Joyee Cheung
@joyeecheung.bsky.social
She/her. I contribute to Node.js and V8. I post about museums, food, plants and other stuff too. https://github.com/joyeecheung
This just landed! Thanks @addaleax.bsky.social and @legendecas.bsky.social for the reviews! It will be out in the next semver-minor release of 25, and likely backportable to older LTS - the new workflow is a compatible improvement to the existing postject-based SEA building workflows from v18.x.
Made some progress in my hobby project 🎄
Moving single executable application building into Node.js core for better UX/DX, currently works on macOS and Linux and open for feedback!
(No Windows yet because I don't take another laptop with me on vacation 😅) github.com/nodejs/node/...
Moving single executable application building into Node.js core for better UX/DX, currently works on macOS and Linux and open for feedback!
(No Windows yet because I don't take another laptop with me on vacation 😅) github.com/nodejs/node/...
[WIP] sea: generate single executable directly with Node.js binary by joyeecheung · Pull Request #61167 · nodejs/node
This is not yet ready for full review, as it lacks more documentation and tests. I've only tested this on macOS and Linux. For now, consider this as a POC for more feedback, especially the name...
github.com
January 22, 2026 at 10:53 PM
This just landed! Thanks @addaleax.bsky.social and @legendecas.bsky.social for the reviews! It will be out in the next semver-minor release of 25, and likely backportable to older LTS - the new workflow is a compatible improvement to the existing postject-based SEA building workflows from v18.x.
Reposted by Joyee Cheung
Good read. A submission to the European Commission's call for evidence on Towards European Open Digital Ecosystems (importance of OSS for EU tech sovereignty, security and competitiveness). It ends with:
> If you work in OSS, consider adding your voice. The feedback period ends February 3, 2026.
> If you work in OSS, consider adding your voice. The feedback period ends February 3, 2026.
> When governments buy Open Source services, the money rarely reaches the people who actually build and maintain it. Procurement rules favor large system integrators, not the maintainers of the software itself.
Funding Open Source for Digital Sovereignty
Open Source alone won't deliver digital sovereignty. Europe must fix procurement and fund those who actually build it.
dri.es
January 21, 2026 at 5:30 PM
Good read. A submission to the European Commission's call for evidence on Towards European Open Digital Ecosystems (importance of OSS for EU tech sovereignty, security and competitiveness). It ends with:
> If you work in OSS, consider adding your voice. The feedback period ends February 3, 2026.
> If you work in OSS, consider adding your voice. The feedback period ends February 3, 2026.
Now is the time to realize I have been compiling with host arch = x64 the whole time because for whatever reason I have been using x64 python the whole time to run the configure script 😅
Installed Parallels since I wanted to play some Windows-only games anyway and tried building it on Windows ARM64, which miraculously compiled without much effort, and I got it to work on Windows before heading to new year's eve dinner 🎊
January 19, 2026 at 11:30 PM
Now is the time to realize I have been compiling with host arch = x64 the whole time because for whatever reason I have been using x64 python the whole time to run the configure script 😅
This release contains a bunch of PRs I recently submitted to mark features I contributed to as stable/release candidate. Here is a thread about them 🧵:
Node.js v25.4.0 is out! 💚
• require(esm) now stable and a new CLI flag: --require-module
• http setGlobalProxyFromEnv() added
• Multiple APIs promoted to stable (heapsnapshot, build snapshot, v8.queryObjects)
• Root CAs updated to NSS 3.117
More in: nodejs.org/en/blog/rele...
• require(esm) now stable and a new CLI flag: --require-module
• http setGlobalProxyFromEnv() added
• Multiple APIs promoted to stable (heapsnapshot, build snapshot, v8.queryObjects)
• Root CAs updated to NSS 3.117
More in: nodejs.org/en/blog/rele...
nodejs.org
January 19, 2026 at 6:42 PM
This release contains a bunch of PRs I recently submitted to mark features I contributed to as stable/release candidate. Here is a thread about them 🧵:
Reposted by Joyee Cheung
This is a mitigation, not a guarantee.
