RepoJournal
Node.js @nodejs
179 wires and counting

$ follow Node.js

Keep up with Node.js in about 3 minutes: what actually shipped — the commits, pull requests, releases, and security advisories that matter.

or

fair warning: these emails are deeply technical. diffs, version numbers, CVEs, benchmark deltas. if that's not your idea of a good read, this isn't your newsletter.

Folds into your digest — weekly by default, monthly if you prefer. Unsubscribe in one click.

$ status

wire 2026-10-09
stories 39
GitHub RSS Archive Reviews

© 2026 RepoJournal Home Showcase How it works Privacy

$ the-wire · showcase

Undici caps cached and error-body retention, drops Milo from the Node core bundle

By RepoJournal · Filed · About Node.js · Composed from the cited sources · methodology

Matteo Collina Christoph Obexer yosifkit Yahiro025 tianon
5 people shipped this
Matteo Collina @mcollina 3 cited Christoph Obexer @cobexer 1 cited yosifkit @yosifkit 1 cited Yahiro025 @Yahiro025 tianon @tianon

Undici landed three behavior-changing fixes: zero-lifetime cache entries are now always stale, response error bodies are capped at 1 MiB by default, and experimental Milo is excluded from the Node.js core bundle.

fix(cache): always treat zero-lifetime entries as stale (#5980) nodejs/undici

by Matteo Collina

Entries served with a zero lifetime are now always treated as stale rather than being served from cache. If your code relied on a zero lifetime meaning "cache but revalidate later", it will now re-fetch.

fix(interceptor): limit response error body size nodejs/undici

by mcollina

interceptors.responseError() gained a maxSize option and now retains at most 1 MiB of a decoded error body, where those bodies previously had no interceptor-specific limit. Setting maxSize: 0 restores unlimited retention; the PR frames the change as hardening against arbitrarily large decoded error bodies.

fix: exclude experimental milo from node.js core bundle nodejs/undici

by mcollina

Milo is excluded from the Node.js core bundle via the existing esbuildDetection build-time marker, so core always uses llhttp even when UNDICI_USE_MILO or useMilo: true requests Milo. The PR notes ordinary npm imports and esbuild bundles retain experimental Milo support.

Security Patches for Gradle 8.14.6 and 9.8.1 (#22452) nodejs/official-images

by Christoph Obexer

Gradle 8.14.6 and 9.8.1 security patches landed in the official-images build. If your container images pin Gradle, rebuild on the patched tags.

[security] Update golang nodejs/official-images

by yosifkit

Rounding out the day: Go moved to 1.27.2 and 1.26.9 under a security-tagged update, docker 29 went to 29.9.0 with buildx 0.38.0, PHP moved to 8.6.0RC3 and 8.4.27RC1, and a fetch-level regression test now locks in that HTTP/2 streams closed with NGHTTP2_INTERNAL_ERROR reject instead of leaving the promise pending.

Action items

$ ls nodejs/reviews/ # the step-back reads

the week in review commit-stream 3.0.0 restricts imports to package root the month in review Node 26 enters LTS as five undici advisories land
Full archive → Weekly reviews →

Quick answers

What shipped in Node.js on October 9, 2026?
Undici landed three behavior-changing fixes: zero-lifetime cache entries are now always stale, response error bodies are capped at 1 MiB by default, and experimental Milo is excluded from the Node.js core bundle. In total, 16 commits and 23 pull requests landed.
Who contributed to Node.js on October 9, 2026?
5 developers shipped this update, including Matteo Collina, Yahiro025, Christoph Obexer, tianon, and yosifkit.
What were the notable Node.js updates?
fix(cache): always treat zero-lifetime entries as stale (#5980), fix(interceptor): limit response error body size, and fix: exclude experimental milo from node.js core bundle.
♥

$ log @nodejs --recent

Workers preload streams into the startup snapshot; http2 accepts repeated content-encoding 18 shipped HTTP drain stalls after coalesced chunks, undici restores h2 error codes 20 shipped Stale OpenSSL errors cleared, npm 12.2.2 lands in node 26 shipped Node coalesces duplicate DNS lookups, batches HTTP body spans 37 shipped

$ log --all # elsewhere on the wire

Agent Security Quiet day in agent security as guard coverage reaches four clients Alignment & Post-training verl defaults Ascend RL mode, open-instruct unblocks SFT packing

$ ls showcases/

Safety Evals AI Red Teaming Agent Security Interpretability Alignment & Post-training

$ init your-desk

RepoJournal can write one of these for any repo you care about. Sign in with GitHub, pick your repos and sources, and your desk gets a wire like this one every morning.