Who contributed to Node.js on June 16, 2026?

3 developers shipped this update, including developers-universe-1, guybedford, and trivikr.

What were the notable Node.js updates?

crypto: runtime-deprecate calling Hmac.digest() more than once, dgram: add synchronous Socket.prototype.bindSync(), and debugger: await initialization after run and restart.

@nodejs

The Node.js runtime - every backend team's CVE source of truth

github ↗

Pick a date

Topics: JavaScript Full archive →

The Wire · Showcase

NODE.JS CRYPTO TIGHTENS HMAC RULES, UNDICI SHIPS TRIPLE RELEASE

By RepoJournal · Filed 06:01 UTC on June 16, 2026 · About Node.js

3 people shipped this

developers-universe-1 @developers-universe-1 1 cited

guybedford @guybedford 1 cited

trivikr @trivikr 1 cited

Node.js runtime-deprecates calling Hmac.digest() multiple times in the same session, aligning its behavior with Hash.digest() and closing a consistency gap that has quietly shipped code across production.

The crypto module now emits a DEP0206 deprecation warning when Hmac.digest() is called on an already-finalized instance [1], a breaking-change warning that fixes the inconsistency where Hash.digest() throws ERR_CRYPTO_HASH_FINALIZED under the same conditions. This catches a class of subtle bugs where callers don't realize they've already finalized the state. Separately, the dgram module adds Socket.prototype.bindSync() [2], a synchronous bind operation that unblocks WebAssembly embeddings and POSIX compatibility layers that need to avoid async patterns. The debugger CLI also fixes a race condition [3] where the REPL prompt would appear before the debuggee actually released from --inspect-brk, and stream handling now fixes a dropped first chunk bug in Utf8Stream buffer mode [4]. On the HTTP client side, undici shipped three releases in quick succession: v6.27.0 [5] and v7.28.0 [6] both fix idle socket validation to skip fresh connections, while v8.5.0 [7] adds native timer support and fixes HTTP/2 stream rewinding past in-flight requests. All three releases converge on the same stability improvements across major versions.

Action items

→ Scan HMAC usage in your codebase for repeated digest() calls and plan upgrade path before DEP0206 becomes breaking nodejs/node [plan]
→ Upgrade undici to v6.27.0, v7.28.0, or v8.5.0 depending on your current major version nodejs/undici [plan]
→ If using WebAssembly UDP binding, test Socket.bindSync() as a non-JSPI alternative nodejs/node [monitor]

References

[1] crypto: runtime-deprecate calling Hmac.digest() more than once ↗ nodejs/node
[2] dgram: add synchronous Socket.prototype.bindSync() ↗ nodejs/node
[3] debugger: await initialization after run and restart ↗ nodejs/node
[4] stream: fix dropped first chunk in Utf8Stream buffer mode nodejs/node
[5] v6.27.0 ↗ nodejs/undici
[6] v7.28.0 ↗ nodejs/undici
[7] v8.5.0 ↗ nodejs/undici

Quick answers

What shipped in Node.js on June 16, 2026?: Node.js runtime-deprecates calling Hmac.digest() multiple times in the same session, aligning its behavior with Hash.digest() and closing a consistency gap that has quietly shipped code across production. In total, 13 commits, 16 pull requests, and 3 releases landed.
Who contributed to Node.js on June 16, 2026?: 3 developers shipped this update, including developers-universe-1, guybedford, and trivikr.
What were the notable Node.js updates?: crypto: runtime-deprecate calling Hmac.digest() more than once, dgram: add synchronous Socket.prototype.bindSync(), and debugger: await initialization after run and restart.

Node DNS Reverse Lookups Fixed, REPL Gets Syntax Highlighting

Node core shipped a DNS fix that stops reverse lookups from consulting /etc/hosts, breaking alignment with documented behavior that caught developers mid-production.

javascript 14 shipped 1-min read

@nodejs 2 days ago

NODE CRASHES ON ODD-LENGTH HEX STRINGS VIA WRITEV

A critical crash in Node's binary handling when writing hex strings through Writev is now fixed, along with three other stability improvements shipping across the runtime.

javascript 25 shipped 1-min read

@nodejs 3 days ago

NODE CORE TIGHTENS DNS BEHAVIOR, DOCS TOOLING SHIFTS AWAY FROM OXC

DNS tests now codify a breaking change in record lookup behavior, while the documentation pipeline abandons OXC for a WASM-based alternative after CI runner incompatibility.

javascript 38 shipped 1-min read

@nodejs 4 days ago

SQLITE GARBAGE COLLECTION BUG AND FFI REENTRANCY HAZARDS DEMAND IMMEDIATE PATCHES

Node.js shipped critical fixes overnight for a use-after-free vulnerability in SQLite callbacks and a string buffer corruption bug in Fast FFI reentrant calls that could crash production systems.

javascript 42 shipped 2-min read

Elsewhere on the wire

AI Agents about 21 hours ago

CLINE SHIPS FIVE CRITICAL AGENT FIXES AFTER END-TO-END TESTING BLITZ

Saoudrizwan just landed a cascade of fixes that prevent the agent loop from running wild, stop file reads from resolving to the wrong directory, and plug the compaction pipeline.

ai-agents 16 shipped 2-min read

Local LLMs about 21 hours ago

LLAMA.CPP SHIPS MINIMAX-M3 SPARSE ATTENTION, VLLM UNLOCKS HETEROGENEOUS PREFILL-DECODE

The inference stack gets a new model architecture and a fundamental shift in how prefill and decode can run on different hardware configurations.

+10

llms 125 shipped 1-min read

@CachyOS about 21 hours ago

GLIBC 2.43 REBUILD SHIPS, INSTALLER JUMPS TO C++26

CachyOS pushed glibc 2.43 through the pipeline while the CLI installer upgraded its C++ standard to C++26, signaling a major refresh across core infrastructure.

infra 97 shipped 1-min read

Elixir & Phoenix about 21 hours ago

ECTO FIXES SUBQUERY PLANNING IN JOINS, ELIXIR PATCHES IEX PARSING

Ecto's query planner now handles subqueries correctly in interpolated join filters, while Elixir fixes a syntax error that broke 'not in' as a continuation operator in IEx.