Node.js 25.4.0 release notes

Notable Changes

[8f6fada8f1] - cli: add --require-module/--no-require-module (Joyee Cheung) #60959
[bf8e738df4] - cli: mark --heapsnapshot-near-heap-limit as stable (Joyee Cheung) #60956
[7930d7a19b] - crypto: update root certificates to NSS 3.117 (Node.js GitHub Bot) #60741
[44f61dfb92] - doc: add @avivkeller to collaborators (Aviv Keller) #61115
[45903ee884] - doc: add gurgunday to collaborators (Gürgün Dayıoğlu) #61094
[77faa14d99] - doc: mark --build-snapshot and --build-snapshot-config as stable (Joyee Cheung) #60954
[aefbe4ba47] - (SEMVER-MINOR) events: repurpose events.listenerCount() to accept EventTargets (René) #60214
[8470e2993b] - (SEMVER-MINOR) http: add http.setGlobalProxyFromEnv() (Joyee Cheung) #60953
[24384d7438] - meta: add Renegade334 to collaborators (Renegade334) #60714
[c1acef6d0f] - module: mark require(esm) as stable (Joyee Cheung) #60959
[2e39f3ed6b] - module: mark module compile cache as stable (Joyee Cheung) #60971
[e6a05cfb4f] - (SEMVER-MINOR) module: allow subpath imports that start with #/ (Jan Martin) #60864
[fa927c31da] - (SEMVER-MINOR) process: preserve AsyncLocalStorage in queueMicrotask only when needed (Gürgün Dayıoğlu) #60913
[bd0942f4f5] - (SEMVER-MINOR) stream: do not pass readable.compose() output via Readable.from() (René) #60907
[5051d90100] - (SEMVER-MINOR) util: add convertProcessSignalToExitCode utility (Erick Wendel) #60963
[408f024906] - v8: mark v8.queryObjects() as stable (Joyee Cheung) #60957

Commits

[e61cfdbf50] - assert: use a set instead of an array for faster lookup (Ruben Bridgewater) #61076
[11861084fd] - assert,util: improve comparison performance (Ruben Bridgewater) #61176
[4ef4f759cb] - assert,util: fix deep comparing invalid dates skipping properties (Ruben Bridgewater) #61076
[c8fccd585f] - assert,util: improve deep comparison performance (Ruben Bridgewater) #61076
[13661a0123] - benchmark: use boolean options in benchmark tests (SeokhunEom) #60129
[36dead3433] - benchmark: allow boolean option values (SeokhunEom) #60129
[376056eaef] - benchmark: add microbench on isInsideNodeModules (Chengzhong Wu) #60991
[22d3e85b7a] - benchmark: fix incorrect base64 input in byteLength benchmark (semimikoh) #60841
[5016f75522] - benchmark: use typescript for import cjs benchmark (Joyee Cheung) #60663
[012a08f6eb] - buffer: let Buffer.of use heap (Сковорода Никита Андреевич) #60503
[65696e42ba] - build: add --shared-hdr-histogram configure flag (Antoine du Hamel) #61280
[6155b8836e] - build: add --shared-gtest configure flag (Antoine du Hamel) #61279
[e80127f49c] - build: expose libplatform symbols in shared libnode (Joyee Cheung) #61144
[d99805049e] - build: fix inconsistent quoting in Makefile (Antoine du Hamel) #60511
[3213de08e8] - build: support building crates (temporal) on windows (沈鸿飞) #61163
[1ad8788391] - build: remove temporal updater (Chengzhong Wu) #61151
[e6e25d65be] - build: add --debug-symbols to build with -g without enabling DCHECKs (Joyee Cheung) #61100
[7040ec94c8] - build: update test-wpt-report to use NODE instead of OUT_NODE (Filip Skokan) #61024
[990da3518d] - build: skip build-ci on actions with a separate test step (Chengzhong Wu) #61073
[3259e395c9] - build: run embedtest with node_g when BUILDTYPE=Debug (Chengzhong Wu) #60850
[af42ca569f] - build: ignore built-in temporal when building with shared lib (Chengzhong Wu) #60703
[bec7fce07a] - build: add temporal_capi gyp (Chengzhong Wu) #60703
