RepoJournal
Node.js

@nodejs

The Node.js runtime - every backend team's CVE source of truth

Keep up with Node.js in about 3 minutes a day: what actually shipped — the commits, pull requests, releases, and security advisories that matter.

One email a day. Unsubscribe in one click.

Pick a date

  1. Wed 29 jul
  2. Thu 30 jul
  3. Fri 31 jul
  4. Sat 1 aug
  5. Sun 2 aug
  6. Mon 3 aug
  7. Tue 4 aug
  8. Wed 5 aug
  9. Thu 6 aug
  10. Fri 7 aug
  11. Sat 8 aug
  12. Sun 9 aug
  13. Mon 10 aug
  14. Tue 11 aug
  15. Wed 12 aug
  16. Thu 13 aug
  17. Fri 14 aug
  18. Sat 15 aug
  19. Sun 16 aug
  20. Mon 17 aug
  21. Tue 18 aug
  22. Wed 19 aug
  23. Thu 20 aug
  24. Fri 21 aug
  25. Sat 22 aug
  26. Sun 23 aug
  27. Mon 24 aug
  28. Tue 25 aug
  29. Wed 26 aug
  30. Today 27 aug
Topics: JavaScript Full archive →

The Wire · Showcase

NODE 26.8.1 HITS DOCKER IMAGES

By RepoJournal · Filed · About Node.js

nodejs-github-bot James M Snell Rafael Gonzaga Tim Perry Yeaseen jakecastelli dependabot
7 people shipped this
nodejs-github-bot @nodejs-github-bot 1 cited James M Snell @jasnell 1 cited Rafael Gonzaga @RafaelGSS 1 cited Tim Perry @pimterry 1 cited Yeaseen @Yeaseen 1 cited jakecastelli @jakecastelli 1 cited dependabot @dependabot

Node's official Docker images just caught up to the latest releases, and a pair of core patches landed that you need on your radar.

The official Node.js Docker images are now shipping Node.js 24.20.0 and 26.8.1 [1], a manual correction that fixes the broken `node -v` output on 26.8.0. In core, two security-policy changes landed: James Snell relaxed vulnerability handling for experimental features [2], while Rafael Gonzaga clarified triage dispositions and permission boundaries [3]. More critically for anyone running HTTP/2, Tim Perry fixed a write deadlock exposed by larger window sizes [4], removing a redundant guard added as a security mechanism. A quieter but valuable fix: `rmSync` now produces correct error messages for non-ASCII paths on Linux and Windows [5]. Test coverage for `Readable.from()` sync iterator errors [6] rounds out a steady 24 hours across 24 commits and 17 PRs.

One email a day. Unsubscribe in one click.

Action items

References

  1. [1] feat: Node.js 24.20.0, 26.8.1 ↗ nodejs/docker-node
  2. [2] meta: refine the security vuln posture for experimental features nodejs/node
  3. [3] doc: clarify security triage dispositions and permission boundaries nodejs/node
  4. [4] http2: fix write deadlock exposed by larger window sizes nodejs/node
  5. [5] fs: fix rmSync error messages for non-ASCII paths nodejs/node
  6. [6] test: cover Readable.from() sync iterator errors ↗ nodejs/node

Quick answers

What shipped in Node.js on August 27, 2026?
Node's official Docker images just caught up to the latest releases, and a pair of core patches landed that you need on your radar. In total, 24 commits, 17 pull requests, and 3 releases landed.
Who contributed to Node.js on August 27, 2026?
7 developers shipped this update, including nodejs-github-bot, dependabot, James M Snell, Rafael Gonzaga, Tim Perry, Yeaseen, and jakecastelli.
What were the notable Node.js updates?
feat: Node.js 24.20.0, 26.8.1, meta: refine the security vuln posture for experimental features, and doc: clarify security triage dispositions and permission boundaries.

More from @nodejs

Node.js @nodejs

NODE CORE PERF: 10-20% EVENTTARGET SPEEDUP LANDS

EventTarget just got 10-20% faster in the benchmark, and recursive readdir drops the per-entry stat() overhead.

Szymon Łągiewka codebytere JunHwan Choi Chengzhong Wu +3
javascript 30 shipped
Node.js @nodejs

Node's TLS abort becomes a throw

Node.js turns a hard crash into a recoverable error, and changelog-maker ships a breaking rework.

Aviv Keller nodejs-github-bot RafaelGSS mcollina +6
javascript 41 shipped
Node.js @nodejs

Node's compile cache turns read-only

Node is about to let you ship a compile cache that the runtime can only ever read, and it's the patch you've been waiting for.

dependabot Jason Zhang codebytere Trivikram Kamat +3
javascript 50 shipped
Node.js @nodejs

Node.js Crypto Overhaul Puts BoringSSL Front and Center

A sweeping crypto refactor lands in Node.js as BoringSSL APIs take over validation and shims disappear.

Filip Skokan 이혜미 Srinu desetti trivikr +3
javascript 52 shipped

Daily updates, in your inbox

Follow Node.js

Keep up with Node.js in about 3 minutes a day: what actually shipped — the commits, pull requests, releases, and security advisories that matter.

or

One email a day. Unsubscribe in one click. Read a past issue →

Elsewhere on the wire

AI Agents AI Agents

Cline desktop plugins crash on launch

Cline's desktop users hit a wall installing marketplace plugins, and the fix is a rewrite of the installer that skips the missing CLI.

langchain-oss-model-profiles langchain-oss-model-profiles[bot] kodurd Badar Rahman +10
ai-agents 66 shipped
Local LLMs Local LLMs

vLLM 0.28.0 LANDED WITH 584 COMMITS AND A KIMI-K3 PERFORMANCE PUSH

vLLM shipped its biggest release in months, and Ollama quietly fixed a macOS bug that could leave stale app processes running.

ParthSareen hoyyeva jessegross Dominik Pantaleoni +10
llms 242 shipped
CachyOS @CachyOS

CachyOS Tuned Strikes: THP and Laptop Mode Out

The tuned project just killed laptop_mode and switched THP to always-on, a performance play that will hit every CachyOS desktop default.

github-actions alexsmolya Peter Jung Adrien Luneau +3
infra 64 shipped
Elixir & Phoenix Elixir & Phoenix

ECT0 FIXES WARNINGS-AS-ERRORS TYPO

Ecto's warnings-as-errors setup was silently broken by a typo, and the fix is now in.

Mathias Polligkeit
elixir 2 shipped
Want every project, not just this one?