Node.js 25: V8 14.1, Permission Model --allow-net, Web Storage e JSPI
Esplora Node.js 25: upgrade V8 14.1 con JSON.stringify più veloce, --allow-net per permission model, Web Storage abilitato, ErrorEvent globale e JSPI per WebAssembly.
Node.js 25 introduce V8 14.1 con performance JSON.stringify migliorate, Uint8Array base64/hex nativo, --allow-net per permission model, Web Storage abilitato di default, ErrorEvent globale e JSPI per WebAssembly. Questa release continua il focus su sicurezza, standard web e performance.
🎯 Novità Principali
V8 14.1 Upgrade
Performance e feature JavaScript:
// ✅ Node.js 25 - V8 14.1
// JSON.stringify performance improvements
const largeObject = {
users: Array.from({ length: 10000 }, (_, i) => ({
id: i,
name: `User ${i}`,
email: `user${i}@example.com`,
active: true,
})),
};
// Benchmark:
// V8 13.7 (Node 24): 45ms
// V8 14.1 (Node 25): 12ms
// → 3.75x faster!
console.time("stringify");
const json = JSON.stringify(largeObject);
console.timeEnd("stringify");
Uint8Array base64/hex conversion:
// ✅ Built-in base64/hex encoding
const data = new Uint8Array([72, 101, 108, 108, 111]);
// Base64 encoding (nativo!)
const base64 = data.toBase64();
console.log(base64); // "SGVsbG8="
// Hex encoding (nativo!)
const hex = data.toHex();
console.log(hex); // "48656c6c6f"
// Decoding
const decoded = Uint8Array.fromBase64("SGVsbG8=");
console.log(decoded); // Uint8Array [72, 101, 108, 108, 111]
const decodedHex = Uint8Array.fromHex("48656c6c6f");
console.log(decodedHex); // Uint8Array [72, 101, 108, 108, 111]
// Prima: necessario Buffer o librerie
// Ora: nativo e più veloce!
WebAssembly optimizations:
// ✅ JIT pipeline improvements
// Compile WebAssembly module
const wasmCode = await fetch("module.wasm").then((r) => r.arrayBuffer());
const module = await WebAssembly.compile(wasmCode);
// Instantiate (più veloce in V8 14.1)
const instance = await WebAssembly.instantiate(module);
// Performance:
// V8 13.7: 45ms compile + instantiate
// V8 14.1: 28ms compile + instantiate
// → 38% faster!
Permission Model: --allow-net
Network access control:
// ✅ Node.js 25 - Network permissions
// Nega tutto di default
node --experimental-permission --deny-all app.js
// PermissionError su qualsiasi network access
// Permetti host specifici
node --experimental-permission \
--allow-net=api.example.com \
app.js
// Permetti multiple hosts
node --experimental-permission \
--allow-net=api.example.com,cdn.example.com \
app.js
// Permetti con wildcard
node --experimental-permission \
--allow-net=*.example.com \
app.js
Usage example:
// ✅ Secure third-party code execution
// app.js
import fetch from "node-fetch";
import { runUntrustedCode } from "./untrusted.js";
// Permetti solo API sicure
// node --experimental-permission \
// --allow-net=trusted-api.com \
// app.js
// OK: host permesso
const response = await fetch("https://trusted-api.com/data");
try {
// Error: host non permesso
await fetch("https://malicious-site.com/steal-data");
} catch (err) {
console.log("Blocked:", err.code); // 'ERR_ACCESS_DENIED'
}
// Esegui codice untrusted con sicurezza
runUntrustedCode();
// Non può fare network requests non autorizzati!
--allow-inspector:
# ✅ Controllo inspector access
# Permetti debugging
node --experimental-permission \
--allow-inspector \
app.js
# Ora inspector/debugger funzionano
# Chrome DevTools, VS Code debugger, ecc.
# Senza flag: inspector disabled per sicurezza
Web Storage API
LocalStorage e SessionStorage abilitati:
// ✅ Node.js 25 - Web Storage enabled
// localStorage (persistent)
localStorage.setItem(
"user",
JSON.stringify({
name: "Alice",
email: "alice@example.com",
})
);
const user = JSON.parse(localStorage.getItem("user"));
console.log(user.name); // "Alice"
// sessionStorage (session-only)
sessionStorage.setItem("token", "abc123");
const token = sessionStorage.getItem("token");
// Standard Web API!
