The dynamic type hints feature in Module Federation 2.0 dramatically streamlines the development process by automatically generating and loading types from remote modules, eliminating the need for shared type packages.
This decision addresses a critical operational need. While Node.js values open collaboration, the volume of low-quality security reports has increased drastically, driven largely by automated tools and generative AI. The problem: Between December and January, the project received over 30 vulnerability reports, compared to the usual average of 6 or 7 per month. Many of these submissions lacked technical merit or turned out to be false positives.
Two years ago, the Express team initiated a complete revamp of the project's governance. What was once a largely single-maintainer effort under Doug Wilson evolved into a structured Technical Committee (TC) with multiple active contributors. "Our goal was to evolve Express from a single-maintainer project into a sustainable, community-driven effort - one built on shared responsibility, clear processes, and long-term vision," Ulises explained.
Node.js/V8 makes a best-effort attempt to recover from stack space exhaustion with a catchable error, which frameworks have come to rely on for service availability, A bug that only reproduces when async_hooks are used would break this attempt, causing Node.js to exit with 7 directly without throwing a catchable error when recursions in user code exhaust the stack space. This makes applications whose recursion depth is controlled by unsanitized input vulnerable to Denial-of-Service attacks.
The jsPDF library for generating PDF documents in JavaScript applications is vulnerable to a critical vulnerability that allows an attacker to steal sensitive data from the local filesystem by including it in generated files. The flaw is a local file inclusion and path traversal that allows passing unsanitized paths to the file loading mechanism (loadFile) in jsPDF versions before 4.0. It is tracked as CVE-2025-68428 and received a severity score of 9.2.
Node.js is one of the most popular server-side platforms, especially for web applications. It gives you non-blocking JavaScript without a browser, plus an enormous ecosystem. That ecosystem is one of Node's chief strengths, making it a go-to option for server development. This article is a quick tour of the most popular web frameworks for server development on Node.js. We'll look at minimalist tools like Express.js, batteries-included frameworks like Nest.js, and full-stack frameworks like Next.js.
With the release of Node.js 24.11.0 "Krypton", the Node.js 24 line has officially entered Long-Term Support (LTS) and will continue receiving maintenance and security updates through April 2028. This marks the beginning of a new stable era for production workloads, bringing developers enhanced security, stricter runtime behavior, and improved Web API support. At NodeSource, we're proud to announce that both our open-source N|Solid Runtime and the N|Solid now fully supports Node.js 24 LTS "Krypton."
What I like about Stu's stab at this is that it's an ongoing journey rather than a wholesale switch. In fact, he's out with a new post that pokes specifically at compiling multiple CSS files into a single file. Splitting and organizing styles into separate files is definitely the reason I continue to Sass-ify my work. I love being able to find exactly what I need in a specific file and updating it without having to dig through a monolith of style rules.
A shell is like browser console, but for the operating system instead of for JavaScript. It helps us with programming by running the tools (programs) we need to get things done. Node.js is a program that lets us run JavaScript code outside browsers - which we can use for a variety of things.
A standardized CI/CD pipeline for microservices should address key challenges such as coordinating cross-service releases, managing backward compatibility, and preventing configuration duplication.
