RepoJournal
Node.js @nodejs
143 wires and counting

$ follow Node.js

Keep up with Node.js in about 3 minutes: what actually shipped — the commits, pull requests, releases, and security advisories that matter.

or

fair warning: these emails are deeply technical. diffs, version numbers, CVEs, benchmark deltas. if that's not your idea of a good read, this isn't your newsletter.

Folds into your digest — weekly by default, monthly if you prefer. Unsubscribe in one click.

$ status

wire 2026-06-16
stories 32
GitHub RSS Archive Reviews

© 2026 RepoJournal Home Showcase How it works Privacy

$ the-wire · showcase

NODE.JS CRYPTO TIGHTENS HMAC RULES, UNDICI SHIPS TRIPLE RELEASE

By RepoJournal · Filed · About Node.js · Composed from the cited sources · methodology

developers-universe-1 guybedford trivikr
3 people shipped this
developers-universe-1 @developers-universe-1 1 cited guybedford @guybedford 1 cited trivikr @trivikr 1 cited

Node.js runtime-deprecates calling Hmac.digest() multiple times in the same session, aligning its behavior with Hash.digest() and closing a consistency gap that has quietly shipped code across production.

The crypto module now emits a DEP0206 deprecation warning when Hmac.digest() is called on an already-finalized instance [1], a breaking-change warning that fixes the inconsistency where Hash.digest() throws ERR_CRYPTO_HASH_FINALIZED under the same conditions. This catches a class of subtle bugs where callers don't realize they've already finalized the state. Separately, the dgram module adds Socket.prototype.bindSync() [2], a synchronous bind operation that unblocks WebAssembly embeddings and POSIX compatibility layers that need to avoid async patterns. The debugger CLI also fixes a race condition [3] where the REPL prompt would appear before the debuggee actually released from --inspect-brk, and stream handling now fixes a dropped first chunk bug in Utf8Stream buffer mode [4]. On the HTTP client side, undici shipped three releases in quick succession: v6.27.0 [5] and v7.28.0 [6] both fix idle socket validation to skip fresh connections, while v8.5.0 [7] adds native timer support and fixes HTTP/2 stream rewinding past in-flight requests. All three releases converge on the same stability improvements across major versions.

$ ls nodejs/reviews/ # the step-back reads

the week in review node-gyp 13.1.0 patches tar CVE, raises CMake floor the month in review Node 26.10.0 lands crypto.parsePKCS12 as npm 12 ships
Full archive → Weekly reviews →

Quick answers

What shipped in Node.js on June 16, 2026?
Node.js runtime-deprecates calling Hmac.digest() multiple times in the same session, aligning its behavior with Hash.digest() and closing a consistency gap that has quietly shipped code across production. In total, 13 commits, 16 pull requests, and 3 releases landed.
Who contributed to Node.js on June 16, 2026?
3 developers shipped this update, including developers-universe-1, guybedford, and trivikr.
What were the notable Node.js updates?
crypto: runtime-deprecate calling Hmac.digest() more than once, dgram: add synchronous Socket.prototype.bindSync(), and debugger: await initialization after run and restart.
♥

$ log @nodejs --recent

Undici caps EventSource buffering, node:ffi takes plain integers 51 shipped Legacy AsyncLocalStorage removed, FFI permission checks dropped 29 shipped node-gyp 13.1.0 fixes --msvs_version, and citgm's red builds traced to loglevel precedence 17 shipped child_process spawn gets 20% faster, QUIC macro cleaned up 43 shipped

$ log --all # elsewhere on the wire

@vuejs Vue language tools stop calling registerHooks on buggy Node builds @openclaw OpenClaw's deslop sweep removes 1,000+ production lines

$ ls showcases/

Rails Django Laravel Go Vercel Vue.js Kubernetes HashiCorp Arch Linux Linux Anthropic OpenAI

$ init your-desk

RepoJournal can write one of these for any repo you care about. Sign in with GitHub, pick your repos and sources, and your desk gets a wire like this one every morning.