Vulnerabilities & updates

Tuesday, July 15, 2025 Security Releases

Next.js 15.4

Next.js 15.4 includes updates to performance, stability, and Turbopack compatibility.

Node.js 24.4.0 (Current)

Bun v1.2.18

Fixes 52 issues (addressing 112 👍). ReadableStream text(), json(), bytes(), blob(), WebSocket client compression with `permessage-deflate`, `bun pm version`, reduced memory usage for large `fetch()` and `S3` uploads, faster `napi_create_buffer`, faster sliced string handling in native addons, `fs.glob` now matches directories by default, `net.createConnection()` now validates `options.host`, `http.ClientRequest#flushHeaders` now correctly sends the request body, `net.connect` `keepAlive` and `keepAliveInitialDelay` options are now correctly handled, `fs.watchFile` emits `stop` on next tick,…

Deno 2.4: deno bundle is back

Deno bundle is back, alongside the addition of bytes and text imports, stabilized built-in OpenTelemetry, a new --preload flag, simplified dependency management with deno update, and more.

JavaScript™ Trademark Update

The Trademark Trial and Appeal Board has dismissed our fraud claim against Oracle. We disagree with this decision.

What's coming to JavaScript

Here are proposals that were advanced at the last TC39 meeting and what that means for the future of JavaScript.

Node.js 22.17.0 (LTS)

Node.js 24.3.0 (Current)

Node.js 20.19.3 (LTS)

Bun v1.2.17

Fixes 50 issues (addressing 80 👍), and adds +24 passing Node.js tests. Ahead-of-time bundling for HTML imports, more reliable Bun Shell, `setTimeout` and `setImmediate` use 8-15% less memory, `columnTypes` & `declaredTypes` in `bun:sqlite`, `bun info` is the new `bun pm view`, Node.js compatibility improvements to `child_process.fork`, `fs.glob` options are now optional, `tls.getCACertificates()` is now implemented, `bun init` generates `CLAUDE.md` when claude code is installed, and more.

Bun v1.2.16

Fixes 73 issues (addressing 124 👍), and adds +119 passing Node.js tests. Serve files with `Bun.serve` through `routes`, `install.linkWorkspacePackages` option in `bunfig.toml`, `bun outdated` support for catalogs, `Bun.hash.rapidhash`, `node:net` compatibility, `vm.SyntheticModule` support, `HTTPParser` binding, and memory leak fixes.

Node.js 24.2.0 (Current)

Bun v1.2.15

Fixes 11 issues (addressing 261 👍). bun audit scans dependencies for security vulnerabilities, bun pm view shows package metadata from npm. bun init adds a Cursor rule to use Bun instead of Node.js/Vite/npm/pnpm, `node:vm SourceTextModule` and `node:perf_hooks createHistogram` are now implemented.

A brief history of JavaScript

In 30 years, JavaScript went from being a little scripting language to one of the world's most popular. Here are key moments to show how it has evolved and where it is headed.

Node.js 22.16.0 (LTS)

Node.js 24.1.0 (Current)

Bun v1.2.14

Fixes 39 issues (addressing 179 👍). Adds support for catalogs in bun install, --react flag for bun init, improved HTTP routing with method-specific routes, better TypeScript default module settings, fixes a HTTPS proxy issue impacting Codex, and several Node.js compatibility improvements including worker_threads reliability enhancements and http2 server improvements.

Reports of Deno's Demise Have Been Greatly Exaggerated

Addressing recent Deno criticisms and sharing our vision for the future

An Update on Fresh

Fresh 2.0 is very much still active. Here’s an update and how to try out the alpha.

Node.js 24.0.2 (Current)

Node.js 23.11.1 (Current)

Node.js 22.15.1 (LTS)

Node.js 20.19.2 (LTS)

Wednesday, May 14, 2025 Security Releases

Bun v1.2.13

Fixes 17 bugs (addressing 28 👍, adding +28 passing Node.js tests). Improved --hot stability and Node.js compatibility. Better `node:worker_threads` support, environment data, reduced memory usage for child_process IPC and worker_threads. Fixes BOM handling in `.npmrc` files. Fixes hot reloading on older versions of chrome

Node.js 24.0.1 (Current)

Node.js 24.0.0 (Current)

Bun v1.2.12

Stream browser console logs to your terminal, dev server uses less memory. Node.js compatibility improvements for timers, vm, net, http, and bugfixes for TextDecoder, hot reloading reliability bugfixes

Deno 2.3: Improved deno compile, local npm packages, and more

Deno 2.3 adds new features for deno compile and deno fmt, support for using local npm packages, several performance improvements, and more. Here are the biggest highlights.

