RepoJournal
Node.js @nodejs
129 wires and counting

$ follow Node.js

Keep up with Node.js in about 3 minutes: what actually shipped — the commits, pull requests, releases, and security advisories that matter.

or

fair warning: these emails are deeply technical. diffs, version numbers, CVEs, benchmark deltas. if that's not your idea of a good read, this isn't your newsletter.

Folds into your digest — weekly by default, monthly if you prefer. Unsubscribe in one click.

$ status

wire 2026-08-03
stories 63
GitHub RSS Archive Reviews Topics

© 2026 RepoJournal Home Showcase Explore How it works Privacy

$ the-wire · showcase

NODE CRYPTO UNLOCKS PRIVATE KEY LOADERS, FFI CRASH FIXED BEFORE IT SPREADS

By RepoJournal · Filed · About Node.js · Composed from the cited sources · methodology

dependabot nodejs-github-bot panva trivikr araujogui
5 people shipped this
dependabot @dependabot 7 cited nodejs-github-bot @nodejs-github-bot 2 cited panva @panva 1 cited trivikr @trivikr 1 cited araujogui @araujogui 1 cited

Node core shipped two critical improvements overnight: crypto now loads private keys through OpenSSL STORE loaders, and FFI fast calls will no longer crash after library close.

The crypto module now supports loading private keys directly through WHATWG URL objects via configured OpenSSL STORE loaders [1], letting you pass `new URL('file:///path/to/private-key.pem')` straight into `createPrivateKey()` and downstream APIs like `sign()`, `privateDecrypt()`, and `decapsulate()`. This eliminates a friction point for workloads that manage keys through external stores. In parallel, a critical FFI fix [3] prevents optimized fast API calls from invoking stale symbol addresses after `DynamicLibrary.close()` unloads the library, which was causing SIGSEGV crashes on AArch64 and x64 SysV architectures. Root certificates updated to NSS 3.125 [5], dropping Entrust Root Certification Authority and SecureSign Root CA12. Separately, `Server.prototype._listen2` is now runtime-deprecated [4], signaling a coming removal. Zlib updated to 1.3.2.1-motley-42c2f19 [2]. The nodejs.org site absorbed routine dependency bumps: Storybook framework updates [6], testing tools [7], styling dependencies [8], and Vercel stack including Turbo 2.9.16 to 2.10.6 and Next.js ESLint plugin patches [9], plus wrangler 4.77.0 to 4.114.0 [10]. Doc-kit tooling advanced: c8 jumped to 12.0.0 [11] with stricter Node version enforcement, Playwright 1.62.0 [12] shipped a new component testing model, and CI actions refreshed including actions/setup-node 7.0.0 .

Action items

References

  1. [1] crypto: support loading private keys through STORE loaders ↗ nodejs/node
  2. [2] deps: update zlib to 1.3.2.1-motley-42c2f19 ↗ nodejs/node
  3. [3] ffi: reject fast calls after library close ↗ nodejs/node
  4. [4] net: runtime-deprecate Server.prototype._listen2 ↗ nodejs/node
  5. [5] crypto: update root certificates to NSS 3.125 nodejs/node ↗
  6. [6] chore(deps): bump the storybook group across 1 directory with 3 updates ↗ nodejs/nodejs.org
  7. [7] chore(deps): bump the testing group across 1 directory with 2 updates ↗ nodejs/nodejs.org
  8. [8] chore(deps): bump the styling group across 1 directory with 2 updates ↗ nodejs/nodejs.org
  9. [9] chore(deps): bump the vercel group across 1 directory with 7 updates ↗ nodejs/nodejs.org
  10. [10] chore(deps): bump wrangler from 4.77.0 to 4.114.0 ↗ nodejs/nodejs.org
  11. [11] meta: bump c8 from 11.0.0 to 12.0.0 ↗ nodejs/doc-kit
  12. [12] meta: bump @playwright/test from 1.60.0 to 1.62.0 ↗ nodejs/doc-kit

$ ls nodejs/reviews/ # the step-back reads

the week in review Node 26.9.0 ships generic crypto MAC API the month in review Node 26 line lands crypto, stream, and FFI hardening as deprecations tighten the core
Topics: JavaScript Full archive → Weekly reviews →

Quick answers

What shipped in Node.js on August 3, 2026?
Node core shipped two critical improvements overnight: crypto now loads private keys through OpenSSL STORE loaders, and FFI fast calls will no longer crash after library close. In total, 20 commits and 43 pull requests landed.
Who contributed to Node.js on August 3, 2026?
5 developers shipped this update, including panva, nodejs-github-bot, trivikr, araujogui, and dependabot.
What were the notable Node.js updates?
crypto: support loading private keys through STORE loaders, deps: update zlib to 1.3.2.1-motley-42c2f19, and ffi: reject fast calls after library close.
♥

$ log @nodejs --recent

SEA gets ZIP asset archives, HTTP server sheds per-request allocations 28 shipped Buffer.stringLength(), and a trace_events abort for embedders 40 shipped cpSync dereference regression fixed, trace union punning removed 39 shipped Node 26.9.0 adds a generic MAC API, undici walks back its decompression size cap 27 shipped

$ log --all # elsewhere on the wire

@openclaw Cold-start Gateway diagnostics stop crying wolf, doctor repairs plugin drift Agentic Coding Cline desktop bundles shrink, goose unblocks its own clicks

$ ls showcases/

Rails Django Laravel Go Vercel Vue.js Kubernetes HashiCorp Arch Linux Linux Anthropic OpenAI

$ init your-desk

RepoJournal can write one of these for any repo you care about. Sign in with GitHub, pick your repos and sources, and your desk gets a wire like this one every morning.