Node Weekly

Node 26.9 turns on FFI by default

Thu, 17 Sep 2026 00:00:00 +0000

#641 — September 17, 2026

Why (and How) GitHub Ported Copilot's Runtime from Node to Rust — GitHub's Copilot runtime moved to Rust, ported in pieces behind napi-rs shims while shipping daily. Startup times and memory usage inspired the move, but the gold for porters is in the regressions they hit involving number types, || semantics, and blocking the event loop.

Stephen Toub (Microsoft)

That p99 Spike Is One Slow Analytics Query — One endpoint runs an analytics query over millions of rows, and latency spikes for everyone. TimescaleDB extends Postgres so that query returns in milliseconds at scale. Hypertables, compression, continuous aggregates. Get $1000 credit to start.

Tiger Data (creators of TimescaleDB) sponsor

IN BRIEF:

Node is to get util.debounce() and util.throttle() functions, two staples of utility libraries. They've landed on main for a future release.
🔒 Moment.js 2.31.0 is a key update. The date library is in 'maintenance mode', but gets 25M downloads a week, and v2.31.0 fixes a path traversal vulnerability.
The Node.js Web Team's redesigned API docs have been merged and should reach nodejs.org/api alongside a release soon.
In Node 27, the HTTP client will reject responses with more headers than request.maxHeadersCount (1000 by default right now) instead of just truncating them.

Node.js 26.9.0 (Current) Released — A reasonably significant minor release that brings a few new things to the table:

node:ffi is enabled by default (but still experimental), so you can call functions in native libraries without writing an addon.
node:bench is a new benchmarking module modeled on node:test.
Web Workers now have an experimental implementation (behind a flag), so browser-style new Worker() and postMessage, etc. can be used.
Worker threads start up to twice as fast (per initial benchmarks) and use less memory, as they now start from Node's built-in snapshot.

Antoine du Hamel (Node.js Team)

Stay Sharp in the Age of AI — Master.dev instructors build at Anthropic, OpenAI, Netflix, Google, and Stripe. Learn from them via courses, workshops, and AI learning paths. New members get $100 off a yearly membership.

Master.dev sponsor

📄 Connection Reuse is the Money – How a webhook sender cut its repeat TLS handshakes with one Undici Agent per destination. Mike Murray

📄 Email, Decoupled from Where and How – The design behind Upyo, a web-standards-based email library for Node, Deno, Bun and edge runtimes that works with many providers. Hong Minhee

📄 A Deep Dive into JavaScript Engines: Writing Code That Makes V8 Happy Audrey Doyen

📄 Five Software Engineering Roles for Working with AI Nicholas C. Zakas

📄 How to Implement a Distributed Circuit Breaker Gabor Koos

🛠 Code & Tools

Eraser Diagrams: Diagrams as Code, Minus the Layout Engine — A Node API/CLI for rendering JSON diagrams to PNG or HTML. Unlike Mermaid or D2, there's no auto-layout engine, so you (or your LLM!) get to control just where things go, while connection routing, icons and styling are handled for you.

Eraser

@platformatic/memcached: A Faster memcached Client — A zero-dependency memcached client built on the modern meta protocol, pipelining over a single connection. Claims to be "roughly 3x" the speed of alternatives.

Matteo Collina (Platformatic)

jsdom 30.1: The Release That's 'Feeling the AGI' — The pure-JS DOM implementation gets faster DOM construction, mutations, getComputedStyle() and event dispatch, plus lower memory use. Much of it came from Scott's Codex-assisted PRs, which Domenic praises for being carefully curated.

Domenic Denicola and Scott Cooper

XO 5.0 – The zero-config ESLint wrapper now lints package.json files and enforces import file extensions in TypeScript.
officeParser 8.0 – Parse Office files (docx, pptx, xlsx, etc.) and PDFs into an AST. Now with a rewritten PDF extractor.
oclif 6.0 – Salesforce's framework for building Node CLIs drops support for installing legacy plugins.
pg-boss 12.33 – The Postgres-backed job queue adds a TestClock so tests needn't wait on timers.
Aedes 1.2 – Barebone MQTT broker that runs on any stream server.
🔒 Express 4.22.3 – A security release for those on Express 4.

