Node.js Interactive 2026: A RecapNode.js Interactive 2026：回顾

Aviv KellerAviv Keller

Node.js Interactive 2026: A Recap

More than a decade after the first Node.js Interactive was announced, the conference returned on August 12 and 13, 2026, as a dedicated experience inside RenderATL and alongside Atlanta Tech Week.在首次 Node.js Interactive 大会宣布十多年后，该会议于 2026 年 8 月 12 日至 13 日回归，作为 RenderATL 大会的一部分，并与亚特兰大科技周（Atlanta Tech Week）同期举办。

Across the two-day speaker program, attendees learned that the future of Node.js is more than its extensive APIs. It also depends on the people who maintain critical infrastructure, the standards that keep runtimes interoperable, the platforms that make safe development easier, and the documentation and tests that turn new ideas into dependable software.在为期两天的演讲议程中，与会者了解到 Node.js 的未来不仅仅在于其丰富的 API。它还依赖于维护关键基础设施的人员、确保运行时互操作性的标准、简化安全开发的平台，以及将新想法转化为可靠软件的文档和测试。

Here are the themes that stood out and the takeaways we think every Node.js-er should know.以下是大会中脱颖而出的主题，以及我们认为每位 Node.js 开发者都应了解的要点。

Open source infrastructure still runs on people开源基础设施依然由人来驱动

Robin Bender Ginn, Executive Director of the OpenJS Foundation, opened the conference with her talk, "Node.js Runs AI. Who Runs Node.js?":OpenJS 基金会执行董事 Robin Bender Ginn 以题为“Node.js 运行 AI，谁在运行 Node.js？”的演讲拉开了大会序幕：

The JavaScript ecosystem powers an enormous share of the modern internet, including much of the infrastructure behind the current AI wave. But projects such as Node.js, Express, Electron, and webpack do not maintain themselves. They depend on people, often surprisingly small teams, doing the ongoing work of reviewing changes, responding to security reports, cutting releases, improving documentation, and keeping communities healthy.JavaScript 生态系统支撑着现代互联网的巨大份额，包括当前 AI 浪潮背后的许多基础设施。但是，Node.js、Express、Electron 和 webpack 等项目并不会自动维护。它们依赖于人员——通常是规模小得惊人的团队——来持续进行审查变更、响应安全报告、发布版本、改进文档以及保持社区健康等工作。

Robin described those maintainers as part of the "missing middle": essential to millions of developers and businesses, but too easily treated as an invisible resource. Her session focused on what sustainable maintainer support looks like and what developers and companies can do to strengthen the projects they rely on.Robin 将这些维护者描述为“缺失的中间层”：他们对数百万开发者和企业至关重要，却太容易被视为隐形资源。她的演讲重点讨论了可持续的维护者支持应该是什么样子，以及开发者和公司可以采取哪些措施来加强他们所依赖的项目。

Open source also depends on people agreeing about how independently developed systems should work together. In "Code, Consensus, and Community: How the JS Ecosystem Continues To Move Forward Together," Joe Sepi, Workers Engineering Manager at Cloudflare, walked through the "alphabet soup" of JavaScript governance, including the W3C, Ecma International, and the OpenJS Foundation.开源同样依赖于人们对独立开发的系统应如何协同工作达成共识。在“代码、共识与社区：JS 生态系统如何继续共同前行”演讲中，Cloudflare 的 Workers 工程经理 Joe Sepi 梳理了 JavaScript 治理中复杂的“字母汤”，包括 W3C、Ecma International 和 OpenJS 基金会。

For instance, the Web-interoperable Runtimes Community Group, or WinterCG, began as a grassroots effort to align APIs across Node.js, Deno, Cloudflare Workers, and other server runtimes. Today, it has moved into a formal standardization track as Ecma TC55, or WinterTC. Its initial goal is to define a verifiable minimum common API for server-side JavaScript environments, letting runtimes become more interoperable without requiring them to become identical.例如，Web 互操作运行时社区组（WinterCG）最初是一项旨在协调 Node.js、Deno、Cloudflare Workers 和其他服务器运行时 API 的草根努力。如今，它已进入正式标准化轨道，成为 Ecma TC55（即 WinterTC）。其初步目标是为服务器端 JavaScript 环境定义一个可验证的最小通用 API，让运行时在无需完全相同的情况下实现更高的互操作性。

