RepoJournal
Node.js

@nodejs

The Node.js runtime - every backend team's CVE source of truth

Keep up with Node.js in about 3 minutes a day: what actually shipped — the commits, pull requests, releases, and security advisories that matter.

One email a day. Unsubscribe in one click.

Pick a date

  1. Sat 25 jul
  2. Sun 26 jul
  3. Mon 27 jul
  4. Tue 28 jul
  5. Wed 29 jul
  6. Thu 30 jul
  7. Fri 31 jul
  8. Sat 1 aug
  9. Sun 2 aug
  10. Mon 3 aug
  11. Tue 4 aug
  12. Wed 5 aug
  13. Thu 6 aug
  14. Fri 7 aug
  15. Sat 8 aug
  16. Sun 9 aug
  17. Mon 10 aug
  18. Tue 11 aug
  19. Wed 12 aug
  20. Thu 13 aug
  21. Fri 14 aug
  22. Sat 15 aug
  23. Sun 16 aug
  24. Mon 17 aug
  25. Tue 18 aug
  26. Wed 19 aug
  27. Thu 20 aug
  28. Fri 21 aug
  29. Sat 22 aug
  30. Today 23 aug
Topics: JavaScript Full archive →

The Wire · Showcase

Node.js Crypto Overhaul Puts BoringSSL Front and Center

By RepoJournal · Filed · About Node.js

Filip Skokan Srinu desetti btea Mohamed Shams El-Deen Node.js GitHub Bot 이혜미 trivikr
7 people shipped this
Filip Skokan @panva 2 cited Srinu desetti @webdevelopersrinu 1 cited btea @btea 1 cited Mohamed Shams El-Deen @moshams272 1 cited Node.js GitHub Bot @nodejs-github-bot 1 cited 이혜미 @hyemimi trivikr @trivikr

A sweeping crypto refactor lands in Node.js as BoringSSL APIs take over validation and shims disappear.

Node.js is cleaning house in its crypto layer. A pair of PRs from Filip Skokan replaces hand-maintained RSA and DH prechecks with BoringSSL's native validation and reports negotiated TLS groups and zero security level through compatibility APIs [1]. The companion lands on the common code path, dropping obsolete shims for OPENSSL_zalloc and BN_secure_new and removing leftover ClientHello helpers [2]. Together they cut a pile of backend-specific drift. Elsewhere, a long-standing glob bug that silently skipped sibling entries and flaked test-fs-glob.mjs is fixed by removing an early return [3]. doc-kit plugs an SEO and accessibility hole: it no longer injects an empty h1 when a page renders its own, eliminating duplicate heading tags [4]. And doc-kit is modernizing its imports, swapping parent-relative paths for `#` package imports [5]. The reliability desk published its scheduled 2026-08-23 report [6]. With 29 commits and 23 PRs across these repos, the crypto cleanup is the one to watch if you touch TLS or key handling.

One email a day. Unsubscribe in one click.

Action items

References

  1. [1] crypto: use available BoringSSL APIs nodejs/node
  2. [2] crypto: remove obsolete BoringSSL shims nodejs/node
  3. [3] fs: fix glob early return skipping sibling entries nodejs/node
  4. [4] fix: do not render headings with no content ↗ nodejs/doc-kit
  5. [5] refactor(core): replace parent-relative imports with `#` package imports ↗ nodejs/doc-kit
  6. [6] Add report for 2026-08-23 nodejs/reliability

Quick answers

What shipped in Node.js on August 23, 2026?
A sweeping crypto refactor lands in Node.js as BoringSSL APIs take over validation and shims disappear. In total, 29 commits and 23 pull requests landed.
Who contributed to Node.js on August 23, 2026?
7 developers shipped this update, including Filip Skokan, 이혜미, Srinu desetti, trivikr, btea, Mohamed Shams El-Deen, and Node.js GitHub Bot.
What were the notable Node.js updates?
crypto: use available BoringSSL APIs, crypto: remove obsolete BoringSSL shims, and fs: fix glob early return skipping sibling entries.

More from @nodejs

Node.js @nodejs

NODE DROPS --USE-LARGEPAGES AND HARMONY IMPORT ATTRIBUTES

Node.js is cleaning house: two long-standing flags are gone, and the fetch path just got faster.

Olivier Flückiger soreavis Trivikram Kamat ganjanggejang +5
javascript 46 shipped
Node.js @nodejs

Undici kills idle-socket latency

Node's HTTP/1.1 keep-alive just got leaner, and native addon authors have a breaking change to plan for.

StefanStojanovic Aviv Keller aduh95 codebytere +4
javascript 51 shipped
Node.js @nodejs

READFILE 3-6x FASTER: NODE'S SMALL-FILE PATH COLLAPSES FOUR ROUND TRIPS INTO ONE

Node.js just made the most common filesystem call dramatically faster, and a second PR cuts cold require() times for large CommonJS trees.

mcollina codebytere Trivikram Kamat Node.js GitHub Bot +3
javascript 31 shipped
Node.js @nodejs

Node slams the brakes on module.register

Node 26 makes module.register() a runtime deprecation, and citgm's test suite was the first to feel it.

Rafael Gonzaga Yuya Inoue Chaseton Collins Erik Demaine +3
javascript 28 shipped

Daily updates, in your inbox

Follow Node.js

Keep up with Node.js in about 3 minutes a day: what actually shipped — the commits, pull requests, releases, and security advisories that matter.

or

One email a day. Unsubscribe in one click. Read a past issue →

Elsewhere on the wire

AI Agents AI Agents

Cline hubs now drain without dropping work

Cline's new hub drain and upgrade flow means you can restart a hub mid-session and lose nothing, thanks to durable event replay.

ump45nose neubig Krishna github-actions[bot] +1
ai-agents 18 shipped
Local LLMs Local LLMs

SGLang Fixes Pixtral 500s as vLLM Cuts TTFT 25%

The biggest news overnight: SGLang is patching a production-breaking Pixtral bug, and vLLM engineers found a way to shave up to 25% off time-to-first-token on Mamba models.

CISC ngxson Kartik Sirohi superm1 +7
llms 134 shipped
CachyOS @CachyOS

AIRE: ANANICY RULES FIX SESSION LAUNCHER SCHEDULING

ly-dm was being pinned to the idle scheduler, killing your login session's responsiveness.

github-actions Matias alexsmolya Peter Jung +2
infra 74 shipped
Elixir & Phoenix Elixir & Phoenix

JOSE VALIM FIXES THE CLASUE BUG

Jose Valim shipped two refactors plus the actual fix for that `none` clause compiler issue, and a UTC fast path in DateTime could save you a TZ DB lookup.

josevalim reisub
elixir 6 shipped
Want every project, not just this one?