Who contributed to Node.js on August 20, 2026?

7 developers shipped this update, including mcollina, codebytere, Trivikram Kamat, Node.js GitHub Bot, adarshx01, ondraulehla, and avivkeller.

What were the notable Node.js updates?

fs: read small files in one thread pool round trip, module: cache nearest parent package.json per directory, and stream: decouple transform backpressure changes.

@nodejs

The Node.js runtime - every backend team's CVE source of truth

github ↗

Pick a date

Topics: JavaScript Full archive →

The Wire · Showcase

READFILE 3-6x FASTER: NODE'S SMALL-FILE PATH COLLAPSES FOUR ROUND TRIPS INTO ONE

By RepoJournal · Filed 06:56 UTC on August 20, 2026 · About Node.js

7 people shipped this

mcollina @mcollina 2 cited

codebytere @codebytere 2 cited

adarshx01 @adarshx01 1 cited

ondraulehla @ondraulehla 1 cited

avivkeller @avivkeller 1 cited

Trivikram Kamat @trivikr

Node.js GitHub Bot @nodejs-github-bot

Node.js just made the most common filesystem call dramatically faster, and a second PR cuts cold require() times for large CommonJS trees.

fs.readFile() and fs.promises.readFile() of small files get 3 to 6x faster by doing open, fstat, read, and close in a single libuv thread pool task instead of four, freeing pool slots for concurrent DNS, fs, and crypto work [1]. The same author also cut cold require() of a 1000-module CommonJS tree by about 6% (and module-require tests up to 13.7%) by caching the nearest parent package.json per directory rather than per file [2]. Meanwhile, Matteo Collina's thirteenth round of pure-JS webstreams optimizations decouples transform backpressure changes; the PR is stacked on #65138, so reviewers should focus only on the last commit [3]. Over in undici, interceptor composition silently dropped onBodySent and onRequestSent callbacks because DecoratorHandler defined one as a no-op and omitted the other; the fix forwards both through RetryHandler, RedirectHandler, and CacheHandler [4]. Undici also now honours maxResponseSize on HTTP/2 clients, fixing a documented option that was validated but never enforced [5]. HTTP/2 timeout tests are stabilized by skipping a churn stress test on Linux Node.js 24 and 25 where an upstream issue can terminate the process prematurely [6]. In related housekeeping, doc-kit adds an opt-in reading time toggle to its documentation pages [7]. Overall: 16 commits and 15 PRs across 4 repos this period, with the fs and module wins being the ones to watch.

Action items

→ Review PR #65327 (small-file readFile) and PR #65326 (package.json caching) in nodejs/node; benchmark against your workloads, then prepare to land. nodejs/node [plan]
→ If you compose undici interceptors (retry, redirect, cache), track PR #5696 for the onBodySent/onRequestSent fix and test your uploads once it lands. nodejs/undici [plan]
→ Check undici PR #5676 for maxResponseSize enforcement on H2CClient; if you rely on that limit, verify your version now. nodejs/undici [monitor]
→ In nodejs/node PR #65143, review only the last commit (decouple transform backpressure); the first three are from #65138. nodejs/node [immediate]

References

[1] fs: read small files in one thread pool round trip ↗ nodejs/node
[2] module: cache nearest parent package.json per directory ↗ nodejs/node
[3] stream: decouple transform backpressure changes ↗ nodejs/node
[4] fix: forward onBodySent/onRequestSent through interceptor handlers ↗ nodejs/undici
[5] fix(h2): honour maxResponseSize ↗ nodejs/undici
[6] test: stabilize HTTP/2 timeout tests ↗ nodejs/undici
[7] chore: opt-in reading time ↗ nodejs/doc-kit

Quick answers

What shipped in Node.js on August 20, 2026?: Node.js just made the most common filesystem call dramatically faster, and a second PR cuts cold require() times for large CommonJS trees. In total, 16 commits and 15 pull requests landed.
Who contributed to Node.js on August 20, 2026?: 7 developers shipped this update, including mcollina, codebytere, Trivikram Kamat, Node.js GitHub Bot, adarshx01, ondraulehla, and avivkeller.
What were the notable Node.js updates?: fs: read small files in one thread pool round trip, module: cache nearest parent package.json per directory, and stream: decouple transform backpressure changes.

Undici kills idle-socket latency

Node's HTTP/1.1 keep-alive just got leaner, and native addon authors have a breaking change to plan for.

javascript 51 shipped

@nodejs Aug 19

Node slams the brakes on module.register

Node 26 makes module.register() a runtime deprecation, and citgm's test suite was the first to feel it.

javascript 28 shipped

@nodejs Aug 18

NODE FFI HARDENS AGAINST CONSTRUCTOR ABUSE

Node's FFI bindings just got safer, and a security release in the download pipeline demands your attention.

javascript 38 shipped

@nodejs Aug 17

JS-YAML SECURITY FIX SHIPS IN NODEJS-DIST-INDEXER 1.8.24

The distribution indexer bumped js-yaml to 4.3.1, patching a quadratic complexity vulnerability in YAML omap duplicate key detection that could enable DoS attacks.

javascript 22 shipped

Elsewhere on the wire

AI Agents Aug 21

CLINE V4.1.11 SHIPS IMAGE GENERATION AND AGENT-UI FIXES

Cline's latest release lets models generate images mid-task, while LlamaIndex quietly breaks frontend tool handlers.

ai-agents 78 shipped

Local LLMs Aug 21

DeepSeek V4 fuses shared experts, as vLLM ships a security guard

The biggest local-LLM repos are moving fast: DeepSeek V4's MoE kernel gets a massive fusion, while vLLM patches a security hole.

+12

llms 274 shipped

@CachyOS Aug 21

CachyOS Scheduler Hotfixes and Kernel Upgrades Lead the Day

A hotfix for the scx_cake scheduler and the latest Linux 7.2 kernel are rolling out across CachyOS repos.

infra 66 shipped

Elixir & Phoenix Aug 21

Phoenix 1.8.12 patches channel message drop

Phoenix shipped a patch release that fixes a channel bug silently dropping messages without a join_ref, and LiveView is quietly rewriting the rules of navigation.