Start with the two permission commits, because they change what the model can express. `permission.drop` (#62672, Rafael Gonzaga) is a runtime call [4]. That means privilege reduction can happen after startup rather than only through flags at launch. The classic shape is: read your config, open your sockets, then drop the file-system read you no longer need. `--permission-audit` (#61869, RafaelGSS) is the flag on the other side of that [5]. The name spells out the purpose: it observes what a process touches rather than enforcing anything, which is the only sane way to derive a permission set for an existing service. You run it, you collect what the process actually touched, then you write the allow list. Neither commit's semantics are described in the changelog beyond the name, so treat the workflow above as the obvious reading and check the docs before you build tooling on it.
Package maps in the loader (#62239, Maël Nison) is the entry I would read first if I owned a monorepo [3]. Resolution changes are the ones that surprise you in production, because they are evaluated at import time under whatever combination of `exports`, conditions and symlinks your installer produced. A semver-minor resolution feature on a maintenance line means the resolver code path in your LTS binary is not the one you tested against six weeks ago.
`using` scopes for `AsyncLocalStorage` (#61674, Stephen Belanger) hangs the store lifetime off explicit resource management [1]. If you have written the `als.run(store, () => ...)` callback pyramid, this is the flattening. It also puts a hard edge on where the store ends, which is the part that actually helps when you are chasing a context leak across an await boundary.
`node:stream/iter` (#62066, James M Snell) arrives with its own benchmarks in the same PR [6][9]. There is also a separate commit to respect broadcast backpressure in those benchmarks (#63314) [10]. Benchmarks landing alongside an experimental API give the maintainers a number to regress against, but that number is specific to their harness and will not necessarily transfer to your pipeline. Any stream throughput figure is a claim about a specific chunk size, a specific consumer speed, and whether the consumer ever applies backpressure. If your sink is a socket that stalls, the broadcast path is the one that matters.
The eleven semver-minor commits sit in a release whose bug-fix list runs long in crypto [11]. Filip Skokan's entries alone include splitting the OpenSSL 3, BoringSSL and legacy backends (#64211) and fixing Argon2 bypassing FIPS mode (#64776) [12][13]. Root certificates move to NSS 3.125 (#64746) [14]. If you ship into a FIPS-constrained environment, the Argon2 fix is the line item that decides your upgrade date, not package maps.
One accounting note. `using` scopes for `AsyncLocalStorage` appears twice in the changelog, once in the notable-changes summary and once in the full commit list, under the same hash `b12bcc9ae1` [1][2]. It's one commit, formatted into both the summary and the full commit list. Count carefully before you tell your platform team how much new surface arrived.
