Node Weekly

Node 26.8 reads and writes ZIP files

Thu, 27 Aug 2026 00:00:00 +0000

#638 — August 27, 2026

🗓️ We're back! If you missed us last week, we took a brief summer vacation :-)
__
Your editor, Peter Cooper

A Recap of Node.js Interactive 2026 — Node.js Interactive returned for the first time since 2019 as part of this month's RenderATL event with Node contributors and invited speakers tackling Node's near-term roadmap in areas like AI, supply chain security, WinterCG becoming Ecma TC55, work on QUIC and HTTP/3 support, and Node's move to one major release a year.

Aviv Keller

Open Source Just Out-Reviewed the Commercial Tools — PR-AF places #2 of 42 on Martian's Code-Review-Bench, ahead of CodeRabbit, Copilot, and Devin, at ~10x lower cost per review. It plans the review per PR, runs reviewer agents in parallel, and verifies every finding against your source. Self-hosted.

AgentField.ai sponsor

Node.js 26.8.0 (Current) Released — Among a variety of additions, Node can read and write ZIP archives without a third-party dependency. Plus Node's REPL now has basic syntax highlighting support. v26.8.1 landed hours later to fix a broken version string.

Antoine du Hamel

💡 Node 24.20.0 (LTS) also landed with several backported features including package maps, permission auditing, node:stream/iter, and WebAssembly JSPI.

IN BRIEF:

🤚 The latest annual Node.js user survey has just launched. As always, your responses help shape the future priorities of the Node.js team.
💡 Aviv Keller has proposed reimplementing fs.glob natively in C++, calling straight into libuv and benching at over twice the speed of the current version. Not landed yet, but there are some big names on this thread.
James Snell is seeking early feedback on a proposed Fetch Server API, part of Node's unified HTTP API initiative, offering one handler model for HTTP/1.1, 2 and 3.
TermDOM, featured in our last issue, lets you build TUI apps with HTML and CSS in Node, and now supports CSS Grid for layout.
AWS Lambda has introduced a new Node.js 26 runtime in preview.

🤖 Node's Official AI Use Policy and Guidelines — Merged into Node's contributing docs after months of debate, PRs with AI code you haven't understood or tested can be closed unreviewed, bot-opened PRs need pre-approval, and more to be aware of. Plus, don't use AI to claim "good first issue" tasks!

Node.js Project

📄 Query Pipelining in node-postgres: 2-3x More Throughput – More throughput and lower latency from one config change is always worth looking into. Matteo Collina

📄 ESM vs CommonJS: What import and require Actually Do Gabor Koos

🛠 Code & Tools

pnpm 12: Rewritten in Rust, Same Commands and Lockfile — The Rust rewrite is stable, but all of v11's commands, flags and lockfile format carry over with only a handful of changes. A global node now follows the version your project pins, too. Note that npm's latest tag still points to pnpm 11, so you'll need pnpm self-update next-12 to upgrade.

Zoltan Kochan

Better Auth 1.7 Ships a Standards-Based OAuth Server — A big OAuth provider release with DPoP, per-API token rules and device code flow, plus MCP auth in its own package. Breaking changes make the upgrade guide required reading.

Gustavo Valverde

Outgrowing Cron? Meet xyOps for Self-Hosted Ops Automation — Schedule jobs, run Node scripts, monitor servers, and automate response. Open source, from the Cronicle team.

xyOps sponsor

GTKX: Build Linux Desktop Apps with Node, GTK and React — Build Linux desktop apps with real GTK4 and Adwaita widgets with no webview involved. Write JSX and get real widgets in an ordinary Node process with npm package and Fast Refresh support.

Eugenio Depalo

Stryker Mutator 10.0: Test Your Tests with Mutation Testing — Stryker deliberately changes your code to see if your test suite catches the mutations. If not, your tests are too lax and need work. Here's how to get started.

Jansen, de Lang, et al.

SVGO 4.1: Node-Powered SVG Optimizer — SVGs often contain redundant information. You can use SVGO as a CLI tool or Node library to slim them down. v4.1 has stricter XML validation and security improvements.

Kir Belevich

Electron 44 – 32-bit builds are gone, macOS 13+ is now required, clipboard is aligned with the W3C Clipboard API, net.WebSocket is added, plus the ability to set window opacity on Linux.
lz4-napi 2.10.0 – N-API bindings for LZ4 compression/decompression, implemented in Rust and backed by lz4_flex.
🤖 grammY 1.46.0 – The framework for building Telegram bots from Node now supports the latest Telegram Bot API 10.3.
Axios 1.20.0 – The long-standing HTTP client for the browser and Node.js.
node-mongodb-native 7.6 – MongoDB 4.2 support has been dropped entirely.
📺 YouTube.js 18.0 – JavaScript client for YouTube's internal API.
node-x11 4.1 – Feature-rich X11 protocol client library.