// Compatibile con codice browser
Storage limits:
// ✅ Storage size limits
// Default: 10MB per origin
// Configurabile con --max-storage-size
// Check available space
console.log(localStorage.length); // Number of items
console.log(sessionStorage.length);
// Iterate storage
for (let i = 0; i < localStorage.length; i++) {
const key = localStorage.key(i);
console.log(key, localStorage.getItem(key));
}
// Clear storage
localStorage.clear();
sessionStorage.clear();
Use cases:
// ✅ Configuration management
class ConfigStore {
static save(config) {
localStorage.setItem("app-config", JSON.stringify(config));
}
static load() {
const data = localStorage.getItem("app-config");
return data ? JSON.parse(data) : this.defaults();
}
static defaults() {
return {
theme: "dark",
language: "en",
notifications: true,
};
}
}
// Use in CLI app
const config = ConfigStore.load();
console.log("Theme:", config.theme);
config.theme = "light";
ConfigStore.save(config);
ErrorEvent Global
Standard error event:
// ✅ Node.js 25 - ErrorEvent global
// Create error events
const errorEvent = new ErrorEvent("error", {
message: "Something went wrong",
filename: "app.js",
lineno: 42,
colno: 10,
error: new Error("Original error"),
});
console.log(errorEvent.message); // "Something went wrong"
console.log(errorEvent.filename); // "app.js"
console.log(errorEvent.lineno); // 42
console.log(errorEvent.error); // Error object
// Use with EventTarget
class MyService extends EventTarget {
async fetchData() {
try {
const response = await fetch("https://api.example.com/data");
return response.json();
} catch (error) {
const errorEvent = new ErrorEvent("error", {
message: error.message,
error,
});
this.dispatchEvent(errorEvent);
}
}
}
const service = new MyService();
service.addEventListener("error", (event) => {
console.error("Service error:", event.message);
});
JSPI for WebAssembly
JavaScript Promise Integration:
// ✅ Node.js 25 - JSPI enabled
// WebAssembly può ora usare async JavaScript APIs!
// wasm module (pseudo-code):
// export async function fetchAndProcess() {
// const data = await fetch('https://api.example.com/data');
// return processData(data);
// }
// JavaScript:
import { instantiate } from "./module.wasm";
const instance = await instantiate({
imports: {
// Async imports funzionano!
async fetchData(url) {
const response = await fetch(url);
return response.arrayBuffer();
},
},
});
// Call async WASM function
const result = await instance.exports.fetchAndProcess();
console.log(result);
// Prima: WASM non poteva usare async APIs
// Ora: integrazione completa con Promises!
🔒 Security & Deprecations
Deprecations Removed
// ❌ Removed in Node.js 25
// SlowBuffer
const buffer = new SlowBuffer(10); // Error!
// Use Buffer.allocUnsafe()
// fs.F_OK, fs.R_OK, fs.W_OK, fs.X_OK
import { F_OK } from "fs"; // Error!
// Use fs.constants.F_OK
// assert.CallTracker
const tracker = new assert.CallTracker(); // Error!
// Use mock functions instead
// assert.fail(message, message2, ...)
assert.fail("msg1", "msg2"); // Error!
// Use assert.fail(message)
// child_process._channel
proc._channel; // Undefined (EOL)
// Use documented IPC APIs
Runtime Deprecations
// ⚠️ Runtime deprecations
// ECDH.setPublicKey()
const ecdh = crypto.createECDH("secp256k1");
ecdh.setPublicKey(publicKey); // DeprecationWarning
// Avoid using, will be removed
// crypto shake128/256 default lengths
const hash = crypto.createHash("shake128");
hash.update("data").digest(); // Warning
// Specify output length explicitly
hash.update("data").digest({ length: 16 });
Compile Cache Improvements
// ✅ Portable compile cache
// Enable compile cache
node --experimental-compile-cache app.js
// Cache location
process.env.NODE_COMPILE_CACHE = '/path/to/cache';
// Benefici:
// - Startup 30% più veloce
// - Portable across machines (Node 25+)
// - Automatic invalidation
// Example timing:
// First run: 450ms startup
// Cached run: 315ms startup (-30%)
📊 Performance Improvements
postMessage Optimization
// ✅ 500x faster per stringhe
import { Worker } from "worker_threads";
const worker = new Worker("./worker.js");
// Large string (3MB)
const largeString = "x".repeat(3 * 1024 * 1024);
// Benchmark:
// Node 24: 593ms
// Node 25: 1.2ms
// → 494x faster!
console.time("postMessage");
worker.postMessage(largeString);
console.timeEnd("postMessage");
// Simple objects: 240x faster
const complexObject = {
users: Array(10000).fill({ name: "User", age: 30 }),
};
console.time("postMessage-object");
worker.postMessage(complexObject);
console.timeEnd("postMessage-object");
// Node 24: 120ms
// Node 25: 0.5ms
Crypto Performance
// ✅ Sign/Verify 34x faster
const { generateKeyPairSync, sign, verify } = require("crypto");
const { privateKey, publicKey } = generateKeyPairSync("rsa", {
modulusLength: 2048,
});
const data = Buffer.from("data to sign");
// Benchmark Sign/Verify:
// Node 24: 850ms (10k iterations)
// Node 25: 25ms (10k iterations)
// → 34x faster!
