Whattoeatnext — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited Whattoeatnext (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Node.js is an open-source, cross-platform JavaScript runtime environment.
For information on using Node.js, see the [Node.js website][].
The Node.js project uses an open governance model. The [OpenJS Foundation][] provides support for the project.
Contributors are expected to act in a collaborative manner to move the project forward. We encourage the constructive exchange of contrary opinions and compromise. The TSC reserves the right to limit or block contributors who repeatedly act in ways that discourage, exhaust, or otherwise negatively affect other participants.
This project has a [Code of Conduct][].
Looking for help? Check out the instructions for getting support.
branch for its major version number (for example, v22.x). Node.js releases a new major version every 6 months, allowing for breaking changes. This happens in April and October every year. Releases appearing each October have a support life of 8 months. Releases appearing each April convert to LTS (see below) each October.
and security. Every even-numbered major version will become an LTS release. LTS releases receive 12 months of _Active LTS_ support and a further 18 months of _Maintenance_. LTS release lines have alphabetically-ordered code names, beginning with v4 Argon. There are no breaking changes or feature additions, except in some special circumstances.
changes. Use with caution.
Current and LTS releases follow semantic versioning. A member of the Release Team signs each Current and LTS release. For more information, see the Release README.
Binaries, installers, and source tarballs are available at <https://nodejs.org/en/download/>.
#### Current and LTS releases
<https://nodejs.org/download/release/>
The latest directory is an alias for the latest Current release. The latest-_codename_ directory is an alias for the latest release from an LTS line. For example, the latest-hydrogen directory contains the latest Hydrogen (Node.js 18) release.
#### Nightly releases
<https://nodejs.org/download/nightly/>
Each directory name and filename contains a date (in UTC) and the commit SHA at the HEAD of the release.
#### API documentation
Documentation for the latest Current release is at <https://nodejs.org/api/>. Version-specific documentation is available in each release directory in the _docs_ subdirectory. Version-specific documentation is also at <https://nodejs.org/download/docs/>.
Download directories contain a SHASUMS256.txt file with SHA checksums for the files.
To download SHASUMS256.txt using curl:
curl -O https://nodejs.org/dist/vx.y.z/SHASUMS256.txtTo check that a downloaded file matches the checksum, run it through sha256sum with a command such as:
grep node-vx.y.z.tar.gz SHASUMS256.txt | sha256sum -c -For Current and LTS, the GPG detached signature of SHASUMS256.txt is in SHASUMS256.txt.sig. You can use it with gpg to verify the integrity of SHASUMS256.txt. You will first need to import the GPG keys of individuals authorized to create releases.
See Release keys for commands to import active release keys.
Next, download the SHASUMS256.txt.sig for the release:
curl -O https://nodejs.org/dist/vx.y.z/SHASUMS256.txt.sigThen use gpg --verify SHASUMS256.txt.sig SHASUMS256.txt to verify the file's signature.
See BUILDING.md for instructions on how to build Node.js from source and a list of supported platforms.
For information on reporting security vulnerabilities in Node.js, see SECURITY.md.
For information about the governance of the Node.js project, see GOVERNANCE.md.