Building terminal UIs with HTML and CSS

Thu, 13 Aug 2026 00:00:00 +0000

#637 — August 13, 2026

Read on the Web

🗓️ We're taking a summer break next week, so will be back in your inbox on August 27.
__
Your editor, Peter Cooper

TermDOM: Build Terminal UIs with HTML, CSS and the DOM — Like the look of Ink but don't like React? TermDOM implements a DOM, cascade and layout engine that paints to the terminal, so you can write a TUI with HTML and CSS. Pure JS, no native or WASM dependencies, and the official TodoMVC runs with only a stylesheet swap. Early days, but I like the idea!

Brian Kim

Harness Engineering: How to Wrangle Your Agents — The models keep changing. The harness is the part you build. Scott Moss (Netflix) shows how: durable execution, sandboxed tool calls, memory systems, and multi-agent handoffs.

Master.dev sponsor

Fastify 6.0 Enters Alpha — It's been two years since Fastify, the popular low overhead web framework, dropped v5, but v6 is coming into sight. It's largely shaping up as a 'spring clean' release requiring Node 24 at minimum but should be good for initial testing. More background here.

The Fastify Team

IN BRIEF:

Node maintainer Matteo Collina explains how he 'triages the AI horde' when it comes to handling 20-40 security reports each week.
Bun 1.4's release appears to be imminent with 𝕏 Node.js compatibility teased as the biggest enhancement. It hasn't dropped as we go to press, but keep an eye on their blog, as no doubt it'll land minutes after we hit send! 😂
node:domain, deprecated in the docs since 2015, could become runtime-deprecated in Node 27 — if you're still using it, speak up now.
⚠️ Several teams are reporting out-of-memory crashes after upgrading from Node 24.18.1 to 24.19.0 (and rolling back fixes it). Nothing confirmed yet, so add your data if affected.
Vercel now offers a one-click Node.js upgrade mechanism for deprecated Node.js versions (notably new Node 20-based builds will fail after Oct 1).

Adding a Second Middleware Broke Our TypeScript Types — A TypeScript detective story in which adding a second middleware could collapse a return type to {}. The culprit was a widely used key-filtering idiom that leaks undefined when properties are optional.

Linell Bonnette (Inngest)

📄 5 Useful npx Helpers – A reminder that npx makes it easy to run one-off tools. Jens shares five he likes for spell checking, cleaning up JS projects, and more. Jens Oliver Meiert

📄 Fixing the Dual-Write Problem in Node.js with the Outbox Pattern – Making your database and message queue agree. Gabor Koos

📄 A Deep Dive into How Hono Is Built Flavio Copes

🛠 Code & Tools

DeepSeek Harness: DeepSeek's New Node-Powered Agent Harness — Today, the popular Chinese model lab unveiled its own Claude Code-alike and already racked up 30k stars. It's not a typical CLI harness, though, but runs through a web UI. Curiously, everything is a plugin, built atop Cordis, an existing Node plugin system whose author DeepSeek has hired. GitHub repo.

DeepSeek

unbash: Fast 0-Dependency Bash Parsing Library — The parser Knip uses to make sense of shell scripts, as a standalone library. It turns bash code into a typed AST that can then be used for classification, permission checks, rewriting commands, and more.

Lars Kappert

Full-Text Search in Drizzle Without a Second System — Try the official ParadeDB integration for Drizzle. Search your live Postgres tables. No ETL, no Elasticsearch cluster.

ParadeDB sponsor

njsscan 1.0: A Semantic-Aware SAST Tool for Node — A pip-installable, zero-config security scanner that finds insecure patterns in Node apps using ~70 semgrep-powered rules for XSS, SSRF, eval, JWT and NoSQL injection.

Ajin Abraham (OpenSecurity)

Hucre 1.0: A Zero-Dependency Spreadsheet Engine — A library for reading and writing common spreadsheet formats, including things like embedded images, hyperlinks, password protection, and tables.

Wind

NodeBB 4.15.0 – The Node-powered forum software (demo site here) gets lots of bug fixes and enhances fediverse support.
smol-toml 1.8 – Small, fast, spec-compliant TOML 1.1 parser/serializer.
BullMQ 6.1 – Fast, reliable Redis- or Postgres-based distributed queue.
swift-node 0.1.2 – Write the native part of a Node module in Swift.
Vitest 5.0 Release Candidate

We'll be back in two weeks on August 27 – see you then! Unless you're a React Status subscriber too, in which case… see you tomorrow ;-)

Node.js 26.7, vlt 1.0, and Shai-Hulud Returns

Thu, 6 Aug 2026 00:00:00 +0000

#636 — August 6, 2026

Read on the Web

Node.js 26.7.0 (Current) Released — Landing just two days after 26.6, coverage reports can now include files your tests didn't touch with --test-coverage-include-all, FFI and SQLite pick up crash fixes, and Perfetto tracing support lands, though you'll need a custom build to use it.

