GitHub 每日趋势
GitHub 每日趋势订阅

nodejs/node

7

Node.js JavaScript runtime ✨🐢🚀✨

https://nodejs.org

Node.js

Node.js is an open-source, cross-platform JavaScript runtime environment.

For information on using Node.js, see the Node.js website.

The Node.js project uses an open governance model. The OpenJS Foundation provides support for the project.

Contributors are expected to act in a collaborative manner to move the project forward. We encourage the constructive exchange of contrary opinions and compromise. The TSC reserves the right to limit or block contributors who repeatedly act in ways that discourage, exhaust, or otherwise negatively affect other participants.

This project has a Code of Conduct.

Table of contents

Support

Looking for help? Check out the instructions for getting support.

Release types

Node.js follows semantic versioning.

  • Alpha: Under active development where semver-major changes are allowed. Each October, a new release line (for example, Node.js 27) branches off main and receives Alpha releases (for example, 27.0.0-alpha.0.0.0) for 6 months, then are promoted to Current (see below) each April. Alpha releases are signed, tagged, and tested through CITGM, but their API and ABI may change between releases. They are intended for library authors and CI pipelines, not for production use.
  • Current: Under active development, no semver-major changes allowed. Node.js releases a new major version once a year, in April. Releases stay Current for 6 months, then convert to LTS (see below) each October. Their ABI may change between releases. They are intended for library authors and CI pipelines, not for production use.
  • LTS: Releases under Long Term Support, with a focus on stability and security. Only changes that have been on Alpha or Current release for two weeks can be backported to a typical LTS release. Every major version becomes an LTS release, and receives 30 months of LTS support, for a total of 36 months from its first Current release to End-of-Life. LTS release lines have alphabetically-ordered code names, beginning with Node.js 4 Argon.
  • Nightly: Code from the main branch built every 24-hours when there are changes. Unlike Alpha releases, nightly builds are automated and untested. Use with caution.

Release lines up to and including Node.js 26 follow the previous schedule, where a new major version was released every 6 months and only even-numbered major versions became LTS. See the Node.js release schedule announcement for details.

For more information, see the Release README.

Download

Binaries, installers, and source tarballs are available at https://nodejs.org/en/download/.

Current and LTS releases

https://nodejs.org/download/release/

The latest directory is an alias for the latest Current release. The latest-codename directory is an alias for the latest release from an LTS line. For example, the latest-hydrogen directory contains the latest Hydrogen (Node.js 18) release.

Nightly releases

https://nodejs.org/download/nightly/

Each directory and filename includes the version (e.g., v22.0.0), followed by the UTC date (e.g., 20240424 for April 24, 2024), and the short commit SHA of the HEAD of the release (e.g., ddd0a9e494). For instance, a full directory name might look like v22.0.0-nightly20240424ddd0a9e494.

API documentation

Documentation for the latest Current release is at https://nodejs.org/api/. Version-specific documentation is available in each release directory in the docs subdirectory. Version-specific documentation is also at https://nodejs.org/download/docs/.

Verifying binaries

Download directories contain a SHASUMS256.txt.asc file with SHA checksums for the files and the releaser PGP signature.

You can get a trusted keyring from nodejs/release-keys, e.g. using curl:

curl -fsLo "/path/to/nodejs-keyring.kbx" "https://github.com/nodejs/release-keys/raw/HEAD/gpg/pubring.kbx"

Alternatively, you can import the releaser keys in your default keyring, see Release keys for commands on how to do that.

Then, you can verify the files you've downloaded locally (if you're using your default keyring, pass --keyring="${GNUPGHOME:-~/.gnupg}/pubring.kbx"):

curl -fsO "https://nodejs.org/dist/${VERSION}/SHASUMS256.txt.asc" \
&& gpgv --keyring="/path/to/nodejs-keyring.kbx" --output SHASUMS256.txt < SHASUMS256.txt.asc \
&& shasum --check SHASUMS256.txt --ignore-missing

Building Node.js

See BUILDING.md for instructions on how to build Node.js from source and a list of supported platforms.

Security

For information on reporting security vulnerabilities in Node.js, see SECURITY.md.

Contributing to Node.js

Current project team members

For information about the governance of the Node.js project, see GOVERNANCE.md.

TSC (Technical Steering Committee)

TSC voting members

TSC regular members

TSC emeriti members

TSC emeriti members

Collaborators

Emeriti

Collaborator emeriti

Collaborators follow the Collaborator Guide in maintaining the Node.js project.

Triagers

Triagers follow the Triage Guide when responding to new issues.

