2026-10-07, Version 26.11.0 (Current)

.github/dependabot.yml

@@ -58,7 +58,8 @@ updates:
       semver-minor-days: 5
       semver-patch-days: 5
       exclude:
-        - '@node-core/doc-kit'
+        - '@doc-kit/*'
+        - '@node-core/*'
     commit-message:
       prefix: tools
     open-pull-requests-limit: 10

.github/label-pr-config.yml

@@ -15,6 +15,7 @@ subSystemLabels:
   /^src\/uv\./: c++, libuv
   /^src\/(?:connect(?:ion)?|pipe|tcp)_/: c++, net
   /^src\/node_os/: c++, os
+  /^src\/permission\//: c++, permission
   /^src\/(?:node_main|signal_)/: c++, process
   /^src\/timer[_s]/: c++, timers
   /^src\/node_root_certs/: c++, tls
@@ -102,6 +103,7 @@ subSystemLabels:
   /^lib\/test.js$/: test_runner
   /^lib\/v8.js$/: v8 module
   /^lib\/internal\/url\.js$/: whatwg-url
+  /^lib\/internal\/process\/permission\.js$/: permission
   /^lib\/internal\/modules\/esm/: esm
   /^lib\/internal\/modules/: module
   /^lib\/internal\/source_map/: source maps
@@ -116,6 +118,13 @@ subSystemLabels:
 
 exlusiveLabels:
   # More specific tests
+  /^test\/(?:parallel|sequential)\/test-(?:[^/]+-)?permission(?:-|\.)/: test, permission
+  /^test\/ffi\/test-ffi-permissions?(?:-|\.)/: test, permission
+  /^test\/addons\/no-addons\/permission\.js$/: test, addons, permission
+  /^test\/es-module\/test-[^/]*-permission(?:-|\.)/: test, esm, permission
+  /^test\/module-hooks\/test-[^/]*-permission(?:-|\.)/: test, module, loaders, permission
+  /^test\/fixtures\/permission\//: test, permission
+  /^test\/fixtures\/rc\/permission-namespace\.json$/: test, permission
   /^test\/addons\//: test, addons
   /^test\/debugger/: test, debugger
   /^test\/doctool\//: test, doc, tools
@@ -150,6 +159,7 @@ exlusiveLabels:
   # test_runner documentation
   /^doc\/api\/test.md$/: doc, test_runner
   # Automatically tag JS subsystem-specific API doc changes
+  /^doc\/api\/permissions\.md$/: doc, permission
   /^doc\/api\/(\w+)\.md$/: doc, $1
   # Add deprecations label to PRs that affect doc/api/deprecations.md
   /^doc\/api\/deprecations.md$/: doc, deprecations
@@ -162,6 +172,7 @@ exlusiveLabels:
   /^doc\//: doc
 
   # More specific benchmarks
+  /^benchmark\/fs\/readfile-permission-enabled\.js$/: benchmark, fs, permission
   /^benchmark\/buffers\//: benchmark, buffer
   /^benchmark\/es\//: benchmark, v8 engine
   /^benchmark\/_http/: benchmark, http
@@ -198,6 +209,7 @@ allJsSubSystems:
   - os
   - path
   - perf_hooks
+  - permission
   - process
   - punycode
   - querystring

.github/workflows/auto-start-ci.yml

@@ -1,6 +1,9 @@
 # This action uses the following secrets:
 #   JENKINS_USER: GitHub user whose Jenkins token is defined below
-#   JENKINS_TOKEN: Jenkins token, to be used to start CI
+#   JENKINS_TOKEN: Jenkins token, to be used to start or resume CI
+# Optional repository variables:
+#   AUTO_START_CI_BATCH_SIZE: maximum PRs to process per run (default: 5)
+#   AUTO_START_CI_MAX_WORKLOAD: pause at this many running or queued PR jobs (default: 15)
 name: Auto Start CI
 
