Tessera
Folgen

Richard Lau

@rwklau.bsky.social

Software Engineer at IBM. Node.js Build Infrastructure, Releaser & Technical Steering Committee.

37 Posts392 Follower30 Folgt
A
Antoine du Hamel@aduh95.bsky.social · 1h ago

📣 New Node.js release 📣 Node.js 26.7.0 is out with Perfetto tracing support, STORE loaders for private keys, and `module.register()` hooks are now disposable, plus many patches. Full changelog and download links available at nodejs.org/en/blog/rele...

Node.js — Node.js 26.7.0 (Current)

Node.js® is a free, open-source, cross-platform JavaScript runtime environment that lets developers create servers, web apps, command line tools and scripts.

nodejs.org

Richard Lau@rwklau.bsky.social · 2d ago

Back at work after a week off to help look after some young relatives. - Inbox 1, 116 unread emails. - Inbox 2, 336 unread emails. - Over 1000 GitHub notifications, which appears to break the notifications counter.

Unread notification display won't display over 1,000 · community · Discussion #139148

Select Topic Area Bug Body The number gets generated as "1" not showing the true count. If I mark some as read, anything under 1,000 works fine Firefox 130

github.com

Joyee Cheung@joyeecheung.bsky.social · 4w ago

Anyone using --use-largepages in real-world deployments? Just opened an issue about possibly deprecating it (if nobody is using it) to reduce the maintenance churn github.com/nodejs/node/...

Future of `--use-largepages=on` · Issue #64408 · nodejs/node

This was added back in 2018, some background can be found in this issue #16198 - from what I can tell we opted into a user-land relocation to work around the fact that for most kernels in the wild,...

github.com

npm@npmjs.com · 4w ago

npm v12 is now generally available. npm install now makes install scripts, Git, and remote-URL dependencies opt-in by default. We're also retiring npm 2FA-bypass GAT: no account management (early Aug 2026), no direct publishing (~Jan 2027). More info at github.blog/changelog/20...

npm install-time security and GAT bypass2fa deprecation - GitHub Changelog

npm v12 is now generally available and tagged latest. This major release turns on the install-time security defaults we announced in June, and it’s also where we begin a deprecation…

github.blog

Joyee Cheung@joyeecheung.bsky.social · 4w ago

Made the new debug helper plugins work for Node.js + bleeding edge V8 🌟 Verified it works in LLDB (Linux, macOS) & GDB (Linux), both in live and coredump debugging Going to backport the patches to Node.js when the object inspection is more polished and it stablizes bit more..

Using the plugin, bt in gdb shows the JS source info of JIT-compiled frames, mostly from the CJS loader (without plugin gdb only shows ???)In the plugin's `v8 inspect` command, it shows the this argument of the first frame is a function named "Module" (the CJS loader class i.e. require('module').Module)
Ruy Adorno@ruyadorno.com · 4w ago

I noticed npm is finally pushing out some of the breaking changes that I wanted to push 5 years ago, so I decided to write something about it, mostly to report and raise awareness that these changes are coming 😊 www.vlt.io/blog/npm-12-...

Beyond disabling postinstalls: how npm install will change in npm 12 | vlt /vōlt/

As part of its planned 12th release, the npm CLI drops automatically running lifecycle scripts on installs as part of multiple planned breaking changes

vlt.io

Joyee Cheung@joyeecheung.bsky.social · 4w ago

Landed a few improvements to the error reporting for require(esm) with top-level await (behind --experimental-print-required-tla for now): - No longer need to run the code to collect the TLA locations, so it can be enabled by default soon - Added require stack and location metadata to the error

Before: extra noisy arrow pointing to internals, no require stack, needs to run the code to find the top-level await location After: no more noisy arrows, added require stacks to the output, finds location without running the codeNew ERR_REQUIRE_ASYNC_MODULE includes error.requireStack and error.topLevelAwaitLocations metadata properties
A
Antoine du Hamel@aduh95.bsky.social · last mo.

Node.js 26.4.0 is out with a new `node:vfs` built-in module (behind `--experimental-vfs` flag). It also adds support for package maps, and many bug fixes, including a fix for a regression shipped with last week security release. Full changelog and download links at nodejs.org/en/blog/rele...

Node.js — Node.js 26.4.0 (Current)

Node.js® is a free, open-source, cross-platform JavaScript runtime environment that lets developers create servers, web apps, command line tools and scripts.

nodejs.org

Matteo Collina@nodeland.dev · 5mo ago

npm install @platformatic/vfs When node:vfs ships in core, migrating is a one-line import change. Full blog post with all the details, code examples, and the story behind the PR: blog.platformatic.dev/why-nodejs-n...

Ulises Gascón@ulisesgascon.com · 2mo ago

🔐 A thing many people miss: Node.js trusts the code you install by default. So blocking npm install scripts closes one door and leaves another wide open, the one that opens when you require() the package. nodesource.com/blog/npm-v12...

Blocking Install Scripts Is Not a Silver Bullet

npm v12 blocks install scripts by default, but supply chain attacks won't disappear. Learn why runtime execution, the Node.js permission model, and sandboxing still matter.

nodesource.com

Matteo Collina@nodeland.dev · 2mo ago

🔒 Security release for undici (the HTTP client powering Node.js fetch). We've shipped fixes for 8 advisories across all supported lines. Please upgrade: • v8 → 8.5.0 • v7 → 7.28.0 • v6 → 6.27.0 npm i undici@latest Details 🧵👇