<!-- node-core-utils and find-inactive-tsc.mjs depend on the format of the TSC list. If the format changes, those utilities need to be tested and updated. -->
#### TSC voting members
<!--lint disable prohibited-strings-->
Antoine du Hamel <<[email protected]>> (he/him)
Yagiz Nizipli <<[email protected]>> (he/him)
Benjamin Gruenbaum <<[email protected]>>
Ruben Bridgewater <<[email protected]>> (he/him)
Gireesh Punathil <<[email protected]>> (he/him)
James M Snell <<[email protected]>> (he/him)
Joyee Cheung <<[email protected]>> (she/her)
Chengzhong Wu <<[email protected]>> (he/him)
Marco Ippolito <<[email protected]>> (he/him)
Matteo Collina <<[email protected]>> (he/him)
Michael Dawson <<[email protected]>> (he/him)
Moshe Atlow <<[email protected]>> (he/him)
Rafael Gonzaga <<[email protected]>> (he/him)
Richard Lau <<[email protected]>>
Robert Nagy <<[email protected]>>
Ruy Adorno <<[email protected]>> (he/him)
Paolo Insogna <<[email protected]>> (he/him)
Michaël Zasso <<[email protected]>> (he/him)
Tobias Nießen <<[email protected]>> (he/him)
#### TSC regular members
Anatoli Papirovski <<[email protected]>> (he/him)
Beth Griggs <<[email protected]>> (she/her)
Ben Noordhuis <<[email protected]>>
Colin Ihrig <<[email protected]>> (he/him)
Shelley Vohr <<[email protected]>> (she/her)
Geoffrey Booth <<[email protected]>> (he/him)
Rich Trott <<[email protected]>> (he/him)
<details>
<summary>TSC emeriti members</summary>
#### TSC emeriti members
Anna Henningsen <<[email protected]>> (she/her)
Сковорода Никита Андреевич <<[email protected]>> (he/him)
Chris Dickinson <<[email protected]>>
Daniel Bevenius <<[email protected]>> (he/him)
Danielle Adams <<[email protected]>> (she/her)
Evan Lucas <<[email protected]>> (he/him)
Franziska Hinkelmann <<[email protected]>> (she/her)
Jeremiah Senkpiel <<[email protected]>> (he/they)
Gabriel Schulhof <<[email protected]>>
Gibson Fahnestock <<[email protected]>> (he/him)
Fedor Indutny <<[email protected]>>
Isaac Z. Schlueter <<[email protected]>>
Josh Gavant <<[email protected]>>
Mary Marchini <<[email protected]>> (she/her)
Brian White <<[email protected]>>
Myles Borins <<[email protected]>> (he/him)
Bryan Hughes <<[email protected]>>
Ali Ijaz Sheikh <<[email protected]>> (he/him)
Alexis Campailla <<[email protected]>>
Bert Belder <<[email protected]>>
Darshan Sen <<[email protected]>> (he/him)
Rod Vagg <<[email protected]>>
Sam Roberts <<[email protected]>>
Shigeki Ohtsu <<[email protected]>> (he/him)
Sakthipriyan Vairamani <<[email protected]>> (he/him)
Tiancheng "Timothy" Gu <<[email protected]>> (he/him)
Trevor Norris <<[email protected]>>
</details>
<!-- node-core-utils and find-inactive-collaborators.mjs depend on the format of the collaborator list. If the format changes, those utilities need to be tested and updated. -->
Anna Henningsen <<[email protected]>> (she/her)
Antoine du Hamel <<[email protected]>> (he/him) - Support me
Yagiz Nizipli <<[email protected]>> (he/him) - Support me
Anatoli Papirovski <<[email protected]>> (he/him)
Chemi Atlow <<[email protected]>> (he/him)
Qingyu Deng <<[email protected]>>
Bryan English <<[email protected]>> (he/him)
Benjamin Gruenbaum <<[email protected]>>
