@@ -9,7 +9,7 @@ on:
     # optimistic, it can take longer to run.
     # To understand why `schedule` is used instead of other events, refer to
     # ./doc/contributing/commit-queue.md
-    - cron: '*/5 * * * *'
+    - cron: 3/5 * * * *
 
 concurrency: ${{ github.workflow }}
 
 
@@ -11,7 +11,7 @@ on:
   # be read-only, and the Action won't have access to any other repository
   # secrets, which it needs to access Jenkins API.
   schedule:
-    - cron: '*/5 * * * *'
+    - cron: 3/5 * * * *
 
 concurrency: ${{ github.workflow }}
 
@@ -28,6 +28,7 @@ jobs:
     if: github.repository == 'nodejs/node'
     runs-on: ubuntu-slim
     outputs:
+      aged_prs: ${{ steps.get_candidate_prs.outputs.aged_prs }}
       candidates: ${{ steps.get_candidate_prs.outputs.candidates }}
     steps:
       - name: Get Pull Request Candidates
@@ -50,6 +51,7 @@ jobs:
                   --search "-label:blocked")
           candidates=$(printf '%s %s\n' "$fast_track_prs" "$aged_prs" |
                   jq -r -s 'reduce .[] as $pr ([]; if index($pr) then . else . + [$pr] end) | join(" ")')
+          echo "aged_prs=$aged_prs" >> "$GITHUB_OUTPUT"
           echo "candidates=$candidates" >> "$GITHUB_OUTPUT"
         env:
           GH_TOKEN: ${{ github.token }}
@@ -93,6 +95,7 @@ jobs:
           curl -fsSLo "$readme" "https://github.com/${GITHUB_REPOSITORY}/raw/${GITHUB_SHA}/README.md"
 
           numbers=
+          lacks_second_approval_prs=
           # shellcheck disable=SC2086
           for pr in $CANDIDATES; do
             metadata="${RUNNER_TEMP}/metadata-${pr}.json"
@@ -139,6 +142,14 @@ jobs:
             if [ "$metadata_status" -ge 20 ] && [ "$metadata_status" -le 29 ]; then
               echo "pr ${pr} skipped, not ready to land"
               echo "reason codes: ${metadata_reason_codes}"
+              if jq -e '
+                    (.reasonCodes | index("wait-time")) and
+                    (.pullRequest.labels | index("lacks-second-approval") | not)
+                  ' "$metadata" > /dev/null; then
+                case " $AGED_PRS " in
+                  *" $pr "*) lacks_second_approval_prs="$lacks_second_approval_prs $pr" ;;
+                esac
+              fi
               continue
             fi
 
@@ -148,11 +159,27 @@ jobs:
           done
 
           numbers=$(echo "$numbers" | xargs)
+          lacks_second_approval_prs=$(echo "$lacks_second_approval_prs" | xargs)
           echo "numbers=$numbers" >> "$GITHUB_OUTPUT"
+          echo "lacks_second_approval_prs=$lacks_second_approval_prs" >> "$GITHUB_OUTPUT"
         env:
+          AGED_PRS: ${{ needs.get_candidate_prs.outputs.aged_prs }}
           CANDIDATES: ${{ needs.get_candidate_prs.outputs.candidates }}
           GH_TOKEN: ${{ github.token }}
 
+      - name: Label Pull Requests Lacking a Second Approval
+        if: steps.get_mergeable_prs.outputs.lacks_second_approval_prs != ''
+        run: |
+          # shellcheck disable=SC2086
+          for pr in $PULL_REQUESTS; do
+            if ! gh -R "$GITHUB_REPOSITORY" pr edit "$pr" --add-label 'lacks-second-approval'; then
+              echo "::warning::Failed to add lacks-second-approval to PR ${pr}"
+            fi
+          done
+        env:
+          GH_TOKEN: ${{ secrets.GH_USER_TOKEN }}
+          PULL_REQUESTS: ${{ steps.get_mergeable_prs.outputs.lacks_second_approval_prs }}
+
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
         if: steps.get_mergeable_prs.outputs.numbers != ''
         with:
 