The supply chain is an identity problem供应链是一个身份问题

In "AI Slop and the Vulnerability Treadmill," Kate Holterhoff traced our past year, in which package security repeatedly became equal to account security.在“AI 垃圾内容与漏洞跑步机”演讲中，Kate Holterhoff 回顾了过去一年，当时软件包安全一再等同于账户安全。

In September 2025, the self-replicating Shai-Hulud attack spread through compromised npm maintainer accounts. GitHub ultimately removed more than 500 compromised packages from the registry. A second wave in November backdoored at least 796 packages, representing more than 20 million weekly downloads, and exfiltrated stolen credentials through public GitHub repositories.2025 年 9 月，自我复制的 Shai-Hulud 攻击通过被入侵的 npm 维护者账户传播。GitHub 最终从注册表中删除了超过 500 个受损软件包。11 月的第二波攻击导致至少 796 个软件包被植入后门，影响了每周超过 2000 万次的下载量，并通过公共 GitHub 仓库窃取凭据。

Then, in March 2026, an attacker compromised an Axios maintainer account and published malicious releases of a package with more than 100 million weekly downloads. The legitimate release had used OIDC-based trusted publishing through GitHub Actions. The attacker bypassed that path and published directly from the compromised account.随后，在 2026 年 3 月，一名攻击者入侵了一个 Axios 维护者账户，并发布了恶意版本的软件包，该软件包每周下载量超过 1 亿次。合法的发布版本曾使用基于 OIDC 的 GitHub Actions 可信发布，但攻击者绕过了该路径，直接从被入侵的账户进行了发布。

While the incidents differed in execution, they generally followed a similar chain of attack: compromise a human identity, then use its legitimate publishing rights to move downstream. That is why defenses such as npm trusted publishing, short-lived credentials, phishing-resistant authentication, protected recovery paths, dependency cooldowns, and tightly scoped automation all matter now more than ever.虽然这些事件的执行方式不同，但它们通常遵循相似的攻击链：入侵人类身份，然后利用其合法的发布权限向下游渗透。这就是为什么 npm 可信发布、短期凭据、抗钓鱼认证、受保护的恢复路径、依赖项冷却期以及严格范围的自动化等防御措施现在比以往任何时候都更加重要。

Additionally, AI now sits on both sides of that struggle. It makes convincing social engineering and high-volume, low-quality vulnerability reports cheaper to produce. In January, the curl project ended its monetary bug bounty after its rate of confirmed reports fell below five percent. The project later returned to HackerOne as an intake platform, but without monetary rewards.此外，AI 现在处于这场斗争的两端。它使得令人信服的社会工程学攻击以及大量低质量漏洞报告的生成成本变得更低。1 月份，curl 项目在确认报告率降至 5% 以下后，停止了货币化的漏洞赏金计划。该项目后来回到了 HackerOne 作为接收平台，但不再提供货币奖励。

The same broad class of technology can help defenders. Security researchers at AISLE used an AI-driven system to identify all 12 vulnerabilities addressed in OpenSSL's January 2026 security release. Human researchers validated the findings, worked through responsible disclosure, and collaborated with OpenSSL on remediation. Some of the underlying bugs had remained in the codebase for more than 25 years.同样大类的技术也可以帮助防御者。AISLE 的安全研究人员利用 AI 驱动的系统识别出了 OpenSSL 2026 年 1 月安全版本中修复的所有 12 个漏洞。人类研究人员验证了这些发现，完成了负责任的披露，并与 OpenSSL 合作进行了修复。其中一些潜在的 Bug 在代码库中已经存在了超过 25 年。

Reproducibility needs more than version numbers可复现性需要的不仅仅是版本号

Supply-chain reliability is also shaped by how package managers interpret metadata. In "Beyond SemVer," Darcy Clarke, founder and CEO of vlt discussed the future of versioning packages and the interpretation of package metadata.供应链的可靠性也受到包管理器如何解析元数据的影响。在“超越 SemVer”演讲中，vlt 的创始人兼 CEO Darcy Clarke 讨论了软件包版本控制和包元数据解析的未来。

