RepoJournal
Node.js

@nodejs

The Node.js runtime - every backend team's CVE source of truth

Keep up with Node.js in about 3 minutes a day: what actually shipped — the commits, pull requests, releases, and security advisories that matter.

One email a day. Unsubscribe in one click.

Pick a date

  1. Fri 19 jun
  2. Sat 27 jun
  3. Sun 28 jun
  4. Mon 29 jun
  5. Tue 30 jun
  6. Wed 1 jul
  7. Thu 2 jul
  8. Fri 3 jul
  9. Sat 4 jul
  10. Sun 5 jul
  11. Mon 6 jul
  12. Tue 7 jul
  13. Wed 8 jul
  14. Thu 9 jul
  15. Fri 10 jul
  16. Sat 11 jul
  17. Sun 12 jul
  18. Mon 13 jul
  19. Tue 14 jul
  20. Wed 15 jul
  21. Thu 16 jul
  22. Fri 17 jul
  23. Sat 18 jul
  24. Sun 19 jul
  25. Mon 20 jul
  26. Tue 21 jul
  27. Wed 22 jul
  28. Thu 23 jul
  29. Fri 24 jul
  30. Today 25 jul
Topics: JavaScript Full archive →

The Wire · Showcase

UNDICI TIGHTENS NODE REQUIREMENTS — PLAN YOUR UPGRADES NOW

By RepoJournal · Filed · About Node.js

dependabot[bot] trivikr
2 people shipped this
dependabot[bot] @dependabot[bot] 2 cited trivikr @trivikr 1 cited

Both c8 and neostandard just dropped breaking changes that will force your test infrastructure to Node 20.19+ or 22.13+, and undici itself is shipping a backpressure optimization that matters for high-throughput streams.

The coverage tool c8 [1] and the linter neostandard [2] both moved to require Node.js 20.19.0 or 22.13.0 or greater — no 20.0-20.18 anymore. If you're still pinned to early LTS, your CI will break on the next undici update. More importantly, undici itself landed a performance win [3] that eliminates duplicate pool dispatcher selection when backpressure hits, which means less CPU spinning on high-concurrency workloads. The typing improvements [4] and test coverage additions [5] round out the week, but they're secondary to the dependency floor you need to clear.

One email a day. Unsubscribe in one click.

Action items

References

  1. [1] build(deps-dev): bump c8 from 10.1.3 to 11.0.0 ↗ nodejs/undici
  2. [2] build(deps-dev): bump neostandard from 0.12.2 to 0.13.0 ↗ nodejs/undici
  3. [3] perf: avoid duplicate pool dispatcher selection on backpressure ↗ nodejs/undici
  4. [4] types: add TOpaque to client connect options (#4928) nodejs/undici
  5. [5] test(fetch): add userinfo coverage for issue-4897 URLs (#4901) nodejs/undici

Quick answers

What shipped in Node.js on May 4, 2026?
Both c8 and neostandard just dropped breaking changes that will force your test infrastructure to Node 20.19+ or 22.13+, and undici itself is shipping a backpressure optimization that matters for high-throughput streams. In total, 3 commits and 16 pull requests landed.
Who contributed to Node.js on May 4, 2026?
2 developers shipped this update, including dependabot[bot] and trivikr.
What were the notable Node.js updates?
build(deps-dev): bump c8 from 10.1.3 to 11.0.0, build(deps-dev): bump neostandard from 0.12.2 to 0.13.0, and perf: avoid duplicate pool dispatcher selection on backpressure.

More from @nodejs

Node.js @nodejs

NODE CORE TIGHTENS DNS BEHAVIOR, DOCS TOOLING SHIFTS AWAY FROM OXC

DNS tests now codify a breaking change in record lookup behavior, while the documentation pipeline abandons OXC for a WASM-based alternative after CI runner incompatibility.

David Evans aduh95 nodejs-github-bot Javonne-liu +4
javascript 38 shipped 1-min read
Node.js @nodejs

SQLITE GARBAGE COLLECTION BUG AND FFI REENTRANCY HAZARDS DEMAND IMMEDIATE PATCHES

Node.js shipped critical fixes overnight for a use-after-free vulnerability in SQLite callbacks and a string buffer corruption bug in Fast FFI reentrant calls that could crash production systems.

GitHub Actions Tim Perry Matteo Collina trivikr +2
javascript 42 shipped 2-min read
Node.js @nodejs

NODE.JS STRIPS DEPRECATED API CALLS, FIXES FFI BOOL REGRESSION

Antoine du Hamel landed two critical cleanups in core this cycle, removing deprecated function calls and custom DOM polyfills while the FFI layer gets a precision fix that restores uint8 semantics.

GitHub Actions tsctx Antoine du Hamel trivikr +1
javascript 17 shipped 1-min read
Node.js @nodejs

NODE CORE HARDENS CRYPTO AND FFI, UNDICI PATCHES HEADER INJECTION

Node's crypto layer just got faster and safer, while undici plugged a CRLF injection hole that only matters if your app trusts untrusted function objects as headers.

Filip Skokan Qard trivikr Mhayk Whandson +2
javascript 26 shipped 1-min read

Daily updates, in your inbox

Follow Node.js

Keep up with Node.js in about 3 minutes a day: what actually shipped — the commits, pull requests, releases, and security advisories that matter.

or

One email a day. Unsubscribe in one click. Read a past issue →

Elsewhere on the wire

AI Agents AI Agents

CLAUDE OPUS 5 LANDS ACROSS THE STACK

The newest Anthropic model is now live in langchain, Cline, and llama-index, with native support for extended reasoning and 1M context windows.

github-actions[bot] hntrl dependabot ak684 +6
ai-agents 28 shipped 1-min read
Local LLMs Local LLMs

OLLAMA LANDS LAGUNA SUPPORT AND CRUSHES MEMORY LEAKS WHILE SGLANG HITS V0.5.16 WITH CONFIDENCE-DRIVEN SPECULATIVE DECODING

Ollama shipped three critical performance and reliability fixes for Metal residency and concurrent access patterns, while SGL-Lang released 0.5.16 with a new speculative algorithm hitting 383.7 tok/s on DeepSeek-V4.

dhiltgen ParthSareen Xuan-Son Nguyen Johannes Gäßler +11
llms 210 shipped 2-min read
CachyOS @CachyOS

HYPRLAND V0.56 FIXES LAND, PACKAGE ECOSYSTEM ROLLS FORWARD

Hyprland configuration updated for v0.56 compatibility across multiple desks, while the AUR-derived ecosystem locked in four automated package bumps.

cantosun99 Jinra Aarrayy Valeri +7
infra 85 shipped 1-min read
Elixir & Phoenix Elixir & Phoenix

LIVEVIEW ASYNC CLEANUP FIX SHIPS ALONGSIDE RANGE OPTIMIZATIONS

Phoenix LiveView closes a critical async task test failure while Elixir cuts unnecessary abs calls from Range operations.

Barna Kovacs Alexander Gubarev SteffenDE José Valim +1
elixir 19 shipped 1-min read
Want every project, not just this one?