Who contributed to Node.js on July 9, 2026?

1 developer shipped this update, including npm-cli-bot.

What were the notable Node.js updates?

crypto: split OpenSSL 3, BoringSSL, and legacy backends, quic: correct http3 callback and fix revealed errs, and deps: upgrade npm to 11.18.0.

@nodejs

The Node.js runtime - every backend team's CVE source of truth

github ↗

Pick a date

Topics: JavaScript Full archive →

The Wire · Showcase

Node crypto backend split lands, HTTP/3 callbacks corrected

By RepoJournal · Filed 06:01 UTC on July 9, 2026 · About Node.js

1 person shipped this

npm-cli-bot @npm-cli-bot 1 cited

The core team shipped major refactoring across crypto and QUIC while npm 11.18.0 tightens registry handling, and undici's benchmarks catch up to got v15.

The most consequential change is the crypto backend split [1], which isolates OpenSSL 3, BoringSSL, and legacy OpenSSL into separate code paths. The OpenSSL 3 path now builds with strict deprecation flags, moving away from APIs marked deprecated in 3.0.0 while keeping ENGINE support in its own compatibility layer. This matters because it unblocks Node from using the latest OpenSSL without forcing every consumer to deal with deprecation warnings. In parallel, the HTTP/3 implementation got a critical callback fix [2] that corrects how the application interprets nghttp3 stopSending and ResetStream callbacks, which the team discovered actually request actions rather than reporting peer events. The discovery also surfaced test failures around header state management during graceful shutdown, now fixed. Less visible but steady work: npm upgraded to 11.18.0 [3] with improved registry host matching via URL prefix support, and undici's benchmarks have been adjusted [4] to account for got v15's removal of the url and isStream parameters. The web team logged meeting notes [5] and reliability published fresh metrics [6].

Action items

→ Review the crypto backend split for any custom ENGINE usage in your build nodejs/node [plan]
→ Watch for HTTP/3 session shutdown behavior changes if you're testing QUIC nodejs/node [monitor]
→ Update benchmarks if you're comparing against got post-v15 nodejs/undici [plan]

References

[1] crypto: split OpenSSL 3, BoringSSL, and legacy backends nodejs/node
[2] quic: correct http3 callback and fix revealed errs nodejs/node
[3] deps: upgrade npm to 11.18.0 ↗ nodejs/node
[4] fix(benchmarks): adjust got after v15 upgrade (#5526) nodejs/undici
[5] Add meeting notes for Node.js Web Team on 2026-07-06 (#162) nodejs/web-team
[6] Add report for 2026-07-09 nodejs/reliability

Quick answers

What shipped in Node.js on July 9, 2026?: The core team shipped major refactoring across crypto and QUIC while npm 11.18.0 tightens registry handling, and undici's benchmarks catch up to got v15. In total, 19 commits, 14 pull requests, and 1 releases landed.
Who contributed to Node.js on July 9, 2026?: 1 developer shipped this update, including npm-cli-bot.
What were the notable Node.js updates?: crypto: split OpenSSL 3, BoringSSL, and legacy backends, quic: correct http3 callback and fix revealed errs, and deps: upgrade npm to 11.18.0.

Node DNS Reverse Lookups Fixed, REPL Gets Syntax Highlighting

Node core shipped a DNS fix that stops reverse lookups from consulting /etc/hosts, breaking alignment with documented behavior that caught developers mid-production.

javascript 14 shipped 1-min read

@nodejs 2 days ago

NODE CRASHES ON ODD-LENGTH HEX STRINGS VIA WRITEV

A critical crash in Node's binary handling when writing hex strings through Writev is now fixed, along with three other stability improvements shipping across the runtime.

javascript 25 shipped 1-min read

@nodejs 3 days ago

NODE CORE TIGHTENS DNS BEHAVIOR, DOCS TOOLING SHIFTS AWAY FROM OXC

DNS tests now codify a breaking change in record lookup behavior, while the documentation pipeline abandons OXC for a WASM-based alternative after CI runner incompatibility.

javascript 38 shipped 1-min read

@nodejs 4 days ago

SQLITE GARBAGE COLLECTION BUG AND FFI REENTRANCY HAZARDS DEMAND IMMEDIATE PATCHES

Node.js shipped critical fixes overnight for a use-after-free vulnerability in SQLite callbacks and a string buffer corruption bug in Fast FFI reentrant calls that could crash production systems.

javascript 42 shipped 2-min read

Elsewhere on the wire

AI Agents about 21 hours ago

CLINE SHIPS FIVE CRITICAL AGENT FIXES AFTER END-TO-END TESTING BLITZ

Saoudrizwan just landed a cascade of fixes that prevent the agent loop from running wild, stop file reads from resolving to the wrong directory, and plug the compaction pipeline.

ai-agents 16 shipped 2-min read

Local LLMs about 21 hours ago

LLAMA.CPP SHIPS MINIMAX-M3 SPARSE ATTENTION, VLLM UNLOCKS HETEROGENEOUS PREFILL-DECODE

The inference stack gets a new model architecture and a fundamental shift in how prefill and decode can run on different hardware configurations.

+10

llms 125 shipped 1-min read

@CachyOS about 21 hours ago

GLIBC 2.43 REBUILD SHIPS, INSTALLER JUMPS TO C++26

CachyOS pushed glibc 2.43 through the pipeline while the CLI installer upgraded its C++ standard to C++26, signaling a major refresh across core infrastructure.

infra 97 shipped 1-min read

Elixir & Phoenix about 21 hours ago

ECTO FIXES SUBQUERY PLANNING IN JOINS, ELIXIR PATCHES IEX PARSING

Ecto's query planner now handles subqueries correctly in interpolated join filters, while Elixir fixes a syntax error that broke 'not in' as a continuation operator in IEx.