[javascript] Update Node.js to v25.9.0

[hayat01sh1da]

1. v25.8.2 (2026-03-24) — Security Release

A security-only release addressing 8 CVEs:

1-1. High Severity

CVE	Description
CVE-2026-21637	Wrap SNICallback invocation in try/catch (TLS)
CVE-2026-21710	Use null prototype for headersDistinct/trailersDistinct (HTTP)

1-2. Medium Severity

CVE	Description
CVE-2026-21711	Include permission check to pipe_wrap.cc
CVE-2026-21712	Handle URL crash on different URL formats
CVE-2026-21713	Use timing-safe comparison in Web Cryptography HMAC and KMAC
CVE-2026-21714	Handle NGHTTP2_ERR_FLOW_CONTROL error code
CVE-2026-21717	Test array index hash collision

1-3. Low Severity

CVE	Description
CVE-2026-21715	Add permission check to realpath.native
CVE-2026-21716	Include permission check on lib/fs/promises

1-4. Dependency Updates

• undici → 7.24.4
• npm → 11.11.1

---

2. v25.9.0 (2026-04-01) — Feature Release

2-1. Notable Changes

2-1-1. Test Runner: Module Mocking Improvements

• MockModuleOptions.defaultExport and MockModuleOptions.namedExports have been consolidated into a single MockModuleOptions.exports option.
  • A default property on exports represents the default export; own enumerable properties are treated as named exports.
  • Automated migration available: npx codemod @nodejs/mock-module-exports
  • #61727

2-1-2. New Features (SEMVER-MINOR)

Area	Change	PR
async_hooks	Add using scopes to AsyncLocalStorage	#61674
CLI	Add --max-heap-size option	#58708
crypto	Add TurboSHAKE and KangarooTwelve Web Cryptography algorithms	#62183
REPL	Add customizable error handling	#62188
REPL	Remove dependency on node:domain	#61227
SEA	Support code cache for ESM entrypoint in Single Executable Applications	#62158
stream	Add stream/iter implementation	#62066

2-1-3. Bug Fixes & Improvements

Area	Change	PR
buffer	Improve performance of multiple Buffer operations	#61871
crypto	Update root certificates to NSS 3.121	#62485
crypto	Reject ML-KEM/ML-DSA PKCS#8 import without seed in SubtleCrypto	#62218
crypto	Enable compilation/linking with OpenSSL 4.0	#62410
diagnostics_channel	Add diagnostics channels for web locks	#62123
esm	Fix source phase identity bug in loadCache eviction	#62415
esm	Fix path normalization in finalizeResolution	#62080
events	Avoid cloning listeners array on every emit	#62261
fs	Fix cpSync to handle non-ASCII characters	#61950
module	Fix coverage of mocked CJS modules imported from ESM	#62133
stream	Preserve error over AbortError in pipeline	#62113
test_runner	Make it compatible with fake timers	#59272
test_runner	Set non-zero exit code when suite errors occur	#62282
url	Enable simdutf for ada	#61477
util	Allow color aliases in styleText	#62180
wasm	Support JS string constant ESM import	#62198
zlib	Fix use-after-free when reset() is called during write	#62325

2-1-4. Deprecations

• module.register() deprecated as DEP0205 (#62395)
• CryptoKey usage in node:crypto deprecated (#62321)

2-1-5. Dependency Updates

• ada → 3.4.4
• npm → 11.12.1
• simdjson → 4.5.0
• ngtcp2 → 1.21.0
• sqlite → 3.51.3
• timezone → 2026a

[Copilot]

Pull request overview

Updates the JavaScript toolchain baseline to Node.js v25.9.0 by aligning the repository’s Node version file and the JavaScript README environment documentation.

Changes:

• Bump root .node-version to v25.9.0 (drives CI/runtime selection).
• Update javascript/README.md to document Node v25.9.0 in the environment section.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.

File	Description
javascript/README.md	Updates documented Node version for the JavaScript environment.
.node-version	Updates the Node version used by CI/tooling via node-version-file.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[hayat01sh1da]