chore(mise): upgrade local tools

[ghappforreleaseplease]

Automated mise tool upgrades from local config.

Updated tools:

• action-validator
• actionlint
• aube
• editorconfig-checker
• ghalint
• node
• pinact
• pipx:gh-action-pulse
• prek
• rumdl
• shellcheck
• shfmt
• tombi
• uv
• yamlfmt
• yamllint
• zizmor

Command: mise upgrade --bump --local action-validator actionlint aube editorconfig-checker ghalint node pinact pipx:gh-action-pulse prek rumdl shellcheck shfmt tombi uv yamlfmt yamllint zizmor

Version changelog (node)

Tool	Requested	Installed
node	24 → 26	24.18.0 → 26.5.0

Release notes (1 tools)

node: `24.18.0` → `26.5.0` (nodejs/node)

v25.8.1

Notable Changes

• [ea87eea71a] - module: fix extensionless CJS files in "type": "module" packages (Matteo Collina) #62083

Commits

• [bab750d1b3] - build: do not depend on V8 deps on --without-bundled-v8 builds (Antoine du Hamel) #62033
• [b26d1c7fcb] - crypto: make --use-system-ca per-env rather than per-process (Aditi) #60678
• [e362635abf] - crypto: add missing AES dictionaries (Filip Skokan) #62099
• [6f975db8af] - crypto: fix importKey required argument count check (Filip Skokan) #62099
• [3beaf9c5fc] - deps: update amaro to 1.1.8 (Node.js GitHub Bot) #62151
• [53afb0edd8] - deps: update sqlite to 3.52.0 (Node.js GitHub Bot) #62150
• [a13ed052a1] - deps: update merve to 1.2.0 (Node.js GitHub Bot) #62149
• [2c850577b7] - deps: patch resb crate (Richard Lau) #62138
• [37862a6728] - deps: V8: cherry-pick aa0b288f87cc (Richard Lau) #62136
• [09191ad8b4] - deps:… (truncated)

v25.8.2

This is a security release.

Notable Changes

• (CVE-2026-21637) wrap SNICallback invocation in try/catch (Matteo Collina) - High
• (CVE-2026-21710) use null prototype for headersDistinct/trailersDistinct (Matteo Collina) - High
• (CVE-2026-21711) include permission check to pipe_wrap.cc (RafaelGSS) - Medium
• (CVE-2026-21712) handle url crash on different url formats (RafaelGSS) - Medium
• (CVE-2026-21713) use timing-safe comparison in Web Cryptography HMAC and KMAC (Filip Skokan) - Medium
• (CVE-2026-21714) handle NGHTTP2_ERR_FLOW_CONTROL error code (RafaelGSS) - Medium
• (CVE-2026-21717) test array index hash collision (Joyee Cheung) - Medium
• (CVE-2026-21715) add permission check to realpath.native (RafaelGSS) - Low
• (CVE-2026-21716) include permission check on lib/fs/promises (RafaelGSS) - Low

Commits

• [2086b7477b] - (CVE-2026-21717) build,test: test array index hash collision (Joyee Cheung) nodejs-private/node-private#834
• [0f9332a40a] - (CVE-2026-21713) crypto: use timing-safe comparison in Web Cryptography HMAC and KMAC (Filip Skokan) nodejs-private/node-private#822
• [2b6937ddb2] - deps: update undici to 7.24.4 (Node.js GitHub Bot) #62271
• [bfb8ad5787] - deps: update undici to 7.24.3 (Node.js GitHub Bot) #62233
• [be6384727f] - deps: upgrade npm to 11.11.1 (npm team) #62216
• [2feea5bb97] - deps: V8: override… (truncated)

v25.9.0

Notable Changes

Test runner module mocking improvements

MockModuleOptions.defaultExport and MockModuleOptions.namedExports have been
consolidated into a single option MockModuleOptions.exports to align with user
expectations and other test runners.

A default property on MockModuleOptions.exports represents the default
export, and own enumerable properties are treated as named exports.

An automated migration is available to update user code:
https://github.com/nodejs/userland-migrations/tree/main/recipes/mock-module-exports

npx codemod @​nodejs/mock-module-exports

Contributed by sangwook in #61727.

Other notable changes

• [312476cb84] - (SEMVER-MINOR) async_hooks: add using scopes to AsyncLocalStorage (Stephen Belanger) #61674
• [62d2cd473b] - (SEMVER-MINOR) cli: add --max-heap-size option (tannal) #58708
• [d0ebf0e44b] - (SEMVER-MINOR) crypto: add TurboSHAKE and KangarooTwelve Web Cryptography algorithms (Filip Skokan) #62183
• [f85b9d9fa8] - (SEMVER-MINOR) repl: add customizable error handling (Anna Henningsen) #62188
• [67b854d407] - (SEMVER-MINOR) repl: remove dependency on node:domain (Matteo Collina) #61227
• [966b700623] - (SEMVER-MINOR) sea: support code cache for ESM entrypoint in SEA (Joyee Cheung) #62158
  *… (truncated)

v26.0.0

We're excited to announce the release of Node.js 26! Highlights include the Temporal API enabled by default,
updates to the V8 JavaScript engine to 14.6, Undici to 8.0, and several important deprecations and removals
as we continue to modernize the platform.

