Claudio Wunder

Platform Engineering @HubSpot — open source at @nodejs @webpack @gnome and open governance at @openjsf.

[Claudio Wunder @wunderacle]

Man, @starsetonline is such a freaking amazing band.

[Claudio Wunder @wunderacle]

@SapphoSys European, not scared 😭

[Claudio Wunder @wunderacle]

Man this song is just a fucking banger

https://t.co/iwyx40STGn

[HeroDevs @herodevs]

Tomorrow. One hour. Two members of the Node.js Technical Steering Committee.

Matteo Collina (TSC Chair) and Marco Ippolito (TSC & HeroDevs Engineer) join HeroDevs' Javier Perez to talk Node 20 EOL, the path to Node 27 LTS, and how the project is handling a flood of AI-generated CVE reports — plus what to do if you can't migrate off Node 20 yet.

Live Q&A included.

📅 May 27, 2026 | 11:00 AM EST | Free registration
Register → https://t.co/zd5l2T8Zl0

#NodeJS #OpenSource #EndOfLife #DevSecOps #JavaScript #HeroDevs

[Claudio Wunder @wunderacle]

You know what, after years of expensive PCs, the Steam Machine is going to be my next PC for Open Source development, gaming and personal usage. I'm pretty sure I'm going to rock it with CachyOS to get the best of performance.

[Claudio Wunder @wunderacle]

@dinokupinic @yiannis__p @tannerlinsley @tan_stack The example of sports and a Coca Cola ad are such in bad taste. Take the L. These sponsors enable @tannerlinsley to keep doing the great work he does. For you and possible your organizations to benefit from it for free. If it bothers you so much, just hide it, cmd-2 […]

[Claudio Wunder @wunderacle]

@bruvimtired I only noticed now you work with my bestie @JuanPa lol

[Claudio Wunder @wunderacle]

@bruvimtired

[Node.js @nodejs]

Another day, another Node.js release 😎

Node.js 24.16.0 is out! A few test runner features, `randomUUIDv7`, plus many more bug fixes and small improvements.

Full changelog and download links: https://t.co/rWsnHIlj26

[Claudio Wunder @wunderacle]

@thejsnation So excited for this talk.

[Claudio Wunder @wunderacle]

Finishing my slides for @thejsnation 2026 whilst listening to Caramelldansen lol

[Node.js @nodejs]

Node.js 26.2.0 is out! ✨

`stream.compose` is now stable, `node:fs` integrates with the new `Temporal` API, and a fair load of bug fixes.

Full changelog and download: https://t.co/VglkTXqgNF

[Claudio Wunder @wunderacle]

I’m slowly starting to think that Bun as a toolchain will be a failure and see no real adoption… But still wishing best of luck for Jarred and team.

[Vic 🌮 @VicVijayakumar]

holy shit bye bye zig and rust

[Claudio Wunder @wunderacle]

What I think of investors that somehow miraculously think AI is going to replace SaaS any time soon:

[Claudio Wunder @wunderacle]

@saltyAom Howdy, could you elaborate? 👀

[Claudio Wunder @wunderacle]

These are no fun times to be an Open Source maintainer. Security incidents all the time.

[Claudio Wunder @wunderacle]

@matteocollina @nodejs @bunjavascript OpenAI might have second thoughts on that Codex license they gave you, Matteo 😩

[Claudio Wunder @wunderacle]

@tan_stack Also, @tannerlinsley and the @tan_stack team handled this gracefully. Quick actions, clear comms, super professional handling. Y'all rock!

[Claudio Wunder @wunderacle]

Sending warm hugs to @tan_stack, the moment I read in their postmortem that they were using steps with pull_request_target I immediately knew, their Actions Cache got poisoned.

This is the sort of silly mistake even veterans can easily be targeted, and yet another reason why GitHub should deprecated pull_request_target and improve the default security of GitHub Actions.

[Claudio Wunder @wunderacle]

Which ends up in a default of having no trust on changes to your workflows by 3rd parties and intensive scrutiny to any changes involving them. We genuinely need better default security mechanisms within GitHub Actions Workflows. From preventing malicious eval, from defaulting a more secure runner, like the Hardener Runner, and much much more.

[Claudio Wunder @wunderacle]

It is unfathomable how many steps we often need to go to secure our GitHub Actions workflows. There is just too much. I'm lucky that @GitHub provided me and my team training through the GitHub Secure OSS Fund program, but still, if your project has many collaborators it is hard to keep track of all the changes your workflows may or not have.