RepoJournal
Node.js @nodejs
129 wires and counting

$ follow Node.js

Keep up with Node.js in about 3 minutes: what actually shipped — the commits, pull requests, releases, and security advisories that matter.

or

fair warning: these emails are deeply technical. diffs, version numbers, CVEs, benchmark deltas. if that's not your idea of a good read, this isn't your newsletter.

Folds into your digest — weekly by default, monthly if you prefer. Unsubscribe in one click.

$ status

wire 2026-07-29
stories 36
GitHub RSS Archive Reviews Topics

© 2026 RepoJournal Home Showcase Explore How it works Privacy

$ the-wire · showcase

NET/PROMISES ARRIVES, SECURITY RELEASE DELAYED AGAIN

By RepoJournal · Filed · About Node.js · Composed from the cited sources · methodology

Rafael Gonzaga github-actions[bot] dependabot lluisemper Ethan-Arrowood Paul Bouchon nodejs-github-bot
10 people shipped this
Rafael Gonzaga @RafaelGSS 2 cited github-actions[bot] @github-actions[bot] 1 cited dependabot @dependabot 1 cited lluisemper @lluisemper 1 cited Ethan-Arrowood @Ethan-Arrowood 1 cited Paul Bouchon @bitpshr 1 cited nodejs-github-bot @nodejs-github-bot 1 cited semantic-release-bot @semantic-release-bot Soul Lee @soulee-dev Aviv Keller @avivkeller

Node.js ships a promise-based net API that eliminates hand-wired event listeners, while the July security release slips for the second time.

The net module now has an experimental `net/promises` namespace [1], mirroring the existing fs/promises and dns/promises patterns. This is the first major ergonomic win for connection handling in Node.js core, letting developers `await` socket connections and server listening without manually wiring `'connect'` and `'error'` events. The feature is available via `require('node:net/promises')` or `require('node:net').promises`. Meanwhile, two back-to-back blog posts [3] [4] announce the July 2026 security release has been postponed again, with no new timeline published yet. On the reliability front, a critical fix landed for AbortSignal.any() [2], which was leaking memory by failing to prune aborted composites from persistent signal tracking. Dependency maintenance continues across the ecosystem: dist-indexer bumped the bl library to 7.0.10 [5] and hit v1.8.21 [6], while SQLite updated to 3.53.4 [7]. Documentation improvements landed too, with MDN cross-references now integrated into fs module docs for explicit resource management [8].

Action items

References

  1. [1] net: add experimental net/promises API ↗ nodejs/node
  2. [2] lib: fix AbortSignal.any() observed-composite leak ↗ nodejs/node
  3. [3] Blog: announce delay of security release (again) (#9030) ↗ nodejs/nodejs.org
  4. [4] Blog: announce sec release postponed (#9022) ↗ nodejs/nodejs.org
  5. [5] chore(deps): bump bl from 7.0.8 to 7.0.10 ↗ nodejs/nodejs-dist-indexer
  6. [6] v1.8.21 ↗ nodejs/nodejs-dist-indexer
  7. [7] deps: update sqlite to 3.53.4 ↗ nodejs/node
  8. [8] doc: add MDN links for explicit resource management in fs ↗ nodejs/node

$ ls nodejs/reviews/ # the step-back reads

the week in review Node 26.9.0 ships generic crypto MAC API the month in review Node 26 line lands crypto, stream, and FFI hardening as deprecations tighten the core
Topics: JavaScript Full archive → Weekly reviews →

Quick answers

What shipped in Node.js on July 29, 2026?
Node.js ships a promise-based net API that eliminates hand-wired event listeners, while the July security release slips for the second time. In total, 18 commits, 17 pull requests, and 1 releases landed.
Who contributed to Node.js on July 29, 2026?
10 developers shipped this update, including github-actions[bot], dependabot, semantic-release-bot, lluisemper, Ethan-Arrowood, Paul Bouchon, nodejs-github-bot, and Soul Lee, and 2 more.
What were the notable Node.js updates?
net: add experimental net/promises API, lib: fix AbortSignal.any() observed-composite leak, and Blog: announce delay of security release (again) (#9030).
♥

$ log @nodejs --recent

SEA gets ZIP asset archives, HTTP server sheds per-request allocations 28 shipped Buffer.stringLength(), and a trace_events abort for embedders 40 shipped cpSync dereference regression fixed, trace union punning removed 39 shipped Node 26.9.0 adds a generic MAC API, undici walks back its decompression size cap 27 shipped

$ log --all # elsewhere on the wire

@openclaw Cold-start Gateway diagnostics stop crying wolf, doctor repairs plugin drift Agentic Coding Cline desktop bundles shrink, goose unblocks its own clicks

$ ls showcases/

Rails Django Laravel Go Vercel Vue.js Kubernetes HashiCorp Arch Linux Linux Anthropic OpenAI

$ init your-desk

RepoJournal can write one of these for any repo you care about. Sign in with GitHub, pick your repos and sources, and your desk gets a wire like this one every morning.