Skip to content

[javascript] Update Node.js to v25.9.0#206

Merged
hayat01sh1da merged 2 commits intomasterfrom
hayat01sh1da/javascript/update-nodejs-to-v25.9.0
Apr 4, 2026
Merged

[javascript] Update Node.js to v25.9.0#206
hayat01sh1da merged 2 commits intomasterfrom
hayat01sh1da/javascript/update-nodejs-to-v25.9.0

Conversation

@hayat01sh1da
Copy link
Copy Markdown
Owner

@hayat01sh1da hayat01sh1da commented Apr 4, 2026 •
edited
Loading

1. v25.8.2 (2026-03-24) — Security Release

A security-only release addressing 8 CVEs:

1-1. High Severity

CVE Description
CVE-2026-21637 Wrap SNICallback invocation in try/catch (TLS)
CVE-2026-21710 Use null prototype for headersDistinct/trailersDistinct (HTTP)

1-2. Medium Severity

CVE Description
CVE-2026-21711 Include permission check to pipe_wrap.cc
CVE-2026-21712 Handle URL crash on different URL formats
CVE-2026-21713 Use timing-safe comparison in Web Cryptography HMAC and KMAC
CVE-2026-21714 Handle NGHTTP2_ERR_FLOW_CONTROL error code
CVE-2026-21717 Test array index hash collision

1-3. Low Severity

CVE Description
CVE-2026-21715 Add permission check to realpath.native
CVE-2026-21716 Include permission check on lib/fs/promises

1-4. Dependency Updates

  • undici → 7.24.4
  • npm → 11.11.1

2. v25.9.0 (2026-04-01) — Feature Release

2-1. Notable Changes

2-1-1. Test Runner: Module Mocking Improvements

  • MockModuleOptions.defaultExport and MockModuleOptions.namedExports have been consolidated into a single MockModuleOptions.exports option.
    • A default property on exports represents the default export; own enumerable properties are treated as named exports.
    • Automated migration available: npx codemod @nodejs/mock-module-exports
    • #61727

2-1-2. New Features (SEMVER-MINOR)

Area Change PR
async_hooks Add using scopes to AsyncLocalStorage #61674
CLI Add --max-heap-size option #58708
crypto Add TurboSHAKE and KangarooTwelve Web Cryptography algorithms #62183
REPL Add customizable error handling #62188
REPL Remove dependency on node:domain #61227
SEA Support code cache for ESM entrypoint in Single Executable Applications #62158
stream Add stream/iter implementation #62066

2-1-3. Bug Fixes & Improvements

Area Change PR
buffer Improve performance of multiple Buffer operations #61871
crypto Update root certificates to NSS 3.121 #62485
crypto Reject ML-KEM/ML-DSA PKCS#8 import without seed in SubtleCrypto #62218
crypto Enable compilation/linking with OpenSSL 4.0 #62410
diagnostics_channel Add diagnostics channels for web locks #62123
esm Fix source phase identity bug in loadCache eviction #62415
esm Fix path normalization in finalizeResolution #62080
events Avoid cloning listeners array on every emit #62261
fs Fix cpSync to handle non-ASCII characters #61950
module Fix coverage of mocked CJS modules imported from ESM #62133
stream Preserve error over AbortError in pipeline #62113
test_runner Make it compatible with fake timers #59272
test_runner Set non-zero exit code when suite errors occur #62282
url Enable simdutf for ada #61477
util Allow color aliases in styleText #62180
wasm Support JS string constant ESM import #62198
zlib Fix use-after-free when reset() is called during write #62325

2-1-4. Deprecations

  • module.register() deprecated as DEP0205 (#62395)
  • CryptoKey usage in node:crypto deprecated (#62321)

2-1-5. Dependency Updates

  • ada → 3.4.4
  • npm → 11.12.1
  • simdjson → 4.5.0
  • ngtcp2 → 1.21.0
  • sqlite → 3.51.3
  • timezone → 2026a

@hayat01sh1da hayat01sh1da requested a review from Copilot April 4, 2026 15:50
@hayat01sh1da hayat01sh1da self-assigned this Apr 4, 2026
Copilot AI reviewed Apr 4, 2026
View reviewed changes
Copy link
Copy Markdown
Contributor

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Updates the repository’s pinned/documented Node.js version to v25.9.0.

Changes:

  • Bump Node.js version references in JavaScript/TypeScript and Rails track READMEs to v25.9.0.
  • Update .node-version files (root + Rails subproject) to v25.9.0.

Reviewed changes

Copilot reviewed 5 out of 5 changed files in this pull request and generated 2 comments.

Show a summary per file
File Description
typescript/README.md Updates documented Node version for the TypeScript track.
ruby-on-rails/perfect-ruby-on-rails/README.md Updates documented Node version for the Rails subproject.
ruby-on-rails/perfect-ruby-on-rails/.node-version Pins Rails subproject Node version to v25.9.0.
javascript/README.md Updates documented Node version for the JavaScript track.
.node-version Pins repository-wide Node version to v25.9.0.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

@hayat01sh1da hayat01sh1da force-pushed the hayat01sh1da/javascript/update-nodejs-to-v25.9.0 branch from 265d416 to b9a96ce Compare April 4, 2026 15:55
hayat01sh1da
hayat01sh1da commented Apr 4, 2026
View reviewed changes
Copy link
Copy Markdown
Owner Author

@hayat01sh1da hayat01sh1da left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

@hayat01sh1da hayat01sh1da merged commit 2f459ca into master Apr 4, 2026
8 checks passed
@hayat01sh1da hayat01sh1da deleted the hayat01sh1da/javascript/update-nodejs-to-v25.9.0 branch April 4, 2026 16:00
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

Copilot code review Copilot Copilot left review comments

Assignees

@hayat01sh1da hayat01sh1da

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@hayat01sh1da