Beth Griggs <<[email protected]>> (she/her)
Tierney Cyren <<[email protected]>> (they/them)
Ben Noordhuis <<[email protected]>>
Ruben Bridgewater <<[email protected]>> (he/him)
Christian Clauss <<[email protected]>> (he/him)
Colin Ihrig <<[email protected]>> (he/him)
Shelley Vohr <<[email protected]>> (she/her)
Kohei Ueno <<[email protected]>> (he/him)
Daeyeon Jeong <<[email protected]>> (he/him)
Danielle Adams <<[email protected]>> (she/her)
Debadree Chatterjee <<[email protected]>> (he/him)
Deokjin Kim <<[email protected]>> (he/him)
Adrian Estrada <<[email protected]>> (he/him)
Erick Wendel <<[email protected]>> (he/him)
Ethan Arrowood <<[email protected]>> (he/him)
Feng Yu <<[email protected]>> (he/him)
Franziska Hinkelmann <<[email protected]>> (she/her)
Gerhard Stöbich <<[email protected]>> (he/they)
Gabriel Schulhof <<[email protected]>>
Jiawen Geng <<[email protected]>>
Geoffrey Booth <<[email protected]>> (he/him)
Gireesh Punathil <<[email protected]>> (he/him)
Guy Bedford <<[email protected]>> (he/him)
Vinícius Lourenço Claro Cardoso <<[email protected]>> (he/him)
Harshitha K P <<[email protected]>> (she/her)
Zeyu "Alex" Yang <<[email protected]>> (he/him)
Jake Yuesong Li <<[email protected]>> (he/him)
Jacob Smith <<[email protected]>> (he/him)
James M Snell <<[email protected]>> (he/him)
Jan Krems <<[email protected]>> (he/him)
Joe Sepi <<[email protected]>> (he/him)
Joyee Cheung <<[email protected]>> (she/her)
Juan José Arboleda <<[email protected]>> (he/him)
Minwoo Jung <<[email protected]>> (he/him)
Matthew Aitken <<[email protected]>> (he/him)
Keyhan Vakil <<[email protected]>>
Chengzhong Wu <<[email protected]>> (he/him)
Daniel Lemire <<[email protected]>>
Nitzan Uziely <<[email protected]>>
LiviaMedeiros <<[email protected]>>
Luigi Pinca <<[email protected]>> (he/him)
Luke Karrys <<[email protected]>> (he/him)
Zijian Liu <<[email protected]>> (he/him)
Marco Ippolito <<[email protected]>> (he/him) - Support me
Akhil Marsonya <<[email protected]>> (he/him)
Mattias Buelens <<[email protected]>> (he/him)
Matteo Collina <<[email protected]>> (he/him) - Support me
Xuguang Mei <<[email protected]>> (he/him)
Michael Dawson <<[email protected]>> (he/him)
Alba Mendez <<[email protected]>> (she/her)
Moshe Atlow <<[email protected]>> (he/him)
Jithil P Ponnan <<[email protected]>> (he/him)
Claudio Wunder <<[email protected]>> (he/they)
Filip Skokan <<[email protected]>> (he/him)
Tim Perry <<[email protected]>> (he/him)
Stephen Belanger <<[email protected]>> (he/him)
Rafael Gonzaga <<[email protected]>> (he/him)
Richard Lau <<[email protected]>>
Raz Luvaton <<[email protected]>> (he/him)
Robert Nagy <<[email protected]>>
Ruy Adorno <<[email protected]>> (he/him)
Santiago Gimeno <<[email protected]>>
Paolo Insogna <<[email protected]>> (he/him)
Steven R Loomis <<[email protected]>>
Stefan Stojanovic <<[email protected]>> (he/him)
Stewart X Addison <<[email protected]>> (he/him)
Michaël Zasso <<[email protected]>> (he/him)
theanarkh <<[email protected]>> (he/him)
Tobias Nießen <<[email protected]>> (he/him)
Trivikram Kamat <<[email protected]>>
Rich Trott <<[email protected]>> (he/him)
Ulises Gascón <<[email protected]>> (he/him)
