Dependencies

Quick lookup for the contents of deps/. The full prose narrative is at Vendored deps and build.

Directory	What it is	Used by Node module
deps/v8/	Google V8 JavaScript engine	the runtime
deps/uv/	libuv async I/O loop	every async path
deps/openssl/	OpenSSL (or BoringSSL when configured)	crypto, tls, https, http2, quic
deps/ncrypto/	Node's wrapper crate over OpenSSL	src/crypto/
deps/llhttp/	HTTP/1.1 parser	http
deps/nghttp2/	HTTP/2 implementation	http2
deps/ngtcp2/	QUIC + nghttp3 (HTTP/3)	quic, experimental HTTP/3
deps/ada/	WHATWG URL parser	URL, URLPattern, fetch
deps/simdjson/	SIMD-accelerated JSON parser	--experimental-config-file
deps/icu-small/	ICU	Intl, URL, ICU-aware String
deps/sqlite/	SQLite amalgamation	node:sqlite
deps/uvwasi/	uvwasi WASI runtime	node:wasi
deps/zlib/	zlib	zlib
deps/zstd/	Zstandard	zlib (zstd APIs)
deps/brotli/	Brotli	zlib (brotli APIs)
deps/cares/	c-ares DNS resolver	dns.resolve*
deps/libffi/	libffi	node:ffi
deps/undici/	Fetch / HTTP client	globalThis.fetch, WebSocket
deps/amaro/	TypeScript stripper (Rust SWC)	--experimental-strip-types
deps/acorn/	Acorn parser	a few JS-side spots
deps/cjs-module-lexer/	CJS named-export detector	require(esm)
deps/corepack/	Corepack package-manager dispatcher	shipped binary
deps/npm/	npm	shipped binary
deps/inspector_protocol/	Chrome DevTools protocol code generator	src/inspector/
deps/perfetto/	Perfetto trace SDK	trace_events
deps/postject/	Inject sections into ELF/Mach-O/PE	SEA
deps/LIEF/	ELF/Mach-O/PE manipulation	SEA codesign tooling
deps/googletest/	googletest	cctest
deps/histogram/	HdrHistogram	perf_hooks
deps/minimatch/	minimatch	fs.glob
deps/nbytes/	nbytes helpers	Buffer, crypto
deps/merve/	Merve (small algorithmic helper)	(specific subsystem)
deps/crates/	Other Rust crates linked into the binary	TS stripping etc.

Updaters

Most directories have a matching script in tools/dep_updaters/:

update-acorn.sh, update-amaro.sh, update-ada.sh, update-archs-files.sh, update-base64.sh,
update-brotli.sh, update-cjs-module-lexer.sh, update-corepack.sh, update-googletest.sh,
update-icu.sh, update-libffi.sh, update-llhttp.sh, update-minimatch.sh, update-nbytes.sh,
update-nghttp2.sh, update-postject.sh, update-simdjson.sh, update-sqlite.sh, update-undici.sh,
update-uv.sh, update-uvwasi.sh, update-v8.sh, update-zlib.sh, update-zstd.sh

OpenSSL has its own workflow at .github/workflows/update-openssl.yml. V8 has both an updater and .github/workflows/update-v8.yml. The umbrella tools workflow is .github/workflows/tools.yml.

Versions at runtime

process.versions exposes the embedded version of every dep that has a runtime fingerprint:

process.versions.node; // 26.0.0-pre, etc.
process.versions.v8;
process.versions.uv;
process.versions.zlib;
process.versions.brotli;
process.versions.ares;
process.versions.modules; // ABI version
process.versions.napi;
process.versions.openssl;
process.versions.ada;
process.versions.simdjson;
process.versions.undici;
process.versions.amaro;
process.versions.sqlite;
process.versions.icu;

See also

• LICENSE — the assembled license file generated by tools/license-builder.sh.
• doc/contributing/maintaining/maintaining-<dep>.md — how to handle major version bumps for individual deps (V8, ICU, OpenSSL, undici, etc.).