content(blog/events): add trip report of 2026 London summit#8840
content(blog/events): add trip report of 2026 London summit#8840legendecas wants to merge 7 commits intonodejs:mainfrom
Conversation
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
PR SummaryLow Risk Overview No application code changes; this PR is content-only. Reviewed by Cursor Bugbot for commit 202f2eb. Bugbot is set up for automated code reviews on this repo. Configure here. |
👋 Codeowner Review RequestThe following codeowners have been identified for the changed files: Team reviewers: @nodejs/nodejs-website Please review the changes when you have a chance. Thank you! 🙏 |
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #8840 +/- ##
==========================================
- Coverage 73.87% 73.24% -0.63%
==========================================
Files 105 102 -3
Lines 8883 8623 -260
Branches 326 313 -13
==========================================
- Hits 6562 6316 -246
+ Misses 2320 2306 -14
Partials 1 1 ☔ View full report in Codecov by Sentry. |
There was a problem hiding this comment.
Pull request overview
Adds a new events blog post documenting the 2026 London Node.js Collaboration Summit, expanding the site’s historical archive of summit trip reports.
Changes:
- Introduces a new markdown blog post with frontmatter (date/category/title/layout/author).
- Adds a structured recap of summit sessions plus a “Thanks” section and reference links.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
joyeecheung
left a comment
joyeecheung
left a comment
There was a problem hiding this comment.
Leaving some points that I think we need to cover before this can be published. I'll see if I can re-listen to the recordings to fill them in on Monday.
| ### Node.js Security - State of the Ecosystem & What's Next | ||
|
|
||
| [Rafael Gonzaga][] shared that the security team has recently advanced the ecosystem through a refined threat model, improved permission models, and enhanced release automation, but these efforts are currently being overshadowed by a massive influx of AI-generated vulnerability reports. This industry-wide surge, driven largely by users seeking CVE attribution and financial bounties, has severely strained maintainer capacity with high-noise, duplicative submissions that often lack reproduction steps or misclassify standard bugs as severe security threats. Despite attempted mitigations like pausing bug bounties, raising HackerOne signal requirements, and clarifying guidelines, the overwhelming volume has significantly driven up resolution times. To combat this bottleneck, the team is exploring strategies such as securing early access for proactive testing, attempting to alter reporting agent behaviors, and adopting a public security flow to bypass embargoes and speed up CI testing. | ||
|
|
There was a problem hiding this comment.
IIRC Robin presented a significant part of this. There was also the introduction of the two new programs which we should cover in the trip report.
There was a problem hiding this comment.
I could not find any public reference on the program so I didn't mention it here.
There was a problem hiding this comment.
@rginn Should we talk about this in the trip report a bit to give the readers a heads up that this is in the talks, or should we just skip talking about them? Note that the recording is public, so those who watch it can still see what's proposed and discussed.
There was a problem hiding this comment.
Oh actually I realized that part is in a separate session, though the recording is public https://www.youtube.com/watch?v=Vr2nrYENzSg
|
Since the recordings are out it may be useful to add links to them for each session, though it sounds like chores that may be better handled by an AI :) |
Co-authored-by: Jacob Smith <3012099+JakobJingleheimer@users.noreply.github.com> Signed-off-by: Chengzhong Wu <legendecas@gmail.com>
Co-authored-by: Joyee Cheung <joyeec9h3@gmail.com> Signed-off-by: Chengzhong Wu <legendecas@gmail.com>
Co-authored-by: Michael Esteban <mickel13@gmail.com> Signed-off-by: Chengzhong Wu <legendecas@gmail.com>
Co-authored-by: Jacob Smith <3012099+JakobJingleheimer@users.noreply.github.com> Signed-off-by: Chengzhong Wu <legendecas@gmail.com>
Co-authored-by: Joyee Cheung <joyeec9h3@gmail.com> Signed-off-by: Chengzhong Wu <legendecas@gmail.com>
There was a problem hiding this comment.
Cursor Bugbot has reviewed your changes and found 1 potential issue.
❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.
Reviewed by Cursor Bugbot for commit 202f2eb. Configure here.
The youtube playlist is linked at the end of the post already. |
mcollina
left a comment
mcollina
left a comment
There was a problem hiding this comment.
lgtm with the details from Robin's talk sorted
Description
Validation
Related Issues
Check List
pnpm formatto ensure the code follows the style guide.pnpm testto check if all tests are passing.pnpm buildto check if the website builds without errors.