Who contributed to Node.js on August 11, 2026?

5 developers shipped this update, including nodejs-github-bot, Chengzhong Wu, panva, Recoordinate, and dependabot.

What were the notable Node.js updates?

deps: update undici to 8.10.0, deps: update googletest to d89aac5f0dd4021198d903d39de16f896726de21, and deps: update libffi to 3.8.0.

@nodejs

The Node.js runtime - every backend team's CVE source of truth

github ↗

Pick a date

Topics: JavaScript Full archive →

The Wire · Showcase

UNDICI 8.10.0 SHIPS AS NODE CORE DEPS SYNC ACROSS THE STACK

By RepoJournal · Filed 06:56 UTC on August 11, 2026 · About Node.js

5 people shipped this

nodejs-github-bot @nodejs-github-bot 5 cited

panva @panva 2 cited

Chengzhong Wu @legendecas 1 cited

dependabot @dependabot 1 cited

Recoordinate @latent-9

Node's HTTP client dependency landed overnight alongside WebCrypto test suite updates and a critical commit queue fix that unblocks the release pipeline.

Undici 8.10.0 is now baked into Node core [1], part of a dependency sweep that also brought in googletest and libffi 3.8.0 [2][3]. The WPT for WebCryptoAPI advanced to 4c2fd05ed5 [4], keeping Node's cryptographic compliance moving forward. Separately, node-core-utils shipped 7.1.0 [5] with a fix that matters for every release: the commit queue now filters check suites by GitHub Actions App ID instead of requesting metadata it can't access [6], unblocking a permissions wall that was slowing automation. The same release adds structured GraphQL error reporting [7], so when things break, the pipeline logs tell the full story. On the build front, the `--enable-static` flag is now deprecated since libnode.a is always produced [8], a cleanup that removes dead config options. Watch undici's websocket security fix in the test harness [9], where ws bumped to 8.21.3 to correctly reject permessage-deflate offers with invalid compression parameters.

Action items

→ Review deprecation of --enable-static in your build scripts nodejs/node [plan]
→ Deploy node-core-utils 7.1.0 to your release infrastructure nodejs/node-core-utils [immediate]
→ Monitor undici 8.10.0 in staging before production rollout nodejs/node [monitor]

References

[1] deps: update undici to 8.10.0 ↗ nodejs/node
[2] deps: update googletest to d89aac5f0dd4021198d903d39de16f896726de21 ↗ nodejs/node
[3] deps: update libffi to 3.8.0 ↗ nodejs/node
[4] test: update WPT for WebCryptoAPI to 4c2fd05ed5 ↗ nodejs/node
[5] v7.1.0 ↗ nodejs/node-core-utils
[6] fix: filter check suites to GitHub Actions nodejs/node-core-utils
[7] feat: report GraphQL error details nodejs/node-core-utils
[8] build: deprecate always enabled `--enable-static` nodejs/node
[9] build(deps-dev): bump ws from 8.21.1 to 8.21.3 ↗ nodejs/undici

Quick answers

What shipped in Node.js on August 11, 2026?: Node's HTTP client dependency landed overnight alongside WebCrypto test suite updates and a critical commit queue fix that unblocks the release pipeline. In total, 21 commits, 18 pull requests, and 2 releases landed.
Who contributed to Node.js on August 11, 2026?: 5 developers shipped this update, including nodejs-github-bot, Chengzhong Wu, panva, Recoordinate, and dependabot.
What were the notable Node.js updates?: deps: update undici to 8.10.0, deps: update googletest to d89aac5f0dd4021198d903d39de16f896726de21, and deps: update libffi to 3.8.0.

NODE CORE TIGHTENS CRYPTO IN FIPS MODE, FIXES SQLITE STATEMENT LEAKS

WebCrypto's experimental XOF digests are now disabled when FIPS mode is enabled, closing a cryptographic gap, while a critical SQLite fix plugs statement lifetime management bugs that could leak resources.

javascript 28 shipped

@nodejs Aug 10

NODE PATCHES COMMIT QUEUE, FIXES FFI MEMORY LEAK

The core commit queue gained safeguards against race conditions while the FFI layer stopped leaking 58 MiB per 20,000 function calls.

javascript 47 shipped

@nodejs Aug 9

NODE COMMITS QUEUE EFFICIENCY FIX, SQLITE AND TLS REFINEMENTS SHIP

Node's commit queue now filters metadata before checkout, cutting CI load on landing operations while five substantive fixes and documentation improvements land across the core runtime.

javascript 37 shipped

@nodejs Aug 8

DOCKER-NODE TIGHTENS CONTRIBUTOR TOOLCHAIN WITH JQ REQUIREMENT

Docker-node now mandates jq as a contributor dependency and adds automated checks to prevent silent failures in the update pipeline.

javascript 4 shipped

Elsewhere on the wire

AI Agents Aug 12

LANGCHAIN SHIPS THREE CRITICAL RELEASES IN 12 HOURS, CLOSES SETUPTOOLS VULNERABILITY

LangChain pushed langchain-core 1.5.4, langchain 1.3.15, and langchain-anthropic 1.5.5 overnight while patching a setuptools supply-chain risk that gated the Hugging Face integration.

ai-agents 59 shipped

Local LLMs Aug 12

OLLAMA CUTS REPEAT PENALTY BLOAT, LLAMA.CPP SHIPS POCKET-TTS SUPPORT

Ollama kills a decade of default penalty cruft that was drowning every model, while llama.cpp gains multimodal audio chops and vLLM fixes ROCm speculative decoding corruption.