--- title: "Node 20 gains require(esm) support by default" publication: "Node Weekly" issue: 570 published_at: "2025-03-18" canonical_url: "https://nodeweekly.com/issues/570" --- Plus a new encryption-in-use library, Node 23.10, and using Deno to trace Node apps. | #​570 — March 18, 2025 [Read on the Web](https://nodeweekly.com/issues/570) Together with [![Stytch logo\](https://res.cloudinary.com/cpress/image/upload/c_fill,g_auto,e_trim,w_686,h_212/e_make_transparent/co_white,e_outline:17/sxadrfitso54gphepg4p.png)](https://stytch.com?utm_source=node-weekly&utm_medium=paid_sponsorship&utm_campaign=node-weekly-03-18-2025&utm_content=primary-listing) ![Node.js Weekly](https://res.cloudinary.com/cpress/image/upload/v1653576619/lgfqinzbdqttwmhvljxb.png) [![\](https://res.cloudinary.com/cpress/image/upload/w_1280,e_sharpen:60,q_auto/es4ot1nhiakan1kafkrh.jpg)](https://nodejs.org/en/blog/announcements/official-discord-launch-announcement) [Node.js Gets an Official Community Space on Discord](https://nodejs.org/en/blog/announcements/official-discord-launch-announcement) — While there have been numerous IRC channels and Discord and Slack servers where Node developers can congregate, the Nodeiflux Discord server has been promoted to being _an official one_ – [here’s the invite link](https://discord.com/invite/vUsrbjd) if you’re a Discord user. There are already 15k members, so it’s hopping. Vitullo and Wunder [Node v23.10.0 (Current) Released](https://nodejs.org/en/blog/release/v23.10.0) — Node gains a new `--experimental-config-file` option for writing a JSON-based config file that contains options that would otherwise litter your command line flags – ideal for configuring the test runner, say. Antoine du Hamel [![\](https://res.cloudinary.com/cpress/image/upload/c_limit,w_480,h_480,q_auto/copm/6362d727.jpg)](https://stytch.com?utm_source=node-weekly&utm_medium=paid_sponsorship&utm_campaign=node-weekly-03-18-2025&utm_content=primary-listing) [Prepare Your App for AI Agents](https://stytch.com?utm_source=node-weekly&utm_medium=paid_sponsorship&utm_campaign=node-weekly-03-18-2025&utm_content=primary-listing) — [Stytch](https://stytch.com?utm_source=node-weekly&utm_medium=paid_sponsorship&utm_campaign=node-weekly-03-18-2025&utm_content=primary-listing) extends auth to handle permissions for AI agents—so your app can securely delegate [access to agents](https://stytch.com/blog/stytch-connected-apps/?utm_source=node-weekly&utm_medium=paid_sponsorship&utm_campaign=node-weekly-03-18-2025&utm_content=primary-listing) or protect against [agent-powered threats](https://stytch.com/blog/stytch-fraud-and-risk-prevention-major-enhancements/?utm_source=node-weekly&utm_medium=paid_sponsorship&utm_campaign=node-weekly-03-18-2025&utm_content=primary-listing). [See our Node quickstart guide](https://stytch.com/docs/quickstarts/node?utm_source=node-weekly&utm_medium=paid_sponsorship&utm_campaign=node-weekly-03-18-2025&utm_content=primary-listing). Stytch sponsor [Node v20.19.0 (LTS) Released with `require(esm)`](https://nodejs.org/en/blog/release/v20.19.0) — Node v20 is in maintenance mode, which usually means no new features, but it lands a significant one here: support for `require(esm)` enabled by default. This means all Node v20+ releases now support loading native ES modules with `require` out of the box. Ideal if you have dependencies to update and you’re still on v20. Marco Ippolito 💡 A year ago, Node contributor [Joyee Cheung wrote about the technical aspects](https://joyeecheung.github.io/blog/2024/03/18/require-esm-in-node-js/) of how `require(esm)` support came together. **IN BRIEF:** - 📉 It's been big news for the past week, but [TypeScript is rewriting its compiler in Go](https://devblogs.microsoft.com/typescript/typescript-native-port/) for ~10x build time performance. - 🔒 If you're using `xml-crypto` (or a SAML implementation that uses it) you should immediately update it as [a critical authentication bypass vulnerability has been found.](https://workos.com/blog/samlstorm) [How to Get Deep Traces in Your Node Backend with OTel and Deno](https://deno.com/blog/otel-tracing-in-node-and-deno) — The Deno project turns up the heat by demonstrating how to add [OpenTelemetry](https://opentelemetry.io/) to a Node app before showing how much easier it is with Deno (as long as your Node app runs well under it). Andy Jiang [🔒 Protect Against AI Bots, Fraud, and Abuse in Real Time](https://workos.com/radar?utm_source=cpnode&utm_medium=newsletter&utm_campaign=q12025) — WorkOS Radar protects your app with advanced device fingerprinting — stop fake signups, free tier abuse, bot attacks and brute force attempts today. WorkOS