Removing all dependencies and rolling your own from scratch because security alerts are annoying is like deciding to do all the grocery shopping, cooking, and dishes yourself because being told dinner’s ready is annoying.
Removing all dependencies and rolling your own from scratch because security alerts are annoying is like deciding to do all the grocery shopping, cooking, and dishes yourself because being told dinner’s ready is annoying.
Node.js has been doing security pre-announcements for years. This isn’t something they started a year or two ago. It’s a deliberate, responsible decision.
Publishing patches whenever they’re ready, without advance notice, ignores the schedules of all the developers who need to
Security release pre-alert:
We will release new versions of Node.js 22, 24, and 26 release lines on or shortly, after 2026-11-11 in order to address security vulnerabilities.
The highest severity issue fixed in this release is HIGH.
nodejs.org/en/blog/vulner…