$ git log --author="mcollina" --all --oneline

On the record

mcollina

@mcollina ↗ first byline May 2026

Every morning, RepoJournal's newsroom reads what shipped across the open-source projects developers depend on — and writes the wire. Your commits kept making the news. This is your clippings file: the stories where your work was the story.

90

stories filed

62

daily wires

$ grep -rn "author: mcollina" wires/ | sort -r

Node.js

wire 2026-11-09

Workers preload streams into the startup snapshot; http2 accepts repeated content-encoding

worker: preload streams into startup snapshot nodejs/node
stream: trim webstreams sink wrappers and BYOB transfers nodejs/node
sea: generate a compile cache for the VFS modules nodejs/node

Node.js

wire 2026-11-07

Stale OpenSSL errors cleared, npm 12.2.2 lands in node

crypto: prevent stale OpenSSL errors nodejs/node

Node.js

wire 2026-11-05

undici closes two redirect credential leaks

fix(redirect): strip credentials from array-of-tuples headers nodejs/undici
fix(cache): prevent cross-origin redirect cache bypass nodejs/undici
docs: add security release notes nodejs/undici

Node.js

wire 2026-11-03

QUIC stream data survives late readers, fromWeb writes keep async context

stream: keep async context of fromWeb writes nodejs/node

Node.js

wire 2026-10-30

Node 27.0.0-alpha.0.0.0 lands with V8 15.6, and pipeTo keeps its async context

stream: keep async context of pipeTo watchers nodejs/node

Node.js

wire 2026-10-25

AbortSignal gets up to 11x faster; http2 stops hanging on GOAWAY

http2: don't suppress internal termination detection on a peer GOAWAY nodejs/node

Node.js

wire 2026-10-23

Alpha release phase lands on nodejs.org download pages

Blog: update brotli vulnerability credits in october 2026 security release post (#9231) nodejs/nodejs.org

Node.js

wire 2026-10-22

Node crypto reset across snapshots, Brotli and permission-model CVEs land in the security queue

fix(http2): keep persistent error sink on released streams nodejs/undici

Node.js

wire 2026-10-18

net.BlockList fails closed, QUIC validates error codes

net: fail closed when BlockList peer address is unavailable nodejs/node
process: return unregister fn from finalization nodejs/node
module: fix require(esm) on the module.register() hooks thread nodejs/node

Node.js

wire 2026-10-17

TransformStream construction trimmed, SEA archive mount re-landed

stream: trim TransformStream construction costs nodejs/node

Node.js

wire 2026-10-16

Five undici DoS and TLS bypass advisories land at once

vfs: unflag nodejs/node

Node.js

wire 2026-10-15

Node 26.12.0 and 24.22.0 ship as undici patches a WebSocket DoS

split wpt out of npm test (#5588) nodejs/undici
fix: reject unsupported FormData request bodies (#5913) nodejs/undici

Node.js

wire 2026-10-12

AbortSignal.any() leak fixed, diagnostics_channel context unblocked

diagnostics_channel: fix default callback context nodejs/node

Node.js

wire 2026-10-09

Undici caps cached and error-body retention, drops Milo from the Node core bundle

fix(cache): always treat zero-lifetime entries as stale (#5980) nodejs/undici
fix(interceptor): limit response error body size nodejs/undici
fix: exclude experimental milo from node.js core bundle nodejs/undici

Node.js

wire 2026-10-06

V8 drops the flag override, so jitless and lite modes come back

net: race family autoselection attempts nodejs/node

Node.js

wire 2026-10-04

Undici caps EventSource buffering, node:ffi takes plain integers

fix(eventsource): enforce maxEventSize on unterminated lines (#5814) nodejs/undici

Node.js

wire 2026-10-03

Legacy AsyncLocalStorage removed, FFI permission checks dropped

async_hooks: remove legacy AsyncLocalStorage implementation nodejs/node

Node.js

wire 2026-09-24

Undici reverts HTTP/2 fetch change, websocket fixes land

Revert "fix: preserve HTTP/2 for legacy fetch consumers" nodejs/undici

Node.js

wire 2026-09-23

Node 26.10.0 lands with crypto.parsePKCS12()

stream: trim per-pipe and per-tee costs in webstreams nodejs/node

Node.js

wire 2026-09-22

undici 8.11.0 lands HTTP/2 length checks and WebSocket fixes

fix(h2): validate response content-length nodejs/undici

Node.js

wire 2026-09-21

Cheaper short-lived web streams, shared cleanup hooks per isolate

stream: trim per-stream costs in webstreams nodejs/node

Node.js

wire 2026-09-20

SEA gets ZIP asset archives, HTTP server sheds per-request allocations

sea: add vfsArchive to serve the assets from a ZIP archive nodejs/node
http: reduce per-request allocations in the server nodejs/node

