sandbox

Following Deepak's review, replace the sandbox-page fallback added for
nodejs/node#61480 and the older InSandboxAllocator with a single
PAInSandboxAllocator, modelled on d8's.

nodejs/node#61480 moved Buffer.allocUnsafe() onto the isolate's
ArrayBuffer allocator. gin's partition caps a single allocation at
partition_alloc::MaxAllocationSize() (2 GiB - 2 MiB), so Buffers above
that size failed. The previous fix served those requests from whole
sandbox pages and tracked them in a separate map.

PAInSandboxAllocator owns a PartitionAlloc partition in the configurable
pool, which gin::V8Initializer::Initialize() places inside the V8
sandbox. The partition is created lazily, after the pool exists. It has
allow_giga_allocations set and allocates with kAllowGigaAllocations,
along with kNoOverrideHooks and kNoMemoryToolOverride, as gin does. A
single ArrayBuffer can therefore reach MaxGigaAllocationSize()
(16 GiB - 2 MiB on 64-bit) without the page fallback. It is both the
ArrayBuffer allocator for JavascriptEnvironment isolates and V8's
in-sandbox allocator, so Node.js worker_threads isolates use it through
NewDefaultAllocator(). Builds without the V8 sandbox keep gin's
allocator.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Vf2yMuJ7XxvNktpKuiMPzU

* fix: reject instead of throwing in asar fs.promises.stat/lstat wrappers

The new fs.promises.stat/lstat wrappers call splitPath() before deciding
whether to use fsPromises' own implementation. For a URL, splitPath()
runs getValidatedPath(), which throws for a non-file: URL, so the error
escaped synchronously instead of rejecting the returned promise as it did
with util.promisify(fs.stat) on main and as Node's fsPromises does. Make
the wrappers async so every input error rejects, and add a spec for it.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Vf2yMuJ7XxvNktpKuiMPzU

---------

Co-authored-by: electron-roller[bot] <84116207+electron-roller[bot]@users.noreply.github.com>
Co-authored-by: Claude <noreply@anthropic.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

author ready PRs with CI started, the required approvals, and no outstanding review comments. lib / src Issues and PRs involving general changes in the lib/ or src/ directories. semver-minor PRs that contain new features and should be released in the next minor version.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants