Compile cache goes read-only, TLS aborts become throws

The most substantial change of the period is the compile cache's new read-only mode [1]. The cache can now be populated once and then used without being written to, which matters for sandboxed or immutable runtimes where cache writes could fail or cause side effects. It also lets deployments bake a cache at build time and serve it read-only in production, eliminating per-process write contention.

Node also replaced a crash with a proper error: TLS connections configured with invalid ALPNProtocols used to abort the process, and now throw instead [2]. This is a breaking change in behavior, though it converts a hard process abort into a catchable exception. Elsewhere, the `--no-experimental-websocket` CLI flag was removed [3], and root certificates were updated to NSS 3.126 [4].

Performance work had a strong week. The EventTarget path gained a 10-20% speedup in one benchmark after inlining the iterationCondition hybrid dispatch closure [5], and webstreams encoding and iteration overhead was reduced [6]. The http ConnectionsList moved to intrusive lists [7], which typically reduces allocation pressure. fs also stopped stat()ing every entry in recursive readdir [8], and there is a fix for realpath of namespaced drive paths [9].

Streams and permissions each got correctness fixes. The stream helper to prevent eager draining of a source now shares state properly [10], and UDP handle adoption is guarded by the permission system [11]. Build tooling advanced too: the snapshot can now be built on top of a V8 startup blob [12], which simplifies embedding Node in custom environments.

The ecosystem and tooling repos moved with incremental updates: actions/setup-node bumped to 7.0.0 in amaro [13], step-security/harden-runner to 2.20.0 [14], changelog-maker shipped v5.0.0 [15], and the reliability report for 2026-08-24 landed [16]. The Node 26.8.1 Docker images also went out, and corepack is reshuffling package manager resolution, but those changes are still settling.