Node Weekly

Node.js 26.7, vlt 1.0, and Shai-Hulud Returns

Thu, 6 Aug 2026 00:00:00 +0000

#636 — August 6, 2026

Node.js 26.7.0 (Current) Released — Landing just two days after 26.6, coverage reports can now include files your tests didn't touch with --test-coverage-include-all, FFI and SQLite pick up crash fixes, and Perfetto tracing support lands, though you'll need a custom build to use it.

Antoine du Hamel

💡 Node v24.19.0 (LTS) is also a noteworthy update, adding --experimental-import-text, fs.readFile() can reuse a buffer you supply, and setKeepAlive exposes TCP_KEEPINTVL and TCP_KEEPCNT.

Join Sentry Live: How Etsy Stays Crash-Free — Sentry and Etsy break down how Etsy's engineering team preps for peak traffic, debugs in real time, and ties crashes to revenue impact. Real stories and practical takeaways for teams running services at scale.

Sentry sponsor

🚨 Shai-Hulud Strikes Again, Affecting keyv and 400+ Packages — A credential-stealing worm was rolled out as part of a false keyv 6.0 release this week, and quickly spread. A reminder to check out npm v12, pnpm, or vlt (below), all of which block install scripts by default, the mechanism this worm relied on.

Shavit Satou (JFrog)

vlt 1.0: An npm Alternative With CSS-Like Selectors — After two years, Darcy Clarke's drop-in npm alternative hits 1.0. A key draw is vlt query, which lets you use 60+ CSS-like selectors over your dependency graph (half of which are security related). vlt also offers hosted private package registries.

Darcy Clarke

💡 In 2023, Darcy wrote "The massive bug at the heart of the npm ecosystem", a post that was prescient of current packaging headaches.

IN BRIEF:

⚠️ The Express team has announced security releases for body-parser to address a DoS vulnerability.
net.BlockList, used to prevent network access to/from specified IP addresses and ranges, is gaining new methods and getting much faster.
There's a proposal and initial implementation to bring the HTML spec's Web Worker API to Node.
ZIP archive support is coming to node:zlib in a future release.

📄 What's New in Mongoose 9.9: Major Performance Improvements – Mongoose is a popular MongoDB object modelling solution. Valeri Karpov

📄 Debugging Stuck Node.js Processes – A trick for catching event loop blockers that never yield. Winona Schroeer-Smith

🛠 Code & Tools

anydoc: Convert 14 Document Formats into Markdown — A Rust-powered library (with Node.js and WASM bindings) that converts Word, PowerPoint, Excel, OpenDocument, RTF, EPUB, CSV, and PDF documents into Markdown. I tried it on a 1,600 page PDF and it took less than 2 seconds. There's also an in-browser demo to try it out. GitHub repo.

Firecrawl

💡 Firecrawl also has pdf-inspector focused specifically on extracting text from PDFs (with positional awareness). Liteparse is also worth considering if you want OCR for scanned / non-text PDFs.

You Added a Cache to Hide a Slow Query — TimescaleDB makes the query fast in Postgres, so you cache less and serve fresh data. Get $1000 credit to start.

Tiger Data (creators of TimescaleDB) sponsor

ioredis 6.0: Robust, Full-Featured Redis Client for Node — v6.0, the first major release in four years, adds RESP3 and support for new Redis 8.10 features.

The ioredis Team

MicroDiff 1.6: Fast Object and Array Comparison Library — Given two objects or arrays, it returns the differences (think diff but for JS objects). This week's release adds support for Temporal types.

Jacob Jackson

Devalue 5.9: Get the Job Done When JSON.stringify Can't — A library from the Svelte project that's like JSON.stringify but can tackle cyclical and repeated references, regexes, Map/Set, and custom types. Try it here.

Svelte

node-x11 3.8 – An X Window System protocol client library with no dependencies, GLX / OpenGL support, and even the ability to work in the browser against a JavaScript X-server emulator.
pnpm 11.20 – Mostly security hardening, but also adds an npmjs: prefix you can use to more succinctly pin a dependency to the public registry. Note that pnpm 12.0 has also reached RC stage.
Hono 4.13.0 – The small, fast Web standards-based web framework focuses on performance and adds HTTP QUERY method support.
graphql-upload 18.0 – Middleware that adds support for GraphQL multipart requests to Node.js GraphQL servers.
cron-parser 5.7 – Library for parsing and manipulating cron expressions.

📰 Classifieds

⚡ Zuplo puts every API, AI, and MCP request behind one gateway. Route traffic, guard your MCP servers, and cap your AI costs. Try it free.

