☕ Something's brewing for @nodejs.org releases starting with 27.x. Official announcement coming soon! 👀 Sneak peek: github.com/nodejs/nodej...

After implementing web streams in multiple runtimes, supporting them for years, talking with other implementers, dealing with issues... I think it's well past time we talked about something better blog.cloudflare.com/a-better-web...

Node.js release day! @ruyadorno.com and I just released Node.js 24.14.0 and 25.7.0, full changelog and download links at nodejs.org/en/blog/rele... and nodejs.org/en/blog/rele...

🎉 We’re thrilled to welcome @socket.dev as our newest Silver member. Socket is doing critical work to secure the JavaScript ecosystem by helping developers identify and prevent supply chain risks. We're excited to collaborate and make open source safer for everyone! 🛡️💻 openjsf.org/blog/socket-...

✨ Keep up to date with @nodejs.org by watching the #Nodejs #Release Working Group's last meeting on YouTube! www.youtube.com/watch?v=ulMh...

I just published the January report for open source software packages for Linux on #IBMZ and #LinuxONE 🐧 The team tested nearly two dozen projects, including doxygen, Elastic Logstash, and PHP 🥳 Full report: community.ibm.com/community/us... #mainframe

Node.js patch release day! Full changelog and download links at nodejs.org/en/blog/rele... and nodejs.org/en/blog/rele...

Want to make an impact? Join the OpenJS Foundation. Fund the projects you rely on. Contribute engineer time where it matters.

It took a while, but the State of JS 2025 survey results are now live! 2025.stateofjs.com/en-US Thanks to @danielroe.dev for contributing the conclusion.

We released version 1.2 of our GitHub Actions service for IBM Z and Power 🎉 including improvements to Python support, so you can now use the IBM fork (until it's accepted upstream) of python-versions to specify versions: community.ibm.com/community/us...

I think I figured out what's going on. Here is another blog post about tinkering with Node.js Core on ARM64 Windows (and tips about reducing the wait time on Windows) joyeecheung.github.io/blog/2026/01...

nvm.sh users: please upgrade to github.com/nvm-sh/nvm/r... if you're using `wget` on your system, to fix a medium vulnerability (github.com/nvm-sh/nvm/s...).

🚨 Node.js assessment of the recent OpenSSL Security Release TL;DR: We'll update OpenSSL versions through a regular release process. nodejs.org/en/blog/vuln...

I love how the answer to the title of this article is "they don't" "Why Costco Still Relies On IBM Computers From The '80s" www.bgr.com/2079471/why-... The new Power 11 servers are so shiny ✨ I was able to meet my first one at IBM TechXchange 2025 back in October. (I work on IBM Z, not Power)

⚠️ The Node.js Project now requires a HackerOne Signal score of 1.0 or higher to submit vulnerability reports. This will help our team streamline reports and support effective security reviews. nodejs.org/en/blog/anno...

How did we do at the end of 2025 as far as testing our current collection of open source software packages for Linux on #IBMZ and #LinuxONE? It was a strong finish! The team worked on over two dozen packages, including cAdvisor, PostgreSQL, and SPIRE. Full report: community.ibm.com/community/us...

State of WebAssembly (Wasm) - recap events of 2025 and preview what 2026 can bring. platform.uno/blog/the-sta...

This release contains a bunch of PRs I recently submitted to mark features I contributed to as stable/release candidate. Here is a thread about them 🧵:

Node.js v25.4.0 is out! 💚 • require(esm) now stable and a new CLI flag: --require-module • http setGlobalProxyFromEnv() added • Multiple APIs promoted to stable (heapsnapshot, build snapshot, v8.queryObjects) • Root CAs updated to NSS 3.117 More in: nodejs.org/en/blog/rele...

Today the Temporal proposal has entered the stable stream shipping Chrome 144. This opens the gates for attaining Stage 4 at TC39. That means tonight I will be purchasing a supply of champagne in preparation. It’s been a long journey and so very worthwhile!

Today, we published a security release for @nodejs.org that fixes a critical bug affecting virtually every production Node.js app. If you use React Server Components, Next.js, or ANY APM tool (Datadog, New Relic, OpenTelemetry), your app could be vulnerable to DoS attacks. 👇

We appreciate your patience and understanding as we work to deliver a secure and reliable release. Updates are now available for the 25.x, 24.x, 22.x, 20.x Node.js release lines to address: - 3 high severity issues - 4 medium severity issues - 1 low severity issue nodejs.org/en/blog/vuln...

🚨Our team has decided to postpone the release to Tuesday, January 13th, 2026. This additional time will allow us to properly test all backports and re-run CITGM to ensure the highest quality for our users.

