RepoJournal
Node.js @nodejs
116 wires and counting

$ follow Node.js

Keep up with Node.js in about 3 minutes: what actually shipped — the commits, pull requests, releases, and security advisories that matter.

or

fair warning: these emails are deeply technical. diffs, version numbers, CVEs, benchmark deltas. if that's not your idea of a good read, this isn't your newsletter.

Folds into your digest — weekly by default, monthly if you prefer. Unsubscribe in one click.

$ status

wire 2026-09-04
stories 65
GitHub RSS Archive Topics

© 2026 RepoJournal Home Showcase Explore How it works Privacy

$ the-wire · showcase

domain runtime-deprecation lands; BlockList round-trip fixed

By RepoJournal · Filed · About Node.js

dependabot Matteo Collina Olivier Flückiger Daijiro Wachi Juan José Node.js GitHub Bot Christian Aurich
7 people shipped this
dependabot @dependabot 3 cited Matteo Collina @mcollina 1 cited Olivier Flückiger @o- 1 cited Daijiro Wachi @watilde 1 cited Juan José @juanarbol 1 cited Node.js GitHub Bot @nodejs-github-bot 1 cited Christian Aurich @christianaurichzm

Loading node:domain now warns at runtime, and net.BlockList round-trips IPv4-mapped IPv6 rules correctly.

Loading the node:domain module now emits a DeprecationWarning with code DEP0032, promoting the deprecation from documentation-only to runtime [1]. Code that imports node:domain, still common in legacy Express apps and tests, will start printing a warning on every load. This is a behavioral signal, not a removal: the module still works, but the warning marks it for eventual removal. Review dependencies that require 'domain' and plan an exit.

BlockList.toJSON()/fromJSON() has a data-loss bug for IPv4-mapped IPv6 addresses. toJSON() serialized them in mixed dotted-quad form (e.g. "::ffff:192.0.2.128"), but fromJSON()'s IPv6 regex excluded '.' and capped length at 39, so those rules were "silently corrupted or dropped on a toJSON()/fromJSON() round-trip" [2]. The fix allows '.' and raises the cap to 45. If you persist or transfer BlockList rules as JSON, upgrade to pick up correct round-trip behavior.

V8 backport f3d4d458fe59 removes the --js-float16array flag, incorporating Float16Array into standard typed array macros and the baseline snapshot unconditionally [3]. Since Float16Array has shipped by default since M138, internal code must not rely on the flag being present. Separately, changelog-maker v5 dropped its --markdown option; release docs now reflect that for anyone scripting releases [4].

Website dependency bumps are routine: lint-staged to 17.3.0, eslint and typescript-eslint updates, plus Shiki (4.3.1 to 4.4.3) and @opennextjs/cloudflare (1.19.3 to 1.20.2) [5][6][7]. A reliability report was added for 2026-09-04 [8].

Action items

References

  1. [1] domain: runtime-deprecate the module ↗ nodejs/node
  2. [2] net: fix BlockList.fromJSON for IPv4-mapped IPv6 rules ↗ nodejs/node
  3. [3] deps: V8: backport f3d4d458fe59 ↗ nodejs/node
  4. [4] doc: update `changelog-maker` instructions for releasing ↗ nodejs/node
  5. [5] chore(deps): bump the lint group with 3 updates ↗ nodejs/nodejs.org
  6. [6] chore(deps): bump the mdx group with 5 updates ↗ nodejs/nodejs.org
  7. [7] chore(deps): bump @opennextjs/cloudflare from 1.19.3 to 1.20.2 ↗ nodejs/nodejs.org
  8. [8] Add report for 2026-09-04 ↗ nodejs/reliability

$ ls nodejs/reviews/ # the step-back reads

the week in review Domain runtime-deprecation lands; security patches ship the month in review Node 26 line lands crypto, stream, and FFI hardening as deprecations tighten the core
Topics: JavaScript Full archive →

Quick answers

What shipped in Node.js on September 4, 2026?
Loading node:domain now warns at runtime, and net.BlockList round-trips IPv4-mapped IPv6 rules correctly. In total, 30 commits and 35 pull requests landed.
Who contributed to Node.js on September 4, 2026?
7 developers shipped this update, including Matteo Collina, Olivier Flückiger, Daijiro Wachi, Juan José, Christian Aurich, dependabot, and Node.js GitHub Bot.
What were the notable Node.js updates?
domain: runtime-deprecate the module, net: fix BlockList.fromJSON for IPv4-mapped IPv6 rules, and deps: V8: backport f3d4d458fe59.
♥

$ log @nodejs --recent

cjs-module-lexer scans faster, ffi throws on missing args 41 shipped Crypto fixes multi-prime RSA JWK handling, adds Hybrid KEMs 29 shipped Node.js security patches land, permission audit mode fixes, and stream EOF optimization 73 shipped Undici fixes cookie parser stack overflow, EventSource header injection risk 62 shipped

$ log --all # elsewhere on the wire

Meta React Native adds Stable API guards to renderer attributed string FastAPI & Pydantic Pydantic fixes Mypy plugin crash, tightens datetime constraints

$ ls showcases/

Rails Django Laravel Go Vercel Vue.js Kubernetes HashiCorp Arch Linux Linux Anthropic OpenAI

$ init your-desk

RepoJournal can write one of these for any repo you care about. Sign in with GitHub, pick your repos and sources, and your desk gets a wire like this one every morning.