Node.js

wire 2026-09-19

Buffer.stringLength(), and a trace_events abort for embedders

buffer: add Buffer.stringLength() nodejs/node

Node.js

wire 2026-09-17

Node 26.9.0 adds a generic MAC API, undici walks back its decompression size cap

fix: honor backpressure in decompression interceptor nodejs/undici

Node.js

wire 2026-09-15

HTTP/2 restored for built-in fetch, http2 onread assert fixed

fix: preserve HTTP/2 for non-upgrade legacy requests nodejs/undici

Node.js

wire 2026-09-12

Undici stops HTTP/2 pool fan-out, Node's TLS state machine gets re-entrancy guards

fix(h2): avoid pool fan-out during ALPN negotiation nodejs/undici

Node.js

wire 2026-09-05

Node.js security patches land, permission audit mode fixes, and stream EOF optimization

fix(websocket): destroy inflater after decompression limit nodejs/undici
fix(websocket): error locked writable on unclean close nodejs/undici
fix(cache): isolate interceptor state by dispatcher origin nodejs/undici
fix(cache): reject unsafe method response caching nodejs/undici
fix: preserve BalancedPool connection options nodejs/undici
stream: skip unobserved 'readable' emission at EOF nodejs/node

Node.js

wire 2026-09-04

domain runtime-deprecation lands; BlockList round-trip fixed

domain: runtime-deprecate the module nodejs/node

Node.js

wire 2026-09-03

Undici fixes cookie parser stack overflow, EventSource header injection risk

fix: avoid unbounded recursion in Set-Cookie attribute parser nodejs/undici
fix(eventsource): validate Last-Event-ID on reconnect nodejs/undici
fix: honor SOCKS5 connection timeout nodejs/undici
fix(cache): refetch when 304 adds vary fields nodejs/undici

Node.js

wire 2026-08-30

Web Crypto PKCS8 export now rejects public keys with InvalidAccessError

test: expect node:ffi to be enabled by default nodejs/node

Node.js

wire 2026-08-25

Node's TLS abort becomes a throw

stream: reduce webstreams encoding and iteration overhead nodejs/node

Node.js

wire 2026-08-24

Node's compile cache turns read-only

http: use intrusive lists in ConnectionsList nodejs/node

Node.js

wire 2026-08-22

NODE DROPS --USE-LARGEPAGES AND HARMONY IMPORT ATTRIBUTES

fix: propagate dispatcher options to base class nodejs/undici

Node.js

wire 2026-08-20

READFILE 3-6x FASTER: NODE'S SMALL-FILE PATH COLLAPSES FOUR ROUND TRIPS INTO ONE

stream: decouple transform backpressure changes nodejs/node
test: stabilize HTTP/2 timeout tests nodejs/undici

Node.js

wire 2026-08-16

WEBSTREAMS PROMISE CHURN CRUSHED, SQLITE DIAGNOSTICS LAND

stream: cut promise churn in webstreams hot paths nodejs/node

Node.js

wire 2026-08-15

UNDICI FIXES ABORT HANDLING BUGS THAT HANG REQUESTS

stream: speed up async iteration of Readable nodejs/node

Node.js

wire 2026-08-07

NODE CORE LANDS PERFORMANCE WINS ACROSS NET, FS, AND STREAMS

zlib: reject ambiguous ZIP archive ends nodejs/node

Node.js

wire 2026-08-06

NODE 26.7.0 SHIPS WITH CRYPTO UPGRADES AND DNS SECURITY FIX

fix(mock): re-invoke reply callback for persistent mocks nodejs/undici
chore: remove Codemod from partners list (#9084) nodejs/nodejs.org

Node.js

wire 2026-08-05

STREAMS SHED ALLOCATIONS, HTTP/2 WINDOWS QUADRUPLE

stream: cut per-chunk allocations in pipeTo nodejs/node
http2: increase default window sizes nodejs/node

Node.js

wire 2026-08-01

NODE CUTS STREAM OVERHEAD, DTLS GAINS STABILITY

stream: reduce per-chunk work in WHATWG tee and BYOB reads nodejs/node

Node.js

wire 2026-07-28

NODE CORE TIGHTENS TEST COVERAGE AS UNDICI SHIPS H2 NAMESPACE UPGRADE

test: update WPT expectations nodejs/undici

Node.js

wire 2026-07-24

SQLITE GARBAGE COLLECTION BUG AND FFI REENTRANCY HAZARDS DEMAND IMMEDIATE PATCHES

sqlite: fix use-after-free in Exec() and ApplyChangeset() nodejs/node
fix(cache): harden cache directive parsing nodejs/undici
fix(retry): reject partial content length mismatch nodejs/undici

