← All reportsPublic report

nodejs/node

Node.js JavaScript runtime ✨🐢🚀✨

120k stars JavaScript View on GitHubprofiled 11d ago
Try GitZoid
400PRs this week
118Contributors
0Deps scanned
0Issues found
01 · Repo overview

How node is put together

This is the Node.js monorepo: a cross-platform JavaScript runtime built around the V8 engine, with core runtime code in C++ and JavaScript and a large set of vendored dependencies under deps/ (llhttp, nghttp2, ngtcp2, c-ares, brotli, ICU, undici, npm, corepack, amaro, ada, ncrypto, libffi, googletest, LIEF). The build system is driven by a Python configure script (configure.py) that generates GYP/GN projects (BUILD.gn, common.gypi) across many OS/arch targets including Android cross-compilation. A Rust component (deps/crates, temporal_rs + ICU crates) provides Temporal/date functionality compiled as a static library. Data flow is: source + vendored deps -> configure.py -> GYP/GN -> native binary bundling JS builtins (undici, amaro) into the executable.

Languages

C++JavaScriptPythonRustC

Frameworks

V8llhttpnghttp2ngtcp2/nghttp3c-aresbrotliICUundicinpmcorepackamarogoogletestLIEFlibffiinspector_protocol

Infrastructure

GYP/GN build system (BUILD.gn, common.gypi)Android NDK cross-compilation (android_configure.py)PGO/LTO/thin-LTO build optionsFIPS-capable OpenSSL configuration flagsGitHub-based release/distribution with GPG-signed SHASUMS256.txt.asc

Major components

Build configuration (configure.py / android_configure.py)

Parses build options (arch, OS, intl mode, OpenSSL/FIPS, LTO/PGO), sets up toolchains, and invokes GYP to generate platform builds including Android cross-compilation.

Vendored native dependencies (deps/*)

Bundled third-party libraries (V8 patches, llhttp, nghttp2, ngtcp2, c-ares, brotli, ada, ncrypto, nbytes, merve, libffi, histogram, googletest, LIEF) each integrated via .gyp/.gni/BUILD.gn files.

Rust crates layer (deps/crates)

Compiles temporal_rs and ICU locale/calendar crates via diplomat into a staticlib (node_crates) used for Temporal support.

Bundled JS tooling: npm (deps/npm)

Ships the npm CLI inside Node.js; index.js dispatches to lib/cli.js when run as main.

Corepack (deps/corepack)

Package-manager shim/proxy that provides yarn/pnpm/npm binaries and bundles them via esbuild.

Amaro (deps/amaro)

TypeScript type-stripping wrapper enabling native TypeScript execution in Node.js.

minimatch (deps/minimatch)

Vendored glob-matching library (with brace-expansion/balanced-match) bundled into the runtime.

Project governance & security docs

README/SECURITY.md/GOVERNANCE.md define TSC membership, release signing keys, LTS policy, and vulnerability reporting process.

Over the past five weeks the Node.js project shipped two new releases (v26.6.0 and v24.19.0 'Krypton'), added Web Workers support, and landed a steady stream of performance work across streams, URLs, permissions, and SQLite. Reliability was a major theme too, with fixes for crashes in buffers, TLS, and file paths, plus a big cleanup of the ZIP archiving code. The week of August 17 was by far the busiest with 127 commits, including a new read-only compile cache mode and faster URL parsing.

Week by week

2026-08-24A quieter week focused on crash fixes and small speedups across streams, files, and networking.latest6 changes

Fix

Buffer crash fix

Fixed a program abort that could happen when searching a buffer for text containing certain unusual characters.

Refactor

Faster recursive directory listing

Reading folders recursively no longer checks every single entry's metadata, making it noticeably quicker.

Fix

TLS safety fix

Invalid connection-negotiation settings now produce a clear error instead of crashing the process.

Chore

Updated root certificates

The built-in list of trusted certificate authorities was refreshed to the latest NSS 3.126 set.

Refactor

Faster HTTP responses

HTTP responses with a known size now finish more efficiently, improving throughput for common requests.

Fix

Windows path fix

Resolved real paths correctly for special Windows drive-style paths like \\?\C:\.

2026-08-17The busiest week of the period (127 commits) brought a read-only compile cache mode, faster URL parsing, and broad reliability cleanups.6 changes

Feature

Read-only compile cache

JavaScript compilation results can now be cached without writing to disk, useful for locked-down or shared environments.

Refactor

Faster URL handling

Both web address parsing and query-string handling got significant speed improvements.

Feature

New terminal modes

Terminals gained new raw input/output modes giving programs finer control over keyboard and screen behavior.

Fix

File globbing fix

Fixed a bug where pattern-matched file searches could skip some matching files when exiting early.

Refactor

Removed old WebSocket flag

The command-line switch to disable WebSockets was removed since the feature is now standard.

Docs

Added AGENTS.md

A top-level guide was added describing how automated coding agents should contribute to the project.

2026-08-10Work centered on stream and SQLite improvements, plus hardening of the FFI add-on against bad inputs.6 changes

Feature

SQLite diagnostics and stats

SQLite databases gained a diagnostics channel and prepared statements now expose usage statistics.

Refactor

Faster UTF-8 decoding

Text decoding now uses an optimized library routine, speeding up string conversion from bytes.

Fix

FFI input validation

The foreign-function interface now rejects detached memory buffers instead of misbehaving on them.

Refactor

Faster async stream iteration

Looping over readable streams asynchronously got a performance boost.

Fix

Crypto accuracy improvement

SubtleCrypto.supports() now reports algorithm support more accurately.

Chore

Dependency updates

Bundled libraries like libuv and perfetto were updated to newer versions.

2026-08-03A large week dominated by permission-system optimization and a thorough security cleanup of ZIP archive handling.6 changes

Refactor

Faster permission checks

The internal permission system was reworked with caching and leaner data structures so security checks run faster.

Fix

ZIP archive hardening

ZIP reading now rejects mismatched headers and no longer hangs when asked to archive special files like pipes.

Feature

RSA-OAEP hash option

Encryption now supports specifying a separate mgf1Hash parameter for RSA-OAEP operations.

Refactor

Leaner streams

Web streams cut down on unnecessary promise creation in their hottest code paths.

Fix

SQLite input validation

Preparing empty or statement-less SQL now returns a proper error instead of failing silently.

Fix

Single-executable fixes

Self-contained executables no longer risk dangling option pointers or mishandle NUL characters in asset names.

2026-07-27Web Workers support landed alongside two new releases: v26.6.0 (Current) and v24.19.0 'Krypton' (LTS).6 changes

Feature

Web Workers support

Node.js added support for browser-standard Web Workers, letting JavaScript run tasks in background threads.

Chore

Version 26.6.0 released

The Current release line published version 26.6.0 on August 3.

Chore

Version 24.19.0 'Krypton' released

The Long-Term Support line published version 24.19.0, codenamed Krypton.

Refactor

Simplified TLS parsing

A hand-written TLS client-hello parser was replaced with a more maintainable approach.

Chore

npm upgraded

The bundled npm package manager was updated to version 11.19.0.

Chore

FIPS testing added

Continuous integration now includes builds tested against OpenSSL's FIPS compliance mode.

03 · Security check

Dependencies and code review

0 dependencies scanned

Dependency advisories

Security Watch

No known advisories across 0 scanned dependencies.

No known advisories in the scanned dependencies.

Code review

No concrete code-level issues confirmed.

Get this report every week for your repos.

GitZoid learns each repo, reports what changed, and flags what needs attention. One flat price for the whole team.

$19 a month, flat · First 10 outputs free · No card required