Who contributed to Node.js on June 11, 2026?

3 developers shipped this update, including mcollina, legendecas, and owlstronaut.

What were the notable Node.js updates?

fix: keep idle validation on global timers, chore: add commit-lint, and fix: disable LTO for addon builds on Windows.

@nodejs

The Node.js runtime - every backend team's CVE source of truth

github ↗

Pick a date

Topics: JavaScript Full archive →

The Wire · Showcase

UNDICI PATCHES FAKE TIMER BYPASS BREAKING TEST ISOLATION

By RepoJournal · Filed 06:01 UTC on June 11, 2026 · About Node.js

3 people shipped this

mcollina @mcollina 1 cited

legendecas @legendecas 1 cited

owlstronaut @owlstronaut 1 cited

Undici restored socket validation to respect global timers instead of sneaking around fake timer mocks, fixing a footgun that silently broke test suites relying on clock control.

The fix [1] restores idle socket validation to use standard Node timer APIs, reversing a bypass that let validation run even when tests faked timers. This matters because cache interceptor tests were forced to fake the entire Date object just to control one clock behavior, and the workaround left poisoned sockets undetected in isolation. Node-gyp tightened its release machinery in parallel: commit-lint now gates changelog generation [2], LTO is disabled for Windows addon builds to prevent linker issues [3], and the CI pipeline updated to immutable GitHub action versions [4]. These changes ensure native modules build reproducibly across platforms without surprises in release automation.

Action items

→ Review test suite for undici cache interceptor mocks - may simplify after this lands nodejs/undici [plan]
→ Upgrade node-gyp to pick up commit-lint and LTO fixes if you maintain native bindings nodejs/node-gyp [plan]

References

[1] fix: keep idle validation on global timers ↗ nodejs/undici
[2] chore: add commit-lint ↗ nodejs/node-gyp
[3] fix: disable LTO for addon builds on Windows ↗ nodejs/node-gyp
[4] fix(ci): update ruff-action version to v4.0.0 (#3324) nodejs/node-gyp

Quick answers

What shipped in Node.js on June 11, 2026?: Undici restored socket validation to respect global timers instead of sneaking around fake timer mocks, fixing a footgun that silently broke test suites relying on clock control. In total, 5 commits and 4 pull requests landed.
Who contributed to Node.js on June 11, 2026?: 3 developers shipped this update, including mcollina, legendecas, and owlstronaut.
What were the notable Node.js updates?: fix: keep idle validation on global timers, chore: add commit-lint, and fix: disable LTO for addon builds on Windows.

Node DNS Reverse Lookups Fixed, REPL Gets Syntax Highlighting

Node core shipped a DNS fix that stops reverse lookups from consulting /etc/hosts, breaking alignment with documented behavior that caught developers mid-production.

javascript 14 shipped 1-min read

@nodejs 2 days ago

NODE CRASHES ON ODD-LENGTH HEX STRINGS VIA WRITEV

A critical crash in Node's binary handling when writing hex strings through Writev is now fixed, along with three other stability improvements shipping across the runtime.

javascript 25 shipped 1-min read

@nodejs 3 days ago

NODE CORE TIGHTENS DNS BEHAVIOR, DOCS TOOLING SHIFTS AWAY FROM OXC

DNS tests now codify a breaking change in record lookup behavior, while the documentation pipeline abandons OXC for a WASM-based alternative after CI runner incompatibility.

javascript 38 shipped 1-min read

@nodejs 4 days ago

SQLITE GARBAGE COLLECTION BUG AND FFI REENTRANCY HAZARDS DEMAND IMMEDIATE PATCHES

Node.js shipped critical fixes overnight for a use-after-free vulnerability in SQLite callbacks and a string buffer corruption bug in Fast FFI reentrant calls that could crash production systems.

javascript 42 shipped 2-min read

Elsewhere on the wire

AI Agents about 21 hours ago

CLINE SHIPS FIVE CRITICAL AGENT FIXES AFTER END-TO-END TESTING BLITZ

Saoudrizwan just landed a cascade of fixes that prevent the agent loop from running wild, stop file reads from resolving to the wrong directory, and plug the compaction pipeline.

ai-agents 16 shipped 2-min read

Local LLMs about 21 hours ago

LLAMA.CPP SHIPS MINIMAX-M3 SPARSE ATTENTION, VLLM UNLOCKS HETEROGENEOUS PREFILL-DECODE

The inference stack gets a new model architecture and a fundamental shift in how prefill and decode can run on different hardware configurations.

+10

llms 125 shipped 1-min read

@CachyOS about 21 hours ago

GLIBC 2.43 REBUILD SHIPS, INSTALLER JUMPS TO C++26

CachyOS pushed glibc 2.43 through the pipeline while the CLI installer upgraded its C++ standard to C++26, signaling a major refresh across core infrastructure.

infra 97 shipped 1-min read

Elixir & Phoenix about 21 hours ago

ECTO FIXES SUBQUERY PLANNING IN JOINS, ELIXIR PATCHES IEX PARSING

Ecto's query planner now handles subqueries correctly in interpolated join filters, while Elixir fixes a syntax error that broke 'not in' as a continuation operator in IEx.