RepoJournal

$ cat nodejs/week/2026-08-31.log

Node.js

Node.js

the week in review · Aug 31 – Sep 6, 2026

Domain runtime-deprecation lands; security patches ship

♥

Node.js weekly: domain deprecated at runtime plus Undici fixes and crypto JWK corrections affect maintainers.

185 commits 126 PRs merged 3 releases 7 briefings covered
← previous week nodejs wire →

What shipped: The domain module is now runtime-deprecated [1]. Undici landed breaking fixes: WebSocket inflater destroyed after decompression limit [2], locked writable errors on unclean close [3], and several cache/connection corrections [4]. Node.js fixed BlockList.fromJSON for IPv4-mapped IPv6 [5] and crypto multi-prime RSA JWK handling [6]. Quic removed unused fin flag [7]. Security patches arrived [7] with permission audit mode fixes [8]. V8 backport included [9].

Why it matters: Runtime deprecation means code using domain will eventually break; start migrating to async_hooks alternatives. Undici fixes labeled breaking; test WebSocket and cache paths. BlockList and crypto JWK fixes correct subtle bugs affecting network and JWT usage. Also: vfs now loads native addons from mounted file systems [10], stream skips unobserved 'readable' emission at EOF [11].

References

  1. [1] domain: runtime-deprecate the module ↗ nodejs/node
  2. [2] fix(websocket): destroy inflater after decompression limit ↗ nodejs/undici
  3. [3] fix(websocket): error locked writable on unclean close ↗ nodejs/undici
  4. [4] fix(cache): reject unsafe method response caching ↗ nodejs/undici
  5. [5] net: fix BlockList.fromJSON for IPv4-mapped IPv6 rules ↗ nodejs/node
  6. [6] crypto: fix multi-prime RSA JWKs ↗ nodejs/node
  7. [7] quic: remove unused fin flag from blob reader wakeup ↗ nodejs/node
  8. [8] permission: do not enforce fs and addons in audit mode ↗ nodejs/node
  9. [9] deps: V8: backport f3d4d458fe59 ↗ nodejs/node
  10. [10] vfs: load native addons from a mounted file system ↗ nodejs/node
  11. [11] stream: skip unobserved 'readable' emission at EOF ↗ nodejs/node

$ ls nodejs/week/ # the briefings behind this review

Mon Aug 31 Node.js quic drops dead fin flag, zlib 1.3.2.1-motley lands Tue Sep 1 Recursive fs.watch fallback now watches directories, not files Wed Sep 2 Node.js adds v8.setHeapProfileNearHeapLimit, fixes environment live lock Thu Sep 3 Undici fixes cookie parser stack overflow, EventSource header injection risk Fri Sep 4 domain runtime-deprecation lands; BlockList round-trip fixed Sat Sep 5 Node.js security patches land, permission audit mode fixes, and stream EOF optimization Sun Sep 6 Crypto fixes multi-prime RSA JWK handling, adds Hybrid KEMs
← previous week nodejs wire →