Semantic Versioning 2.0.0 defines the structure and precedence of versions. It does not, however, define the complete range language people use in package.json files. Carets, tildes, and many advanced range expressions are conventions implemented by tools such as node-semver.语义化版本控制（Semantic Versioning 2.0.0）定义了版本的结构和优先级。然而，它并没有定义人们在 package.json 文件中使用的完整范围语言。插入符号（^）、波浪号（~）以及许多高级范围表达式，都是由 node-semver 等工具实现的约定。

Darcy focused on another frequently overlooked part of the specification: build metadata. SemVer intentionally ignores build metadata when calculating version precedence. Rather than changing that rule, his talk explored using build metadata as a backwards-compatible extension point for richer package information. He proposed a brand new variant of the SemVer specification, open-source and available at semver.xyz.Darcy 重点关注了规范中另一个经常被忽视的部分：构建元数据。SemVer 在计算版本优先级时会刻意忽略构建元数据。他的演讲没有改变这一规则，而是探讨了将构建元数据用作向后兼容的扩展点，以获取更丰富的包信息。他提议了一种全新的 SemVer 规范变体，该规范已开源并可在 semver.xyz 上获取。

More code needs stronger platforms更多的代码需要更强大的平台

While AI coding tools can increase how quickly a team produces code, they do not change what makes that code safe to ship.虽然 AI 编码工具可以提高团队编写代码的速度，但它们并不能改变代码安全交付的前提。

In "Platform Thinking for the AI Era," Bekah Suttner Cheek, Staff Software Engineer at Fastly, argued that familiar platform fundamentals become more important as development speeds up: fast CI, meaningful tests, safe rollbacks, healthy codebase patterns, and clear paths from a local change to production.在“AI 时代的平台思维”演讲中，Fastly 的资深软件工程师 Bekah Suttner Cheek 指出，随着开发速度的加快，熟悉的平台基础知识变得更加重要：快速的 CI、有意义的测试、安全的回滚、健康的代码库模式，以及从本地变更到生产环境的清晰路径。

Despite the name, platform thinking is not exclusive to people with "platform" in their title. Everyone who designs a workflow, API, test suite, or deployment process can make the safe choice easier. Good guardrails prevent common mistakes, surface failures quickly, and make recovery routine instead of heroic. They also treat a near miss as useful evidence. Waiting for the same weakness to become a full incident is an expensive way to learn.尽管名字如此，平台思维并不局限于头衔中带有“平台”的人。每一个设计工作流、API、测试套件或部署流程的人，都可以让安全的选择变得更容易。良好的护栏可以防止常见错误，快速暴露故障，并使恢复成为常规而非英雄行为。它们还将“险些酿成事故”视为有用的证据。等待同样的弱点演变成全面的事故是一种昂贵的学习方式。

This is ultimately a trust problem. Users and internal teams should not need to remember hidden rules or jump through unnecessary hoops to do the right thing. The platform should guide them there by default.这归根结底是一个信任问题。用户和内部团队不应该为了做正确的事而被迫记住隐藏的规则或跳过不必要的障碍。平台应该默认引导他们走向正确的方向。

Node.js is becoming more capable out of the boxNode.js 开箱即用的功能正变得越来越强大

Not long ago, starting a Node.js project often meant installing a collection of packages before writing application code. Environment variables, tests, HTTP clients, file watching, and TypeScript support all commonly began in userland.不久前，启动一个 Node.js 项目通常意味着在编写应用代码之前要安装一堆软件包。环境变量、测试、HTTP 客户端、文件监视和 TypeScript 支持通常都始于用户空间。

In "The New Node.js: Built-in Batteries and the Road Ahead," Matteo Collina, Co-Founder and CTO of Platformatic, showed how much of that foundation now ships with the runtime. Modern Node.js includes built-in TypeScript type stripping, node:test and node:assert, native .env loading, fetch powered by Undici, watch mode, node:sqlite, and the stable Permission Model (among a great many other things).在“新 Node.js：内置功能与未来之路”演讲中，Platformatic 的联合创始人兼 CTO Matteo Collina 展示了现在有多少基础功能是随运行时直接提供的。现代 Node.js 包含了内置的 TypeScript 类型剥离、node:test 和 node:assert、原生 .env 加载、由 Undici 驱动的 fetch、监视模式、node:sqlite 以及稳定的权限模型（以及许多其他功能）。

