Node Weekly issue 628 covers major npm v12 security changes: install scripts (preinstall, install, postinstall) will no longer run by default, and git/remote URL resolution will be disabled unless explicitly allowed. npm 11.16.0 is available now to preview what v12 will block. Other highlights include upcoming Node.js security releases for v22/24/26 (HIGH severity), Drizzle ORM being blocked from publishing due to npm's 100MB metadata limit, and several library releases including Commander.js 15.0 (now ESM-only), Cucumber.js 13.0 (parallel runtime rebuilt on worker threads), and Kanel 4.0 (TypeScript types from Postgres).
5.5K Impressions