Latest security news

Deno in 2024

We had a busy 2024 with the launch of Deno 2 and JSR, and dozens of features to simplify programming. Here are the biggest updates in 2024 and what's on the horizon.

Tuesday, January 21, 2025 Security Releases

Bun v1.1.45

Fixes 13 bugs (addressing 50 👍) 82% of the 'streams' module tests from Node.js' test suite now pass in Bun. node:crypto now implements diffieHellman, getCipherInfo, and X509Certificate. The checkServerIdentity object now matches Node.js' format. Bugfixes in Bun's fs.mkdirSync method, importing with query string

Bun v1.1.44

Fixes 43 bugs. > 90% of the 'dns' module tests from Node.js' test suite now pass in Bun. You can now build frontend applications on-demand in Bun.serve(). Adds xxHash support to Bun.hash(). Adds support for reading bun.lock using import. Adds --no-install flag to bunx. Improves console.warn output. Fixes bugs in Bun's S3 client, HTMLRewriter, and node:fs compatibility improvements, and more.

Goodbye WinterCG, welcome WinterTC

WinterCG, the Web Interoperable Runtimes Community Group is moving to Ecma as TC55 to be able to publish standards.

Bun v1.1.43

Bun v1.1.43 introduces 1st-class S3 support, HTML bundling, bun install --filter, V8 heap snapshots, bun install --lockfile-only, bun add --peer, 100% of `node:path` module Node.js test pass, 98% of `node:zlib` tests pass, Bun.file(path).stat(), Bun.file(path).delete(), along with many reliability improvements and bugfixes.

Node.js 22.13.0 (LTS)

Node.js 23.6.0 (Current)

Upcoming CVE for End-of-Life Node.js Versions

Composable Caching with Next.js

Learn more about the API design and benefits of 'use cache'

Bun v1.1.42

Fixes 1 regression from Bun v1.1.41 involving 'use strict' in empty files that impacted Prisma

Bun v1.1.41

Fixes 12 bugs (addressing 196 👍). JSDOM & happy-dom work more reliably due to node:vm compatibility improvements. Single-file executables on Windows now support custom icons and hiding the console. throw: true in Bun.build throws an error instead of returning errors. bun install gets the --omit=dev|optional|peer options and in .npmrc. A hoisting edgecase in bun install is fixed

Node.js 23.5.0 (Current)

Bun v1.1.40

Fixes 14 bugs. Adds `install.saveTextLockfile` option in bunfig.toml to make the text lockfile format the default. Fixes a bug in package-lock.json migration when manually changing npm URLs to git URLs. Fixes a regression in process.on from Bun v1.1.39. Fixes an issue with BigInt in napi APIs impacting DuckDB. Improves reliability of installing git/github dependencies in bun install. Upgrades WebKit with security & reliability improvements.

Bun's new text-based lockfile

We're introducing a new text-based lockfile format for bun install. It's GitHub & git-friendly, and makes it easier for teams to migrate from npm, yarn, and pnpm to bun install

Bun v1.1.39

Fixes 61 bugs (addressing 99 👍). bun.lock is bun's new text-based lockfile. Cached bun install gets 30% faster. fetch() request body streams. 100% of string_decoder, punycode and querystring Node.js tests pass. Native plugin API for Bun.build() and Rust crate. Implemented expect().toMatchInlineSnapshot(). More accurate heap snapshots. WebSocket server memory reduction. WebKit Upgrade with Error.isError, faster String.prototype.at.

Next.js 15.1

Next.js 15.1 introduces React 19 stable support, improved error debugging, new experimental authorization APIs, and more.

Node.js 23.4.0 (Current)

Build a SolidJS app with Deno

Learn how to build a simple SolidJS application with Deno.

React v19

React 19 is now available on npm! In this post, we'll give an overview of the new features in React 19, and how you can adopt them.

Node.js 22.12.0 (LTS)

Run your Next.js SSR app on Deno Deploy

Here's how to get your Next.js SSR project up and running on Deno Deploy.

Bun v1.1.38

Fixes 7 bugs (addressing 14 👍). Fixes debugger bug causing Bun to hang in VSCode terminal. Fixes crash in `postgres` npm package. Fixes TypeScript minification bug, console.log improvements, updated SQLite and c-ares. Adds `reusePort` option to `Bun.listen` and `node:net`, and fixes a bug in `Bun.FileSystemRouter.reload()`. Fixes rare crash in `fetch()`. Fixes assertion failure when re-assigning global modules in `--print` or `--eval`

Solve Advent of Code 2024 with Deno and Win Prizes!

