node

I'm not a lawyer, but three characters in package.json isn't sufficient. You need to include the license text - eg https://github.com/nodejs/node/blob/master/LICENSE.

There are always breaking changes waiting to go in (https://github.com/nodejs/node/labels/semver-major). Often they’re edge cases or native extension things though. Although the choice on when is arbitrary timing, the major bump does mean there are breaking changes. The nature of JS is that there are very few breaking changes allowed from an end-user perspective even between major versions.

The bug happened for setInterval() with any timeout (the bug report is for one with 500 milliseconds). The problem is that the function that returned the current time was overflowing a 32-bit integer, so interval calculations were messed up and setInteval() wouldn't fire. The fix[1] was simply to change an int to an unsigned int. [1] https://github.com/nodejs/node/pull/22214/commits/3bb7fdfbbe...

Seems similar to this beauty: https://github.com/nodejs/node/issues/12115

Here is the commit that fixes it: https://github.com/nodejs/node/pull/22214

TL;DR from the GitHub discussion: had to do with an integer overflow related to oxffffff hex string lengths and unsigned ints, introduced in one of the Node 10.x versions. This is the pull request that fixes it: https://github.com/nodejs/node/pull/22214

Node.js actually has separate docs[1]. The only documentation you'll find inline in our source is documentation for other developers working on the source. [1]: https://github.com/nodejs/node/tree/master/doc/api

There are a lot of busybodies on Github, sometimes these go viral on Twitter and other locations for the heated discussions. Here's a small collection of various levels of offence. Some are merely polite requests and some are "horribly offended". I think one or two of them may even be concern trolls but that doesn't matter since they still got the changes made. There are a few hundred other examples to pull from, these are just a few I chose at random while trying to select ones that are more about the code, or terms used in the code, than contributors or maintainers of the code. [0] https://github.com/WICG/feature-policy/issues/150 [1] https://github.com/NARKOZ/hacker-scripts/pull/152 [2] https://github.com/Droogans/unmaintainable-code/pull/20 [3] https://github.com/braydie/HowToBeAProgrammer/issues/68 [4] https://github.com/spencermount

> Explicit whitelisting for network access. > Explicit whitelisting for fs access. Would you (or anyone else reading this) be interested in exploring what that would look like for Node.js? (If you do, feel free to reach me at my email in https://github.com/nodejs/node under benjamingr) I think it would be interesting - one solution could be a loader (ESM) that only lets you load other "unprivileged" files by default - then importing things like `child_process` or `fs` could require more privilege. A little like how apps work. > A programmatic way to tell if the publisher of a module has 2FA enabled. I will bring this up. Personally I think I understand the objection of the reply below about this information being risky. That's something NPM likely can/should solve and not Node.js. For what it's worth GitHub orgs can already tell who has o

I think they're testing natively provided promise APIs with the fs module. https://github.com/nodejs/node/pull/18297 It's of course not a full promisification of every built in, but it looks like theyre at least trying it out.