[d2f50047f7] - build: fix OpenSSL version parsing for OpenSSL < 3 (Richard Lau) #60775
[91b20c52df] - build: add flag to compile V8 with Temporal support (Antoine du Hamel) #60701
[0aaed248f0] - build: add support for Visual Studio 2026 (Michaël Zasso) #60727
[8f6fada8f1] - cli: add --require-module/--no-require-module (Joyee Cheung) #60959
[bf8e738df4] - cli: mark --heapsnapshot-near-heap-limit as stable (Joyee Cheung) #60956
[7930d7a19b] - crypto: update root certificates to NSS 3.117 (Node.js GitHub Bot) #60741
[1b15453602] - deps: update cjs-module-lexer to 2.2.0 (Node.js GitHub Bot) #61271
[118fa97c95] - deps: update nbytes to 0.1.2 (Node.js GitHub Bot) #61270
[9b136db814] - deps: update ngtcp2 to 1.19.0 (Node.js GitHub Bot) #61156
[5635f23a50] - deps: update nghttp3 to 1.14.0 (Node.js GitHub Bot) #61187
[9ec35c0977] - deps: update nghttp3 to 1.13.1 (Node.js GitHub Bot) #60046
[4d7d37f701] - deps: update timezone to 2025c (Node.js GitHub Bot) #61138
[2c1e3ab19d] - deps: nghttp2: revert 7784fa979d0b (Antoine du Hamel) #61136
[56a6513648] - deps: update nghttp2 to 1.68.0 (nodejs-github-bot) #61136
[f2692c5534] - deps: remove independent temporal (Chengzhong Wu) #61072
[3acbf3f129] - deps: apply cargo vendor (Chengzhong Wu) #61072
[d2759f4805] - deps: add vendor depenency crate (Chengzhong Wu) #61072
[6330385174] - deps: update simdjson to 4.2.4 (Node.js GitHub Bot) #61056
[9835860115] - deps: update googletest to 065127f1e4b46c5f14fc73cf8d323c221f9dc68e (Node.js GitHub Bot) #61055
[d2e6dff2f9] - deps: brotli: cherry-pick e230f474b87 (liujiahui) #61003
[27da9ca1c7] - deps: upgrade npm to 11.7.0 (npm team) #61011
[398ba68793] - deps: V8: cherry-pick 72b0e27bd936 (pthier) #60706
[a8ae3b9557] - deps: update sqlite to 3.51.1 (Node.js GitHub Bot) #60899
[4e1edae655] - deps: update zlib to 1.3.1-63d7e16 (Node.js GitHub Bot) #60898
[49b5954e74] - deps: update corepack to 0.34.5 (Node.js GitHub Bot) #60842
[6ae415361f] - deps: upgrade npm to 11.6.4 (npm team) #60853
[3cc857001a] - deps: add temporal_rs 0.1.0 (Chengzhong Wu) #60703
[660788cd4b] - deps: update sqlite to 3.51.0 (Node.js GitHub Bot) #60614
[c6d7a7b7cd] - deps: upgrade npm to 11.6.3 (npm team) #60785
[062e15bddf] - deps: update brotli to 1.2.0 (Node.js GitHub Bot) #60540
[db053988db] - deps: update simdjson to 4.2.2 (Node.js GitHub Bot) #60740
[ea5deab531] - deps: update googletest to 1b96fa13f549387b7549cc89e1a785cf143a1a50 (Node.js GitHub Bot) #60739
[c23f40cca4] - deps: update minimatch to 10.1.1 (Node.js GitHub Bot) #60543
[479c9290b9] - deps: update corepack to 0.34.4 (Node.js GitHub Bot) #60643
[e42911eddd] - deps: update inspector_protocol to 1b1bcbbe060e8c8cd8704f00f78978c50991 (Node.js GitHub Bot) #60705
[d908c83330] - deps: update cjs-module-lexer to 2.1.1 (Node.js GitHub Bot) #60646
[96530a4ca6] - deps: update simdjson to 4.2.1 (Node.js GitHub Bot) #60644
[6b0926ef20] - deps,src: prepare for cpplint update (Michaël Zasso) #60901
[5ed71efa3e] - doc: fix v25 changelog after security release (Marco Ippolito) #61371
[c2791069a2] - doc: correct description of error.stack accessor behavior (René) #61090
[134780c035] - doc: add documentation for process.traceProcessWarnings (Alireza Ebrahimkhani) #53641
[3b08efcebb] - doc: add sqlite session disposal method (René) #61273
[ec1847a097] - doc: fix filename typo (Hardanish Singh) #61297
[2c651ce460] - doc: fix typos and grammar in BUILDING.md & onboarding.md (Hardanish Singh) #61267
