2026-10-28, Version 27.0.0-alpha.0.0.0 (Alpha) by RafaelGSS · Pull Request #67062 · nodejs/node

RafaelGSS · 2026-10-27T15:02:03Z

2026-10-28, Version 27.0.0-alpha.0.0.0 (Alpha), @RafaelGSS

Notable Changes

V8 15.6

The V8 engine is updated to version 15.6.75.13, up from 14.6 in Node.js 26. Highlights:

New language features enabled by default: Math.sumPrecise(), Intl.Locale.prototype.variants, Iterator.prototype.join(), Iterator.prototype.includes(), Iterator.zip() and Iterator.zipKeyed().
Experimental features behind flags: import defer (--js-defer-import-eval), Immutable ArrayBuffer (--js-immutable-arraybuffer) and RegExp buffer boundaries (--js-regexp-buffer-boundaries).
Memory: when --max-old-space-size is not set, the default heap size limit is now half of the physical memory clamped between 256 MB and 4 GB, and memory held by Buffer and ArrayBuffer instances now counts toward the heap limit. Applications that relied on the previous defaults should set --max-old-space-size explicitly.
Serialization: v8.serialize(), structuredClone() and postMessage() use a new format that older Node.js releases cannot read. v8.cachedDataVersionTag() and the compile cache also change on every Node.js patch of V8, not only on V8 version changes.
Observable behavior changes: Math methods now use LLVM's libm and may differ in the last bit; Math.random() sequences change for a given --random-seed; error.stack is no longer looked up through the prototype chain; await incurs fewer microtasks; Array.prototype.sort() uses PowerSort for large arrays and remains stable.
Heap snapshots include internal objects, numeric values and full script sources. Taking one takes about twice as long and the file is about twice as large.
WebAssembly: asm.js is no longer compiled to WebAssembly, and the --experimental-wasm-<name> flags are renamed --wasm-<name>.

A full changelog of the V8 changes between 14.6 and 15.6 will be shared soon.

Contributed by Joyee Cheung in #65161, #66537 and #66601.

Other notable changes

[21cfb2a4ad] - (SEMVER-MAJOR) build: remove the bundled FIPS provider build (Filip Skokan) #64777
[34e3b90621] - (SEMVER-MAJOR) build: require OpenSSL 3 or later (Filip Skokan) #64777
[c362db6e24] - (SEMVER-MAJOR) build: downgrade Intel macOS support to experimental (Antoine du Hamel) #65427
[fb8d52d75a] - (SEMVER-MAJOR) crypto: move DEP0093 to End-of-Life (Filip Skokan) #64777
[8be36fb494] - (SEMVER-MAJOR) crypto: remove legacy OpenSSL code paths (Filip Skokan) #64777
[718f044f07] - (SEMVER-MAJOR) crypto: validate digest output encodings (Filip Skokan) #66247
[6b8001d219] - (SEMVER-MAJOR) crypto: validate update input encodings (Filip Skokan) #66247
[127f79a911] - (SEMVER-MAJOR) crypto: validate inputEncoding in Cipher/Decipher update (Maruthan G) #66247
[b116861e88] - (SEMVER-MAJOR) crypto: move DEP0198 to End-of-Life (Filip Skokan) #64000
[4d09c04253] - (SEMVER-MAJOR) crypto: move DEP0203 and DEP0204 to End-of-Life (Filip Skokan) #63188
[9d50432837] - (SEMVER-MAJOR) crypto: reject resizable backing stores in Web Crypto buffer parameters (Filip Skokan) #63925
[63907e1018] - (SEMVER-MAJOR) crypto: throw on uninitialized DH computeSecret (Filip Skokan) #63922
[463e56fb00] - (SEMVER-MAJOR) crypto: runtime-deprecate calling Hmac.digest() more than once (Madelyn) #63624
[a2cd8aa883] - (SEMVER-MAJOR) crypto,https,tls: end OpenSSL engine support (Filip Skokan) #64777
[3983092f63] - (SEMVER-MAJOR) deps: update archs files for openssl-4.1.0 (Node.js GitHub Bot) #66971
[79239a48f1] - (SEMVER-MAJOR) deps: upgrade openssl sources to openssl-4.1.0 (Node.js GitHub Bot) #66971
[85bfe9a938] - (SEMVER-MAJOR) deps: remove ncrypto legacy OpenSSL backend (Filip Skokan) #64777
[826df076a3] - (SEMVER-MAJOR) deps: update V8 to 15.6.75.13 (Joyee Cheung) #66601
[4eb3908d1f] - (SEMVER-MAJOR) deps: upgrade npm to 12.1.0 (npm team) #66212
[cba0833111] - (SEMVER-MAJOR) dgram: skip the custom lookup for literal IP addresses (Ruben Bridgewater) #64131
[54a5095764] - (SEMVER-MAJOR) dns: do not consult hosts file in reverse lookups (Archkon) #64268
[efc0a14461] - (SEMVER-MAJOR) dns: stop using deprecated functions in SetServers (Antoine du Hamel) #64356
[7f16850ef6] - (SEMVER-MAJOR) doc: remove OpenSSL 1.x references (Filip Skokan) #64777
[9c67491706] - (SEMVER-MAJOR) doc: update Node.js 27 official binary toolchains (Richard Lau) #66377
[6071f8bc32] - (SEMVER-MAJOR) domain: runtime-deprecate the module (Matteo Collina) #65074
[2c4356cedf] - (SEMVER-MAJOR) domain: port to AsyncLocalStorage (Matteo Collina) #61095
[a8f2bf007e] - (SEMVER-MAJOR) fs: implement glob natively (Aviv Keller) #65392
[1f53d7ee3f] - (SEMVER-MAJOR) fs: return Buffer from mkdtemp when prefix is a Buffer (Hamid Reza Ghavami) #64397
[e5778f78c5] - (SEMVER-MAJOR) http: reject responses exceeding header limit (Matteo Collina) #65010
[25c0c8e18a] - (SEMVER-MAJOR) http: runtime deprecate instantiating without new (Yagiz Nizipli) #64853
[9f75269840] - (SEMVER-MAJOR) http: increase keepAliveTimeout default to 65 seconds (Tim Perry) #62782
[21436f0405] - (SEMVER-MAJOR) http: make req.headers have a null prototype (Matteo Collina) #62900
[b2248fd370] - (SEMVER-MAJOR) http: reject addTrailers after finish (Ryuhei Shima) #62832
[1576cb83b4] - (SEMVER-MAJOR) http2: increase default window sizes (Matteo Collina) #64623
[12ce81920a] - (SEMVER-MAJOR) lib: deprecate _http_* (Sebastian Beltran) #58535
[19c46abbef] - (SEMVER-MAJOR) lib: insert argv[0] at argv[1] in setDeserializeMainFunction (Daijiro Wachi) #62928
[b1387e6aed] - (SEMVER-MAJOR) lib: use Object.freeze to avoid defensive cloning in SourceMap (Daijiro Wachi) #62830
[9390c810d1] - (SEMVER-MAJOR) lib: reject SharedArrayBuffer in Blob constructor per spec (Ali Hassan) #63046
[057e591f7c] - (SEMVER-MAJOR) lib,src: remove --no-experimental-websocket CLI flag (Antoine du Hamel) #65284
[9746ebce07] - (SEMVER-MAJOR) net: race family autoselection attempts (Matteo Collina) #66229
[e03e2f6486] - (SEMVER-MAJOR) net: throw on multiple listen calls (Matteo Collina) #64871
[a6e7e6a95e] - (SEMVER-MAJOR) net: runtime-deprecate Server.prototype._listen2 (Guilherme Araújo) #64794
[6d8baeabb0] - (SEMVER-MAJOR) net: add experimental net/promises API (Ethan Arrowood) #63965
[4f844f4380] - (SEMVER-MAJOR) repl: use inspector over vm (Aviv Keller) #64034
[fc28d9402f] - (SEMVER-MAJOR) src: officially deprecate node::ObjectWrap (Anna Henningsen) #63756
[2d0c926907] - (SEMVER-MAJOR) src: merge CreateEnvironment() overloads (Anna Henningsen) #63596
[f378cfcfbf] - (SEMVER-MAJOR) src,lib: add --allow-env permission (James M Snell) #66132
[9f7ae86d8b] - (SEMVER-MAJOR) stream: destroy source when map iterator closes early (Y1D7NG) #64264
[6698675526] - test_runner: use AsyncLocalStorage instead of async_hooks (Matteo Collina) #66795
[7a11a9b2db] - (SEMVER-MAJOR) tls: move _tls_* to end-of-life (Sebastian Beltran) #60658
[967d4af565] - (SEMVER-MAJOR) zlib: convert classes to modern syntax and eol DEP0184 (Yagiz Nizipli) #64849

