#​617 — March 26, 2026

Read on the Web

🟦 TypeScript 6.0 landed this week. We've put together a quick bulletpoint list of the Node-relevant changes and considerations at the end of the issue for you to check out before upgrading.
____
Your editor, Peter Cooper

Together with  Clerk
Node.js Weekly

The Node.js March 24, 2026 Security Releases — Node.js v25.8.2 (Current), v24.14.1 (LTS), v22.22.2 (LTS), and v20.20.2 (LTS) have just been released to address nine vulnerabilities (two of ‘high’ severity) covering a broad variety of areas like TLS, HTTP/HTTP2, the permission model, HMAC verification, URL processing, and V8 hashing (more on that next!)

The Node.js Team

Developing a Minimally HashDoS Resistant, Yet Quickly Reversible Integer Hash for V8 — Can a hash be both resistant to hash flooding (a.k.a. HashDoS) and quickly reversible? That’s the puzzle the Node team had to tackle in V8 for this week’s security release. This post on the official Node blog is extremely technical, but one of the most educational in years.

Joyee Cheung

Clerk M2M Tokens Now Support JWT Format for Faster Auth — Verify machine-to-machine tokens locally with no network request. Self-contained JWTs carry machine ID, claims, and expiration.

Clerk sponsor

IN BRIEF:

  • pnpm 11 Beta offers a sneak peek of the future for the popular, alternative efficiency-focused package manager, including a new SQLite-powered store, config overhaul, and stricter build security by default.

  • Last week, several Deno employees departed the company. Though not officially speaking for the company, Josh Collinsworth noted "Deno is not going away. These are just hard times."

  • ⚠️ Fastify users should upgrade to v5.8.3 / 5.8.4 to avoid a now-fixed protocol/host spoofing vulnerability.

Where Did 400 Megabytes of Memory Go? — A meticulous deep dive into working out why a Node-powered WebSocket k8s pod was using way more memory than its peers, despite process.memoryUsage() painting a rosy picture. Powerful techniques worth referring to when you need to investigate similar issues.

Fernando S.

The Three Pillars of JavaScript Bloat — Three reasons your node_modules is bigger than it should be: needless ES3-era compat packages, micro-libraries with a single consumer, and ponyfills for APIs that shipped years ago. Luckily, this article offers some solutions for trimming the fat.

James Garbutt

🛠 Code & Tools

Announcing Knip v6: The Fast Way to Declutter Your Projects — Knip has established itself as a go-to tool for finding and removing unused files, exports, and dependencies. v6 leans on oxc-parser for 2-4x performance gains (tearing through a huge repo like Astro in two seconds) and is a drop-in upgrade.

Lars Kappert

Your API Shouldn't Wait on a Pipeline for Fresh Data — TimescaleDB extends Postgres so analytics hits live data. No second database, no sync lag, no stale responses. Get started for free.

Tiger Data (creators of TimescaleDB) sponsor

Knex.js 3.2: The SQL Query Builder is Back — Knex is a popular ‘batteries included’ SQL query builder that supports Postgres, MySQL, SQL Server, SQLite3, and other SQL oriented database systems.

knex

💡 The Knex.js team has written a blog post announcing a revival of active development after an intensive period of catching up on a backlog of issues. "Knex deserves to thrive, and we’re committed to getting it there."

Vavite 6: Develop Server-Side Applications with Vite — Use Vite for your backend Node.js code too, so you get one unified toolchain for everything, including hot reloading for both front and back-end. v6 brings Vite 7/8 support, server-side HMR, and separate server mode (e.g. for Bun.serve).

Fatih Aygün

htmlparser2 12.0: A Fast and Forgiving HTML and XML Parser — Consumes documents and calls callbacks, but it can generate a DOM as well. There’s a live demo here. Works in both Node and browser.

Felix Böhm

  • Deno 2.7.6-2.7.8 – Now with NodeRuntime CDP (Chrome DevTools Protocol) support, deno eval auto-detects CJS vs ESM, and --cpu-prof-flamegraph generates interactive SVG flamegraphs.

  • pnpm/action-setup 5.0 – GitHub Action to install and configure pnpm. Now uses Node.js v24.

  • pnpm 10.33 – Adds a new dedupePeers setting that reduces peer dependency duplication.

  • Faker 10.4 – Generate realistic data for testing and development.

  • ws 8.20.0 – Long-standing WebSocket client and server library.

  • 🤖 OpenAI Node v6.33.0

🟦 TypeScript 6.0 for Node developers

Announcing TypeScript 6.0 — TypeScript 6.0 is designed to bridge the way from its self-hosted compiler to the Go-powered native compiler future of TypeScript 7.0 (which, we're told, is almost ready to go, too).

As always, the release post is huge but here are the things that jumped out to me as affecting Node developers the most:

  • types now defaults to []. TypeScript will no longer pull in potentially thousands of type declarations at build time. Great for performance, but... if you were relying on it, your project will break! "types": ["node"] or "types": ["*"] may be your friend at first.

  • strict is now true by default. Many of you will already be working in strict mode, but if not, get ready for a flood of new type errors unless you explicitly set it to false.

  • --moduleResolution node is deprecated. If you're targeting Node, you'll now use --moduleResolution nodenext which reflects how modern versions of Node resolve modules.

  • module now defaults to esnext. CommonJS projects must now set "module": "commonjs" explicitly.

  • #/ subpath imports now work. Available in Node since v25.4 (and backported into LTS releases), but now in TypeScript too.

  • rootDir now defaults to . If you have source files deeper than your tsconfig.json and were relying on TypeScript to infer a common root directory, you now need to explicitly set rootDir.

  • --esModuleInterop false and --allowSyntheticDefaultImports false no longer work. So if you're still using syntax like import * as express from "express" it won't work, you'd need to use import express from "express".

In short, TypeScript 6.0 tightens defaults across the board and throws enough changes into the works that many projects will need at least a tsconfig tweak.. good luck with your upgrades! 🤞