Stack space exhaustion recovery is NOT specified by ECMAScript. V8 does it on a best-effort basis.
If the recursion depth can be controlled by attackers, explicitly limit the depth.
This is what the React and Next.js teams fixed in vercel.com/kb/bulletin/....
Stack space exhaustion recovery is NOT specified by ECMAScript. V8 does it on a best-effort basis.
If the recursion depth can be controlled by attackers, explicitly limit the depth.
This is what the React and Next.js teams fixed in vercel.com/kb/bulletin/....
January 13, 2026 at 6:50 PM
This is a mitigation, not a guarantee.
Stack space exhaustion recovery is NOT specified by ECMAScript. V8 does it on a best-effort basis.
If the recursion depth can be controlled by attackers, explicitly limit the depth.
This is what the React and Next.js teams fixed in vercel.com/kb/bulletin/....
Stack space exhaustion recovery is NOT specified by ECMAScript. V8 does it on a best-effort basis.
If the recursion depth can be controlled by attackers, explicitly limit the depth.
This is what the React and Next.js teams fixed in vercel.com/kb/bulletin/....
Reposted by Joyee Cheung
We appreciate your patience and understanding as we work to deliver a secure and reliable release.
Updates are now available for the 25.x, 24.x, 22.x, 20.x Node.js release lines to address:
- 3 high severity issues
- 4 medium severity issues
- 1 low severity issue
nodejs.org/en/blog/vuln...
Updates are now available for the 25.x, 24.x, 22.x, 20.x Node.js release lines to address:
- 3 high severity issues
- 4 medium severity issues
- 1 low severity issue
nodejs.org/en/blog/vuln...
Node.js — Tuesday, January 13, 2026 Security Releases
Node.js® is a free, open-source, cross-platform JavaScript runtime environment that lets developers create servers, web apps, command line tools and scripts.
nodejs.org
January 13, 2026 at 2:42 PM
We appreciate your patience and understanding as we work to deliver a secure and reliable release.
Updates are now available for the 25.x, 24.x, 22.x, 20.x Node.js release lines to address:
- 3 high severity issues
- 4 medium severity issues
- 1 low severity issue
nodejs.org/en/blog/vuln...
Updates are now available for the 25.x, 24.x, 22.x, 20.x Node.js release lines to address:
- 3 high severity issues
- 4 medium severity issues
- 1 low severity issue
nodejs.org/en/blog/vuln...
Reposted by Joyee Cheung
The Node.js package configuration guide is now live! 🎉
Whether you're creating your first package or migrating to ESM, this guide walks you through it with examples.
https://nodejs.github.io/package-examples
Whether you're creating your first package or migrating to ESM, this guide walks you through it with examples.
https://nodejs.github.io/package-examples
nodejs.github.io
January 8, 2026 at 9:02 PM
The Node.js package configuration guide is now live! 🎉
Whether you're creating your first package or migrating to ESM, this guide walks you through it with examples.
https://nodejs.github.io/package-examples
Whether you're creating your first package or migrating to ESM, this guide walks you through it with examples.
https://nodejs.github.io/package-examples
Finished two retrospective blog posts on the journey of require(esm) before 2025 ends:
joyeecheung.github.io/blog/2025/12...
joyeecheung.github.io/blog/2025/12...
joyeecheung.github.io/blog/2025/12...
joyeecheung.github.io/blog/2025/12...
require(esm) in Node.js: from experiment to stability
More than a year ago, I set out to revive require(esm) in Node.js and landed an experimental implementation. After a lot of iteration and battle-testing, require(esm) is now unflagged across all suppo
joyeecheung.github.io
December 30, 2025 at 7:04 PM
Finished two retrospective blog posts on the journey of require(esm) before 2025 ends:
joyeecheung.github.io/blog/2025/12...
joyeecheung.github.io/blog/2025/12...
joyeecheung.github.io/blog/2025/12...
joyeecheung.github.io/blog/2025/12...