As a reminder, Node.js 26 will enter long-term support (LTS) in October, but until then, it will be the "Current" release for the next six months.
We encourage you to explore the new features and benefits offered by this latest release and evaluate their potential impact on your applications.

Notable Changes

Temporal API

The Temporal API is now enabled by default in Node.js 26. Temporal is a modern date/time API for JavaScript
that provides a more robust and feature-rich alternative to the legacy Date object.

Contributed by Richard Lau in #61806.

V8 14.6

The V8 engine is updated to version 14.6.202.33, which is part of Chromium 134.

This version also includes:

• Upsert (https://github.com/tc39/proposal-upsert): [Weak]Map.prototype.getOrInsert(), [Weak]Map.prototype.getOrInsertComputed()
• Iterator sequencing (https://github.com/tc39/proposal-iterator-sequencing): Iterator.concat()

Contributed by Michaël Zasso in #61898.

Undici 8

Undici has been updated to version 8.0.2, bringing new features and improvements to Node.js's HTTP client implementation.

Deprecations and Removals

• [dff46c07c3] - (SEMVER-MAJOR) crypto: move DEP0182 to End-of-Life (Tobias Nießen) #61084
• [93c25815ee] - (SEMVER-MAJOR) http: move writeHeader to end-of-life (Sebastian Beltran) #60635

http.Server.prototype.writeHeader() is now fully removed. Use `http.Server.prototype.write… (truncated)

v26.1.0

Notable Changes

Experimental node:ffi module

Node.js now includes an experimental node:ffi module for loading dynamic
libraries and calling native symbols from JavaScript.

The API is gated behind the --experimental-ffi flag and, when the Permission
Model is enabled, requires --allow-ffi.

This API is inherently unsafe. Invalid pointers, incorrect signatures, or accessing memory
after it has been freed can crash the process or corrupt memory.

Contributed by Paolo Insogna in #62072.

Other Notable Changes

• [34a6454fe3] - (SEMVER-MINOR) buffer: add end parameter (Robert Nagy) #62390
• [073e84d7fe] - (SEMVER-MINOR) crypto: accept key data in crypto.diffieHellman() and cleanup DH jobs (Filip Skokan) #62527
• [5b9cb10a5f] - (SEMVER-MINOR) crypto: implement randomUUIDv7() (nabeel378) #62553
• [98f9becd16] - (SEMVER-MINOR) debugger: add edit-free runtime expression probes to node inspect (Joyee Cheung) #62713
• [06defaa2ea] - (SEMVER-MINOR) fs: add signal option to fs.stat() (Mert Can Altin) #57775
• [db66a963bf] - (SEMVER-MINOR) fs: expose frsize field in statfs (Jinho Jang) #62277
• [87adb3472b] - (SEMVER-MINOR) http: harden ClientRequest options merge (Matteo Collina) [fix: ship action bundle as index.cjs for ESM package type #6… (truncated)

v26.2.0

Notable Changes

• [189d43a193] - doc: mark stream.compose stable (Matteo Collina) #62562
• [f858c6140e] - (SEMVER-MINOR) fs: add Temporal.Instant support to Stats and BigIntStats (Livia Medeiros) #60789
• [0cbb3895df] - (SEMVER-MINOR) http: add writeInformation to send arbitrary 1xx status codes (Tim Perry) #63155

Commits

• [9a394bab84] - benchmark: respect stream/iter broadcast backpressure (Trivikram Kamat) #63314
• [ad98b4620b] - crypto: align verifyOneShot accepted types (Anshika Jain) #63280
• [ba0736a847] - crypto: wire ML-DSA and ML-KEM for use when using BoringSSL (Filip Skokan) #63255
• [5573a6a4a8] - crypto: wire ChaCha20-Poly1305 in Web Cryptography when using BoringSSL (Filip Skokan) #63255
• [7dc563b8d6] - crypto: wire AES-KW in Web Cryptography when using BoringSSL (Filip Skokan) #63255
• [b55e2b1f4d] - crypto: improve system certificate enumeration logic on macOS (Robo) #62576
• [fd509a755a] - crypto: harden CryptoKey algorithm slots… (truncated)

v26.3.0

Notable Changes

Potential changes to macOS Universal Binary availability

With Apple and its ecosystem progressively dropping support for Intel-based
architectures, it has become apparent that the Node.js project may not be able
to maintain the universal binaries we currently distribute for the full lifetime
of Node.js 26. This change serves to communicate that risk. At present, our
intention remains to continue shipping universal binaries supporting both Apple
Silicon and Intel-based Macs for as long as practical.

Contributed by Antoine du Hamel in #63055.

