Node.js 26 Goes LTS, Motion 14.9, BullMQ 6.5.3 Fixes

Executive Summary

• Node.js 26.13.0 "Lithium" moves the 26.x line to Long Term Support with support through April 2029. It contains only metadata changes over 26.12.1. See the release page.
• Next.js announced (Oct 27) a scheduled security release for Tuesday, November 3 covering seven medium-severity vulnerabilities. Details: advance notice.
• Motion 14.9.0 makes Reorder keyboard accessible (changelog); BullMQ 6.5.3 fixes the node-redis client staying in an ended state after connect() (release).
• Still open if unpatched: the Oct 21 Node.js security releases (10 CVEs, four High, including a Brotli out-of-bounds write).

Node.js 26.13.0: The Release Line Becomes LTS

The v26.13.0 release is the LTS promotion for the 26.x line. The only differences from 26.12.1 are metadata, such as process.release now reporting LTS status. It lists no new features and no security fixes. Since Node.js 25, official Linux binaries link against libatomic, so teams coming from 24 or 22 may need to install it on minimal distributions.

Pinning to the LTS line in CI and containers:

# Pin to the 26 LTS line and make sure libatomic exists on slim images
FROM node:26-slim
RUN apt-get update && apt-get install -y --no-install-recommends libatomic1 && rm -rf /var/lib/apt/lists/*

# Or locally
nvm install 26 && node -p "process.release.lts"

Before switching, confirm you are at or above the Oct 21 fixes (26.12.1, 24.22.1, 22.23.4). That advisory (nodejs.org) covers CVE-2026-111497 (Brotli decoder out-of-bounds write, potentially RCE), CVE-2026-105482 (DNS names truncated at a NUL byte), and three High-severity IP-address validation flaws in TLS and URL handling. Images built before Oct 21 keep the old runtime until rebuilt on a fresh base pull.

Next.js: Plan for the November 3 Security Release

The advance notice says seven medium-severity vulnerabilities will be fixed on Tuesday, November 3, with full advisories published alongside. It follows the out-of-band update planned for Oct 14, which addressed two Critical and one High upstream vulnerabilities. The latest stable on npm is 16.4.3, and the 16.5.0 canary line is still moving (canary.34 landed Oct 30). Reserve a deploy window and check your lockfile now:

npm ls next react react-dom
npm view next dist-tags --json   # compare 'latest' on Nov 3

Motion 14.8.0 and 14.9.0

Per the changelog, 14.9.0 (Oct 30) improves Reorder keyboard accessibility: focus lands on the first item, arrow keys move focus, and direction follows the on-screen layout. 14.8.0 (Oct 29) adds a mixer option on transitions, fixes accelerated animations stuck at initial after remount, and shrinks drag by 20% and the m component by 6%.

import { Reorder } from "motion/react"

export function List({ items, setItems }) {
  return (
    <Reorder.Group axis="y" values={items} onReorder={setItems}>
      {items.map(item => (
        <Reorder.Item key={item} value={item}>{item}</Reorder.Item>
      ))}
    </Reorder.Group>
  )
}
// 14.9.0: no code change needed, keyboard navigation is built in

BullMQ 6.5.2 and 6.5.3

6.5.2 (Oct 30) formats exclusive time bounds in the relay without precision loss. 6.5.3 (Oct 31) clears the ended status when connect() reopens a node-redis client, which matters if your workers reconnect after a Redis restart. Both are drop-in patches.

Vue 3.6.0-rc.14

Vue published 3.6.0-rc.14 on Oct 30. The release page does not list changes and points to the minor branch CHANGELOG, so review that before testing the release candidate. Stable remains 3.5.44.

Also Seen, Not Verified

npm shows new Prisma 8.0.0-rc.29, Firebase 13.2.0 pre-release and Node 24.22.2 builds, but I could not find release notes for them, so they are not analyzed here. No new stable releases were found today for Nuxt, Svelte, Tailwind CSS, NestJS, Fastify, Hono, Drizzle, Better Auth or Supabase client packages.