RepoJournal
Node.js @nodejs
129 wires and counting

$ follow Node.js

Keep up with Node.js in about 3 minutes: what actually shipped — the commits, pull requests, releases, and security advisories that matter.

or

fair warning: these emails are deeply technical. diffs, version numbers, CVEs, benchmark deltas. if that's not your idea of a good read, this isn't your newsletter.

Folds into your digest — weekly by default, monthly if you prefer. Unsubscribe in one click.

$ status

wire 2026-05-27
stories 41
GitHub RSS Archive Reviews Topics

© 2026 RepoJournal Home Showcase Explore How it works Privacy

$ the-wire · showcase

NODE STRIPS 14 ROOT CERTIFICATES, ADDS PERMISSION.DROP CONTROL

By RepoJournal · Filed · About Node.js · Composed from the cited sources · methodology

nodejs-github-bot dependabot[bot]
2 people shipped this
nodejs-github-bot @nodejs-github-bot 1 cited dependabot[bot] @dependabot[bot] 1 cited

Node's certificate store just got pruned hard, removing 14 trusted roots including DigiCert and COMODO, while a new permission.drop API gives you runtime control over what your code can access.

The crypto update [1] lands certificates from NSS 3.123.1 (Firefox 151.0.1's version), clearing out a substantial list of legacy certificate authorities that failed modern security standards. This is the kind of maintenance that keeps TLS chains trustworthy but requires you to validate if any internal or legacy systems relied on the removed roots. In parallel, Node added permission.drop [2], a new capability that lets you revoke permissions at runtime instead of being locked into initial grants, giving you finer control over what dangerous operations your code can execute. The undici core also got a simplification [3] to its abort listener utility, reducing complexity without breaking behavior. Over at amaro, SWC bumped to v1.15.40 [4] and the project shipped v1.1.10 [5] with workflow hardening post-CVE-2025-30066. The undici dependency chain picked up ws 8.21.0 [6], which fixes a remote memory exhaustion DoS and adds configurable buffering limits for fragmented messages.

$ ls nodejs/reviews/ # the step-back reads

the week in review Node 26.9.0 ships generic crypto MAC API the month in review Node 26 line lands crypto, stream, and FFI hardening as deprecations tighten the core
Topics: JavaScript Full archive → Weekly reviews →

Quick answers

What shipped in Node.js on May 27, 2026?
Node's certificate store just got pruned hard, removing 14 trusted roots including DigiCert and COMODO, while a new permission.drop API gives you runtime control over what your code can access. In total, 18 commits, 22 pull requests, and 1 releases landed.
Who contributed to Node.js on May 27, 2026?
2 developers shipped this update, including nodejs-github-bot and dependabot[bot].
What were the notable Node.js updates?
crypto: update root certificates to NSS 3.123.1, lib,permission: add permission.drop, and fix(core): simplify `addAbortListener` util (#5317).
♥

$ log @nodejs --recent

SEA gets ZIP asset archives, HTTP server sheds per-request allocations 28 shipped Buffer.stringLength(), and a trace_events abort for embedders 40 shipped cpSync dereference regression fixed, trace union punning removed 39 shipped Node 26.9.0 adds a generic MAC API, undici walks back its decompression size cap 27 shipped

$ log --all # elsewhere on the wire

@openclaw Cold-start Gateway diagnostics stop crying wolf, doctor repairs plugin drift Agentic Coding Cline desktop bundles shrink, goose unblocks its own clicks

$ ls showcases/

Rails Django Laravel Go Vercel Vue.js Kubernetes HashiCorp Arch Linux Linux Anthropic OpenAI

$ init your-desk

RepoJournal can write one of these for any repo you care about. Sign in with GitHub, pick your repos and sources, and your desk gets a wire like this one every morning.