Emscripten 6.0.2 still has Node.js 22.16.0

[John Dallman]

Is this deliberate? My software security people are pointing out that it's the same version as was in Emscripten 4.0.21, so it is pretty old. The latest 22.x is 22.23.1, from 16-JUN-2026. 

I used Node for the first time when I started on Emscripten, so I'm a bit cautious about trying to install my own. I'm working on Linux.

Thanks, 

John Dallman

 

[Sam Clegg]

Hi John,

What you are referring to with 22.16.0 is the version of node that is bundled with emsdk.   We don't tend to update this very often, for various reasons.   Note that emscripten uses node only for its internal JS compiler.  This means its only used to process your code, not, for example, untrusted code from the internet.

If you have concerns about it fairly easy to just avoid using it.   You can configure emscripten to use any version of node you like (by setting `NODE=` in your config file or `EM_NODE=` as an environment variable).

For example, if you would prefer to use your linux distributions version of node with emscripten you should be able to simply `export EM_NODE=/usr/bin/node`.     You could instead edit `/path/to/emsdk/.emscripten` config file (but you may need to re-edit this each time you run emsdk installs a new version).

cheers,

sam

--
You received this message because you are subscribed to the Google Groups "emscripten-discuss" group.
To unsubscribe from this group and stop receiving emails from it, send an email to emscripten-disc...@googlegroups.com.
To view this discussion visit https://groups.google.com/d/msgid/emscripten-discuss/CAH1xqgnEC%2B4oUWNZ2vKEGGPvsfYqbCr2KfBqLHwzwcGYNncSmQ%40mail.gmail.com.

[John Dallman]

> Note that emscripten uses node only for its internal JS compiler.  This means it's only used 

> to process your code, not, for example, untrusted code from the internet.

Oh. I've been using it for testing stuff I build, simply because it was already on PATH. 

Would a sounder method be to leave $EMSDK_NODE alone, so that Emscripten can use the version it was tested with for compiling and put another version of Node on PATH ahead of the Emscripten entries? If so, do I need any other environment variables set for the other version of Node? 

Yes, I'm being extremely cautious. I'm under a lot of time pressure, and my knowledge of web application programming is very limited. I keep finding I'm making wrong assumptions, and/or running into things that seem weird to me. Many things that seem utterly obvious to you are strange to me. 

Thanks, 

John

To view this discussion visit https://groups.google.com/d/msgid/emscripten-discuss/CAL_va2-sxHr8m3Jbd1FAj%2B7DJ2x-HkVOLNtwWGiO3O756pZRxw%40mail.gmail.com.

[Sam Clegg]

On Tue, Jul 14, 2026 at 3:24 AM John Dallman <jgdats...@gmail.com> wrote:

> Note that emscripten uses node only for its internal JS compiler.  This means it's only used 

> to process your code, not, for example, untrusted code from the internet.

Oh. I've been using it for testing stuff I build, simply because it was already on PATH. 

Indeed if you put some other version of node in your path we have code in emsdk that will ensure that the emsdk version is *not* installed in your PATH:   https://github.com/emscripten-core/emsdk/blob/main/emsdk_manifest.json#L190.   This line means that if `node` is found in your PATH we will not add the path or the emsdk node (Although emscripten itself will still use it).

Would a sounder method be to leave $EMSDK_NODE alone, so that Emscripten can use the version it was tested with for compiling and put another version of Node on PATH ahead of the Emscripten entries? If so, do I need any other environment variables set for the other version of Node? 

No, you should not need to do anything special to run the emscripten-generated code on any version of node you like.. as long as it is recent enough (The current default min version for the generated code is 18.3).
 

To view this discussion visit https://groups.google.com/d/msgid/emscripten-discuss/CAH1xqgkUwJS8avEO8J4OYZY4Bbsw2%2BMK1xiFDc%3DfEhU7xcyBUw%40mail.gmail.com.