2026-08-05, Version 26.7.0 (Current) - #65027

This reverts commit a44fca5.

PR-URL: #64663
Reviewed-By: Antoine du Hamel <[email protected]>
Reviewed-By: Tim Perry <[email protected]>
Reviewed-By: Ethan Arrowood <[email protected]>

Cut several sources of per-stream/per-request overhead on the hot
path:

- Track 'priority'/'frameError' stream listeners by overriding the
  EventEmitter methods on Http2Stream instead of subscribing to
  'newListener'/'removeListener', which made every listener add and
  remove on every stream emit an extra tracking event.
- Replace the per-call SafeSet and sensitive-header mapping in
  buildNgHeaderString with a lazily allocated array and an
  empty-array fast path, and skip the HTTP token regex and
  connection-specific header checks for well-known single-value
  header names.
- Replace per-call closures with shared named handlers in
  onStreamClose, afterShutdown and Http2Stream._destroy.
- Skip the pendingStreams Set add/delete for streams that are
  created with their native handle already available (all server
  streams).
- Hoist the per-request onStreamTimeout closure factories in the
  compat layer to module-level handlers, and avoid a once() wrapper
  allocation per server stream.

h2load, 1 KiB response payload, -c 4 -m 100, mean of 6 alternating
runs: core API 60.2k -> 69.3k req/s (+15%), compat API 43.6k ->
46.2k req/s (+5.9%).

Signed-off-by: Matteo Collina <[email protected]>
PR-URL: #64265
Backport-PR-URL: #64663
Reviewed-By: Antoine du Hamel <[email protected]>
Reviewed-By: Tim Perry <[email protected]>
Reviewed-By: Ethan Arrowood <[email protected]>

Every _write()/_writev() on an Http2Stream allocated four closures
and an anonymous nextTick callback to coordinate the write callback
with the end-of-stream check. Since the stream machinery dispatches
at most one write at a time, that coordination state can live on the
stream's kState object instead, with shared named functions for the
end check and completion logic.

When trailers are pending the writable side cannot be shut down
early anyway, so the end-of-stream check tick is now skipped
entirely for those writes.

Also pre-initialize the kState fields that used to be added
dynamically (shutdownWritableCalled, fd) so hot-path stores no
longer transition the object shape.

h2load, 1 KiB response payload, -c 4 -m 100, mean of 6 alternating
runs vs main: core API 61.0k -> 70.7k req/s (+15.9% cumulative),
compat API 43.7k -> 50.4k req/s (+15.3% cumulative).

Signed-off-by: Matteo Collina <[email protected]>
PR-URL: #64265
Backport-PR-URL: #64663
Reviewed-By: Antoine du Hamel <[email protected]>
Reviewed-By: Tim Perry <[email protected]>
Reviewed-By: Ethan Arrowood <[email protected]>

respond() copied the user-provided options object on every call just
so it could normalize and locally flip options.endStream, and
prepareResponseHeadersObject() then looked the :status and date
fields up again on the dictionary-mode null-prototype headers copy
it had just built. Use a local variable for endStream and pick up
:status/date while copying the headers instead.

No measurable throughput change on its own; this removes an object
clone and several dictionary-mode property lookups per response.

Signed-off-by: Matteo Collina <[email protected]>
PR-URL: #64265
Backport-PR-URL: #64663
Reviewed-By: Antoine du Hamel <[email protected]>
Reviewed-By: Tim Perry <[email protected]>
Reviewed-By: Ethan Arrowood <[email protected]>

Fixes: #64598
Signed-off-by: islandryu <[email protected]>
PR-URL: #64599
Reviewed-By: James M Snell <[email protected]>
Reviewed-By: Luigi Pinca <[email protected]>

Every string-named JavaScript channel consumed an entry in the fixed
native subscriber array. Creating more than 1,024 channels triggered a
CHECK and terminated the process.

Allocate slots only for native publishers and grow the aliased buffer
when it fills. Refresh the JavaScript view after resizing and preserve
the capacity in snapshots.

