
Security News
Attackers Are Hunting High-Impact Node.js Maintainers in a Coordinated Social Engineering Campaign
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.
node-release-lines
Advanced tools
Introspection API for Node.js release metadata. Provides information about release lines, their relative status along with details of each release.
See how release lines work for more context.
Currently optimized for offline mode. Release schedule has apis to support both online & offline mode.
npm install node-release-lines
Array classArray classconst { ReleaseLines } = require('node-release-lines')
const releases = ReleaseLines.load('2018-09-15') // state of release lines at a point in time
if (releases.getLTS().length === 4 && // LTS release lines
releases.getEOL().length === 6 && // release lines that have reached EOL (end of life)
releases.getEOL().getModern().length === 4 && // "modern" EOL release lines
releases.getEOL().getLTS().length === 1) { // LTS release lines that are EOL
// examine supported release lines
releases.getSupported().forEach(line => {
let stats = line.getStats()
console.log({
version: line.version,
daysToEOL: stats.days.until.eol,
progress: `${stats.percent.total}%`,
state: {
lts: line.isLTS,
isCurrent: line.isCurrent,
isActive: line.isActive,
isMaintenance: line.isMaintenance
},
releases: {
total: line.releases.length,
safe: line.releases.getSafe().length,
latest: line.releases[0].version
}
})
})
}
{ version: 'v6',
daysToEOL: 198,
progress: '81%',
state:
{ lts: true,
isCurrent: false,
isActive: false,
isMaintenance: true },
releases: { total: 39, safe: 1, latest: 'v6.14.3' } }
{ version: 'v8',
daysToEOL: 472,
progress: '50%',
state:
{ lts: true,
isCurrent: false,
isActive: true,
isMaintenance: false },
releases: { total: 26, safe: 2, latest: 'v8.11.4' } }
{ version: 'v10',
daysToEOL: 929,
progress: '13%',
state:
{ lts: true,
isCurrent: true,
isActive: false,
isMaintenance: false },
releases: { total: 12, safe: 6, latest: 'v10.9.0' } }
The node-release-lines CLI options can be used globally or via npx.
Globally, where <command> is the command you'd like to use:
npm install node-release-lines -g
<command> [options]
Via npx, where <command> is the command you'd like to use:
npx node-release-lines <command> [options]
isnodesafe [options]isnodesafe is a CLI utility to check if Node.js is safe. The CLI defaults to checking system version, but can also check user-specified versions.
isnodesafe Options-v, --version: output the version number-c, --ci: Returns a non-zero exit code if the version of Node.js is not safe, and a zero exit code if it is safe.-r, --release [release] Checks to see if a specific release of Node.js is safe-h, --help output usage informationisnodesafe Examples$ isnodesafe
$ isnodesafe --ci
$ isnodesafe --release 10.2.0
$ isnodesafe -rc 6.9.5
amisafeThis command is deprecated in favor of isnodesafe. It will work as an alias of isnodesafe until node-release-lines@2.0.0, at which point it will be removed.
nodetimeline [options]nodetimeline is a CLI tool to understand Node.js release lines lifespans.
nodetimeline Options-v, --version: output the version number-c, --current: Returns all "Current" versions of Node.js.-l, --lts: Returns all presently supported "LTS" versions of Node.js – regardless of whether or not they are presently active "LTS".-a, --active: Returns all active "LTS" Node.js release lines.-m, --maintenance: Returns all presently supported "Maintenance" versions of Node.js.-s, --supported: Returns all presently supported Node.js version-h, --help: output usage informationnodetimeline Examples$ nodetimeline
$ nodetimeline -c
$ nodetimeline --lts
ReleaseLine no longer supported and recieves no more updates.ReleaseLine that has been started and has not reached EOL.ReleaseLine that has an active LTS period in the lifecycle.ReleaseLine that is in LTS, excluding maintenance window.ReleaseLine that is in maintenance mode and has not reached EOL.ReleaseLine that has been started, in active development, not in maintenance or LTS.ReleaseLine that has yet to start.ReleaseLine that is v1 or greater. This does not include io.js releases (any version from v4 onwards).ReleaseLine classInstance properties:
StringDateDateDate or undefinedDate or undefinedString or undefinedInstance getters:
Releases see Releases section (lazy loaded)BooleanBooleanBooleanBooleanBoolean alias for isActiveBooleanBooleanBooleanBooleanBooleansetDate(date)Changes the date for calculating stats in getStats
Params:
Date.now)Returns: this
getStats(precision)Params:
NumberStats about the relative timeline of the release based on the current setDate.
