Modernity posture

blamejs anchors its defaults to the *current* bar — the active LTS, the current TLS minimum, the post-quantum primitives standardized today — not the broadest-compatible older option. Frameworks that pin to "what most people support" entrench yesterday's posture as tomorrow's default.

Node.js: Active LTS, no transpilation #

The framework runs on Node Active LTS as shipped — currently Node 24+. No Babel, no TypeScript build, no transpilation step. Every transpilation hop is a supply-chain hop and a debug-loss hop. CommonJS, var, node:-prefixed builtins.

TLS 1.3 minimum, no fallbacks #

Inbound and outbound TLS both refuse anything below 1.3. ALPN announces h2 first; HTTP/1.1 only on opt-in. ECH is enabled when the OS / Node version supports it; SVCB / HTTPS records are honored on outbound DNS. OCSP stapling is required on inbound listeners; CT SCTs are validated on outbound dialing.

Post-quantum first #

Default symmetric: **XChaCha20-Poly1305** (extended-nonce, 256- bit key). Default KEM: **ML-KEM-1024 hybridized with X25519** (FIPS 203 + classical safety net). Default KDF: **SHAKE256**. Default signature: **SLH-DSA-SHAKE-256f** for audit; **ML-DSA** for outbound where size matters. No AES-GCM, SHA-256, P-256, or classical-only ECDH as defaults.

Passwords: Argon2id only #

The framework refuses to verify a hash that doesn't start with $argon2id$. No PBKDF2 or bcrypt fallback. Operators with legacy hashes migrate at first login (the verify path detects + re-hashes).

LTS calendar #

Every major version ships with a 24-month security-only patch calendar. The calendar is published at blamejs.com/lts with the next-major's breaking-change list visible during the deprecation window. Deprecation warnings ship at least one minor before removal. No silent breaking changes in minor versions.

Last updated 2026-08-08T16:39:49.652Z by seeder.