Marco Ippolito's Avatar

Marco Ippolito

@marcoippolito.dev

Security Engineer @herodevs | Node.js Technical Steering Committee & Release marcoippolito.dev

879
Followers
148
Following
208
Posts
03.11.2024
Joined
Posts Following

Latest posts by Marco Ippolito @marcoippolito.dev

Preview
Node.js — Node.js 22.22.1 (LTS) Node.js® is a free, open-source, cross-platform JavaScript runtime environment that lets developers create servers, web apps, command line tools and scripts.

Node.js v22.22.1 is out 🔥

Release notes 👇
nodejs.org/en/blog/rele...

05.03.2026 15:02 👍 16 🔁 4 💬 0 📌 0
Preview
Node.js — Node.js 20.20.1 (LTS) Node.js® is a free, open-source, cross-platform JavaScript runtime environment that lets developers create servers, web apps, command line tools and scripts.

Node.js v20.20.1 is out 🎉
This is the last planned release before v20 goes End-of-Life ❗

Release notes 👇
nodejs.org/en/blog/rele...

05.03.2026 14:51 👍 14 🔁 3 💬 0 📌 0

I just found out @deno.land throws the same error as Node.js when trying to run typescript in node_modules. That's cool 🙏
github.com/denoland/den...

12.02.2026 19:18 👍 2 🔁 0 💬 0 📌 0
Preview
The future of `--experimental-transform-types` · Issue #51 · nodejs/typescript I wanted to talk about the future of --experimental-transform-types. The feature has been stable for a while no outstanding issue. The problem with this flag is that the syntax supported might chan...

github.com/nodejs/types...

11.02.2026 17:32 👍 4 🔁 1 💬 0 📌 1

I proposed it a while ago, my idea was to use a github action that runs on PR and checks a few things:
- first pr on the repo
- edits the readme
- empty description

10.02.2026 15:33 👍 4 🔁 0 💬 0 📌 0
Preview
Node.js — Node.js 24.13.1 (LTS) Node.js® is a free, open-source, cross-platform JavaScript runtime environment that lets developers create servers, web apps, command line tools and scripts.

Node.js patch release day! Full changelog and download links at nodejs.org/en/blog/rele... and nodejs.org/en/blog/rele...

10.02.2026 14:20 👍 19 🔁 5 💬 0 📌 0

See you at #FOSDEM tomorrow 💚

30.01.2026 13:28 👍 1 🔁 0 💬 1 📌 0
Preview
Node.js — OpenSSL Security Advisory Assessment, January 2026 Node.js® is a free, open-source, cross-platform JavaScript runtime environment that lets developers create servers, web apps, command line tools and scripts.

🚨 Node.js assessment of the recent OpenSSL Security Release

TL;DR: We'll update OpenSSL versions through a regular release process.

nodejs.org/en/blog/vuln...

29.01.2026 12:53 👍 6 🔁 2 💬 0 📌 0

This just landed! Thanks @addaleax.bsky.social and @legendecas.bsky.social for the reviews! It will be out in the next semver-minor release of 25, and likely backportable to older LTS - the new workflow is a compatible improvement to the existing postject-based SEA building workflows from v18.x.

22.01.2026 22:53 👍 19 🔁 6 💬 0 📌 1
Post image

This account is now operating on a cats-only basis

14.01.2026 10:59 👍 12 🔁 0 💬 2 📌 0
Preview
Node.js — Tuesday, January 13, 2026 Security Releases Node.js® is a free, open-source, cross-platform JavaScript runtime environment that lets developers create servers, web apps, command line tools and scripts.

We appreciate your patience and understanding as we work to deliver a secure and reliable release.

Updates are now available for the 25.x, 24.x, 22.x, 20.x Node.js release lines to address:

- 3 high severity issues
- 4 medium severity issues
- 1 low severity issue

nodejs.org/en/blog/vuln...

13.01.2026 14:42 👍 65 🔁 26 💬 1 📌 2

Node.s sec release

We are doing our best. We are ensuring test passes on all platforms and all active release lines (v20, v22, v24 and v25) - and they aren't currently.

Unfortunately, we don't have an ETA for that, and it's likely that this security release will be postponed one more time. Sorry.

08.01.2026 20:53 👍 7 🔁 4 💬 0 📌 0
import { loadEnvFile } from 'node:process';

// load .env file with default path ('./.env`)
loadEnvFile();
// load .env file with a custom path
loadEnvFile('../../.env');

import { loadEnvFile } from 'node:process'; // load .env file with default path ('./.env`) loadEnvFile(); // load .env file with a custom path loadEnvFile('../../.env');

TIL that modern Node not only supports `--env-file` / `--env-file-if-exists` but also a new method to programmatically load .env files.

It's been marked stable since Node v24 (current LTS), and I'm now on the journey of removing all the `dotenv` dependencies. 😅

www.stefanjudis.com/today-i-lear...

