Node.js 26.9.0 (Current)

The Node.js version 26.9.0 includes several minor updates focused primarily on cryptographic functions, performance hooks, module loading integrations, and stream handling. Notable changes involve adding a generic MAC API in the crypto module, discovering ciphers and hashes from OpenSSL providers, and implementing experimental DTLS APIs. Performance-related updates include implementing Histogram meanCI API and adding CBOR export/import for histogram exchange within `perfhooks`. The release also incorporates updates from various contributors, touching upon file system operations, network protocols like HTTP2 and QUIC, and various V8 backports and utility improvements across the codebase.

The release reflects a concerted effort toward deepening the cryptographic security features of Node.js while simultaneously optimizing internal performance measurement capabilities. The focus on exposing OpenSSL provider information suggests a drive for transparency in cryptographic operations, but this must be balanced against potential security implications if not handled strictly by downstream consumers. The integration of experimental DTLS APIs and updates to stream handling, along with extensive work in `node:bench`, indicates an underlying architectural push toward more performant, interoperable network and memory management. The breadth of changes across the repository—touching filesystem operations, worker support, and internal V8 optimizations—suggests a holistic refactoring effort aiming for better integration between core subsystems. The tension lies in balancing this ambitious feature rollout with maintaining stability, especially given the complexity introduced by asynchronous and low-level memory handling. What is the risk of expanding interfaces like MAC APIs or performance hooks without fully locking down their security invariants? How does this focus on specific providers impact the broader promise of platform neutrality?