179 wires and counting

$ follow Node.js

Keep up with Node.js in about 3 minutes: what actually shipped — the commits, pull requests, releases, and security advisories that matter.

or

fair warning: these emails are deeply technical. diffs, version numbers, CVEs, benchmark deltas. if that's not your idea of a good read, this isn't your newsletter.

Folds into your digest — weekly by default, monthly if you prefer. Unsubscribe in one click.

$ status

wire 2026-11-04
stories 28

© 2026 RepoJournal Home Showcase How it works Privacy

$ the-wire · showcase

v8 learns to serialize X509Certificate, http2 frees canceled-write memory

By RepoJournal · Filed · About Node.js · Composed from the cited sources · methodology

Node's X.509 series lands its third patch, v8.serialize() gains certificate support with chain handling, and http2 stops leaking memory credit when uploads are canceled.

v8: support X509Certificate serialization nodejs/node

by panva

v8.serialize() used to reject X509Certificate objects outright; it now encodes a host object carrying the certificate's DER snapshot, follows issuerCertificate up the chain, and reconstructs fresh instances in v8.deserialize(). The patch reads the stored snapshot rather than the cached raw Buffer, which callers can mutate, and decodes each certificate independently instead of imposing issuer re...

http2: release memory credit for canceled writes nodejs/node

by fatihguzeldev

Bytes from a canceled HTTP/2 upload were discarded but still counted against the session's memory limit, which could make later requests on the same session fail with NGHTTP2_ENHANCE_YOUR_CALM. Cleanup now subtracts those bytes before the write callbacks run, with tests covering both server-side cancellation and destroy() from a write callback.

lib: place `value` before `done` in iterator results nodejs/node

by bakkot

Iterator result objects now place value before done, matching what ECMA-262 requires and the order V8 optimizes for. The change buys real throughput: the url/url-searchparams-iterator-consumers.js benchmark with method='Map' measured +35.6% ops/sec. Note the reversal from the lint rule that enforced the opposite order.

deps: load amaro from dist/internal.js nodejs/node

by Geoffrey Booth

amaro 1.3.0 reduced dist/index.js to a thin wrapper around dist/internal.js, so the built-in now registers and requires internal.js, which would otherwise fail to resolve its sibling. Relevant if you vendor or pin amaro yourself.

feat: index riscv64-pointer-compression builds (#257) nodejs/unofficial-builds

by Richard Lau

The unofficial-builds index now covers riscv64 pointer-compression builds, which requires a later nodejs-dist-indexer than the one currently in use. The same repo stops building musl x64 after Node.js 26 and had its README run through markdownlint-cli2 --fix.

Quick answers

What shipped in Node.js on November 4, 2026?
Node's X.509 series lands its third patch, v8.serialize() gains certificate support with chain handling, and http2 stops leaking memory credit when uploads are canceled. In total, 17 commits and 11 pull requests landed.
Who contributed to Node.js on November 4, 2026?
7 developers shipped this update, including panva, fatihguzeldev, bakkot, Geoffrey Booth, nschonni, Richard Lau, and Node.js GitHub Bot.
What were the notable Node.js updates?
v8: support X509Certificate serialization, http2: release memory credit for canceled writes, and lib: place `value` before `done` in iterator results.