This is the changelog for 20.8.1, but it’s important to point out that that 4 of the CVEs were also patched in 18.18.2.
Shameless promotion time, I have a little utility that can check a node version for CVEs or EOL:
npx node-version-audit@latest --fail-security
Or with docker:
docker run --rm -t lightswitch05/node-version-audit:latest --version=$(node -e "console.log(process.versions.node)")
Some highlights of the tool is zero dependencies and CVEs are sourced directly from NPM changelogs instead of waiting on slow CVE release processes. See the website for more details: https://www.github.developerdan.com/node-version-audit/
It was already pretty performant. The issue is as always runtime type checking. For serious stuff you really want that. Also, async everything is not fun. Simple code executed in a thread pool or whatever is so much easier to reason about.
> Simple code executed in a thread pool or whatever is so much easier to reason about.
reply
Hard disagree. It's much easier to reason about async await because you don't need to worry about preemption. You (generally) don't need mutexes or anything like that.
When do you have to worry about synchronization? You don't. Pull DB connection from pool, etc, done.
Async await has colored functions, promises, and other atrocities.
Even if I have some locking primitives somewhere I'll GLADLY take that over the fucking mess of async stack traces and code executed "next tick" with no trace.
Rather than searching "node" on TechEmpower I do my own comparative benchmarks in a given environment.
Node always loses. Every time. To everything. It reliably loses to Java, Python, and even other JavaScript engines. Which is why I asked... performant compared to what?
Shameless promotion time, I have a little utility that can check a node version for CVEs or EOL:
Or with docker: Some highlights of the tool is zero dependencies and CVEs are sourced directly from NPM changelogs instead of waiting on slow CVE release processes. See the website for more details: https://www.github.developerdan.com/node-version-audit/