Signed-off-by: Stephen Belanger <[email protected]>
PR-URL: #64497
Reviewed-By: Rafael Gonzaga <[email protected]>
Reviewed-By: Gerhard Stöbich <[email protected]>
Reviewed-By: James M Snell <[email protected]>

Validate narrow integer and 64-bit BigInt arguments before entering
the Fast API trampoline. This prevents out-of-range values from being
silently truncated or wrapped and matches the generic FFI path.

Signed-off-by: Kamat, Trivikram <[email protected]>
Assisted-by: openai:gpt-5.6-sol
PR-URL: #64614
Fixes: #64613
Reviewed-By: Paolo Insogna <[email protected]>
Reviewed-By: Matteo Collina <[email protected]>

Normalize bool to kUint8 when creating Fast API metadata. This keeps
optimized calls consistent with generic FFI behavior, including numeric
return values and rejection of JavaScript Boolean values.

Signed-off-by: Kamat, Trivikram <[email protected]>
Assisted-by: openai:gpt-5.6-sol
PR-URL: #64527
Fixes: #64526
Reviewed-By: Paolo Insogna <[email protected]>

When sqlite3_exec() or sqlite3changeset_apply() call JavaScript
callbacks (user-defined functions, conflict handlers, or filter
callbacks), the DatabaseSync object could be garbage-collected
if the JavaScript code drops all references to it. Both methods
only held a raw DatabaseSync* pointer on the C++ stack, which
V8 GC does not track.

Add a BaseObjectPtr<DatabaseSync> guard that keeps the database
alive for the duration of these SQLite API calls, preventing a
use-after-free when the JavaScript callback triggers GC.

Signed-off-by: Matteo Collina <[email protected]>
PR-URL: #64535
Reviewed-By: Edy Silva <[email protected]>
Reviewed-By: Stephen Belanger <[email protected]>
Reviewed-By: James M Snell <[email protected]>
Reviewed-By: René <[email protected]>

Cache temporary string conversion buffers by wrapper and active call
depth. This prevents nested FFI calls from overwriting or replacing
buffers still in use by an outer native call.

Signed-off-by: Kamat, Trivikram <[email protected]>
Assisted-by: openai:gpt-5.6-sol
PR-URL: #64551
Fixes: #64550
Reviewed-By: Paolo Insogna <[email protected]>
Reviewed-By: Matteo Collina <[email protected]>

`http.request({ highWaterMark })` passes the value to the TCP socket
via createConnection() but does not set it on the OutgoingMessage
internal kHighWaterMark.  OutgoingMessage._writeRaw() has two mutually
exclusive write paths:

  Path A (socket connected): conn.write() — uses socket HWM ✓
  Path B (no socket yet):    outputSize < this[kHighWaterMark] — uses
                             OutgoingMessage own default (64 KB) ✗

Because the OutgoingMessage constructor already accepts
options.highWaterMark, the fix is to set kHighWaterMark from the
user options after they are parsed in the ClientRequest constructor.

This resolves two symptoms:

  1. write() returning the wrong boolean for pre-socket writes (the
     user highWaterMark was silently ignored on all Node versions).

  2. A deadlock on Node >= 24.16.0 where the incorrect false return
     sets kNeedDrain, but drain never fires because the socket was
     never backpressured (introduced by the stricter drain gate in
     #62936).

Signed-off-by: Naman Trivedi <[email protected]>
Fixes: #64645
Refs: #62936
PR-URL: #64653
Reviewed-By: Trivikram Kamat <[email protected]>
Reviewed-By: Tim Perry <[email protected]>
Reviewed-By: Matteo Collina <[email protected]>
Reviewed-By: Luigi Pinca <[email protected]>

pledgedSrcSize represents an exact byte count. Reject values that are
not non-negative safe integers instead of silently ignoring or coercing
them through IntegerValue().

Apply the same validation to zlib/iter and retain a native validation
check for internal callers.