06.01.2026 15:19 👍 96 🔁 15 💬 8 📌 1
Post image

Welcome Frieren 💜

05.01.2026 18:09 👍 5 🔁 0 💬 0 📌 0

Peak italian software

29.12.2025 09:17 👍 3 🔁 0 💬 1 📌 0
Preview
Sponsor @marco-ippolito on GitHub Sponsors Hi I'm Marco and I work on Node.js

Thank you @awscloud.bsky.social soooo much for sponsoring me on @github.com 🙏 what a present 🎁

github.com/sponsors/mar...

19.12.2025 08:32 👍 8 🔁 0 💬 0 📌 0
Preview
Node.js — Wednesday, January 7, 2026 Security Releases Node.js® is a free, open-source, cross-platform JavaScript runtime environment that lets developers create servers, web apps, command line tools and scripts.

⚠️ Node.js security release has been postponed ⚠️
We have decided to delay the security release further to January 7th 2026 to ensure the team has enough time to prepare the releases and avoid distruptions during the holiday season.
nodejs.org/en/blog/vuln...

17.12.2025 17:31 👍 16 🔁 3 💬 0 📌 0

⚠️ The security release has been postponed to the 18th of December. The team is working on a challenging patch.

15.12.2025 19:55 👍 19 🔁 4 💬 0 📌 0

YES 🔥🔥

10.12.2025 21:59 👍 2 🔁 0 💬 0 📌 0

Type stripping is stable in a LTS version 👽

10.12.2025 19:11 👍 44 🔁 6 💬 0 📌 0

oh true, I forgot 😄

10.12.2025 17:36 👍 2 🔁 0 💬 0 📌 0
Preview
Release 2025-12-10, Version 24.12.0 'Krypton' (LTS), @targos · nodejs/node Notable Changes [1a00b5f68a] - (SEMVER-MINOR) http: add optimizeEmptyRequests server option (Rafael Gonzaga) #59778 [ff5754077d] - (SEMVER-MINOR) lib: add options to util.deprecate (Rafael Gonzaga...

Type stripping landed in Node 24 LTS 40 minutes ago! Thanks @marcoippolito.dev!

github.com/nodejs/node/...

10.12.2025 17:33 👍 9 🔁 3 💬 1 📌 0
Preview
Node.js — Monday, December 15, 2025 Security Releases Node.js® is a free, open-source, cross-platform JavaScript runtime environment that lets developers create servers, web apps, command line tools and scripts.

❗️Node.js Security release pre-alert ❗️
We will release new versions of v20, v22, v24, v25 release lines on or shortly after the 15th of December 2025 in order to address:
* 3 high severity issues.
* 1 low severity issue.
* 1 medium severity issue.
nodejs.org/en/blog/vuln...

08.12.2025 17:50 👍 18 🔁 7 💬 0 📌 1
Preview
Node.js — Node.js v20.19.6 (LTS) Node.js® is a free, open-source, cross-platform JavaScript runtime environment that lets developers create servers, web apps, command line tools and scripts.

Node.js v20.19.6 is out 🥳

Release notes:
nodejs.org/en/blog/rele...

25.11.2025 13:17 👍 15 🔁 4 💬 0 📌 0

Oh no 😮‍💨

24.11.2025 10:46 👍 1 🔁 0 💬 2 📌 0

Node & TypeScript excitement 😉

Marco tells the story of implementing Type Stripping support in Node. It involves a lot of collaboration across the JS ecosystem.

🔷 First cut took 20 days (fast for Node)
🔷 TS delivered flags to ease adoption
🔷 Marco's reward: a bread machine

24.11.2025 09:20 👍 27 🔁 2 💬 2 📌 0

Just published a new blog post. It’s about my experience shipping Node.js native TypeScript support.

It’s not a technical blog post, it's about my perspective, what it felt like and what I learned along the way.

satanacchio.hashnode.dev/the-summer-i...

24.11.2025 08:14 👍 20 🔁 4 💬 2 📌 1
Post image Post image Post image

frfr

22.11.2025 08:27 👍 6 🔁 0 💬 0 📌 0
Frog and Toad illustration edited to say: Frog put the value in an option. "There", he said, "now we will not deref any more null pointers". "But we can unwrap the option," said Toad. "That is true", said Frog.

Frog and Toad illustration edited to say: Frog put the value in an option. "There", he said, "now we will not deref any more null pointers". "But we can unwrap the option," said Toad. "That is true", said Frog.

on type safety

14.06.2025 14:42 👍 494 🔁 92 💬 8 📌 2
Preview
--experimental-strip-types default value should depend on --without-amaro configure flag · Issue #60640 · nodejs/node Version git november 8 2025 Platform All... Subsystem No response What steps will reproduce the bug? Build with --without-amaro flag, several tests will fail (parallel/test-worker-syntax-error is a...

Good first issue in Node.js
github.com/nodejs/node/...

21.11.2025 06:26 👍 5 🔁 0 💬 0 📌 0