2026-03-11, Version 25.8.1 (Current)

.github/workflows/build-tarball.yml

@@ -91,7 +91,7 @@ jobs:
           export COMMIT=$(git rev-parse --short=10 "$GITHUB_SHA")
           ./configure && make tar -j4 SKIP_XZ=1
       - name: Upload tarball artifact
-        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f  # v6.0.0
+        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f  # v7.0.0
         with:
           name: tarballs
           path: '*.tar.gz'
@@ -127,7 +127,7 @@ jobs:
       - name: Environment Information
         run: npx envinfo
       - name: Download tarball
-        uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131  # v7.0.0
+        uses: actions/download-artifact@70fc10c6e5e1ce46ad2ea6f2b72d43f7d47b13c3  # v8.0.0
         with:
           name: tarballs
           path: tarballs

.github/workflows/daily-wpt-fyi.yml

@@ -49,7 +49,7 @@ jobs:
       # install a version and checkout
       - name: Get latest nightly
         if: matrix.node-version == 'latest-nightly'
-        run: echo "NIGHTLY=$(curl -s https://nodejs.org/download/nightly/index.json | jq -r '[.[] | select(.files[] | contains("linux-x64"))][0].version')" >> $GITHUB_ENV
+        run: echo "NIGHTLY=$(curl -s https://nodejs.org/download/nightly/index.json | jq -r '[.[] | select(.files[] | contains("linux-arm64"))][0].version')" >> $GITHUB_ENV
       - name: Install Node.js
         id: setup-node
         uses: actions/setup-node@6044e13b5dc448c55e2357c09f80417699197238  # v6.2.0
@@ -103,7 +103,7 @@ jobs:
         run: cp wptreport.json wptreport-${{ steps.setup-node.outputs.node-version }}.json
       - name: Upload GitHub Actions artifact
         if: ${{ env.WPT_REPORT != '' }}
-        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f  # v6.0.0
+        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f  # v7.0.0
         with:
           path: out/wpt/wptreport-*.json
           name: WPT Report for ${{ steps.setup-node.outputs.node-version }}

.github/workflows/doc.yml

@@ -35,7 +35,7 @@ jobs:
         run: npx envinfo
       - name: Build
         run: NODE=$(command -v node) make doc-only
-      - uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f  # v6.0.0
+      - uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f  # v7.0.0
         with:
           name: docs
           path: out/doc

.github/workflows/scorecard.yml

@@ -35,7 +35,7 @@ jobs:
 
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@5ef0c079ce82195b2a36a210272d6b661572d83e  # v2.14.2
+        uses: step-security/harden-runner@a90bcbc6539c36a85cdfeb73f7e2f433735f215b  # v2.15.0
         with:
           egress-policy: audit  # TODO: change to 'egress-policy: block' after couple of runs
 
@@ -67,7 +67,7 @@ jobs:
       # Upload the results as artifacts (optional). Commenting out will disable uploads of run results in SARIF
       # format to the repository Actions tab.
       - name: Upload artifact
-        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f  # v6.0.0
+        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f  # v7.0.0
         with:
           name: SARIF file
           path: results.sarif

.github/workflows/test-shared.yml

@@ -130,7 +130,7 @@ jobs:
 
       - name: Upload tarball artifact
         if: ${{ github.event_name != 'workflow_dispatch' }}
-        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f  # v6.0.0
+        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f  # v7.0.0
         with:
           name: tarballs
           path: '*.tar.gz'
@@ -153,7 +153,7 @@ jobs:
     name: '${{ matrix.system }}: with shared libraries'
     runs-on: ${{ matrix.runner }}
     steps:
-      - uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131  # v7.0.0
+      - uses: actions/download-artifact@70fc10c6e5e1ce46ad2ea6f2b72d43f7d47b13c3  # v8.0.0
         if: ${{ github.event_name != 'workflow_dispatch' }}
         with:
           name: tarballs

.github/workflows/timezone-update.yml

@@ -16,7 +16,8 @@ jobs:
       pull-requests: write  # to create a PR (gr2m/create-or-update-pull-request-action)
 
     if: github.repository == 'nodejs/node'
-    runs-on: ubuntu-slim
+    # cannot use ubuntu-slim here because it does not have icupkg
+    runs-on: ubuntu-latest
 
     steps:
       - name: Checkout nodejs/node

CHANGELOG.md

@@ -41,7 +41,8 @@ release.
 </tr>
 <tr>
   <td valign="top">
-<b><a href="doc/changelogs/CHANGELOG_V25.md#25.8.0">25.8.0</a></b><br/>
+<b><a href="doc/changelogs/CHANGELOG_V25.md#25.8.1">25.8.1</a></b><br/>
+<a href="doc/changelogs/CHANGELOG_V25.md#25.8.0">25.8.0</a><br/>
 <a href="doc/changelogs/CHANGELOG_V25.md#25.7.0">25.7.0</a><br/>
 <a href="doc/changelogs/CHANGELOG_V25.md#25.6.1">25.6.1</a><br/>
 <a href="doc/changelogs/CHANGELOG_V25.md#25.6.0">25.6.0</a><br/>

