RepoJournal
Node.js

@nodejs

The Node.js runtime — every backend team's CVE source of truth

Pick a date

  1. Thu 21 may
  2. Sat 23 may
  3. Sun 24 may
  4. Mon 25 may
  5. Tue 26 may
  6. Wed 27 may
  7. Thu 28 may
  8. Fri 29 may
  9. Sat 30 may
  10. Sun 31 may
  11. Mon 1 jun
  12. Mon 8 jun
  13. Tue 9 jun
  14. Wed 10 jun
  15. Thu 11 jun
  16. Fri 12 jun
  17. Sat 13 jun
  18. Sun 14 jun
  19. Mon 15 jun
  20. Tue 16 jun
  21. Wed 17 jun
  22. Thu 18 jun
  23. Fri 19 jun
  24. Sat 27 jun
  25. Sun 28 jun
  26. Mon 29 jun
  27. Tue 30 jun
  28. Wed 1 jul
  29. Thu 2 jul
  30. Today 3 jul

The Wire · Showcase

NODE CORE REMOVES DEAD CODE, UPGRADES NPM, UNDICI FIXES HTTP/2 QUEUE CORRUPTION

By RepoJournal · Filed · About Node.js

Node's test runner shed unused helpers while the debugger gained new probe termination controls, but the real urgency is undici's HTTP/2 fix for out-of-order stream completion that could leave requests dangling.

The core team is cleaning house [1] with dead code removal in the test runner while adding real functionality to the debugger's probe mode [2], which now supports termination limits for per-probe hits. On the C++ side, node::ObjectWrap is officially deprecated [3] in favor of better userland alternatives that don't lock you into specific Node versions. npm bumped to 11.17.0 [5] with new tooling for script allowlisting and dependency age controls. But the critical fix lives in undici: HTTP/2 streams completing out of order were corrupting the request queue [6], advancing the wrong index and potentially losing running requests entirely. The team also backported WebSocket fragmentation fixes [7] that ensure empty fragments don't trip maxFragments limits, closing a spec compliance gap. fs.readFile now accepts caller-supplied buffers [4], reducing allocation pressure for high-volume workloads.

Action items

References

  1. [1] test_runner: remove unused shuffleArrayWithSeed nodejs/node
  2. [2] debugger: add --max-hit option to probe mode nodejs/node
  3. [3] src: officially deprecate `node::ObjectWrap` nodejs/node
  4. [4] fs: support caller-supplied readFile() buffers ↗ nodejs/node
  5. [5] deps: upgrade npm to 11.17.0 ↗ nodejs/node
  6. [6] fix: preserve h2 queue on out-of-order completion ↗ nodejs/undici
  7. [7] Cherry-pick 91678cbbce and 7a2db575e0 (#5422) nodejs/undici

FAQ

What changed in Node.js on June 14, 2026?
Node's test runner shed unused helpers while the debugger gained new probe termination controls, but the real urgency is undici's HTTP/2 fix for out-of-order stream completion that could leave requests dangling.
What should Node.js teams do about it?
Update undici to latest immediately if you're using HTTP/2 streams in production • Plan upgrade to Node with npm 11.17.0 for dependency security tooling in next release cycle • Remove any direct calls to node::ObjectWrap before upgrading major versions
Which Node.js repositories shipped on June 14, 2026?
nodejs/node, nodejs/undici

Related across the cluster

For your repos

The showcase is a teaser.
Your wire is the product.

Same engine. Different stack. Below: what changes when the wire is yours.

Showcase wire

  • •14 famous open source orgs
  • •One wire per day
  • •Public, generic
  • •Read on the web, when you remember

Your wire

  • →Up to 1,500 of your repos - orgs, deps, vendors
  • →Morning and evening briefs
  • →Action items routed to your team
  • →Slack delivery, email, breaking-news CVE alerts

Want a hands-on demo first? Ask a current user for an invite link.