$ cat nodejs/week/2026-09-07.log
the week in review · Sep 7 – Sep 13, 2026
Undici 8.10.2 lands in Node
By RepoJournal · composed from the cited sources · human-reviewed weekly · methodology
The runtime dependency bump headlines a week that also tightened FFI argument checks and sped up cjs-module-lexer's UTF-16 scans.
deps: update undici to 8.10.2 nodejs/node
The automated update brings the runtime's bundled HTTP client to 8.10.2, following last week's fixes to keep unref'd HTTP/2 WebSockets alive and to stop pool fan-out on HTTP/2. If you rely on Node's bundled undici rather than a pinned version, the behavior lands with your next runtime upgrade.
ffi: throw on missing memory helper arguments nodejs/node
The ffi memory helpers now throw when a required argument is omitted, instead of returning undefined from ffi.getInt8() through ffi.getFloat64(), ffi.setInt8() through ffi.setFloat64(), ffi.toBuffer(), and ffi.toArrayBuffer(). Before, a call that read or wrote nothing looked identical to a successful one; now it fails loudly.
perf: skip identifier and number runs nodejs/cjs-module-lexer
Skipping identifier and number runs in the scanner cut JS parse time from 12,799.70 to 11,094.91 µs per sweep on Node 24.20.0, with Wasm at 14,187.29 to 11,671.96 µs, at a cost of 154 bytes of optimized Wasm. It affects every ESM resolution path, including the one that runs each time a bare specifier is resolved.
perf: speed up UTF-16 source copies nodejs/cjs-module-lexer
A separate optimization targets UTF-16 source copies, improving an eight-file corpus from 13,921.11 to 10,368.47 µs per sweep on Node 24.20.0. The 128-code-unit cutoff keeps the fast path where Buffer setup would regress on older runtimes.
fs: support removing read-only files in rmSync on Windows nodejs/node
fs.rmSync now clears the read-only attribute on Windows before deleting, since libc++ std::filesystem::remove and remove_all do not. Windows users hitting EPERM when removing read-only files can drop their pre-delete chmod workaround.
src: fix null pointer call when running without a startup snapshot nodejs/node
Starting a Worker without a startup snapshot, whether via --no-node-snapshot, a --without-node-snapshot build, or an embedder Environment bootstrapped from scratch, no longer dereferences a null SnapshotData pointer. Embedders running snapshot-less builds were the affected group.
sqlite: bind undefined to NULL nodejs/node
sqlite now binds undefined named parameters to NULL instead of throwing ERR_INVALID_ARG_TYPE, matching the existing behavior when the parameter is omitted entirely. Code that worked around the throw by deleting parameters before binding can simplify.
lib: use Web IDL interface brand checks nodejs/node
CryptoKey and AbortSignal conversion moved from prototype ancestry to explicit brand checks, so a genuine signal survives a prototype change without invoking a shadowed getter. Code that previously relied on duck-typing these interfaces may need to pass real instances.
$ ls nodejs/week/ # the briefings behind this review
Keep up with Node.js in about 3 minutes: what actually shipped — the commits, pull requests, releases, and security advisories that matter.
fair warning: these emails are deeply technical. diffs, version numbers, CVEs, benchmark deltas. if that's not your idea of a good read, this isn't your newsletter.
Folds into your digest — weekly by default, monthly if you prefer. Unsubscribe in one click.