Who contributed to Node.js on June 14, 2026?

2 developers shipped this update, including mcollina and npm-cli-bot.

What were the notable Node.js updates?

test_runner: remove unused shuffleArrayWithSeed, debugger: add --max-hit option to probe mode, and src: officially deprecate `node::ObjectWrap`.

@nodejs

The Node.js runtime - every backend team's CVE source of truth

github ↗

Pick a date

Topics: JavaScript Full archive →

The Wire · Showcase

NODE CORE REMOVES DEAD CODE, UPGRADES NPM, UNDICI FIXES HTTP/2 QUEUE CORRUPTION

By RepoJournal · Filed 06:01 UTC on June 14, 2026 · About Node.js

2 people shipped this

mcollina @mcollina 2 cited

npm-cli-bot @npm-cli-bot 1 cited

Node's test runner shed unused helpers while the debugger gained new probe termination controls, but the real urgency is undici's HTTP/2 fix for out-of-order stream completion that could leave requests dangling.

The core team is cleaning house [1] with dead code removal in the test runner while adding real functionality to the debugger's probe mode [2], which now supports termination limits for per-probe hits. On the C++ side, node::ObjectWrap is officially deprecated [3] in favor of better userland alternatives that don't lock you into specific Node versions. npm bumped to 11.17.0 [5] with new tooling for script allowlisting and dependency age controls. But the critical fix lives in undici: HTTP/2 streams completing out of order were corrupting the request queue [6], advancing the wrong index and potentially losing running requests entirely. The team also backported WebSocket fragmentation fixes [7] that ensure empty fragments don't trip maxFragments limits, closing a spec compliance gap. fs.readFile now accepts caller-supplied buffers [4], reducing allocation pressure for high-volume workloads.

Action items

→ Update undici to latest immediately if you're using HTTP/2 streams in production nodejs/undici [immediate]
→ Plan upgrade to Node with npm 11.17.0 for dependency security tooling in next release cycle nodejs/node [plan]
→ Remove any direct calls to node::ObjectWrap before upgrading major versions nodejs/node [plan]
→ Monitor undici HTTP/2 deployments for queue misclassification symptoms nodejs/undici [monitor]

References

[1] test_runner: remove unused shuffleArrayWithSeed nodejs/node
[2] debugger: add --max-hit option to probe mode nodejs/node
[3] src: officially deprecate `node::ObjectWrap` nodejs/node
[4] fs: support caller-supplied readFile() buffers ↗ nodejs/node
[5] deps: upgrade npm to 11.17.0 ↗ nodejs/node
[6] fix: preserve h2 queue on out-of-order completion ↗ nodejs/undici
[7] Cherry-pick 91678cbbce and 7a2db575e0 (#5422) nodejs/undici

Quick answers

What shipped in Node.js on June 14, 2026?: Node's test runner shed unused helpers while the debugger gained new probe termination controls, but the real urgency is undici's HTTP/2 fix for out-of-order stream completion that could leave requests dangling. In total, 16 commits and 10 pull requests landed.
Who contributed to Node.js on June 14, 2026?: 2 developers shipped this update, including mcollina and npm-cli-bot.
What were the notable Node.js updates?: test_runner: remove unused shuffleArrayWithSeed, debugger: add --max-hit option to probe mode, and src: officially deprecate `node::ObjectWrap`.

Node DNS Reverse Lookups Fixed, REPL Gets Syntax Highlighting

Node core shipped a DNS fix that stops reverse lookups from consulting /etc/hosts, breaking alignment with documented behavior that caught developers mid-production.

javascript 14 shipped 1-min read

@nodejs 2 days ago

NODE CRASHES ON ODD-LENGTH HEX STRINGS VIA WRITEV

A critical crash in Node's binary handling when writing hex strings through Writev is now fixed, along with three other stability improvements shipping across the runtime.

javascript 25 shipped 1-min read

@nodejs 3 days ago

NODE CORE TIGHTENS DNS BEHAVIOR, DOCS TOOLING SHIFTS AWAY FROM OXC

DNS tests now codify a breaking change in record lookup behavior, while the documentation pipeline abandons OXC for a WASM-based alternative after CI runner incompatibility.

javascript 38 shipped 1-min read

@nodejs 4 days ago

SQLITE GARBAGE COLLECTION BUG AND FFI REENTRANCY HAZARDS DEMAND IMMEDIATE PATCHES

Node.js shipped critical fixes overnight for a use-after-free vulnerability in SQLite callbacks and a string buffer corruption bug in Fast FFI reentrant calls that could crash production systems.

javascript 42 shipped 2-min read

Elsewhere on the wire

AI Agents about 21 hours ago

CLINE SHIPS FIVE CRITICAL AGENT FIXES AFTER END-TO-END TESTING BLITZ

Saoudrizwan just landed a cascade of fixes that prevent the agent loop from running wild, stop file reads from resolving to the wrong directory, and plug the compaction pipeline.

ai-agents 16 shipped 2-min read

Local LLMs about 21 hours ago

LLAMA.CPP SHIPS MINIMAX-M3 SPARSE ATTENTION, VLLM UNLOCKS HETEROGENEOUS PREFILL-DECODE

The inference stack gets a new model architecture and a fundamental shift in how prefill and decode can run on different hardware configurations.

+10

llms 125 shipped 1-min read

@CachyOS about 21 hours ago

GLIBC 2.43 REBUILD SHIPS, INSTALLER JUMPS TO C++26

CachyOS pushed glibc 2.43 through the pipeline while the CLI installer upgraded its C++ standard to C++26, signaling a major refresh across core infrastructure.

infra 97 shipped 1-min read

Elixir & Phoenix about 21 hours ago

ECTO FIXES SUBQUERY PLANNING IN JOINS, ELIXIR PATCHES IEX PARSING

Ecto's query planner now handles subqueries correctly in interpolated join filters, while Elixir fixes a syntax error that broke 'not in' as a continuation operator in IEx.