OpenJS Foundation

Do all security vulnerabilities need to be fixed in private? With support from the Sovereign Tech Agency, OpenJS is using @nodejs.org to research whether some vulnerabilities can be remediated faster through normal open development without increasing security risk. More: openjsf.org/blog/soverei...

A new major release from the WebdriverIO community: WebdriverIO v10. New agent workflows, improved tracing and debugging, Appium 3 support, WebDriver BiDi updates, and more. Built with contributions from 191 people across 1,725 PRs. webdriver.io/blog/2026/10...

Finding vulnerabilities is only part of the work. Maintainers still need resources to triage, patch, and ship secure releases. The new OpenJS Security Stewardship Program will fund researchers and maintainers, starting with Node.js. openjsf.org/blog/openjs-...

Registration for Node-RED Con 2026 is now open. The programme is set and it's a strong one. November 3rd, free and online. events.zoom.us/ev/Ag_xPefs5... #NodeRED #NRCon2026

nvm.sh v0.40.8 is out, fixing a path traversal vuln and a number of bugs - cve.org/CVERecord?id... - github.com/nvm-sh/nvm/r...

Last chance to share your feedback in the 2026 Node.js User Survey! If you use Node.js, take a few minutes to tell us about your experience, priorities, and what matters most to you. Take the survey: linuxfoundation.surveymonkey.com/r/nodejs-use... #NodeJS #OpenSource

Heads up — if you tried to submit a talk for Node-RED Con 2026 and hit an error, we've switched to a new form. Give it another go at nrcon.nodered.org. CFP closes July 31. 🙌

Node.js Interactive at @renderatl.com — speaker lineup is live. QUIC in Node.js core. npm supply chain economics. Built-in TypeScript, test runners, and sqlite. AI agents with MCP. SemVer's next chapter. 15 speakers, all @nodejs.org. 🔗 openjsf.org/blog/node-in...

Running Node-RED in production? Node-RED Con 2026 wants to hear from you. Submit before July 31 — full talks, or a lightning talk on any project you're proud of. 👉 nrcon.nodered.org #NodeRED #NRCon2026 #CallForPapers

Node-RED Con 2026 is on — November 3rd, free & online. Theme: Node-RED at the Edge of Intelligence. The Call for Papers is open until July 31. Submit your talk: nrcon.nodered.org #NodeRED #NRCon2026 #IIoT #CallForPapers

Say hello to SQLRooms 👋 SQLRooms is joining the OpenJS Foundation as an Incubation Project, helping developers build modern, privacy first analytics experiences with open source. Read more: openjsf.org/blog/sqlroom...

🚀 cosmos.gl v3 has landed. The OpenJS Foundation project for GPU accelerated graph visualization keeps getting faster and more capable, helping developers explore massive datasets, embeddings, and network graphs directly in the browser. 🌐 Read more: openjsf.org/blog/cosmos-...

#OpenSource #security sustainability isn't about working harder. It's about structure that holds when the volume spikes. Yesterday we kicked off a new @openjsf.org CNA initiative: an #API that lets each project own its own #CVEs. youtu.be/HkePMUn0rKs?...

#NodeConf EU is back! If you've been working on something worth sharing about #Node.js internals, performance, #developer experience, or anything in between, this is the stage for you! nodeconf.eu See you in Bologna! 🇮🇹

nvm.sh v0.40.5 is out, with some CVE fixes: github.com/nvm-sh/nvm/r... Be sure to update!

Node.js Interactive returns at RenderATL 2026. Join maintainers, contributors, and developers for two days of talks on Node.js performance, security, AI tooling, infrastructure, and the real world challenges of running JavaScript at scale. https://bit.ly/43aFSBs

TuxCare has joined OpenJS Foundation as a Gold member and ESP partner, bringing long term security support for end of life JavaScript projects while helping strengthen ecosystem sustainability. Learn more: https://openjsf.org/blog/tuxcare-joins-openjs-foundation

Security isn't just about code, it's about sustainability. 🌐 The latest OpenJS Security Update dives into how the foundation is adapting to new challenges, from the pause of the Internet Bug Bounty program to managing AI-generated vulnerability reports. Read the Q1 Update: https://bit.ly/4cWocPA

"These sites must have our support, or we're all going to be in trouble developing, building, and running the programs our companies need to keep the lights on." Great article from ZDNet on the new Sustaining Package Registries Working Group news today. Read more: https://zd.net/4dsYORG

The open source sustainability crisis is a challenge we must face together 🤝 OpenJS is proud to join fellow registry leaders in the new Sustaining Package Registries Working Group. Our goal: shared approaches to funding, governance, and long-term resilience. https://bit.ly/48KhxWh

We're proud to support #MaintainerMonth by offering 15% off our summit at RenderATL for open source maintainers! Check it out at maintainermonth.github.com. See you there 💚

The Open Visualization Collaborator Summit is heading to Zürich! 🇨🇭 On September 9-10, 2026, we’re bringing together developers and maintainers of vis.gl, deck.gl, and kepler.gl to discuss the present and future of web-based visualization. Details & Registration: deck.gl/events/zurich-summit-2026/

Reminder: We're bringing a dedicated summit to RenderATL 2026. 🔥 Created by and for the JavaScript and Node.js community. Expect technical talks, real world lessons, and practical takeaways. Check out the details + register for the conference: https://bit.ly/4sgp4mF

Understanding JavaScript security is more important than ever 👀 Check out our free training course to better spot security flaws in JavaScript apps, design safer systems, and bring a security-first mindset to every stage of development. Details here: https://bit.ly/4vhXCay

OpenJS + JavaScript Monthly London Meetup = 🤩 Join us for the "warm up" to CityJS London! 📆 Wednesday April 15 📍 Tessl Office, 210 Pentonville Rd, London N1 9JY 📝 Details: https://guild.host/events/jsmonthly-205-cityjs-bsmk1x

Throwback Thursday: Christina Koch is taking off 🚀 and will be the first woman to journey around the moon. In 2020, she spoke at OpenJS World about what life is like in outer space as an international crew member of the ISS, and being a female in STEM. Recap here: https://bit.ly/4smsjsQ

"The biggest supply-chain risk isn’t abandoned code. It’s unsupported ecosystems." At RSAC 2026, @rginn206.bsky.social outlined a consistent pattern across ecosystems: when maintainer capacity does not scale with dependency usage, security risk increases. Read more on the blog: bit.ly/3PzHKA0

We are thrilled to announce that @rginn206.bsky.social 206 at @openjsf.org will be joining us for #CityJSLondon event - Come and see Robin speaking at our #WomenInTech panel and delivering interesting talks Register now london.cityjsconf.org

ECMAScript EXTRA-SPECIAL excitement 😉 🚨🚨🚨 IT'S ABOUT TIME! 🚨🚨🚨 Congrats to @ptomato.name on advancing Temporal to Stage 4 at @tc39.es today 🎉 Temporal is the replacement for the JavaScript Date API 👍

Node.js is moving to one major release per year starting with Node 27! 🚀 ✅ Simpler: Every release becomes LTS. ✅ Predictable: Version numbers now align with the year. ✅ New: A 6-month Alpha channel for early testing. https://bit.ly/4rnosLg

Yesterday was International Women's Day 💙 We're SO grateful for our women contributors, community members and staff. THANK YOU!

Announcing the @nodejs.org LTS Upgrade and Modernization Program! 🚀 We're helping enterprises move safely off end-of-life Node.js versions to reduce security risks with our partnerNodeSource. Modern Node.js is safer Node.js. Details: openjsf.org/blog/nodejs-...

We're excited to announce that Socket is joining the @openjsf.org! Proud to support the #JavaScript ecosystem alongside so many great projects and contributors. socket.dev/blog/socket-...

🎉 We’re thrilled to welcome @socket.dev as our newest Silver member. Socket is doing critical work to secure the JavaScript ecosystem by helping developers identify and prevent supply chain risks. We're excited to collaborate and make open source safer for everyone! 🛡️💻 openjsf.org/blog/socket-...

GitHub is funding open source security work across dozens of projects, including OpenJS projects like @nodejs.org and Webpack. Strong ecosystems are built through sustained investment in the software supply chain, and we appreciate @github.com's continued support of open source maintainers. 🫶

WHAT EVEN IS A CVE!!! ❓ @ulisesgascon.com breaks it down and explains what a CVE is and how it helps in our latest short. You can view all of the shorts in our series on our YouTube Channel too for more security insights 👀 youtube.com/@OpenJSFound...

We're testing something, please ignore this 🥸 [green-grass-grows]

Big year for security at OpenJS 👀 With support from Alpha Omega, we leveled up security across Node.js and the OpenJS ecosystem in 2025. Faster vulnerability response, automated releases, a new OpenJS CNA, stronger disclosure practices, and hands on support for over 10 projects. hubs.la/Q040lXwL0

nvm.sh users: please upgrade to github.com/nvm-sh/nvm/r... if you're using `wget` on your system, to fix a medium vulnerability (github.com/nvm-sh/nvm/s...).

jQuery UI 1.14.2 is now available. 💙 This release includes improvements to Tabs behavior and removes the mousewheel plugin dependency. Read the full release notes here: blog.jqueryui.com/2026/01/jque...

Big news 👀 The OpenJS Foundation is bringing a dedicated summit to RenderATL 2026. 🔥 Created by and for the JavaScript and Node.js community. Expect technical talks, real world lessons, and practical takeaways. Check out the details + register for the conference: hubs.la/Q040sX130

Lodash v4.17.23 is live and features a whole new look for security 😎🔥 Security fixes, stronger governance, and improved maintenance = safer and more reliable for your projects. Check it out 👇 hubs.la/Q03_NX2J0

New Security Snapshot is live. @ulisesgascon.com walks through how Express handles security reports, from first contact to shipped patch. Clear steps, zero panic, just a solid process that keeps users safe. 👍

Oh hi. 👋 We're back with the latest Security Snapshot that covers how to publish to npm safely and with ease. ✨ @rafaelgss.dev breaks down why local publishing with 2FA gives you the safest setup right now.