Node.js 26.3: examining application permissions
A runtime update
On 1 June 2026, Node.js 26.3.0, on the Current branch, added permission.drop. This API deserves attention from teams examining the permissions granted to their applications.
Start with actual needs
For a JavaScript service, our practical question is which files it needs to read, where it writes and which processes it can launch. An inventory of these operations is more useful than a copied policy that ignores dependencies.
Consider a document converter. Loading configuration, processing a file and producing the result are three different stages. We recommend recording the access each stage needs before experimenting with restrictions. A library can also perform indirect operations that application code does not immediately reveal.
Check failure paths
A useful trial includes valid input, a missing file and a forbidden operation. Inspect returned messages, resource cleanup and temporary files. Having a permissions API does not by itself establish complete process isolation or application compatibility.
Retrospective watch — June 2026.