Node Weekly

npm v12 and TypeScript 7 released

Thu, 9 Jul 2026 00:00:00 +0000

#632 — July 9, 2026

npm v12 Ships with Install Scripts Off by Default — npm 12 is now GA with many breaking changes. The headline change is lifecycle scripts and implicit node-gyp builds no longer run by default. Socket’s Sarah Gooding writes more about the practical implications including, thankfully, that unknown .npmrc keys will now only warn rather than error as they did in the pre-releases.

GitHub

Your Next.js App Is Already Tracing. Now Make It Useful — When a Next.js page is slow, the hard part is finding which part is responsible: middleware, SSR, an API route, a query, or a fetch call. 🔍 Next.js is already tracing all of it. Here's how to actually see it and put it to use.

Sentry sponsor

Node.js 26.5.0 (Current) Released — Key additions include the ability to import text files into ES modules via import attributes (behind an experimental flag), blob.textStream() (good for streaming large blob content), and being able to sample event-loop delay per iteration via perf_hooks.

Richard Lau

IN BRIEF:

Bun's Jarred Sumner wrote up the full story of rewriting Bun in Rust, a somewhat controversial AI-powered port that will power Bun 1.4 onward. The cost? ~$165k of Fable usage, at API prices.
James Snell has a TC39 proposal to standardize a code property on Error (as has long been common in Node).
Better Auth, the framework-agnostic auth library, is joining Vercel.

TypeScript 7.0 Released — Over a year after announcing TypeScript would be ported to Go, the final release is out. Don't rush to upgrade: TS 7.0 doesn't ship with an API yet, and 6.0 is still a good stepping stone. If you do upgrade, expect to see huge build time speedups, once moduleResolution: node is switched to nodenext and you've sorted out "types": ["node"].

Microsoft

CVE-2026-48931 Shouldn't Have Been a CVE — A candid post-mortem from a Node maintainer explaining a recent snafu around an HTTP/1.1 poisoning issue he now argues shouldn’t have been a CVE, especially after the fix broke node-fetch, Firebase, and the official Docker images.

Matteo Collina

What's New in ECMAScript 2026 — The ECMAScript 2026 spec was approved last week, and this round-up covers several main new features that made the cut, with all (except Math.sumPrecise) available in Node today.

Pawel Grzybek

📄 You Shouldn't Trust Trusted Publishing – npm added trusted publishing, but it’s authentication, not a safety or quality badge. Matteo Collina has also written about this from the npm perspective before. William Woodruff

📄 Node.js Worker Threads in Production – Hard-won lessons from running worker threads at scale. Aaron Harper (Inngest)

🛠 Code & Tools

terminal-image 5.0: Display Images in the Terminal — Works in any terminal that supports colors by rendering colored blocks, but can render images inline in terminals that support inline graphics. v5.0 improves iTerm2 support by using its native inline image support, rather than the Kitty protocol.

Sindre Sorhus

Full-Text Search in Drizzle Without a Second System — Try the official ParadeDB integration for Drizzle. Search your live Postgres tables. No ETL, no Elasticsearch cluster.

ParadeDB sponsor

eslint-node-test: ESLint Rules for Node's Built-In Test Runner — In Sindre’s own words: “If you use the Node.js test runner (node:test), you may like the new ESLint plugin I cooked up. 64 [now 82] rules to improve your tests, prevent mistakes, and enforce style.”

Sindre Sorhus

✉️ Upyo 0.5: A Cross-Runtime Email Sending Library — A unified, type-safe API for sending emails both on SMTP and HTTP-based (e.g. SendGrid or Amazon SES) providers from Node, Deno, Bun, and edge function runtimes.

Hong Minhee

webpack-dev-server 6.0: The Official webpack Dev Server — Bumps Express up to v5, drops support for older Node versions, adds support to be used as a webpack plugin, and switches to ESM.

webpack

XO 4.0 – Opinionated but configurable ESLint wrapper that includes numerous popular ESLint plugins and rules out of the box.
ESLint Plugin Perfectionist 5.10 – For when you're really particular about the ordering of things like objects, imports, and types.
MongoDB Node.js Driver 7.5 – Official driver for MongoDB. Now supports Queryable Encryption string queries on MongoDB 9.0.
🐍 node-calls-python 1.2 – Call Python from Node directly, in-process, without spawning processes.
FoalTS 5.3 – The full-featured Node.js app framework adds a new dev-verbose logging format.
Fastify 5.10.0 – The fast and low overhead web framework.
feed 6.0 – RSS, JSON, and Atom feed generator library.

📰 Classifieds

📈 Crystallize seeks a remote SRE who thinks in SLOs, not heroics. Node/TS, GraphQL.