Notes:
0 will be used for unknown values. For example maintenance, lts are not valid for some release.0 is returned instead. This is useful for a ReleaseLine that hasn't started.setDateReturns:
{ days: {
total: 1073, // total days release is supported
current: 160, // days in `current` mode
lts: 548, // days in `active` LTS
maintenance: 365, // days in maintenance
completed: {
total: 144,
current: 144,
lts: 0,
maintenance: 0 },
remaining: {
total: 929,
current: 16,
lts: 548,
maintenance: 365 },
until: {
start: 0, // already started
lts: 16,
maintenance: 564,
eol: 929 }
},
percent: {
total: 13, // complete
current: 90,
lts: 0,
maintenance: 0 }
}
ReleaseLines extends Array classAn array of ReleaseLine instances. Provides helper methods for updating, filtering and querying release lines.
ReleaseLines.load(schedule, date) staticHydrates a schedule. If a schedule is not defined then the internal cached copy is automatically used.
Params:
Object
String or Date (required)String or Date (required)String or DateString or DateStringDate.now)Returns: ReleaseLines instance
ReleaseLines.fetch(date) staticParams:
Date.now)Returns: Promise - resolves to ReleaseLines instance
ReleaseLines.scheduleUrl (string) staticThe url to the offical release schedule.
get(version, resetDate)Params:
v10)Date, String or Boolean - changes the date. (optional)Returns: ReleaseLine or undefined
setDate(date)Params:
Date.now)Returns: this
getSupported(resetDate)Filters ReleaseLine items by isSupported
Params:
Date, String or Boolean - changes the date. (optional)Returns: ReleaseLines instance with only supported release lines.
getCurrent(resetDate)Filters ReleaseLine items by isCurrent
Params:
Date, String or Boolean - changes the date. (optional)Returns: ReleaseLines instance with only current release lines.
getMaintenance(resetDate)Filters ReleaseLine items by isMaintenance
Params:
Date, String or Boolean - changes the date. (optional)Returns: ReleaseLines instance with only release lines in maintenance mode.
getFuture(resetDate)Filters ReleaseLine items by isFuture
Params:
Date, String or Boolean - changes the date. (optional)Returns: ReleaseLines instance with only release lines that have yet to start.
getActive(resetDate)Filters ReleaseLine items by isActive
Params:
Date, String or Boolean - changes the date. (optional)Returns: ReleaseLines instance with only release lines that are in LTS, excluding maintenance window.
getEOL(resetDate)Filters ReleaseLine items by isEOL
Params:
Date, String or Boolean - changes the date. (optional)Returns: ReleaseLines instance with only release lines that have hit EOL
getModern(resetDate)Filters ReleaseLine items by isModern
Params:
Date, String or Boolean - changes the date. (optional)Returns: ReleaseLines instance with only modern release lines.
getLTS(resetDate)Filters ReleaseLine items by isLTS
Params:
Date, String or Boolean - changes the date. (optional)Returns: ReleaseLines instance with only release lines that have an LTS active mode in their lifecycle. Note: It does not neccessarily mean it is an active LTS (see getActive()).
Release classInstance properties:
String - version number of releaseDate - date of releaseNumber - number of modulesString - versionString - versionString - versionString - versionString - versionInstance getters:
Array of Vulnerability (lazy loading)Boolean - true if Release has no known vulnerabilities.Boolean - true if Release has one or more vulnerabilities.String url of docs for the specific releaseRelease.load(version) staticoptions:
StringReturns: Release or null if version does not exist
download(arch, type)If arch is omitted returns directory to all download resources for release version.
Currently
archandtypeare not implemented
options:
StringString (gz, xz, pkg, msi, zip)Returns: String url of download resource
Releases extends Array classAn array of Release instances. Provides helper methods for updating, filtering and querying release lines.
Releases.load(version) staticParams:
String (example v6)Returns: Releases instance
getSafe()Filters Release items by isSafe
Returns: Releases instance with only releases that have no known vulnerabilities.
Vulnerability classInstance properties:
StringInstance getters:
String - url to specific vulnerability in nodejs/security-wg repo.BooleanChangeLog classCurrently deprecations and notable changes are not fully supported.
Instance properties:
StringString current release line (example: Current)Date release dateString individual who performed the releaseString meta text above other sub headersString raw markdown text of the whole releaseArray of Commitload(version) staticoptions:
StringReturns: ChangeLog instance or null
Commit classInstance properties:
String commit shaString pr number associated with commitString author of commitBoolean if commit reverts prior commit(s) or behaviorString commit descriptionArray areas the commit touches (example: ['build', 'win'])Instance getters:
String url to the commit in githubString url to the pr on githubThank you Node.js Release Team and all the contributors to the Node.js project, without you none of this is possible. Special thanks goes out to Tierney Cyren. His relentless desire to improve accessibility, visibility and communication inspired this project.
To submit a bug report, please create an issue on GitHub.
If you'd like to contribute code to this project, please read the CONTRIBUTING.md document.
node-release-lines is Copyright (c) 2018 Nathan White and licensed under the MIT license. All rights not explicitly granted in the MIT license are reserved. See the included LICENSE.md file for more details.
FAQs
Data api for node.js releases
The npm package node-release-lines receives a total of 2 weekly downloads. As such, node-release-lines popularity was classified as not popular.
We found that node-release-lines demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.