nodejs-github-bot · 2026-10-27T15:02:10Z

Notable changes: async_hooks: * (SEMVER-MAJOR) remove legacy AsyncLocalStorage implementation (Matteo Collina) #63641 benchmark: * (SEMVER-MAJOR) protect against accidental fork bomb (James M Snell) #66132 build: * (SEMVER-MAJOR) remove the bundled FIPS provider build (Filip Skokan) #64777 * (SEMVER-MAJOR) require OpenSSL 3 or later (Filip Skokan) #64777 * (SEMVER-MAJOR) downgrade Intel macOS support to experimental (Antoine du Hamel) #65427 crypto: * (SEMVER-MAJOR) move DEP0093 to End-of-Life (Filip Skokan) #64777 * (SEMVER-MAJOR) remove legacy OpenSSL code paths (Filip Skokan) #64777 * (SEMVER-MAJOR) validate digest output encodings (Filip Skokan) #66247 * (SEMVER-MAJOR) validate update input encodings (Filip Skokan) #66247 * (SEMVER-MAJOR) validate inputEncoding in Cipher/Decipher update (Maruthan G) #66247 * (SEMVER-MAJOR) move DEP0198 to End-of-Life (Filip Skokan) #64000 * (SEMVER-MAJOR) move DEP0203 and DEP0204 to End-of-Life (Filip Skokan) #63188 * (SEMVER-MAJOR) reject resizable backing stores in Web Crypto buffer parameters (Filip Skokan) #63925 * (SEMVER-MAJOR) throw on uninitialized DH computeSecret (Filip Skokan) #63922 * (SEMVER-MAJOR) runtime-deprecate calling Hmac.digest() more than once (Madelyn) #63624 crypto,https,tls: * (SEMVER-MAJOR) end OpenSSL engine support (Filip Skokan) #64777 deps: * (SEMVER-MAJOR) update archs files for openssl-4.1.0 (Node.js GitHub Bot) #66971 * (SEMVER-MAJOR) upgrade openssl sources to openssl-4.1.0 (Node.js GitHub Bot) #66971 * (SEMVER-MAJOR) remove ncrypto legacy OpenSSL backend (Filip Skokan) #64777 * (SEMVER-MAJOR) update V8 to 15.6.75.13 (Joyee Cheung) #66601 * (SEMVER-MAJOR) update V8 to 15.5.35.20 (Joyee Cheung) #66537 * (SEMVER-MAJOR) update V8 to 15.2.124.38 (Joyee Cheung) #65161 * (SEMVER-MAJOR) upgrade npm to 12.1.0 (npm team) #66212 dgram: * (SEMVER-MAJOR) skip the custom lookup for literal IP addresses (Ruben Bridgewater) #64131 dns: * (SEMVER-MAJOR) do not consult hosts file in reverse lookups (Archkon) #64268 * (SEMVER-MAJOR) stop using deprecated functions in `SetServers` (Antoine du Hamel) #64356 doc: * (SEMVER-MAJOR) remove OpenSSL 1.x references (Filip Skokan) #64777 * (SEMVER-MAJOR) update Node.js 27 official binary toolchains (Richard Lau) #66377 domain: * (SEMVER-MAJOR) runtime-deprecate the module (Matteo Collina) #65074 * (SEMVER-MAJOR) port to AsyncLocalStorage (Matteo Collina) #61095 fs: * (SEMVER-MAJOR) implement glob natively (Aviv Keller) #65392 * (SEMVER-MAJOR) return Buffer from mkdtemp when prefix is a Buffer (Hamid Reza Ghavami) #64397 http: * (SEMVER-MAJOR) reject responses exceeding header limit (Matteo Collina) #65010 * (SEMVER-MAJOR) runtime deprecate instantiating without new (Yagiz Nizipli) #64853 * (SEMVER-MAJOR) increase keepAliveTimeout default to 65 seconds (Tim Perry) #62782 * (SEMVER-MAJOR) make req.headers have a null prototype (Matteo Collina) #62900 * (SEMVER-MAJOR) reject addTrailers after finish (Ryuhei Shima) #62832 http2: * (SEMVER-MAJOR) increase default window sizes (Matteo Collina) #64623 lib: * (SEMVER-MAJOR) deprecate _http_* (Sebastian Beltran) #58535 * (SEMVER-MAJOR) insert argv[0] at argv[1] in setDeserializeMainFunction (Daijiro Wachi) #62928 * (SEMVER-MAJOR) use `Object.freeze` to avoid defensive cloning in `SourceMap` (Daijiro Wachi) #62830 * (SEMVER-MAJOR) reject SharedArrayBuffer in Blob constructor per spec (Ali Hassan) #63046 lib,src: * (SEMVER-MAJOR) remove `--no-experimental-websocket` CLI flag (Antoine du Hamel) #65284 net: * (SEMVER-MAJOR) race family autoselection attempts (Matteo Collina) #66229 * (SEMVER-MAJOR) throw on multiple listen calls (Matteo Collina) #64871 * (SEMVER-MAJOR) runtime-deprecate Server.prototype._listen2 (Guilherme Araújo) #64794 * (SEMVER-MAJOR) add experimental net/promises API (Ethan Arrowood) #63965 repl: * (SEMVER-MAJOR) use inspector over vm (Aviv Keller) #64034 src: * (SEMVER-MAJOR) officially deprecate `node::ObjectWrap` (Anna Henningsen) #63756 * (SEMVER-MAJOR) merge `CreateEnvironment()` overloads (Anna Henningsen) #63596 src, test: src,lib: * (SEMVER-MAJOR) add --allow-env permission (James M Snell) #66132 stream: * (SEMVER-MAJOR) destroy source when map iterator closes early (Y1D7NG) #64264 test: * (SEMVER-MAJOR) fix fs write encoding coverage (Filip Skokan) #66247 test,benchmark: * (SEMVER-MAJOR) drop OpenSSL 1.x-only coverage (Filip Skokan) #64777 test,tools: * (SEMVER-MAJOR) drop OpenSSL 1.x-era FIPS leftovers (Filip Skokan) #64777 test_runner: * use AsyncLocalStorage instead of async_hooks (Matteo Collina) #66795 tls: * (SEMVER-MAJOR) move _tls_* to end-of-life (Sebastian Beltran) #60658 zlib: * (SEMVER-MAJOR) convert classes to modern syntax and eol DEP0184 (Yagiz Nizipli) #64849 PR-URL: #67062

