最新安全信息

Publish a lint rule, get a prize

Deno's new lint plugin system means you can extend the deno lint functionality with your own rules. We're giving prizes for anyone who publishes a lint rule this week. Here's how to participate.

Bun v1.2.3

Fixes 128 bugs (addressing 349 👍). Bun gets a full-featured frontend development toolchain with incredibly fast hot reloading and bundling. Built-in routing for Bun.serve() makes it simpler to build web applications. Bun.SQL gets sql.array, sql fragments, sql.file, and many bugfixes. Node.js compatibility improvements for Buffer & Node-API (napi).

Laravel Cloud is live! Can you ship in 1 minute?

Today we shipped Laravel Cloud, Starter Kits (React, Vue, & Livewire), VS Code Extension, and Laravel 12.

Node.js 18.20.7 (LTS)

Deno 2.2: OpenTelemetry, Lint Plugins, node:sqlite

Deno 2.2 adds built-in OpenTelemetry, a new linter plugin API, node:sqlite, and major improvements to deno check, deno lsp, and deno task.

Sunsetting Create React App

Today, we’re deprecating Create React App for new apps, and encouraging existing apps to migrate to a framework, or to migrate to a build tool like Vite, Parcel, or RSBuild. We’re also providing docs for when a framework isn’t a good fit for your project, you want to build your own framework, or you just want to learn how React works by building a React app from scratch.

Node.js 23.8.0 (Current)

If you're not using npm specifiers, you're doing it wrong

One common way to import npm packages is with transpile services like esm.sh or unpkg.com, which converts npm modules to esm and hosts them on the web. However, since Deno 2, which supports npm natively, we recommend using npm specifiers. Here's why.

Node.js 22.14.0 (LTS)

Node.js 20.18.3 (LTS)

Oracle justified its JavaScript trademark with Node.js—now it wants that ignored

Oracle filed a motion to dismiss in response to Deno’s petition to cancel its “JavaScript” trademark. But instead of addressing the real issue—that JavaScript is an open standard with multiple independent implementations—Oracle is trying to stall the process and sidestep accountability.

Introducing the JSR open governance board

JSR, a modern open source JavaScript registry, is meant for the greater JavaScript and TypeScript community. We're thrilled to announce its own independent governing body.

Bun v1.2.2

Fixes 38 bugs (addressing 129 👍). JavaScript idle memory usage drops by 10–30%. Fixes regression impacting vite build. Reliability improvements to Bun.SQL, Bun.S3Client, Bun's CSS parser. Node.js compatibility improvements: fs.glob, fs.globSync, fs.promises.glob, bugfixes for fs.Dir, fs.accessSync, node:http WebSocket exports

Node.js 23.7.0 (Current)

Intro to Wasm in Deno

Web Assembly, or Wasm, is a great way to increase performance in your web application. Here is an introductory guide to what it is and how you can use it.

Bun v1.2.1

Fixes 32 bugs. S3 storage class support, X25519 support in crypto.generateKeyPair. fs.stat uses less memory. node:fs, node:child_process, and node:process compatibility improvements. CSS parser bugfixes. Zero-filled buffers with `--zero-fill-buffers` flag. Indented inline snapshots in bun test. Improved: String GC Reporting Accuracy. Fixed memory leaks in Bun.serve(), Bun.pathToFileURL, and with some strings. Disable minification in HTML imports.

Announcing OpenAI on JSR

OpenAI, leading development platform for building generative AI products and experiences, now has a JavaScript and TypeScript SDK on JSR.

Bun 1.2

Built-in Postgres client with Bun.sql, built-in S3 object support with Bun.s3, a new text-based lockfile: bun.lock, Express is 3x faster, and a major update on Node.js compatibility.

Node.js 23.6.1 (Current)

Node.js 22.13.1 (LTS)

Node.js 20.18.2 (LTS)

Node.js 18.20.6 (LTS)

Deno in 2024

We had a busy 2024 with the launch of Deno 2 and JSR, and dozens of features to simplify programming. Here are the biggest updates in 2024 and what's on the horizon.

Tuesday, January 21, 2025 Security Releases

Bun v1.1.45

Fixes 13 bugs (addressing 50 👍) 82% of the 'streams' module tests from Node.js' test suite now pass in Bun. node:crypto now implements diffieHellman, getCipherInfo, and X509Certificate. The checkServerIdentity object now matches Node.js' format. Bugfixes in Bun's fs.mkdirSync method, importing with query string

Bun v1.1.44

Fixes 43 bugs. > 90% of the 'dns' module tests from Node.js' test suite now pass in Bun. You can now build frontend applications on-demand in Bun.serve(). Adds xxHash support to Bun.hash(). Adds support for reading bun.lock using import. Adds --no-install flag to bunx. Improves console.warn output. Fixes bugs in Bun's S3 client, HTMLRewriter, and node:fs compatibility improvements, and more.

