Richard Lau

A fun thing I'm working on: A minimalist implementation of @opentelemetry.io auto tracing and egress via OTLP/JSON for @nodejs.org, with the intention of baking it into Node.js itself for OOTB observability. It's not ready yet! But here it is. github.com/nodejs/micro...

We did a GPG keysigning at The Open Mainframe Project event today at #IBMTechXchange 2 keys signed by active OMP project members (yes, one was mine) Lots of information dispensed for next time! It's still early days for the ZTRUST Working Group, so I'm calling this a success 🔐😁

Do all security vulnerabilities need to be fixed in private? With support from the Sovereign Tech Agency, OpenJS is using @nodejs.org to research whether some vulnerabilities can be remediated faster through normal open development without increasing security risk. More: openjsf.org/blog/soverei...

Time to update node 💚

The patch is included in the security relases: 👉 Node@26.12.1 👉 Node@24.22.1 👉 Node@22.23.4 nodejs.org/en/blog/vuln...

Just 11 days until IBM TechXchange 2026 in Atlanta! During our keynote, I'll be covering the Software Discovery Tool, the Mainframe Software Hub for Linux, and the ZTRUST Working Group (plus hosting a keysigning!) Full event details here: openmainframeproject.org/event/join-u...

In the September Open Source Software Report for Linux on IBM Z & LinuxONE we saw updates to Alfresco, Cilium, and Ruby. And while on Ruby... the Ruby FFI project added CI, and ffi-llvm-jit was among the projects we on-boarded to our GitHub Actions service! Report: community.ibm.com/community/us...

it's funny that now that we've democratized code and software programming, open source has actually drifted further away from a collaborative and value position as if AI coding agents are in negative correlation with open source software

We're making the Cloudflare developer platform the best place to run JavaScript, anywhere. Big step toward that today: the Deno team is joining us to build what’s next. https://cfl.re/4rXMBKy

Happy #HugYourMainframeDay 🤗 Last year I had the pleasure of assisting PJ Catalano and Camillo Sassano with an IBM LinuxONE (and IBM Z 😉) unboxing in the IBM TechXchange 2025 expo hall, and I got in the first hug!

Quote of the day from a colleague: "I feel that's not the panic situation we need to be focusing on ;-)"

If you're not able to join us in person at @nodeconf.eu in Bologna, Italy next week, please do try to join us remotely here live.nodeconf.eu ... every talk will be broadcast live with downloadable recordings available after.

One of the most exciting things I've seen in my seven years at IBM is how much open source software originally developed for cloud-native environments is coming to IBM z/OS. Ansible! Apache Kafka! And OpenTelemetry! SHARE has posted a nice intro article about it here: blog.share.org/Article/what...

Learn more recent improvements and what’s next. Tell us what would make publishing and consuming packages safer and easier.

Node.js now has (or in the next release will soon have) an improved range of performance diagnostic analysis features built in. New APIs have been added to the Histogram class: * h.burnRate(slowTarget) * h.ccdf(value) * h.cliffsD(other) * h.cohensD(other) * h.ewmaMean * h.ewmaErrorRate ...

Last chance to share your feedback in the 2026 Node.js User Survey! If you use Node.js, take a few minutes to tell us about your experience, priorities, and what matters most to you. Take the survey: linuxfoundation.surveymonkey.com/r/nodejs-use... #NodeJS #OpenSource

100% true. And, honestly, one of the secrets to @nodejs.org's longevity is that we exactly built resilience to this into the governance. No single company can represent more than 1/3 of the TSC for instance. It's never perfect but with effort companies can participate rather than dominate.

Node.js 26.9.0 is out, it enables by default node:ffi and adds support for Web Worker API (behind a flag). Full changelog and download links at nodejs.org/en/blog/rele...

🫶 As part of the @openjsf.org #CNA, we also want to encourage #maintainers, in our projects and beyond, to give themselves permission to take a break. #Burnout is real for #maintainers, especially in #security work. openjsf.org/blog/the-ope...

Node.js 24.21.0 and 26.8.2 are available, with security updates from OpenSSL and Undici. Full changelog and download links available at nodejs.org/en/blog/rele... and nodejs.org/en/blog/rele...

Here we are, the Linux on IBM Z and LinuxONE Open Source Software Report for August 2026! 🐧 The team worked on Bazel, Consul, and Zabbix, along with 30 other projects. In the community we saw binaries released and/or CI enabled for another 7 🎉 Full report: community.ibm.com/community/us...

25 years at #IBM today (including a five year stint at #RedHat). 🎉

Coming next: bypass-2FA tokens will also lose direct publish (~Jan 2027). Move automated publishing to trusted publishing (OIDC) or staged publishing.

npm Granular Access Tokens that bypass 2FA can no longer manage your account, org, or packages—those actions now require an interactive 2FA challenge, closing a major credential-based attack surface. github.blog/changelog/20...

