OpenJS Foundation

AI is finding open source bugs faster than people can fix them.

Node.js fixed a record 50 vulnerabilities this year. The bots find them, but maintainers triage, patch, and coordinate disclosure.

If your company runs on open source, fund the people keeping it secure.
nytimes.com/2026/10/28/tec…

Do all security vulnerabilities need to be fixed in private?

With support from @SovereignTechFund, OpenJS is using @nodejs to test whether some vulnerabilities can be remediated faster in the open without increasing security risk.

Read more: openjsf.org/blog/sovereign…

🔄 Node.js is changing how it approaches major releases.

Node.js 26 will be the final release under the project’s twice-yearly model. Starting with Node.js 27, new major versions will follow an annual release schedule, giving developers a more predictable lifecycle to plan around.

But a clearer release schedule does not automatically move production applications forward. If your application is still tied to Node.js 12, 14, 16, 18, or 20, upgrading may require dependency updates, compatibility testing, and changes to application behavior.

@TuxCare_ 's Endless Lifecycle Support provides ongoing CVE patches for these Node.js versions, so you can keep your application protected while working toward a supported release.

Learn more:
tuxcare.com/lp/click-nodej…

A new major release from the WebdriverIO community: WebdriverIO v10.

New agent workflows, improved tracing and debugging, Appium 3 support, WebDriver BiDi updates, and more.

Built with contributions from 191 people across 1,725 PRs.

webdriver.io/blog/2026/10/0…

Finding vulnerabilities is only part of open source security. Maintainers still need resources to triage, patch, and ship secure releases.

The new OpenJS Security Stewardship Program will fund researchers and maintainers, starting with Node.js.

hubs.la/Q04ykc4R0