Release keys

Primary GPG keys for Node.js Releasers (some Releasers sign with subkeys):

  • Antoine du Hamel 5BE8A3F6C8A5C01D106C0AD820B1A390B168D356
  • Juan José Arboleda DD792F5973C6DE52C432CBDAC77ABFA00DDBF2B7
  • Marco Ippolito CC68F5A3106FF448322E48ED27F5E38D5B0A215F
  • Rafael Gonzaga 890C08DB8579162FEE0DF9DB8BEAB4DFCF555EF4
  • Richard Lau C82FA3AE1CBEDC6BE46B9360C43CEC45C17AB93C
  • Ruy Adorno 108F52B48DB57BB0CC439B2997B01419BD92F80A
  • Stewart X Addison 655F3B5C1FB3FA8D1A0CA6BDE4A7D232B936D2FD
  • Ulises Gascón A363A499291CBBC940DD62E41F10027AF002F8B0

You can use the keyring the project maintains at https://github.com/nodejs/release-keys/raw/refs/heads/main/gpg-only-active-keys/pubring.kbx. Alternatively, you can import them from a public key server. Have in mind that the project cannot guarantee the availability of the server nor the keys on that server.

gpg --keyserver hkps://keys.openpgp.org --recv-keys 5BE8A3F6C8A5C01D106C0AD820B1A390B168D356 # Antoine du Hamel
gpg --keyserver hkps://keys.openpgp.org --recv-keys DD792F5973C6DE52C432CBDAC77ABFA00DDBF2B7 # Juan José Arboleda
gpg --keyserver hkps://keys.openpgp.org --recv-keys CC68F5A3106FF448322E48ED27F5E38D5B0A215F # Marco Ippolito
gpg --keyserver hkps://keys.openpgp.org --recv-keys 890C08DB8579162FEE0DF9DB8BEAB4DFCF555EF4 # Rafael Gonzaga
gpg --keyserver hkps://keys.openpgp.org --recv-keys C82FA3AE1CBEDC6BE46B9360C43CEC45C17AB93C # Richard Lau
gpg --keyserver hkps://keys.openpgp.org --recv-keys 108F52B48DB57BB0CC439B2997B01419BD92F80A # Ruy Adorno
gpg --keyserver hkps://keys.openpgp.org --recv-keys 655F3B5C1FB3FA8D1A0CA6BDE4A7D232B936D2FD # Stewart X Addison
gpg --keyserver hkps://keys.openpgp.org --recv-keys A363A499291CBBC940DD62E41F10027AF002F8B0 # Ulises Gascón

See Verifying binaries for how to use these keys to verify a downloaded file.

Other keys used to sign some previous releases

  • Antoine du Hamel C0D6248439F1D5604AAFFB4021D900FFDB233756
  • Beth Griggs 4ED778F539E3634C779C87C6D7062848A1AB005C
  • Bryan English 141F07595B7B3FFE74309A937405533BE57C7D57
  • Chris Dickinson 9554F04D7259F04124DE6B476D5A82AC7E37093B
  • Colin Ihrig 94AE36675C464D64BAFA68DD7434390BDBE9B9C5
  • Danielle Adams 1C050899334244A8AF75E53792EF661D867B9DFA 74F12602B6F1C4E913FAA37AD3A89613643B6201
  • Evan Lucas B9AE9905FFD7803F25714661B63B535A4C206CA9
  • Gibson Fahnestock 77984A986EBC2AA786BC0F66B01FBB92821C587A
  • Isaac Z. Schlueter 93C7E9E91B49E432C2F75674B0A78B0A6C481CF6
  • Italo A. Casas 56730D5401028683275BD23C23EFEFE93C4CFFFE
  • James M Snell 71DCFD284A79C3B38668286BC97EC7A07EDE3FC1
  • Jeremiah Senkpiel FD3A5288F042B6850C66B31F09FE44734EB7990E
  • Juan José Arboleda 61FC681DFB92A079F1685E77973F295594EC4689
  • Julien Gilli 114F43EE0176B71C7BC219DD50A3051F888C628D
  • Michaël Zasso 8FCCA13FEF1D0C2E91008E09770F7A9A5AE15600
  • Myles Borins C4F0DFFF4E8C1A8236409D08E73BC641CC11F4C8
  • Rod Vagg DD8F2338BAE7501E3DD5AC78C273792F7D83545D
  • Ruben Bridgewater A48C2BEE680E841632CD4E44F07496B3EB3C1762
  • Shelley Vohr B9E2F5981AA6E0CD28160D9FF13993A75599653C
  • Timothy J Fontaine 7937DFD2AB06298B2293C3187D33FF9D0246406D

The project maintains a keyring able to verify all past releases of Node.js at https://github.com/nodejs/release-keys/raw/refs/heads/main/gpg/pubring.kbx.

Security release stewards

When possible, the commitment to take slots in the security release steward rotation is made by companies in order to ensure individuals who act as security stewards have the support and recognition from their employer to be able to prioritize security releases. Security release stewards manage security releases on a rotation basis as outlined in the security release process.

License

Node.js is licensed under the MIT License.

This project also depends on external libraries that may use different open-source licenses. For a complete list of included licenses, please see the LICENSE file.

If you are contributing documentation or source changes, please ensure your additions comply with the project’s license guidelines.

参与讨论