October is a pivotal month in the Node.js release cycle. With a new major version, as well as a new Long Term Support (LTS) release line, no other calendar month brings as much change to the Node.js ecosystem as October. This blog post examines the state of the various release lines as we move through October 2016. The following image is a visual representation of the LTS schedule and can be referenced throughout the remainder of the post.



September 2016 Security Releases

Before examining the future of the release lines, we should briefly evaluate their current states. On Tuesday, September 27th, 2016 (UTC), the Node Foundation released security updates for all supported release lines. The details of the security releases can be found on the project’s official blog. Depending on the release line you are currently deploying, you should be running either v0.10.47 (Maintenance), v0.12.16 (Maintenance), v4.6.0 (LTS), or v6.7.0 (Current). If you are running a version that is older than these, you should upgrade as soon as possible in order to avoid unnecessary security vulnerabilities.

The v0.10 and v0.12 Release Lines

Looking beyond October 2016, 0.10 users absolutely must upgrade to v4, or, preferably v6. The 0.10 line, which was released in March 2013, is finally coming to the end of its life. This means that there will be no further official releases, including fixes for critical security bugs, for the 0.10 release line. While migration to a newer version of Node should be a priority, we do not recommend moving to the 0.12 release line, which will also reach its end of life in December 2016. It is worth noting that support for OpenSSL 1.0.1, which is included in these older release lines, will also cease at the end of 2016. The 0.10 and 0.12 release lines represent significant milestones in the history of Node.js, but it is time to move on if you have not already done so.

The v4 Release Line

The v4 release line is so much more than code to anyone involved with the Node project over the past few years. This particular line represents the io.js fork, the birth of the Node Foundation, convergence, and the creation of an LTS roadmap, among other things. v4 was first released in September 2015 and became the first LTS line in October 2015.

Codenamed Argon, the v4 line will remain in active LTS until April 2017, when it will transition into maintenance mode for one year. This means that, for the next six months, the v4 line will continue to receive bug fixes and security updates while prioritizing code stability. Once v4 enters maintenance, it will only receive security updates, and releases will become less frequent.

The final six months of active LTS for v4 intentionally overlap with v6 entering LTS. The idea is that LTS users, such as enterprises, can use this overlap to migrate from one version to the next.

The v6 Release Line

Released in April of 2016, v6 will enter LTS this month. The exact date is subject to change but is currently planned for October 18th. Once it reaches LTS, the release line will take on the codename Boron, following the periodic table naming convention established with Argon. The move to LTS means that v6 will stop receiving new features as the priority shifts to stability. Ideally, users of all previous release lines will begin migrating to Boron, although Argon is perfectly acceptable for the time being. If you are beginning development on a new project, we recommend targeting v6, which will be supported until April of 2019.

Welcome the v7 Release Line

The majority of Node’s October acclaim will undoubtedly go to the freshly released v7 release line. As an odd numbered release, v7 will only be supported for approximately nine months. If you are interested in receiving the latest features, can easily upgrade your deployment, and can tolerate some level of instability, then you might be interested in targeting v7. If you don’t fit into these categories, then please stick to v6.

The v7 release line will receive new features throughout its lifetime, as long as those features are backwards compatible. There is one feature in particular that everyone is interested in. That feature is native support for JavaScript async functions. The good news is that the v7 line will ship with V8 5.4, which does include some support for async await, as well as performance and memory usage improvements. The bad news is that async functions are still behind a runtime flag (--harmony_async_await to be specific). This means that you can experiment with the feature, but it is incomplete, likely contains bugs and is not recommended for production use. There have been discussions about potentially upgrading Node’s version of V8 once async functions are officially supported, but this is dependent on the amount of breakage the update would bring, and whether or not Node core can shield users from said breakage.

The initial v7 release is currently scheduled for October 25th, although this is subject to change. In the interim, the Node project is making prereleases, which can be downloaded here (look for the newest v7.0.0-test* directory). Stay tuned for updates on v7 as they become available.

Navigating Node’s LTS schedule can be daunting. There are multiple release lines with varying policies that change over time. Hopefully, this post clarified your picture of the immediate future. If you find yourself needing to migrate between releases, the Node.js wiki contains detailed lists of breaking changes between versions. If you need additional help beyond what the documentation offers, please reach out – we’d love to help you!

By: Colin Ihrig

Colin Ihrig is a senior software engineer at nearForm. He is a Node.js collaborator and a member of the Node.js Core Technical Committee. Colin is also a member of the hapi.js core team. He is the author of several books, including Pro Node.js for Developers and Full Stack JavaScript Development with MEAN (co-author).