Who contributed to Node.js on June 30, 2026?

4 developers shipped this update, including legendecas, BridgeAR, nodejs-github-bot, and aduh95.

What were the notable Node.js updates?

vm: fix copying PropertyDescriptor, fix: instrument type-stripped TypeScript modules, and feat: instrument type-stripped TypeScript modules (#258).

@nodejs

The Node.js runtime - every backend team's CVE source of truth

github ↗

Pick a date

Topics: JavaScript Full archive →

The Wire · Showcase

NODE FIXES VM PROPERTY DESCRIPTOR BUG, TYPESCRIPT INSTRUMENTATION GAPS

By RepoJournal · Filed 06:01 UTC on June 30, 2026 · About Node.js

4 people shipped this

legendecas @legendecas 2 cited

nodejs-github-bot @nodejs-github-bot 2 cited

BridgeAR @BridgeAR 1 cited

aduh95 @aduh95 1 cited

Node's VM context is now copying property descriptors correctly after a recent V8 change exposed a long-standing bug that left values undefined.

The VM fix [1] matters immediately if you're using `vm.createContext` and property interception hooks. The descriptor copy was silently assigning undefined values when none existed, but Node's recent changes made V8 stop auto-correcting this, leaving broken property definitions in place. In parallel, import-in-the-middle now handles type-stripped TypeScript modules [2], closing an instrumentation gap that left `.ts` files running completely uninstrumented when Node's `--experimental-strip-types` flag was active. The library now adds TypeScript formats to its handler list, ensuring hooks fire even when source is type-stripped before parsing [3]. On the dependency front, Node merged updates to nghttp3 1.17.0 [4] and SQLite 3.53.3 [5], both routine maintenance. Infrastructure improvements include a new GitHub Actions benchmark runner [7] that lets non-collaborators test performance on their own forks, and Node's tracing layer is being abstracted to support both legacy and perfetto agents [6], setting up diagnostics for the future.

Action items

→ Test vm.createContext code paths with Node 23+ if using property descriptors nodejs/node [plan]
→ Update import-in-the-middle if instrumenting type-stripped TypeScript with Node 22.13+ nodejs/import-in-the-middle [plan]
→ Monitor reliability report for 2026-06-30 nodejs/reliability [monitor]

References

[1] vm: fix copying PropertyDescriptor ↗ nodejs/node
[2] fix: instrument type-stripped TypeScript modules ↗ nodejs/import-in-the-middle
[3] feat: instrument type-stripped TypeScript modules (#258) nodejs/import-in-the-middle
[4] deps: update nghttp3 to 1.17.0 ↗ nodejs/node
[5] deps: update sqlite to 3.53.3 ↗ nodejs/node
[6] src: abstract tracing agent for both legacy and perfetto ↗ nodejs/node
[7] tools: add GHA benchmark runner ↗ nodejs/node

Quick answers

What shipped in Node.js on June 30, 2026?: Node's VM context is now copying property descriptors correctly after a recent V8 change exposed a long-standing bug that left values undefined. In total, 18 commits, 16 pull requests, and 1 releases landed.
Who contributed to Node.js on June 30, 2026?: 4 developers shipped this update, including legendecas, BridgeAR, nodejs-github-bot, and aduh95.
What were the notable Node.js updates?: vm: fix copying PropertyDescriptor, fix: instrument type-stripped TypeScript modules, and feat: instrument type-stripped TypeScript modules (#258).

Node DNS Reverse Lookups Fixed, REPL Gets Syntax Highlighting

Node core shipped a DNS fix that stops reverse lookups from consulting /etc/hosts, breaking alignment with documented behavior that caught developers mid-production.

javascript 14 shipped 1-min read

@nodejs 2 days ago

NODE CRASHES ON ODD-LENGTH HEX STRINGS VIA WRITEV

A critical crash in Node's binary handling when writing hex strings through Writev is now fixed, along with three other stability improvements shipping across the runtime.

javascript 25 shipped 1-min read

@nodejs 3 days ago

NODE CORE TIGHTENS DNS BEHAVIOR, DOCS TOOLING SHIFTS AWAY FROM OXC

DNS tests now codify a breaking change in record lookup behavior, while the documentation pipeline abandons OXC for a WASM-based alternative after CI runner incompatibility.

javascript 38 shipped 1-min read

@nodejs 4 days ago

SQLITE GARBAGE COLLECTION BUG AND FFI REENTRANCY HAZARDS DEMAND IMMEDIATE PATCHES

Node.js shipped critical fixes overnight for a use-after-free vulnerability in SQLite callbacks and a string buffer corruption bug in Fast FFI reentrant calls that could crash production systems.

javascript 42 shipped 2-min read

Elsewhere on the wire

AI Agents about 21 hours ago

CLINE SHIPS FIVE CRITICAL AGENT FIXES AFTER END-TO-END TESTING BLITZ

Saoudrizwan just landed a cascade of fixes that prevent the agent loop from running wild, stop file reads from resolving to the wrong directory, and plug the compaction pipeline.

ai-agents 16 shipped 2-min read

Local LLMs about 21 hours ago

LLAMA.CPP SHIPS MINIMAX-M3 SPARSE ATTENTION, VLLM UNLOCKS HETEROGENEOUS PREFILL-DECODE

The inference stack gets a new model architecture and a fundamental shift in how prefill and decode can run on different hardware configurations.

+10

llms 125 shipped 1-min read

@CachyOS about 21 hours ago

GLIBC 2.43 REBUILD SHIPS, INSTALLER JUMPS TO C++26

CachyOS pushed glibc 2.43 through the pipeline while the CLI installer upgraded its C++ standard to C++26, signaling a major refresh across core infrastructure.

infra 97 shipped 1-min read

Elixir & Phoenix about 21 hours ago

ECTO FIXES SUBQUERY PLANNING IN JOINS, ELIXIR PATCHES IEX PARSING

Ecto's query planner now handles subqueries correctly in interpolated join filters, while Elixir fixes a syntax error that broke 'not in' as a continuation operator in IEx.