[28fe6ea4a8] - doc: mention --newVersion release script (Rafael Gonzaga) #61255
[2fb35d897d] - doc: correct typo in BUILDING doc (Mike McCready) #61261
[8dc2501a25] - doc: correct typo in api contributing doc (Mike McCready) #61260
[69e357a9d4] - doc: add PR-URL requirement for security backports (Rafael Gonzaga) #61256
[73326ae103] - doc: add reusePort error behavior to net module (mag123c) #61250
[67fbf4d371] - doc: note corepack package removal in distribution doc (Mike McCready) #61207
[0792859e49] - doc: fix tls.connect() timeout documentation (Azad Gupta) #61079
[72f42b9985] - doc: missing passed, error and passed properties on TestContext (Xavier Stouder) #61185
[f418fcc635] - doc: clarify threat model for application-level API exposure (Rafael Gonzaga) #61184
[bd4710769a] - doc: correct options for net.Socket class and socket.connect (Xavier Stouder) #61179
[387b65ca08] - doc: document error event on readline InterfaceConstructor (Xavier Stouder) #61170
[6d886e10e4] - doc: add a smooth scrolling effect to the sidebar (btea) #59007
[23fb3a64ec] - doc: fix test settime docs (Efe) #61117
[808eb437ee] - doc: correct invalid collaborator profile (JJ) #61091
[5e8eb5fe6c] - doc: add a tip about developer mode on Windows (Joyee Cheung) #61112
[a4248776da] - doc: exclude compile-time flag features from security policy (Matteo Collina) #61109
[44f61dfb92] - doc: add @avivkeller to collaborators (Aviv Keller) #61115
[08b5347b41] - doc: warn about short GCM tags visibly (Tobias Nießen) #61082
[45903ee884] - doc: add gurgunday to collaborators (Gürgün Dayıoğlu) #61094
[ce5d6e22ef] - doc: update MDN links (Livia Medeiros) #61062
[657cbd4af3] - doc: mark sync module hooks as release candidate (Joyee Cheung) #60960
[a46368a82b] - doc: reorganize docs of module customization hooks (Joyee Cheung) #60960
[9851278e99] - doc: mark crypto.hash as stable (Joyee Cheung) #60994
[77faa14d99] - doc: mark --build-snapshot and --build-snapshot-config as stable (Joyee Cheung) #60954
[6d5f9ffc6d] - doc: add File modes cross-references in fs methods (Mohit Raj Saxena) #60286
[521b25a27d] - doc: add missing zstd to mjs example of zlib (Deokjin Kim) #60915
[9a9bed9b3a] - doc: clarify fileURLToPath security considerations (Rafael Gonzaga) #60887
[bebb4731b1] - doc: show the use of string expressions in the SQLTagStore example (schliepa) #60873
[f247c24cb0] - doc: replace column with columnNumber in example of util.getCallSites (Deokjin Kim) #60881
[487c1080aa] - doc: correct spelling in BUILDING.md (Rich Trott) #60875
[5751e3f736] - doc: update debuglog examples to use 'foo-bar' instead of 'foo' (xiaoyao) #60867
[ec8336b7a0] - doc: correct 'event handle' to 'event handler' in Utf8Stream drop event (Riddhi) #60692
[95ef052751] - doc: fix typos in changelogs (Rich Trott) #60855
[a10b3130c6] - doc: mark module.register as active development (Chengzhong Wu) #60849
[bfe8c62a2d] - doc: add fullName property to SuiteContext (PaulyBearCoding) #60762
[2799f594e3] - doc: add additional codemods for deprecation (Augustin Mauroy) #60811
[2b51d5d113] - doc: keep sidebar module visible when navigating docs (Botato) #60410
[2fa9917b07] - doc: fix webstorage config file property (Marco Ippolito) #60798
[a0691d6eb6] - doc: correct concurrency wording in test() documentation (Azad Gupta) #60773
[d26842c523] - doc: clarify that CQ only picks up PRs targeting main (René) #60731
[3e84428ffe] - doc: clarify license section and add contributor note (KaleruMadhu) #60590
