Who contributed to Node.js on August 2, 2026?

7 developers shipped this update, including GitHub Actions, marko1olo, dependabot, trivikr, anonrig, pipobscure, and Kamal Rawal.

What were the notable Node.js updates?

fix(interceptors): cache() and deduplicate() silently inert on Client/Pool without opts.origin, fix(interceptors): allow interceptors without opts.origin (#5628), and stream: honor AbortSignal in Writer.end().

@nodejs

The Node.js runtime - every backend team's CVE source of truth

github ↗

Pick a date

Topics: JavaScript Full archive →

The Wire · Showcase

UNDICI FIXES SILENT INTERCEPTOR FAILURE; NODE ADDS ZIP SUPPORT AND HTTP DEPRECATION

By RepoJournal · Filed 06:56 UTC on August 2, 2026 · About Node.js

7 people shipped this

dependabot @dependabot 3 cited

marko1olo @marko1olo 2 cited

trivikr @trivikr 1 cited

anonrig @anonrig 1 cited

pipobscure @pipobscure 1 cited

GitHub Actions @web-flow

Kamal Rawal @Rawal27

Undici's cache() and deduplicate() interceptors were silently breaking on direct Client/Pool use, now fixed with fallback origin detection.

The fix lands in undici as a critical correction: when cache() or deduplicate() interceptors compose onto a Client or Pool without opts.origin, both were collapsing to an empty string key, effectively disabling the entire interceptor [1]. A new getEffectiveOrigin() helper now reconstructs the origin when needed [2]. Across Node core, three substantial changes ship: stream.Writer.end() now honors AbortSignal properly, rejecting gracefully when passed a pre-aborted signal [3]. The http module promotes DEP0195 from documentation-only to runtime, emitting a DeprecationWarning when constructors like Agent, Server, and ClientRequest are called without new [4]. In a larger addition, zlib gains native ZIP archive support through three new classes: ZipEntry for individual members with buffered and streaming reads, ZipFile for random-access file-backed archives, and ZipBuffer for in-memory operations [5]. Build dependencies also bump: setup-node moves to 7.0.0 with new cache output keys [6], codeql-action reaches 4.37.3 [7], and scorecard-action updates to 2.4.4 [8].

Action items

→ If using undici interceptors directly on Client/Pool, upgrade immediately for cache/deduplicate to function nodejs/undici [immediate]
→ Audit http module code calling Agent/Server/ClientRequest without new; DEP0195 warnings will appear at runtime nodejs/node [plan]
→ Evaluate ZIP archive support in zlib for native compression workflows nodejs/node [monitor]

References

[1] fix(interceptors): cache() and deduplicate() silently inert on Client/Pool without opts.origin ↗ nodejs/undici
[2] fix(interceptors): allow interceptors without opts.origin (#5628) nodejs/undici
[3] stream: honor AbortSignal in Writer.end() ↗ nodejs/node
[4] http: runtime deprecate instantiating without new ↗ nodejs/node
[5] zlib: add ZIP archive support to zlib (ZipFile,ZipBuffer,ZipEntry) ↗ nodejs/node
[6] build(deps): bump actions/setup-node from 6.4.0 to 7.0.0 ↗ nodejs/undici
[7] build(deps): bump github/codeql-action/init from 4.36.2 to 4.37.3 ↗ nodejs/undici
[8] build(deps): bump ossf/scorecard-action from 2.4.3 to 2.4.4 ↗ nodejs/undici

Quick answers

What shipped in Node.js on August 2, 2026?: Undici's cache() and deduplicate() interceptors were silently breaking on direct Client/Pool use, now fixed with fallback origin detection. In total, 17 commits and 10 pull requests landed.
Who contributed to Node.js on August 2, 2026?: 7 developers shipped this update, including GitHub Actions, marko1olo, dependabot, trivikr, anonrig, pipobscure, and Kamal Rawal.
What were the notable Node.js updates?: fix(interceptors): cache() and deduplicate() silently inert on Client/Pool without opts.origin, fix(interceptors): allow interceptors without opts.origin (#5628), and stream: honor AbortSignal in Writer.end().

NODE 26.7.0 SHIPS WITH CRYPTO UPGRADES AND DNS SECURITY FIX

Node.js 26.7.0 landed overnight with SEMVER-MINOR crypto improvements and a critical DNS vulnerability patch that prevents large resolveAny replies from crashing.

javascript 49 shipped

@nodejs Aug 5

STREAMS SHED ALLOCATIONS, HTTP/2 WINDOWS QUADRUPLE

Node.js core cut per-chunk memory overhead in pipeTo by eliminating redundant promise allocations, while HTTP/2 default window sizes jumped 64x to unlock full bandwidth on high-latency connections.

javascript 70 shipped

@nodejs Aug 4

NODE 26.6.0 AND 24.19.0 LTS LAND WITH FFI EVENT LOOP AND BUFFER STREAMING

Node.js shipped two releases overnight: the current branch gets foreign function interface power, while the LTS line adds blob.textStream() and OpenSSL compression support.

javascript 73 shipped

@nodejs Aug 3

NODE CRYPTO UNLOCKS PRIVATE KEY LOADERS, FFI CRASH FIXED BEFORE IT SPREADS

Node core shipped two critical improvements overnight: crypto now loads private keys through OpenSSL STORE loaders, and FFI fast calls will no longer crash after library close.

javascript 63 shipped

Elsewhere on the wire

AI Agents Aug 6

LANGCHAIN HARDENS ANTHROPIC TOOL CALLING AND GIT CREDENTIALS AS OPENHANDS SHIPS 1.10.0

LangChain fixed a critical credential leak in evaluation runs while Anthropic tool schemas get proper fallback handling, as three major agent frameworks push releases across the ecosystem.

ai-agents 54 shipped

Local LLMs Aug 6

OLLAMA FIXES KV CACHE CORRUPTION, LLAMA.CPP HARDENS FILE SEARCH, VLLM KILLS MOE LEGACY CODE

Ollama patched a critical cache corruption bug that corrupts lazy snapshots during multi-request prefills, while llama.cpp hardened Windows junction traversal and vLLM removed 14 hardcoded MoE shards across quantization methods.