Tessera

Joyee Cheung @joyeecheung.bsky.social · 7mo ago

We have increased the barrier to submit reports through HackerOne due to the amount of low-quality submissions we have received recently. Please, see: nodejs.org/en/blog/anno...

Node.js — New HackerOne Signal Requirement for Vulnerability Reports

Node.js® is a free, open-source, cross-platform JavaScript runtime environment that lets developers create servers, web apps, command line tools and scripts.

nodejs.org

This release contains a bunch of PRs I recently submitted to mark features I contributed to as stable/release candidate. Here is a thread about them 🧵:

Rafael Gonzaga | Node.js@rafaelgss.dev · 7mo ago

Node.js v25.4.0 is out! 💚 • require(esm) now stable and a new CLI flag: --require-module • http setGlobalProxyFromEnv() added • Multiple APIs promoted to stable (heapsnapshot, build snapshot, v8.queryObjects) • Root CAs updated to NSS 3.117 More in: nodejs.org/en/blog/rele...

nodejs.org

🚨Our team has decided to postpone the release to Tuesday, January 13th, 2026. This additional time will allow us to properly test all backports and re-run CITGM to ensure the highest quality for our users.

Node.js — Thursday, January 8, 2026 Security Releases

Node.js® is a free, open-source, cross-platform JavaScript runtime environment that lets developers create servers, web apps, command line tools and scripts.

nodejs.org

OpenJS Foundation @openjsf.org · 7mo ago

Node.s sec release We are doing our best. We are ensuring test passes on all platforms and all active release lines (v20, v22, v24 and v25) - and they aren't currently. Unfortunately, we don't have an ETA for that, and it's likely that this security release will be postponed one more time. Sorry.

Oh hi. 👋 We're back with the latest Security Snapshot that covers how to publish to npm safely and with ease. ✨ @rafaelgss.dev breaks down why local publishing with 2FA gives you the safest setup right now.

Rafael Gonzaga | Node.js @rafaelgss.dev · 8mo ago

New release of bench-node v0.14.0! Two important features were released: github.com/RafaelGSS/be...

Release v0.14.0 · RafaelGSS/bench-node

0.14.0 (2025-12-17) Features add dce detection plugin (#131) (2e2a6be) add t-test mode for statistical significance testing (#133) (53e20aa) Narrow the bar display by another couple of characters ...

github.com

Rafael Gonzaga | Node.js @rafaelgss.dev · 8mo ago

Right on time! Lovely @openjsf.org

OpenJS Foundation @openjsf.org · 8mo ago

Want to dive in further? Check out Rafael’s release of @nodejs.org 25: twitch.tv/videos/25925...

Releasing Node.js v25.0.0! - rafaelgss on Twitch

rafaelgss went live on Twitch. Catch up on their Software and Game Development VOD now.

twitch.tv

OpenJS Foundation @openjsf.org · 8mo ago

SEMVER MAJORS ARE BORING 🚨 Major releases mostly bring breaking changes, not shiny new features. The fun stuff? That’s hiding in the minors. @rafaelgss.dev talks about why you should follow the minor releases in our latest JavaScript Security Snapshot.

James Snell @jasnell.me · 9mo ago

I should get back to this platform. I’ve scrolled it for like 5 minutes and I found many interesting topics that I don’t see in one week of X.

ok so... I'm writing a book. It's called JavaScript In Depth (www.manning.com/books/javasc...) ... the first four chapters are available by Manning. This has been a difficult project and will continue to be so. The reason is that it isn't a How To book that focuses only on how to use the langauge

JavaScript in Depth - James M. Snell

Explore the inner workings of the world’s most popular programming language and enjoy the power and control that comes only from deep knowledge! In JavaScript in Depth, JavaScript and Node legend Jame...

manning.com

Before automated workflows, releasing @nodejs.org meant 20 manual steps. Now it’s one command. 👀 @ulisesgascon.com and @rafaelgss.dev share how the Node.js build team went from a rack of Raspberry Pis in someone’s garage to full release automation. 👉Build Team on GitHub: github.com/nodejs/build

Wes @notwes.bsky.social · 9mo ago

Live now!

It was great working with you on this! As much as I dislike that we had to do this work, I think it is important that we did it so there is a thorough and accurate resource about the current state of things.

With npm supply chain attacks on the rise, secure publishing practices are becoming a pressing concern for anyone maintaining npm packages. ⚠️ We've released updated guidance to help maintainers reduce exposure, strengthen release processes, and protect the ecosystem: openjsf.org/blog/publish...

Publishing More Securely on npm: Guidance from the OpenJS Security Collaboration Space | OpenJS Foundation

The OpenJS Security Collaboration Space has been working closely with GitHub’s npm team to understand how new security features affect projects and maintainers, especially as threats and tools keep ev...

openjsf.org

Wes@notwes.bsky.social · 9mo ago

Thanks for your hard work on this @notwes.bsky.social

After a few months of targeted attacks on our ecosystem, followed by a confusing and rapidly changing response from @github.com, we wanted to put together some guidance for maintainers on how to help us all secure our supply chain together. Here is that guidance 👇

Too many @nodejs.org users are running old versions 😬 The team is exploring changes to the release schedule to fix that. @rafaelgss.dev shares all the details in our latest JavaScript Security Snapshot. Be a part of the conversation on releases: github.com/nodejs/lts-s...

Ever wonder why @nodejs.org drops new versions like clockwork? Here’s the scoop. ⏱️ @rafaelgss.dev shares all the details about the Node.js release schedule in our new series, JavaScript Security Snapshot.