README.md

@@ -757,6 +757,8 @@ maintaining the Node.js project.
   **Oliver Medhurst** <<honk@goose.icu>> (they/them)
 * [daeyeon](https://github.com/daeyeon) -
   **Daeyeon Jeong** <<daeyeon.dev@gmail.com>> (he/him)
+* [efekrskl](https://github.com/efekrskl) -
+  **Efe Karasakal** <<hi@efe.dev>> (he/him)
 * [gireeshpunathil](https://github.com/gireeshpunathil) -
   **Gireesh Punathil** <<gpunathi@in.ibm.com>> (he/him)
 * [gurgunday](https://github.com/gurgunday) -

common.gypi

@@ -38,7 +38,7 @@
 
     # Reset this number to 0 on major V8 upgrades.
     # Increment by one for each non-official patch applied to deps/v8.
-    'v8_embedder_string': '-node.20',
+    'v8_embedder_string': '-node.21',
 
     ##### V8 defaults for Node.js #####
 

deps/ada/ada.cpp

@@ -1,4 +1,4 @@
-/* auto-generated on 2026-01-30 13:29:04 -0500. Do not edit! */
+/* auto-generated on 2026-02-23 21:29:24 -0500. Do not edit! */
 /* begin file src/ada.cpp */
 #include "ada.h"
 /* begin file src/checkers.cpp */
@@ -14495,6 +14495,12 @@ bool url_aggregator::set_pathname(const std::string_view input) {
   if (get_pathname().starts_with("//") && !has_authority() && !has_dash_dot()) {
     buffer.insert(components.pathname_start, "/.");
     components.pathname_start += 2;
+    if (components.search_start != url_components::omitted) {
+      components.search_start += 2;
+    }
+    if (components.hash_start != url_components::omitted) {
+      components.hash_start += 2;
+    }
   }
   ADA_ASSERT_TRUE(validate());
   return true;

deps/ada/ada.h

@@ -1,4 +1,4 @@
-/* auto-generated on 2026-01-30 13:29:04 -0500. Do not edit! */
+/* auto-generated on 2026-02-23 21:29:24 -0500. Do not edit! */
 /* begin file include/ada.h */
 /**
  * @file ada.h
@@ -8091,6 +8091,12 @@ inline void url_aggregator::update_base_pathname(const std::string_view input) {
     // output.
     buffer.insert(components.pathname_start, "/.");
     components.pathname_start += 2;
+    if (components.search_start != url_components::omitted) {
+      components.search_start += 2;
+    }
+    if (components.hash_start != url_components::omitted) {
+      components.hash_start += 2;
+    }
   }
 
   uint32_t difference = replace_and_resize(
@@ -9530,13 +9536,14 @@ url_pattern_component<regex_provider>::create_component_match_result(
   auto result =
       url_pattern_component_result{.input = std::move(input), .groups = {}};
 
-  // Optimization: Let's reserve the size.
-  result.groups.reserve(exec_result.size());
-
   // We explicitly start iterating from 0 even though the spec
   // says we should start from 1. This case is handled by the
-  // std_regex_provider.
-  for (size_t index = 0; index < exec_result.size(); index++) {
+  // std_regex_provider which removes the full match from index 0.
+  // Use min() to guard against potential mismatches between
+  // exec_result size and group_name_list size.
+  const size_t size = std::min(exec_result.size(), group_name_list.size());
+  result.groups.reserve(size);
+  for (size_t index = 0; index < size; index++) {
     result.groups.emplace(group_name_list[index],
                           std::move(exec_result[index]));
   }
@@ -11221,14 +11228,14 @@ constructor_string_parser<regex_provider>::parse(std::string_view input) {
 #ifndef ADA_ADA_VERSION_H
 #define ADA_ADA_VERSION_H
 
-#define ADA_VERSION "3.4.2"
+#define ADA_VERSION "3.4.3"
 
 namespace ada {
 
 enum {
   ADA_VERSION_MAJOR = 3,
   ADA_VERSION_MINOR = 4,
-  ADA_VERSION_REVISION = 2,
+  ADA_VERSION_REVISION = 3,
 };
 
 }  // namespace ada

deps/amaro/README.md

@@ -41,11 +41,31 @@ node --import="amaro/strip" file.ts
 Enabling TypeScript feature transformation:
 
 ```bash
-node --experimental-transform-types --import="amaro/transform" file.ts
+node --enable-source-maps --import="amaro/transform" file.ts
 ```
 
-> Note that the "amaro/transform" loader should be used with `--experimental-transform-types` flag, or
-> at least with `--enable-source-maps` flag, to preserve the original source maps.
+> Note that the `amaro/transform` loader should be used with `--enable-source-maps`
+> to preserve accurate source-mapped stack traces.
+
+#### Programmatic registration with `module.register()`
+
+If you want TypeScript to "just work" in an existing codebase without passing `--import` every time, create a small bootstrap file and register Amaro once before loading your TS entrypoint.
+
+```mjs
+// bootstrap.mjs
+import { register } from "node:module";
+
+register("amaro/strip", import.meta.url);
+await import("./src/index.ts");
+```
+
+Then start your app through the bootstrap file:
+
+```bash
+node --watch ./bootstrap.mjs
+```
+
+For transform mode, swap `amaro/strip` with `amaro/transform` and run Node with `--enable-source-maps`.
 
