Who contributed to Node.js on July 30, 2026?

5 developers shipped this update, including Nick Schonning, Node.js GitHub Bot, rvagg, github-actions[bot], and semantic-release-bot.

What were the notable Node.js updates?

feat: Node.js 26.5.1 (#2582), feat: Node.js 22.23.2, and chore: downgrade broken changelog maker (#22).

@nodejs

The Node.js runtime - every backend team's CVE source of truth

github ↗

Pick a date

Topics: JavaScript Full archive →

The Wire · Showcase

NODE.JS 26.5.1 DOCKER IMAGES LIVE, CHANGELOG TOOLING FIXED ACROSS RELEASE INFRASTRUCTURE

By RepoJournal · Filed 06:56 UTC on July 30, 2026 · About Node.js

5 people shipped this

rvagg @rvagg 3 cited

Nick Schonning @nschonni 1 cited

Node.js GitHub Bot @nodejs-github-bot 1 cited

github-actions[bot] @github-actions[bot] 1 cited

semantic-release-bot @semantic-release-bot

Docker Node shipped 26.5.1 overnight while the release pipeline fixed a broken changelog maker that was cascading failures through branch-diff and commit-stream.

Node.js 26.5.1 landed in docker-node with musl builds now ready [1], following the 22.23.2 release that automated bot systems picked up across the ecosystem [2]. The real story behind the scenes: Rod Vagg downgraded a broken changelog maker in commit-stream [3] that was blocking the entire release toolchain. That same fix flowed into branch-diff [4], which just shipped v3.1.8 [5] with the changelog tool downgrade and a reworked GitHub Actions setup. Vagg also tightened CI discipline in branch-diff by slowing dependabot, grouping updates, and pinning all actions by hash [6], a hardening move that signals the team expects more pressure on their release infrastructure. Across both tooling repos, 5 PRs merged and 2 releases shipped in 24 hours.

Action items

→ Pull latest Node.js 26.5.1 docker images if you ship containerized workloads nodejs/docker-node [plan]
→ If you depend on branch-diff or commit-stream for release tooling, upgrade to branch-diff 3.1.8 nodejs/branch-diff [plan]
→ Watch for follow-up releases as the changelog tool stabilizes nodejs/commit-stream [monitor]

References

[1] feat: Node.js 26.5.1 (#2582) nodejs/docker-node
[2] feat: Node.js 22.23.2 ↗ nodejs/docker-node
[3] chore: downgrade broken changelog maker (#22) nodejs/commit-stream
[4] chore: downgrade broken changelog maker, backfill, rework GHA ↗ nodejs/branch-diff
[5] v3.1.8 ↗ nodejs/branch-diff
[6] chore(ci): slow down dependabot, group, pin actions by hash ↗ nodejs/branch-diff

Quick answers

What shipped in Node.js on July 30, 2026?: Docker Node shipped 26.5.1 overnight while the release pipeline fixed a broken changelog maker that was cascading failures through branch-diff and commit-stream. In total, 8 commits, 5 pull requests, and 2 releases landed.
Who contributed to Node.js on July 30, 2026?: 5 developers shipped this update, including Nick Schonning, Node.js GitHub Bot, rvagg, github-actions[bot], and semantic-release-bot.
What were the notable Node.js updates?: feat: Node.js 26.5.1 (#2582), feat: Node.js 22.23.2, and chore: downgrade broken changelog maker (#22).

NODE 26.7.0 SHIPS WITH CRYPTO UPGRADES AND DNS SECURITY FIX

Node.js 26.7.0 landed overnight with SEMVER-MINOR crypto improvements and a critical DNS vulnerability patch that prevents large resolveAny replies from crashing.

javascript 49 shipped

@nodejs Aug 5

STREAMS SHED ALLOCATIONS, HTTP/2 WINDOWS QUADRUPLE

Node.js core cut per-chunk memory overhead in pipeTo by eliminating redundant promise allocations, while HTTP/2 default window sizes jumped 64x to unlock full bandwidth on high-latency connections.

javascript 70 shipped

@nodejs Aug 4

NODE 26.6.0 AND 24.19.0 LTS LAND WITH FFI EVENT LOOP AND BUFFER STREAMING

Node.js shipped two releases overnight: the current branch gets foreign function interface power, while the LTS line adds blob.textStream() and OpenSSL compression support.

javascript 73 shipped

@nodejs Aug 3

NODE CRYPTO UNLOCKS PRIVATE KEY LOADERS, FFI CRASH FIXED BEFORE IT SPREADS

Node core shipped two critical improvements overnight: crypto now loads private keys through OpenSSL STORE loaders, and FFI fast calls will no longer crash after library close.

javascript 63 shipped

Elsewhere on the wire

AI Agents Aug 6

LANGCHAIN HARDENS ANTHROPIC TOOL CALLING AND GIT CREDENTIALS AS OPENHANDS SHIPS 1.10.0

LangChain fixed a critical credential leak in evaluation runs while Anthropic tool schemas get proper fallback handling, as three major agent frameworks push releases across the ecosystem.

ai-agents 54 shipped

Local LLMs Aug 6

OLLAMA FIXES KV CACHE CORRUPTION, LLAMA.CPP HARDENS FILE SEARCH, VLLM KILLS MOE LEGACY CODE

Ollama patched a critical cache corruption bug that corrupts lazy snapshots during multi-request prefills, while llama.cpp hardened Windows junction traversal and vLLM removed 14 hardcoded MoE shards across quantization methods.