RepoJournal
Node.js @nodejs
129 wires and counting

$ follow Node.js

Keep up with Node.js in about 3 minutes: what actually shipped — the commits, pull requests, releases, and security advisories that matter.

or

fair warning: these emails are deeply technical. diffs, version numbers, CVEs, benchmark deltas. if that's not your idea of a good read, this isn't your newsletter.

Folds into your digest — weekly by default, monthly if you prefer. Unsubscribe in one click.

$ status

wire 2026-09-10
stories 47
GitHub RSS Archive Reviews Topics

© 2026 RepoJournal Home Showcase Explore How it works Privacy

$ the-wire · showcase

Node 26.8.2 ships OpenSSL 3.5.8 and an HTTP/2 window override

By RepoJournal · Filed · About Node.js · Composed from the cited sources · methodology

marawanokasha Node.js GitHub Bot Constantine Molchanov huaxingao Antoine du Hamel Filip Skokan Wiyeong Seo
10 people shipped this
marawanokasha @marawanokasha 1 cited Node.js GitHub Bot @nodejs-github-bot 1 cited Constantine Molchanov @moigagoo 1 cited huaxingao @huaxingao 1 cited Antoine du Hamel @aduh95 1 cited Filip Skokan @panva 1 cited Wiyeong Seo @HBSPS 1 cited Trivikram Kamat @trivikr 1 cited pimterry @pimterry 1 cited Chengzhong Wu @legendecas 1 cited

Node.js 26.8.2 (Current) replaces OpenSSL with 3.5.8 and Undici with 8.10.2, while a new http2 option lets servers shrink the connection window that a prior release raised to 32MB.

Node 26.8.2 landed as the Current line, updating OpenSSL to 3.5.8 and Undici to 8.10.2 [1]. The same release deprecates `Server.prototype._listen2` in `node:net` and refines the project's security vulnerability posture for experimental features [1]. If you pin to the Current release line, this is the version to test against.

The HTTP/2 connection window is now configurable at setup. A previous change raised the default connection window from 64KB to 32MB, and the only adjustment path was `setLocalWindowSize`, which works after the connection is established [2]. The new `connectionWindowSize` option lets callers set the window before setup, so workloads that want a smaller window can shrink it without patching the default. Separately, `posix.resolve`, `posix.normalize`, and `posix.parse` no longer use `StringPrototypeCharCodeAt` internally [3].

In `node:sqlite`, scalar and aggregate/window functions registered on a `DatabaseSync` instance are now tracked, with registrations removed through SQLite destruction callbacks and tracking cleared when the database closes [4]. The change targets the leak tracked as issue 65880 [4]. Node.js 24.21.0 also appeared in the official images manifests [5].

Tooling saw two smaller changes. A daily workflow now removes the `[author ready]` label from open pull requests that conflict with their base branch and comments with rebase guidance [6]. In node-gyp, a test fix adds the missing callback to `fs.unlink` [7]. The official-images side carried Apache Spark updates: 3.5.8 to 3.5.9, 4.0.2 to 4.0.4, and 4.1.2 to 4.1.3 referencing the upstream Spark Docker commit, plus a purely additive Spark 4.2.0 set covering all 12 image variants (Scala 2.13 with Java 17, 21, and 25) while the shared rolling tags stay on 4.1.2 [8][9]. Nim 2.2.12 was added with only the latest versions of actively maintained branches kept [10].

Action items

References

  1. [1] 2026-09-09, Version 26.8.2 (Current) ↗ nodejs/node
  2. [2] http2: add new connectionWindowSize option ↗ nodejs/node
  3. [3] path: remove `StringPrototypeCharCodeAt` from some methods of `posix` ↗ nodejs/node
  4. [4] sqlite: track registered user-defined functions ↗ nodejs/node
  5. [5] Node: feat: Node.js 24.21.0 (#22231) ↗ nodejs/official-images
  6. [6] tools: unlabel author ready on base branch conflicts ↗ nodejs/node
  7. [7] test: fix missing cb in fs.unlink (#3368) ↗ nodejs/node-gyp
  8. [8] Update Spark versions to 3.5.9, 4.0.4, 4.1.3 ↗ nodejs/official-images
  9. [9] Add spark 4.2.0 ↗ nodejs/official-images
  10. [10] Add Nim 2.2.12. (#22227) ↗ nodejs/official-images

$ ls nodejs/reviews/ # the step-back reads

the week in review Node 26.9.0 ships generic crypto MAC API the month in review Node 26 line lands crypto, stream, and FFI hardening as deprecations tighten the core
Topics: JavaScript Full archive → Weekly reviews →

Quick answers

What shipped in Node.js on September 10, 2026?
Node.js 26.8.2 (Current) replaces OpenSSL with 3.5.8 and Undici with 8.10.2, while a new http2 option lets servers shrink the connection window that a prior release raised to 32MB. In total, 25 commits, 21 pull requests, and 1 releases landed.
Who contributed to Node.js on September 10, 2026?
10 developers shipped this update, including marawanokasha, Node.js GitHub Bot, Constantine Molchanov, huaxingao, Antoine du Hamel, Filip Skokan, Wiyeong Seo, and Trivikram Kamat, and 2 more.
What were the notable Node.js updates?
2026-09-09, Version 26.8.2 (Current), http2: add new connectionWindowSize option, and path: remove `StringPrototypeCharCodeAt` from some methods of `posix`.
♥

$ log @nodejs --recent

SEA gets ZIP asset archives, HTTP server sheds per-request allocations 28 shipped Buffer.stringLength(), and a trace_events abort for embedders 40 shipped cpSync dereference regression fixed, trace union punning removed 39 shipped Node 26.9.0 adds a generic MAC API, undici walks back its decompression size cap 27 shipped

$ log --all # elsewhere on the wire

@openclaw Cold-start Gateway diagnostics stop crying wolf, doctor repairs plugin drift Agentic Coding Cline desktop bundles shrink, goose unblocks its own clicks

$ ls showcases/

Rails Django Laravel Go Vercel Vue.js Kubernetes HashiCorp Arch Linux Linux Anthropic OpenAI

$ init your-desk

RepoJournal can write one of these for any repo you care about. Sign in with GitHub, pick your repos and sources, and your desk gets a wire like this one every morning.