RepoJournal
Node.js @nodejs
179 wires and counting

$ follow Node.js

Keep up with Node.js in about 3 minutes: what actually shipped — the commits, pull requests, releases, and security advisories that matter.

or

fair warning: these emails are deeply technical. diffs, version numbers, CVEs, benchmark deltas. if that's not your idea of a good read, this isn't your newsletter.

Folds into your digest — weekly by default, monthly if you prefer. Unsubscribe in one click.

$ status

wire 2026-08-11
stories 41
GitHub RSS Archive Reviews

© 2026 RepoJournal Home Showcase How it works Privacy

$ the-wire · showcase

UNDICI 8.10.0 SHIPS AS NODE CORE DEPS SYNC ACROSS THE STACK

By RepoJournal · Filed · About Node.js · Composed from the cited sources · methodology

nodejs-github-bot panva Chengzhong Wu dependabot Recoordinate
5 people shipped this
nodejs-github-bot @nodejs-github-bot 5 cited panva @panva 2 cited Chengzhong Wu @legendecas 1 cited dependabot @dependabot 1 cited Recoordinate @latent-9

Node's HTTP client dependency landed overnight alongside WebCrypto test suite updates and a critical commit queue fix that unblocks the release pipeline.

Undici 8.10.0 is now baked into Node core [1], part of a dependency sweep that also brought in googletest and libffi 3.8.0 [2][3]. The WPT for WebCryptoAPI advanced to 4c2fd05ed5 [4], keeping Node's cryptographic compliance moving forward. Separately, node-core-utils shipped 7.1.0 [5] with a fix that matters for every release: the commit queue now filters check suites by GitHub Actions App ID instead of requesting metadata it can't access [6], unblocking a permissions wall that was slowing automation. The same release adds structured GraphQL error reporting [7], so when things break, the pipeline logs tell the full story. On the build front, the `--enable-static` flag is now deprecated since libnode.a is always produced [8], a cleanup that removes dead config options. Watch undici's websocket security fix in the test harness [9], where ws bumped to 8.21.3 to correctly reject permessage-deflate offers with invalid compression parameters.

Action items

References

  1. [1] deps: update undici to 8.10.0 ↗ nodejs/node
  2. [2] deps: update googletest to d89aac5f0dd4021198d903d39de16f896726de21 ↗ nodejs/node
  3. [3] deps: update libffi to 3.8.0 ↗ nodejs/node
  4. [4] test: update WPT for WebCryptoAPI to 4c2fd05ed5 ↗ nodejs/node
  5. [5] v7.1.0 ↗ nodejs/node-core-utils
  6. [6] fix: filter check suites to GitHub Actions ↗ nodejs/node-core-utils
  7. [7] feat: report GraphQL error details ↗ nodejs/node-core-utils
  8. [8] build: deprecate always enabled `--enable-static` ↗ nodejs/node
  9. [9] build(deps-dev): bump ws from 8.21.1 to 8.21.3 ↗ nodejs/undici

$ ls nodejs/reviews/ # the step-back reads

the week in review commit-stream 3.0.0 restricts imports to package root the month in review Node 26 enters LTS as five undici advisories land
Full archive → Weekly reviews →

Quick answers

What shipped in Node.js on August 11, 2026?
Node's HTTP client dependency landed overnight alongside WebCrypto test suite updates and a critical commit queue fix that unblocks the release pipeline. In total, 21 commits, 18 pull requests, and 2 releases landed.
Who contributed to Node.js on August 11, 2026?
5 developers shipped this update, including nodejs-github-bot, Chengzhong Wu, panva, Recoordinate, and dependabot.
What were the notable Node.js updates?
deps: update undici to 8.10.0, deps: update googletest to d89aac5f0dd4021198d903d39de16f896726de21, and deps: update libffi to 3.8.0.
♥

$ log @nodejs --recent

Workers preload streams into the startup snapshot; http2 accepts repeated content-encoding 18 shipped HTTP drain stalls after coalesced chunks, undici restores h2 error codes 20 shipped Stale OpenSSL errors cleared, npm 12.2.2 lands in node 26 shipped Node coalesces duplicate DNS lookups, batches HTTP body spans 37 shipped

$ log --all # elsewhere on the wire

Agent Security Quiet day in agent security as guard coverage reaches four clients Alignment & Post-training verl defaults Ascend RL mode, open-instruct unblocks SFT packing

$ ls showcases/

Safety Evals AI Red Teaming Agent Security Interpretability Alignment & Post-training

$ init your-desk

RepoJournal can write one of these for any repo you care about. Sign in with GitHub, pick your repos and sources, and your desk gets a wire like this one every morning.