RafaelGSS · 2026-10-27T15:04:52Z

Lint CI will be failing until #67023 gets landed on main and I cherry-pick it.

npm 12.1.0 declares `engines.node` as `^22.22.2 || ^24.15.0 || >=26.0.0`, which does not match the Alpha versions of the 27 release line (`27.0.0-alpha.x.y.z`). npm prints an unsupported version warning on every invocation, and `test-release-npm` fails on release builds. Add `>=27.0.0-alpha` to the range until a new npm release includes it. Upstream issue: npm/cli#10169 Refs: nodejs#67062 Signed-off-by: RafaelGSS <[email protected]>

npm 12.1.0 declares `engines.node` as `^22.22.2 || ^24.15.0 || >=26.0.0`, which does not match the Alpha versions of the 27 release line (`27.0.0-alpha.x.y.z`). npm prints an unsupported version warning on every invocation, and `test-release-npm` fails on release builds. Adds `>=27.0.0-alpha` to the range until a new npm release includes it. Signed-off-by: RafaelGSS <[email protected]> PR-URL: #67063 Refs: #67062 Refs: npm/cli#10169 Reviewed-By: Antoine du Hamel <[email protected]> Reviewed-By: Ruy Adorno <[email protected]>

codecov · 2026-10-27T18:16:05Z

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 90.65%. Comparing base (75191c4) to head (58de2e1).

Additional details and impacted files

@@            Coverage Diff             @@
##            v27.x   #67062      +/-   ##
==========================================
- Coverage   92.97%   90.65%   -2.32%     
==========================================
  Files         428      797     +369     
  Lines      195284   278326   +83042     
  Branches    30205    53522   +23317     
==========================================
+ Hits       181560   252329   +70769     
- Misses      13397    16386    +2989     
- Partials      327     9611    +9284

see 501 files with indirect coverage changes

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

npm 12.1.0 declares `engines.node` as `^22.22.2 || ^24.15.0 || >=26.0.0`, which does not match the Alpha versions of the 27 release line (`27.0.0-alpha.x.y.z`). npm prints an unsupported version warning on every invocation, and `test-release-npm` fails on release builds. Adds `>=27.0.0-alpha` to the range until a new npm release includes it. Signed-off-by: RafaelGSS <[email protected]> PR-URL: #67063 Refs: #67062 Refs: npm/cli#10169 Reviewed-By: Antoine du Hamel <[email protected]> Reviewed-By: Ruy Adorno <[email protected]> (cherry picked from commit 75191c4)

