Latest security news

Next.js 16

Next.js 16 includes Cache Components, stable Turbopack, file system caching, React Compiler support, smarter routing, new caching APIs, and React 19.2 features.

My highlights from the new Deno Deploy

Highlights from the new version of Deno Deploy.

Node.js 22.21.0 (LTS)

Deno's Other Open Source Projects

Here’s a roundup of some of our popular open source libraries and how we use them in Deno.

React Conf 2025 Recap

Last week we hosted React Conf 2025, in this post, we summarize the talks and announcements from the event...

Node.js 25.0.0 (Current)

Node.js 24.10.0 (Current)

Bun 1.3

Bun 1.3 introduces zero-config frontend development, unified SQL API, built-in Redis client, security enhancements, package catalogs, async stack traces, VS Code test integration, and Node.js compatibility improvements.

Next.js 16 (beta)

Next.js 16 beta includes stable Turbopack, file system caching, React Compiler support, smarter routing, new caching APIs, and React 19.2 features.

Introducing the React Foundation

Today, we're announcing our plans to create the React Foundation a new technical governance structure

React Compiler v1.0

We are releasing the compiler's first stable release today.

React 19.2

React 19.2 adds new features like Activity, React Performance Tracks, useEffectEvent, and more.

How Deno protects against npm exploits

Recent supply chain attacks on npm is a reminder that Node and npm grants unfettered access to your systems. Here's how Deno, with an opt-in security model, protects against these vulnerabilities.

Bun v1.2.23

Fixes 119 issues (addressing 412 👍). pnpm-lock.yaml migration for seamless switching from pnpm to bun install, Redis Pub/Sub support, concurrent test execution with configurable parallelism, platform-specific dependency filtering with --cpu and --os flags, system CA certificates support with --use-system-ca, Windows code signing for compiled executables, JSX configuration improvements in Bun.build, sql.array helper for parameterized arrays, randomized test ordering, stricter CI test defaults, process.report.getReport() on Windows, and numerous Node.js compatibility improvements including htt…

Node.js 24.9.0 (Current)

Node.js 22.20.0 (LTS)

Help Us Raise $200k to Free JavaScript from Oracle

Our legal battle over Oracle's claim on the word "JavaScript" is entering the discovery phase. Here's how you can help.

Bun v1.2.22

Fixes 144 issues (addressing 257 👍). Async stack traces for better debugging, RFC 6455 compliant WebSocket client subprotocol negotiation, MySQL adapter improvements including affectedRows and lastInsertRowid support, JSX side effects preservation during bundling, event loop delay monitoring with perf_hooks, HTTP server idle connection management, --workspaces in bun run, function name removal during minification, and numerous Node.js compatibility fixes including child_process.spawnSync, socket.write with Uint8Array, crypto.verify RSA defaults, N-API improvements, HTMLRewriter error handlin…

Node.js 24.8.0 (Current)

Behind The Scenes of Bun Install

Learn how Bun is able to cut install times by up to 25×. Bun skips Node.js's overhead with direct system calls, cache-friendly data layouts, OS-level copy-on-write, and full-core parallelism.

Deno 2.5: Permissions in the config file

Simpler permission management with permission sets, new Deno.test APIs for setting up and tearing down test cases, specifying custom headers in WebSocket connections, runtime APIs in deno bundle, and more.

Node.js 20.19.5 (LTS)

Fresh 2.0 Graduates to Beta, Adds Vite Support

Fresh 2.0 beta introduces optional Vite integration - with hot reloading, faster boot times, seamless React aliasing, and the full Vite plugin ecosystem

Node.js 22.19.0 (LTS)

Node.js 24.7.0 (Current)

Bun v1.2.21

Fixes 69 issues (addressing 204 👍). Bun.SQL now supports MySQL and SQLite, alongside PostgreSQL. Native YAML support. 500x faster postMessage(string). Bun.build() compile API, with cross-platform targets. Reduced idle CPU usage. Bun.stripANSI for SIMD-accelerated ANSI escape removal. bunx --package flag support. customizable User-Agent headers. Windows executable metadata embedding. and extensive Node.js compatibility improvements

500x faster postMessage(string)

Zero-copy postMessage(string)

Next.js 15.5

Next.js 15.5 includes Turbopack builds in beta, stable Node.js middleware, TypeScript improvements, `next lint` deprecation, and deprecation warnings for Next.js 16.

