LH034 interim checkpoint, 30 October 2026: measures 1, 2 and 4 to day 7
Interim, unreviewed. The brief allows an interim checkpoint after the read of 29 or 30 October, reporting measures 1, 2 and 4 to the last completed published day. Here that is day 7 (28 October), from reads read-2026-10-27T1811Z, read-2026-10-29T0635Z and read-2026-10-30T0635Z; each day's value is from the earliest read holding it. Days 0 to 7 are re-read once at the read holding day 30, as the brief requires. Written by the scheduled daily run of 30 October.
Measure 1: share of each fixed line's nodejs.org downloads at or above the fixed release (requests in a day)
| Line | Day 0 | Day 1 | Day 2 | Day 3 | Day 4 | Day 5 | Day 6 | Day 7 | First day at half |
|---|---|---|---|---|---|---|---|---|---|
| 22 | 16.0% | 41.0% | 51.7% | 48.1% | 49.3% | 52.7% | 53.3% | 53.9% | 2 |
| 24 | 14.0% | 45.8% | 72.4% | 71.4% | 71.3% | 69.3% | 70.9% | 72.2% | 2 |
| 26 | 18.1% | 45.4% | 79.7% | 76.9% | 77.3% | 61.5% | 76.4% | 64.7% | 2 |
Day 0 is a part day (binaries posted about 10:32 to 10:36). Days 3 and 4 were a weekend, at about half the weekday volume. Two later releases, v24.22.2 (27 October) and v26.13.0 (28 October), neither flagged security, count as at or above the fix under the brief's rule. Line 22's share sat near half on days 2 to 4 and rose from 49.3 per cent on day 4 to 53.9 on day 7; line 26's, the smallest line, moved by more than ten points on some days.
Measure 2: the unfixed tail
Lines the release does not fix took 11.8 to 16.5 per cent of version-attributed downloads each day from 14 to 28 October: 14.3 per cent on day 0, 11.8 on day 2 and 14.7 on day 7. Line 20 (end of life) took 5.2 to 8.5 per cent, and line 25 (end of life) 0.7 to 1.1 per cent. Requests with no version were at most 0.01 per cent of total.
Measure 4: the July security release, same instrument
Day 0 is 28 July by the brief's rule (the date dist/index.json gives v26.5.1). The /dist/ listings show the July files posted on 29 July, so July's day 1 is its posting day, where October's day 0 is; this offset was not known when the rule was fixed.
| Line | July day 1 | July day 2 | July day 7 | July first day at half | October day 1 | October day 2 | October day 7 |
|---|---|---|---|---|---|---|---|
| 22 | 13.6% | 30.7% | 31.1% | 18 | 41.0% | 51.7% | 53.9% |
| 24 | 4.3% | 15.1% | 29.4% | 4 | 45.8% | 72.4% | 72.2% |
| 26 | 41.6% | 69.9% | 89.0% | 2 | 45.4% | 79.7% | 64.7% |
Aligned by posting instead (a reading made after the offset was seen, not the brief's rule), July's days 2, 3 and 8 stand against October's days 1, 2 and 7: line 22 30.7, 31.9 and 31.0 per cent; line 24 15.1, 46.0 and 26.8; line 26 69.9, 89.1 and 89.4. On either alignment, lines 22 and 24 were higher in October's first week than in July's, and line 26 lower by day 7.
Beside the comparators (named in the brief)
| Day | Node.js lines 22 to 26 (downloads, nodejs.org) | Four Python security fixes (downloads, PyPI; same unit, different index) | Median of 37 Python projects | PHP 8.2 to 8.5, Censys patched share (services; different unit) |
|---|---|---|---|---|
| 1 | 41.0 to 45.8% | 53.8 to 60.8% | 57.6% | 22.1 to 36.1% |
| 2 | 51.7 to 79.7% | 52.7 to 63.7% | 57.2% | 41.2 to 70.5% |
| 7 | 53.9 to 72.2% | 55.6 to 59.5% | 57.9% | 52.4 to 78.8% |
As descriptions only: on day 1 the three Node lines were below all four Python fixes and above all four PHP branches; on day 2 lines 24 and 26 were above the Python range and line 22 just below it (51.7 against 52.7); on day 7 line 22 was below the Python range and lines 24 and 26 above it. A download is a request, not a machine, and nodejs.org is one channel of several; a Censys share is a stock of services as last scanned. No statement here says which ecosystem is faster or safer, or why.
From studies/LH034/checkpoints/interim-2026-10-30.md in the repository, last changed 30 October 2026.