What nodejs/node shipped
Written by FoxPlug from the repository's own releases; not affiliated with Node.js. Paste your own repository in the box below and FoxPlug writes the same weekly update for your product. This page is an automatic summary of the releases, pull requests and commits in github.com/nodejs/node; Node.js did not write it and does not use or endorse FoxPlug. Every line links to the change it describes.
Get a weekly update like this for your product, free
Week of October 5, 2026
What shipped
- Released Node.js 26.11.1 (Current) on 2026-10-07, which reverts a set of build and documentation changes. Release
- Released Node.js 26.11.0 (Current) on 2026-10-07 with buffer.isLatin1 and Buffer.stringLength(). Release
- Module loading now synchronously resolves and loads most ES modules that lack top-level await, used when no async loader hooks, --import flags, or --inspect-brk are active. Pull request #62530
- Documentation, lib, and src now throw a catchable ERR_WEBASSEMBLY_NOT_SUPPORTED error when WebAssembly or RX memory are unavailable, such as under --jitless. Pull request #66533
- Fixed require of imports with a package map so that # specifiers fall through to the package.json imports lookup under --experimental-package-map. Pull request #66565
- Http2 response getHeaders is faster after replacing ObjectAssign with an explicit key-copy loop that keeps the null-prototype shallow copy. Pull request #66592
- Child_process now propagates config-file permission flags to child processes. Pull request #66559
- Added --allow-fs-vfs to the permission available flags. Pull request #66554
- Diagnostics_channel traceCallback now allocates a fresh context when undefined is passed and subscribers are present. Pull request #66481
- Watch mode strips underscore aliases of watch flags from process.execArgv and NODE_OPTIONS, so --watch_path no longer leaks through. Pull request #66365
Why it matters
This week brought two Current releases, 26.11.0 and 26.11.1, the latter reverting build and documentation changes. Users also get new buffer helpers, faster http2 response getHeaders, synchronous loading for most ES modules without top-level await, and clearer errors when WebAssembly or RX memory are unavailable.
Changelog entry
- Release: Node.js 26.11.1 (Current) Release
- Release: Node.js 26.11.0 (Current) Release
- Module: synchronously load most ES modules Pull request #62530
- Doc,lib,src: throw on missing WebAssembly or RX support Pull request #66533
- Module: fix require of imports with package map Pull request #66565
- Http2: speed up response getHeaders Pull request #66592
- Child_process: propagate config-file permission flags to children Pull request #66559
- Lib: add --allow-fs-vfs to permission available flags Pull request #66554
- Diagnostics_channel: fix default callback context Pull request #66481
- Watch: strip underscore aliases of watch flags Pull request #66365
- Sqlite: throw on oversized strings instead of aborting Pull request #66521
- Sqlite: validate aggregate() name and options Pull request #66463
Node.js 26.11.0 and 26.11.1 are out. Plus most ES modules without top-level await can now load synchronously, http2 response getHeaders is faster, and WebAssembly-unavailable errors are catchable.
This week in Node.js: 26.11.0 and 26.11.1 were released on 2026-10-07. 26.11.0 adds buffer.isLatin1 and Buffer.stringLength(); 26.11.1 reverts several build and documentation changes. Module loading can now synchronously resolve and load most ES modules that lack top-level await, active when no async loader hooks, --import flags, or --inspect-brk are in use. http2 response getHeaders is faster through an explicit key-copy loop. WebAssembly or RX memory unavailability, such as under --jitless, now raises a catchable error. require of imports with a package map now handles # specifiers, and child_process propagates config-file permission flags to children.
Week of September 28, 2026
What shipped
- V8 updated to 15.2. Pull request #65161
- Removed support for jitless and lite modes since built-in functionality like fetch() and TypeScript require WebAssembly. Pull request #66459
- Web Crypto ExperimentalWarnings removed from algorithms and methods moving toward unflagged browser implementations. Pull request #66312
- Removed legacy AsyncLocalStorage implementation and the --no-async-context-frame flag, making AsyncContextFrame the sole implementation. Pull request #63641
- FFI now accepts safe integer numbers for 64-bit arguments alongside bigint values, allowing buffer lengths to be passed without explicit BigInt() conversions. Pull request #66197
- SQLite connection state is now restored when reopening a closed database. Pull request #66042
- Spawn() and spawnSync() are 20-24% faster when no options.env is passed by building the default environment block in one native pass. Pull request #65325
- Random synchronous number generation performance improved by calling the CSPRNG directly instead of creating RandomBytesJob objects. Pull request #66348
- Recursive mkdir no longer retries ENOENT indefinitely when the parent directory exists but continues returning ENOENT, such as under /proc. Pull request #66340
- Workers no longer abort the process when stopped while running an FFI callback. Pull request #66389
Why it matters
This week removes experimental status from Web Crypto APIs and AsyncLocalStorage, consolidates configuration management, and fixes correctness issues in FFI, SQLite, and filesystem code. Performance improvements in child process spawning and crypto operations benefit common use cases.