Bun v1.2.11

Fixes 62 bugs (addressing 77 👍). `process.ref` and `process.unref`, `util.parseArgs` negative options, `BUN_INSPECT_PRELOAD`, Highway SIMD, Node.js compatibility improvements for `node:http`, `node:https`, `node:tls`, and `node:readline`

Add JSR packages with pnpm and Yarn

You can now access JSR packages via pnpm and Yarn. Here's how.

Node.js Test CI Security Incident

Node.js 22.15.0 (LTS)

React Labs: View Transitions, Activity, and more

In React Labs posts, we write about projects in active research and development. In this post, we're sharing two new experimental features that are ready to try today, and updates on other areas we're working on now.

Node.js 20.19.1 (LTS)

Bun v1.2.10

Fixes 33 bugs (addressing 33 👍). setImmediate gets faster. Reliability improvements for filesystem operations. Fixes test.failing with done callbacks. Fixes default idle timeout in Redis client. Fixes importing from 'bun' module with bytecode compilation. Default Docker image updated to Debian Bookworm.

Next.js 15.3

Next.js 15.3 includes Turbopack for builds, new client instrumentation and navigation hooks, and more.

Zero-config Debugging with Deno and OpenTelemetry

Debugging requires implementation to get the right data for you to resolve issues quickly. Here's how you can use Deno to capture necessary telemetry data without any additional work.

Bun v1.2.9

Fixes 48 bugs (addressing 116 👍). Bun.redis is a builtin Redis client for Bun. `ListObjectsV2` support in `Bun.S3Client`, more `libuv` symbols, `require.extensions` & require.resolve paths, bugfixes in `node:http`, `AsyncLocalStorage`, and `node:crypto`. Shell reliability improvements.

Debugging JavaScript Memory Leaks

Use v8 heap snapshot API + Chrome DevTools to compare heap snapshots

Node.js 23.11.0 (Current)

Exploring Art with TypeScript, Jupyter, Polars, and Observable Plot

With Deno's Jupyter support, you can explore, interact, and create interactive charts with TypeScript and HTML. Here's a tutorial featuring data of over 130,000 famous artworks.

Bun v1.2.8

Fixes 18 bugs (addressing 18 👍). napi improvements make node-sdl 100x faster. Headers.get() is 2x faster. Several node:http bugfixes. node:fs improvements. `bun install --frozen-lockfile` now works with `overrides`. `bun pack` now handles directory-specific pattern exclusion.

Deno v Oracle Update 3: Fighting the JavaScript Trademark

Oracle has filed a partial motion to dismiss our fraud claim. We’re now waiting on the USPTO to weigh in.

Node.js 18.20.8 (LTS)

Bun v1.2.7

Fixes 35 bugs (addressing 219 👍). Bun.CookieMap is a Map-like API for getting & setting cookies. Bun's TypeScript type declarations have been rewritten to eliminate conflicts with Node.js and DOM type definitions. Several bugfixes for node:http, node:crypto, and node:vm.

Bun v1.2.6

Fixes 74 bugs (addressing 36 👍). Faster, more compatible node:crypto. `timeout` option in Bun.spawn. Support for `module.children` in `node:module`. Connect to PostgreSQL via unix sockets with `Bun.SQL`. Dev Server stability improvements. vm.compileFunction. Initial support for node:test. Faster Express & Fastify.

Laravel Starter Kits: A New Beginning for Your Next Project

We’ve overhauled our starter kits, replacing Jetstream and Breeze with three distinct, purpose-built starter kits in Livewire, React, and Vue. These new kits allow you to focus on building your app instead of creating boilerplate code from scratch.