Notable changes: async_hooks: * (SEMVER-MAJOR) remove legacy AsyncLocalStorage implementation (Matteo Collina) #63641 benchmark: * (SEMVER-MAJOR) protect against accidental fork bomb (James M Snell) #66132 build: * (SEMVER-MAJOR) remove the bundled FIPS provider build (Filip Skokan) #64777 * (SEMVER-MAJOR) require OpenSSL 3 or later (Filip Skokan) #64777 * (SEMVER-MAJOR) downgrade Intel macOS support to experimental (Antoine du Hamel) #65427 crypto: * (SEMVER-MAJOR) move DEP0093 to End-of-Life (Filip Skokan) #64777 * (SEMVER-MAJOR) remove legacy OpenSSL code paths (Filip Skokan) #64777 * (SEMVER-MAJOR) validate digest output encodings (Filip Skokan) #66247 * (SEMVER-MAJOR) validate update input encodings (Filip Skokan) #66247 * (SEMVER-MAJOR) validate inputEncoding in Cipher/Decipher update (Maruthan G) #66247 * (SEMVER-MAJOR) move DEP0198 to End-of-Life (Filip Skokan) #64000 * (SEMVER-MAJOR) move DEP0203 and DEP0204 to End-of-Life (Filip Skokan) #63188 * (SEMVER-MAJOR) reject resizable backing stores in Web Crypto buffer parameters (Filip Skokan) #63925 * (SEMVER-MAJOR) throw on uninitialized DH computeSecret (Filip Skokan) #63922 * (SEMVER-MAJOR) runtime-deprecate calling Hmac.digest() more than once (Madelyn) #63624 crypto,https,tls: * (SEMVER-MAJOR) end OpenSSL engine support (Filip Skokan) #64777 deps: * (SEMVER-MAJOR) update archs files for openssl-4.1.0 (Node.js GitHub Bot) #66971 * (SEMVER-MAJOR) upgrade openssl sources to openssl-4.1.0 (Node.js GitHub Bot) #66971 * (SEMVER-MAJOR) remove ncrypto legacy OpenSSL backend (Filip Skokan) #64777 * (SEMVER-MAJOR) update V8 to 15.6.75.13 (Joyee Cheung) #66601 * (SEMVER-MAJOR) update V8 to 15.5.35.20 (Joyee Cheung) #66537 * (SEMVER-MAJOR) update V8 to 15.2.124.38 (Joyee Cheung) #65161 * (SEMVER-MAJOR) upgrade npm to 12.1.0 (npm team) #66212 dgram: * (SEMVER-MAJOR) skip the custom lookup for literal IP addresses (Ruben Bridgewater) #64131 dns: * (SEMVER-MAJOR) do not consult hosts file in reverse lookups (Archkon) #64268 * (SEMVER-MAJOR) stop using deprecated functions in `SetServers` (Antoine du Hamel) #64356 doc: * (SEMVER-MAJOR) remove OpenSSL 1.x references (Filip Skokan) #64777 * (SEMVER-MAJOR) update Node.js 27 official binary toolchains (Richard Lau) #66377 domain: * (SEMVER-MAJOR) runtime-deprecate the module (Matteo Collina) #65074 * (SEMVER-MAJOR) port to AsyncLocalStorage (Matteo Collina) #61095 fs: * (SEMVER-MAJOR) implement glob natively (Aviv Keller) #65392 * (SEMVER-MAJOR) return Buffer from mkdtemp when prefix is a Buffer (Hamid Reza Ghavami) #64397 http: * (SEMVER-MAJOR) reject responses exceeding header limit (Matteo Collina) #65010 * (SEMVER-MAJOR) runtime deprecate instantiating without new (Yagiz Nizipli) #64853 * (SEMVER-MAJOR) increase keepAliveTimeout default to 65 seconds (Tim Perry) #62782 * (SEMVER-MAJOR) make req.headers have a null prototype (Matteo Collina) #62900 * (SEMVER-MAJOR) reject addTrailers after finish (Ryuhei Shima) #62832 http2: * (SEMVER-MAJOR) increase default window sizes (Matteo Collina) #64623 lib: * (SEMVER-MAJOR) deprecate _http_* (Sebastian Beltran) #58535 * (SEMVER-MAJOR) insert argv[0] at argv[1] in setDeserializeMainFunction (Daijiro Wachi) #62928 * (SEMVER-MAJOR) use `Object.freeze` to avoid defensive cloning in `SourceMap` (Daijiro Wachi) #62830 * (SEMVER-MAJOR) reject SharedArrayBuffer in Blob constructor per spec (Ali Hassan) #63046 lib,src: * (SEMVER-MAJOR) remove `--no-experimental-websocket` CLI flag (Antoine du Hamel) #65284 net: * (SEMVER-MAJOR) race family autoselection attempts (Matteo Collina) #66229 * (SEMVER-MAJOR) throw on multiple listen calls (Matteo Collina) #64871 * (SEMVER-MAJOR) runtime-deprecate Server.prototype._listen2 (Guilherme Araújo) #64794 * (SEMVER-MAJOR) add experimental net/promises API (Ethan Arrowood) #63965 repl: * (SEMVER-MAJOR) use inspector over vm (Aviv Keller) #64034 src: * (SEMVER-MAJOR) officially deprecate `node::ObjectWrap` (Anna Henningsen) #63756 * (SEMVER-MAJOR) merge `CreateEnvironment()` overloads (Anna Henningsen) #63596 src, test: src,lib: * (SEMVER-MAJOR) add --allow-env permission (James M Snell) #66132 stream: * (SEMVER-MAJOR) destroy source when map iterator closes early (Y1D7NG) #64264 test: * (SEMVER-MAJOR) fix fs write encoding coverage (Filip Skokan) #66247 test,benchmark: * (SEMVER-MAJOR) drop OpenSSL 1.x-only coverage (Filip Skokan) #64777 test,tools: * (SEMVER-MAJOR) drop OpenSSL 1.x-era FIPS leftovers (Filip Skokan) #64777 test_runner: * use AsyncLocalStorage instead of async_hooks (Matteo Collina) #66795 tls: * (SEMVER-MAJOR) move _tls_* to end-of-life (Sebastian Beltran) #60658 zlib: * (SEMVER-MAJOR) convert classes to modern syntax and eol DEP0184 (Yagiz Nizipli) #64849 PR-URL: #67062

The release proposal linter assumed that a changelog without a `### Commits` section belongs to a semver-major release whose proposal contains only the release commit. The first Alpha release of a line has the same changelog layout, but its proposal may carry commits picked into `vN.x-staging` after the branch-off, which made the linter fail with "Cannot find <sha> on the list". Look the proposal commits up in the `Semver-*` lists instead, and skip the check that every listed commit is in the proposal, since that list covers every commit since the previous release line. Refs: nodejs#67062 Signed-off-by: RafaelGSS <[email protected]>

