Introducing Node.js 20: What’s New Experimental Permission Model and Other Features in New Release

“Node.js 20 includes the new Node.js experimental Permission Model for improved security!”

Well, the time has come again for all Node.js developers to try their hands at the latest released version of Node.js. This year, the Node.js community has released the latest major version, it’s Node.js 20.

We can conclude that the release line is even-numbered, which means it will be promoted to long-term support (LTS) in October 2023 and receive support until April 2026. And that is what happened. With the latest release of Node JS 21, Node.js is being promoted to long-term support (LTS). As per the release schedule, Node.js 21 will be ‘Current' release for the next 6 months, until April 2024.

By the way, do you know Node.js 20 is the first major release of the platform since the Node.js 12 LTS was released in 2019?

However, before the release of the official version of Node JS 20 is promoted to LTS, the Node.js team needs help from the development community to test it, identify any issues, fix them, and provide feedback to deliver a seamless developer experience.

Before I take you on the ride of the latest version of Node.js - Node.js 20, allow me to brush up your mind with its previous version – Node.js 19. Node.js v.19 was released on 19th October 2022 with V8 JavaScript engine and many other features.

The latest version of Node JS 20 was released on 18th April 2023 with an experimental permission model and other exciting features. As a tech-savvy person and Node.js developer, I went deeper to know what other features have been released along with Permission Model. And then I found that Node JS 20 comes with a synchronous import.meta.resolve, a stable test_runner, updated V8 JavaScript engine to 11.3, Ada to 2.0 and many more.

All these promising features excite the dev community to utilize Node.js 20 in their projects and explore further. So, why should we wait here to understand what’s new in Node 20?

Introduction to Node.js 20

We don’t need any introduction of Node.js to the dev community due to its amazing features.

So, as a Node.js developer, if you are using the older version of Node.js, it’s better to get it updated to experience better performance. In fact, you can install the latest version of Node.js on your Windows and Mac or upgrade it easily with simple steps.

Node.js 20 is available in the market with “Current” release for the next six months. If you plan to implement Node JS 20, now is the time to test and prototype.

It seems like Node.js will fit into the complete development environment and be perfect for testing with the addition of the experimental Permission Model and updates to V8 JavaScript engine.

Let’s hear what Rafael Gonzaga, a Node.js TSC member, said about the latest release of Node.js v20,

“We have made excellent progress making Node.js more secure and performant over the past year. Many thanks to our broad and energetic community of open-source contributors for constantly improving Node.js.”

OpenJS Foundation Executive Director Robin Ginn also said,

“From security to testing to portability, Node.js has made important gains in the past year and Node.js 20 shows it. If you’re already using Node.js, Node JS 20 is a great way to get a close-up look at new features before LTS comes out.”

“Thank you to our open source contributors from around the world. Node.js 20 is a great example of open source making a difference.”

After reading to what the prominent members of Node.js said, I looked over the GiHub of Node.js. And what I found is, Node JS has 94.8K Stars and 25.7K Forks on GitHub.

That’s huge, right?

The usefulness, quality, and security are mainly due to contributors like us. If you still have not contributed to the project, you may do a bit here - https://nodejs.org/en/get-involved/contribute.

You can find the release post on the official Node.js website, which contains the full list of commits included in this release.

What’s New? Major Updates for Node 20

The fact is the usage of NodeJS is rapidly increased, with billions of downloads of Node.js NVM, binaries, and containers reported in the past year.

Node.js 20 is the latest version of the popular JavaScript runtime environment. So, it is packed with many excellent features. This makes developers to consider NodeJS 20 for their next Node.js development services.

Permission Model

One of the important features of NodeJS 20 is the experimental Permission Model. It’s been developed over the last nine months to enhance the security of the Node JS application. It allows restriction of access to specific resources during the program execution.

In this first release containing the Permission Model, the features come with the following abilities:

• Restrict access to the file system (read and write)
• Use --allow-fs-read and --allow-fs-write
• Restrict access to child_process
• Use --allow-child-process
• Restrict access to worker_threads
• Use --allow-worker
• Restrict access to native addons (same as --no-addons flag)

You can switch to the new permission model by writing the below-given flag.

--experimental-permission

The available permissions are documented by the --experimental-permission flag.

Starting with --experimental-permission in Node.js, the ability to access the file system, spawn processes, and use node:worker_threads will be restricted.

Now you will have more control over file system access using two new flags,

--allow-fs-read and --allow-fs-write flags

These experimental features allow for more granular control over which Node.js processes can access parts of the file system.

Furthermore can be found in Permission Model documentation.

Updated V8 JavaScript Engine to 11.3

The JavaScript V8 engine is what powers Node.js. Hence, Node JS 20 also comes with the update of V8. The new methods isWellFormed and toWellFormed ensure that the user string input is the right UTF-16 string causing fewer errors, especially in the Emoji era.

The latest version of Node.js 20 comes with new features for V8 JavaScript engine:

• String.prototype.isWellFormed and toWellFormed
• Methods that change Array and TypedArray by copy
• Resizable ArrayBuffer and growable SharedArrayBuffer
• RegExp v flag with set notation + properties of strings
• WebAssembly Tail Call

Synchronous import.meta.resolve()

Now you can easily write scripts, which are insensitive to their exact location or the web application’s module setup with import.meta.resolve().

This function returns synchronously, aligning with browser behavior. User loader resolve hooks can still be defined as an async function (or as a sync function, if you, as an author, prefer), despite this behavior. import.meta.resolve() will still return synchronously for the application code, even if async resolve hooks are loaded.

Web Crypto API

The project strives to be compatible with other JavaScript environments.

For instance, the arguments for Web Crypto API functions are now coerced and validated in accordance with their WebIDL specifications, just like in other Web Crypto API implementations, in Node 20. This also enhances Web Crypto API interoperability with other implementations.

Stable Test Runner

Node.js 19 came up with the experimental test runner. Now you will find a stable version in Node 20. It offers the creation of JavaScript tests.

The functionality offers a quick and simple way to build and run a test suite without installing additional dependencies, not to replace fully featured test frameworks like Jest or Mocha. Numerous improvements have been made since its addition, including:

• Node --test invokes the command-line test runner
• Configurable and custom test reporters via --test-reporter
• Experimental test coverage using --experimental-test-coverage
• Mocking capabilities

Single Executable Apps

The new feature of Node v20 – Single Executable Apps lets you distribute the Node.js applications systems without installing Node.js.

The entire functionality was created by Darshan Sen, who won the Outstanding Contribution from a New Arrival award as part of the JavaScriptLandia Awards at OpenJS World.

The functionality actually compiles your project into binary for distribution. Microsoft, an OpenJS Foundation member, is investigating it as a way to reduce vector attacks. This actually empowers the Node JS architecture for a better experience.

Implement Node.js 20 Today!You can install and implement Node.js 20 now from Node.js official website. You can also check out the release post by Rafael, which contains the list of commits included in this release. The team would love to hear your feedback!You can also check out the Node.js Release Schedule for the timeline of Node.js releases.And needless to say, as a versatile web app development company, we are going to implement Node.js 20 in our upcoming projects to leverage all features. I am sure, NodeJS 20 will surely show the bright side of web development with the latest changes and features.However, if you find any issues while installing NodeJS 20 on your system or, as a business owner, if you wish to migrate your Node.js project to the latest version, we have you covered. You can surely connect with our Node.js experts and share your requirements.