However, despite all this addition, adoption remains the harder part. Teams still run unsupported versions because upgrades require time, testing, and coordination. That's why, starting with the 27.x line, Node.js will move from two major releases per year to one. An Alpha phase begins in October 2026, Node.js 27.0.0 becomes Current in April 2027, and it enters LTS in October 2027. Version numbers will align with the calendar year of their initial Current release, and every release will eventually become LTS. This change reduces the number of concurrent release lines maintainers must support while preserving a predictable testing and migration window for users.然而，尽管增加了这么多功能，采用率仍然是更难的部分。团队仍然在运行不受支持的版本，因为升级需要时间、测试和协调。这就是为什么从 27.x 系列开始，Node.js 将从每年两个主要版本发布改为一个。Alpha 阶段将于 2026 年 10 月开始，Node.js 27.0.0 将于 2027 年 4 月成为 Current 版本，并于 2027 年 10 月进入 LTS。版本号将与初始 Current 发布年份对齐，并且每个版本最终都将成为 LTS。这一变化减少了维护者必须支持的并发发布系列数量，同时为用户保留了可预测的测试和迁移窗口。

QUIC and HTTP/3 are taking shape in Node.jsQUIC 和 HTTP/3 正在 Node.js 中成形

James Snell, System Engineer at Cloudflare, has led much of Node.js's work on HTTP/2, QUIC, and HTTP/3. In "QUIC in Node.js," he reviewed an implementation that has gone through several major iterations since the effort began in 2018.Cloudflare 的系统工程师 James Snell 领导了 Node.js 在 HTTP/2、QUIC 和 HTTP/3 方面的大部分工作。在“Node.js 中的 QUIC”演讲中，他回顾了一个自 2018 年开始以来经历了多次重大迭代的实现。

QUIC and HTTP/3 are related, but they are not interchangeable names. QUIC is a secure, multiplexed transport protocol built on UDP. HTTP/3 maps HTTP semantics onto QUIC.QUIC 和 HTTP/3 相关，但并不是可以互换的名称。QUIC 是一种构建在 UDP 之上的安全、多路复用的传输协议。HTTP/3 将 HTTP 语义映射到 QUIC 上。

Node.js's node:quic implementation is still in active development. Using it requires a Node.js binary built with experimental QUIC support and then starting that binary with --experimental-quic. The runtime flag cannot add QUIC support to a binary that was compiled without it.Node.js 的 node:quic 实现仍在积极开发中。使用它需要一个构建时启用了实验性 QUIC 支持的 Node.js 二进制文件，并在启动该二进制文件时添加 --experimental-quic 参数。运行时标志无法为未经编译支持的二进制文件添加 QUIC 支持。

James also discussed the work needed to move the implementation forward, including tests, documentation, and the use of AI to help make progress on a change set whose scale had previously stalled development. Completing the work would allow more of Node.js's networking stack, including fetch, to benefit from HTTP/3 over time.James 还讨论了推动该实现向前发展所需的工作，包括测试、文档以及利用 AI 来帮助推进那些因规模过大而曾停滞的变更集。完成这项工作将使 Node.js 的更多网络栈（包括 fetch）能够随着时间的推移受益于 HTTP/3。

The session also previewed a proposed unified server API spanning HTTP/1.1, HTTP/2, and HTTP/3, with the intent to bring the design to WinterTC for broader discussion, something Node.js & James are both very excited about.该环节还预览了一个跨越 HTTP/1.1、HTTP/2 和 HTTP/3 的统一服务器 API 提案，旨在将其设计提交给 WinterTC 进行更广泛的讨论，这是 Node.js 和 James 都非常期待的事情。

Documentation and testing are infrastructure文档和测试即基础设施

New runtime features only matter when developers can understand and trust them. That makes documentation and testing infrastructure, not supporting material.新的运行时功能只有在开发者能够理解并信任它们时才有意义。这使得文档和测试成为基础设施，而不是辅助材料。