37 CLI best practices for Node devs

Thu, 2 Jul 2026 00:00:00 +0000

#631 — July 2, 2026

Read on the Web

So You Want to Land Your First Node.js Core Contribution? — Joyee Cheung has put together a new, official guide for anyone considering making their first contribution to the Node project, including where to look for issues to work on and how to improve the chances of your work making the cut.

Joyee Cheung

Your Autonomous Engineering Team, in TypeScript — One call spins up an orchestrated fleet — planner, architect, coders, QA, reviewers — that plans, builds, tests and ships production-grade PRs. TypeScript SDK, agents as typed APIs, open- and closed-source models.

AgentField.ai sponsor

37 Node CLI App Best Practices — A long-standing, but now modernized, set of guidelines for building “successful, empathic and user-friendly” CLI tools, plus an appendix rounding up the most popular CLI framework options. Now also includes a SKILL.md file you can point agents to.

Liran Tal

IN BRIEF:

Nub, a toolkit that adds useful features to Node (rather than replacing it), is now a single self-contained binary and has added a web-standard Worker mechanism to Node.
🔒 npm now locks 'high impact accounts' (those maintaining the most popular packages) into a 72-hour read-only mode when they change their email or use a 2FA recovery code.
npm 11.18.0 promotes the linked install strategy to stable, where packages are installed in node_modules/.store and linked in place, so code can only reach dependencies it actually declared. More info here.

Why Drizzle ORM Couldn't Publish New Releases on npm for a Month — As well as explaining why the popular ORM ran into the problem, Evert shares tips to see if you run a similar risk, and how to mitigate it.

Evert Pot

Iterating Faster on VS Code with TypeScript 7 — The tale of how the VS Code team adopted the Go-based TypeScript 7 compiler and got a 7x reduction in type checking time.

The VS Code Team (Microsoft)

📄 Roll Your Own File-Based Router in Under 50 Lines of Code – One for users of Wasp, the Node.js + React + Prisma full-stack framework. Carlos Precioso (Wasp)

📄 Finding Memory Leaks with Heap Snapshot Analysis in N|Solid – Using the N|Solid extension to capture a heap snapshot to trace a memory leak in VS Code. Estefany Aguilar (NodeSource)

🛠 Code & Tools

Node-GTK 4.0: GTK Bindings for Node — Bindings to the popular GTK desktop widget toolkit for building Linux, macOS and Windows apps. Now supports Node 26 and includes an npx node-gtk create app-name command to spin up a project. Worked well on macOS once I had the dependencies in place!

Rom Grk et al.

Schedule Node.js Scripts Across Your Server Fleet with xyOps — Run unlimited Node, Shell, HTTP, and Docker jobs with live logs, alerts, snapshots, and visual workflows. Self-hosted.

xyOps sponsor

🤖 Vercel AI SDK 7: An SDK for Working with AI Model Providers — Provider-agnostic library for building AI apps (no Vercel services needed). v7 focuses on agents, but adds WebSocket sessions for real-time transcription/voice agents, and video generation support for several providers.

Martynus, Grammel, Arntz, et al.

Electron 43: Faster Startup and V8 15 — Updates to Chromium 150, Node 24.17, and V8 15, with faster startup via a Node boot snapshot and bytecode-cached preloads. Adds rounded corners on Linux, matching Windows and macOS. v43 is also the final line to ship 32-bit binaries.

John Kleinschmidt

Deno 2.9 – The alternative runtime rolls out its new desktop app generator, improves support for npm/pnpm/yarn/Bun lockfiles, improves its test runner substantially, and more.
Git 2.55 – Adds git history fixup for 'fixing up' earlier commits, faster git status on Linux, and more.
pg-promise 12.7 – Node 26 is now officially supported by the popular Postgres client library.
Middy 7.7 – Node.js middleware engine for AWS Lambda. (Release notes)
Fastify 5.9 – Lots of bug fixes, and introduces request.mediaType.
Knex 3.3 – Batteries-included, multi-dialect SQL query builder.
JS YAML 5.2 – Fast YAML 1.2 parser and writer library. (Demo.)

📰 Classifieds

🚀 Crystallize is hiring a remote SRE: Node/TS, GraphQL, AWS, MongoDB, Cloudflare Workers.

Node.js 26.4 lands package maps

Thu, 25 Jun 2026 00:00:00 +0000

#630 — June 25, 2026

Read on the Web

Node.js 26.4 Adds Package Maps — A minor release whose headline feature is the (experimental) implementation of package maps (which let Node resolve packages from a static JSON file rather than walking node_modules). Matteo Collina’s node:vfs subsystem also begins to make an appearance.

Antoine du Hamel

💡 Node v24.18.0 (LTS) and v22.23.1 (LTS) have also been released.