Antoine du Hamel

💡 Node v24.19.0 (LTS) is also a noteworthy update, adding --experimental-import-text, fs.readFile() can reuse a buffer you supply, and setKeepAlive exposes TCP_KEEPINTVL and TCP_KEEPCNT.

Join Sentry Live: How Etsy Stays Crash-Free — Sentry and Etsy break down how Etsy's engineering team preps for peak traffic, debugs in real time, and ties crashes to revenue impact. Real stories and practical takeaways for teams running services at scale.

Sentry sponsor

🚨 Shai-Hulud Strikes Again, Affecting keyv and 400+ Packages — A credential-stealing worm was rolled out as part of a false keyv 6.0 release this week, and quickly spread. A reminder to check out npm v12, pnpm, or vlt (below), all of which block install scripts by default, the mechanism this worm relied on.

Shavit Satou (JFrog)

vlt 1.0: An npm Alternative With CSS-Like Selectors — After two years, Darcy Clarke's drop-in npm alternative hits 1.0. A key draw is vlt query, which lets you use 60+ CSS-like selectors over your dependency graph (half of which are security related). vlt also offers hosted private package registries.

Darcy Clarke

💡 In 2023, Darcy wrote "The massive bug at the heart of the npm ecosystem", a post that was prescient of current packaging headaches.

IN BRIEF:

⚠️ The Express team has announced security releases for body-parser to address a DoS vulnerability.
net.BlockList, used to prevent network access to/from specified IP addresses and ranges, is gaining new methods and getting much faster.
There's a proposal and initial implementation to bring the HTML spec's Web Worker API to Node.
ZIP archive support is coming to node:zlib in a future release.

📄 What's New in Mongoose 9.9: Major Performance Improvements – Mongoose is a popular MongoDB object modelling solution. Valeri Karpov

📄 Debugging Stuck Node.js Processes – A trick for catching event loop blockers that never yield. Winona Schroeer-Smith

🛠 Code & Tools

anydoc: Convert 14 Document Formats into Markdown — A Rust-powered library (with Node.js and WASM bindings) that converts Word, PowerPoint, Excel, OpenDocument, RTF, EPUB, CSV, and PDF documents into Markdown. I tried it on a 1,600 page PDF and it took less than 2 seconds. There's also an in-browser demo to try it out. GitHub repo.

Firecrawl

💡 Firecrawl also has pdf-inspector focused specifically on extracting text from PDFs (with positional awareness). Liteparse is also worth considering if you want OCR for scanned / non-text PDFs.

You Added a Cache to Hide a Slow Query — TimescaleDB makes the query fast in Postgres, so you cache less and serve fresh data. Get $1000 credit to start.

Tiger Data (creators of TimescaleDB) sponsor

ioredis 6.0: Robust, Full-Featured Redis Client for Node — v6.0, the first major release in four years, adds RESP3 and support for new Redis 8.10 features.

The ioredis Team

MicroDiff 1.6: Fast Object and Array Comparison Library — Given two objects or arrays, it returns the differences (think diff but for JS objects). This week's release adds support for Temporal types.

Jacob Jackson

Devalue 5.9: Get the Job Done When JSON.stringify Can't — A library from the Svelte project that's like JSON.stringify but can tackle cyclical and repeated references, regexes, Map/Set, and custom types. Try it here.

Svelte

node-x11 3.8 – An X Window System protocol client library with no dependencies, GLX / OpenGL support, and even the ability to work in the browser against a JavaScript X-server emulator.
pnpm 11.20 – Mostly security hardening, but also adds an npmjs: prefix you can use to more succinctly pin a dependency to the public registry. Note that pnpm 12.0 has also reached RC stage.
Hono 4.13.0 – The small, fast Web standards-based web framework focuses on performance and adds HTTP QUERY method support.
graphql-upload 18.0 – Middleware that adds support for GraphQL multipart requests to Node.js GraphQL servers.
cron-parser 5.7 – Library for parsing and manipulating cron expressions.

📰 Classifieds

⚡ Zuplo puts every API, AI, and MCP request behind one gateway. Route traffic, guard your MCP servers, and cap your AI costs. Try it free.