Notable changes: async_hooks: * (SEMVER-MAJOR) remove legacy AsyncLocalStorage implementation (Matteo Collina) #63641 benchmark: * (SEMVER-MAJOR) protect against accidental fork bomb (James M Snell) #66132 build: * (SEMVER-MAJOR) remove the bundled FIPS provider build (Filip Skokan) #64777 * (SEMVER-MAJOR) require OpenSSL 3 or later (Filip Skokan) #64777 * (SEMVER-MAJOR) downgrade Intel macOS support to experimental (Antoine du Hamel) #65427 crypto: * (SEMVER-MAJOR) move DEP0093 to End-of-Life (Filip Skokan) #64777 * (SEMVER-MAJOR) remove legacy OpenSSL code paths (Filip Skokan) #64777 * (SEMVER-MAJOR) validate digest output encodings (Filip Skokan) #66247 * (SEMVER-MAJOR) validate update input encodings (Filip Skokan) #66247 * (SEMVER-MAJOR) validate inputEncoding in Cipher/Decipher update (Maruthan G) #66247 * (SEMVER-MAJOR) move DEP0198 to End-of-Life (Filip Skokan) #64000 * (SEMVER-MAJOR) move DEP0203 and DEP0204 to End-of-Life (Filip Skokan) #63188 * (SEMVER-MAJOR) reject resizable backing stores in Web Crypto buffer parameters (Filip Skokan) #63925 * (SEMVER-MAJOR) throw on uninitialized DH computeSecret (Filip Skokan) #63922 * (SEMVER-MAJOR) runtime-deprecate calling Hmac.digest() more than once (Madelyn) #63624 crypto,https,tls: * (SEMVER-MAJOR) end OpenSSL engine support (Filip Skokan) #64777 deps: * (SEMVER-MAJOR) update archs files for openssl-4.1.0 (Node.js GitHub Bot) #66971 * (SEMVER-MAJOR) upgrade openssl sources to openssl-4.1.0 (Node.js GitHub Bot) #66971 * (SEMVER-MAJOR) remove ncrypto legacy OpenSSL backend (Filip Skokan) #64777 * (SEMVER-MAJOR) update V8 to 15.6.75.13 (Joyee Cheung) #66601 * (SEMVER-MAJOR) update V8 to 15.5.35.20 (Joyee Cheung) #66537 * (SEMVER-MAJOR) update V8 to 15.2.124.38 (Joyee Cheung) #65161 * (SEMVER-MAJOR) upgrade npm to 12.1.0 (npm team) #66212 dgram: * (SEMVER-MAJOR) skip the custom lookup for literal IP addresses (Ruben Bridgewater) #64131 dns: * (SEMVER-MAJOR) do not consult hosts file in reverse lookups (Archkon) #64268 * (SEMVER-MAJOR) stop using deprecated functions in `SetServers` (Antoine du Hamel) #64356 doc: * (SEMVER-MAJOR) remove OpenSSL 1.x references (Filip Skokan) #64777 * (SEMVER-MAJOR) update Node.js 27 official binary toolchains (Richard Lau) #66377 domain: * (SEMVER-MAJOR) runtime-deprecate the module (Matteo Collina) #65074 * (SEMVER-MAJOR) port to AsyncLocalStorage (Matteo Collina) #61095 fs: * (SEMVER-MAJOR) implement glob natively (Aviv Keller) #65392 * (SEMVER-MAJOR) return Buffer from mkdtemp when prefix is a Buffer (Hamid Reza Ghavami) #64397 http: * (SEMVER-MAJOR) reject responses exceeding header limit (Matteo Collina) #65010 * (SEMVER-MAJOR) runtime deprecate instantiating without new (Yagiz Nizipli) #64853 * (SEMVER-MAJOR) increase keepAliveTimeout default to 65 seconds (Tim Perry) #62782 * (SEMVER-MAJOR) make req.headers have a null prototype (Matteo Collina) #62900 * (SEMVER-MAJOR) reject addTrailers after finish (Ryuhei Shima) #62832 http2: * (SEMVER-MAJOR) increase default window sizes (Matteo Collina) #64623 lib: * (SEMVER-MAJOR) deprecate _http_* (Sebastian Beltran) #58535 * (SEMVER-MAJOR) insert argv[0] at argv[1] in setDeserializeMainFunction (Daijiro Wachi) #62928 * (SEMVER-MAJOR) use `Object.freeze` to avoid defensive cloning in `SourceMap` (Daijiro Wachi) #62830 * (SEMVER-MAJOR) reject SharedArrayBuffer in Blob constructor per spec (Ali Hassan) #63046 lib,src: * (SEMVER-MAJOR) remove `--no-experimental-websocket` CLI flag (Antoine du Hamel) #65284 net: * (SEMVER-MAJOR) race family autoselection attempts (Matteo Collina) #66229 * (SEMVER-MAJOR) throw on multiple listen calls (Matteo Collina) #64871 * (SEMVER-MAJOR) runtime-deprecate Server.prototype._listen2 (Guilherme Araújo) #64794 * (SEMVER-MAJOR) add experimental net/promises API (Ethan Arrowood) #63965 repl: * (SEMVER-MAJOR) use inspector over vm (Aviv Keller) #64034 src: * (SEMVER-MAJOR) officially deprecate `node::ObjectWrap` (Anna Henningsen) #63756 * (SEMVER-MAJOR) merge `CreateEnvironment()` overloads (Anna Henningsen) #63596 src, test: src,lib: * (SEMVER-MAJOR) add --allow-env permission (James M Snell) #66132 stream: * (SEMVER-MAJOR) destroy source when map iterator closes early (Y1D7NG) #64264 test: * (SEMVER-MAJOR) fix fs write encoding coverage (Filip Skokan) #66247 test,benchmark: * (SEMVER-MAJOR) drop OpenSSL 1.x-only coverage (Filip Skokan) #64777 test,tools: * (SEMVER-MAJOR) drop OpenSSL 1.x-era FIPS leftovers (Filip Skokan) #64777 test_runner: * use AsyncLocalStorage instead of async_hooks (Matteo Collina) #66795 tls: * (SEMVER-MAJOR) move _tls_* to end-of-life (Sebastian Beltran) #60658 zlib: * (SEMVER-MAJOR) convert classes to modern syntax and eol DEP0184 (Yagiz Nizipli) #64849 PR-URL: #67062

