We Don’t Just Support Node.js — We Help Build It

When organizations evaluate end-of-life (EOL) support for open source software, they’re often told the same thing: “We can support it.”

The more important question is rarely asked:

Who is actually qualified to do that work?

At HeroDevs, Node.js support isn’t something we added after the fact. It’s a continuation of work our engineers already do upstream. We don’t just run Node.js in production. We help build, secure, and release it.

That distinction matters — especially when Node.js reaches end of life.

‍

Open Source Support Is Only as Strong as the People Behind It

Most companies that sell open source support are consumers of open source. They rely on publicly available patches, advisories, and community fixes.

That works — until it doesn’t.

When a project like Node.js reaches end of life:

• There are no upstream security patches
• No free CVE remediation
• No community-maintained fixes

At that point, effective support requires deep knowledge of:

• Node.js internals
• Release engineering processes
• Security backporting
• Ecosystem-wide impact

That level of expertise doesn’t come from using Node.js.
It comes from maintaining it.

‍

HeroDevs Is a Top Organizational Contributor to Node.js

HeroDevs is one of the top organizations contributing to the Node.js project, ranked alongside companies like Cloudflare, NodeSource, and Bloomberg.

Our engineers contribute directly to:

• Node.js core
• Security fixes
• Release engineering
• Standards and ecosystem governance

This isn’t marketing language — it’s visible, measurable contribution activity recognized by the Node.js project itself.

HeroDevs isn’t adjacent to the Node.js ecosystem.
We are part of it.

‍

Meet the People Behind the Commits

Marco Ippolito

Marco Ippolito is a Senior Security Engineer at HeroDevs and a core contributor to Node.js.

His roles include:

• Node.js Technical Steering Committee member
• Official Node.js Releaser
• OpenJS Foundation CPC member
• TC39 delegate
• International JavaScript and Node.js conference speaker

Marco helps decide what ships in Node.js. He works on security, release processes, and standards that shape the platform used by millions of applications worldwide.

Now, that same expertise is applied to securing Node.js after end of life.

Learn more:

• https://www.marcoippolito.dev/

‍

Juan José Arboleda

Juan José Arboleda is a Senior Software Engineer at HeroDevs and a long-time Node.js contributor.

Juan brings:

• Years of hands-on Node.js engineering experience
• Deep familiarity with Node.js tooling and infrastructure
• Prior experience at NodeSource
• Real-world production insight across the Node.js ecosystem

His work bridges upstream development and downstream reliability — exactly what’s required when supporting Node.js beyond its official lifecycle.

Learn more:

• https://juanarbol.co/

‍

Why This Matters for Node.js End-of-Life Support

When Node.js reaches end of life, the risk profile changes overnight.

New vulnerabilities continue to be discovered. Attackers don’t stop looking. Auditors don’t relax requirements.

But upstream fixes stop.

Supporting Node.js after EOL requires:

• Identifying vulnerabilities without upstream guidance
• Safely backporting fixes
• Understanding subtle runtime and ecosystem impacts
• Preserving stability in production systems

This is work best done by people who already understand the codebase — because they helped write it.

At HeroDevs, EOL support isn’t guesswork.
It’s a continuation of upstream stewardship.

‍

The Difference Between Consuming Open Source and Maintaining It

There’s a meaningful difference between:

• Supporting software you depend on
  and
• Supporting software you help maintain

HeroDevs’ Node.js expertise comes from:

• Shipping releases
• Reviewing security changes
• Participating in governance decisions
• Understanding long-term design tradeoffs

That depth is difficult to replicate — and impossible to fake.

‍

What This Means for Organizations Running Node.js in Production

For teams running Node.js in production environments, especially regulated or security-sensitive ones, this translates to:

• Faster, safer CVE remediation after EOL
• Reduced risk of breaking changes during security fixes
• Greater confidence during audits and compliance reviews
• No forced upgrades or rushed migrations

When Node.js reaches end of life, the safest path forward is working with the people who already know it best.

‍

FAQ: HeroDevs, Node.js, and End-of-Life Support

Who contributes to the Node.js project?

The Node.js project is maintained by a global community of individual contributors and organizations. Contributors include maintainers, release engineers, security experts, and working group members who help design, secure, and ship Node.js releases.

‍

Is HeroDevs a contributor to Node.js?

Yes. HeroDevs is one of the top organizational contributors to the Node.js project, contributing code, security fixes, and release engineering work directly upstream.

‍

Does HeroDevs employ Node.js maintainers?

Yes. HeroDevs employs recognized Node.js leaders, including members of the Node.js Technical Steering Committee and official Node.js release engineers.

‍

Who is Marco Ippolito?

Marco Ippolito is a Senior Security Engineer at HeroDevs, a Node.js Technical Steering Committee member, a Node.js Releaser, an OpenJS Foundation CPC member, and a TC39 delegate.

‍

Who is Juan José Arboleda?

Juan José Arboleda is a Senior Software Engineer at HeroDevs and a long-time Node.js contributor with deep experience across Node.js tooling and infrastructure.

‍

Why does open source contribution matter for Node.js end-of-life support?

After Node.js reaches end of life, there are no upstream security patches. Contributors and maintainers are uniquely qualified to backport fixes safely and remediate vulnerabilities without introducing instability.

‍

Is Node.js still safe to run after end of life?

Running Node.js after end of life without security coverage introduces increasing security and compliance risk. Extended support is typically required for regulated or high-risk environments.

‍

What options do teams have when Node.js reaches end of life?

Teams generally have three options:

1. Migrate to a newer Node.js version
2. Rewrite or replatform applications
3. Use extended security support to remain protected while planning future upgrades

‍

Does HeroDevs provide extended support for Node.js?

Yes. HeroDevs offers Never-Ending Support (NES) for Node.js, providing post–end-of-life security patches, CVE remediation, and ongoing maintenance without requiring immediate upgrades.

‍

Bottom Line

Node.js end of life doesn’t mean Node.js stops running.
It means the responsibility shifts.

At HeroDevs, that responsibility is carried by engineers who already help build and secure Node.js upstream.

We don’t just support Node.js.We help maintain its future — even after official support ends.