
Security News
Open Source Maintainers Feeling the Weight of the EU’s Cyber Resilience Act
The EU Cyber Resilience Act is prompting compliance requests that open source maintainers may not be obligated or equipped to handle.
Sarah Gooding
June 26, 2025
The ECMAScript 2025 specification (16th edition of ECMA-262) has been officially approved by the Ecma General Assembly during its 129th meeting in Geneva on June 25, 2025. Shared by TC39 co-chair Rob Palmer on Bluesky, this milestone finalizes the language updates curated by TC39 and signals what’s next for the JavaScript ecosystem.
JavaScript evolves through a formal process led by TC39, a technical committee under Ecma International that reviews, debates, and stages proposals before they become part of the official language spec. Once a set of features reaches Stage 4, meaning they’ve been implemented in two major engines and pass thorough review, they’re eligible for inclusion in the next edition of ECMAScript, the standardized version of JavaScript.
We’ve covered parts of this process in past posts, including Iterator Helpers reaching Stage 4, the standardization of JSON Modules and Import Attributes, and the addition of features like Promise.try
, RegExp.escape, and Float16Array
. Since ECMAScript 2016, the spec has followed a steady annual release cycle, with a new edition published every June.
Here’s a closer look at what made the cut for the most recent update to the spec:
type: "json"
, etc.) and bundler/runtime optimizations..map()
, .filter()
, .take()
, etc.) directly on iterators, bringing long-awaited parity with array methods and enabling more expressive lazy evaluation..json
files as modules. No more custom loaders. This makes server and toolchain code cleaner and simpler.Promise.try(fn)
executes fn
and wraps any synchronous errors in a rejected promise. It’s a pattern that’s already widely used in async codebases via utility libraries like Bluebird, now standardized..modifiers
property for improved introspection and manipulation.Set.prototype
: union
, intersection
, difference
, and symmetricDifference
. These mirror mathematical set operations and reduce the need for manual iteration or third-party libs.Many of the ECMAScript 2025 features are already implemented, or partially available, in engines like V8, often behind flags. Some, like Iterator Helpers, are supported in environments such as Deno, or can be polyfilled. For testing and experimentation, transpilers like Babel (as support lands) are good places to try them out.
The final spec is available here: https://tc39.es/ecma262/ and a printable PDF is also available for download.
TC39 notes that the HTML version is the normative copy. (If there's ever a conflict between formats, the HTML defines the official behavior. The PDF is provided for convenience but isn't authoritative.) TC39 recommends reporting issues only if they persist in the latest draft.
Subscribe to our newsletter
Get notified when we publish new security blog posts!
Try it now
Security News
The EU Cyber Resilience Act is prompting compliance requests that open source maintainers may not be obligated or equipped to handle.
Security News
Crates.io adds Trusted Publishing support, enabling secure GitHub Actions-based crate releases without long-lived API tokens.
Research
/Security News
Undocumented protestware found in 28 npm packages disrupts UI for Russian-language users visiting Russian and Belarusian domains.