nodejs-github-bot · 2026-10-27T20:48:16Z

CI: https://ci.nodejs.org/job/node-test-pull-request/78692/ 🟢
📦 https://ci-release.nodejs.org/job/iojs+release/12206/ 🟢

aduh95 · 2026-10-27T20:52:37Z

+* \[[`826df076a3`](https://github.com/nodejs/node/commit/826df076a3)] - **(SEMVER-MAJOR)** **deps**: update V8 to 15.6.75.13 (Joyee Cheung) [#66601](https://github.com/nodejs/node/pull/66601)
+* \[[`6b28cb0909`](https://github.com/nodejs/node/commit/6b28cb0909)] - **(SEMVER-MAJOR)** **deps**: update V8 to 15.5.35.20 (Joyee Cheung) [#66537](https://github.com/nodejs/node/pull/66537)
+* \[[`07fa7280c1`](https://github.com/nodejs/node/commit/07fa7280c1)] - **(SEMVER-MAJOR)** **deps**: update V8 to 15.2.124.38 (Joyee Cheung) [#65161](https://github.com/nodejs/node/pull/65161)


nit: only the latest one is notable

Suggested change

* \[[`826df076a3`](https://github.com/nodejs/node/commit/826df076a3)] - **(SEMVER-MAJOR)** **deps**: update V8 to 15.6.75.13 (Joyee Cheung) [#66601](https://github.com/nodejs/node/pull/66601)

* \[[`6b28cb0909`](https://github.com/nodejs/node/commit/6b28cb0909)] - **(SEMVER-MAJOR)** **deps**: update V8 to 15.5.35.20 (Joyee Cheung) [#66537](https://github.com/nodejs/node/pull/66537)

* \[[`07fa7280c1`](https://github.com/nodejs/node/commit/07fa7280c1)] - **(SEMVER-MAJOR)** **deps**: update V8 to 15.2.124.38 (Joyee Cheung) [#65161](https://github.com/nodejs/node/pull/65161)

* \[[`826df076a3`](https://github.com/nodejs/node/commit/826df076a3)] - **(SEMVER-MAJOR)** **deps**: update V8 to 15.6.75.13 (Joyee Cheung) [#66601](https://github.com/nodejs/node/pull/66601)

We should use https://hackmd.io/0igOVskwTuC3GhiwkH93Ww (will need to happen after the release)

aduh95 · 2026-10-27T20:55:19Z

+* \[[`822e8ef3ce`](https://github.com/nodejs/node/commit/822e8ef3ce)] - **(SEMVER-MAJOR)** **test**: fix fs write encoding coverage (Filip Skokan) [#66247](https://github.com/nodejs/node/pull/66247)
+* \[[`acbc3ff133`](https://github.com/nodejs/node/commit/acbc3ff133)] - **(SEMVER-MAJOR)** **test,benchmark**: drop OpenSSL 1.x-only coverage (Filip Skokan) [#64777](https://github.com/nodejs/node/pull/64777)
+* \[[`ee9ae88636`](https://github.com/nodejs/node/commit/ee9ae88636)] - **(SEMVER-MAJOR)** **test,tools**: drop OpenSSL 1.x-era FIPS leftovers (Filip Skokan) [#64777](https://github.com/nodejs/node/pull/64777)


Those are internal-only, not notable

Suggested change

* \[[`822e8ef3ce`](https://github.com/nodejs/node/commit/822e8ef3ce)] - **(SEMVER-MAJOR)** **test**: fix fs write encoding coverage (Filip Skokan) [#66247](https://github.com/nodejs/node/pull/66247)

* \[[`acbc3ff133`](https://github.com/nodejs/node/commit/acbc3ff133)] - **(SEMVER-MAJOR)** **test,benchmark**: drop OpenSSL 1.x-only coverage (Filip Skokan) [#64777](https://github.com/nodejs/node/pull/64777)

* \[[`ee9ae88636`](https://github.com/nodejs/node/commit/ee9ae88636)] - **(SEMVER-MAJOR)** **test,tools**: drop OpenSSL 1.x-era FIPS leftovers (Filip Skokan) [#64777](https://github.com/nodejs/node/pull/64777)

aduh95 · 2026-10-27T20:56:23Z

+### Notable Changes
+
+* \[[`984aa0c25e`](https://github.com/nodejs/node/commit/984aa0c25e)] - **(SEMVER-MAJOR)** **async\_hooks**: remove legacy AsyncLocalStorage implementation (Matteo Collina) [#63641](https://github.com/nodejs/node/pull/63641)
+* \[[`d1960949bb`](https://github.com/nodejs/node/commit/d1960949bb)] - **(SEMVER-MAJOR)** **benchmark**: protect against accidental fork bomb (James M Snell) [#66132](https://github.com/nodejs/node/pull/66132)


not notable

Suggested change

* \[[`d1960949bb`](https://github.com/nodejs/node/commit/d1960949bb)] - **(SEMVER-MAJOR)** **benchmark**: protect against accidental fork bomb (James M Snell) [#66132](https://github.com/nodejs/node/pull/66132)

bricss · 2026-10-28T12:30:07Z

Would be great to pull 🧲 in this #66161 crucial bug 🐞 fix 🪛

joyeecheung · 2026-10-28T15:25:59Z

For notable changes, not sure how we could incorporate the V8 ones, but I am still compling https://hackmd.io/0igOVskwTuC3GhiwkH93Ww - I think most sections are done now, the only one I am still trying to compile is the performance part

BethGriggs · 2026-10-28T16:09:19Z

Maybe I missed where it was discussed, but do we need a new entry for the alpha in doc/abi_version_registry.json?