We're giving out exclusive prizes for using Deno during the Advent of Code 2024. Here's what you can win.

Bun v1.1.37

Fixes 62 bugs (addressing 109 👍). Realtime error reporting & test runner in VSCode, self-referencing `import` & `require`, package.json `config` environment variables, improved CSS parser errors, fixes for a Prisma memory leak, a `bun install` regression, `expect.toMatchSnapshot` quote escaping, `node:net` regression impacting `http2-wrapper`, and several other bugfixes and improvements.

Deno v. Oracle: Canceling the JavaScript Trademark

Oracle is holding the JavaScript trademark hostage, and we’re pursuing legal means to #FreeJavaScript. Here’s a brief update.

Deno 2.1: Wasm Imports and other enhancements

Deno 2.1 introduces first-class Wasm imports, built-in tracing with OpenTelemetry, faster `deno compile`, and improved package management.

Node.js 23.3.0 (Current)

Node.js 20.18.1 (LTS)

Build a Typesafe API with tRPC and Deno

Learn how to build a typesafe API with tRPC and Deno.

Bun v1.1.35

Fixes 46 bugs (addressing 570 👍). Musl LibC support, JUnit XML test output, 6 MB binary size reduction, `Worker` `preload` option, faster `fs.readFile` for small files, deep equality support for `Headers` and `URLSearchParams`, `node:net` compatibility improvements, unicode import bugfixes, several `bun install` fixes

Self-contained Executable Programs with Deno Compile

Deno compile is a flexible tool that turns a JavaScript or TypeScript program into a portable, streamlined binary for any OS. Here's how it works.

Build a Database App with Drizzle ORM and Deno

Using an object-relational mapping (ORM) database can make working with persistent data simpler. Here's how to use a popular ORM, Drizzle, with Deno.

Node.js 18.20.5 (LTS)

Node.js 23.2.0 (Current)

Introducing your new JavaScript package manager: Deno

Deno’s new package manager, added in v2.0, is fast, flexible, and supports Node and package.json. Here’s how it works.

How Bun supports V8 APIs without using V8 (part 2)

Rearranging JavaScriptCore types to match V8 code's assumptions

Announcing Growthbook on JSR

Growthbook's JavaScript SDK, which enables easy AB testing and personalization, is now available on JSR.

Bun v1.1.34

Fixes 64 bugs (addressing 62 👍). `Bun.randomUUIDv7`, reduced memory usage for long-running processes, `napi_type_tag_object` and `napi_check_object_type_tag`, redacted secrets from config logs, `ReadableStream` and HTTP/1.1 spec fixes, several `bun install` and Node.js compatibility improvements

Node.js 22.11.0 (LTS)

Build an Astro site with Deno

Learn how to build a server-rendered website with Astro and Deno.

Node.js 23.1.0 (Current)

Our Journey with Caching

Learn about our journey with caching in Next.js App Router.

Bun v1.1.33

Fixes 8 bugs. Fixes JSX symbol collisions with imports, fixes a `bun install` slowdown, skips optional dependency, fixes optional dependency postinstall failures, and fixes an assertion failure in the CSS parser.

Bun v1.1.32

Fixes 7 bugs and adds crypto.hash() in node:crypto. Warnings in Next.js 15 are fixed. A regression in ESM CJS interop impacting Vite config objects is fixed. A crash in Bun.serve() when passing invalid TLS certificates at start is fixed.

Next.js 15

Next.js 15 introduces React 19 support, caching improvements, a stable release for Turbopack in development, new APIs, and more.

Turbopack Dev is Now Stable

It's been a long road, but we are happy to announce that `next dev --turbo` is now stable and ready to speed up your development experience.

React Compiler Beta Release

At React Conf 2024, we announced the experimental release of React Compiler, a build-time tool that optimizes your React app through automatic memoization. In this post, we want to share what's next for open source, and our progress on the compiler.

Bun v1.1.31

Fixes 41 bugs (addressing 595 👍). node:http2 server and gRPC server support, ca and cafile support in bun install, Bun.inspect.table, bun build --drop, iterable SQLite queries, iterator helpers, Promise.try, Buffer.copyBytesFrom, and several Node.js compatibility improvements and bugfixes.

Node.js 22.10.0 (Current)