RepoJournal
Node.js @nodejs
179 wires and counting

$ follow Node.js

Keep up with Node.js in about 3 minutes: what actually shipped — the commits, pull requests, releases, and security advisories that matter.

or

fair warning: these emails are deeply technical. diffs, version numbers, CVEs, benchmark deltas. if that's not your idea of a good read, this isn't your newsletter.

Folds into your digest — weekly by default, monthly if you prefer. Unsubscribe in one click.

$ status

wire 2026-08-23
stories 52
GitHub RSS Archive Reviews

© 2026 RepoJournal Home Showcase How it works Privacy

$ the-wire · showcase

Node.js Crypto Overhaul Puts BoringSSL Front and Center

By RepoJournal · Filed · About Node.js · Composed from the cited sources · methodology

Filip Skokan Srinu desetti btea Mohamed Shams El-Deen Node.js GitHub Bot 이혜미 trivikr
7 people shipped this
Filip Skokan @panva 2 cited Srinu desetti @webdevelopersrinu 1 cited btea @btea 1 cited Mohamed Shams El-Deen @moshams272 1 cited Node.js GitHub Bot @nodejs-github-bot 1 cited 이혜미 @hyemimi trivikr @trivikr

A sweeping crypto refactor lands in Node.js as BoringSSL APIs take over validation and shims disappear.

Node.js is cleaning house in its crypto layer. A pair of PRs from Filip Skokan replaces hand-maintained RSA and DH prechecks with BoringSSL's native validation and reports negotiated TLS groups and zero security level through compatibility APIs [1]. The companion lands on the common code path, dropping obsolete shims for OPENSSL_zalloc and BN_secure_new and removing leftover ClientHello helpers [2]. Together they cut a pile of backend-specific drift. Elsewhere, a long-standing glob bug that silently skipped sibling entries and flaked test-fs-glob.mjs is fixed by removing an early return [3]. doc-kit plugs an SEO and accessibility hole: it no longer injects an empty h1 when a page renders its own, eliminating duplicate heading tags [4]. And doc-kit is modernizing its imports, swapping parent-relative paths for `#` package imports [5]. The reliability desk published its scheduled 2026-08-23 report [6]. With 29 commits and 23 PRs across these repos, the crypto cleanup is the one to watch if you touch TLS or key handling.

$ ls nodejs/reviews/ # the step-back reads

the week in review commit-stream 3.0.0 restricts imports to package root the month in review Node 26 enters LTS as five undici advisories land
Full archive → Weekly reviews →

Quick answers

What shipped in Node.js on August 23, 2026?
A sweeping crypto refactor lands in Node.js as BoringSSL APIs take over validation and shims disappear. In total, 29 commits and 23 pull requests landed.
Who contributed to Node.js on August 23, 2026?
7 developers shipped this update, including Filip Skokan, 이혜미, Srinu desetti, trivikr, btea, Mohamed Shams El-Deen, and Node.js GitHub Bot.
What were the notable Node.js updates?
crypto: use available BoringSSL APIs, crypto: remove obsolete BoringSSL shims, and fs: fix glob early return skipping sibling entries.
♥

$ log @nodejs --recent

Workers preload streams into the startup snapshot; http2 accepts repeated content-encoding 18 shipped HTTP drain stalls after coalesced chunks, undici restores h2 error codes 20 shipped Stale OpenSSL errors cleared, npm 12.2.2 lands in node 26 shipped Node coalesces duplicate DNS lookups, batches HTTP body spans 37 shipped

$ log --all # elsewhere on the wire

Agent Security Quiet day in agent security as guard coverage reaches four clients Alignment & Post-training verl defaults Ascend RL mode, open-instruct unblocks SFT packing

$ ls showcases/

Safety Evals AI Red Teaming Agent Security Interpretability Alignment & Post-training

$ init your-desk

RepoJournal can write one of these for any repo you care about. Sign in with GitHub, pick your repos and sources, and your desk gets a wire like this one every morning.