 on:
@@ -30,16 +33,25 @@ jobs:
     steps:
       - name: Get Pull Requests
         id: get_prs_for_ci
-        run: >
-          echo "numbers=$(gh pr list \
+        # Explicit bash enables pipefail so jq cannot hide a failed gh query.
+        shell: bash
+        run: |
+          if ! [[ "$BATCH_SIZE" =~ ^[1-9][0-9]*$ ]]; then
+            echo '::error::AUTO_START_CI_BATCH_SIZE must be a strictly positive integer'
+            exit 1
+          fi
+          # Filter before selecting the batch; UNKNOWN mergeability is retried later.
+          numbers=$(gh pr list \
                   --repo "$GITHUB_REPOSITORY" \
-                  --label 'request-ci' \
-                  --json 'number' \
-                  --search 'review:approved' \
-                  -t '{{ range . }}{{ .number }} {{ end }}' \
-                  --limit 5)" >> "$GITHUB_OUTPUT"
+                  --json 'number,mergeable' \
+                  --search 'review:approved label:request-ci,resume-ci' \
+                  --limit 100 \
+                  | jq --argjson limit "$BATCH_SIZE" \
+                    '[.[] | select(.mergeable == "MERGEABLE") | .number] | .[:$limit] | map(tostring) | join(" ")' -r)
+          echo "numbers=$numbers" >> "$GITHUB_OUTPUT"
         env:
           GH_TOKEN: ${{ github.token }}
+          BATCH_SIZE: ${{ vars.AUTO_START_CI_BATCH_SIZE || '5' }}
   start-ci:
     permissions:
       checks: read
@@ -70,11 +82,12 @@ jobs:
           GH_TOKEN: ${{ github.token }}
           JENKINS_TOKEN: ${{ secrets.JENKINS_TOKEN }}
 
-      - name: Start the CI
+      - name: Start or resume the CI
         run: |
           read -r -a numbers <<< "$PULL_REQUESTS"
           curl -fsSL "https://github.com/${GITHUB_REPOSITORY}/raw/${GITHUB_SHA}/tools/actions/start-ci.sh" \
           | sh -s -- "${numbers[@]}"
         env:
           GH_TOKEN: ${{ github.token }}
           PULL_REQUESTS: ${{ needs.get-prs-for-ci.outputs.numbers }}
+          MAX_WORKLOAD: ${{ vars.AUTO_START_CI_MAX_WORKLOAD || '15' }}

.github/workflows/benchmark.yml

@@ -121,15 +121,11 @@ jobs:
             --pure --keep TAR_DIR --keep FLAKY_TESTS \
             --keep SCCACHE_GHA_ENABLED --keep SCCACHE_GHA_RW_MODE \
             --keep ACTIONS_CACHE_SERVICE_V2 --keep ACTIONS_RESULTS_URL --keep ACTIONS_RUNTIME_TOKEN \
-            --arg useSeparateDerivationForV8 true \
             --arg withPerfetto ${{ matrix.perfetto || false }} \
-            --arg loadJSBuiltinsDynamically false \
             --arg ccache '(import <nixpkgs> {}).sccache' \
-            --arg devTools '[]' \
-            --arg benchmarkTools '[]' \
             --run '
               make build-ci -j4 V=1 && sccache --stop-server
-            '
+            ' tools/nix/ci-shell.nix
           mv out/Release/node base_node
 
       - name: Checkout the merge commit
@@ -141,15 +137,11 @@ jobs:
           nix-shell \
             -I nixpkgs=./tools/nix/pkgs.nix \
             --pure --keep SCCACHE_LOCAL_RW_MODE \
-            --arg useSeparateDerivationForV8 true \
             --arg withPerfetto ${{ matrix.perfetto || false }} \
-            --arg loadJSBuiltinsDynamically false \
             --arg ccache '(import <nixpkgs> {}).sccache' \
-            --arg devTools '[]' \
-            --arg benchmarkTools '[]' \
             --run '
                 make build-ci -j4 V=1
-            '
+            ' tools/nix/ci-shell.nix
         env:
           SCCACHE_LOCAL_RW_MODE: READ_ONLY
 
@@ -232,7 +224,7 @@ jobs:
           nix-shell \
             -I nixpkgs=./tools/nix/pkgs.nix \
             --pure \
-            -E '(import <nixpkgs> {}).mkShell { buildInputs = import ./tools/nix/benchmarkTools.nix { withHttpBenchmarkDeps = false; }; }' \
+            -E '(import <nixpkgs> {}).mkShellNoCC { buildInputs = import ./tools/nix/benchmarkTools.nix { withHttpBenchmarkDeps = false; }; }' \
             --run '
                 export LC_ALL=C.UTF-8
                 echo "> [!WARNING] "