@@ -0,0 +1,97 @@
+name: Welcome first-time contributors
+
+on:
+  pull_request_target:
+    types: [opened]
+
+permissions: {}
+
+jobs:
+  agentscan:
+    if: >-
+      github.run_attempt == 1 &&
+      github.repository == 'nodejs/node' &&
+      (github.event.pull_request.author_association == 'FIRST_TIMER' ||
+      github.event.pull_request.author_association == 'FIRST_TIME_CONTRIBUTOR')
+    runs-on: ubuntu-slim
+    permissions:
+      contents: read
+    outputs:
+      scan_outcome: ${{ steps.agentscan.outcome }}
+      classification: ${{ steps.agentscan.outputs.classification }}
+      community_flagged: ${{ steps.agentscan.outputs['community-flagged'] }}
+    steps:
+      - name: Scan contributor activity
+        id: agentscan
+        # The welcome should still be posted if this advisory scan fails.
+        continue-on-error: true
+        uses: MatteoGabriele/agentscan-action@98202262c925c508d4c1424b1dfbe17ee35b0c02  # v2.4.0
+        with:
+          github-token: ${{ github.token }}
+          mode: silent
+          scan-pull-requests: true
+          scan-issues: false
+          auto-close: false
+          honeypot: false
+
+  comment:
+    needs: agentscan
+    runs-on: ubuntu-slim
+    permissions:
+      pull-requests: write
+    steps:
+      - name: Welcome first-time contributor
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          NUMBER: ${{ github.event.pull_request.number }}
+          AGENTSCAN_OUTCOME: ${{ needs.agentscan.outputs.scan_outcome }}
+          AGENTSCAN_CLASSIFICATION: ${{ needs.agentscan.outputs.classification }}
+          AGENTSCAN_COMMUNITY_FLAGGED: ${{ needs.agentscan.outputs.community_flagged }}
+          WELCOME_MESSAGE: >2-
+              Welcome to Node.js, and thank you for your first contribution!
+
+            Before review, please take a moment to read:
+
+              * the [guide for first-time contributors](https://github.com/nodejs/node/blob/HEAD/doc/contributing/first-contributions.md)
+              * the [contribution and automation policies](https://github.com/nodejs/node/blob/HEAD/CONTRIBUTING.md)
+              * the [pull request guide](https://github.com/nodejs/node/blob/HEAD/doc/contributing/pull-requests.md)
+              * the [AI use policy](https://github.com/nodejs/node/blob/HEAD/doc/contributing/ai-guidelines.md)
+              * the [Code of Conduct](https://github.com/nodejs/admin/blob/HEAD/CODE_OF_CONDUCT.md)
+
+            Please make sure every commit is
+            [signed off](https://github.com/nodejs/node/blob/HEAD/doc/contributing/pull-requests.md#step-4-commit).
+            For a first pull request, GitHub Actions require collaborator
+            approval and Jenkins CI must be started by a collaborator or triager,
+            so an initial wait is normal.
+          CAUTION_MESSAGE: >-
+            > [!CAUTION]
+
+            > AgentScan found account activity patterns that may be consistent with
+            automation. This is a heuristic, not proof that this pull request was
+            opened by an agent or violates policy. AI-assisted contributions are
+            permitted, but automated tooling must not open pull requests without
+            advance approval, and contributors must personally understand, test,
+            verify, and take responsibility for every submitted change. See the
+            [AgentScan analysis](https://agentscan.tools/user/${{ github.event.pull_request.user.login }}),
+            [AI use policy](https://github.com/nodejs/node/blob/HEAD/doc/contributing/ai-guidelines.md),
+            and
+            [automation policy](https://github.com/nodejs/node/blob/HEAD/CONTRIBUTING.md#automation-and-bots)
+            for additional context.
+        run: |
+          add_caution=false
+          if [[ "$AGENTSCAN_OUTCOME" == "success" ]]; then
+            case "$AGENTSCAN_CLASSIFICATION" in
+              mixed|automation)
+                add_caution=true
+                ;;
+            esac
+            if [[ "$AGENTSCAN_COMMUNITY_FLAGGED" == "true" ]]; then
+              add_caution=true
+            fi
+          fi
+
+          if [[ "$add_caution" == "true" ]]; then
+            printf '%s\n\n%s\n' "$WELCOME_MESSAGE" "$CAUTION_MESSAGE"
+          else
+            printf '%s\n' "$WELCOME_MESSAGE"
+          fi | gh pr comment "$NUMBER" --repo "$GITHUB_REPOSITORY" --body-file -
@@ -41,7 +41,8 @@ release.
 </tr>
 <tr>
   <td valign="top">
-<b><a href="doc/changelogs/CHANGELOG_V26.md#26.8.0">26.8.0</a></b><br/>
+<b><a href="doc/changelogs/CHANGELOG_V26.md#26.8.1">26.8.1</a></b><br/>
+<a href="doc/changelogs/CHANGELOG_V26.md#26.8.0">26.8.0</a><br/>
 <a href="doc/changelogs/CHANGELOG_V26.md#26.7.0">26.7.0</a><br/>
 <a href="doc/changelogs/CHANGELOG_V26.md#26.6.0">26.6.0</a><br/>
 <a href="doc/changelogs/CHANGELOG_V26.md#26.5.1">26.5.1</a><br/>
 