Migrating to Laravel with Lenny the Larva. The Artisan of the Day Is Dave Kiss.

Dave Kiss shows that switching frameworks doesn't have to be scary, and walks through a Next.js to Laravel migration in the company of Lenny the larva.

Node.js 24.6.0 (Current)

Taming JavaScript Complexity: The Artisan of the Day Is Evan You

Meet Evan You, the creator of Vue.js and Vite, two essential pieces of the modern JavaScript ecosystem.

Bun v1.2.20

Fixes 141 issues (addressing 429 👍). Reduced idle CPU usage. Improved `bun:test` diffing. Automatic `ETag` and `If-None-Match` in static routes for `Bun.serve`. 40x faster `AbortSignal.timeout`. Windows long path support. `WebAssembly.compileStreaming` and `WebAssembly.instantiateStreaming`. Many, many reliability improvements.

Node.js 22.18.0 (LTS)

Node.js 24.5.0 (Current)

Bun v1.2.19

Fixes 163 issues (addressing 1,043 👍). Introduces `bun install --linker=isolated` for pnpm-style isolated node_modules, `bun why` for dependency tree understanding, `bun pm pkg` commands for package.json management, enhanced `node:fs.glob()` with array patterns and exclude options, `node:module.SourceMap` class and `findSourceMap()`, smarter `@types/bun` with automatic Node.js compatibility detection, plus numerous Node.js compatibility improvements, runtime bugfixes, bundler enhancements, and bun install optimizations.

Node.js 20.19.4 (LTS)

Node.js 22.17.1 (LTS)

Node.js 24.4.1 (Current)

Tuesday, July 15, 2025 Security Releases

Next.js 15.4

Next.js 15.4 includes updates to performance, stability, and Turbopack compatibility.

Node.js 24.4.0 (Current)

Bun v1.2.18

Fixes 52 issues (addressing 112 👍). ReadableStream text(), json(), bytes(), blob(), WebSocket client compression with `permessage-deflate`, `bun pm version`, reduced memory usage for large `fetch()` and `S3` uploads, faster `napi_create_buffer`, faster sliced string handling in native addons, `fs.glob` now matches directories by default, `net.createConnection()` now validates `options.host`, `http.ClientRequest#flushHeaders` now correctly sends the request body, `net.connect` `keepAlive` and `keepAliveInitialDelay` options are now correctly handled, `fs.watchFile` emits `stop` on next tick,…

Deno 2.4: deno bundle is back

Deno bundle is back, alongside the addition of bytes and text imports, stabilized built-in OpenTelemetry, a new --preload flag, simplified dependency management with deno update, and more.

JavaScript™ Trademark Update

The Trademark Trial and Appeal Board has dismissed our fraud claim against Oracle. We disagree with this decision.

What's coming to JavaScript

Here are proposals that were advanced at the last TC39 meeting and what that means for the future of JavaScript.

Node.js 22.17.0 (LTS)

Node.js 24.3.0 (Current)

Node.js 20.19.3 (LTS)

Bun v1.2.17

Fixes 50 issues (addressing 80 👍), and adds +24 passing Node.js tests. Ahead-of-time bundling for HTML imports, more reliable Bun Shell, `setTimeout` and `setImmediate` use 8-15% less memory, `columnTypes` & `declaredTypes` in `bun:sqlite`, `bun info` is the new `bun pm view`, Node.js compatibility improvements to `child_process.fork`, `fs.glob` options are now optional, `tls.getCACertificates()` is now implemented, `bun init` generates `CLAUDE.md` when claude code is installed, and more.

Bun v1.2.16

Fixes 73 issues (addressing 124 👍), and adds +119 passing Node.js tests. Serve files with `Bun.serve` through `routes`, `install.linkWorkspacePackages` option in `bunfig.toml`, `bun outdated` support for catalogs, `Bun.hash.rapidhash`, `node:net` compatibility, `vm.SyntheticModule` support, `HTTPParser` binding, and memory leak fixes.