Node.js

wire 2026-07-22

NODE CORE HARDENS CRYPTO AND FFI, UNDICI PATCHES HEADER INJECTION

fix: validate coerced header values for CRLF (#5579) nodejs/undici
fix: validate coerced header values for CRLF nodejs/undici

Node.js

wire 2026-07-20

NODE PLUGS TIMER MEMORY LEAK, FIXES FFI SIGNATURE DOUBLE-EVALUATION

timers: do not retain a reference to the async store after firing nodejs/node

Node.js

wire 2026-07-14

UNDICI FIXES H2 MULTIPLEXING BOTTLENECK, NODE EVENTS LAYER CUTS MEMORY BLOAT

events: avoid retaining removed event names nodejs/node
events: optimize once() and removeListener() nodejs/node

Node.js

wire 2026-07-13

NODE ADDS WORKER THREAD SOCKET TRANSFER AND LIVE TEST LOGGING

net: make TCP Server and Socket transferable across worker threads nodejs/node

Node.js

wire 2026-07-12

NGTCP2 UPGRADED, STREAM PERFORMANCE SURGES 27 PERCENT

stream: speed up reads and iteration over default WHATWG streams nodejs/node

Node.js

wire 2026-07-06

NODE CORE BUMPS TEMPORAL RS, STREAM API EXPANDS FOR FETCH

stream: expose ReadableStreamTee nodejs/node

Node.js

wire 2026-07-04

NODE STREAM ENGINE CUTS OVERHEAD BY 23 PERCENT

stream: cut per-chunk overhead in WHATWG streams nodejs/node

Node.js

wire 2026-06-29

NODE.JS TIGHTENS SECURITY ACCESS CONTROLS

doc: clarify vfs is not a sandbox nodejs/node

Node.js

wire 2026-06-14

NODE CORE REMOVES DEAD CODE, UPGRADES NPM, UNDICI FIXES HTTP/2 QUEUE CORRUPTION

fs: support caller-supplied readFile() buffers nodejs/node
fix: preserve h2 queue on out-of-order completion nodejs/undici

Node.js

wire 2026-06-13

UNDICI PLUGS WEBSOCKET DOS WHILE NODE CORE OPTIMIZES BUFFERS AND ADDS PACKAGE MAPS

fix: reap idle HTTP/2 sessions nodejs/undici
fix: allow h2 post request multiplexing nodejs/undici

Node.js

wire 2026-06-11

UNDICI PATCHES FAKE TIMER BYPASS BREAKING TEST ISOLATION

fix: keep idle validation on global timers nodejs/undici

Node.js

wire 2026-05-31

UNDICI PATCHES HTTP/2 SESSION COLLAPSE, NODE CORE HARDENS BUFFER ENCODING

fix: reset invalid HTTP/2 sessions nodejs/undici
test: fix flaky http2 trailers test nodejs/undici

Node.js

wire 2026-05-30

NPM 11.16.0 LANDS IN NODE, VFS MOUNTING SHIPS FOR ENTERPRISE

vfs: dispatch fs/promises to mounted VFS instances nodejs/node

Node.js

wire 2026-05-24

NODE SHIPS STREAM FLUSH FIX AND EXPERIMENTAL VFS SUBSYSTEM

vfs: add minimal node:vfs subsystem nodejs/node

Node.js

wire 2026-05-15

COREPACK DROPS NODE 20 AND 25 SUPPORT, UNDICI 8.3.0 SHIPS POOL FIX

fix: register connect listener before initiating requests in close-and-destroy test nodejs/undici

Node.js

wire 2026-05-12

UNDICI PATCHES CHUNKED RESPONSE VALIDATION HOLE AS NODE-GYP PIVOTS TO v26

fix: validate EOF for chunked h1 responses nodejs/undici

Node.js

wire 2026-05-10

NODE CORE CLEANS HOUSE WHILE UNDICI FIXES FETCH MULTIPART TRAP

fix: preserve fetch multipart body on MockAgent fallback nodejs/undici

Node.js

wire 2026-05-09

STREAM HARDENING AND QUIC DOCS LAND AS NODE TIGHTENS CRYPTO INTERNALS

fix(test): make http2-pseudo-headers test order-independent nodejs/undici

Node.js

wire 2026-05-07

UNDICI FIXES FLAKY WEBSOCKET TESTS AND DEAD ASSERTIONS

test(websocket): fix flaky send test nodejs/undici

Node.js

wire 2026-05-06

NODE.JS 26 SHIPS WITH TEMPORAL API ENABLED BY DEFAULT

test: deflake stream compat coverage nodejs/undici