Systems | Development | Analytics | API | Testing

2026 is shaping up to be a remarkable year for Node.js download activity. Through July, downloads recorded through the official Node.js distribution infrastructure have already surpassed the total recorded during all of 2025: 4.61 billion downloads in the first seven months of 2026, compared with 4.48 billion across the entire previous year. That puts 2026 roughly 128 million downloads ahead of the 2025 total, with five months still left in the year. Figure 1.

Updating Node.js can be as simple as installing a new version. But a safe Node.js upgrade is more than changing the number returned by node -v. A major release can affect dependencies, native addons, Node.js APIs, OpenSSL, build environments, and runtime behavior. Before changing the runtime, the first question should be.

When npm announced that version 12 would require developers to explicitly approve install scripts, the reaction across the community was almost universally positive. For years, security researchers had warned that package installation had become one of the weakest links in the JavaScript supply chain. Every npm install represented an opportunity for third-party code to execute automatically, often before developers had even looked at the source they were downloading.

TL;DR: When AI-assisted development moved from autocomplete to agentic workflows, the bottleneck for our engineering velocity stopped being the model and started being the vendor. Owning our own orchestration layer, running the same upstream agent stack across multiple developer surfaces, wrapping every change in a version-controlled spec, and treating the agent calls themselves as first-class telemetry is what made spec-driven development practical for us at NodeSource.

Node.js 24 is the latest Long-Term Support release, and Node.js 26 is the Current release line. Node.js 18 and Node.js 20, meanwhile, have both reached End-of-Life (EOL). That should make the direction of travel obvious. Instead, Matteo Collina’s analysis of Node.js download data showed that even discontinued Node.js 12, 14, and 16 release lines were still generating tens of millions of downloads per month, highlighting how slowly the ecosystem moves away from unsupported versions.

For years, the Node.js community has typed the same command billions of times: It's probably the most frequently executed command in the JavaScript ecosystem. We use it to start new projects, add dependencies, update existing ones, or simply bootstrap a development environment. It has become such a routine part of our workflow that most of us no longer stop to think about what actually happens during those few seconds while npm fills node_modules.

A Node.js application can continue starting, accepting traffic, and passing health checks long after the runtime underneath it has become unsupported. That creates a dangerous assumption: In reality, “running” and “supported” are two very different states. A Node.js release is more than a JavaScript executable.

The N|Solid Extension and open-source N|Solid Plugin bring real Node.js runtime context into code editors and AI coding agents, helping developers investigate production issues, improve performance, and validate changes without breaking their workflow.

If you've ever updated a dependency, scanned your project for vulnerabilities, or opened a GitHub Security Advisory, you've probably seen something like CVE-2025-13465. For many developers, it's just another identifier attached to a security warning. Easy to ignore, especially when your priority is simply getting your application shipped. But that small reference represents something much bigger: it's the common language the software industry uses to identify and communicate security vulnerabilities.

Reaching a milestone is always exciting. Some milestones carry a deeper meaning. Today, we're proud to share that the N|Solid Runtime has surpassed 2 million downloads. The milestone reflects growing momentum, with downloads accelerating and putting us on track to nearly double last year's total. To us, this isn't simply a download count.