$ cat nodejs/week/2026-11-02.log
the week in review · Nov 2 – Nov 8, 2026
commit-stream 3.0.0 restricts imports to package root
By RepoJournal · composed from the cited sources · human-reviewed weekly · methodology
Undici closed two redirect credential leaks the same week node fixed QUIC streams losing data sent before a reader attached.
v3.0.0 nodejs/commit-stream
The major version adds types and package exports and modernises the tests, with the exports map as the breaking part: anything in your tooling that reached into a subpath rather than the root now fails to resolve. Check your imports before bumping.
fix(redirect): strip credentials from array-of-tuples headers nodejs/undici
The redirect handler assumed every Array header was a flat alternating name/value list, but Undici also accepts an iterable of [name, value] pairs, so credentials in an Object.entries-style tuple array survived a cross-origin redirect. If you pass headers to fetch as tuples, this is worth picking up.
fix(cache): prevent cross-origin redirect cache bypass nodejs/undici
A redirect bouncing through an untrusted intermediate origin and landing back on the trusted origin was cached under the original key, because the origin guard only checked the final URL. Redirect hops also carried storage policies through the chain.
quic: retain readers for readable streams nodejs/node
When a peer-initiated unidirectional stream sent data and FIN before the consumer's first async iterator pull, the native stream was cleaned up before the reader existed and the buffered data was gone. Readers are now retained for readable streams.
v8: support X509Certificate serialization nodejs/node
v8.serialize() rejected X509Certificate objects; it now encodes a host object holding the certificate's DER snapshot, including its issuerCertificate chain, and v8.deserialize() reconstructs fresh objects from the stored snapshot rather than the cached raw value.
http2: release memory credit for canceled writes nodejs/node
Canceled uploads discarded queued data that still counted against the session's memory limit, so later requests on the same session could fail with NGHTTP2_ENHANCE_YOUR_CALM. Cleanup now subtracts those bytes before the write callbacks run.
stream: keep async context of fromWeb writes nodejs/node
Since the fromWeb write path moved to a shared write tracker, the async context shifted for writes issued before the WritableStream or for writes still in flight at close. Writable.fromWeb() and Duplex.fromWeb() now keep it.
lib: place `value` before `done` in iterator results nodejs/node
Iterator results now place value before done, matching the ECMA-262 CreateIterResultObject order that V8 optimises, with a measured gain in the microbenchmark. It also reverses the lint rule that enforced the opposite order, so that rule needs updating. Alongside: V8 patched to 15.6.75.33, perfetto to 59.1, gyp-next to v0.22.4 in node-gyp, and doc-kit now skips auto-PR workflows on forks.
$ ls nodejs/week/ # the briefings behind this review
Keep up with Node.js in about 3 minutes: what actually shipped — the commits, pull requests, releases, and security advisories that matter.
fair warning: these emails are deeply technical. diffs, version numbers, CVEs, benchmark deltas. if that's not your idea of a good read, this isn't your newsletter.
Folds into your digest — weekly by default, monthly if you prefer. Unsubscribe in one click.