Notable changes: build: * (SEMVER-MAJOR) remove the bundled FIPS provider build (Filip Skokan) #64777 * (SEMVER-MAJOR) require OpenSSL 3 or later (Filip Skokan) #64777 * (SEMVER-MAJOR) downgrade Intel macOS support to experimental (Antoine du Hamel) #65427 crypto: * (SEMVER-MAJOR) move DEP0093 to End-of-Life (Filip Skokan) #64777 * (SEMVER-MAJOR) remove legacy OpenSSL code paths (Filip Skokan) #64777 * (SEMVER-MAJOR) validate digest output encodings (Filip Skokan) #66247 * (SEMVER-MAJOR) validate update input encodings (Filip Skokan) #66247 * (SEMVER-MAJOR) validate inputEncoding in Cipher/Decipher update (Maruthan G) #66247 * (SEMVER-MAJOR) move DEP0198 to End-of-Life (Filip Skokan) #64000 * (SEMVER-MAJOR) move DEP0203 and DEP0204 to End-of-Life (Filip Skokan) #63188 * (SEMVER-MAJOR) reject resizable backing stores in Web Crypto buffer parameters (Filip Skokan) #63925 * (SEMVER-MAJOR) throw on uninitialized DH computeSecret (Filip Skokan) #63922 * (SEMVER-MAJOR) runtime-deprecate calling Hmac.digest() more than once (Madelyn) #63624 crypto,https,tls: * (SEMVER-MAJOR) end OpenSSL engine support (Filip Skokan) #64777 deps: * (SEMVER-MAJOR) update archs files for openssl-4.1.0 (Node.js GitHub Bot) #66971 * (SEMVER-MAJOR) upgrade openssl sources to openssl-4.1.0 (Node.js GitHub Bot) #66971 * (SEMVER-MAJOR) remove ncrypto legacy OpenSSL backend (Filip Skokan) #64777 * (SEMVER-MAJOR) update V8 to 15.6.75.13 (Joyee Cheung) #66601 * (SEMVER-MAJOR) upgrade npm to 12.1.0 (npm team) #66212 dgram: * (SEMVER-MAJOR) skip the custom lookup for literal IP addresses (Ruben Bridgewater) #64131 dns: * (SEMVER-MAJOR) do not consult hosts file in reverse lookups (Archkon) #64268 * (SEMVER-MAJOR) stop using deprecated functions in `SetServers` (Antoine du Hamel) #64356 doc: * (SEMVER-MAJOR) remove OpenSSL 1.x references (Filip Skokan) #64777 * (SEMVER-MAJOR) update Node.js 27 official binary toolchains (Richard Lau) #66377 domain: * (SEMVER-MAJOR) runtime-deprecate the module (Matteo Collina) #65074 * (SEMVER-MAJOR) port to AsyncLocalStorage (Matteo Collina) #61095 fs: * (SEMVER-MAJOR) implement glob natively (Aviv Keller) #65392 * (SEMVER-MAJOR) return Buffer from mkdtemp when prefix is a Buffer (Hamid Reza Ghavami) #64397 http: * (SEMVER-MAJOR) reject responses exceeding header limit (Matteo Collina) #65010 * (SEMVER-MAJOR) runtime deprecate instantiating without new (Yagiz Nizipli) #64853 * (SEMVER-MAJOR) increase keepAliveTimeout default to 65 seconds (Tim Perry) #62782 * (SEMVER-MAJOR) make req.headers have a null prototype (Matteo Collina) #62900 * (SEMVER-MAJOR) reject addTrailers after finish (Ryuhei Shima) #62832 http2: * (SEMVER-MAJOR) increase default window sizes (Matteo Collina) #64623 lib: * (SEMVER-MAJOR) deprecate _http_* (Sebastian Beltran) #58535 * (SEMVER-MAJOR) insert argv[0] at argv[1] in setDeserializeMainFunction (Daijiro Wachi) #62928 * (SEMVER-MAJOR) use `Object.freeze` to avoid defensive cloning in `SourceMap` (Daijiro Wachi) #62830 * (SEMVER-MAJOR) reject SharedArrayBuffer in Blob constructor per spec (Ali Hassan) #63046 lib,src: * (SEMVER-MAJOR) remove `--no-experimental-websocket` CLI flag (Antoine du Hamel) #65284 net: * (SEMVER-MAJOR) race family autoselection attempts (Matteo Collina) #66229 * (SEMVER-MAJOR) throw on multiple listen calls (Matteo Collina) #64871 * (SEMVER-MAJOR) runtime-deprecate Server.prototype._listen2 (Guilherme Araújo) #64794 * (SEMVER-MAJOR) add experimental net/promises API (Ethan Arrowood) #63965 repl: * (SEMVER-MAJOR) use inspector over vm (Aviv Keller) #64034 src: * (SEMVER-MAJOR) officially deprecate `node::ObjectWrap` (Anna Henningsen) #63756 * (SEMVER-MAJOR) merge `CreateEnvironment()` overloads (Anna Henningsen) #63596 src,lib: * (SEMVER-MAJOR) add --allow-env permission (James M Snell) #66132 stream: * (SEMVER-MAJOR) destroy source when map iterator closes early (Y1D7NG) #64264 test_runner: * use AsyncLocalStorage instead of async_hooks (Matteo Collina) #66795 tls: * (SEMVER-MAJOR) move _tls_* to end-of-life (Sebastian Beltran) #60658 zlib: * (SEMVER-MAJOR) convert classes to modern syntax and eol DEP0184 (Yagiz Nizipli) #64849 PR-URL: #67062

RafaelGSS · 2026-10-28T17:48:43Z

Maybe I missed where it was discussed, but do we need a new entry for the alpha in doc/abi_version_registry.json?

I might be wrong, but I think no new number is needed. The alpha is built from main with the same V8 and the same NODE_MODULE_VERSION (153). Since the ABI can still change during Alpha, 153 may not even be the value 27.0.0 ships with, so I would keep the 27.0.0-pre label and drop the -pre suffix in the 27.0.0 release commit as usual.

What do you think? @nodejs/releasers @nodejs/tsc

RafaelGSS · 2026-10-28T17:53:18Z

@joyeecheung I have updated the notable changes section according to your WIP, can you check? Maybe that's too technical.

richardlau · 2026-10-28T18:02:37Z

Maybe I missed where it was discussed, but do we need a new entry for the alpha in doc/abi_version_registry.json?

I might be wrong, but I think no new number is needed. The alpha is built from main with the same V8 and the same NODE_MODULE_VERSION (153). Since the ABI can still change during Alpha, 153 may not even be the value 27.0.0 ships with, so I would keep the 27.0.0-pre label and drop the -pre suffix in the 27.0.0 release commit as usual.