console.time("sign-verify");
for (let i = 0; i < 10000; i++) {
const signature = sign("sha256", data, privateKey);
verify("sha256", data, publicKey, signature);
}
console.timeEnd("sign-verify");
Hash/HMAC Performance
// ✅ Native C++ implementation
const crypto = require("crypto");
const data = Buffer.from("test data");
// Hash benchmark:
console.time("hash");
for (let i = 0; i < 100000; i++) {
const hash = crypto.createHash("sha256");
hash.update(data);
hash.digest();
}
console.timeEnd("hash");
// Node 24: 245ms
// Node 25: 68ms → 3.6x faster
// HMAC benchmark:
console.time("hmac");
for (let i = 0; i < 100000; i++) {
const hmac = crypto.createHmac("sha256", "secret");
hmac.update(data);
hmac.digest();
}
console.timeEnd("hmac");
// Node 24: 280ms
// Node 25: 75ms → 3.7x faster
🎨 Node.js Compatibility
node:test Support
// ✅ Initial node:test support
import { test, describe } from "node:test";
import assert from "node:assert";
describe("Math operations", () => {
test("addition", () => {
assert.strictEqual(1 + 1, 2);
});
test("subtraction", () => {
assert.strictEqual(5 - 3, 2);
});
});
// Leverages bun:test under the hood
// Same performance, Node.js API
Worker Enhancements
// ✅ environmentData API
import { Worker, getEnvironmentData, setEnvironmentData } from "worker_threads";
// Parent thread
setEnvironmentData("config", {
apiUrl: "https://api.example.com",
timeout: 5000,
});
const worker = new Worker("./worker.js");
// worker.js
import { getEnvironmentData } from "worker_threads";
const config = getEnvironmentData("config");
console.log(config.apiUrl); // "https://api.example.com"
console.log(config.timeout); // 5000
// Share configuration across workers
// No need to pass via postMessage
🎓 Best Practices
1. Permission Model per Security
// ✅ Least privilege principle
// Development: permetti tutto
node app.js
// Production: restrizioni
node --experimental-permission \
--allow-fs-read=/app/data \
--allow-net=api.example.com \
app.js
// Testing untrusted code
node --experimental-permission \
--deny-all \
--allow-fs-read=/safe/path \
untrusted.js
2. Web Storage per Config
// ✅ CLI configuration
class Config {
static KEY = "app-config";
static load() {
const data = localStorage.getItem(this.KEY);
return data ? JSON.parse(data) : this.defaults();
}
static save(config) {
localStorage.setItem(this.KEY, JSON.stringify(config));
}
static defaults() {
return {
apiKey: process.env.API_KEY,
debug: false,
};
}
}
// Usage
const config = Config.load();
if (config.debug) console.log("Debug mode");
3. ErrorEvent per Error Handling
// ✅ Consistent error handling
class DataService extends EventTarget {
async fetch(url) {
try {
const response = await fetch(url);
if (!response.ok) {
throw new Error(`HTTP ${response.status}`);
}
return response.json();
} catch (error) {
const event = new ErrorEvent("error", {
message: error.message,
error,
});
this.dispatchEvent(event);
return null;
}
}
}
// Usage
const service = new DataService();
service.addEventListener("error", (event) => {
logger.error("Fetch failed:", event.message);
});
const data = await service.fetch("https://api.example.com/data");
4. Compile Cache in Production
# ✅ Enable for faster restarts
# Production
NODE_COMPILE_CACHE=/var/cache/node node app.js
# Docker
ENV NODE_COMPILE_CACHE=/app/.cache
# Benefici:
# - Cold start -30%
# - Container restart più veloce
# - Lambda warm start ridotto
📊 Performance Comparison
| Feature | Node 24 | Node 25 | Improvement |
|---|---|---|---|
| JSON.stringify | 45ms | 12ms | 3.75x |
| postMessage (str) | 593ms | 1.2ms | 494x |
| postMessage (obj) | 120ms | 0.5ms | 240x |
| Sign/Verify | 850ms | 25ms | 34x |
| Hash (SHA256) | 245ms | 68ms | 3.6x |
| HMAC (SHA256) | 280ms | 75ms | 3.7x |
| Compile cache | 450ms | 315ms | -30% |
💡 Conclusioni
Node.js 25 porta miglioramenti significativi:
✅ V8 14.1 con JSON.stringify 3.75x più veloce ✅ --allow-net per network security ✅ Web Storage abilitato di default ✅ ErrorEvent globale standard ✅ JSPI per WebAssembly async ✅ postMessage 500x più veloce ✅ Crypto 34x più veloce
Upgrade oggi:
# Installa Node.js 25
# nvm
nvm install 25
nvm use 25
# Direct download
# https://nodejs.org/dist/v25.0.0/
# Verifica versione
node --version # v25.0.0
Quando usare Node.js 25:
- ✅ Nuovi progetti
- ✅ Security-critical applications
- ✅ Heavy JSON processing
- ✅ Worker threads intensive
- ✅ Crypto operations
- ✅ WebAssembly integration