Node.js Security Best Practices — Did you know the Node.js project maintains a page about security best practices organized around how to mitigate ten of the most significant vectors? Topics include networking weaknesses, timing attacks, supply chain attacks, and the monkey patching of intrinsics.

Node Documentation

Agentic Postgres: AI-Ready Postgres for Go Developers — Tiger Data’s Agentic Postgres turns vanilla Postgres into an AI-native database. Fork DBs, give agents memory, and query via REST or CLI. Perfect for Go backends building with Claude, Cursor, or custom agents. Try it free—no card needed.

Tiger Data sponsor

pnpm 10.21: Safer Installs and Smarter Runtime Management — pnpm can now automatically install the Node version required by a dependency, declared in its engines.runtime field, meaning CLI apps and postinstall scripts will run with the specified version. A new trustPolicy setting also adds protection against supply-chain attacks by failing to install packages whose trust level drops (e.g. if a package’s build pipeline loses attestation).

Zoltan Kochan

Umami 3.0: A Self-Hosted, Privacy-Focused Google Analytics Alternative — Think something like Plausible or Google Analytics, but built in Node and ready for you to host yourself. Here’s the full feature list. MIT licensed but also available as a paid hosted service.

Umami Software, Inc.

Unify Logs, Errors, and Traces in One Place — See logs, errors, and traces together in one place for full context. Debug faster with Sentry Logs.

Sentry sponsor

Tasuku (タスク): A Minimal Task Runner for Node — Tasuku, Japanese for ‘task’, provides a clean way to break up processes into small tasks, which can then be run in the right order with progress displayed elegantly in the terminal. Think make but Node-flavored. Live demo.

hiroki osame

🛑 fkill 10.0: A Cross-Platform Way to Kill Processes — Working on macOS, Linux, and Windows, this gives you a nice API for kill processes. For example: await fkill('chrome', {waitForExit: 2000});

Sindre Sorhus

CSSOM: A CSS Parser Written in Pure JavaScript — Also a partial implementation of CSS Object Model.

Nikita Vasilyev

Render.js: A Raytracing Renderer with RenderMan Format Support — Created at Pixar in the 80s, the RenderMan Interface Specification was an early API for building 3D scenes. Anders has been building a Node-based, 90s-style renderer for the format “as a stroll down amnesia lane” in pure JavaScript.

Anders Brownworth