@@ -1528,7 +1528,8 @@ format-md: tools/lint-md/node_modules/remark-parse/package.json ## Format the ma
 LINT_JS_TARGETS = eslint.config.mjs benchmark doc lib test tools
 
 run-lint-js = tools/eslint/node_modules/eslint/bin/eslint.js --cache \
-	--max-warnings=0 --report-unused-disable-directives $(LINT_JS_TARGETS)
+	--max-warnings=0 --report-unused-disable-directives \
+	--concurrency auto $(LINT_JS_TARGETS)
 run-lint-js-fix = $(run-lint-js) --fix
 
 tools/eslint/node_modules/eslint/bin/eslint.js: tools/eslint/package-lock.json
@@ -1555,7 +1556,7 @@ jslint: lint-js
 
 run-lint-js-ci = tools/eslint/node_modules/eslint/bin/eslint.js \
   --max-warnings=0 --report-unused-disable-directives -f tap \
-	-o test-eslint.tap $(LINT_JS_TARGETS)
+  --concurrency auto -o test-eslint.tap $(LINT_JS_TARGETS)
 
 .PHONY: lint-js-ci
 # On the CI the output is emitted in the TAP format.
 
@@ -124,21 +124,43 @@ This policy recognizes that experimental platforms may not compile, may not
 pass the test suite, and do not have the same level of testing and support
 infrastructure as Tier 1 and Tier 2 platforms.
 
-### Experimental features behind compile-time flags and V8 flags
+### Experimental features behind compile-time flags, experimental runtime flags, and V8 flags
 
 Node.js includes certain experimental features that are only available when
-Node.js is compiled with specific flags. These features are intended for
-development, debugging, or testing purposes and are not enabled in official
-releases.
+Node.js is compiled with specific flags or that are only enabled with experimental
+runtime flags. These features are intended for development, debugging, or testing
+purposes and are not enabled or supported in official releases.
 
 Node.js may also expose V8 features that are controlled by V8 command-line flags
 (e.g., `--js-staging`, `--max_old_space_size`). These flags
 enable or modify V8-level JavaScript engine behavior that is not part of the
 ECMAScript specification that Node.js implements and is not part of the
 Node.js documented API surface.
 
+#### Runtime gated experimental features
+
+Experimental features behind runtime flags can fall into one of three
+[categories](https://github.com/nodejs/node/blob/main/doc/api/documentation.md?rgh-link-date=2026-08-21T20%3A28%3A33.000Z#stability-index):
+
+* 1.0 - Early development.
+* 1.1 - Active development.
+* 1.2 - Release candidate.
+
+Security vulnerabilities that only affect experimental features in either the
+1.0 or 1.1 stages, and that are gated with an `--experimental-*` runtime flag
+requiring explicit opt-in by the user to enable, will **not** be accepted as
+valid security issues unless the vulnerability can be exploited in a way that
+impacts the security of a stable feature when the associated `--experimental-*`
+flag is **not enabled**.
+
+Security vulnerabilities that affect experimental features in the 1.2 stage are
+acceptable as valid security issues.
+
+#### Compile-time gated experimental features and V8 flags
+
 * Security vulnerabilities that only affect features behind compile-time flags
-  or V8 flags will **not** be accepted as valid security issues.
+  or V8 flags _that are not enabled by default_ will **not** be accepted as valid
+  security issues.
 * Any issues with these features will be treated as normal bugs.
 * No CVEs will be issued for issues that only affect compile-time flag or V8 flag features.
 * Bug bounty rewards are not available for compile-time flag or V8 flag feature issues.
@@ -524,6 +546,15 @@ The following are **not** vulnerabilities in Node.js:
   vulnerability. Applications that rely on the Permission Model must not grant
   `--allow-worker` to code they do not trust.
 
