Subscribe free
Morning Merge · Thursday, October 29, 20265 min read

Node 26 goes LTS, plus a Wasmtime sandbox escape

Lithium is supported to April 2029. Also: Gemini 4 Carbon, GitHub's agents and Mac certs.

The main thing

An orange engine block rests unchanged inside a substantial uncoloured maintenance cradle, drawn as an isometric engineering blueprint.

Your next Node upgrade target now has an end date. If you only run LTS lines, Node.js 26 is one of them as of today, and it gets updates until the end of April 2029.

Node.js 26.13.0 moves the 26.x line into Long Term Support under the codename 'Lithium'. It may be the dullest release you install this year. Apart from metadata like process.release now reporting LTS, it has nothing that 26.12.1 did not already ship. The changelog would fit on a sticky note with room left for a grocery list.

If 26.12.1 already passes your CI, this release changes nothing in your code. The real work falls on teams coming from Node 24 or 22.

Those teams have one catch to check. Since Node 25, the official Linux binaries link against libatomic, and on some distributions you have to install it separately. Check this on the images you build and deploy with, not only on your laptop.

These release notes say nothing about compatibility changes between 24 and 26. Read the 25 and 26 changelogs before you plan the jump.

What to do today: If you are on 26.x, move to 26.13.0 when it suits you. If you are on 24 or 22, add a Node 26 job to CI and make sure libatomic is present on your Linux build and runtime images.

Quick bits

Google announced Gemini 4 Carbon, which it says scores 59 and ranks #1 on the Artificial Analysis Intelligence Index v5.0. The discussion notes that AA had not updated yet. Some cyber defenders get access first. Developers wait, and the price will be $2/$10 per million input/output tokens.

GitHub Agentic Workflows is generally available. You write automations in Markdown, they compile to standard Actions YAML, and Copilot or your own agent runs them in a sandboxed container with read-only permissions by default. The default Copilot CLI engine needs a Copilot license.

Terminal tools on your Mac may still trust the compromised eMudhra CAs. Apple blocks them in Safari and its frameworks. But curl, git, python3 and similar tools check /etc/ssl/cert.pem and will keep trusting them until a future macOS update. Admins can remove emSign ECC Root CA - G3 and AAA Certificate Services from that file now (discussion).

Copilot Fusion is generally available. You pick Standard, High or Max effort and Copilot routes each prompt across models. You pay each model's standard rate, with 30% off on paid plans for a limited time. Local-model routing is experimental.

Cursor's Agent SDK is generally available. Prompts are Markdown, tools are TypeScript functions, and evals come built in. agent-sdk deploy runs your agent on Cursor, or you can run it as a single Node process on your own machines. The discussion points out that OpenAI and Anthropic already have products called Agent SDK. Naming things remains hard.

Next.js 16.4 adds a /next-bundle-optimizer agent skill. It reads Turbopack's module graph to find code that loads before it is needed. Vercel says it cut nearly two megabytes of compressed JavaScript across v0 and vercel.com. It requires Turbopack.

Vercel CI is in beta for Turborepo. Tag a task ci and it runs on every push, but only where your changes reach, with Remote Cache. The "2-6x shorter wait" comes from Vercel's own repos.

Chrome opened an origin trial for the Email Verification API. A user signed in to Gmail can prove they own an address with a signed token instead of a code email. It is still an experimental WICG proposal. From Chrome 156 it returns the email exactly as submitted, so testers should watch for changes like that one.

Also happening

Patch roundup

Install the boring Node release first. It is the only thing today that won't argue back.

← All issues

Get this in your inbox every morning.

Free. Five minutes. Unsubscribe in one click.

Subscribe free →