Who contributed to Node.js on May 15, 2026?

3 developers shipped this update, including aduh95, mcollina, and dependabot[bot].

What were the notable Node.js updates?

chore(deps): bump engine support matrix, chore(deps): bump engine support matrix (#831), and v8.3.0.

@nodejs

The Node.js runtime - every backend team's CVE source of truth

github ↗

Pick a date

Topics: JavaScript Full archive →

The Wire · Showcase

COREPACK DROPS NODE 20 AND 25 SUPPORT, UNDICI 8.3.0 SHIPS POOL FIX

By RepoJournal · Filed 06:01 UTC on May 15, 2026 · About Node.js

3 people shipped this

dependabot[bot] @dependabot[bot] 3 cited

aduh95 @aduh95 1 cited

mcollina @mcollina 1 cited

Corepack is breaking backward compatibility by ending support for Node.js 20 and 25, while requiring NODE_USE_ENV_PROXY for proxy functionality going forward.

Corepack's new engine support matrix [1] [2] marks a significant shift in maintenance strategy, dropping two actively-used versions and moving to built-in proxy support that requires explicit environment configuration. This is a forcing function for teams still on Node 20 to plan their migration timeline now. Undici 8.3.0 landed this morning [3] with a critical fix that preserves pool capacity after removing stale clients [3], addressing a connection stability issue that affected production workloads. The release also fixes a race condition in test suites on Windows [4] where listeners registered after connection initiation could miss events. Over on nodejs.org, the dev team merged a lint toolchain refresh [5] bumping ESLint to 10.2.1, TypeScript-ESLint to 8.59.1, and Prettier to 3.8.3, plus React component library updates [6] to 19.2.6. Playwright test infrastructure got a Windows fix in 1.59.1 [7] that restores codegen and UI functionality after a console window regression.

Action items

→ Plan Node.js version migration away from 20 and 25 before updating Corepack nodejs/corepack [plan]
→ Update Undici to 8.3.0 to fix pool capacity handling nodejs/undici [monitor]
→ Sync lint dependencies in nodejs.org workflow (ESLint 10.2.1, TypeScript-ESLint 8.59.1) nodejs/nodejs.org [plan]

References

[1] chore(deps): bump engine support matrix ↗ nodejs/corepack
[2] chore(deps): bump engine support matrix (#831) nodejs/corepack
[3] v8.3.0 ↗ nodejs/undici
[4] fix: register connect listener before initiating requests in close-and-destroy test ↗ nodejs/undici
[5] meta: bump the lint group across 1 directory with 5 updates ↗ nodejs/nodejs.org
[6] meta: bump the react group across 1 directory with 2 updates ↗ nodejs/nodejs.org
[7] meta: bump @playwright/test from 1.58.2 to 1.59.1 ↗ nodejs/nodejs.org

Quick answers

What shipped in Node.js on May 15, 2026?: Corepack is breaking backward compatibility by ending support for Node.js 20 and 25, while requiring NODE_USE_ENV_PROXY for proxy functionality going forward. In total, 3 commits, 7 pull requests, and 1 releases landed.
Who contributed to Node.js on May 15, 2026?: 3 developers shipped this update, including aduh95, mcollina, and dependabot[bot].
What were the notable Node.js updates?: chore(deps): bump engine support matrix, chore(deps): bump engine support matrix (#831), and v8.3.0.

NODE CORE TIGHTENS DNS BEHAVIOR, DOCS TOOLING SHIFTS AWAY FROM OXC

DNS tests now codify a breaking change in record lookup behavior, while the documentation pipeline abandons OXC for a WASM-based alternative after CI runner incompatibility.

javascript 38 shipped 1-min read

@nodejs 1 day ago

SQLITE GARBAGE COLLECTION BUG AND FFI REENTRANCY HAZARDS DEMAND IMMEDIATE PATCHES

Node.js shipped critical fixes overnight for a use-after-free vulnerability in SQLite callbacks and a string buffer corruption bug in Fast FFI reentrant calls that could crash production systems.

javascript 42 shipped 2-min read

@nodejs 2 days ago

NODE.JS STRIPS DEPRECATED API CALLS, FIXES FFI BOOL REGRESSION

Antoine du Hamel landed two critical cleanups in core this cycle, removing deprecated function calls and custom DOM polyfills while the FFI layer gets a precision fix that restores uint8 semantics.

javascript 17 shipped 1-min read

@nodejs 3 days ago

NODE CORE HARDENS CRYPTO AND FFI, UNDICI PATCHES HEADER INJECTION

Node's crypto layer just got faster and safer, while undici plugged a CRLF injection hole that only matters if your app trusts untrusted function objects as headers.

javascript 26 shipped 1-min read

Elsewhere on the wire

AI Agents about 9 hours ago

CLAUDE OPUS 5 LANDS ACROSS THE STACK

The newest Anthropic model is now live in langchain, Cline, and llama-index, with native support for extended reasoning and 1M context windows.

ai-agents 28 shipped 1-min read

Local LLMs about 9 hours ago

OLLAMA LANDS LAGUNA SUPPORT AND CRUSHES MEMORY LEAKS WHILE SGLANG HITS V0.5.16 WITH CONFIDENCE-DRIVEN SPECULATIVE DECODING

Ollama shipped three critical performance and reliability fixes for Metal residency and concurrent access patterns, while SGL-Lang released 0.5.16 with a new speculative algorithm hitting 383.7 tok/s on DeepSeek-V4.