Three of the twelve notable changes carry no SEMVER-MINOR tag [20]. The tag is a statement about API surface, and the pattern makes sense once you see it that way. A certificate bundle is data, so moving the store to NSS 3.126 lands as a plain entry in the list [2]. Marking TracingChannel stable is a documentation promise, so it lands the same way [3]. Neither one changes a signature, but both change what a running process does. A CA bundle rarely gets its own maintenance window, and that is how a stale trust list survives three quarters.
Ten commits in this release carry the `crypto:` prefix [17]. The full list is sorted by subsystem prefix, and the crypto block sits between a child_process fix and a debugger fix [22], so those ten are the whole of it. Two of them decide whether your upgrade is boring. PR #65172 disables non-FIPS WebCrypto paths when FIPS mode is on [7], and #64982 fixes disabling FIPS mode in the first place [8]. If you run FIPS, that is a behaviour change with no marker on it: a call that used to reach a non-FIPS algorithm through SubtleCrypto stops reaching it. The same release improves the accuracy of `SubtleCrypto.supports()` [14], which is the call to make before assuming an algorithm is present rather than discovering it in a catch block.
The new SIV and GCM-SIV modes are enabled in the Cipher and Decipher APIs [4]. That placement is literal. The WebCrypto work in this release is listed as its own set of commits [14][19], and nothing in the changelog says SubtleCrypto learned the SIV modes. If your key handling lives behind SubtleCrypto today, adopting these modes means writing against the Cipher constructors instead, which is a different code path with different key-object plumbing.
`StatementSync.prototype.close()` and `StatementSync.prototype[Symbol.dispose]()` both arrived from PR #64232 [5][6]. One PR for both is the right call, because the disposal hook and the explicit call have to free the same handle in the same order, and a reviewer should see them in one diff. Which one you use is a build question. The dispose route only pays off if your toolchain emits explicit resource management; otherwise you call `close()` in a `finally` and get the same statement released.
The item I would actually spend an afternoon on is #65416, which added statistical hypothesis testing to perf_hooks histograms and an `--analyze` mode to `compare.js` in the same change [9][10]. That means Node's own comparison harness can report whether a delta survived the run-to-run noise instead of leaving a reader to eyeball two means. It is good engineering, and it is aimed at the right failure. It still does not make anyone's published table transfer to your service: for that, your workload has to resemble the one that was measured, on hardware that resembles the hardware. The release also floats perfetto to 57.2 [23], which is the layer underneath the tracing you are now being invited to depend on.