📰 Classifieds

⚡ Zuplo puts every API, AI, and MCP request behind one gateway. Route traffic, guard your MCP servers, and cap your AI costs. Try it free.

🛡️ Not all bots deserve blocking. Fingerprint Bot Detection stops content scrapers while letting legit AI agents through. Try for free.

🎟️ Join us at Supabase Select on October 2. Bring your hardest questions to the engineers building Supabase at the Ask Supabase booth. Apply to attend with 25% off: SUPAWEEKLY.

📢 Elsewhere in the ecosystem

npmchart.com (above) is a new option for tracking download trends and repo activity of npm packages. Here's the chart for express, for example.
A review of sixteen weeks of package manager releases across ecosystems finds similar new defences rolling out, like cooldowns, blocking install scripts (as in npm 12), and publish-time scans, which npm has done since July.
Those npm 12 defaults won't reach current Node lines, though. Last month, the Release WG decided npm 12 is "far too disruptive" for Node 22, 24 or 26, so it'll arrive in Node 27.
GitHub Actions has a new cache-mode setting to limit cache access per workflow or job, a defence against the kind of cache poisoning that compromised TanStack's npm packages in May.

Node is getting a built-in benchmark runner

Thu, 10 Sep 2026 00:00:00 +0000

#640 — September 10, 2026

Read on the Web

Cloudflare Workers Gets a New, Node.js-Aligned Module Registry — Workers enabled Node.js compatibility by default last month, meaning you can use most of Node’s built-in APIs in your Workers. Now there’s an opt-in way to load modules that resolves import paths as proper URLs, bringing import.meta and Node's require(esm) rules with it.

Logan Gatlin and James Snell (Cloudflare)

Confidently Deploy and Manage Containerized Apps on Kubernetes — Join this detailed video course with Erik Reinert and learn how to deploy and manage production-grade containerized applications on Kubernetes. You'll cover infrastructure, testing, rollbacks, autoscaling and more, all before pushing your cluster to EKS.

Master.dev sponsor

📊 node:bench: Node Core Gets a Built-In Benchmark Runner — Node has had a built-in test runner for years but no benchmark runner. James's experimental node:bench module has landed on main, so expect to see it soon. It's modelled on node:test, with a node --bench CLI and JSON reporter.

James M Snell

IN BRIEF:

Node.js v26.8.2 (Current) and v24.21.0 (LTS) are out, both including a security release of Undici that fixes several vulnerabilities, plus OpenSSL 3.5.8 and numerous tweaks and fixes.
🔒 Researchers at GitLab found a CVSS 10.0 sandbox escape in vm2, the widely used Node sandboxing library. The reported escape was patched in 3.11.7+, but the writeup argues vm2 shouldn't be used for genuinely untrusted code (though vm2's own docs are also honest about this).
Zod creator Colin McDonnell has landed a change that speeds up Node's startup (by a millisecond or so, granted) by seeding V8's non-cryptographic entropy from the OS rather than OpenSSL.
This year's TSC elections went uncontested: Matteo Collina staying Chair and Rafael Gonzaga becoming Vice-Chair.

Fuzzing the State Machines Inside My HTTP Client — A practical case for property-based testing, made by adding fast-check properties to ffetch’s 206 passing tests. Thousands of generated cases found 11 real bugs in code considered fully tested.

Gabor Koos

Add MCP Server Monitoring to Your Node.js Project — A single function call. See who is connecting, which tools drag, and the failures MCP never throws.

Sentry sponsor

📄 Is Prisma 8 Ready for Long-Lived Production Apps? – A response to community worries about Prisma 8's new migration model. Will Madden (Prisma)

📄 Containerizing and Slimming Node Apps with Paketo Buildpacks Costas Papastathis (Paketo)

📄 What await fetch() Actually Waits For Gabor Koos

🛠 Code & Tools

Rslib 1.0: A Build Tool for JavaScript Libraries and CLIs — Rspack's answer to tsup/tsdown goes 1.0 with a stable config and JS API. It can infer syntax targets from engines.node, generates declarations faster with TypeScript 7, and (experimentally) build Node SEA executables.

Chenwei Dai, Elecmonkey, et al.

vgpu: Render WebGPU Shaders in the Browser or Node.js — Provides a way to use the same shader in the browser or render headlessly with Node (to a high-resolution PNG or MP4 video). WGSL modules import and export like TypeScript does.