Signed-off-by: Archkon <[email protected]>
PR-URL: #64604
Fixes: #64603
Reviewed-By: Ethan Arrowood <[email protected]>
Reviewed-By: Jan Martin <[email protected]>

PR-URL: #63918
Reviewed-By: Antoine du Hamel <[email protected]>
Reviewed-By: Michaël Zasso <[email protected]>
Reviewed-By: Luigi Pinca <[email protected]>
Reviewed-By: Ulises Gascón <[email protected]>

Ignore `PostDelayedTask` after `Stop`
to avoid assertions.

Fixes: #56645
Signed-off-by: liuxingbaoyu <[email protected]>
PR-URL: #61999
Reviewed-By: Santiago Gimeno <[email protected]>
Reviewed-By: Aviv Keller <[email protected]>

And other minor cleanups

Signed-off-by: James M Snell <[email protected]>
PR-URL: #64668
Reviewed-By: Filip Skokan <[email protected]>
Reviewed-By: Joyee Cheung <[email protected]>

Original commit message:

    [loong64][compiler] Extend Word64Select instruction functionality

    Change-Id: Iba762777642d2d2d3aa904f9afc1e9005139992e
    Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7801520
    Reviewed-by: Zhao Jiazhong <[email protected]>
    Commit-Queue: Liu Yu <[email protected]>
    Reviewed-by: Darius Mercadier <[email protected]>
    Auto-Submit: Liu Yu <[email protected]>
    Cr-Commit-Position: refs/heads/main@{#107619}

Refs: v8/v8@c4d06ba
Co-authored-by: liujiahui <[email protected]>
PR-URL: #63731
Fixes: #63721
Reviewed-By: René <[email protected]>
Reviewed-By: Michaël Zasso <[email protected]>

Signed-off-by: Chengzhong Wu <[email protected]>
PR-URL: #64565
Refs: nodejs/diagnostics#654
Reviewed-By: James M Snell <[email protected]>
Reviewed-By: Ryuhei Shima <[email protected]>

Signed-off-by: Chengzhong Wu <[email protected]>
PR-URL: #64565
Refs: nodejs/diagnostics#654
Reviewed-By: James M Snell <[email protected]>
Reviewed-By: Ryuhei Shima <[email protected]>

Signed-off-by: Chengzhong Wu <[email protected]>
PR-URL: #64565
Refs: nodejs/diagnostics#654
Reviewed-By: James M Snell <[email protected]>
Reviewed-By: Ryuhei Shima <[email protected]>

Signed-off-by: Chengzhong Wu <[email protected]>
PR-URL: #64565
Refs: nodejs/diagnostics#654
Reviewed-By: James M Snell <[email protected]>
Reviewed-By: Ryuhei Shima <[email protected]>

Signed-off-by: Chengzhong Wu <[email protected]>
PR-URL: #64565
Refs: nodejs/diagnostics#654
Reviewed-By: James M Snell <[email protected]>
Reviewed-By: Ryuhei Shima <[email protected]>

Speed up Interface construction:

- Hoist the history accessor property descriptors to module scope and
  define them with a single ObjectDefineProperties call, instead of
  allocating six closures and four descriptor objects per instance.
- Stop assigning the history options onto the input stream. This avoids
  hidden class transitions on the user provided stream and no longer
  mutates it observably.
- Only check process.env.TERM for a dumb terminal when the interface is
  in terminal mode. Reading process.env goes through the environment
  interceptor and is comparatively expensive, and _ttyWrite is never
  called when terminal is false.

Signed-off-by: Matteo Collina <[email protected]>
PR-URL: #64585
Reviewed-By: James M Snell <[email protected]>
Reviewed-By: Rafael Gonzaga <[email protected]>
Reviewed-By: Yagiz Nizipli <[email protected]>
Reviewed-By: Benjamin Gruenbaum <[email protected]>
Reviewed-By: Gürgün Dayıoğlu <[email protected]>

Signed-off-by: Guy Bedford <[email protected]>
PR-URL: #64399
Reviewed-By: Ethan Arrowood <[email protected]>
Reviewed-By: James M Snell <[email protected]>
Reviewed-By: Matteo Collina <[email protected]>

Signed-off-by: Matteo Collina <[email protected]>
PR-URL: #64460
Fixes: #64456
Reviewed-By: James M Snell <[email protected]>
Reviewed-By: Stefan Stojanovic <[email protected]>
Reviewed-By: Marco Ippolito <[email protected]>

A Debugger.paused event can arrive before the response to the resume
request that triggered it. The resulting probe evaluation replaces the
resume request in `inFlight`, but the resume cleanup then clears the
newer request's state.