 #### Type stripping in dependencies
 

deps/amaro/dist/package.json

@@ -4,7 +4,7 @@
     "강동윤 <kdy1997.dev@gmail.com>"
   ],
   "description": "wasm module for swc",
-  "version": "1.15.11",
+  "version": "1.15.18",
   "license": "Apache-2.0",
   "repository": {
     "type": "git",

deps/amaro/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "amaro",
-	"version": "1.1.7",
+	"version": "1.1.8",
 	"description": "Node.js TypeScript wrapper",
 	"license": "MIT",
 	"type": "commonjs",

deps/crates/Cargo.toml

@@ -30,3 +30,7 @@ version = "=0.1.0"
 default-features = false
 # This is necessary to enable a spec-compliance quirk when upgrading to v0.1.2
 # features = ["float64_representable_durations"]
+
+[patch.crates-io]
+# Float https://github.com/unicode-org/icu4x/pull/7658 until crate is updated.
+resb = { path="patches/resb" }

deps/crates/vendor/resb/src/binary.rs → deps/crates/patches/resb/src/binary.rs

@@ -473,7 +473,7 @@ fn read_u16(input: &[u8]) -> Result<(u16, &[u8]), BinaryDeserializerError> {
     let bytes = get_subslice(input, ..core::mem::size_of::<u16>())?
         .try_into()
         .unwrap();
-    let value = u16::from_le_bytes(bytes);
+    let value = u16::from_ne_bytes(bytes);
 
     let rest = get_subslice(input, core::mem::size_of::<u16>()..)?;
     Ok((value, rest))

deps/crates/vendor/resb/src/binary/deserializer.rs → deps/crates/patches/resb/src/binary/deserializer.rs

@@ -23,6 +23,11 @@ const SYSTEM_CHARSET_FAMILY: CharsetFamily = CharsetFamily::Ascii;
 
 /// Deserializes an instance of type `T` from bytes representing a binary ICU
 /// resource bundle.
+///
+/// The input data must be in the platform's native endianness. ICU4C resource
+/// bundles such as `zoneinfo64.res` are generated in both little endian and
+/// big endian formats; callers must ensure the appropriate format is provided
+/// for the target platform.
 pub fn from_words<'a, T>(input: &'a [u32]) -> Result<T, BinaryDeserializerError>
 where
     T: Deserialize<'a>,
@@ -142,7 +147,7 @@ impl<'de> ResourceTreeDeserializer<'de> {
                 ))
             }
         };
-        let descriptor = u32::from_le_bytes(descriptor);
+        let descriptor = u32::from_ne_bytes(descriptor);
 
         ResDescriptor::try_from(descriptor)
     }
@@ -887,7 +892,7 @@ impl<'de> Resource16BitDeserializer<'de> {
             // exactly 2 bytes.
             #[expect(clippy::unwrap_used)]
             let bytes = <[u8; 2]>::try_from(bytes).unwrap();
-            u16::from_le_bytes(bytes)
+            u16::from_ne_bytes(bytes)
         });
 
         char::decode_utf16(units)
@@ -1255,7 +1260,7 @@ fn read_u32(input: &[u8]) -> Result<(u32, &[u8]), BinaryDeserializerError> {
         ))?
         .try_into()
         .unwrap();
-    let value = u32::from_le_bytes(bytes);
+    let value = u32::from_ne_bytes(bytes);
 
     let rest =
         input

deps/crates/vendor/resb/src/binary/header.rs → deps/crates/patches/resb/src/binary/header.rs

@@ -113,11 +113,8 @@ impl TryFrom<&[u8]> for BinReprInfo {
         let (size, value) = read_u16(value)?;
         let (reserved_word, value) = read_u16(value)?;
 
-        // While the consumer is responsible for verifying acceptability of most
-        // contents of the repr info, we explicitly depend on little endian data
-        // in order to ensure compatibility with `zerovec`.
         let (endianness, value) = (Endianness::try_from(value[0])?, &value[1..]);
-        if endianness != Endianness::Little {
+        if (endianness == Endianness::Little) != cfg!(target_endian = "little") {
             return Err(BinaryDeserializerError::unsupported_format(
                 "big-endian bundles are not supported",
             ));