In "Replacing What Works: doc-kit and the Next 10 Years of Node.js Documentation," Brian Muenzenmeyer and Claudio Wunder told the story of replacing a documentation pipeline that dates back to Node.js v0.6.在“替换有效方案：doc-kit 与 Node.js 文档的下一个十年”演讲中，Brian Muenzenmeyer 和 Claudio Wunder 讲述了替换一个追溯到 Node.js v0.6 的文档流水线的故事。

The new doc-kit CLI parses, lints, and transforms Markdown into an annotated representation that can produce redesigned web pages, legacy HTML, man pages, JSON schemas, search indexes, and llms.txt files. Keeping those outputs aligned is one of the major advantages of moving them onto a shared pipeline.新的 doc-kit CLI 可以解析、检查并转换 Markdown 为带注释的表示形式，从而生成重新设计的网页、旧版 HTML、man 手册、JSON 模式、搜索索引和 llms.txt 文件。保持这些输出的一致性是将它们迁移到共享流水线的主要优势之一。

The migration also brings a redesigned reader experience shaped by research from the Node.js website and infrastructure teams. You can preview the new API documentation today and read more about the design and the tooling behind it. The beta remains usable without JavaScript and offline, while adding faster navigation, improved search, and clearer information architecture.此次迁移还带来了由 Node.js 网站和基础设施团队的研究成果所塑造的重新设计的阅读体验。您现在可以预览新的 API 文档，并阅读更多关于其设计和背后工具的信息。测试版在没有 JavaScript 的情况下依然可用且支持离线，同时增加了更快的导航、改进的搜索和更清晰的信息架构。

Testing the systems described by that documentation can be just as difficult. Local-only failures, operating-system differences, port conflicts, and CI constraints all make integration tests harder to run reliably and in parallel.测试这些文档描述的系统可能同样困难。仅限本地的失败、操作系统差异、端口冲突和 CI 限制都使得集成测试难以可靠地并行运行。

In "Performant, Parallelizable, Framework Agnostic Node.js Integration Testing," Ethan Arrowood, Head of Open Source Engineering at Harper, presented @harperfast/integration-testing. The framework runs real processes, allocates ports dynamically, supports parallel execution, and integrates with both the Node.js test runner and external runners like Playwright.在“高性能、可并行、框架无关的 Node.js 集成测试”演讲中，Harper 开源工程主管 Ethan Arrowood 展示了 @harperfast/integration-testing。该框架运行真实进程，动态分配端口，支持并行执行，并与 Node.js 测试运行器以及 Playwright 等外部运行器集成。

Integration tests, like the ones Ethan showed us, verify that the pieces of an application work together as a system. Good test tooling makes that level of confidence repeatable across local machines, operating systems, and CI rather than reserving it for the one environment where everything happens to line up.像 Ethan 向我们展示的那样，集成测试验证了应用程序的各个部分作为一个系统如何协同工作。优秀的测试工具使得这种置信度可以在本地机器、操作系统和 CI 之间重复，而不是仅限于一切恰好对齐的单一环境中。

AI may change the workflow, but not the responsibilityAI 可能会改变工作流，但不会改变责任

Several sessions approached AI from different layers and views of the software stack, but ultimately, all asserted that developers still own the systems they ship.多个环节从软件栈的不同层面和视角探讨了 AI，但最终都断言开发者仍然对其交付的系统负有责任。

In "Node.js After the AI Shift: Building Tools Developers Can Trust," Andrea Griffiths, Senior Developer Advocate at GitHub, broke AI-powered Node.js features into practical components: inputs, context, tool calls, guardrails, evaluation, and developer experience.在“AI 转型后的 Node.js：构建开发者可信的工具”演讲中，GitHub 资深开发者倡导者 Andrea Griffiths 将 AI 驱动的 Node.js 功能拆解为实际的组成部分：输入、上下文、工具调用、护栏、评估和开发者体验。

Aileen Villanueva Lecuona, a Senior Software Engineer and Google Developer Expert, made those boundaries more concrete in "Guiding AI Agents with MCP, Skills and Spec-Driven Development for Reliable Node.js Backends." Her workflow combined the Model Context Protocol, specialized skills, and specifications that act as the source of truth.资深软件工程师兼 Google 开发者专家 Aileen Villanueva Lecuona 在“通过 MCP、技能和规范驱动的开发指导 AI 代理，实现可靠的 Node.js 后端”演讲中，使这些边界变得更加具体。她的工作流结合了模型上下文协议（MCP）、专业技能以及作为单一事实来源的规范。