Only clear `inFlight` when it still refers to the request being
completed. This preserves probe attribution when the target exits
during evaluation. Clarify the existing end-to-end test coverage
for this case.

Signed-off-by: Kamat, Trivikram <[email protected]>
Assisted-by: openai:gpt-5.6-sol
PR-URL: #64467
Refs: https://github.com/nodejs/reliability/issues?q=sort%3Aupdated-desc%20test-debugger-probe-failure-process-exit
Reviewed-By: Matteo Collina <[email protected]>
Reviewed-By: James M Snell <[email protected]>
Reviewed-By: Joyee Cheung <[email protected]>

Signed-off-by: Augustin Mauroy <[email protected]>
PR-URL: #63175
Reviewed-By: Trivikram Kamat <[email protected]>
Reviewed-By: Aviv Keller <[email protected]>

Signed-off-by: Jacob Smith <[email protected]>
PR-URL: #64505
Reviewed-By: Luigi Pinca <[email protected]>
Reviewed-By: Ulises Gascón <[email protected]>
Reviewed-By: Aviv Keller <[email protected]>

Signed-off-by: Archkon <[email protected]>
PR-URL: #64688
Fixes: #64687
Reviewed-By: René <[email protected]>
Reviewed-By: Luigi Pinca <[email protected]>

StringBytes::StorageSize had a CHECK that fatal-asserted when a
hex-encoded string with an odd number of characters was written
through Writev (e.g. via HTTP requests which are automatically
corked). Writing the same string via a single Write did not crash
because StringBytes::Write delegates to HexDecode, which silently
drops the trailing incomplete nibble.

Remove the CHECK and let integer division handle odd lengths, which
is consistent with StringBytes::Size and HexDecode.

Fixes: #45150
Signed-off-by: RajeshKumar11 <[email protected]>
PR-URL: #63658
Reviewed-By: Edy Silva <[email protected]>
Reviewed-By: Matteo Collina <[email protected]>
Reviewed-By: Gürgün Dayıoğlu <[email protected]>

PR-URL: #64941
Reviewed-By: Antoine du Hamel <[email protected]>
Reviewed-By: Colin Ihrig <[email protected]>

PR-URL: #64942
Reviewed-By: Moshe Atlow <[email protected]>
Reviewed-By: Colin Ihrig <[email protected]>

PR-URL: #64945
Reviewed-By: Daeyeon Jeong <[email protected]>
Reviewed-By: Moshe Atlow <[email protected]>
Reviewed-By: Colin Ihrig <[email protected]>

`TestOptions` as provided to `node:test`'s `test`/`it` supports both
`name` and `fn` as options per its implementation.

I'd like to formalize this as part of the public, documented API.

### Motivation

I have a use-case for consuming both fields.  I'd like to be able to
return the result of a function to `test`/`it` without needing to spread
 the parameters; e.g.:

```js
const testOptionsFactory = (opts = {}) => {
  return {
    fn: () => { /* .. */ },
    name: opts.name
  };
};

test(testOptionsFactory({name: 'foo'}));
```

If I cannot rely on this behavior, then I would need to instead return
an array of parameters and spread them:

```js
const testParamsFactory = (opts = {}) => {
  return opts.name !== undefined
    ? [opts.name, () => { /* .. */ }] : [() => { /* .. */ }];
};

test(...testParamsFactory({name: 'foo'}));
```

I don't think it's too terribly controversial that the former is more
ergonomic than the latter.

### Next Steps

Once this lands, I plan to propose the addition of these fields to
`@types/node`. Since the fields are not currently publicly documented, I
can't justify such a change.