Vercel

MikroORM 7.2: Row Level Security, a WASM SQLite Driver, and More — A TypeScript ORM for SQL databases and MongoDB. 7.2 adds native Postgres row level security, with policies as entity metadata, plus through relations and a WASM sql.js driver (yes, you can now use MikroORM in the browser!)

Martin Adámek

Javet 6.0: A Way to Embed Node.js and V8 in Java — A Java library that embeds a real Node.js runtime (now v26) in the JVM. Java code can load npm packages, call into running Node code, and run multiple Node instances side by side. GitHub repo.

Sam Cao

eslint-plugin-regexp 3.3: ESLint Plugin for Finding Regex Mistakes — There’s a neat online demo to show off the things it can catch.

Yosuke Ota

parse-xml 5.0 – The fast, compliant XML parser goes ESM-only. The API is unchanged and require() still works on Node 22+.
dhcp.js 1.0 – DHCPv4 client, server, and tools for Node. We covered the explainer blog post about this project nine years ago!
pnpm 12.4 – The fast drop-in npm replacement can now manage npm, Python, and Cargo dependencies in the same workspace.
✉️ Nodemailer 10.0 – The popular e-mail sending library has migrated to TypeScript with ESM and CJS builds.
⚠️ Fastify 5.12.2 – Includes fixes for four high-severity issues, including validation and auth bypasses.
tinybench 6.2 – Simple, tiny and lightweight benchmarking library with precise timing.
🌐 supercluster 9.1 – Mapbox's fast geospatial point clustering library.

📰 Classifieds

🎯 Catch promo abuse at signup. Fingerprint’s visitor ID persists for months, not days, so abusers can’t hide. Try it for free.

Your API is fast until it hits analytics. TimescaleDB extends Postgres so those queries return in ms at scale. Get $1000 credit.

📢 Elsewhere in the ecosystem

React 19.3 is out with stable view transitions and fragment refs, Trusted Types support, and a browser() API used via use(browser()) to let components skip server-side rendering when they need browser-only APIs.
📺 Microsoft released a movie-length documentary about VS Code, directed by Stefan Kingham. It covers the editor's technical roots, touching on Node's arrival on Windows and its evolution through node-webkit (now NW.js) and Electron.
The team behind Tailwind CSS is joining Shopify, though they say "nothing changes with Tailwind CSS or any of our other open-source projects."
🔒 Two men have been arrested over the TeamPCP npm supply chain attacks. TeamPCP is suspected of cloning the Shai-Hulud worm, resulting in the so-called 'Mini Shai-Hulud' waves.
📺 How can someone actually change JavaScript? A two-minute explainer of the basics from TC39 delegate Mikhail Barash.

Bun now passes 80.5% of Node's test suite

Thu, 3 Sep 2026 00:00:00 +0000

#639 — September 3, 2026

Read on the Web

NestJS 12 Released with ESM-First Packages, Rspack and Vitest — The progressive framework gets its biggest release in years, going ESM-first (CJS is still an option), replacing webpack with Rspack, adding Standard Schema support for easy interop with Zod, Valibot and friends, plus structured logging, a brand new homepage, and more.

Kamil Mysliwiec

One Slow Query Starves Your Whole Connection Pool — A heavy analytics query holds a connection while everything else waits. TimescaleDB extends Postgres so those queries return fast, freeing the pool. Hypertables, compression, continuous aggregates. One database, not two. Get $1000 credit to start.

Tiger Data (creators of TimescaleDB) sponsor

📊 Bun 1.4 Now Passes 80% of Node's Test Suite — Bun 1.4's headline feature is a big jump in Node.js compatibility as part of its goal of being a "drop-in replacement". This page lets you see the project's progress and where Bun is strong and weak.

Bun Project

IN BRIEF:

Matteo Collina has landed node:ffi enabled by default, so calling into a native C library will no longer need --experimental-ffi, an addon, or node-gyp. It remains experimental, warns on first load, and hasn't shipped in a release yet.
Matteo has also added support for Single Executable Applications to mount their bundled assets as a read-only virtual file system by setting "useVfs": true in the config.
🔒 Express has patched six vulnerabilities across hbs, multer and morgan.
Node's issue tracker reaches issue 2**16 with a proposal to remove dual ESM/CJS code samples in the API docs.