In "Imagineering Future Interfaces," Charlie Gerard, Senior Research Engineer at CrowdStrike, shifted the focus from control to creativity. AI is often good at reproducing patterns that already exist. Humans remain responsible for imagining what has not been built yet. Her examples showed how agents can help product developers to prototype new interfaces based on previous human interaction in order to improve user experience.在“想象未来的接口”演讲中，CrowdStrike 资深研究工程师 Charlie Gerard 将重点从控制转向了创造力。AI 通常擅长复制已经存在的模式。人类依然负责想象尚未被构建的东西。她的例子展示了代理如何帮助产品开发者基于之前的人类交互来原型化新接口，从而提升用户体验。

Finally, in "Client Performance in the Age of AI," Jenna Zeigen, Senior Staff Engineer at Notion, argued that generating more code does not guarantee generating better patterns. In fact, it creates more surface area for regressions and more opportunities for users to feel the accumulated cost.最后，在“AI 时代的客户端性能”演讲中，Notion 资深工程师 Jenna Zeigen 指出，生成更多代码并不能保证生成更好的模式。事实上，它创造了更多的回归风险，并增加了用户感受到累积成本的机会。

However, there is a solution to this: specific metrics, flamegraphs, and representative benchmarks. For example, Interaction to Next Paint measures whether an interface responds promptly when someone clicks, taps, or types. Another metric, Time to First Token measures how long an AI-backed experience takes to begin responding. No single metric tells the entire story, which is why choosing the right benchmarks is just as important as having one.然而，有一个解决方案：具体的指标、火焰图和具有代表性的基准测试。例如，“交互到下一次绘制”（Interaction to Next Paint）衡量了当有人点击、触摸或输入时，界面是否能及时响应。另一个指标“首个令牌时间”（Time to First Token）衡量了 AI 支持的体验开始响应需要多长时间。没有单一指标能说明全部情况，这就是为什么选择正确的基准测试与拥有指标同样重要。

Code & Learn代码与学习（Code & Learn）

Finally, Node.js Interactive also ended the conference with a Code & Learn session in partnership with Harper. Attendees at every experience level sat down with core maintainers and worked through a curated set of ready-to-go contributions to Node.js core.最后，Node.js Interactive 还与 Harper 合作举办了“代码与学习”环节。各个水平的与会者与核心维护者坐在一起，通过精心挑选的一组可直接贡献的 Node.js 核心任务进行了实践。

The session began with the ethos of open source, the project's contribution guidelines, responsible use of AI-assisted development, and practical advice for finding an issue to work on. From there, participants moved into reproducing problems, changing code, adding tests, receiving review, and submitting patches. Plus, everyone who submitted a contribution also walked away with some cool new Node.js swag.该环节从开源精神、项目的贡献指南、AI 辅助开发的负责任使用以及寻找待解决问题的实用建议开始。随后，参与者进入了复现问题、修改代码、添加测试、接收审查和提交补丁的流程。此外，每位提交贡献的参与者还获得了一些很酷的 Node.js 周边产品。

The event may be over, but the Node.js contribution guide is always open, and we'd love to have you contribute to the future of open source software.活动虽然结束了，但 Node.js 贡献指南永远开放，我们非常欢迎您为开源软件的未来做出贡献。

Thank you, Atlanta谢谢你，亚特兰大

Thank you to everyone who spoke, attended, volunteered, mentored, and sponsored, and to RenderATL, Atlanta Tech Week, and Harper for helping make the week larger than any single conference or session.感谢所有演讲者、与会者、志愿者、导师和赞助商，以及 RenderATL、亚特兰大科技周和 Harper，感谢你们让这周的活动超越了任何单一的会议或环节。

To keep the conversation going, join the community in the OpenJS Slack, follow the OpenJS community calendar, or make your first contribution to Node.js.为了保持交流，请加入 OpenJS Slack 社区，关注 OpenJS 社区日历，或者做出您对 Node.js 的第一次贡献。

See you at the next one!下次见！

- Aviv Keller, Node.js Core Collaborator- Aviv Keller，Node.js 核心贡献者