Who contributed to Node.js on August 12, 2026?

6 developers shipped this update, including dependabot, Antoine du Hamel, araujogui, panva, Chemi Atlow, and Node.js GitHub Bot.

What were the notable Node.js updates?

crypto: disable non-FIPS WebCrypto paths in FIPS mode, sqlite: manage sqlite3_stmt lifetime with RAII, and test_runner: do not tag-filter test file wrappers.

@nodejs

The Node.js runtime - every backend team's CVE source of truth

github ↗

Pick a date

Topics: JavaScript Full archive →

The Wire · Showcase

NODE CORE TIGHTENS CRYPTO IN FIPS MODE, FIXES SQLITE STATEMENT LEAKS

By RepoJournal · Filed 06:56 UTC on August 12, 2026 · About Node.js

6 people shipped this

dependabot @dependabot 2 cited

Antoine du Hamel @aduh95 2 cited

araujogui @araujogui 1 cited

panva @panva 1 cited

Chemi Atlow @atlowChemi 1 cited

Node.js GitHub Bot @nodejs-github-bot

WebCrypto's experimental XOF digests are now disabled when FIPS mode is enabled, closing a cryptographic gap, while a critical SQLite fix plugs statement lifetime management bugs that could leak resources.

The crypto team shipped a breaking change for FIPS deployments [1], disabling hand-rolled XOF digests and rejecting cSHAKE and KMAC parameters that bypass OpenSSL's FIPS provider constraints. This hardens compliance but requires applications relying on experimental crypto features to audit their code. Simultaneously, core landed a SQLite patch that replaces raw pointer management with RAII-style statement tracking [2], fixing two critical bugs: a leaked statement on `StatementSync::Create()` failure that inserted null pointers into the statements list, and tag store statements that were never tracked at all, leaving them open after `db.close()`. The test runner got a precision fix [3] that prevented tag filters from accidentally filtering out test file wrappers under process isolation, which meant no child processes ever spawned. On process infrastructure, the commit queue got a cleanup [4] removing legacy skip logic, and release tooling gained alpha prerelease tag support [5] to formalize pre-release workflows. Dependency bumps across the meeting agenda repo address a js-yaml security fix for quadratic complexity in omap duplicate key detection [6] and a brace-expansion patch [7].

Action items

→ Audit WebCrypto usage if FIPS mode is enabled and you use cSHAKE, KMAC, or experimental XOF digests nodejs/node [plan]
→ Update SQLite bindings if using statements at all, especially with process isolation or long-running databases nodejs/node [plan]
→ Verify test runner tag filtering if you use testTagFilters with process isolation nodejs/node [monitor]

References

[1] crypto: disable non-FIPS WebCrypto paths in FIPS mode ↗ nodejs/node
[2] sqlite: manage sqlite3_stmt lifetime with RAII ↗ nodejs/node
[3] test_runner: do not tag-filter test file wrappers nodejs/node
[4] tools: remove skip logic in `commit-queue.sh` nodejs/node
[5] meta: add support for alpha prerelease tag ↗ nodejs/node
[6] chore(deps-dev): bump js-yaml from 4.3.0 to 4.3.1 ↗ nodejs/node-meeting-agenda
[7] chore(deps-dev): bump brace-expansion from 1.1.11 to 1.1.18 ↗ nodejs/node-meeting-agenda

Quick answers

What shipped in Node.js on August 12, 2026?: WebCrypto's experimental XOF digests are now disabled when FIPS mode is enabled, closing a cryptographic gap, while a critical SQLite fix plugs statement lifetime management bugs that could leak resources. In total, 14 commits and 14 pull requests landed.
Who contributed to Node.js on August 12, 2026?: 6 developers shipped this update, including dependabot, Antoine du Hamel, araujogui, panva, Chemi Atlow, and Node.js GitHub Bot.
What were the notable Node.js updates?: crypto: disable non-FIPS WebCrypto paths in FIPS mode, sqlite: manage sqlite3_stmt lifetime with RAII, and test_runner: do not tag-filter test file wrappers.

NODE.JS DOCKER AUTOMATION TIGHTENS RELEASE KEY SYNC

Docker-node merged automated release key synchronization today, closing a gap that previously required manual PR creation whenever Node releasers rotated credentials.

javascript 5 shipped

@nodejs Aug 11

UNDICI 8.10.0 SHIPS AS NODE CORE DEPS SYNC ACROSS THE STACK

Node's HTTP client dependency landed overnight alongside WebCrypto test suite updates and a critical commit queue fix that unblocks the release pipeline.

javascript 41 shipped

@nodejs Aug 10

NODE PATCHES COMMIT QUEUE, FIXES FFI MEMORY LEAK

The core commit queue gained safeguards against race conditions while the FFI layer stopped leaking 58 MiB per 20,000 function calls.

javascript 47 shipped

@nodejs Aug 9

NODE COMMITS QUEUE EFFICIENCY FIX, SQLITE AND TLS REFINEMENTS SHIP

Node's commit queue now filters metadata before checkout, cutting CI load on landing operations while five substantive fixes and documentation improvements land across the core runtime.

javascript 37 shipped

Elsewhere on the wire

AI Agents Aug 13

ANTHROPIC INTEGRATION FIXES TOOL BLOCKS, OPENHANDS UNBLOCKS CI, CLINE PATCHES COMPOSER WEDGE

LangChain's Anthropic integration corrected tool result handling and model profiles [ref:1], while OpenHands fixed a critical test infrastructure failure blocking all PRs and shipped 1.13.0 with conversation archives [ref:6][ref:9].