📢 Elsewhere in the ecosystem

Did you know JavaScript supports a third type of comment (beyond // and /* */)? ▶️ Mat Marquis shows off hashbang comments in a short YouTube video. And yes, they're in the language spec!
🤖 Fred K. Schott, of Astro fame, has unveiled Flue 2.0, the latest version of his TypeScript-based open agent framework.
⚖️ The Deno vs Oracle JavaScript™ trademark case rumbles on with Deno consenting to a fifth extension request as discovery continues.
📺 SQLite's Richard Hipp gave ▶️ a detailed 50-minute talk on SQLite's reliability and the tools, practices, and design choices that have given it its strong reputation.
📊 The results of the State of CSS 2026 survey have been released.

npm to scan packages for malware at publish time

Thu, 30 Jul 2026 00:00:00 +0000

#635 — July 30, 2026

Read on the Web

The Secure Way to Release an npm Package in 2026 — A practical guide to publishing npm packages more safely in 2026, written by someone who's released several popular packages (like postcss and nanoid). As well as showing how to use things like staged publishing and trusted publishing, he explains why and the security benefits of doing so.

Andrey Sitnik

Ship Node and Bun Apps in Minutes — Link your repo and Render takes it from there, handling every build, deploy, and SSL cert. Loop in your agent with official Render /plugins for Codex and Claude Code. Start free and scale from there.

Render sponsor

npm to Scan Every Package For Malware at Publish Time — The npm registry is beginning to scan packages at publish time, meaning new versions can take several minutes to become installable, and could be held or blocked.

GitHub

IN BRIEF:

🔒 The Wednesday, July 29, 2026 Security Releases of Node are available as Node v26.5.1, v24.18.1 and v22.23.2. 11 CVEs are tackled, including two HTTP/2 flaws, a Permission Model allowlist bypass, and more.
Microsoft is previewing a way to call native Windows APIs from Node (and therefore Electron) without native addons via a new dynamic Windows Runtime API (WinRT) projection.
Amazon's security team has narrowed down several npm supply chain attacks (such as those on debug and chalk) to a single North Korean-linked group.
Cloudflare's wrangler can now run integration tests against Workers from any Node.js test runner.

Check Out Node's New API Documentation Preview — Node's official API docs have been getting redesigned (now sharing a design system with nodejs.org itself) and have a new built-in search feature. You're invited to try the preview here and report what breaks.

Guilherme Araújo (Node.js Team)

How GitHub Is Disrupting Supply Chain Attacks on npm and Actions — Separate to the scanning news above, GitHub's team explains recent npm and Actions changes designed to mitigate supply chain attack techniques.

Ose and Steindler (GitHub)

📄 Finding Eight High-Severity Vulnerabilities in NodeBB in Six Hours Jorian Woltjer (Aikido)

📄 Running npm in a Separate Container When Using Claude Bryan Hogan

📄 Integration Testing with Node and Testcontainers Flavio Copes

🛠 Code & Tools

scriptc: Vercel's New TypeScript-to-Native Compiler — A new entry into the growing field of JS/TS native ahead-of-time compilers that makes the promise that "what compiles behaves byte-for-byte like Node." Static by default, but you can opt in to a --dynamic mode which embeds a JavaScript engine for runtime dynamism. GitHub repo.

Vercel Labs

Fast Endpoints Shouldn't Choke on Analytics — TimescaleDB extends Postgres so heavy queries stay fast at scale. One database, not two. Get $1000 credit to start.

Tiger Data (creators of TimescaleDB) sponsor

tslog 5: Zero-Dependency Logger for Node, Deno, Bun and Browsers — A ground-up rewrite that's now ESM-only. Pretty output by default, JSON optionally, plus middleware, file/HTTP/worker transports, secret masking, and error stacks that resolve through source maps to your .ts code. GitHub repo.

Eugene Terehov

npm-check-updates 23.0: Find Newer Versions of Dependencies — Find newer versions than your package.json allows. Has a -i interactive mode to look at upgrades and opt in to them one by one. Supports custom cooldown periods. v23 is faster, smaller, and is now a pure ESM package.

Raine Revere

jsdom 30.0: Pure JS Implementation of Web Standards for Node — The venerable browser-environment emulator used by countless test suites. v30.0 adds CSS.escape(), CSS.supports(), background-position-x/y, as well as some fixes.

Denicola, Insua, et al.

crypto-random-string 6.0: Generate a Cryptographically Strong Random String — For example: cryptoRandomString({length: 10}) might return 2cf05d94db. v6.0 improves performance and removes cryptoRandomStringAsync.

Sindre Sorhus

Ada v4 – The WHATWG-compliant URL parser used by Node is now even faster.
Wasp v0.25 – The Rails-esque framework for building full-stack webapps with React & Node introduces Vite 8 and React Router 8.
modern-tar 0.8 – Zero-dependency streaming tar parser and writer.
📋 tinyclip 1.0 – Cross-platform clipboard utility library.
Nub 0.6 – Fast all-in-one toolkit that augments Node.
Verdaccio 6.9 – Self-hostable private npm registry.