Marco Ippolito

Marco Ippolito

@marcoippolito.dev

Security Engineer @herodevs | Node.js Technical Steering Committee & Release marcoippolito.dev

914 followers152 following216 posts

Marco Ippolito reposted

Excited to share vlt 1.0 along with our hosted registries & ecosystem mirrors now GA! A drop-in npm replacement, built so nothing runs on your machine just because you typed install. → faster delivery → malware blocking at the registry layer → graph-native querying

Marco Ippolito reposted

#NodeConf EU is back! If you've been working on something worth sharing about #Node.js internals, performance, #developer experience, or anything in between, this is the stage for you! nodeconf.eu See you in Bologna! 🇮🇹

Marco Ippolito reposted

Replying to @jakearchibald.com

We now have an 'open web API' that requires you to comply with Google's "terms of use". I know many at Chrome disagree with this, but feel they can't say anything publicly out of fear of internal retribution. github.com/mozilla/stan...

github.comPrompt API · Issue #1213 · mozilla/standards-positionsSpecification title Prompt API Specification or proposal URL (if available) No response Explainer URL (if available) https://github.com/webmachinelearning/prompt-api/blob/main/README.md Proposal au...

Marco Ippolito reposted

We are happy to announce the NodeConf EU is returning in 2026. This time, things will be a little different. While the Irish countryside made for a beauttiful backdrop for getting the community together to talk about Node.js, there have always been a number of logistical challenges to hosting there;

Marco Ippolito reposted

Node.js is moving to one major release per year starting with Node 27! 🚀 ✅ Simpler: Every release becomes LTS. ✅ Predictable: Version numbers now align with the year. ✅ New: A 6-month Alpha channel for early testing. https://bit.ly/4rnosLg

nodejs.orgNode.js — Evolving the Node.js Release ScheduleNode.js® is a free, open-source, cross-platform JavaScript runtime environment that lets developers create servers, web apps, command line tools and scripts.

Marco Ippolito reposted

This just landed! Thanks @addaleax.bsky.social and @legendecas.bsky.social for the reviews! It will be out in the next semver-minor release of 25, and likely backportable to older LTS - the new workflow is a compatible improvement to the existing postject-based SEA building workflows from v18.x.

Joyee Cheung@joyeecheung.bsky.social

Made some progress in my hobby project 🎄 Moving single executable application building into Node.js core for better UX/DX, currently works on macOS and Linux and open for feedback! (No Windows yet because I don't take another laptop with me on vacation 😅) github.com/nodejs/node/...

Marco Ippolito reposted

We appreciate your patience and understanding as we work to deliver a secure and reliable release. Updates are now available for the 25.x, 24.x, 22.x, 20.x Node.js release lines to address: - 3 high severity issues - 4 medium severity issues - 1 low severity issue nodejs.org/en/blog/vuln...

nodejs.orgNode.js — Tuesday, January 13, 2026 Security ReleasesNode.js® is a free, open-source, cross-platform JavaScript runtime environment that lets developers create servers, web apps, command line tools and scripts.

Marco Ippolito reposted

Node.s sec release We are doing our best. We are ensuring test passes on all platforms and all active release lines (v20, v22, v24 and v25) - and they aren't currently. Unfortunately, we don't have an ETA for that, and it's likely that this security release will be postponed one more time. Sorry.

Marco Ippolito reposted

TIL that modern Node not only supports `--env-file` / `--env-file-if-exists` but also a new method to programmatically load .env files. It's been marked stable since Node v24 (current LTS), and I'm now on the journey of removing all the `dotenv` dependencies. 😅 www.stefanjudis.com/today-i-lear...

⚠️ Node.js security release has been postponed ⚠️ We have decided to delay the security release further to January 7th 2026 to ensure the team has enough time to prepare the releases and avoid distruptions during the holiday season. nodejs.org/en/blog/vuln...

nodejs.orgNode.js — Wednesday, January 7, 2026 Security ReleasesNode.js® is a free, open-source, cross-platform JavaScript runtime environment that lets developers create servers, web apps, command line tools and scripts.

⚠️ The security release has been postponed to the 18th of December. The team is working on a challenging patch.

Marco Ippolito@marcoippolito.dev

❗️Node.js Security release pre-alert ❗️ We will release new versions of v20, v22, v24, v25 release lines on or shortly after the 15th of December 2025 in order to address: * 3 high severity issues. * 1 low severity issue. * 1 medium severity issue. nodejs.org/en/blog/vuln...

❗️Node.js Security release pre-alert ❗️ We will release new versions of v20, v22, v24, v25 release lines on or shortly after the 15th of December 2025 in order to address: * 3 high severity issues. * 1 low severity issue. * 1 medium severity issue. nodejs.org/en/blog/vuln...

nodejs.orgNode.js — Monday, December 15, 2025 Security ReleasesNode.js® is a free, open-source, cross-platform JavaScript runtime environment that lets developers create servers, web apps, command line tools and scripts.

Marco Ippolito reposted

Node & TypeScript excitement 😉 Marco tells the story of implementing Type Stripping support in Node. It involves a lot of collaboration across the JS ecosystem. 🔷 First cut took 20 days (fast for Node) 🔷 TS delivered flags to ease adoption 🔷 Marco's reward: a bread machine

Marco Ippolito@marcoippolito.dev

Just published a new blog post. It’s about my experience shipping Node.js native TypeScript support. It’s not a technical blog post, it's about my perspective, what it felt like and what I learned along the way. satanacchio.hashnode.dev/the-summer-i...

Marco Ippolito reposted

Node excitement 😉 Congrats to @marcoippolito.dev on making it official: type-stripping in Node 25 is now declared to be stable 🎉 You can run: node index.ts The capabilities have not changed since Node 24. This is purely a maturity indicator.

Marco Ippolito@marcoippolito.dev

Type stripping is now stable. Enjoy 🌞

Marco Ippolito reposted

Marco Ippolito introduces node.config.json in Node.js v23, a long-awaited config file that finally makes runtime flag management structured and predictable. 🚀 #NordicJS #NordicJS2025

Marco Ippolito reposted

please do fill this out! it's one of the good surveys and I always find taking it to be informative and fun. ✨ ... and, if you're not always represented in surveys like this, it would be particularly good to hear your voice 🙏

Alexander Lichter@thealexlichter.com

State of JS 2025 Christmas is only 3 months away, which means it is also time to take the State of JavaScript survey (again). The more devs participate, the clearer the big picture will be in the end 🙌 Plus, you learn about features, libs, and frameworks you haven't heard before (or forgot about).

Marco Ippolito reposted

pnpm v10.16.0 adds "minimumReleaseAge", a setting for defining how long a version has to have been published before pnpm will install it. A nice countermeasure against accidental installs of short-lived compromised packages before they get taken down. Not a 100% fix, but a great additional step!

github.comRelease pnpm 10.16 · pnpm/pnpmMinor Changes There have been several incidents recently where popular packages were successfully attacked. To reduce the risk of installing a compromised version, we are introducing a new settin...