Node.js 25.9.0 (Current) Released — Including a --max-heap-size option to set the maximum heap size for a process, James Snell’s experimental ‘better streams API’ implementation lands as stream/iter (docs here), plus test runner module mocking improvements.

Antoine du Hamel

Memetria K/V: Efficient Redis & Valkey Hosting — Memetria K/V hosts Redis OSS and Valkey for Node.js apps, featuring large key tracking and detailed analytics.

Memetria sponsor

The Hidden Blast Radius of the Axios Compromise — You’ve probably heard about the supply chain attack via Axios this week (if not, be sure to check if you’re affected). Ahmad reflects on the mechanics of such attacks and why their effects spread further than you might think.

Ahmad Nassri (Socket)

A Gentle Intro to npm Workspaces — With workspaces, you can manage multiple packages in one repo and link local packages so they can import each other by name. npm may then hoist and deduplicate compatible dependencies during install.

Carlos Precioso (Wasp)

Run Agents on Production-Fidelity Sandboxes — Ox spins up a sandbox for every agent task. Isolated code, compute, and data. Test against prod with zero blast radius.

Ox sponsor

🤖 Transformers.js v4: Run AI Models from JavaScript — Run Hugging Face-hosted models to do things like LLMs, vision, and audio models from Node, in the browser, etc. v4 switches to WebGPU and is installable with npm. There are many demos covering speech transcription, using Qwen 3.5, and video captioning.

Hugging Face

node-re2: Bindings for Google's RE2 Regex Library — RE2 is a regular expression library with linear-time matching, making it immune to ReDoS attacks caused by backtracking. node-re2 offers it as a near drop-in replacement for RegExp.

Eugene Lazutkin

Defuddle: Extract the Main Content from Pages — Strips clutter from HTML leaving only the primary content for you to use. There’s a demo where you can try it out.

Steph Ango