Latest security news

Node.js 22.22.2 (LTS)

Node.js 20.20.2 (LTS)

Tuesday, March 24, 2026 Security Releases

Next.js 16.2

Next.js 16.2 includes Adapters, rendering performance improvements, improved debugging and error pages, and more.

Turbopack: What's New in Next.js 16.2

Turbopack in Next.js 16.2 brings faster builds, SRI support, postcss.config.ts, tree shaking of dynamic imports, Server Fast Refresh, inline loader configuration, and over 200 bug fixes.

Next.js 16.2: AI Improvements

Next.js 16.2 ships AGENTS.md in create-next-app, browser log forwarding, dev server lock file with PID, and next-browser for AI agent debugging.

Bun v1.3.11

Fixes 105 issues (addressing 307 👍). 4 MB smaller on Linux. x64 Bun.cron for OS-level cron jobs and expression parsing, Bun.sliceAnsi for ANSI/grapheme-aware string slicing, richer Bun.markdown list metadata; bun test --path-ignore-patterns; native Windows ARM64 .bin shim; dgram UDP fixed on macOS, fs.openSync numeric flags fixed on Windows (unbreaks tar@7), http2 WINDOW_UPDATE fix; bundler --bytecode/barrel/import-attribute fixes; CSS unicode-range/mask/border-radius fixes; Proxy-array crash fixes, CRLF injection fix, bun install hang fixes, and many Node.js compatibility improvements.

Node.js 25.8.1 (Current)

Node.js 22.22.1 (LTS)

Node.js 20.20.1 (LTS)

Node.js 25.8.0 (Current)

Bun v1.3.10

Fixes 155 issues (addressing 642 👍). New native REPL, --compile --target=browser for self-contained HTML, TC39 standard ES decorators, Windows ARM64 support, barrel import optimization, and a faster event loop. structuredClone up to 25x faster for arrays, Buffer.slice() 1.8x faster, path.parse() up to 7x faster, fewer closures in bundled output, and upgraded JavaScriptCore with 168x faster deep rope string slicing. Fixes Python asyncio-based MCP servers breaking with Bun.spawn(), plus numerous bugfixes across Node.js compatibility, bun install, the bundler, shell, and Windows.

Deno 2.7: Temporal API, Windows ARM, and npm overrides

Deno 2.7 stabilizes the Temporal API, adds Windows on ARM builds, npm overrides in package.json, brotli compression streams, self-extracting compiled binaries, deno create, and dozens of Node.js compatibility improvements.

Node.js 25.7.0 (Current)

Node.js 24.14.0 (LTS)

The React Foundation: A New Home for React Hosted by the Linux Foundation

The React Foundation has officially launched, hosted by the Linux Foundation.

Build a dinosaur runner game with Deno, pt. 6

Add structured logging, distributed traces, and game analytics to your Deno game and learn how to use Deno Deploy's built-in logs, traces, and metrics dashboards.

Building Next.js for an agentic future

How we built and sunset an in-browser agent, shipped MCP integration, and learned that better AI agent support means thinking from the agent's perspective.

Node.js 25.6.1 (Current)

Node.js 24.13.1 (LTS)

Build a dinosaur runner game with Deno, pt. 5

Capture player identities, add a customization modal, and persist those preferences via Oak + PostgreSQL.

Bun v1.3.9

Fixes 23 issues (addressing 13 👍). Run multiple scripts in --parallel or --sequential. bun:test mock & spyOn get Symbol.dispose support. ESM bytecode compilation. Faster Bun.markdown. Faster RegExp, String.prototype.trim, String.prototype.startsWith.

Introducing Deno Sandbox

Instant Linux microVMs with defense-in-depth security for running untrusted code.

Deno Deploy is Generally Available

Deno Deploy is now generally available, plus some highlights of new features and tools.

Node.js 25.6.0 (Current)

Bun v1.3.8

Fixes 8 issues (addressing 6 👍). Bun.markdown is a builtin CommonMark-compliant Markdown parser written in Zig. Bun's bundler gets bun build --metafile-md to write LLM-friendly module graph metadata. Fixes a regression in 'npm install -g bun' on Windows.

OpenSSL Security Advisory Assessment, January 2026

Bun v1.3.7

Fixes 91 issues (addressing 243 👍). 50% faster `Buffer.from(array)`, 35% faster async/await, 3x faster `array.flat()`, 90% faster `padStart`/`padEnd` via JSC upgrade. New: `Bun.JSON5`, `Bun.JSONL`, `Bun.wrapAnsi()` (33-88x faster than wrap-ansi npm), `--heap-prof-md`, `--cpu-prof-md`, `node:inspector` Profiler API, `replMode` for `Bun.Transpiler`. Fetch now preserves header casing. HTTP/2 fixes for AWS ALB/gRPC/Fauna.

Node.js 25.5.0 (Current)

Build a dinosaur runner game with Deno, pt. 4

Building a leaderboard with database integration for our example browser-based game.

Inside Turbopack: Building Faster by Building Less

Learn how we built Turbopack with incremental computation to scale development and builds to massive Next.js applications.

Node.js 25.4.0 (Current)

Laravel Wayfinder: End-to-End Type Safety for PHP and TypeScript

Sync PHP and TypeScript automatically with Laravel Wayfinder, now in beta. Generate types, routes, and validation from your Laravel app.

Mitigating Denial-of-Service Vulnerability from Unrecoverable Stack Space Exhaustion for React, Next.js, and APM Users

Node.js 22.22.0 (LTS)

Node.js 25.3.0 (Current)

Node.js 24.13.0 (LTS)

Node.js 20.20.0 (LTS)

Bun v1.3.6

Fixes 45 issues (addressing 125 👍). Bun.Archive API for creating & extracting tarballs with gzip compression, Bun.JSONC for parsing JSON with comments, metafile & files options in Bun.build for bundle analysis and virtual files, Response.json() 3.5x faster, 15% faster async/await, 30% faster Promise.race, 20x faster Bun.hash.crc32, faster Buffer.indexOf/includes with SIMD, HTTP/HTTPS proxy support for WebSocket, S3 Requester Pays support, --grep flag for bun test, fake timers now work with @testing-library/react, SQLite updated to 3.51.2, and numerous Node.js compatibility improvements.

Tuesday, January 13, 2026 Security Releases

Build a dinosaur runner game with Deno, pt. 3

Adding obstacles, collision detection and game mechanics to our example browser-based game.

Next.js 16.1

Next.js 16.1 introduces Turbopack file system caching for development, a new bundle analyzer, and easier debugging in Node.js.

Bun v1.3.5

Fixes 32 issues (addressing 25 👍). Bun.Terminal API, compile-time feature flags, improved Bun.stringWidth accuracy, V8 C++ value type checking APIs, Content-Disposition support for S3 uploads, environment variable expansion in .npmrc quoted values, and numerous bug fixes & node.js compatibility improvements

Build a dinosaur runner game with Deno, pt. 2

This series of posts will guide you through building a simple game using Deno. This post sets up the game loop, user controls and basic game physics.

Next.js Security Update: December 11, 2025

Two additional vulnerabilities have been identified in React Server Components. Users should upgrade to patched versions immediately.

Node.js 24.12.0 (LTS)

Deno 2.6: dx is the new npx

This release includes `dx` for running package binaries, more granular permissions, source phase imports, faster type checking with `tsgo`, native source maps, `deno audit`, and much more.

Build a dinosaur runner game with Deno, pt. 1

This series of posts will guide you through building a simple game using Deno. Each post corresponds to a stage in the development process, gradually introducing new features and concepts.