.github/workflows/build-shared.yml

@@ -85,12 +85,9 @@ jobs:
             -I "nixpkgs=$TAR_DIR/tools/nix/pkgs.nix" \
             --pure --keep TAR_DIR --keep FLAKY_TESTS \
             --keep SCCACHE_GHA_ENABLED --keep ACTIONS_CACHE_SERVICE_V2 --keep ACTIONS_RESULTS_URL --keep ACTIONS_RUNTIME_TOKEN \
-            --arg loadJSBuiltinsDynamically false \
             --arg ccache "${NIX_SCCACHE:-null}" \
-            --arg devTools '[]' \
-            --arg benchmarkTools '[]' \
             --arg pkcs11 ${{ inputs.pkcs11-store-test }} \
             ${{ inputs.extra-nix-flags }} \
             --run '
                 make -C "$TAR_DIR" run-ci -j4 V=1 TEST_CI_ARGS="-p actions --measure-flakiness 9 --skip-tests=$CI_SKIP_TESTS"
-            ' "$TAR_DIR/shell.nix"
+            ' "$TAR_DIR/tools/nix/ci-shell.nix"

.github/workflows/build-tarball.yml

@@ -67,6 +67,7 @@ env:
   PYTHON_VERSION: '3.14'
   FLAKY_TESTS: keep_retrying
   CLANG_VERSION: '19'
+  NODE_VERSION: lts/*
 
 permissions:
   contents: read
@@ -84,12 +85,16 @@ jobs:
         with:
           python-version: ${{ env.PYTHON_VERSION }}
           allow-prereleases: true
+      - name: Use Node.js ${{ env.NODE_VERSION }}
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020  # v7.0.0
+        with:
+          node-version: ${{ env.NODE_VERSION }}
       - name: Make tarball
         run: |
           export DISTTYPE=nightly
           export DATESTRING=$(date "+%Y-%m-%d")
           export COMMIT=$(git rev-parse --short=10 "$GITHUB_SHA")
-          ./configure && make tar -j4 SKIP_XZ=1
+          ./configure && make tar -j4 SKIP_XZ=1 GZIP_COMPRESSION=6
       - name: Upload tarball artifact
         uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7.0.1
         with:

.github/workflows/codeql.yml

@@ -30,15 +30,15 @@ jobs:
 
       # Initializes the CodeQL tools for scanning.
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@b96794f015dfd88f77b49b1c93e0fa7110f94c63  # v4.38.0
+        uses: github/codeql-action/init@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2  # v4.38.2
         with:
           languages: ${{ matrix.language }}
           config-file: ./.github/codeql-config.yml
 
       - name: Autobuild
-        uses: github/codeql-action/autobuild@b96794f015dfd88f77b49b1c93e0fa7110f94c63  # v4.38.0
+        uses: github/codeql-action/autobuild@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2  # v4.38.2
 
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@b96794f015dfd88f77b49b1c93e0fa7110f94c63  # v4.38.0
+        uses: github/codeql-action/analyze@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2  # v4.38.2
         with:
           category: /language:${{matrix.language}}

.github/workflows/coverage-linux-without-intl.yml

@@ -85,6 +85,6 @@ jobs:
       - name: Clean tmp
         run: rm -rf coverage/tmp && rm -rf out
       - name: Upload
-        uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f  # v7.0.0
+        uses: codecov/codecov-action@0b35c9ecc4f0529d0eb674914510c22f85b196b4  # v7.1.0
         with:
           directory: ./coverage

.github/workflows/coverage-linux.yml

@@ -85,6 +85,6 @@ jobs:
       - name: Clean tmp
         run: rm -rf coverage/tmp && rm -rf out
       - name: Upload
-        uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f  # v7.0.0
+        uses: codecov/codecov-action@0b35c9ecc4f0529d0eb674914510c22f85b196b4  # v7.1.0
         with:
           directory: ./coverage

.github/workflows/coverage-windows.yml

@@ -101,6 +101,6 @@ jobs:
       - name: Clean tmp
         run: npx rimraf ./coverage/tmp
       - name: Upload
-        uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f  # v7.0.0
+        uses: codecov/codecov-action@0b35c9ecc4f0529d0eb674914510c22f85b196b4  # v7.1.0
         with:
           directory: ./coverage

.github/workflows/linters.yml

@@ -41,6 +41,12 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
           persist-credentials: false
+          # Skip large vendored trees that lint-cpp does not use.
+          sparse-checkout: |
+            /*
+            !/deps/openssl/
+            !/deps/v8/
+          sparse-checkout-cone-mode: false
       - name: Set up Python ${{ env.PYTHON_VERSION }}
         uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97  # v7.0.0
         with:
@@ -54,7 +60,8 @@ jobs:
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
-          fetch-depth: 0
+          # The first parent of the PR merge commit is the base branch commit.
+          fetch-depth: 2
           persist-credentials: false
       - name: Use Node.js ${{ env.NODE_VERSION }}
         uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020  # v7.0.0
@@ -72,7 +79,7 @@ jobs:
           # because it is irrelevant. We already check if the formatter produced
           # a diff in the next line.
           # Refs: https://github.com/nodejs/node/pull/42764
-          CLANG_FORMAT_START="$(git merge-base HEAD refs/remotes/origin/$GITHUB_BASE_REF)" \
+          CLANG_FORMAT_START=HEAD^ \
             make format-cpp || true
           git --no-pager diff --exit-code && EXIT_CODE="$?" || EXIT_CODE="$?"
           if [ "$EXIT_CODE" != "0" ]
@@ -93,13 +100,29 @@ jobs:
         with:
           persist-credentials: false
       - name: Use Node.js ${{ env.NODE_VERSION }}
+        id: setup-node
         uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020  # v7.0.0
         with:
           node-version: ${{ env.NODE_VERSION }}
+          cache: npm
+          cache-dependency-path: |
+            tools/doc/package-lock.json
+            tools/eslint/package-lock.json
+            tools/lint-md/package-lock.json
+      - name: Cache ESLint results
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9  # v6.1.0
+        env:
+          # ESLint only invalidates its cache on config changes, so the key also
+          # covers the custom rules and the files they read.
+          cache-prefix: eslint-${{ runner.os }}-${{ steps.setup-node.outputs.node-version }}-${{ hashFiles('eslint.config.mjs', '*/eslint.config_partial.mjs', 'tools/eslint/*', 'tools/eslint-rules/**', 'doc/api/errors.md', 'doc/api/deprecations.md') }}
+        with:
+          path: .eslintcache
+          key: ${{ env.cache-prefix }}-${{ github.sha }}
+          restore-keys: ${{ env.cache-prefix }}-
       - name: Lint JavaScript files
         run: |
           set +e
-          NODE=$(command -v node) make lint-js
+          NODE=$(command -v node) make lint-js ESLINT_CACHE_FLAGS='--cache --cache-strategy content'
           EXIT_CODE="$?"
           if [ "$EXIT_CODE" != "0" ]; then
             echo
@@ -129,7 +152,7 @@ jobs:
       - name: Lint markdown files
         run: |
           echo "::add-matcher::.github/workflows/remark-lint-problem-matcher.json"
-          NODE=$(command -v node) make lint-md
+          NODE=$(command -v node) make lint-md ESLINT_CACHE_FLAGS='--cache --cache-strategy content'
         env:
           NODE_RELEASED_VERSIONS: ${{ steps.get-released-versions.outputs.NODE_RELEASED_VERSIONS }}
 

.github/workflows/nix-changes.yml

@@ -68,10 +68,16 @@ jobs:
 
       - name: Compute requisites before change
         run: |
-          git reset HEAD^ --hard
-          # TODO(aduh95): remove this once list-requisites.sh has reached `main`
-          [ -f tools/nix/list-requisites.sh ] || git checkout FETCH_HEAD -- tools/nix/list-requisites.sh
+          BASE_SHA="$(git rev-parse HEAD^)"
+          if [ -n "$PUSH_BEFORE_SHA" ] && [ "$PUSH_BEFORE_SHA" != "$BASE_SHA" ] \
+            && [ "$PUSH_BEFORE_SHA" != "0000000000000000000000000000000000000000" ] \
+            && git fetch --no-tags --depth=1 origin "$PUSH_BEFORE_SHA"; then
+            BASE_SHA="$PUSH_BEFORE_SHA"
+          fi
+          git reset "$BASE_SHA" --hard
           ./tools/nix/list-requisites.sh > requisites-${{ matrix.system }}-before.list
+        env:
+          PUSH_BEFORE_SHA: ${{ github.event_name == 'push' && github.event.before || '' }}
 
       - name: Output diff
         run: |

.github/workflows/scorecard.yml

@@ -76,6 +76,6 @@ jobs:
 
       # Upload the results to GitHub's code scanning dashboard.
       - name: Upload to code-scanning
-        uses: github/codeql-action/upload-sarif@b96794f015dfd88f77b49b1c93e0fa7110f94c63  # v4.38.0
+        uses: github/codeql-action/upload-sarif@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2  # v4.38.2
         with:
           sarif_file: results.sarif

.github/workflows/test-linux-perfetto.yml

@@ -62,6 +62,9 @@ jobs:
       - name: Build
         working-directory: node
         run: make build-ci -j4 V=1 CONFIG_FLAGS="--error-on-warn --v8-enable-temporal-support --with-perfetto"
+      - name: Get trace_processor
+        working-directory: node
+        run: make tools/perfetto/trace_processor_shell
       - name: Test
         working-directory: node
         run: make test-ci -j1 V=1 TEST_CI_ARGS="-p actions --measure-flakiness 9"