That Analytics Route is Blocking Your Event Loop — Crunching big result sets in Node ties up the event loop and stalls other requests. TimescaleDB extends Postgres so the database aggregates instead. Hypertables, 95% compression, continuous aggregates. No second database. Get $1000 credit to start.

Tiger Data (creators of TimescaleDB) sponsor

Blocking Install Scripts is Not a Silver Bullet — npm v12 won't run install scripts by default, but Ulises argues that only removes one attack trigger, not a capability, since a compromised dependency’s code still runs on import! He shows why, even then, Node's permissions model and sandboxing are the layers that actually limit what that code can do.

Ulises Gascon

IN BRIEF:

The first preview release of npm 12 is here if you want to get testing.
Deno has begun to show off a new feature to create cross-platform desktop apps. Think Electron-style apps, but on top of Deno with cross-compilation, framework auto-detection, and a choice between bundling a Chromium runtime or using the system's WebView.
Vercel has opened a public beta of WebSockets support in Vercel Functions. You can write normal Node.js code using ws with no extra setup.
The pnpm project is working on pnpr, an experimental pnpm-compatible npm registry server, written in Rust.

What If npm Ran on AT Protocol? — James, a long-standing Node core contributor, ponders what a package system built atop the protocol Bluesky uses could look like: “It’s just an idea I couldn’t get out of my head until I wrote it down.”

James M Snell

Benchmarking 5 WebSocket Servers for Node.js — A banned IP, a lying load generator, and a 20× latency illusion turned a routine benchmark run into quite the detective story.

Irina Nazarova

Your Node App Has an N+1 Problem. AppSignal Shows You Where — Auto-detects N+1 queries in Prisma, Express, and Koa. One install, minutes to first trace. Free 30-day trial, no card.

AppSignal sponsor

📄 JavaScript Still Can't Ship a 'Full-Stack Module' – Thoughts on modules which provide frontend and backend code ready to go, as you might see in ecosystems like Rails and Laravel. Mihovil Ilakovac

📊 The Performance of WebAssembly Runtimes in 2026 – Mostly focused on dedicated options, but also including Node/V8. Frank Denis

🛠 Code & Tools

🤖 Eve: A Next.js-Style Framework for Building Agents — A new framework from Vercel that provides Next.js-esque structure for building AI-powered agents using TypeScript and Markdown. It's quite Vercel-flavored by default, but I found you can run it entirely independently of Vercel with a few settings tweaks and your own keys. Project homepage.

Vercel

TypeScript 7.0 Release Candidate — A step closer for the Go-powered TypeScript compiler that promises ~10x faster build performance. A reminder that moduleResolution: node / node10 are no longer supported and @types packages you need have to be listed explicitly.

Daniel Rosenwasser (Microsoft)

🔐 AccessControl 3.0: Role and Attribute-based Access Control — A role and attribute-based (RBAC/ABAC) access control library that, as of v3, now has a real policy engine available to apply conditions to grants, enforced ownership, mandatory restriction gates, audit hooks, and more. GitHub repo.

Onur Yıldırım

Camaro 6.5: A High Performance XML to JSON Converter — Uses bindings to pugixml, a fast C++ XML parser.

Tuan Anh Tran

Tedious 20.0 – TDS module for connecting to SQL Server. A related release is the SQL Server client library node-mssql 12.6 which uses Tedious (or msnodesqlv8).
Chardet 2.2 – Character encoding detection library that uses statistical methods to detect around 30 different encodings.
cookie 2.0 – HTTP cookie parser and serializer library. Now faster and ESM only.

📰 Classifieds

🧐 Where to host? Judoscale’s cost comparison calculator puts the PaaS alternatives head-to-head.

⚙️ Run AI agents like microservices — every agent an auto-generated API: schemas, versioning, no glue code. 100+ recipes, TypeScript SDK. → Star on GitHub.

📢 Elsewhere in the ecosystem

A roundup of some other interesting stories in the broader landscape:

Cloudflare has added the ability to create and deploy Workers on 'temporary accounts'. Ostensibly 'for AI agents', but you can use them yourself too, and get a Worker (which have increased Node.js compatibility nowadays) running for 60 minutes with no strings attached.
The Bun team has proposed adding shared-memory threads to JavaScriptCore (a more traditional threading approach versus worker threads).
🔒 GitHub has released actions/checkout v7 that "refuses common pwn request patterns by default" including refusing to fetch fork pull request code in pull_request_target and workflow_run workflows.

Extending Node instead of replacing it

Thu, 18 Jun 2026 00:00:00 +0000

#629 — June 18, 2026

Read on the Web

Nub: An All-in-One Toolkit That Augments Node — While Bun and Deno try to replace Node, this project from Zod’s creator (and a former Bun employee) extends your existing Node and package manager with nice-to-haves, like fuller TypeScript support (beyond what type stripping offers), faster and more secure package installation, and fuller .env handling.