The Node.js package configuration guide is now live! 🎉 Whether you're creating your first package or migrating to ESM, this guide walks you through it with examples. https://nodejs.github.io/package-examples

npm is planning to implement staged publishing, adding a review step before packages go live. It follows a year of supply chain attacks & a rocky shift away from classic tokens over the past month that left many maintainers struggling. socket.dev/blog/npm-to-... #NodeJS cc: @campuscodi.risky.biz

When the reproducibility of a serialized object breaks and 1. It doesn’t show up in debug builds 2. There is no obvious pattern in how the bits change Then that might be an uninitialised padding (Spent a couple of hours trying to fix this again…after I forgot how I fixed something similar before)

Here we are, the last report of the year from the #Linux on #IBMZ and #LinuxONE porting team and beyond 🚀 The list for November has nearly three dozen projects tested, including Apache Cassandra, fluentd, and neo4j + GnuCOBOL on our GitHub Actions for s390x 🧑‍💻 community.ibm.com/community/us...

⚠️ Node.js security release has been postponed ⚠️ We have decided to delay the security release further to January 7th 2026 to ensure the team has enough time to prepare the releases and avoid distruptions during the holiday season. nodejs.org/en/blog/vuln...

⚠️ The security release has been postponed to the 18th of December. The team is working on a challenging patch.

In the end, it would be best if NPM just blocked TOTP reuse. TOTP stands for “Time-based One-Time Password,” after all. The “one-time” property is important enough to account for 50% of the acronym. 🙂 Even the spec explicitly calls for blocking reuse: datatracker.ietf.org/doc/html/rfc... 6/6

Devonte' Hawkins and I published a blog post all about the giant IBM Telum II that was professionally designed, you can read the full post here: community.ibm.com/community/us... But at the end there's a surprise: the instructions and parts list for building your own little dual-chip module! Enjoy!

npm has revoked classic tokens for publishing, pushing maintainers toward OIDC trusted publishing or granular tokens. But @openjsf.org warns trusted publishing still has risky gaps for critical projects. What maintainers should do next: socket.dev/blog/npm-rev... #NodeJS #JavaScript

Working in an enterprise setup with corporate proxies or custom CAs? Node.js has native support for that. No external dependency required, just configure and continue 👍 Details: https://nodejs.org/en/learn/http/enterprise-network-configuration

🧨 “Gaps in design and implementation with the new OIDC Trusted Publisher workflows leave maintainers open to novel and increasingly difficult to detect gaps in their publishing setups. We do not recommend critical projects move to this new workflow..." - @notwes.bsky.social

ECMAScript excitement 😉 A highly comprehensive article on what will (and might!) land in ES2026 by @marypcbuk.bsky.social 🎉 Includes coverage on Temporal by Boa creator @jason-williams.co.uk who leads the Rust-based temporal_rs library, as used by Google's V8 engine, amongst others.

❗️Node.js Security release pre-alert ❗️ We will release new versions of v20, v22, v24, v25 release lines on or shortly after the 15th of December 2025 in order to address: * 3 high severity issues. * 1 low severity issue. * 1 medium severity issue. nodejs.org/en/blog/vuln...

🤔

This week has been one of the most enjoyable at work in a long time. It's amazing how having co-workers you can discuss work with helps you feel part of an actual team.

Congratulations to Stewart Addison, a top Q3 committer with the #EclipseAdoptium project! 🙌 Stewart’s exceptional efforts in infrastructure work and #Temurin builds continue to strengthen Adoptium’s impact across the open source ecosystem. Thank you for your contributions.

If you haven’t patched any libs you maintain, go do that immediately. This is “as bad as it gets”. We need everything moved past these vulnerable versions because they can *easily* be mistakenly in your apps.

Cloudflare was down for half an hour this morning, and it was caused by work we were doing to try to mitigate the React CVE. (Seriously, people: upgrade Next.js/React Router etc right now)

Shai-Hulud strieks back? The following is a curated, practical, security‑focused npm package manager hardening list of recommended practices for secure local development and open source software maintainers' processes: snyk.io/articles/npm... Keep this open next to your terminal

Node.js v20.19.6 is out 🥳 Release notes: nodejs.org/en/blog/rele...

✍️ Open source doesn’t fail because of code. It fails because of governance gaps, burnout, and invisible work. I wrote down what I learned working on #Expressjs and #Lodash blog.ulisesgascon.com/open-source-...

ok so... I'm writing a book. It's called JavaScript In Depth (www.manning.com/books/javasc...) ... the first four chapters are available by Manning. This has been a difficult project and will continue to be so. The reason is that it isn't a How To book that focuses only on how to use the langauge

The second paragraph here is slightly misleading. There's no link between moving on from the Raspberry Pis (Build Working Group) to the release automation (Release Working Group) -- they happened independently of each other.

The #s390x open source software team at IBM confirms the latest versions of various software packages run well on #Linux on #IBMZ & #LinuxONE 🐧 In October 2025 validation was maintained for two dozen projects, including #ApacheActiveMQ #InfluxDB & #Rails 🎉 More: community.ibm.com/community/us...

In case you're curious... blog.cloudflare.com/18-november-...

I'm on a regular call with teams from Microsoft, Red Hat, Canonical and IBM regarding IBM Z & Power porting work for .NET so each release comes out smoothly. Last week .NET 10 went live! That's our 5th release with s390x support (4th for ppc64le) community.ibm.com/community/us...