Made some progress in my hobby project 🎄
Moving single executable application building into Node.js core for better UX/DX, currently works on macOS and Linux and open for feedback!
(No Windows yet because I don't take another laptop with me on vacation 😅) github.com/nodejs/node/...
Moving single executable application building into Node.js core for better UX/DX, currently works on macOS and Linux and open for feedback!
(No Windows yet because I don't take another laptop with me on vacation 😅) github.com/nodejs/node/...
[WIP] sea: generate single executable directly with Node.js binary by joyeecheung · Pull Request #61167 · nodejs/node
This is not yet ready for full review, as it lacks more documentation and tests. I've only tested this on macOS and Linux. For now, consider this as a POC for more feedback, especially the name...
github.com
December 24, 2025 at 5:49 PM
Made some progress in my hobby project 🎄
Moving single executable application building into Node.js core for better UX/DX, currently works on macOS and Linux and open for feedback!
(No Windows yet because I don't take another laptop with me on vacation 😅) github.com/nodejs/node/...
Moving single executable application building into Node.js core for better UX/DX, currently works on macOS and Linux and open for feedback!
(No Windows yet because I don't take another laptop with me on vacation 😅) github.com/nodejs/node/...
Good news: I am leaving cold and rainy weather for vacation
Bad news: it looks like the location I picked is still cold and rainy (just slightly less so)
Bad news: it looks like the location I picked is still cold and rainy (just slightly less so)
December 20, 2025 at 10:00 PM
Good news: I am leaving cold and rainy weather for vacation
Bad news: it looks like the location I picked is still cold and rainy (just slightly less so)
Bad news: it looks like the location I picked is still cold and rainy (just slightly less so)
When the reproducibility of a serialized object breaks and
1. It doesn’t show up in debug builds
2. There is no obvious pattern in how the bits change
Then that might be an uninitialised padding
(Spent a couple of hours trying to fix this again…after I forgot how I fixed something similar before)
1. It doesn’t show up in debug builds
2. There is no obvious pattern in how the bits change
Then that might be an uninitialised padding
(Spent a couple of hours trying to fix this again…after I forgot how I fixed something similar before)
December 17, 2025 at 11:56 PM
When the reproducibility of a serialized object breaks and
1. It doesn’t show up in debug builds
2. There is no obvious pattern in how the bits change
Then that might be an uninitialised padding
(Spent a couple of hours trying to fix this again…after I forgot how I fixed something similar before)
1. It doesn’t show up in debug builds
2. There is no obvious pattern in how the bits change
Then that might be an uninitialised padding
(Spent a couple of hours trying to fix this again…after I forgot how I fixed something similar before)
Reposted by Joyee Cheung
Does LLVM produce slower RISC-V code than GCC? Currently, yes.
Can we make LLVM produce faster code? Also, yes!
lukelau.me/2025/12/10/c...
#llvm #riscv
Can we make LLVM produce faster code? Also, yes!
lukelau.me/2025/12/10/c...
#llvm #riscv
Closing the LLVM RISC-V gap to GCC, part 1
At the time of writing, GCC beats Clang on several SPEC CPU 2017 benchmarks on RISC-V1: Compiled with -march=rva22u64_v -O3 -flto, running the train ↩
lukelau.me
December 10, 2025 at 2:42 PM
Does LLVM produce slower RISC-V code than GCC? Currently, yes.
Can we make LLVM produce faster code? Also, yes!
lukelau.me/2025/12/10/c...
#llvm #riscv
Can we make LLVM produce faster code? Also, yes!
lukelau.me/2025/12/10/c...
#llvm #riscv
Reposted by Joyee Cheung
Working in an enterprise setup with corporate proxies or custom CAs? Node.js has native support for that.
