OpenJS Foundation✓

AI is finding open source bugs faster than people can fix them. Node.js fixed a record 50 vulnerabilities this year. The bots find them, but maintainers triage, patch, and coordinate disclosure. If your company runs on open source, fund the people keeping it secure.

Do all security vulnerabilities need to be fixed in private? With support from @SovereignTechFund, OpenJS is using @nodejs to test whether some vulnerabilities can be remediated faster in the open without increasing security risk. Read more:

🔄 Node.js is changing how it approaches major releases. Node.js 26 will be the final release under the project’s twice-yearly model. Starting with Node.js 27, new major versions will follow an annual release schedule, giving developers a more predictable lifecycle to plan around. But a clearer release schedule does not automatically move production applications forward. If your application is still tied to Node.js 12, 14, 16, 18, or 20, upgrading may require dependency updates, compatibility testing, and changes to application behavior. @TuxCare_ 's Endless Lifecycle Support provides ongoing CVE patches for these Node.js versions, so you can keep your application protected while working toward a supported release. Learn more:

A new major release from the WebdriverIO community: WebdriverIO v10. New agent workflows, improved tracing and debugging, Appium 3 support, WebDriver BiDi updates, and more. Built with contributions from 191 people across 1,725 PRs.

📣 ICYMI: The OpenJS Foundation CNA is taking a coordinated break through October 6 📣 Routine security operations are paused, but emergency support remains available for critical vulnerabilities and actively exploited issues. Details:

Finding vulnerabilities is only part of open source security. Maintainers still need resources to triage, patch, and ship secure releases. The new OpenJS Security Stewardship Program will fund researchers and maintainers, starting with Node.js.

RT @NodeRED: Registration for Node-RED Con 2026 is now open. The programme is set and it's a strong one. November 3rd, free and online. Don't miss it. #NodeRED #NRCon2026

RT @ljharb: v0.40.8 is out, fixing a path traversal vuln and a number of bugs - -

Last chance to share your feedback in the 2026 Node.js User Survey! If you use Node.js, take a few minutes to tell us about your experience, priorities, and what matters most to you. Take the survey: #NodeJS #OpenSource

RT @TuxCare_: ⚡ Still running an older Express version? Express 3 and earlier are EOL, Express 4 is in maintenance, and Express 5 is the active major release. 👇 Learn what EOL means for security and your upgrade options:

RT @TuxCare_: ⚡ #Fastify v3 reached EOL in 2023, followed by v4 in 2025. Today, v5 is the actively supported release. EOL versions no longer receive upstream security fixes, so upgrading helps keep apps on maintained releases. 👇 Learn more:

NativeScript 9.1 adds Node-API support, so many existing Node native addons can run with little or no change. The test runner was also rebuilt around Vitest, running real tests on a real device. More:

RT @nodejs: Are you a Node.js user? We want your feedback. Tell us all about how you're using Node.js in our annual user survey. Your response helps shape our future priorities!

RT @acolombiadev: So much love for the Node.js community. I gave my first ever tech talk at @NodeConfCo, and I got to show up for @RenderATL. Really grateful to the foundation for the opportunity.

What happens when the Node.js community gets together to talk about the future? A lot. 👀 Node.js Interactive 2026 brought developers, maintainers, speakers, and open source leaders together in Atlanta for conversations about the technology and, just as importantly, the people behind it. And there was a reminder worth repeating: open source infrastructure runs on people. Supporting maintainers and strengthening communities is how we keep the ecosystem moving forward. Catch up on the conversations and takeaways from Node.js Interactive 2026 👇 Thank you @aviv_keller for the post. And thank you @RenderATL for having us. WE LOVE OUR COMMUNITY!

RT @acolombiadev: The amazing @rginn206 opening Node.js Interactive @RenderATL, speaking about the responsibility of @openjsf, their commitment to sustainability, and the strength of the OSS ecosystem. 🤩

Hi from @nodejs Interactive at @RenderATL 👋 we've got talks this afternoon and tomorrow, plus a code and learn from 2-4pm on Thursday. Schedule here:

We're excited for this one. The @nodejs Interactive Code and Learn workshop is happening at RenderATL this Thursday, August 13, led by our friends at Harper. Attending @RenderATL? Join the nodejs-interactive-code-and-learn channel in Render's Discord ahead of time: There's still time to register:

RT @TuxCare_: ⚠️ Node.js 20 reached EOL on April 30, 2026, meaning it no longer receives security fixes. That risk can also extend to bundled components like OpenSSL, V8, undici, nghttp2, and zlib. 👇 Learn what EOL means for your apps and the options available: