RepoJournal
Node.js

@nodejs

The Node.js runtime — every backend team's CVE source of truth

Pick a date

The Wire · Showcase

NODE FIXES VM PROPERTY DESCRIPTOR BUG, TYPESCRIPT INSTRUMENTATION GAPS

By RepoJournal · Filed · About Node.js

Node's VM context is now copying property descriptors correctly after a recent V8 change exposed a long-standing bug that left values undefined.

The VM fix [1] matters immediately if you're using `vm.createContext` and property interception hooks. The descriptor copy was silently assigning undefined values when none existed, but Node's recent changes made V8 stop auto-correcting this, leaving broken property definitions in place. In parallel, import-in-the-middle now handles type-stripped TypeScript modules [2], closing an instrumentation gap that left `.ts` files running completely uninstrumented when Node's `--experimental-strip-types` flag was active. The library now adds TypeScript formats to its handler list, ensuring hooks fire even when source is type-stripped before parsing [3]. On the dependency front, Node merged updates to nghttp3 1.17.0 [4] and SQLite 3.53.3 [5], both routine maintenance. Infrastructure improvements include a new GitHub Actions benchmark runner [7] that lets non-collaborators test performance on their own forks, and Node's tracing layer is being abstracted to support both legacy and perfetto agents [6], setting up diagnostics for the future.

Action items

References

  1. [1] vm: fix copying PropertyDescriptor ↗ nodejs/node
  2. [2] fix: instrument type-stripped TypeScript modules ↗ nodejs/import-in-the-middle
  3. [3] feat: instrument type-stripped TypeScript modules (#258) nodejs/import-in-the-middle
  4. [4] deps: update nghttp3 to 1.17.0 ↗ nodejs/node
  5. [5] deps: update sqlite to 3.53.3 ↗ nodejs/node
  6. [6] src: abstract tracing agent for both legacy and perfetto ↗ nodejs/node
  7. [7] tools: add GHA benchmark runner ↗ nodejs/node

FAQ

What changed in Node.js on June 30, 2026?
Node's VM context is now copying property descriptors correctly after a recent V8 change exposed a long-standing bug that left values undefined.
What should Node.js teams do about it?
Test vm.createContext code paths with Node 23+ if using property descriptors • Update import-in-the-middle if instrumenting type-stripped TypeScript with Node 22.13+ • Monitor reliability report for 2026-06-30
Which Node.js repositories shipped on June 30, 2026?
nodejs/node, nodejs/import-in-the-middle

Related across the cluster

For your repos

The showcase is a teaser.
Your wire is the product.

Same engine. Different stack. Below: what changes when the wire is yours.

Showcase wire

  • 14 famous open source orgs
  • One wire per day
  • Public, generic
  • Read on the web, when you remember

Your wire

  • Up to 1,500 of your repos - orgs, deps, vendors
  • Morning and evening briefs
  • Action items routed to your team
  • Slack delivery, email, breaking-news CVE alerts

Want a hands-on demo first? Ask a current user for an invite link.