I triage 20-40 security vulnerability reports a week. Almost all of them are now AI-written. And we usually get 3-5 duplicates of each one. That's the new reality of being a maintainer. 🧵

This is really sad news: www.hampshirechronicle.co.uk/news/2644920... Thankfully nobody was injured. The clubhouse was one of the perks of working at #IBM Hursley Park office, even if getting to it in a wheelchair onsite was difficult due to the gravel paths and steps.

Added some new commands to the GDB & LLDB plugin for V8.. `v8 source`: shows the JS source of the selected frame `v8 isolate`: find the isolate address in the current thread, works from the coredump too (implementing that in LLDB was quite a bit of challenge!)

A word of advice to young developers: Stop spamming open source projects with AI "contributions". Opening dozens of PRs in a matter of hours is just going to piss people off and get you blocked regardless of whether the changes are legitimate or not.

Who is still using the domain module? We are planning to runtime deprecate it in @nodejs.org v27.

📣 New Node.js release 📣 Node.js 26.7.0 is out with Perfetto tracing support, STORE loaders for private keys, and `module.register()` hooks are now disposable, plus many patches. Full changelog and download links available at nodejs.org/en/blog/rele...

npm is rotating write-scoped npm Granular Access Tokens that bypass 2FA as a precaution following a now-contained security incident. This doesn't affect GitHub personal access tokens. Maintainers should upgrade the npm CLI to v12+ and consider Trusted Publishing. docs.npmjs.com/trusted-publ...

Node.js 26.6.0 and 24.19.0 are out 💚 - https://nodejs.org/blog/release/v24.19.0 - https://nodejs.org/blog/release/v26.6.0

⚠️ Node.js Security Update: Updates are now available for the 26.x, 24.x, 22.x release lines. Details: https://nodejs.org/en/blog/vulnerability/july-2026-security-releases

Back at work after a week off to help look after some young relatives. - Inbox 1, 116 unread emails. - Inbox 2, 336 unread emails. - Over 1000 GitHub notifications, which appears to break the notifications counter.

Welcome to the Open Source Software report for IBM Z and LinuxONE for June 2026 🐧 Validation was maintained for over 2 dozen projects, including the Apache HTTP Server, pgvector, & RabbitMQ + 6 projects and ecosystems added s390x binaries, CI, and/or containers! 📦 community.ibm.com/community/us...

⚠️ The Node.js project will release new versions of the 26.x, 24.x, 22.x releases lines on or shortly after, Monday, July 27, 2026. Details: https://nodejs.org/en/blog/vulnerability/july-2026-security-releases

My talk at PLUG went well last night 🐧 🎉 Answered lots of interesting mainframe questions, got to show off zopen's port of DNF5, and folks were interested in both the IBM LinuxONE Community Cloud and learning more via IBM Z Xplore. Slides here: princessleia.com/presentation... (1.3M pdf)

This evening at 7PM I'm speaking at the Philadelphia Linux Users Group about the latest in the open source mainframe world, from the Mainframe Software Hub for Linux to the development around rpm and dnf5 for IBM z/OS Unix System Services (yes, really!) Info: lists.netisland.net/archives/plu...

TIL `git history split`!! 😍 lalitm.com/post/git-his...

Anyone using --use-largepages in real-world deployments? Just opened an issue about possibly deprecating it (if nobody is using it) to reduce the maintenance churn github.com/nodejs/node/...

Fetch is not enough... a blog post on server-side HTTP API standardization www.jasnell.me/posts/fetch-...

✨ Keep up to date with @nodejs.org by watching the #Nodejs #Security Working Group's last meeting on YouTube! We discussed around the @openjsf.org #CNA #API initiative and the next steps for the final adoption👌 www.youtube.com/watch?v=p1wR...

npm v12 is now generally available. npm install now makes install scripts, Git, and remote-URL dependencies opt-in by default. We're also retiring npm 2FA-bypass GAT: no account management (early Aug 2026), no direct publishing (~Jan 2027). More info at github.blog/changelog/20...

Made the new debug helper plugins work for Node.js + bleeding edge V8 🌟 Verified it works in LLDB (Linux, macOS) & GDB (Linux), both in live and coredump debugging Going to backport the patches to Node.js when the object inspection is more polished and it stablizes bit more..

I noticed npm is finally pushing out some of the breaking changes that I wanted to push 5 years ago, so I decided to write something about it, mostly to report and raise awareness that these changes are coming 😊 www.vlt.io/blog/npm-12-...

New @nodejs.org 26.5.0 release nodejs.org/en/blog/rele...

Waiting for the website CI to complete so I can announce the @nodejs.org 26.5.0 release ⌛

Landed a few improvements to the error reporting for require(esm) with top-level await (behind --experimental-print-required-tla for now): - No longer need to run the code to collect the TLA locations, so it can be enabled by default soon - Added require stack and location metadata to the error