v4.13.5 v24.20.0

medium risk

smicallef/spiderfootAug 26, 2026 → Aug 26, 20261 day between releases

What's New

Introduces AsyncLocalStorage scopes, package maps, and permission drop API in this LTS release.

Breaking Changes

  • permission.drop API added
  • Package maps implementation
  • AsyncLocalStorage scopes added
  • Buffer end parameter added
  • permission-audit flag added

New Features

  • AsyncLocalStorage using scopes
  • Package maps implementation
  • Permission drop API
  • WebAssembly JSPI support
  • node:stream/iter implementation

Improvements

  • Update root certificates to NSS 3.125
  • AsyncLocalStorage using scopes for better resource management
  • Package maps for more flexible module resolution
  • Permission drop API for granular access control
  • WebAssembly JSPI support

Upgrade Notes

Review configuration for the new permission model and package maps. Ensure code using AsyncLocalStorage handles the new scopes correctly.

The Two Releases

v4.13.5

v4.13.5

Aug 26, 2026· 2 months ago

This release patches multiple security vulnerabilities including a query parser fragment handling issue, a Static Site Generation path containment flaw, and a potential memory exhaustion bug in body parsing.

Full release notes
v24.20.0

2026-08-26, Version 24.20.0 'Krypton' (LTS), @aduh95

Aug 26, 2026· 2 months ago

The latest Long Term Support (LTS) release featuring significant updates to the permission model, module loading, and WebAssembly support.

Full release notes