2024-08-06, Version 22.6.0 (Current), @RafaelGSS Experimental TypeScript support via strip types Node.js introduces the --experimental-strip-types flag for initial TypeScript support. This feature strips type annotations from .ts files, allowing them to run without transforming TypeScript-specific syntax. Current limitations include: Supports only inline type annotations, not features like enums o

2024-07-08, Version 22.4.1 (Current), @RafaelGSS This is a security release. Notable Changes CVE-2024-36138 - Bypass incomplete fix of CVE-2024-27980 (High) CVE-2024-22020 - Bypass network import restriction via data URL (Medium) CVE-2024-22018 - fs.lstat bypasses permission model (Low) CVE-2024-36137 - fs.fchown/fchmod bypasses permission model (Low) CVE-2024-37372 - Permission model improperly p

Security releases available Updates are now available for the 22.x, 20.x, 18.x Node.js release lines for the following issues. Bypass incomplete fix of CVE-2024-27980 (CVE-2024-36138) - (High) The CVE-2024-27980 was identified as an incomplete fix for the BatBadBut vulnerability. This vulnerability arises from improper handling of batch files with all possible extensions on Windows via child_proce

2024-06-11, Version 22.3.0 (Current), @RafaelGSS Notable Changes [5a41bcf9ca] - (SEMVER-MINOR) src: traverse parent folders while running --run (Yagiz Nizipli) #53154 [1d5934524b] - (SEMVER-MINOR) buffer: add .bytes() method to Blob (Matthew Aitken) #53221 [75e5612fae] - (SEMVER-MINOR) src,permission: --allow-wasi & prevent WASI exec (Rafael Gonzaga) #53124 [b5c30e2f5e] - (SEMVER-MINOR) module: pr

2024-03-06, Version 21.7.0 (Current), @RafaelGSS prepared by @marco-ippolito Text Styling util.styleText(format, text): This function returns a formatted text considering the format passed. A new API has been created to format text based on util.inspect.colors, enabling you to style text in different colors (such as red, blue, ...) and emphasis (italic, bold, ...). const { styleText } = require('n

We're excited to announce the release of Node.js 21! Highlights include updates of the V8 JavaScript engine to 11.8, stable fetch and WebStreams, a new experimental flag to flip module defaults (--experimental-default-type), a built-in WebSocket client, many updates to our test runner, and more! Node.js 21 will replace Node.js 20 as our ‘Current’ release line when Node.js 20 enters long-term suppo

Notable changes built-in .env file support Starting from Node.js v20.6.0, Node.js supports .env files for configuring environment variables. Your configuration file should follow the INI file format, with each line containing a key-value pair for an environment variable. To initialize your Node.js application with predefined configurations, use the following CLI command: node --env-file=config.env

Notable Changes Ada 2.0 Node.js v18.17.0 comes with the latest version of the URL parser, Ada. This update brings significant performance improvements to URL parsing, including enhancements to the url.domainToASCII and url.domainToUnicode functions in node:url. Ada 2.0 has been integrated into the Node.js codebase, ensuring that all parts of the application can benefit from the improved performanc

Notable Changes Mock Timers The new feature allows developers to write more reliable and predictable tests for time-dependent functionality. It includes MockTimers with the ability to mock setTimeout, setInterval from globals, node:timers, and node:timers/promises. The feature provides a simple API to advance time, enable specific timers, and release all timers. import assert from 'node:assert'; i

(Update 20-June-2023) Security releases available Updates are now available for all supported Node.js release lines for the following issues. OpenSSL Security updates This security release includes the following OpenSSL security updates OpenSSL security advisory 28th March. OpenSSL security advisory 20th April. OpenSSL security advisory 30th May. Impacts: All versions of the 20.x, 18.x, and 16.x r

We're excited to announce the release of Node.js 20! Highlights include the new Node.js Permission Model,a synchronous import.meta.resolve, a stable test_runner, updates of the V8 JavaScript engine to 11.3, Ada to 2.0, and more! The project continues to make progress across a number of areas, with many new features and fixes flowing into existing LTS releases. For that reason, the changes outlined

(Update 16-February-2023) Security releases available Updates are now available for the v19.x, v18.x, v16.x, and v14.x Node.js release lines for the following issues. OpenSSL Security updates This security release includes OpenSSL security updates as outlined in the recent OpenSSL security advisory. Impacts: All versions of the 19.x, 18.x, 16.x, and 14.x release lines. Node.js Permissions policies

Notable changes Add support for externally shared js builtins By default Node.js is built so that all dependencies are bundled into the Node.js binary itself. Some Node.js distributions prefer to manage dependencies externally. There are existing build options that allow dependencies with native code to be externalized. This commit adds additional options so that dependencies with JavaScript code

const watcher = fs.watch(testDirectory, { recursive: true }); watcher.on('change', function (event, filename) {}); Contributed by Yagiz Nizipli in #45098 Other notable changes deps update ICU to 72.1 (Michaël Zasso) #45068 doc add lukekarrys to collaborators (Luke Karrys) #45180 add anonrig to collaborators (Yagiz Nizipli) #45002 lib drop fetch experimental warning (Matteo Collina) #45287 util (SE

Security Best Practices Intent This document intends to extend the current threat model and provide extensive guidelines on how to secure a Node.js application. Document Content Best practices: A simplified condensed way to see the best practices. We can use this issue or this guideline as the starting point. It is important to note that this document is specific to Node.js, if you are looking for