Outdated Node.js version support

This is based on travis coverage, as I couldn’t find a better indicator of supported versions (such as "engines" in package.json). Node 8, 11, and 13 are no longer maintained and shouldn’t be supported, and Node 14 is missing support. ESM is also unflagged in Node 14, and backwards-compatible support is relatively easy if you’re willing to add some ease-of-use.

[iarna]

If you could phrase this as a PR? =D (If you’re not up to this, I’ll do it myself, but it’ll get in faster this way. XD)

As far as older versions go: I’m not about supporting lazy devs, I’m about supporting overworked ops teams. The reality is that all of security is constant cost/benefit calculations, and the risk level of a given vulnerability is going to vary a lot depending on the specifics of the situation. Folks tend to think in terms of Node backing up websites, but I know of a number of very large Node installations that are not web based at all.

[jsejcksn]

Second unpopular opinion: I avoid ESM whenever possible.

@iarna Will you explain this? I’m very interested to understand your perspective. If you’ve already written about it elsewhere, a link is great.