📢 Elsewhere in the ecosystem

Did you know JavaScript supports a third type of comment (beyond // and /* */)? ▶️ Mat Marquis shows off hashbang comments in a short YouTube video. And yes, they're in the language spec!
🤖 Fred K. Schott, of Astro fame, has unveiled Flue 2.0, the latest version of his TypeScript-based open agent framework.
⚖️ The Deno vs Oracle JavaScript™ trademark case rumbles on with Deno consenting to a fifth extension request as discovery continues.
📺 SQLite's Richard Hipp gave ▶️ a detailed 50-minute talk on SQLite's reliability and the tools, practices, and design choices that have given it its strong reputation.
📊 The results of the State of CSS 2026 survey have been released.

npm to scan packages for malware at publish time

Thu, 30 Jul 2026 00:00:00 +0000

#635 — July 30, 2026

Read on the Web

The Secure Way to Release an npm Package in 2026 — A practical guide to publishing npm packages more safely in 2026, written by someone who's released several popular packages (like postcss and nanoid). As well as showing how to use things like staged publishing and trusted publishing, he explains why and the security benefits of doing so.

Andrey Sitnik

Ship Node and Bun Apps in Minutes — Link your repo and Render takes it from there, handling every build, deploy, and SSL cert. Loop in your agent with official Render /plugins for Codex and Claude Code. Start free and scale from there.

Render sponsor

npm to Scan Every Package For Malware at Publish Time — The npm registry is beginning to scan packages at publish time, meaning new versions can take several minutes to become installable, and could be held or blocked.

GitHub

IN BRIEF:

🔒 The Wednesday, July 29, 2026 Security Releases of Node are available as Node v26.5.1, v24.18.1 and v22.23.2. 11 CVEs are tackled, including two HTTP/2 flaws, a Permission Model allowlist bypass, and more.
Microsoft is previewing a way to call native Windows APIs from Node (and therefore Electron) without native addons via a new dynamic Windows Runtime API (WinRT) projection.
Amazon's security team has narrowed down several npm supply chain attacks (such as those on debug and chalk) to a single North Korean-linked group.
Cloudflare's wrangler can now run integration tests against Workers from any Node.js test runner.

Check Out Node's New API Documentation Preview — Node's official API docs have been getting redesigned (now sharing a design system with nodejs.org itself) and have a new built-in search feature. You're invited to try the preview here and report what breaks.

Guilherme Araújo (Node.js Team)

How GitHub Is Disrupting Supply Chain Attacks on npm and Actions — Separate to the scanning news above, GitHub's team explains recent npm and Actions changes designed to mitigate supply chain attack techniques.

Ose and Steindler (GitHub)

📄 Finding Eight High-Severity Vulnerabilities in NodeBB in Six Hours Jorian Woltjer (Aikido)

📄 Running npm in a Separate Container When Using Claude Bryan Hogan

📄 Integration Testing with Node and Testcontainers Flavio Copes

🛠 Code & Tools

scriptc: Vercel's New TypeScript-to-Native Compiler — A new entry into the growing field of JS/TS native ahead-of-time compilers that makes the promise that "what compiles behaves byte-for-byte like Node." Static by default, but you can opt in to a --dynamic mode which embeds a JavaScript engine for runtime dynamism. GitHub repo.

Vercel Labs

Fast Endpoints Shouldn't Choke on Analytics — TimescaleDB extends Postgres so heavy queries stay fast at scale. One database, not two. Get $1000 credit to start.

Tiger Data (creators of TimescaleDB) sponsor

tslog 5: Zero-Dependency Logger for Node, Deno, Bun and Browsers — A ground-up rewrite that's now ESM-only. Pretty output by default, JSON optionally, plus middleware, file/HTTP/worker transports, secret masking, and error stacks that resolve through source maps to your .ts code. GitHub repo.

Eugene Terehov

npm-check-updates 23.0: Find Newer Versions of Dependencies — Find newer versions than your package.json allows. Has a -i interactive mode to look at upgrades and opt in to them one by one. Supports custom cooldown periods. v23 is faster, smaller, and is now a pure ESM package.

Raine Revere

jsdom 30.0: Pure JS Implementation of Web Standards for Node — The venerable browser-environment emulator used by countless test suites. v30.0 adds CSS.escape(), CSS.supports(), background-position-x/y, as well as some fixes.

Denicola, Insua, et al.

crypto-random-string 6.0: Generate a Cryptographically Strong Random String — For example: cryptoRandomString({length: 10}) might return 2cf05d94db. v6.0 improves performance and removes cryptoRandomStringAsync.

Sindre Sorhus

Ada v4 – The WHATWG-compliant URL parser used by Node is now even faster.
Wasp v0.25 – The Rails-esque framework for building full-stack webapps with React & Node introduces Vite 8 and React Router 8.
modern-tar 0.8 – Zero-dependency streaming tar parser and writer.
📋 tinyclip 1.0 – Cross-platform clipboard utility library.
Nub 0.6 – Fast all-in-one toolkit that augments Node.
Verdaccio 6.9 – Self-hostable private npm registry.

Domenic Denicola's modern dev setup

Thu, 23 Jul 2026 00:00:00 +0000

#634 — July 23, 2026

Read on the Web

No, We Can't Harden Node.js Against Prototype Pollution — An explanation of why the Node team rejects prototype pollution reports against core: each assumes the attacker can already write to Object.prototype, by which point the game is over. The true fix lives at the boundary where untrusted JSON becomes objects.

Matteo Collina

Full-Text Search in Drizzle Without a Second System — Try the official ParadeDB integration for Drizzle. Search your live Postgres tables. No stale results, no ETL, no Elasticsearch cluster.

ParadeDB sponsor

Domenic Denicola's Agentic Coding Setup — It's fascinating when a prolific developer (Domenic was a key figure in the adoption of promises in JavaScript, creating jsdom, and much more) shares their workflow. This is no exception, covering areas like disposable VMs, Tailscale, and worktrees.

Domenic Denicola

IN BRIEF:

⚠️ A round of July 27 Node.js security releases has been announced, with Node 26.x, 24.x, 22.x being updated to resolve a HIGH severity issue.
🏆 The OpenJS Foundation is showcasing a ranking of the top contributors to its projects (which include Node, Express, and Electron) in the past year. Matteo Collina leads the way…just!
Over on 𝕏, the Bun team is teasing the imminent release of Bun 1.4, which will have the "biggest jump in Node.js compatibility since Bun v1.0".
pnpm has had a flurry of releases introducing native workspace release management, a doctor command to diagnose installation issues, and more.
ESLint now provides official 'codemods' for automating ESLint version migrations, with v8→v9 and v9→v10 available.

better-sqlite3 13.0: The Popular SQLite Library Moves to N-API — The good news is prebuilt binaries should now work across different versions of Node and Electron. There's also a new db.explain() method and a preparedStatement.toString() method to get the expanded SQL of a prepared statement.

Joshua Wise

High-Ingest Analytics, Still Just Postgres — TimescaleDB extends Postgres to ingest and query events at scale. One database, standard SQL. Get $1000 credit to start.

Tiger Data (creators of TimescaleDB) sponsor

📄 Unpacking the AsyncAPI npm Supply Chain Compromise – It seems attackers have already adapted to a world where post-install scripts are no longer run. Microsoft Security Research

📄 New Study Identifies 53 Slopsquatting Targets Across 5 Popular LLMs – LLMs continue to make up npm package names. Sarah Gooding

📄 Running Background Jobs in Node.js with BullMQ Flavio Copes

🛠 Code & Tools

Execa 10.0: Better Process Execution from Node — A powerful way to run processes that makes passing in input, processing output, handling errors, piping things around, and handling streams easy. v10 trims the API and adds new stream conversion powers and a killDescendants option to terminate a subprocess's descendant processes.

Sindre Sorhus

eslint-package-json: Powerful ESLint Rules for package.json — An ESLint plugin that catches package.json mistakes like invalid names, bad version ranges, broken exports, redundant files entries, and more, and fixes many of them automatically.

Sindre Sorhus

🤖 BotKit: Build Standalone ActivityPub Bots — A way to run a bot (or multiple bots) that Mastodon users can see and follow but without needing an account anywhere. Write it all in JavaScript and self-host. I spun one up with Node (temporarily) and it worked well.

Fedify

Nub 0.5 – The all-in-one toolkit that augments Node's feature set. v0.5 adds nub init as a way to quickly scaffold new projects.
odiff 4.5 – Fast SIMD-powered image comparison library. Written in Zig with Node bindings.
node-html-to-image 6.2 – A function to generate images from HTML.
find-my-way 9.7 – Fast radix-tree based HTTP router used by Fastify.
Gitify 7.0 – Electron-powered Git notifications menu bar app.
Verdaccio 6.8 – Self-hostable Node.js private proxy registry.
Piscina 5.3 – Popular worker thread pool implementation.
Prisma 7.9

📰 Classifieds

⚡ Zuplo puts every API, AI, and MCP request behind one gateway. Route traffic, guard your MCP servers, and cap your AI costs. Try it free.

The life of a ~200ms HTTP request to a Node app

Thu, 16 Jul 2026 00:00:00 +0000

#633 — July 16, 2026

Read on the Web

Follow a Single HTTP Request Through Its ~200ms Life — From the creator of NodeBook, a thorough guide to Node's internals, comes a scroll-driven visualization following every step a single HTTP POST request takes from the user's click to Node's event loop and on to a database behind it.

Ishtmeet Singh

The Best Harness Wins, Not the Best Model. Learn Harness Engineering — Scott Moss (Netflix) teaches you to wrap an LLM in a production-grade harness. Learn durable execution, sandboxing, memory, and multi-agent orchestration.

