Node.js 26.7.0 (Current)

Version 26.7.0 brings a set of minor-version changes across several subsystems. The crypto library receives two notable upgrades: a new API for pulling private keys from system stores and an updated root-certificate bundle based on NSS 3.125. At the same time, the core library adds perfetto support, a module hook for Symbol.dispose, and a test-runner option to include every file when measuring coverage. These updates are bundled with a range of dependency bumps, including npm 11.19.0 and several networking libraries.

For engineers handling TLS or other cryptographic operations, the new STORE loader means code can now delegate private-key retrieval to the operating system’s secure storage, reducing the need for manual key handling. Existing code that directly reads key files may need to be refactored to use the new loader interface, and any error-handling paths should be reviewed because the change also introduces more detailed OpenSSL error propagation. The root-certificate update improves trust chain verification out of the box, but applications that pin specific certificates might need to verify that the new bundle still matches their expectations.

Perfetto integration adds a built-in tracing pipeline that can be activated via runtime flags, allowing developers to capture detailed performance data without adding external libraries. However, enabling this feature requires the Node binary to be built with the perfetto-sdk, and the build process now mandates a Rust compiler version of at least 1.86, which could affect CI pipelines that still use older toolchains. Projects that compile Node from source will need to ensure their environment meets this Rust requirement, otherwise the build will fail.

The module system now recognizes Symbol.dispose in ModuleHooks, giving libraries a standardized way to run cleanup logic when a module is unloaded. Code that previously relied on custom teardown patterns can migrate to this hook for more predictable resource release. Additionally, the test runner gains a "--test-coverage-include-all" flag, which forces coverage collection across every test file, simplifying full-suite coverage reporting but potentially increasing runtime overhead for large test suites.

A broad set of dependency updates, such as newer versions of ngtcp2, nghttp3, minimatch, and SQLite, means that native addons and compiled modules may see binary compatibility shifts, prompting a rebuild of any C/C++ extensions. Documentation patches address grammar, missing references, and new API descriptions, helping developers understand the updated behaviors. Overall, the release is a collection of incremental improvements that require modest environment upgrades and code reviews to fully benefit from the new capabilities.