Systems | Development | Analytics | API | Testing

Updating Node.js can be as simple as installing a new version. But a safe Node.js upgrade is more than changing the number returned by node -v. A major release can affect dependencies, native addons, Node.js APIs, OpenSSL, build environments, and runtime behavior. Before changing the runtime, the first question should be.

When npm announced that version 12 would require developers to explicitly approve install scripts, the reaction across the community was almost universally positive. For years, security researchers had warned that package installation had become one of the weakest links in the JavaScript supply chain. Every npm install represented an opportunity for third-party code to execute automatically, often before developers had even looked at the source they were downloading.

TL;DR: When AI-assisted development moved from autocomplete to agentic workflows, the bottleneck for our engineering velocity stopped being the model and started being the vendor. Owning our own orchestration layer, running the same upstream agent stack across multiple developer surfaces, wrapping every change in a version-controlled spec, and treating the agent calls themselves as first-class telemetry is what made spec-driven development practical for us at NodeSource.

Node.js 24 is the latest Long-Term Support release, and Node.js 26 is the Current release line. Node.js 18 and Node.js 20, meanwhile, have both reached End-of-Life (EOL). That should make the direction of travel obvious. Instead, Matteo Collina’s analysis of Node.js download data showed that even discontinued Node.js 12, 14, and 16 release lines were still generating tens of millions of downloads per month, highlighting how slowly the ecosystem moves away from unsupported versions.

For years, the Node.js community has typed the same command billions of times: It's probably the most frequently executed command in the JavaScript ecosystem. We use it to start new projects, add dependencies, update existing ones, or simply bootstrap a development environment. It has become such a routine part of our workflow that most of us no longer stop to think about what actually happens during those few seconds while npm fills node_modules.