Move to LFX

This proposal moves our @iojs.org mailing aliases into the Linux Foundation's LFX Project Control Center under the @nodejs.org alias, which gives us managed committees and mailing lists with support for surveys and voting.

(For purposes of this document, → should be interpreted as email@domain.tld forwards to email@domain.tld)

Each alias falls into one of four categories:

Converted to a Working Group: These will be upgraded to LFX and are fine to continue using. They will¹ be automatically updated as our GitHub Teams evolve
Supported: These aliases that remain in active use, and for the most part redirect to an alias defined in (1). These will be upgraded to LFX and are fine to continue using.
Maintenance: These aliases are kept only for legacy or operational reasons. These will be upgraded to LFX, but only so existing integrations keep working; new usage is discouraged, and users should move to an alias defined in (1).
Deprecated: aliases that will not be upgraded to LFX. They remain reachable only through their @iojs.org counterpart, which will eventually stop working.

Two general principles apply throughout:

LF-controlled aliases will be replaced by this proposal.
*@iojs.org aliases will not be touched for now, but should be gradually phased out after the migration to @nodejs.org on LFX is complete.
*@iojs.org aliases will redirect to *@nodejs.org once this migration is complete.

1. Converted to a Working Group

I've created the following committees in LFX, with this proposed mapping.
These will be upgraded to LFX and are fine to continue using.

Technical Steering Committee: tsc@nodejs.org
Moderation Team: moderation@nodejs.org
Discord Moderation Team: moderation-discord@nodejs.org
Build Working Group: build@nodejs.org
Website & Infrastructure Working Group: web@nodejs.org
Jenkins Administrators: ci@nodejs.org
Security Triage Team: security-triage@nodejs.org
Release Working Group: release@nodejs.org
Undici Maintainers: undici@nodejs.org

2. Supported

These externally-facing aliases remain in active use. They will be upgraded
to LFX and forward to the relevant working-group alias (with an exception of security@); they are fine to
continue using.

report@nodejs.org forwards to moderation@nodejs.org
report-discord@nodejs.org → moderation-discord@nodejs.org
security@nodejs.org → nodejs-79566c66a30b0312@forwarding.hackerone.com

3. Maintenance

These aliases will be upgraded to LFX, but only for legacy reasons. They will keep working for the time being so existing integrations don't break, but new usage is discouraged.

Note: They are not mapped 1:1 with their previous mappings.

admin@nodejs.org forwards to build-infra@nodejs.org
accounts@nodejs.org → build-infra@nodejs.org
nodejs-pypi@nodejs.org → build-infra@nodejs.org
nodejs-vercel@nodejs.org → web@nodejs.org
nodejs-crowdin@nodejs.org → web@nodejs.org
cve-request@nodejs.org → security-triage@nodejs.org
cve-mitre-contact@nodejs.org → security-triage@nodejs.org
cna-discussion-list@nodejs.org → security-triage@nodejs.org
ci-alert@nodejs.org → ci@nodejs.org
release-validation-alert@nodejs.org → build-infra@nodejs.org.
zoom-nodejs@nodejs.org → tsc@nodejs.org²
wiby-bot@nodejs.org → bjohansebas@gmail.com + hello+wibybot@dominykas.com
github-bot@nodejs.org → tsc@nodejs.org

4. Deprecated

These aliases will not be upgraded to LFX. They remain reachable only via
their @iojs.org counterpart, which will eventually stop working. If any are
still in use, please let me know.

rvagg@iojs.org
Personal account; no longer needed as a project alias.
nodejs-lfx-bounty@iojs.org
No longer needed.
security-ecosystem@iojs.org
The associated HackerOne account has been closed, as far as I'm aware.

In the future ↩
We are in the process of moving away from Zoom meetings created using this email, and as such, this email will forward to TSC for legacy reasons, but will be deprecated in the near future. ↩

I think this might need to be done on a case by case basis. Possibly mailing only lists could be migrated but functional aliases such as build's is used in several of the infra providers.

@RafaelGSS

I've created the following committees in LFX, and here's my proposed mapping:

* [Technical Steering Committee](https://projectadmin.lfx.linuxfoundation.org/project/a092M00001IV4HSQA1/collaboration/committees/d4186f20-9af3-4bc2-8f5d-da44eeff54a9): `tsc@nodejs.org`

This alias exists today, so how is this going to work? Does the proposal replace the existing LF managed account? (I'm not even sure how the LF account is currently set up as it isn't managed by the Build WG -- @RafaelGSS mentioned that he didn't get emails sent to the existing nodejs.org alias).

The following aliases are simple 1:1 aliases without a committee, and can probably be set up with LFX email forwarding. After this migration, we should consider these aliases deprecated, in favor of the ones above. After all services linked to the deprecated aliases are updated, these can be removed entirely2:

First of all the existing aliases (the left hand side of the mapping) are *@iojs.org (with the exception of tsc where there is the Build WG alias at iojs.org and the LF managed one at nodejs.org).

* `zoom-nodejs@nodejs.org`: `tsc@nodejs.org`[1](#user-content-fn-4-c66be792d8d2ef35990e4a6d06fa59c2)

This is wrong. I believe this alias is for the people who host meetings on Zoom and

those are not all TSC.
neither are all TSC on this alias.

There might be a valid question of whether the alias is needed if all WG meetings are moved to LFX, but the point is that it is not the same list as the TSC.

* `ci-alert@nodejs.org`: `ci@nodejs.org`[1](#user-content-fn-4-c66be792d8d2ef35990e4a6d06fa59c2)

I'd keep the -alert to make it clear what this list is for.

* `cve-request@nodejs.org`: `security-wg@nodejs.org`

* `cve-mitre-contact@nodejs.org`: `security-wg@nodejs.org`

* `cna-discussion-list@nodejs.org`: `security-wg@nodejs.org`

This is wrong. Security reports should be going to the security team, which is not the same as the Security WG.

* `release-validation-alert@nodejs.org`: `release@nodejs.org`[1](#user-content-fn-4-c66be792d8d2ef35990e4a6d06fa59c2)

Same as for ci-alert above, this obfuscates the purpose for this list.

I think my confusion is that I don't understand the second mapping. That isn't a 1:1 mapping and instead appears to be attempting to collapse them into the aliases for the working groups, which is not how we're handling the mailing aliases.

I've updated the proposal above

@nodejs/TSC PTAL at the original issue for my proposal

Given the hiccups we had with the meetings, I think we should hold off for this for a while and reassess.

This system worked extremely well for a decade, I'm not sure it's worth changing.

Navigation Menu

Repository navigation

Move to LFX #293

1. Converted to a Working Group

2. Supported

3. Maintenance

4. Deprecated

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Move to LFX #293

Description

1. Converted to a Working Group

2. Supported

3. Maintenance

4. Deprecated

Footnotes

Activity

richardlau commented on Jun 19, 2026

avivkeller commented on Jun 22, 2026

avivkeller commented on Jun 22, 2026

richardlau commented on Jun 22, 2026

avivkeller commented on Jun 22, 2026

richardlau commented on Jun 22, 2026

avivkeller commented on Jun 22, 2026

avivkeller commented on Jun 22, 2026

avivkeller commented on Jul 4, 2026

abduljaleelvpjallu-arch commented on Jul 17, 2026

mcollina commented on Jul 17, 2026

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions