RepoJournal
Node.js @nodejs
129 wires and counting

$ follow Node.js

Keep up with Node.js in about 3 minutes: what actually shipped — the commits, pull requests, releases, and security advisories that matter.

or

fair warning: these emails are deeply technical. diffs, version numbers, CVEs, benchmark deltas. if that's not your idea of a good read, this isn't your newsletter.

Folds into your digest — weekly by default, monthly if you prefer. Unsubscribe in one click.

$ status

wire 2026-07-20
stories 18
GitHub RSS Archive Reviews Topics

© 2026 RepoJournal Home Showcase Explore How it works Privacy

$ the-wire · showcase

NODE PLUGS TIMER MEMORY LEAK, FIXES FFI SIGNATURE DOUBLE-EVALUATION

By RepoJournal · Filed · About Node.js · Composed from the cited sources · methodology

mcollina Adrián Estrada trivikr panva MFA-G avivkeller Brian Muenzenmeyer
7 people shipped this
mcollina @mcollina 1 cited Adrián Estrada @edsadr 1 cited trivikr @trivikr 1 cited panva @panva 1 cited MFA-G @MFA-G 1 cited avivkeller @avivkeller Brian Muenzenmeyer @bmuenzenmeyer

Node's garbage collector was holding onto timer references it shouldn't have, and a critical FFI vulnerability let native functions receive different signatures than JavaScript thought it was passing.

The timer memory leak [1] is the bigger ship right now. After timers fire, Node was failing to clean up async context store references, preventing garbage collection. The fix iterates over active stores and clears relevant symbols, but the PR notes this pattern needs extending to immediates and intervals too. In parallel, the FFI signature double-evaluation bug [2] was letting attackers craft payloads where native code and the JavaScript wrapper disagreed on what arguments a function accepted. An accessor that mutates `signature.arguments` could make an eight-argument native function appear as fewer arguments to Node's type safety layer. Both merit immediate attention in your next patch cycle. On the surface improvements front, Node's shipping styled `--help` output [3] using util.styleText for bold headers and colored option names, though piped output stays plain. The doc-kit team is also hardening the deprecations table of contents [5], preserving DEP codes so engineers can find deprecations by ID instead of having them stripped from the sidebar.

$ ls nodejs/reviews/ # the step-back reads

the week in review Node 26.9.0 ships generic crypto MAC API the month in review Node 26 line lands crypto, stream, and FFI hardening as deprecations tighten the core
Topics: JavaScript Full archive → Weekly reviews →

Quick answers

What shipped in Node.js on July 20, 2026?
Node's garbage collector was holding onto timer references it shouldn't have, and a critical FFI vulnerability let native functions receive different signatures than JavaScript thought it was passing. In total, 9 commits and 9 pull requests landed.
Who contributed to Node.js on July 20, 2026?
7 developers shipped this update, including mcollina, Adrián Estrada, trivikr, panva, avivkeller, MFA-G, and Brian Muenzenmeyer.
What were the notable Node.js updates?
timers: do not retain a reference to the async store after firing, ffi: evaluate function signatures once, and cli: style node --help output with util.styleText.
♥

$ log @nodejs --recent

SEA gets ZIP asset archives, HTTP server sheds per-request allocations 28 shipped Buffer.stringLength(), and a trace_events abort for embedders 40 shipped cpSync dereference regression fixed, trace union punning removed 39 shipped Node 26.9.0 adds a generic MAC API, undici walks back its decompression size cap 27 shipped

$ log --all # elsewhere on the wire

@openclaw Cold-start Gateway diagnostics stop crying wolf, doctor repairs plugin drift Agentic Coding Cline desktop bundles shrink, goose unblocks its own clicks

$ ls showcases/

Rails Django Laravel Go Vercel Vue.js Kubernetes HashiCorp Arch Linux Linux Anthropic OpenAI

$ init your-desk

RepoJournal can write one of these for any repo you care about. Sign in with GitHub, pick your repos and sources, and your desk gets a wire like this one every morning.