This is a security release.
Notable changes:
crypto:
* (CVE-2026-21713) use timing-safe comparison in Web Cryptography HMAC
deps:
* update undici to v6.24.1
* (CVE-2026-21717) fix array index hash collision
http:
* (CVE-2026-21710) use null prototype for headersDistinct/trailersDistinct
permission:
* (CVE-2026-21716) include permission check on lib/fs/promises
* (CVE-2026-21715) add permission check to realpath.native
src:
* (CVE-2026-21714) handle NGHTTP2_ERR_FLOW_CONTROL error code
tls:
* (CVE-2026-21637) wrap SNICallback invocation in try/catch
PR-URL: https://github.com/nodejs-private/node-private/pull/842
3626fea570