Signed-off-by: Christopher Hiller <[email protected]>
PR-URL: #64946
Reviewed-By: Rich Trott <[email protected]>
Reviewed-By: James M Snell <[email protected]>
Reviewed-By: Ruy Adorno <[email protected]>
Reviewed-By: Colin Ihrig <[email protected]>
Reviewed-By: Chemi Atlow <[email protected]>

Pass the stream-wide signal reason directly to writer.fail() so valid
non-Error abort reasons are not replaced with an AbortError.

Signed-off-by: Kamat, Trivikram <[email protected]>
Assisted-by: codex:gpt-5.6-sol
PR-URL: #64798
Fixes: #64797
Reviewed-By: Aviv Keller <[email protected]>

Signed-off-by: Tim Perry <[email protected]>
PR-URL: #64710
Reviewed-By: James M Snell <[email protected]>

Only emit 'finish' and set writableFinished once all data has actually
been flushed successfully. end() callbacks now report the outcome like
stream.Writable: called with null on finish, or with the error that
prevented the flush.

Signed-off-by: Tim Perry <[email protected]>
PR-URL: #64847
Reviewed-By: James M Snell <[email protected]>
Reviewed-By: Matteo Collina <[email protected]>

Signed-off-by: Rawal27 <[email protected]>
PR-URL: #64952
Reviewed-By: Mike McCready <[email protected]>
Reviewed-By: Richard Lau <[email protected]>
Reviewed-By: Rich Trott <[email protected]>

PR-URL: #64943
Reviewed-By: Tim Perry <[email protected]>
Reviewed-By: Antoine du Hamel <[email protected]>

PR-URL: #64944
Reviewed-By: Tim Perry <[email protected]>
Reviewed-By: Antoine du Hamel <[email protected]>

PR-URL: #64883
Reviewed-By: Jordan Harband <[email protected]>
Reviewed-By: Aviv Keller <[email protected]>
Reviewed-By: Luigi Pinca <[email protected]>
Reviewed-By: Mike McCready <[email protected]>
Reviewed-By: Trivikram Kamat <[email protected]>

readableStreamPipeTo allocated, for every chunk written to the
destination, a { promise, resolve, reject } write request record that
it immediately marked as handled, and drove its loop with an async
step()/run() pair whose implicit promises cost one allocation and one
reaction per iteration. The parked-read path additionally allocated a
read request object, a PromiseWithResolvers record, and a microtask
closure per chunk; this is the steady state for pipeThrough, since a
TransformStream's readable side has a high water mark of zero.

Replace the per-write records with a single per-pipe tracker that the
write request queue holds once per pending write and whose
resolve()/reject() methods maintain a pending-write count, drive the
pump loop with plain callbacks instead of async functions, and reuse
one read request and one forwarding function across all chunks, the
same pattern tee uses since c543cfb.

Benchmark results (benchmark/compare.js --runs 20):
webstreams/pipe-to.js +29.9% to +35.8% across all 16 configurations
(all 99.9% confidence); a pipeThrough(TransformStream) passthrough
loop improves ~17%; every other webstreams benchmark is unchanged.

Signed-off-by: Matteo Collina <[email protected]>
PR-URL: #64890
Reviewed-By: James M Snell <[email protected]>
Reviewed-By: Yagiz Nizipli <[email protected]>

Signed-off-by: Rawal27 <[email protected]>
PR-URL: #64957
Reviewed-By: Mike McCready <[email protected]>
Reviewed-By: Tierney Cyren <[email protected]>
Reviewed-By: Rich Trott <[email protected]>

Notable changes:

crypto:
  * (SEMVER-MINOR) support loading private keys through STORE loaders (Filip Skokan) #63949
  * update root certificates to NSS 3.125 (Node.js GitHub Bot) #64746
lib:
  * (SEMVER-MINOR) add perfetto support (Chengzhong Wu) #64565
module:
  * (SEMVER-MINOR) implement `Symbol.dispose` in ModuleHooks (Remco Haszing) #63928
test_runner:
  * (SEMVER-MINOR) add support for `--test-coverage-include-all` (avivkeller) #64830

PR-URL: #65027