$ cat nodejs/week/2026-10-19.log
the week in review · Oct 19 – Oct 25, 2026
TLS rejects chains with blocked public keys
By RepoJournal · composed from the cited sources · human-reviewed weekly · methodology
The same period shipped three breaking changes to crypto and permissions, plus faster AbortSignal and an HTTP/2 GOAWAY fix.
tls: reject chains containing blocked public keys nodejs/node
Node embeds the Mozilla root store but carries no equivalent of the browsers' CRLSet or OneCRL and no default revocation checking, so a chain through a compromised intermediate still verified as long as it reached a trusted root. That gap now closes at the cost of a behavior change for anyone whose trust store depends on the old permissiveness.
permission: check permission model in realpathSync nodejs/node
realpathSync now consults the permission model; the sibling entry points (fs.realpathSync.native(), fs.promises.realpath(), fs.lstatSync(), fs.existsSync()) already denied the same paths. Permission-restricted code that previously reached a path through realpathSync will start failing.
crypto: reset random caches across snapshots nodejs/node
Startup snapshots were retaining unused randomInt() and UUID cache entries, so deserialized processes replayed the same random values. Caches are now cleared after user serialization callbacks and before deserialization callbacks. The release notes say "the latter also handles" the deserialization side, meaning anything relying on snapshot-carried entropy needs a look.
module: add "worker" condition for Web Worker threads nodejs/node
A new "worker" package condition activates for Web Worker threads created via the Worker global under --experimental-web-worker, letting packages expose a worker-specific entry point instead of inheriting the parent's conditions verbatim. Relevant only to code already running on the experimental Web Worker path.
fix(http2): keep persistent error sink on released streams nodejs/undici
When an HTTP/2 session tears down with an error, such as the idle reaper in onHttp2SessionIdleTimeout, Node fans that error to every native stream still tracked, and a released stream without an 'error' listener crashed the process. This was the second http2 change of the period after the GOAWAY replay work.
feat: support the Alpha release phase nodejs/nodejs.org
nodejs.org now keeps vN.0.0-alpha.X.Y.Z versions in the release data instead of letting nodevu coerce them to vN.0.0, with a matching /download/alpha route. Alongside it came Alpha versions added to the download pages, so the alpha phase reaches users through the site rather than only through release notes.
tools: add lint rule for unread benchmark `n` nodejs/node
The node-core/benchmark-n-config lint rule requires main() to read any n declared in a benchmark's configs, catching the class of bug where num was renamed to n but main({ num: n }) was left behind and n arrived as undefined. The rule already surfaced more instances in async_hooks benchmarks.
perf(legacy-html): stop re-parsing shiki themes per code block nodejs/doc-kit
Alongside: legacy-html stopped re-parsing Shiki themes on every code block, saving roughly 3.8s of CPU per build; gyp-next 0.22.4 avoided deprecated os.path.commonprefix() in RelativePath; the root store moved to NSS 3.131.1, dropping three emSign roots; and undici ignored SQLITE_BUSY in its sqlite cache store.
$ ls nodejs/week/ # the briefings behind this review
Keep up with Node.js in about 3 minutes: what actually shipped — the commits, pull requests, releases, and security advisories that matter.
fair warning: these emails are deeply technical. diffs, version numbers, CVEs, benchmark deltas. if that's not your idea of a good read, this isn't your newsletter.
Folds into your digest — weekly by default, monthly if you prefer. Unsubscribe in one click.