RepoJournal
Node.js

@nodejs

The Node.js runtime - every backend team's CVE source of truth

What actually shipped in Node.js, written up every day — commits, pull requests, releases, and security advisories.

One email a day. Unsubscribe in one click.

Pick a date

  1. Wed 17 jun
  2. Thu 18 jun
  3. Fri 19 jun
  4. Sat 27 jun
  5. Sun 28 jun
  6. Mon 29 jun
  7. Tue 30 jun
  8. Wed 1 jul
  9. Thu 2 jul
  10. Fri 3 jul
  11. Sat 4 jul
  12. Sun 5 jul
  13. Mon 6 jul
  14. Tue 7 jul
  15. Wed 8 jul
  16. Thu 9 jul
  17. Fri 10 jul
  18. Sat 11 jul
  19. Sun 12 jul
  20. Mon 13 jul
  21. Tue 14 jul
  22. Wed 15 jul
  23. Thu 16 jul
  24. Fri 17 jul
  25. Sat 18 jul
  26. Sun 19 jul
  27. Mon 20 jul
  28. Tue 21 jul
  29. Wed 22 jul
  30. Today 23 jul
Topics: JavaScript Full archive →

The Wire · Showcase

NODE.JS STRIPS DEPRECATED API CALLS, FIXES FFI BOOL REGRESSION

By RepoJournal · Filed · About Node.js

Antoine du Hamel GitHub Actions tsctx trivikr Node.js GitHub Bot
5 people shipped this
Antoine du Hamel @aduh95 3 cited GitHub Actions @web-flow 1 cited tsctx @tsctx 1 cited trivikr @trivikr 1 cited Node.js GitHub Bot @nodejs-github-bot

Antoine du Hamel landed two critical cleanups in core this cycle, removing deprecated function calls and custom DOM polyfills while the FFI layer gets a precision fix that restores uint8 semantics.

Node.js is tightening its internal APIs. The stream module ditched its custom `CloneableDOMException` implementation [1], a workaround that's outlived its usefulness now that the platform's native `DOMException` supports cloning natively. The DNS module followed suit, stopping use of deprecated functions in `SetServers` [2], keeping the codebase aligned with modern patterns. On the FFI front, a subtle but important regression got fixed: the `bool` type in fast calls was incorrectly mapped to V8's JavaScript Boolean after JIT optimization, changing return values from numbers to Booleans and accepting true/false as arguments when it shouldn't [3]. The fix normalizes `bool` to `kUint8` semantics, restoring documented behavior. Documentation also got attention, with broken links cleaned up during backport work to v24.x [4]. Meanwhile, undici tightened Windows compatibility by ignoring auto-generated .npmrc files [5], and the nightly snapshots continue rolling [6].

One email a day. Unsubscribe in one click.

Action items

References

  1. [1] stream: remove custom `CloneableDOMException` implementation nodejs/node
  2. [2] dns: stop using deprecated functions in `SetServers` nodejs/node
  3. [3] ffi: preserve uint8 semantics for bool fast calls ↗ nodejs/node
  4. [4] doc: fix broken links and clean up type map ↗ nodejs/node
  5. [5] Ignore auto-generated .npmrc on Windows ↗ nodejs/undici
  6. [6] snap: (auto) updated to 27.0.0-nightly202607230992f6b87e nodejs/snap

Quick answers

What shipped in Node.js on July 23, 2026?
Antoine du Hamel landed two critical cleanups in core this cycle, removing deprecated function calls and custom DOM polyfills while the FFI layer gets a precision fix that restores uint8 semantics. In total, 10 commits and 7 pull requests landed.
Who contributed to Node.js on July 23, 2026?
5 developers shipped this update, including GitHub Actions, tsctx, Antoine du Hamel, trivikr, and Node.js GitHub Bot.
What were the notable Node.js updates?
stream: remove custom `CloneableDOMException` implementation, dns: stop using deprecated functions in `SetServers`, and ffi: preserve uint8 semantics for bool fast calls.

More from @nodejs

Node.js @nodejs

NODE CORE HARDENS CRYPTO AND FFI, UNDICI PATCHES HEADER INJECTION

Node's crypto layer just got faster and safer, while undici plugged a CRLF injection hole that only matters if your app trusts untrusted function objects as headers.

Filip Skokan Qard trivikr Mhayk Whandson +2
javascript 26 shipped 1-min read
Node.js @nodejs

NODE FIXES STACK OVERFLOW IN RECURSIVE READDIR, PATCHES PERMISSION AUDIT MODE

A circular symlink crash in recursive directory traversal just got patched, and permission audit mode finally stops throwing errors when it should only warn.

AkshatOP edsadr Trivikram Kamat panva +4
javascript 23 shipped 1-min read
Node.js @nodejs

NODE PLUGS TIMER MEMORY LEAK, FIXES FFI SIGNATURE DOUBLE-EVALUATION

Node's garbage collector was holding onto timer references it shouldn't have, and a critical FFI vulnerability let native functions receive different signatures than JavaScript thought it was passing.

mcollina Adrián Estrada trivikr panva +3
javascript 18 shipped 1-min read
Node.js @nodejs

NODE FIXES CRITICAL STREAM PIPE BUG BLOCKING HEALTHY DESTINATIONS

A regression in Node's stream handling silences data flow to working destinations when a sibling pipe errors, breaking multi-destination pipelines across all recent versions.

bmuenzenmeyer Mahin Anowar avivkeller Paul Bouchon +2
javascript 13 shipped 1-min read

Daily updates, in your inbox

Follow Node.js

What actually shipped in Node.js, written up every day — commits, pull requests, releases, and security advisories.

or

One email a day. Unsubscribe in one click. Read a past issue →

Elsewhere on the wire

AI Agents AI Agents

LANGCHAIN REFRESHES MODEL PROFILES, OPENROUTER 0.2.7 SHIPS

OpenRouter integration lands with updated model profiles including Google's Gemini 3.5 Flash Lite, while core token counting gets a performance fix for multi-tool agents.

github-actions[bot] langchain-oss-model-profiles langchain-oss-model-profiles[bot] imnishitha +6
ai-agents 29 shipped 1-min read
Local LLMs Local LLMs

OLLAMA AGENTS NOW IMPORT SKILLS FROM CODEX AND CLAUDE

Ollama shipped a skills import system that lets coding agents pull validated skill directories from external sources, while simultaneous fixes to GLM tool-call parsing and Laguna model alignment prevent agents from silently failing.

ParthSareen dhiltgen m1el rankaiyx +10
llms 212 shipped 2-min read
CachyOS @CachyOS

BRAVE BROWSER SOURCES SHIFT TO APT, GAME RULES SURGE, GERMAN WIKI TRANSLATIONS ACCELERATE

CachyOS is consolidating Brave packaging around apt sources while ananicy-rules absorbs a massive gaming ruleset expansion and the wiki team pushes German localization across multiple docs.

Vladislav Nepogodin Piotr Gorski lukaogadze Matias +1
infra 81 shipped 1-min read
Elixir & Phoenix Elixir & Phoenix

ELIXIR FIXES CALENDAR AND COMPILER EDGE CASES ACROSS FIVE PATCHES

Alexander Gubarev landed five targeted fixes to Calendar.ISO and ParallelCompiler that close gaps in time parsing, validation guards, and documentation.

Alexander Gubarev
elixir 15 shipped 1-min read
Want every project, not just this one?