Other notable changes

• [a2a4b33dd8] - (SEMVER-MINOR) buffer: increase Buffer.poolSize default to 64 KiB (Matteo Collina) #63597
• [051a2152f7] - crypto: update root certificates to NSS 3.123.1 (Node.js GitHub Bot) #63527
• [49462eca37] - (SEMVER-MINOR) http: add httpValidation option to configure header value validation (RajeshKumar11) #61597
• [97b7ab19bd] - (SEMVER-MINOR) inspector: expose precise coverage start to JS runtime (sangwook) #63079
• [cfb80a2103] - (SEMVER-MINOR) lib,permission: add permission.drop (Rafael Gonzaga) #62672

Commits

• [a2a4b33dd8] - (SEMVER-MINOR) buffer: increase Buffer.poolSize default to 64 KiB (Matteo Collina) #63597
• [[0eff3e23b9](https://github.com/nodejs/n… (truncated)

v26.3.1

This is a security release.

Notable Changes

• (CVE-2026-48618) tls: normalize hostname for server identity checks (Matteo Collina) – High
• (CVE-2026-48933) crypto: guard WebCrypto cipher output length (Filip Skokan) – High
• (CVE-2026-48615) lib,test: redact proxy credentials in tunnel errors (Matteo Collina) – Medium
• (CVE-2026-48619) http2: cap originSet size to prevent unbounded memory growth (Matteo Collina) – Medium
• (CVE-2026-48928) tls: fix case-sensitive SNI context matching (Matteo Collina) – Medium
• (CVE-2026-48930) dns,net: reject hostnames with embedded NUL bytes (Matteo Collina) – Medium
• (CVE-2026-48934) tls: bind reusable sessions to authenticated host (Matteo Collina) – Medium
• (CVE-2026-48617) permission: handle process.chdir on writereport (RafaelGSS) – Low
• (CVE-2026-48931) http: fix response queue poisoning in http.Agent (Matteo Collina) – Low
• (CVE-2026-48935) permission: disable FileHandle utimes with permission model (RafaelGSS) – Low
• (CVE-2026-48936) permission: guard pipe open and chmod with net scope (RafaelGSS) – Low

Commits

• [98fbc89211] - (CVE-2026-48933) crypto: guard WebCrypto cipher output length (Filip Skokan) nodejs-private/node-private#878
• [110840f2c7] - deps: update llhttp to 9.4.2 (Antoine du Hamel) nodejs-private/node-private#890
• [8d36d522b2] - deps: update undici to 8.5.0 (Node.js GitHub Bot) #63903
• [2e6d03993a] - deps: update undici to 8.4.0 (Node.js GitHub Bot) #63779
• [5a17d5b07a] - **deps… (truncated)

v26.4.0

Notable Changes

• [cde0daabcc] - (SEMVER-MINOR) doc: update blockList stability status to release candidate (alphaleadership) #63050
• [b78f5a7537] - (SEMVER-MINOR) fs: support caller-supplied readFile() buffers (Matteo Collina) #63634
• [417aacbc36] - (SEMVER-MINOR) http: close pre-request sockets in closeIdleConnections (semimikoh) #63470
• [fbb108be7d] - (SEMVER-MINOR) loader: implement package maps (Maël Nison) #62239
• [45494d5a8a] - (SEMVER-MINOR) net: support TCP_KEEPINTVL and TCP_KEEPCNT in setKeepAlive (Guy Bedford) #63825
• [ee29465e77] - (SEMVER-MINOR) tls: add certificateCompression option (Tim Perry) #62217
• [b17817eb2b] - (SEMVER-MINOR) vfs: dispatch node:fs/promises to mounted VFS instances (Matteo Collina) #63537
• [7bc93a6ac5] - (SEMVER-MINOR) vfs: add minimal node:vfs subsystem (Matteo Collina) #63115

Commits

• [c7eb83b46a] - benchmark: add child_process async path baselines (Yagiz Nizipli) #63929
• [[066fff17a5](nodejs/node@066f… (truncated)

v26.5.0

Notable Changes

New release key

Welcome to our newest releaser, Stewart X Addison. Future Node.js releases may be signed with his release key, 655F3B5C1FB3FA8D1A0CA6BDE4A7D232B936D2FD.

Other notable changes

• [55f48446c7] - (SEMVER-MINOR) buffer: implement blob.textStream() (Matthew Aitken) #64036
• [b373202efc] - (SEMVER-MINOR) esm: add --experimental-import-text flag (Efe) #62300
• [39e0c14455] - (SEMVER-MINOR) perf_hooks: sample delay per event loop iteration (Pablo Erhard) #62935
• [999a83c937] - (SEMVER-MINOR) stream: expose ReadableStreamTee (Matteo Collina) #64195
• [4e0236dc3d] - (SEMVER-MINOR) tls: report negotiated TLS groups (Filip Skokan) #64119

Commits

• [87648c0a6c] - benchmark: trim down the argon2 sets (Filip Skokan) #64218
• [a483bfd3f0] - buffer: remove unreachable overflow check in atob (haramjeong) #60161
• [6d14279688] - buffer: add fast api for isUtf8 and isAscii (Gürgün Dayıoğlu) #64169
• [55f48446c7] -… (truncated)

Omitted 11 older releases.

Modified files:

• .mise.toml

[github-actions]

Commit-Check ✔️