Vladimir Morozov <<[email protected]>> (he/him)
Mohammed Keyvanzadeh <<[email protected]>> (he/him)
Daijiro Wachi <<[email protected]>> (he/him)
Cheng Zhao <<[email protected]>> (he/him)
Yongsheng Zhang <<[email protected]>> (he/him)
<details>
<summary>Emeriti</summary>
<!-- find-inactive-collaborators.mjs depends on the format of the emeriti list. If the format changes, those utilities need to be tested and updated. -->
Aleksei Koziatinskii <<[email protected]>>
Andras <<[email protected]>>
Andreas Madsen <<[email protected]>> (he/him)
Anna M. Kedzierska <<[email protected]>>
Anto Aravinth <<[email protected]>> (he/him)
Alexey Orlenko <<[email protected]>> (he/him)
Ash Cripps <<[email protected]>>
Ben Coe <<[email protected]>> (he/him)
Bradley Farias <<[email protected]>>
Benedikt Meurer <<[email protected]>>
Christopher Hiller <<[email protected]>> (he/him)
Brendan Ashworth <<[email protected]>>
Bartosz Sosnowski <<[email protected]>>
Calvin Metcalf <<[email protected]>>
Сковорода Никита Андреевич <<[email protected]>> (he/him)
Chris Dickinson <<[email protected]>>
Claudio Rodriguez <<[email protected]>>
Daniel Bevenius <<[email protected]>> (he/him)
David Cai <<[email protected]>> (he/him)
Jamie Davis <<[email protected]>> (he/him)
David Carlier <<[email protected]>>
Gus Caplan <<[email protected]>> (they/them)
Hitesh Kanwathirtha <<[email protected]>> (he/him)
Xu Meng <<[email protected]>> (he/him)
dnlup <<[email protected]>>
Robert Jefe Lindstaedt <<[email protected]>>
Alexander Makarenko <<[email protected]>>
Eugene Ostroukhov <<[email protected]>>
Evan Lucas <<[email protected]>> (he/him)
Daniel Wang <<[email protected]>>
Jeremiah Senkpiel <<[email protected]>> (he/they)
George Adams <<[email protected]>> (he/him)
Wyatt Preul <<[email protected]>>
Gibson Fahnestock <<[email protected]>> (he/him)
Glen Keane <<[email protected]>> (he/him)
Yang Guo <<[email protected]>> (he/him)
Yuta Hiroto <<[email protected]>> (he/him)
Ian Sutherland <<[email protected]>>
Rebecca Turner <<[email protected]>>
Imran Iqbal <<[email protected]>>
Ilkka Myller <<[email protected]>>
Fedor Indutny <<[email protected]>>
Isaac Z. Schlueter <<[email protected]>>
Italo A. Casas <<[email protected]>> (he/him)
Jackson Tian <<[email protected]>>
Jason Ginchereau <<[email protected]>>
Johan Bergström <<[email protected]>>
John-David Dalton <<[email protected]>>
Yuval Brik <<[email protected]>>
João Reis <<[email protected]>>
Josh Gavant <<[email protected]>>
Julian Duque <<[email protected]>> (he/him)
Kyle Farnung <<[email protected]>> (he/him)
Kunal Pathak <<[email protected]>>
Yoshiki Kurihara <<[email protected]>> (he/him)
Lance Ball <<[email protected]>> (he/him)
Shingo Inoue <<[email protected]>> (he/him)
Luca Maraschi <<[email protected]>> (he/him)
Denys Otrishko <<[email protected]>> (he/him)
Aleksey Smolenchuk <<[email protected]>>
Jon Moss <<[email protected]>> (he/him)
Mathias Buus <<[email protected]>> (he/him)
Matthew Loring <<[email protected]>>
Mestery <<[email protected]>> (he/him)
Nicu Micleușanu <<[email protected]>> (he/him)
Mikeal Rogers <<[email protected]>>
Milad Fa <<[email protected]>> (he/him)
Julien Gilli <<[email protected]>>
Mary Marchini <<[email protected]>> (she/her)
