RepoJournal
Node.js @nodejs
129 wires and counting

$ follow Node.js

Keep up with Node.js in about 3 minutes: what actually shipped — the commits, pull requests, releases, and security advisories that matter.

or

fair warning: these emails are deeply technical. diffs, version numbers, CVEs, benchmark deltas. if that's not your idea of a good read, this isn't your newsletter.

Folds into your digest — weekly by default, monthly if you prefer. Unsubscribe in one click.

$ status

wire 2026-09-13
stories 53
GitHub RSS Archive Reviews Topics

© 2026 RepoJournal Home Showcase Explore How it works Privacy

$ the-wire · showcase

dgram skips custom lookup for literal IPs, node:bench gated behind a flag

By RepoJournal · Filed · About Node.js · Composed from the cited sources · methodology

Ruben Bridgewater jasnell martenrichter trivikr bmuenzenmeyer KhafraDev
6 people shipped this
Ruben Bridgewater @BridgeAR 1 cited jasnell @jasnell 1 cited martenrichter @martenrichter 1 cited trivikr @trivikr 1 cited bmuenzenmeyer @bmuenzenmeyer 1 cited KhafraDev @KhafraDev 1 cited

Node's dgram module now bypasses a user-supplied lookup function when the destination is a literal IP of the socket's family, a breaking change for any lookup that expected to be invoked for IP addresses.

dgram now uses a literal IP of the socket's family directly instead of calling a user-supplied lookup function, matching how net.connect() already skips the lookup for a literal IP host before consulting options.lookup. This is a breaking change: a lookup that expected to be invoked for IP addresses will no longer be called [1].

The experimental node:bench module is now properly gated behind the --experimental-bench flag, a step the author says was missed on the initial landing [2]. On the QUIC side, QuicStream gains a promise that fulfills when a stream becomes available and ready, removing the need to poll when a stream cannot be created immediately due to flow control [3].

In crypto, the new crypto.parsePKCS12() returns the private key, end-entity certificate, and other certificates from a PKCS#12 (.p12/.pfx) bundle as a KeyObject and X509Certificate instances. Reading those bundles from JavaScript previously meant shelling out to the openssl pkcs12 CLI or taking a userland dependency such as node-forge; Node already parsed this internally, and the PR exposes those internals [4]. The vfs layer now resolves symlinks when checking rename descendants, validating resolved source and destination parent paths before renaming a directory so it cannot be moved into its own subtree through a symlink [5].

Over in undici, a fix drops the ReadableStream.from helper function on the grounds that ReadableStream.from has been supported since node v20.6.0. The author's note pulls no punches: "Unfortunately ai doesn't understand nuance, so ai cannot be trusted to fix this bug" [6].

$ ls nodejs/reviews/ # the step-back reads

the week in review Node 26.9.0 ships generic crypto MAC API the month in review Node 26 line lands crypto, stream, and FFI hardening as deprecations tighten the core
Topics: JavaScript Full archive → Weekly reviews →

Quick answers

What shipped in Node.js on September 13, 2026?
Node's dgram module now bypasses a user-supplied lookup function when the destination is a literal IP of the socket's family, a breaking change for any lookup that expected to be invoked for IP addresses. In total, 29 commits and 24 pull requests landed.
Who contributed to Node.js on September 13, 2026?
6 developers shipped this update, including Ruben Bridgewater, jasnell, martenrichter, trivikr, bmuenzenmeyer, and KhafraDev.
What were the notable Node.js updates?
dgram: skip the custom lookup for literal IP addresses, lib: put node:bench behind an --experimental-bench flag, and quic: add promise to QuicStream for pending strms.
♥

$ log @nodejs --recent

SEA gets ZIP asset archives, HTTP server sheds per-request allocations 28 shipped Buffer.stringLength(), and a trace_events abort for embedders 40 shipped cpSync dereference regression fixed, trace union punning removed 39 shipped Node 26.9.0 adds a generic MAC API, undici walks back its decompression size cap 27 shipped

$ log --all # elsewhere on the wire

@openclaw Cold-start Gateway diagnostics stop crying wolf, doctor repairs plugin drift Agentic Coding Cline desktop bundles shrink, goose unblocks its own clicks

$ ls showcases/

Rails Django Laravel Go Vercel Vue.js Kubernetes HashiCorp Arch Linux Linux Anthropic OpenAI

$ init your-desk

RepoJournal can write one of these for any repo you care about. Sign in with GitHub, pick your repos and sources, and your desk gets a wire like this one every morning.