Rewriting a Node.js Service in Go with AI Agents — A very 2026 tale of an overnight porting run, with a focus on doing agentic engineering well. Good takeaways on building a test harness first and the rollout experience.

Edvinas Janusevicius (Checkly)

Your Trace Shows the Slow Span. Not the Exception — OTLP carries traces and logs, not errors. Sentry's OtlpIntegration connects both in one trace waterfall. Learn more about Sentry’s OTLP.

Sentry sponsor

📄 Detecting SQLite Full Table Scans in Node.js – Did you know SQLite counts the rows scanned by statements and you can read it after the query runs? CodeSilva

📄 Workers vs Processes in Node Ishtmeet Singh

🛠 Code & Tools

Drydock: Diff Your npm Tarballs Before You Publish — From a Preact core team member comes a tool to diff built npm tarballs against the last published version, flagging install scripts, network access and new binaries. It can then gate your Actions publish job or watch npm's new staged publishing flow.

Jovi De Croock

💡 You can get a quick taste without installing anything: this web-based diff viewer can compare two versions of an npm package file by file.

srvx 1.0: One fetch Handler for Node, Deno and Bun — You can export a handler that takes a web-standard Request and returns a Response, then run it unchanged on Node, Deno or Bun. Includes a CLI with watcher and static serving, and srvx fetch can hit your handler without starting a server.

Pooya Parsa

NVM for Windows 2.0: Node Version Manager for Windows — A modern Node workflow for Windows users with version pinning, native integrations, auto-install of missing versions, and more. v2 is a rewrite that introduces a lighter shim-based mechanism and no longer needs admin privileges. GitHub repo.

Author Software Inc

Got 16.0: Built-In HTTP/2 and QUERY Method Support — The popular Node HTTP client now has a built-in HTTP/2 client, its own DNS cache, fewer dependencies, and support for the newly standardized QUERY HTTP method.

Sindre Sorhus

SimpleWebAuthn 14.0: Now with Post-Quantum Passkeys — The passkeys library now verifies post-quantum ML-DSA passkeys and, on Node 24.7 and up, prefers ML-DSA-44 at registration by default.

Matthew Miller

Restify 12.0 – The REST API framework returns after a two and a half year gap with Node 26 support and url.parse() replaced with WHATWG URL. Existing users have a few breaking changes to note.
Zod 4.5 – A big performance release for the popular TypeScript-first schema validation library.
np 12.1 – Sindre Sorhus's improved npm publish workflow gets some speedups.
express-rate-limit 8.7 – Rate-limiting middleware for Express.

📰 Classifieds

⚡ Zuplo puts every API, AI, and MCP request behind one gateway. Route traffic, guard your MCP servers, and cap your AI costs. Try it free.

📉 Headout cut chargebacks 90% with Fingerprint. Stop payment fraud with 100+ signals such as Browser Bot and VPN detection.

🎟️ Join us at Supabase Select on Oct 2. Learn from the industry’s best builders and meet people building dev tools. Apply to attend with 25% off: SUPAWEEKLY.

📢 Elsewhere in the ecosystem

htmx 4.0 has landed, the first major release in two years, with lots of changes. It remains a neat way to add interactivity to server-rendered pages without reaching for a frontend framework.
🤔 Upon finding eight versions of glob across five major version lines in his employer's monorepo, James Healy is imploring library maintainers to bump their major versions as rarely as they can.
A developer shares the techniques behind squeezing an implementation of Minesweeper into just 247 bytes of JavaScript.
🤚 The 2026 Node.js user survey is still open. Your responses guide the core team and its priorities.

Node 26.8 reads and writes ZIP files

Thu, 27 Aug 2026 00:00:00 +0000

#638 — August 27, 2026

Read on the Web

🗓️ We're back! If you missed us last week, we took a brief summer vacation :-)
__
Your editor, Peter Cooper

A Recap of Node.js Interactive 2026 — Node.js Interactive returned for the first time since 2019 as part of this month's RenderATL event with Node contributors and invited speakers tackling Node's near-term roadmap in areas like AI, supply chain security, WinterCG becoming Ecma TC55, work on QUIC and HTTP/3 support, and Node's move to one major release a year.