+#### QUIC and HTTP/3
+
+The experimental QUIC and HTTP/3 implementation in Node.js is a complex new
+protocol stack and API that is still under active development and should not be
+used for production workloads. Reports that only affect QUIC or HTTP/3 are not
+considered Node.js vulnerabilities at this time. It is expected that the QUIC
+and HTTP/3 implementation will continue to evolve, and security issues will be
+addressed as the implementation matures.
+
 #### Virtual File System (`node:vfs`)
 
 The experimental [Virtual File System](https://nodejs.org/api/vfs.html)
@@ -560,12 +591,6 @@ vulnerability. Node.js validates the structure of Early Hints per the HTTP spec
 but does not sanitize free-form application data passed to it; that is the
 application's responsibility.
 
-## Assessing experimental features reports
-
-Experimental features are eligible for security reports just like any other
-stable feature of Node.js. They may also receive the same severity score that a
-stable feature would.
-
 ## Receiving security updates
 
 Security notifications will be distributed via the following methods.
 
@@ -0,0 +1,86 @@
+'use strict';
+
+const common = require('../common.js');
+const assert = require('node:assert');
+const crypto = require('node:crypto');
+const fs = require('node:fs');
+const path = require('node:path');
+
+const fixtureDir = path.resolve(__dirname, '../../test/fixtures/keys');
+const certificate = fs.readFileSync(path.join(fixtureDir, 'agent1-cert.pem'));
+const dhPrime = crypto.getDiffieHellman('modp14').getPrime();
+const key = Buffer.alloc(32, 0x01);
+const keyObject = crypto.createSecretKey(key);
+const hmacAlgorithm = { name: 'HMAC', hash: 'SHA-256' };
+const keyUsages = ['sign'];
+const iv = Buffer.alloc(16, 0x02);
+
+const iterations = {
+  Certificate: 1e7,
+  Cipheriv: 1e5,
+  Decipheriv: 1e5,
+  DiffieHellman: 10,
+  DiffieHellmanGroup: 2e5,
+  ECDH: 2e5,
+  Hash: 1e5,
+  Hmac: 5e4,
+  KeyObject: 1e5,
+  Sign: 1e5,
+  Verify: 1e5,
+  CryptoKey: 5e4,
+  X509Certificate: 5e3,
+};
+
+const bench = common.createBenchmark(main, {
+  type: Object.keys(iterations),
+  n: [...new Set(Object.values(iterations))],
+}, {
+  combinationFilter({ type, n }) {
+    // Benchmark test mode reduces numeric options to 1.
+    return n === 1 || iterations[type] === n;
+  },
+});
+
+function construct(type) {
+  switch (type) {
+    case 'Certificate':
+      return new crypto.Certificate();
+    case 'Cipheriv':
+      return crypto.createCipheriv('aes-256-ctr', key, iv);
+    case 'Decipheriv':
+      return crypto.createDecipheriv('aes-256-ctr', key, iv);
+    case 'DiffieHellman':
+      return crypto.createDiffieHellman(dhPrime);
+    case 'DiffieHellmanGroup':
+      return crypto.getDiffieHellman('modp14');
+    case 'ECDH':
+      return crypto.createECDH('prime256v1');
+    case 'Hash':
+      return crypto.createHash('sha256');
+    case 'Hmac':
+      return crypto.createHmac('sha256', key);
+    case 'KeyObject':
+      return crypto.createSecretKey(key);
+    case 'Sign':
+      return crypto.createSign('sha256');
+    case 'Verify':
+      return crypto.createVerify('sha256');
+    case 'CryptoKey':
+      return keyObject.toCryptoKey(hmacAlgorithm, true, keyUsages);
+    case 'X509Certificate':
+      return new crypto.X509Certificate(certificate);
+    default:
+      throw new Error(`Unsupported class: ${type}`);
+  }
+}
+
+function main({ type, n }) {
+  const instances = new Array(n);
+
+  bench.start();
+  for (let i = 0; i < n; ++i)
+    instances[i] = construct(type);
+  bench.end(n);
+
+  assert.strictEqual(typeof instances[n - 1], 'object');
+}