~nodeweekly | Bookmarks (8)

The April 10 Node.js Security Releases — Another week, another set of security releases, made up of v18.20.2 (LTS), v20.12.2 (LTS), and v21.7.3 (Current). The main issue relates to a command injection vulnerability on Windows.

A Trip Report from the Latest Node.js Collaboration Summit — Twice a year, Node's collaborators and community members meet at collaboration summits to share knowledge, discuss problems, and flesh out new ideas. The last one took place in London earlier this month and featured discussion on Node’s HTTP stack, a new node --run feature, ES modules support, package management, and more. A good update!

The April 3 Node.js Security Releases — Includes v18.20.1 (LTS), v20.12.1 (LTS) and v21.7.2 (Current), each rolling out fixes to llhttp and Undici to tackle two HTTP related vulnerabilities.

Diving into the Node.js Website Redesign — Yes, Node’s official homepage has an all new, clean, modern design. We like it! Front end engineer Brian Muenzenmeyer gives us a bit of a peek into what went into the rebuild, which has been a long time in the making.

Node v21.7.0 (Current) Released — Sometimes minor Node versions have little beyond bug fixes, but other times you get some new features, and 21.7 doesn’t disappoint. Node gains a new util.styleText() function for formatting text (including with color!), new functions to work with .env files, multi-line value support for .env files, a crypto.hash() function to more quickly compute digests in one shot (example), and more.

💕 The Node.js Valentine's Day Security Releases — Security releases had been expected to land some time in the past two weeks and they finally landed as a Valentine's Day present in the shape of v21.6.2 (Current), v20.11.1 (LTS), and v18.19.1 (LTS). They include fixes for a variety of vulnerabilities, including a few high severity ones in areas like HTTP-based DoS attacks and privilege escalation.

Node v21.6.0 (Current) Released — Includes improvements to the experimental permissions model, the ability to configure snapshots via a JSON config file, and three new events available in the net.createConnection flow.

Node v20.11.0 (LTS) Released — Meanwhile ‘the version of Node you should probably be using’ receives a variety of tweaks, with perhaps the most notable being the addition of import.meta.dirname and import.meta.filename which fulfil the same role as __dirname and __filename, but for our new, shiny ES module-based world.