Aviv Keller

Open Source Just Out-Reviewed the Commercial Tools — PR-AF places #2 of 42 on Martian's Code-Review-Bench, ahead of CodeRabbit, Copilot, and Devin, at ~10x lower cost per review. It plans the review per PR, runs reviewer agents in parallel, and verifies every finding against your source. Self-hosted.

AgentField.ai sponsor

Node.js 26.8.0 (Current) Released — Among a variety of additions, Node can read and write ZIP archives without a third-party dependency. Plus Node's REPL now has basic syntax highlighting support. v26.8.1 landed hours later to fix a broken version string.

Antoine du Hamel

💡 Node 24.20.0 (LTS) also landed with several backported features including package maps, permission auditing, node:stream/iter, and WebAssembly JSPI.

IN BRIEF:

🤚 The latest annual Node.js user survey has just launched. As always, your responses help shape the future priorities of the Node.js team.
💡 Aviv Keller has proposed reimplementing fs.glob natively in C++, calling straight into libuv and benching at over twice the speed of the current version. Not landed yet, but there are some big names on this thread.
James Snell is seeking early feedback on a proposed Fetch Server API, part of Node's unified HTTP API initiative, offering one handler model for HTTP/1.1, 2 and 3.
TermDOM, featured in our last issue, lets you build TUI apps with HTML and CSS in Node, and now supports CSS Grid for layout.
AWS Lambda has introduced a new Node.js 26 runtime in preview.

🤖 Node's Official AI Use Policy and Guidelines — Merged into Node's contributing docs after months of debate, PRs with AI code you haven't understood or tested can be closed unreviewed, bot-opened PRs need pre-approval, and more to be aware of. Plus, don't use AI to claim "good first issue" tasks!

Node.js Project

📄 Query Pipelining in node-postgres: 2-3x More Throughput – More throughput and lower latency from one config change is always worth looking into. Matteo Collina

📄 ESM vs CommonJS: What import and require Actually Do Gabor Koos

🛠 Code & Tools

pnpm 12: Rewritten in Rust, Same Commands and Lockfile — The Rust rewrite is stable, but all of v11's commands, flags and lockfile format carry over with only a handful of changes. A global node now follows the version your project pins, too. Note that npm's latest tag still points to pnpm 11, so you'll need pnpm self-update next-12 to upgrade.

Zoltan Kochan

Better Auth 1.7 Ships a Standards-Based OAuth Server — A big OAuth provider release with DPoP, per-API token rules and device code flow, plus MCP auth in its own package. Breaking changes make the upgrade guide required reading.

Gustavo Valverde

Outgrowing Cron? Meet xyOps for Self-Hosted Ops Automation — Schedule jobs, run Node scripts, monitor servers, and automate response. Open source, from the Cronicle team.

xyOps sponsor

GTKX: Build Linux Desktop Apps with Node, GTK and React — Build Linux desktop apps with real GTK4 and Adwaita widgets with no webview involved. Write JSX and get real widgets in an ordinary Node process with npm package and Fast Refresh support.

Eugenio Depalo

Stryker Mutator 10.0: Test Your Tests with Mutation Testing — Stryker deliberately changes your code to see if your test suite catches the mutations. If not, your tests are too lax and need work. Here's how to get started.

Jansen, de Lang, et al.

SVGO 4.1: Node-Powered SVG Optimizer — SVGs often contain redundant information. You can use SVGO as a CLI tool or Node library to slim them down. v4.1 has stricter XML validation and security improvements.

Kir Belevich

Electron 44 – 32-bit builds are gone, macOS 13+ is now required, clipboard is aligned with the W3C Clipboard API, net.WebSocket is added, plus the ability to set window opacity on Linux.
lz4-napi 2.10.0 – N-API bindings for LZ4 compression/decompression, implemented in Rust and backed by lz4_flex.
🤖 grammY 1.46.0 – The framework for building Telegram bots from Node now supports the latest Telegram Bot API 10.3.
Axios 1.20.0 – The long-standing HTTP client for the browser and Node.js.
node-mongodb-native 7.6 – MongoDB 4.2 support has been dropped entirely.
📺 YouTube.js 18.0 – JavaScript client for YouTube's internal API.
node-x11 4.1 – Feature-rich X11 protocol client library.