Node.js Collaboration Summit London 2026: HeroDevs Trip Report

In April 2026, I attended the Node.js (http://node.js) Collaboration Summit in London. The Collaboration Summit is where Node.js collaborators, working groups, and community members meet to discuss the project, align on maintenance work, and move important decisions forward in person.

This report focuses on the topics most relevant to HeroDevs and to teams running Node.js in production: release, sustainability, security response, long-term support, and migration readiness.

‍

What's changing in the Node.js release schedule starting with v27?

The most important session for HeroDevs covered the new Node.js release schedule. Starting with Node.js v27, all major versions are going to be LTS, not just even-numbered versions. Each version will also align with the calendar year of their initial current release, with Node.js v27 being released in 2027.

Node.js is maintained by a largely volunteer project, and managing security releases across four or five active release lines has become difficult to sustain. Reducing the number of concurrent release lines lets the project concentrate maintenance effort on the versions most users should be moving toward.

For enterprise users, the reassuring part is what stays the same:

- Long-Term Support remains about 30 months.
- Migration windows between LTS versions remain available.
- April Current releases and October LTS promotions remain predictable.
- Testing, CITGM, security processes, and quality expectations remain in place.
- Newer Node.js releases continue to track recent V8 versions.

Upstream Node.js needs a sustainable release model. Enterprise teams often need more time than the upstream schedule can provide. HeroDevs' Node.js NES exists in that gap: it gives organizations supported security continuity for older Node.js lines while upstream focuses on the active release lines, it can maintain well.

‍

How is AI-generated vulnerability noise affecting Node.js security?

The security session was the other major HeroDevs-relevant discussion. The Node.js security team has been improving threat modeling, permission models, release automation, and VEX work. At the same time, those improvements are being strained by a surge of low-signal, often AI-generated vulnerability reports.

Part of my work at HeroDevs involves evaluating vulnerability reports across enterprise open-source projects. AI has made it cheap to generate reports that look like real security findings: they cite real files, use the language of vulnerabilities, and often arrive with confident impact claims. Many still lack a viable threat model, a working reproduction, or basic domain understanding of how the project is deployed.

I wrote about this problem in more detail in "The AI Security Slop Problem".

Every noisy report takes time away from valid vulnerability analysis, patch development, CI validation, and coordinated releases. In Node.js, much of that triage happens through volunteer effort.

The summit discussion also covered VEX, or Vulnerability Exploitability eXchange, files. Scanners often raise false positives when they do not know whether a vulnerability is exploitable in a given package, runtime, or configuration. A better machine-readable security context can reduce alert fatigue and help customers focus on risks that actually affect them.

The group also discussed ways to improve the security process itself: higher signal requirements, clearer reporting guidelines, earlier access for proactive testing, better documentation to steer AI agents away from false positives, and possible public-security flow options for cases where embargoed coordination slows validation.

For HeroDevs, security support is not just patching an application; it requires triage, reproduction, impact analysis, careful backport decisions, release automation, clear customer-facing communication, and auditable release notes.

‍

What other Node.js initiatives were discussed at the Collaboration Summit?

The summit also covered the Next-10 survey and project health, collaboratorship and review capacity, AI-assisted contribution governance, OpenTelemetry and observability infrastructure, a proposed new Streams API, stabilization work for module customization hooks and `vm.Module`, libuv v2 planning, and a proposed Virtual File System.

Node.js needs to evolve its APIs, observability, governance, and platform internals while protecting the ecosystem that depends on it. These topics inform future compatibility work, customer migration paths, and the maintenance burden behind every supported runtime line.

‍

Final takeaway

HeroDevs' work depends on a healthy open-source ecosystem, so being present in events like the Node.js Collaboration Summit allows me to be part of the discussion, influence decisions, and learn from my peers. Long-term support is strongest when it stays close to the projects, the people, and the maintenance behind the software.

That is also part of what makes HeroDevs different from companies that extract value from open source without giving much back. HeroDevs employs maintainers and contributors who are already active in the ecosystems we support. In my case, that means bringing day-to-day Node.js project context into the work we do for customers, and bringing customer reality back into the broader conversation about maintenance, releases, and security.

The summit made that connection concrete. Every active release line adds work: backports, CI, security triage, embargo coordination, release builds, documentation, and communication. Customers need more time, security coverage, and clear release notes. Upstream maintainers need a sustainable release model. Node.js NES sits between those needs and has to serve both honestly.

‍

FAQ

When does Node.js v27 release?
Node.js v27 is scheduled for the April 2027 release, and will be the first version to follow the calendar-year versioning scheme.

Does the new release schedule shorten Node.js LTS?
No, LTS duration remains approximately 30 months, and the April Current / October LTS cadence is unchanged.

What happens to Node.js versions after they reach end-of-life?
Once a version reaches upstream EOL, it stops receiving security patches from the Node.js project. HeroDevs Never-Ending Support (NES) for Node.js provides continued security patches for organizations that need more time to migrate.