Christopher Monsanto <<[email protected]>>
Chen Gang <<[email protected]>>
Brian White <<[email protected]>>
Myles Borins <<[email protected]>> (he/him)
Teddy Katz <<[email protected]>> (he/him)
Ali Ijaz Sheikh <<[email protected]>> (he/him)
Oleg Elifantiev <<[email protected]>>
Alexis Campailla <<[email protected]>>
Forrest L Norvell <<[email protected]>> (they/them/themself)
Ouyang Yadong <<[email protected]>> (he/him)
Petka Antonov <<[email protected]>>
Phillip Johnsen <<[email protected]>>
Bert Belder <<[email protected]>>
Minqi Pan <<[email protected]>>
Pooja D P <<[email protected]>> (she/her)
Prince John Wesley <<[email protected]>>
Peter Marshall <<[email protected]>> (he/him)
Andrey Pechkurov <<[email protected]>> (he/him)
Darshan Sen <<[email protected]>> (he/him)
Refael Ackermann (רפאל פלחי) <<[email protected]>> (he/him/הוא/אתה)
Pranshu Srivastava <<[email protected]>> (he/him)
Ricky Zhou <<[email protected]>> (he/him)
Alex Kocharin <<[email protected]>>
Ryan Graham <<[email protected]>>
Robert Kowalski <<[email protected]>>
Roman Klauke <<[email protected]>>
Ron Korving <<[email protected]>>
Ingvar Stepanyan <<[email protected]>>
Sam Ruby <<[email protected]>>
Rod Vagg <<[email protected]>>
Ujjwal Sharma <<[email protected]>> (he/him)
Saúl Ibarra Corretgé <<[email protected]>>
Sam Roberts <<[email protected]>>
Sebastiaan Deckers <<[email protected]>>
Nikolai Vavilov <<[email protected]>>
Shigeki Ohtsu <<[email protected]>> (he/him)
Masashi Hirano <<[email protected]>> (he/him)
Roman Reiss <<[email protected]>>
Weijia Wang <<[email protected]>>
Stefan Budeanu <<[email protected]>>
Christian Tellnes <<[email protected]>>
Sakthipriyan Vairamani <<[email protected]>> (he/him)
Thorsten Lorenz <<[email protected]>>
Tiancheng "Timothy" Gu <<[email protected]>> (he/him)
Trevor Norris <<[email protected]>>
Mike Tunnicliffe <<[email protected]>>
Vladimir de Turckheim <<[email protected]>> (he/him)
Vladimir Kurchatkin <<[email protected]>>
Vse Mozhet Byt <<[email protected]>> (he/him)
Thomas Watson <<[email protected]>>
Jeremy Whitlock <<[email protected]>>
Khaidi Chu <<[email protected]>> (he/him)
Yash Ladha <<[email protected]>> (he/him)
Yihong Wang <<[email protected]>>
Yorkie Liu <<[email protected]>>
Yosuke Furukawa <<[email protected]>>
</details>
<!--lint enable prohibited-strings-->
Collaborators follow the Collaborator Guide in maintaining the Node.js project.
Chemi Atlow <<[email protected]>> (he/him)
Qingyu Deng <<[email protected]>>
Brian Muenzenmeyer <<[email protected]>> (he/him)
Oliver Medhurst <<[email protected]>> (they/them)
Daeyeon Jeong <<[email protected]>> (he/him)
Feng Yu <<[email protected]>> (he/him)
Gireesh Punathil <<[email protected]>> (he/him)
Frank Qiu <<[email protected]>> (he/him)
Kevin Eady <<[email protected]>> (he/him)
Keyhan Vakil <<[email protected]>>
Akhil Marsonya <<[email protected]>> (he/him)
Xuguang Mei <<[email protected]>> (he/him)
Mert Can Altin <<[email protected]>>
Preveen Padmanabhan <<[email protected]>> (he/him)
Aviv Keller <<[email protected]>> (they/them)
Mohammed Keyvanzadeh <<[email protected]>> (he/him)
Triagers follow the Triage Guide when responding to new issues.
Primary GPG keys for Node.js Releasers (some Releasers sign with subkeys):
4ED778F539E3634C779C87C6D7062848A1AB005C
141F07595B7B3FFE74309A937405533BE57C7D57
74F12602B6F1C4E913FAA37AD3A89613643B6201
DD792F5973C6DE52C432CBDAC77ABFA00DDBF2B7
CC68F5A3106FF448322E48ED27F5E38D5B0A215F
8FCCA13FEF1D0C2E91008E09770F7A9A5AE15600
890C08DB8579162FEE0DF9DB8BEAB4DFCF555EF4
C82FA3AE1CBEDC6BE46B9360C43CEC45C17AB93C
108F52B48DB57BB0CC439B2997B01419BD92F80A
A363A499291CBBC940DD62E41F10027AF002F8B0
To import the full set of trusted release keys (including subkeys possibly used to sign releases):
gpg --keyserver hkps://keys.openpgp.org --recv-keys 4ED778F539E3634C779C87C6D7062848A1AB005C # Beth Griggs
gpg --keyserver hkps://keys.openpgp.org --recv-keys 141F07595B7B3FFE74309A937405533BE57C7D57 # Bryan English
gpg --keyserver hkps://keys.openpgp.org --recv-keys 74F12602B6F1C4E913FAA37AD3A89613643B6201 # Danielle Adams
gpg --keyserver hkps://keys.openpgp.org --recv-keys DD792F5973C6DE52C432CBDAC77ABFA00DDBF2B7 # Juan José Arboleda
gpg --keyserver hkps://keys.openpgp.org --recv-keys CC68F5A3106FF448322E48ED27F5E38D5B0A215F # Marco Ippolito
gpg --keyserver hkps://keys.openpgp.org --recv-keys 8FCCA13FEF1D0C2E91008E09770F7A9A5AE15600 # Michaël Zasso
gpg --keyserver hkps://keys.openpgp.org --recv-keys 890C08DB8579162FEE0DF9DB8BEAB4DFCF555EF4 # Rafael Gonzaga
gpg --keyserver hkps://keys.openpgp.org --recv-keys C82FA3AE1CBEDC6BE46B9360C43CEC45C17AB93C # Richard Lau
gpg --keyserver hkps://keys.openpgp.org --recv-keys 108F52B48DB57BB0CC439B2997B01419BD92F80A # Ruy Adorno
gpg --keyserver hkps://keys.openpgp.org --recv-keys A363A499291CBBC940DD62E41F10027AF002F8B0 # Ulises GascónSee Verifying binaries for how to use these keys to verify a downloaded file.
<details>
<summary>Other keys used to sign some previous releases</summary>
9554F04D7259F04124DE6B476D5A82AC7E37093B
94AE36675C464D64BAFA68DD7434390BDBE9B9C5
1C050899334244A8AF75E53792EF661D867B9DFA
B9AE9905FFD7803F25714661B63B535A4C206CA9
77984A986EBC2AA786BC0F66B01FBB92821C587A
93C7E9E91B49E432C2F75674B0A78B0A6C481CF6
56730D5401028683275BD23C23EFEFE93C4CFFFE
71DCFD284A79C3B38668286BC97EC7A07EDE3FC1
FD3A5288F042B6850C66B31F09FE44734EB7990E
61FC681DFB92A079F1685E77973F295594EC4689
114F43EE0176B71C7BC219DD50A3051F888C628D
C4F0DFFF4E8C1A8236409D08E73BC641CC11F4C8
DD8F2338BAE7501E3DD5AC78C273792F7D83545D
A48C2BEE680E841632CD4E44F07496B3EB3C1762
B9E2F5981AA6E0CD28160D9FF13993A75599653C
7937DFD2AB06298B2293C3187D33FF9D0246406D
</details>
When possible, the commitment to take slots in the security release steward rotation is made by companies in order to ensure individuals who act as security stewards have the support and recognition from their employer to be able to prioritize security releases. Security release stewards manage security releases on a rotation basis as outlined in the security release process.
Bryan English <<[email protected]>> (he/him)
Juan José Arboleda <<[email protected]>> (he/him)
Rafael Gonzaga <<[email protected]>> (he/him)
Matteo Collina <<[email protected]>> (he/him)
Joe Sepi <<[email protected]>> (he/him)
Michael Dawson <<[email protected]>> (he/him)
Node.js is available under the MIT license. Node.js also includes external libraries that are available under a variety of licenses. See LICENSE for the full license text.
[Code of Conduct]: https://github.com/nodejs/admin/blob/HEAD/CODE_OF_CONDUCT.md [Contributing to the project]: CONTRIBUTING.md [Node.js website]: https://nodejs.org/ [OpenJS Foundation]: https://openjsf.org/ [Strategic initiatives]: doc/contributing/strategic-initiatives.md [Technical values and prioritization]: doc/contributing/technical-values.md [Working Groups]: https://github.com/nodejs/TSC/blob/HEAD/WORKING_GROUPS.md
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.