Changelog entry
- Deps: update V8 to 15.2 Pull request #65161
- Crypto: remove select Web Crypto warnings from algorithms moving toward unflagged browser implementation Pull request #66312
- Deps,lib,tools: remove jitless and lite modes due to required WebAssembly support for fetch() and TypeScript Pull request #66459
- Async_hooks: remove legacy AsyncLocalStorage implementation and --no-async-context-frame flag Pull request #63641
- Ffi: accept safe integer numbers for 64-bit arguments alongside bigint values Pull request #66197
- Sqlite: restore connection state on reopen Pull request #66042
- Child_process: 20-24% faster spawn/spawnSync when no custom env provided Pull request #65325
- Crypto: improve random synchronous number generation performance Pull request #66348
- Fs: stop recursive mkdir from retrying ENOENT forever Pull request #66340
- Ffi: do not abort when a Worker stops in a callback Pull request #66389
- Deps: update timezone to 2026e Pull request #66419
- Test: do not hardcode V8 serialization header to avoid breaking on V8 updates Pull request #66442
Node.js this week: V8 15.2, Web Crypto warnings removed, jitless mode dropped, AsyncLocalStorage simplified, FFI safe integers, faster spawn(), and multiple correctness fixes.
Node.js updates: V8 15.2 integrated, Web Crypto ExperimentalWarnings removed as APIs near unflagged browser implementations, jitless and lite modes removed, AsyncLocalStorage simplified, FFI now accepts safe integers for 64-bit args, spawn/spawnSync 20-24% faster, SQLite connection state restored on reopen, and fixes for Workers in FFI callbacks, recursive mkdir hanging, and more.
Week of September 21, 2026
What shipped
- Process timeouts can now be enforced with --process-timeout=N, providing a portable way to limit Node.js process execution time across different operating systems. Pull request #66138
- Worker process timeouts no longer hang waiting for unresponsive workers; the report now skips workers that do not respond within the timeout. Pull request #66304
- File watching with --watch now correctly detects and restarts when watched files are replaced via unlink+create or atomic saves. Pull request #63888
- SQLite classes were renamed from DatabaseSync to Database and StatementSync to Statement, with old names kept as deprecated aliases. Pull request #65988
- MonitorEventLoopDelay() now accepts options to tune histogram parameters. Pull request #66115
- AddAbortListener() now correctly passes the abort event to listeners when called on already-aborted signals. Pull request #65640
- Querystring.parse() and unescape operations are faster by skipping unnecessary processing for inputs without encoded characters. Pull request #66175
- Brotli compression reset() now preserves quality parameters and dictionary instead of resetting to defaults. Pull request #66157
- Socket(fd) now properly enforces the --allow-net permission when used with --permission. Pull request #66117
- Web Worker module entries now have TypeScript types stripped, allowing type annotations in entry files. Pull request #66085
Why it matters
This week brings improvements to process lifecycle management, file watching reliability, performance optimizations in HTTP and querystring, and fixes for permission enforcement and TypeScript support in workers. The addition of portable process timeouts addresses a common operational need across platforms.
Changelog entry
- Src: add --process-timeout=N for portable process execution time limits Pull request #66138
- Report: skip unresponsive workers on process timeout Pull request #66304
- Watch: detect files replaced via unlink and create Pull request #63888
- Sqlite: rename DatabaseSync to Database and StatementSync to Statement (old names deprecated) Pull request #65988
- Perf_hooks: add options to monitorEventLoopDelay() Pull request #66115
- Events: fix addAbortListener for aborted signals Pull request #65640
- Querystring: speed up default parse and unescape Pull request #66175
- Zlib: preserve brotli params and dictionary on reset Pull request #66157
- Src: ensure Socket(fd) cannot bypass allow-net permission Pull request #66117
- Worker: strip types in Web Worker module entries Pull request #66085
Node.js now supports --process-timeout=N for portable process time limits, fixes file watching on atomic saves, speeds up querystring parsing, and properly enforces net permissions with Socket(fd).
Node.js improvements this week include portable process timeouts (--process-timeout=N), fixes for file watching with atomic saves and unlink+create patterns, faster querystring parsing by skipping unnecessary processing, SQLite API simplification with deprecation aliases, and proper permission enforcement for Socket file descriptors. Web Workers now strip TypeScript types from entry files, and monitorEventLoopDelay accepts tuning options.