Who contributed to Node.js on July 29, 2026?

10 developers shipped this update, including github-actions[bot], dependabot, semantic-release-bot, lluisemper, Ethan-Arrowood, Paul Bouchon, nodejs-github-bot, and Soul Lee, and 2 more.

What were the notable Node.js updates?

net: add experimental net/promises API, lib: fix AbortSignal.any() observed-composite leak, and Blog: announce delay of security release (again) (#9030).

@nodejs

The Node.js runtime - every backend team's CVE source of truth

github ↗

Pick a date

Topics: JavaScript Full archive →

The Wire · Showcase

NET/PROMISES ARRIVES, SECURITY RELEASE DELAYED AGAIN

By RepoJournal · Filed 06:56 UTC on July 29, 2026 · About Node.js

10 people shipped this

Rafael Gonzaga @RafaelGSS 2 cited

github-actions[bot] @github-actions[bot] 1 cited

dependabot @dependabot 1 cited

lluisemper @lluisemper 1 cited

Ethan-Arrowood @Ethan-Arrowood 1 cited

Paul Bouchon @bitpshr 1 cited

nodejs-github-bot @nodejs-github-bot 1 cited

semantic-release-bot @semantic-release-bot

Soul Lee @soulee-dev

Aviv Keller @avivkeller

Node.js ships a promise-based net API that eliminates hand-wired event listeners, while the July security release slips for the second time.

The net module now has an experimental `net/promises` namespace [1], mirroring the existing fs/promises and dns/promises patterns. This is the first major ergonomic win for connection handling in Node.js core, letting developers `await` socket connections and server listening without manually wiring `'connect'` and `'error'` events. The feature is available via `require('node:net/promises')` or `require('node:net').promises`. Meanwhile, two back-to-back blog posts [3] [4] announce the July 2026 security release has been postponed again, with no new timeline published yet. On the reliability front, a critical fix landed for AbortSignal.any() [2], which was leaking memory by failing to prune aborted composites from persistent signal tracking. Dependency maintenance continues across the ecosystem: dist-indexer bumped the bl library to 7.0.10 [5] and hit v1.8.21 [6], while SQLite updated to 3.53.4 [7]. Documentation improvements landed too, with MDN cross-references now integrated into fs module docs for explicit resource management [8].

Action items

→ Review net/promises migration path for your connection-heavy services nodejs/node [plan]
→ Patch AbortSignal.any() if you track multiple abort sources nodejs/node [immediate]
→ Watch for July security release announcement with concrete date nodejs/nodejs.org [monitor]

References

[1] net: add experimental net/promises API ↗ nodejs/node
[2] lib: fix AbortSignal.any() observed-composite leak nodejs/node
[3] Blog: announce delay of security release (again) (#9030) nodejs/nodejs.org
[4] Blog: announce sec release postponed (#9022) nodejs/nodejs.org
[5] chore(deps): bump bl from 7.0.8 to 7.0.10 ↗ nodejs/nodejs-dist-indexer
[6] v1.8.21 ↗ nodejs/nodejs-dist-indexer
[7] deps: update sqlite to 3.53.4 ↗ nodejs/node
[8] doc: add MDN links for explicit resource management in fs nodejs/node

Quick answers

What shipped in Node.js on July 29, 2026?: Node.js ships a promise-based net API that eliminates hand-wired event listeners, while the July security release slips for the second time. In total, 18 commits, 17 pull requests, and 1 releases landed.
Who contributed to Node.js on July 29, 2026?: 10 developers shipped this update, including github-actions[bot], dependabot, semantic-release-bot, lluisemper, Ethan-Arrowood, Paul Bouchon, nodejs-github-bot, and Soul Lee, and 2 more.
What were the notable Node.js updates?: net: add experimental net/promises API, lib: fix AbortSignal.any() observed-composite leak, and Blog: announce delay of security release (again) (#9030).

NODE CORE TIGHTENS TEST COVERAGE AS UNDICI SHIPS H2 NAMESPACE UPGRADE

Node's core test suite is closing escape hatches that let assertions slip through linter rules, while Undici moves HTTP/2 options into a cleaner namespace.

javascript 18 shipped 1-min read

@nodejs 2 days ago

Node DNS Reverse Lookups Fixed, REPL Gets Syntax Highlighting

Node core shipped a DNS fix that stops reverse lookups from consulting /etc/hosts, breaking alignment with documented behavior that caught developers mid-production.

javascript 14 shipped 1-min read

@nodejs 3 days ago

NODE CRASHES ON ODD-LENGTH HEX STRINGS VIA WRITEV

A critical crash in Node's binary handling when writing hex strings through Writev is now fixed, along with three other stability improvements shipping across the runtime.

javascript 25 shipped 1-min read

@nodejs 4 days ago

NODE CORE TIGHTENS DNS BEHAVIOR, DOCS TOOLING SHIFTS AWAY FROM OXC

DNS tests now codify a breaking change in record lookup behavior, while the documentation pipeline abandons OXC for a WASM-based alternative after CI runner incompatibility.

javascript 38 shipped 1-min read

Elsewhere on the wire

AI Agents about 4 hours ago

LANGCHAIN CORES SHIP, ANTHROPIC THINKING BLOCKS FIXED, OPENHANDS TIGHTENS WEBSOCKET AUTH

LangChain released two core packages with critical fixes for streaming stability and environment variable handling, while OpenHands closed a security gap that left WebSocket connections unprotected.

ai-agents 119 shipped 1-min read

Local LLMs about 4 hours ago

OLLAMA RIPS OUT IMAGE GENERATION, LLAMA.CPP SHIPS SPECULATIVE DECODING

Ollama removed its entire MLX image generation pipeline overnight, while llama.cpp landed DSpark speculative decoding and fixed a critical SYCL memory bug affecting Arc GPUs.

+11

llms 239 shipped 2-min read

@CachyOS about 4 hours ago

KERNEL SCHEDULER UPDATES ACROSS BORE AND SCX TOOLING

CachyOS shipped BORE 6.8.0 patches across two kernel series while upgrading its sched-ext ecosystem in parallel, signaling major tuning work ahead.

infra 83 shipped 1-min read

Elixir & Phoenix about 4 hours ago

ELIXIR TIGHTENS ERROR HANDLING ACROSS DATE, ECTO, AND IEXHELPERS

Date.range now surfaces ArgumentError instead of Protocol.UndefinedError when passed invalid step values, catching a class of bugs that silently fail in production code.