5

AWS Lambda's support for Node.js and Node.js end of life do not coincide, instead AWS Lambda continues to support the runtime for a few months after the official end of life for a specific Node.js version. AWS says that they stop providing security patches after their deprecation, which to me implies that they will provide patches before then. Since there is a stretch of time between Node.js and of life and AWS Lambda runtime for Node.js, how is it that AWS is able to provide security patches to Node.js?

A concrete example to look towards is Node.js 18. The official end of life for this version is April 30 2025. AWS Lambda runtime lists the deprecation date of July 31 2025.

Improve this question
1
  • 1
    Good question. I would assume because the code is executed in an isolated environment, only for the runtime and gets reinitialized each time with no communication to outside directly per se.
    – Sir Muffington
    Commented Nov 22 at 16:34

1 Answer 1

Reset to default
5

... how is it that AWS is able to provide security patches to Node.js?

The code for Node.js is open source. If an issue gets known anybody can create a fix and ship it, including AWS. This is not much different from Linux distributions backporting fixes into old software versions so that customers don't need to upgrade to newer versions (which can create compatibility problems) just to fix security issues.

Note though that AWS does not claim that it will actively search for bugs. It neither claims that it will fix all known bugs. Usually such statements mean that they mostly care about critical bugs found by others.

Improve this answer
1
  • I'm reasonably satisfied with this answer. Though their claims sound dubious that they will do any fixing. Instead it sounds like they're relying on the goodwill of the opensource community to provide a fix after end of life, and it just so happens that will get picked up by AWS. I tried finding documentation about AWS notifying about bug fixes for node but could find none, I am curious but did not try looking to see if AWS is contributing to node after eol.
    – ndenarodev
    Commented Dec 6 at 20:37

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .