@nodejs

The Node.js runtime — every backend team's CVE source of truth

github ↗

Pick a date

The Wire · Showcase

NODE.JS SNAP DROPS YARN, SHIPS TEMPORAL BY DEFAULT

By RepoJournal · Filed 06:56 UTC on July 11, 2026 · About Node.js

9 people shipped this

Node.js snap builds are moving forward: Yarn support ends for pre-26 releases, Node 26 enters the CI pipeline, and Temporal becomes a standard feature across all new builds.

The snap maintainers shipped breaking changes that mark a hard line in the sand [1]. Node 20 is out of the CI matrix, Node 26 is in [2], and pre-26 builds no longer include Yarn [1]. This isn't just version housekeeping. Temporal landed as an enabled-by-default feature in Node builds [3], which means snap users get the stage-3 temporal API without feature flags. Over on the core side, Node addressed compile-time warnings in the c-ares bindings by updating deprecated function calls [4], and OpenSSL gained RISC-V assembly support that was unavailable when riscv64 was first added to the build matrix [5]. Doc-kit is patching its Vercel scripts to build against the latest upstream Node release tag instead of the process version [6], and stream consumers now defensively copy SharedArrayBuffer-backed chunks to prevent unintended data persistence [7]. Unofficial builds fixed a critical arm64-musl gap where the musl-cross-make toolchain wasn't injecting build-id sections, breaking postject-based SEA tooling [8].

Action items

→ If you maintain snap distributions, test Node 26 compatibility immediately and drop any pre-26 Yarn expectations nodejs/snap [immediate]
→ Update Vercel deployment scripts to use upstream Node release tags instead of process.version nodejs/doc-kit [plan]
→ If building arm64-musl binaries for SEA or postject tooling, upgrade unofficial-builds to get build-id sections nodejs/unofficial-builds [immediate]
→ Review stream consumer code that handles SharedArrayBuffer data to understand the new defensive copy behavior nodejs/node [monitor]

References

[1] feat!: remove yarn for pre-26 (#100) nodejs/snap
[2] chore(ci): drop 20, add 26 nodejs/snap
[3] fix: enable Temporal in Node builds nodejs/snap
[4] dns: address compile-time warnings ↗ nodejs/node
[5] deps: enable OpenSSL asm support for riscv64 ↗ nodejs/node
[6] fix(vercel): update vercel scripts to build against latest Node.js release tag ↗ nodejs/doc-kit
[7] stream: copy SAB-backed chunks in iter consumers ↗ nodejs/node
[8] fix: emit build-id in arm64-musl cross-compiled binaries (#233) nodejs/unofficial-builds

NOTHING SHIPPED

All quiet across Node.js overnight.

javascript 1 shipped 1-min read

@nodejs 2 days ago

Node crypto backend split lands, HTTP/3 callbacks corrected

The core team shipped major refactoring across crypto and QUIC while npm 11.18.0 tightens registry handling, and undici's benchmarks catch up to got v15.

javascript 34 shipped 1-min read

@nodejs 3 days ago

HTTP2 CUTS OVERHEAD 30 PERCENT ACROSS HOT PATH

Node core just shipped a series of performance wins that strip per-request allocations from HTTP2, skipping unnecessary trailers round trips and eliminating object clones on every respond() call.

javascript 29 shipped 1-min read

@nodejs 4 days ago

BUFFER METHODS GET 15% SPEED BOOST, QUIC HARDENS AGAINST PACKET ATTACKS

Node core shipped three performance wins overnight while tightening QUIC security for version negotiation packets.

javascript 44 shipped 1-min read

— or follow the whole beat:

Elsewhere on the wire

Elixir & Phoenix about 6 hours ago

ELIXIR FIXES TIME MATH BUG THAT ROUNDS THE WRONG WAY

NaiveDateTime.diff/3 has been silently rounding elapsed time up instead of down, breaking its documented contract and potentially causing logic errors in any code relying on time-based calculations.

elixir 35 shipped 1-min read

@dotnet about 6 hours ago

OPERATOR SDK 13.0 BREAKS CONTROLLER ARCHITECTURE, ANDROID TESTS GO LOCAL

The dotnet-operator-sdk ships a major breaking change that fundamentally rewrites how multiple controllers target the same entity, while the Android team closes external test dependencies to fix certificate export failures on macOS.

dotnet 40 shipped 2-min read

@spring-projects about 6 hours ago

SPRING INTEGRATION FIXES CRITICAL LOCK REGISTRY BUG BLOCKING DISTRIBUTED SYSTEMS

Spring Integration shipped an emergency fix for JdbcLockRegistry that was causing false application hangs when different keys collided on shared locks.

java 10 shipped 1-min read

FastAPI & Pydantic about 6 hours ago

PYDANTIC ADDS VALIDATION ERROR TROUBLESHOOTING GUIDE

Pydantic just shipped a troubleshooting guide that walks you through reading validation failures in Logfire traces, cutting your debugging time in half.

python 2 shipped 1-min read