sponsor 📄 [Web Scraping with Cheerio in 2025](https://blog.apify.com/web-scraping-with-cheerio/) – [Cheerio](https://cheerio.js.org/) is a long-standing library for working with HTML and XML in Node. Usama Jamil (Apify) 📄 [Retrieval-Augmented Generation (RAG) with Node, Podman AI Lab & React](https://developers.redhat.com/articles/2025/03/10/retrieval-augmented-generation-nodejs-podman-ai-lab-react) Michael Dawson (Red Hat) 📄 [Learn Zod So You Can Trust Your Data and Your Types](https://didoesdigital.com/blog/zod-overview/) Diana MacDonald 📄 [Building Robust Data Synchronization Code in Node.js](https://blog.appsignal.com/2025/03/12/building-robust-data-synchronization-code-in-nodejs.html) Ashley Davis 📄 [How GitHub Engineers Learn New Codebases](https://github.blog/developer-skills/application-development/how-github-engineers-learn-new-codebases/) Brittany Ellich (GitHub) 🛠 Code & Tools [![\](https://res.cloudinary.com/cpress/image/upload/w_1280,e_sharpen:60,q_auto/rusaywetnovtggtykdp8.jpg)](https://cipherstash.com/blog/introducing-protectjs) 🔐 [Protect.js: 'Encryption in Use' for Data in Node Apps](https://cipherstash.com/blog/introducing-protectjs) — Designed to work with any Node framework or ORM, Protect.js provides AES-256 based ‘encryption in use’ functionality. [GitHub repo.](https://github.com/cipherstash/protectjs) CipherStash [Piscina 4.9: A Fast Worker Thread Pool Implementation](https://github.com/piscinajs/piscina) — Node’s [worker threads](https://nodejs.org/api/worker_threads.html) bring true multithreading to Node apps and Piscina is a _pool_ for tracking and controlling the number of such threads. Piscina [Refractor 5.0: Virtual Syntax Highlighting using Prism](https://github.com/wooorm/refractor) — Wraps the powerful [Prism](https://prismjs.com/) syntax highlighter to output objects instead of an HTML string so you can manipulate and render it as you wish (e.g. in a VDOM or at the terminal). [Lowlight](https://github.com/wooorm/lowlight), by the same author, offers the same functionality but backed by [highlight.js.](https://highlightjs.org/) Titus Wormer [OTPAuth: One Time Password (HOTP/TOTP) Library](https://github.com/hectorm/otpauth) — When you log in to a site with 2FA and you’re asked for six digits from your authentication app, that’s a Time-based One-Time Password (or TOTP). This library for Node, Deno, Bun _and_ the browser lets you work with both TOTPs and HOTPs (HMAC-based OTPs) from JavaScript. Héctor Molinero Fernández - [svg2pdf.js v2.5](https://github.com/yWorks/svg2pdf.js) – JavaScript-only SVG to PDF conversion. - [MTKruto 0.60.0](https://github.com/MTKruto/MTKruto) – Cross-runtime library for building Telegram clients. - [strong-soap v4.1.10](https://github.com/loopbackio/strong-soap) – SOAP client with mock server capabilities. - [Git 2.49](https://github.blog/open-source/git/highlights-from-git-2-49/) – Not Node specific, but plenty of enhancements. 📰 Classifieds 🇫🇷 The Node & Conquer Conference. In person, in Paris. 4 April 2025. Come learn how to best run Node.js at scale. [Sign up here](https://lu.ma/node-and-conquer-conference). --- 👀 Give your eyes a break! [MonoLisa](https://monolisa.dev/?utm_source=jsw03) is a font optimized for developers. [Try now](https://monolisa.dev/?utm_source=jsw03). 📢 Elsewhere in JavaScript A quick roundup of some other interesting stories in the broader JavaScript landscape, in case you've missed them: - [Oxlint, a Rust-powered JavaScript and TSX linter, is now in beta.](https://socket.dev/blog/oxlint-now-in-beta-with-500-built-in-rules-2X-faster-javascript-linting) It has over 500 rules out of the box and manages to lint Microsoft's entire VS Code repo in under a second. - [It's just 14 characters of JavaScript, but can you parse it?](https://www.hillelwayne.com/post/javascript-puzzle/) A fun puzzle from Hillel Wayne, from which you'll learn a little ancient JavaScript history.. - Lee Robinson gives us [the tour of building modern APIs with Next.js](https://nextjs.org/blog/building-apis-with-nextjs) using the App Router and route handlers. - [Astro 5.5](https://astro.build/blog/astro-550/), the latest version of the popular content site framework, has been released. **Got a link for us?** Reply and tell us. We can't include everything but we'll look at anything you send. _Thanks!_ --- **Sponsorship:** Email `[kristina@cooperpress.com](mailto:kristina@cooperpress.com)` for details. --- Published by Cooper Press Ltd. Fairfield Enterprise Centre, Louth, LN11 0LS, United Kingdom [Cancel your subscription](https://nodeweekly.com/leave/*|UID|*) or [change your address](https://nodeweekly.com/edit_subscription/*|UID|*).