What do you think? @nodejs/releasers @nodejs/tsc

We need a new entry for every V8 version we bump, or if we make a semver major change to the ABI for Node.js. We have an existing entry for V8 15.6 and v27.0.0-pre and I guess the only question is whether v27.0.0-pre is suitable or if we want something reflecting the alpha tag. I'm comfortable with v27.0.0-pre until we exit alpha status -- we can have as many entries as needed with v27.0.0-pre:

node/doc/abi_version_registry.json

Lines 4 to 6 in 75191c4

    
           { "modules": 153, "runtime": "node", "variant": "v8_15.6", "versions": "27.0.0-pre" }, 
        
           { "modules": 152, "runtime": "node", "variant": "v8_15.5", "versions": "27.0.0-pre" }, 
        
           { "modules": 151, "runtime": "node", "variant": "v8_15.2", "versions": "27.0.0-pre" },

The main thing is that NODE_MODULE_VERSION gets embedded into (non-node-addon-api?) native addons, so the important thing is that modules is unique across ABI-incompatible versions. I'm not aware of anything looking at the values for runtime, variant or versions -- I think those are for human consumption (unless there's something on Electron's side, but I'd assume they'd only be looking for the Electron entries).

RafaelGSS · 2026-10-28T18:06:28Z

📦 https://ci-release.nodejs.org/job/iojs+release/12208/

RafaelGSS · 2026-10-28T20:45:19Z

Builds for VS2022 are still in progress. It is likely that the v27 Alpha version will be delayed until tomorrow.

RafaelGSS added release Issues and PRs related to Node.js releases. v27.x Issues that can be reproduced on v27.x or PRs targeting the v27.x-staging branch. labels Oct 27, 2026

RafaelGSS self-assigned this Oct 27, 2026

RafaelGSS force-pushed the v27.0.0-alpha.0.0.0-proposal branch from d04389c to 431dd20 Compare October 27, 2026 15:02

nodejs-github-bot added the meta Issues and PRs related to the general management of the project. label Oct 27, 2026

RafaelGSS mentioned this pull request Oct 27, 2026

engines.node rejects Node.js Alpha versions (27.0.0-alpha.x.y.z) npm/cli#10169

Open

RafaelGSS mentioned this pull request Oct 27, 2026

deps: patch npm engines to accept alpha versions #67063

Merged

RafaelGSS force-pushed the v27.0.0-alpha.0.0.0-proposal branch from 431dd20 to 95c633f Compare October 27, 2026 19:04

This was referenced Oct 27, 2026

tools: lint first Alpha release proposals #67065

Closed

feat(release): support alpha releases nodejs/node-core-utils#1224

Merged

This comment was marked as outdated.

Sign in to view

RafaelGSS force-pushed the v27.0.0-alpha.0.0.0-proposal branch from 95c633f to 8ab5fc9 Compare October 27, 2026 20:32

This comment was marked as outdated.

Sign in to view

RafaelGSS force-pushed the v27.x branch from bc4ec98 to 75191c4 Compare October 27, 2026 20:43

RafaelGSS force-pushed the v27.0.0-alpha.0.0.0-proposal branch from 8ab5fc9 to cdf632e Compare October 27, 2026 20:44

aduh95 approved these changes Oct 27, 2026

View reviewed changes

aduh95 mentioned this pull request Oct 28, 2026

Windows release nodes are offline nodejs/build#4544

Open

RafaelGSS force-pushed the v27.0.0-alpha.0.0.0-proposal branch from cdf632e to 58de2e1 Compare October 28, 2026 17:52

This comment was marked as resolved.

Sign in to view

	* \[[`822e8ef3ce`](https://github.com/nodejs/node/commit/822e8ef3ce)] - (SEMVER-MAJOR) test: fix fs write encoding coverage (Filip Skokan) [#66247](https://github.com/nodejs/node/pull/66247)
	* \[[`acbc3ff133`](https://github.com/nodejs/node/commit/acbc3ff133)] - (SEMVER-MAJOR) test,benchmark: drop OpenSSL 1.x-only coverage (Filip Skokan) [#64777](https://github.com/nodejs/node/pull/64777)
	* \[[`ee9ae88636`](https://github.com/nodejs/node/commit/ee9ae88636)] - (SEMVER-MAJOR) test,tools: drop OpenSSL 1.x-era FIPS leftovers (Filip Skokan) [#64777](https://github.com/nodejs/node/pull/64777)

Conversation

RafaelGSS commented Oct 27, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

2026-10-28, Version 27.0.0-alpha.0.0.0 (Alpha), @RafaelGSS

Notable Changes

V8 15.6

Other notable changes

Uh oh!

nodejs-github-bot commented Oct 27, 2026

Uh oh!

RafaelGSS commented Oct 27, 2026

Uh oh!

codecov Bot commented Oct 27, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

This comment was marked as outdated.

This comment was marked as outdated.

nodejs-github-bot commented Oct 27, 2026 • edited by RafaelGSS Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

aduh95 Oct 27, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

aduh95 Oct 27, 2026

Choose a reason for hiding this comment

Uh oh!

aduh95 Oct 27, 2026

Choose a reason for hiding this comment

Uh oh!

bricss commented Oct 28, 2026

Uh oh!

joyeecheung commented Oct 28, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

BethGriggs commented Oct 28, 2026

Uh oh!

RafaelGSS commented Oct 28, 2026

Uh oh!

RafaelGSS commented Oct 28, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

richardlau commented Oct 28, 2026

Uh oh!

RafaelGSS commented Oct 28, 2026

Uh oh!

This comment was marked as resolved.

RafaelGSS commented Oct 28, 2026

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

7 participants

RafaelGSS commented Oct 27, 2026 •

edited

Loading

codecov Bot commented Oct 27, 2026 •

edited

Loading

nodejs-github-bot commented Oct 27, 2026 •

edited by RafaelGSS

Loading

aduh95 Oct 27, 2026 •

edited

Loading

joyeecheung commented Oct 28, 2026 •

edited

Loading

RafaelGSS commented Oct 28, 2026 •

edited

Loading