diff --git a/.github/workflows/lint-commit.yml b/.github/workflows/lint-commit.yml
new file mode 100644
index 0000000000..6a61ae771a
--- /dev/null
+++ b/.github/workflows/lint-commit.yml
@@ -0,0 +1,27 @@
+name: Lint Commits
+
+on:
+  pull_request:
+
+permissions:
+  contents: read # to fetch code (actions/checkout)
+
+jobs:
+  lint-pr-first-commit:
+    name: Commit Lint
+    runs-on: ubuntu-latest
+    steps:
+    - uses: actions/checkout@v6
+      with:
+        fetch-depth: 0
+    - uses: actions/setup-node@v6
+      with:
+        node-version: 22.x
+    - run: npm install
+    - name: Lint first PR commit message
+      run: |
+        FIRST=$(git rev-list --reverse ${{ github.event.pull_request.base.sha }}..${{ github.event.pull_request.head.sha }} | head -1)
+        echo "Base:       ${{ github.event.pull_request.base.sha }}"
+        echo "Head:       ${{ github.event.pull_request.head.sha }}"
+        echo "First PR commit: $FIRST"
+        git log -1 --format=%B "$FIRST" | npx commitlint --verbose
diff --git a/.github/workflows/release-please.yml b/.github/workflows/release-please.yml
index 70050b9a04..a792c76633 100644
--- a/.github/workflows/release-please.yml
+++ b/.github/workflows/release-please.yml
@@ -15,7 +15,7 @@ jobs:
       release_created:  ${{ steps.release.outputs.release_created }}
     runs-on: ubuntu-latest
     steps:
-      - uses: googleapis/release-please-action@v4
+      - uses: googleapis/release-please-action@v5
         id: release
         with:
           token: ${{ secrets.GH_USER_TOKEN }}
diff --git a/.github/workflows/tests.yml b/.github/workflows/tests.yml
index 7bbf6ea711..53090b55e8 100644
--- a/.github/workflows/tests.yml
+++ b/.github/workflows/tests.yml
@@ -19,7 +19,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
     - uses: actions/checkout@v6
-    - uses: astral-sh/ruff-action@v3
+    - uses: astral-sh/ruff-action@v4.0.0
       with:
         args: "check --select=E,F,PLC,PLE,UP,W,YTT --ignore=E721,PLC0206,PLC0415,PLC1901,S101,UP031 --target-version=py39"
     - run: ruff format --check --diff
diff --git a/.github/workflows/update-gyp-next.yml b/.github/workflows/update-gyp-next.yml
index 44936014f9..c1b2f8f9b2 100644
--- a/.github/workflows/update-gyp-next.yml
+++ b/.github/workflows/update-gyp-next.yml
@@ -21,7 +21,7 @@ jobs:
         with:
           persist-credentials: false
 
-      - uses: actions/github-script@v8
+      - uses: actions/github-script@v9
         id: get-gyp-next-version
         with:
           script: |
diff --git a/.release-please-manifest.json b/.release-please-manifest.json
index 7cf5faf711..139a159133 100644
--- a/.release-please-manifest.json
+++ b/.release-please-manifest.json
@@ -1,3 +1,3 @@
 {
-    ".": "12.4.0"
+    ".": "13.0.0"
 }
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 83881ed2a3..211b04ef35 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,5 +1,36 @@
 # Changelog
 
+## [13.0.0](https://github.com/nodejs/node-gyp/compare/v12.4.0...v13.0.0) (2026-06-10)
+
+
+### ⚠ BREAKING CHANGES
+
+* `node-gyp` now supports node `^22.22.2 || ^24.15.0 || >=26.0.0`
+
+### Features
+
+* bump to new node engine range ([b792b8e](https://github.com/nodejs/node-gyp/commit/b792b8e321e6e56d46c32f4b9adb15e4085c3797))
+
+
+### Bug Fixes
+
+* **ci:** update ruff-action version to v4.0.0 ([#3324](https://github.com/nodejs/node-gyp/issues/3324)) ([f089669](https://github.com/nodejs/node-gyp/commit/f089669a4c95a3c8b7f435556b226fa66dcd94b7))
+* disable LTO for addon builds on Windows ([#3331](https://github.com/nodejs/node-gyp/issues/3331)) ([d30bb6e](https://github.com/nodejs/node-gyp/commit/d30bb6e6fdaf46374de9b9bfe1bf54f49337b052))
+
+
+### Core
+
+* **deps:** bump actions/github-script from 8 to 9 ([#3297](https://github.com/nodejs/node-gyp/issues/3297)) ([f6a5e45](https://github.com/nodejs/node-gyp/commit/f6a5e458e819f05ddfbba5cbd5589a7a1c80128e))
+* **deps:** bump googleapis/release-please-action from 4 to 5 ([#3307](https://github.com/nodejs/node-gyp/issues/3307)) ([b2cde80](https://github.com/nodejs/node-gyp/commit/b2cde802487f3b9efd726a1a1cb43650731f9958))
+* nopt@10.0.0 ([327424a](https://github.com/nodejs/node-gyp/commit/327424ad630dd7007771b19f7b77691b2156a556))
+* proc-log@7.0.0 ([f6c296b](https://github.com/nodejs/node-gyp/commit/f6c296b2952e23b7e690b7148c9dc32b25a26ee2))
+* which@7.0.0 ([11a8b10](https://github.com/nodejs/node-gyp/commit/11a8b109f805f13129302508c219607167a8e9ea))
+
+
+### Miscellaneous
+
+* add commit-lint ([#3325](https://github.com/nodejs/node-gyp/issues/3325)) ([6fb6c11](https://github.com/nodejs/node-gyp/commit/6fb6c11eae1258eddd478956a20f0cb154dd4553))
+
 ## [12.4.0](https://github.com/nodejs/node-gyp/compare/v12.3.0...v12.4.0) (2026-05-15)
 
 
diff --git a/commitlint.config.mjs b/commitlint.config.mjs
new file mode 100644
index 0000000000..2291173ef3
--- /dev/null
+++ b/commitlint.config.mjs
@@ -0,0 +1,3 @@
+export default {
+  extends: ['@commitlint/config-conventional']
+};
diff --git a/lib/create-config-gypi.js b/lib/create-config-gypi.js
index 01a820e9f2..d471da5169 100644
--- a/lib/create-config-gypi.js
+++ b/lib/create-config-gypi.js
@@ -99,6 +99,11 @@ async function getCurrentConfigGypi ({ gyp, nodeDir, vsInfo, python }) {
     if (config.variables.clang === 1) {
       config.variables.clang = 0
     }
+    // disable LTO for addon builds. node release builds may enable (thin) LTO,
+    // which leaks clang/lld-only flags like -flto=thin and /opt:lldltojobs into
+    // addons built with the default MSVC toolchain, which rejects those flags
+    variables.enable_lto = 'false'
+    variables.enable_thin_lto = 'false'
   }
 
   // loop through the rest of the opts and add the unknown ones as variables.
diff --git a/package.json b/package.json
index 7f579406da..cc11fc65e8 100644
--- a/package.json
+++ b/package.json
@@ -11,7 +11,7 @@
     "bindings",
     "gyp"
   ],
-  "version": "12.4.0",
+  "version": "13.0.0",
   "installVersion": 11,
   "author": "Nathan Rajlich <nathan@tootallnate.net> (http://tootallnate.net)",
   "repository": {
@@ -25,18 +25,20 @@
     "env-paths": "^2.2.0",
     "exponential-backoff": "^3.1.1",
     "graceful-fs": "^4.2.6",
-    "nopt": "^9.0.0",
-    "proc-log": "^6.0.0",
+    "nopt": "^10.0.0",
+    "proc-log": "^7.0.0",
     "semver": "^7.3.5",
     "tar": "^7.5.4",
     "tinyglobby": "^0.2.12",
     "undici": "^6.25.0",
-    "which": "^6.0.0"
+    "which": "^7.0.0"
   },
   "engines": {
-    "node": "^20.17.0 || >=22.9.0"
+    "node": "^22.22.2 || ^24.15.0 || >=26.0.0"
   },
   "devDependencies": {
+    "@commitlint/cli": "^21.0.2",
+    "@commitlint/config-conventional": "^21.0.2",
     "bindings": "^1.5.0",
     "cross-env": "^10.1.0",
     "eslint": "^9.39.1",
diff --git a/test/fixtures/win-lto/include/node/config.gypi b/test/fixtures/win-lto/include/node/config.gypi
new file mode 100644
index 0000000000..2e432eb842
--- /dev/null
+++ b/test/fixtures/win-lto/include/node/config.gypi
@@ -0,0 +1,8 @@
+# Test configuration simulating a Node.js Windows release built with Thin LTO
+{
+  'variables': {
+    'enable_lto': 'true',
+    'enable_thin_lto': 'true',
+    'lto_jobs': '2'
+  }
+}
diff --git a/test/test-create-config-gypi.js b/test/test-create-config-gypi.js
index 3c77b87859..602fd3d678 100644
--- a/test/test-create-config-gypi.js
+++ b/test/test-create-config-gypi.js
@@ -52,6 +52,25 @@ describe('create-config-gypi', function () {
     assert.strictEqual(config.variables.build_with_electron, undefined)
   })
 
+  it('config.gypi disables LTO for addon builds on Windows', async function () {
+    const nodeDir = path.join(__dirname, 'fixtures', 'win-lto')
+
+    const prog = gyp()
+    prog.parseArgv(['_', '_', `--nodedir=${nodeDir}`])
+
+    const originalPlatform = process.platform
+    Object.defineProperty(process, 'platform', { value: 'win32' })
+    try {
+      const config = await getCurrentConfigGypi({ gyp: prog, nodeDir, vsInfo: {} })
+      // thin LTO leaks clang/lld-only flags into the MSVC addon build, so it
+      // must be disabled regardless of how node itself was built
+      assert.strictEqual(config.variables.enable_lto, 'false')
+      assert.strictEqual(config.variables.enable_thin_lto, 'false')
+    } finally {
+      Object.defineProperty(process, 'platform', { value: originalPlatform })
+    }
+  })
+
   it('config.gypi parsing', function () {
     const str = "# Some comments\n{'variables': {'multiline': 'A'\n'B'}}"
     const config = parseConfigGypi(str)