Master.dev sponsor

Fetch Needs Error Codes — e.cause.code lets you find out why a fetch() failed in Node, but the spec says failures are just bare TypeErrors, so HTTP/2/3 typed signals like "safe to retry this POST" go missing. James, who created Node's error code convention, is pushing a TC39 proposal to standardize a fix.

James M Snell

IN BRIEF:

Ant is a new entry to the growing field of JavaScript runtimes. This time, it's an independent engine written in C packed into a 9MB binary that boasts very low cold start times and can run Hono apps.
If you're considering using Go at all, this 'from Express to Fiber' guide with examples in both JavaScript and Go (on the Express-inspired Fiber framework) could be helpful.
🇮🇹 NodeConf EU 2026 takes place this September 29-30 in Italy. Tickets are still available.
Vercel is deprecating Node 20 for Builds and Functions on October 1, 2026.

Proxy and Reflect: Redefining How Objects Fundamentally Work — A deep dive into intercepting the internal operations of JavaScript objects, covering why Reflect exists at all, and ending with a small reactive state system.

Mat Marquis

Telegram Serverless: Run Telegram Bots on Telegram's Servers — Creating a bot for Telegram is easy (it has a great API) with libraries like node-telegram-bot-api, but it's starting to support running them on its own servers.

💡 The serverless program is in beta, so not all users will have access to it yet.

📄 A Gentle Introduction to Git Worktrees – For when you need to check out multiple branches into separate directories simultaneously. Nicholas C. Zakas

📄 Playwright on GitHub Actions: A Setup That Actually Runs Fast – How to cut Playwright CI time by caching browser binaries, lifting the scaffold's one-worker cap, and more. Jakob Norlin

📄 6 Security Settings Every GitHub Maintainer Should Enable This Week Joseph Katsioloudes (GitHub)

🛠 Code & Tools

LiteParse 2: Fast, Light PDF Document Parsing — A PDF parser built in Rust with bindings for Node (plus WASM, Rust, and Python) — it worked great in my testing. It includes OCR, handles layouts/is spatially aware, and is fast (a complex 140-page PDF took ~10 seconds). Here's how to get started from Node.

LlamaIndex

One Postgres for Your API and Your Analytics — TimescaleDB extends Postgres so your app and analytics run in one database at scale. Get $1000 credit to start.

Tiger Data (creators of TimescaleDB) sponsor

actions/setup-node@v7: Install Node in GitHub Actions — The popular way to set up an Actions workflow with a version of Node brings changes supporting GitHub's cache-poisoning defenses, inspired by recent exploits. There are also new docs on publishing to npm with Trusted Publisher (OIDC).

GitHub

🎬 Mediabunny: A Full Media Toolkit for JavaScript — It's been a year since we mentioned this library for reading/writing/converting media formats (MP4, MP3, and more). Since then, it's added Apple ProRes, HLS read/write, and a new server package that makes it all even easier to use from Node.

Vanilagy

Tinbase: A Supabase-Compatible Backend in a Single Binary — Provides a local Supabase-like dev experience using a JS backend built atop PGlite and pg-mem. A sort of mini, local-only Postgres wrapped in the same APIs as Supabase, so supabase-js works unchanged.

Sanket Sahu

@neon/sdk: Neon's New TypeScript Client Library — For users of the Neon Postgres platform to manage projects, branches, and databases from code.

Andre Landgraf (Neon)

Nano ID 6.0 – Generate tiny URL-friendly unique string identifiers. Now 4x faster and drops Node 18/20 support.
c8 12.0 – Istanbul-compatible coverage reports using Node's built-in V8 data. Node's test runner also has its own experimental code coverage reporting.
np 12.0 – Sindre Sorhus's "better npm publish" adds support for npm 12 and staged publishing.
HyperExpress 7.0 – A high performance Node server powered by uWebSockets.js.
Helmet 8.3 – HTTP security header hardening for Express apps.
node-auth0 6.0 – One for Auth0 users.
ESLint 10.7

📢 Elsewhere in the ecosystem

TypeScript-using AWS SDK for JavaScript v3 users need to be aware of changes to the library's support for TypeScript versions.
GitHub's Dependabot is now giving packages a three-day default cooldown before opening version update PRs, though security fixes are exempt.
TC39's 115th meeting takes place next week. Here's the agenda, including Await Dictionary aiming for Stage 3, plus Decimal, Import Defer, and Map.take.
📁 Cloudflare has launched 'Drop', a way to quickly get a site live by dropping a folder or ZIP onto a page, similar to Netlify's service of the same name.
plx is a transpiler for Postgres stored functions that converts JavaScript, PHP, Python, Ruby, and even COBOL, to Postgres's own PL/pgSQL language.