No external dependency required, just configure and continue 👍
Details: https://nodejs.org/en/learn/http/enterprise-network-configuration
No external dependency required, just configure and continue 👍
Details: https://nodejs.org/en/learn/http/enterprise-network-configuration
Node.js — Enterprise Network Configuration
Node.js® is a free, open-source, cross-platform JavaScript runtime environment that lets developers create servers, web apps, command line tools and scripts.
nodejs.org
December 10, 2025 at 3:32 PM
Working in an enterprise setup with corporate proxies or custom CAs? Node.js has native support for that.
No external dependency required, just configure and continue 👍
Details: https://nodejs.org/en/learn/http/enterprise-network-configuration
No external dependency required, just configure and continue 👍
Details: https://nodejs.org/en/learn/http/enterprise-network-configuration
WIP guide on making Node.js work in an enterprise network environment… github.com/nodejs/nodej... ⚒️
December 5, 2025 at 1:08 PM
WIP guide on making Node.js work in an enterprise network environment… github.com/nodejs/nodej... ⚒️
Reposted by Joyee Cheung
The changed code is a small fraction of an open source contribution. Your commitment to understand the issue, how your proposed solution fits with the project, and be ready to own and push the review process forward is the biggest chunk of the work. Your effort is the contribution, not the code.
December 5, 2025 at 9:58 AM
The changed code is a small fraction of an open source contribution. Your commitment to understand the issue, how your proposed solution fits with the project, and be ready to own and push the review process forward is the biggest chunk of the work. Your effort is the contribution, not the code.
Bumping the stability of a bunch of Node.js features that I've been contributing to...(some of them are about the time; some of them are just forgotten to be promoted to stable 😅)
December 5, 2025 at 11:34 AM
Bumping the stability of a bunch of Node.js features that I've been contributing to...(some of them are about the time; some of them are just forgotten to be promoted to stable 😅)
Got my new passport and said goodbye to the old one that was full 😬
Anecdote: I got my first passport to give a talk at NodeJS interactive in Austin, that was my first trip abroad, my first conference, my first conference talk, and my first English talk all at the same time
Anecdote: I got my first passport to give a talk at NodeJS interactive in Austin, that was my first trip abroad, my first conference, my first conference talk, and my first English talk all at the same time
December 3, 2025 at 7:55 AM
Got my new passport and said goodbye to the old one that was full 😬
Anecdote: I got my first passport to give a talk at NodeJS interactive in Austin, that was my first trip abroad, my first conference, my first conference talk, and my first English talk all at the same time
Anecdote: I got my first passport to give a talk at NodeJS interactive in Austin, that was my first trip abroad, my first conference, my first conference talk, and my first English talk all at the same time
Touring/climbing steps in Chongqing
November 22, 2025 at 3:59 PM
Touring/climbing steps in Chongqing
Today I gave a talk at JSConf JP covering the implementation story of recent Node.js module loader changes (compile cache, require(esm) and synchronous loader customization hooks). Very lovely conference!
Slides:
github.com/joyeecheung/...
Slides:
github.com/joyeecheung/...
github.com
November 16, 2025 at 3:17 PM
Today I gave a talk at JSConf JP covering the implementation story of recent Node.js module loader changes (compile cache, require(esm) and synchronous loader customization hooks). Very lovely conference!
Slides:
github.com/joyeecheung/...
Slides:
github.com/joyeecheung/...
Preparing my talk for JSConf JP and I finally drew my mental venn diagram about how Node.js development works 🤪
November 11, 2025 at 7:20 PM
Preparing my talk for JSConf JP and I finally drew my mental venn diagram about how Node.js development works 🤪
In an unexpected turn of events, this helped me reproduce a bug that can only be reproduced in a Linux arm64 container (not in bare-metal Linux arm64, or any other containers on other platforms 😅)
Uploaded a demo on how to use nodejs/devcontainer!
- Testing a mounted dev branch on a different OS
- No need to build V8 from scratch on a fresh checkout (usually)
- Testing third-party code with the dev branch in a container
www.youtube.com/watch?v=3Nwa...
PR: github.com/nodejs/node/...
