129 wires and counting

$ follow Node.js

Keep up with Node.js in about 3 minutes: what actually shipped — the commits, pull requests, releases, and security advisories that matter.

or

fair warning: these emails are deeply technical. diffs, version numbers, CVEs, benchmark deltas. if that's not your idea of a good read, this isn't your newsletter.

Folds into your digest — weekly by default, monthly if you prefer. Unsubscribe in one click.

$ status

wire 2026-09-14
stories 25

© 2026 RepoJournal Home Showcase Explore How it works Privacy

$ the-wire · showcase

Embedder abort fix, safer snapshot blobs

By RepoJournal · Filed · About Node.js · Composed from the cited sources · methodology

Node.js landed two crash-class fixes for embedders and snapshot consumers, while the test runner work continued to rein in WPT and fixture scheduling costs.

src: fix abort when two Environments share an IsolateData nodejs/node

by codebytere

Creating a second Environment from the same IsolateData, which doc/api/embedding.md allows and the cctest fixture does, used to abort as soon as it ran require('net'): stream_wrap, tcp_wrap, pipe_wrap, tty_wrap, http2 and the crypto key classes built per-isolate templates from the per-Environment binding initializer and stored them through a setter that CHECKs the slot is empty, while ffi, sqli...

src: fix crash on empty, foreign or truncated --snapshot-blob files nodejs/node

by Shelley Vohr

node --snapshot-blob <file> aborted with an assertion on an empty file, a non-Node blob, or a zero-length startup blob, and read past the end of the buffer on a truncated one because BlobDeserializer trusted every length field in the blob. EmbedderSnapshotData::FromFile() is documented to return an empty pointer rather than crash.

test: schedule WPT variants individually nodejs/node

by panva

Generated WPT paths now go through the Python test runner's work queue with query variants scheduled and validated individually, so each task runs one variant at a time instead of every wrapper independently launching up to availableParallelism() - 1 specs. On overloaded CI workers, lowering -j now actually limits concurrency.

test: synchronize ordered runner events nodejs/node

by Filip Skokan

The ordered runner test releases its slow fixture over a local socket after the fast fixture emits its bypassed completion event, replacing a fixed 30-second delay while keeping the event-order assertions and a bounded failure timeout.

test: reuse fixed primes in DH tests nodejs/node

by Filip Skokan

Older test hygiene also moved forward: DH tests reuse the modp14 prime instead of generating fresh parameters, and the news feeder and reliability desks pushed their routine feed update and 2026-09-14 report.

Quick answers

What shipped in Node.js on September 14, 2026?
Node.js landed two crash-class fixes for embedders and snapshot consumers, while the test runner work continued to rein in WPT and fixture scheduling costs. In total, 19 commits and 6 pull requests landed.
Who contributed to Node.js on September 14, 2026?
4 developers shipped this update, including panva, codebytere, github-actions, and Node.js GitHub Bot.
What were the notable Node.js updates?
src: fix abort when two Environments share an IsolateData, src: fix crash on empty, foreign or truncated --snapshot-blob files, and test: schedule WPT variants individually.