[745ea1d61f] - doc: correct and expand documentation for SQLTagStore (René) #60200
[a442c27c0a] - doc: correct tls ALPNProtocols types (René) #60143
[d90001a579] - doc: remove mention of SMS 2FA (Antoine du Hamel) #60707
[7525a3fa4b] - doc: add info about renamed flag in cli.md (Antoine du Hamel) #60690
[db0a86897b] - doc: fix incorrect slh-dsa oids in crypto.md (Artsiom Malakhau) #60681
[e5ede89a94] - doc: domain.add() does not accept timer objects (René) #60675
[36ba9d99ba] - Revert "doc, assert: correct order of changes entries" (Michaël Zasso) #60774
[e6e5ed7665] - doc,test: add documentation and test on how to use addons in SEA (Joyee Cheung) #59582
[f12eb28489] - esm: avoid throw when module specifier is not url (Craig Macomber (Microsoft)) #61000
[a7b92e0677] - esm: improve error messages for ambiguous module syntax (mag123c) #60376
[6da85b576b] - events: remove eventtarget custom inspect branding (Efe) #61128
[aefbe4ba47] - (SEMVER-MINOR) events: repurpose events.listenerCount() to accept EventTargets (René) #60214
[dc19409f36] - fs: validate statfs path (Efe) #61230
[206e353a4a] - fs: fix rmSync to handle non-ASCII characters (Yeaseen) #61108
[feee377b83] - fs: remove broken symlinks in rmSync (sangwook) #61040
[6b577c80bb] - fs: detect dot files when using globstar (Robin van Wijngaarden) #61012
[8470e2993b] - (SEMVER-MINOR) http: add http.setGlobalProxyFromEnv() (Joyee Cheung) #60953
[a731463a60] - http,https: fix double ERR_PROXY_TUNNEL emission (Shima Ryuhei) #60699
[b2736646b6] - http2,zlib: prefer call() over apply() if argument list is not array (Livia Medeiros) #60834
[86bce15e96] - lib: implement all 1-byte encodings in js (Сковорода Никита Андреевич) #61093
[8156738b97] - lib: gbk decoder is gb18030 decoder per spec (Сковорода Никита Андреевич) #61099
[d8f1dea0d3] - lib: enforce use of URLParse (Antoine du Hamel) #61016
[9023b3f9ce] - lib: add lint rules for reflective function calls (Antoine du Hamel) #60825
[2979113136] - lib: prefer call() over apply() if argument list is not array (Livia Medeiros) #60796
[2b36433f4a] - lib: add support for readable byte streams to .toWeb() (Hans Klunder) #58664
[1a0c3dddb9] - lib: use FastBuffer for empty buffer allocation (Gürgün Dayıoğlu) #60558
[9209cf67a4] - lib: refactor JWK import PQC support check (Filip Skokan) #60586
[42666c241a] - lib,src: isInsideNodeModules should test on the first non-internal frame (Chengzhong Wu) #60991
[4a22647609] - lib,src,test: fix tests without SQLite (Antoine du Hamel) #60906
[24795530bb] - lib,test: enforce use of assert.fail via a lint rule (Antoine du Hamel) #61004
[1977348ae0] - lib,test: fix jsdoc comments (Michaël Zasso) #60870
[3549cf14ce] - meta: remove t.js (RafaelGSS) #61369
[5cf54abad7] - meta: bump step-security/harden-runner from 2.13.2 to 2.14.0 (dependabot[bot]) #61245
[b57bab72e1] - meta: bump actions/setup-node from 6.0.0 to 6.1.0 (dependabot[bot]) #61244
[42117b5069] - meta: bump actions/cache from 4.3.0 to 5.0.1 (dependabot[bot]) #61243
[fee3edd38e] - meta: bump actions/download-artifact from 6.0.0 to 7.0.0 (dependabot[bot]) #61242
[a96c3160ff] - meta: bump github/codeql-action from 4.31.6 to 4.31.9 (dependabot[bot]) #61241
[b4233e18a9] - meta: bump codecov/codecov-action from 5.5.1 to 5.5.2 (dependabot[bot]) #61240
[c5d7dd3731] - meta: bump actions/checkout from 6.0.0 to 6.0.1 (dependabot[bot]) #61239
[d83cec1534] - meta

These notes run past the length kept in the archive. The rest is on the publisher’s page.