Who contributed to Node.js on August 19, 2026?

7 developers shipped this update, including Rafael Gonzaga, Yuya Inoue, Chaseton Collins, Erik Demaine, T, MikeMcC399, and Node.js GitHub Bot.

What were the notable Node.js updates?

chore: update tap to 21.7.5, doc: add missing return types in buffer.md, and doc: add missing return types in fs.md.

@nodejs

The Node.js runtime - every backend team's CVE source of truth

github ↗

Pick a date

Topics: JavaScript Full archive →

The Wire · Showcase

Node slams the brakes on module.register

By RepoJournal · Filed 06:56 UTC on August 19, 2026 · About Node.js

7 people shipped this

MikeMcC399 @MikeMcC399 2 cited

Rafael Gonzaga @RafaelGSS 1 cited

Yuya Inoue @inoway46 1 cited

Chaseton Collins @chasetonco 1 cited

Erik Demaine @edemaine 1 cited

T @cookesan 1 cited

Node.js GitHub Bot @nodejs-github-bot

Node 26 makes module.register() a runtime deprecation, and citgm's test suite was the first to feel it.

Node 26.0.0 promotes DEP0205 to a runtime deprecation, so any tooling still calling module.register() now logs a warning on every run [1]. citgm's fix is to pull in tap 21.7.5, which the release notes say "closes https://github.com/nodejs/citgm/issues/1126" [1]. This is a warning sign for the broader ecosystem: audit your test runners and loaders for module.register() before Node 26 hits your CI [1]. Meanwhile the core docs desk is quietly tidying up. buffer.md gets missing return types for Blob and legacy Base64 helpers [2], and fs.md fills in the void for asyncDispose and Utf8Stream [3]. Two more doc PRs land: setRawMode write access on Windows [4] and copyFile symlink behavior [5]. The release process also gets a refreshed security prepare command [6]. None of these are breaking changes, but they tighten the surface area before you upgrade. Citgm's tap bump is the only code change of note: 1 PR, no commits, and it keeps the smoke tests green on Node 26 [7]. Act now if you maintain a loader or test framework, because the deprecation is already live in the runtime.

Action items

→ Upgrade citgm to tap 21.7.5 before running tests on Node 26 nodejs/citgm [immediate]
→ Audit your own tooling for module.register() usage nodejs/node [immediate]
→ Review the updated security release prepare command for your release pipeline nodejs/node [plan]
→ Monitor doc-kit rendering for return types after these fixes nodejs/node [monitor]

References

[1] chore: update tap to 21.7.5 ↗ nodejs/citgm
[2] doc: add missing return types in buffer.md nodejs/node
[3] doc: add missing return types in fs.md nodejs/node
[4] doc: document setRawMode write access on Windows nodejs/node
[5] doc: clarify copyFile symlink behavior nodejs/node
[6] doc: update security release prepare command nodejs/node
[7] chore: update tap to 21.7.5 (#1128) nodejs/citgm

Quick answers

What shipped in Node.js on August 19, 2026?: Node 26 makes module.register() a runtime deprecation, and citgm's test suite was the first to feel it. In total, 15 commits and 13 pull requests landed.
Who contributed to Node.js on August 19, 2026?: 7 developers shipped this update, including Rafael Gonzaga, Yuya Inoue, Chaseton Collins, Erik Demaine, T, MikeMcC399, and Node.js GitHub Bot.
What were the notable Node.js updates?: chore: update tap to 21.7.5, doc: add missing return types in buffer.md, and doc: add missing return types in fs.md.

READFILE 3-6x FASTER: NODE'S SMALL-FILE PATH COLLAPSES FOUR ROUND TRIPS INTO ONE

Node.js just made the most common filesystem call dramatically faster, and a second PR cuts cold require() times for large CommonJS trees.

javascript 31 shipped

@nodejs Aug 18

NODE FFI HARDENS AGAINST CONSTRUCTOR ABUSE

Node's FFI bindings just got safer, and a security release in the download pipeline demands your attention.

javascript 38 shipped

@nodejs Aug 17

JS-YAML SECURITY FIX SHIPS IN NODEJS-DIST-INDEXER 1.8.24

The distribution indexer bumped js-yaml to 4.3.1, patching a quadratic complexity vulnerability in YAML omap duplicate key detection that could enable DoS attacks.

javascript 22 shipped

@nodejs Aug 16

WEBSTREAMS PROMISE CHURN CRUSHED, SQLITE DIAGNOSTICS LAND

Matteo Collina's twelfth round of pure-JS webstreams optimization cuts promise overhead by redesigning microtask handling on hot paths, while Node adds DatabaseSync diagnostic channels for production visibility.

javascript 29 shipped

Elsewhere on the wire

AI Agents Aug 20

LangChain ships core 1.6.0 with a security warning tucked inside

LangChain's newest core release fixes a tool-injection bug, but the fix itself widens the path for arbitrary code execution.

ai-agents 95 shipped

Local LLMs Aug 20

OLLAMA FIXES DEADLOCK THAT HUNG CHAT AND GENERATE

A mid-stream parser error in Ollama's server silently wedged chat and generate requests, leaking goroutines and hanging retries until a fix landed overnight.

+14

llms 268 shipped

@CachyOS Aug 20

LINUX-CACHYOS SHIPS 7.2.0-1

CachyOS's custom kernel just advanced to 7.2.0-1, and the sched-ext toolchain is moving in lockstep.

infra 55 shipped

Elixir & Phoenix Aug 20

LIVE VIEW HOOKS GET THE ELOQUENT TREATMENT

Phoenix Live View is shipping a passel of hook and JS-client fixes today, headlined by new beforeUpdate arguments that hand you more control over a hook's lifespan.