Colin McDonnell et al.

Free Claude Code Course from Anthropic + Master.Dev — Coding is changing fast, and the engineers who thrive will be the ones who direct AI instead of guessing at it. Lydia Hallie from Anthropic teaches exactly that in our Claude Code course, now free for everyone.

Master.dev sponsor

Node.js 26.3.1, 24.17.0, and 22.23.0 Released — The latest round of security releases is here, with 26.3.1 (Current), 24.17.0 (LTS), and 22.23.0 (LTS) fixing eleven vulnerabilities. Two are of 'high' severity: one around normalizing hostnames for server identity checks in tls, and the other in WebCrypto.

Antoine du Hamel

🔒 The releases above also include Undici 8.5.0 which has addressed some security advisories of its own.

IN BRIEF:

As npm prepares to disable install scripts by default, Andrew Nesbitt looks at how other tools and ecosystems handle install-script allow-listing.
Iroh 1.0 is a peer-to-peer encrypted networking stack that punches through NAT and firewalls. It's built in Rust but has official Node.js bindings.
Babel 8.0 has been released: no new features, but with a focus on modernization. It's ESM-only, ships TypeScript types, and no longer compiles to ES5 and CommonJS by default.

Shipping psql Without psql: A Pure-TypeScript Postgres Client — Postgres platform Neon wanted the experience of Postgres’ psql client in their own Node-powered CLI, without the binary dependency. Here’s how they did it using AI, a strong conformance harness, and a security review.

Vadim Kharitonov (Neon)

A Backdoor in a LinkedIn Job Offer — A hacker, posing as a recruiter on LinkedIn, asked the author to diagnose an issue in a Node project, but the dependencies had a backdoor included. Both the recruiter and the git repo involved also used real identities of people unrelated to the scam.

Roman Imankulov

How LinkedIn Unlocked 18x Code Review Throughput — See how LinkedIn used Orkes and multi-agent workflows to scale code reviews 18x.

Orkes sponsor

📄 What are Git Worktrees, And Why Should I Use Them? – A decade-old git feature that's seen a boost in the AI agent era. Cassidy Williams (GitHub)

📄 Setting Node and pnpm Versions in Cloudflare Workers Programmatically – “I’ve wasted a couple of hours so you don’t have to.” Sen Hongo

📄 Wasp Now Lets You Write Your Full-Stack Logic as a Spec in TypeScript – Say goodbye to the React + Node.js + Prisma full-stack framework’s custom .wasp DSL. Martin Sosic (Wasp)

📄 Why pnpm No Longer Expands Environment Variables in .npmrc Zoltan Kochan

🛠 Code & Tools

✉️ Nodemailer 9.0: Easily Send Emails from Node.js — A long-standing, popular way to send emails over SMTP, through SES, or Sendmail. v9.0 now validates TLS connections by default when fetching remote content.

Andris Reinman

zod-compiler: Compile Zod Schemas Into Zero-Overhead Validators — A build-time compiler that plugs into Vite, webpack, et al. and rewrites existing schemas into optimized, tree-shakeable validators, with the full Zod API preserved.

Gajus Kuizinas

💬 Node Telegram Bot API 1.0/1.1 — Interact with the official Telegram Bot API from Node. Now modernized, rewritten in TypeScript, and ESM-only, with Telegram Bot API 10.1 support.

Yago

eslint-plugin-unicorn 67.0: 200+ Powerful Linting Rules — Sindre’s set of rules that will seriously challenge (and improve) your code, whether it's comments, the depth of nested calls, preferring Temporal over Date, and more.

Sindre Sorhus et al.

📰 Classifieds

⚙️ clerk deploy walks your app to production: instance clone, DNS setup, OAuth credentials, SSL check. Guided, resumable, and available now.

AI writes a growing share of Node services, but your reviewer hasn't caught up to its mistakes. pr-af is AgentField's multi-agent low cost reviewer: compiled per PR, runs on open/closed models. → Star & deploy.

XO 3.0 – Opinionated ESLint wrapper that enforces strict and readable code with zero configuration. Includes eslint-plugin-unicorn (above).
Playwright 1.61 – You can now register and test passkeys, as well as read/write to localStorage and sessionStorage via a new WebStorage API.
ESLint v10.5.0 – Five core rules now highlight smaller ranges of code to avoid shadowing other problems in editors.
Axios 1.18.0 – Security fixes and hardening for the promise-based HTTP client.
node-gyp 13.0 – Cross-platform tool for compiling native addon modules.
graphql-js 17.0 – Official reference implementation of GraphQL for JavaScript.
Faker 10.5 – Generate realistic but fake data for testing and development.
Nx 23.0 – Build system for TypeScript and polyglot monorepos.
BSON Parser 7.3 – BSON parser library.