Goodbye WinterCG, welcome WinterTC

WinterCG, the Web Interoperable Runtimes Community Group is moving to Ecma as TC55 to be able to publish standards.

Bun v1.1.43

Bun v1.1.43 introduces 1st-class S3 support, HTML bundling, bun install --filter, V8 heap snapshots, bun install --lockfile-only, bun add --peer, 100% of `node:path` module Node.js test pass, 98% of `node:zlib` tests pass, Bun.file(path).stat(), Bun.file(path).delete(), along with many reliability improvements and bugfixes.

Node.js 22.13.0 (LTS)

Node.js 23.6.0 (Current)

Upcoming CVE for End-of-Life Node.js Versions

Composable Caching with Next.js

Learn more about the API design and benefits of 'use cache'

Bun v1.1.42

Fixes 1 regression from Bun v1.1.41 involving 'use strict' in empty files that impacted Prisma

Bun v1.1.41

Fixes 12 bugs (addressing 196 👍). JSDOM & happy-dom work more reliably due to node:vm compatibility improvements. Single-file executables on Windows now support custom icons and hiding the console. throw: true in Bun.build throws an error instead of returning errors. bun install gets the --omit=dev|optional|peer options and in .npmrc. A hoisting edgecase in bun install is fixed

Node.js 23.5.0 (Current)

Bun v1.1.40

Fixes 14 bugs. Adds `install.saveTextLockfile` option in bunfig.toml to make the text lockfile format the default. Fixes a bug in package-lock.json migration when manually changing npm URLs to git URLs. Fixes a regression in process.on from Bun v1.1.39. Fixes an issue with BigInt in napi APIs impacting DuckDB. Improves reliability of installing git/github dependencies in bun install. Upgrades WebKit with security & reliability improvements.

Bun's new text-based lockfile

We're introducing a new text-based lockfile format for bun install. It's GitHub & git-friendly, and makes it easier for teams to migrate from npm, yarn, and pnpm to bun install

Bun v1.1.39

Fixes 61 bugs (addressing 99 👍). bun.lock is bun's new text-based lockfile. Cached bun install gets 30% faster. fetch() request body streams. 100% of string_decoder, punycode and querystring Node.js tests pass. Native plugin API for Bun.build() and Rust crate. Implemented expect().toMatchInlineSnapshot(). More accurate heap snapshots. WebSocket server memory reduction. WebKit Upgrade with Error.isError, faster String.prototype.at.

Next.js 15.1

Next.js 15.1 introduces React 19 stable support, improved error debugging, new experimental authorization APIs, and more.

Node.js 23.4.0 (Current)

Build a SolidJS app with Deno

Learn how to build a simple SolidJS application with Deno.

React v19

React 19 is now available on npm! In this post, we'll give an overview of the new features in React 19, and how you can adopt them.

Node.js 22.12.0 (LTS)

Run your Next.js SSR app on Deno Deploy

Here's how to get your Next.js SSR project up and running on Deno Deploy.

Bun v1.1.38

Fixes 7 bugs (addressing 14 👍). Fixes debugger bug causing Bun to hang in VSCode terminal. Fixes crash in `postgres` npm package. Fixes TypeScript minification bug, console.log improvements, updated SQLite and c-ares. Adds `reusePort` option to `Bun.listen` and `node:net`, and fixes a bug in `Bun.FileSystemRouter.reload()`. Fixes rare crash in `fetch()`. Fixes assertion failure when re-assigning global modules in `--print` or `--eval`

Solve Advent of Code 2024 with Deno and Win Prizes!

We're giving out exclusive prizes for using Deno during the Advent of Code 2024. Here's what you can win.

Bun v1.1.37

Fixes 62 bugs (addressing 109 👍). Realtime error reporting & test runner in VSCode, self-referencing `import` & `require`, package.json `config` environment variables, improved CSS parser errors, fixes for a Prisma memory leak, a `bun install` regression, `expect.toMatchSnapshot` quote escaping, `node:net` regression impacting `http2-wrapper`, and several other bugfixes and improvements.

Deno v. Oracle: Canceling the JavaScript Trademark

Oracle is holding the JavaScript trademark hostage, and we’re pursuing legal means to #FreeJavaScript. Here’s a brief update.

Deno 2.1: Wasm Imports and other enhancements

Deno 2.1 introduces first-class Wasm imports, built-in tracing with OpenTelemetry, faster `deno compile`, and improved package management.