- Testing a mounted dev branch on a different OS
- No need to build V8 from scratch on a fresh checkout (usually)
- Testing third-party code with the dev branch in a container
www.youtube.com/watch?v=3Nwa...
PR: github.com/nodejs/node/...
Demo of nodejs/devcontainer
YouTube video by Qiuyi Zhang (Joyee)
www.youtube.com
November 9, 2025 at 2:50 AM
In an unexpected turn of events, this helped me reproduce a bug that can only be reproduced in a Linux arm64 container (not in bare-metal Linux arm64, or any other containers on other platforms 😅)
Uploaded a demo on how to use nodejs/devcontainer!
- Testing a mounted dev branch on a different OS
- No need to build V8 from scratch on a fresh checkout (usually)
- Testing third-party code with the dev branch in a container
www.youtube.com/watch?v=3Nwa...
PR: github.com/nodejs/node/...
- Testing a mounted dev branch on a different OS
- No need to build V8 from scratch on a fresh checkout (usually)
- Testing third-party code with the dev branch in a container
www.youtube.com/watch?v=3Nwa...
PR: github.com/nodejs/node/...
Demo of nodejs/devcontainer
YouTube video by Qiuyi Zhang (Joyee)
www.youtube.com
October 28, 2025 at 11:15 PM
Uploaded a demo on how to use nodejs/devcontainer!
- Testing a mounted dev branch on a different OS
- No need to build V8 from scratch on a fresh checkout (usually)
- Testing third-party code with the dev branch in a container
www.youtube.com/watch?v=3Nwa...
PR: github.com/nodejs/node/...
- Testing a mounted dev branch on a different OS
- No need to build V8 from scratch on a fresh checkout (usually)
- Testing third-party code with the dev branch in a container
www.youtube.com/watch?v=3Nwa...
PR: github.com/nodejs/node/...
TIL git-restore-mtime, which is very handy when mounting a local clone to a clone in a docker container while still reusing the build cache from the docker image 😇 (otherwise all the files from the local clone would be too fresh and invalidate the build cache in the container)
October 22, 2025 at 7:59 PM
TIL git-restore-mtime, which is very handy when mounting a local clone to a clone in a docker container while still reusing the build cache from the docker image 😇 (otherwise all the files from the local clone would be too fresh and invalidate the build cache in the container)
Built-in HTTP proxies are now on v22 😇
(Going to update the version mentions in a WIP guide on using Node.js in enterprise network environments)
(Going to update the version mentions in a WIP guide on using Node.js in enterprise network environments)
Node.js v22.21.0 is out 🙌 Check out the notable changes here: nodejs.org/en/blog/rele...
Node.js — Node.js v22.21.0 (LTS)
Node.js® is a free, open-source, cross-platform JavaScript runtime environment that lets developers create servers, web apps, command line tools and scripts.
nodejs.org
October 21, 2025 at 7:05 PM
Built-in HTTP proxies are now on v22 😇
(Going to update the version mentions in a WIP guide on using Node.js in enterprise network environments)
(Going to update the version mentions in a WIP guide on using Node.js in enterprise network environments)
Stalled this PR for almost a year due to CI build cache issues, last week I realized (once again?) the Linux binary size is a bit out of hands and gave the CI another try, and the CI miraculously handled it , so finally landed this and shed of 8MB off the binaries at least github.com/nodejs/node/...
build: build v8 with -fvisibility=hidden -fvisibility-inlines-hidden by joyeecheung · Pull Request #56290 · nodejs/node
Split from #56275 since it seems to cause gcc on some machines in the CI to time out or run out of memory. Trying to see if it's just a CI hiccup or if it's something that needs to be worke...
github.com
October 20, 2025 at 10:02 AM
Stalled this PR for almost a year due to CI build cache issues, last week I realized (once again?) the Linux binary size is a bit out of hands and gave the CI another try, and the CI miraculously handled it , so finally landed this and shed of 8MB off the binaries at least github.com/nodejs/node/...