--- title: "Running Laravel apps in the Node.js world" publication: "Node Weekly" issue: 587 published_at: "2025-07-22" canonical_url: "https://nodeweekly.com/issues/587" --- Plus NAPI-RS v3, a safer way to install npm packages, and Node version locking is coming to pnpm. | #​587 — July 22, 2025 [Read on the Web](https://nodeweekly.com/issues/587) Together with [![Fusion Auth\](https://res.cloudinary.com/cpress/image/upload/c_fill,g_auto,w_1280,h_316/e_make_transparent/co_white,e_outline:15/wm1gvx8cub0d4gmmabev.png)](https://fusionauth.link/4nZ12LI) ![Node.js Weekly](https://res.cloudinary.com/cpress/image/upload/v1653576619/lgfqinzbdqttwmhvljxb.png) [![\](https://res.cloudinary.com/cpress/image/upload/w_1280,e_sharpen:60,q_auto/rcrfrghyegqtu4xwoag5.jpg)](https://blog.platformatic.dev/laravel-nodejs-php-in-watt-runtime) [Laravel and Node.js: PHP in Watt Runtime](https://blog.platformatic.dev/laravel-nodejs-php-in-watt-runtime) — In June we featured [php-node](https://blog.platformatic.dev/seamlessly-blend-php-with-nodejs), a new way to ‘bridge the gap’ between PHP and Node.js by being able to embed PHP into Node apps. Now they’ve gone a step further by using php-node and the [Watt](https://www.npmjs.com/package/wattpm) app server to enable the running of [Laravel](https://laravel.com/) apps too. A curious meeting of ecosystems! Stephen Belanger (Platformatic) [The Node.js July 15 Security Releases](https://nodejs.org/en/blog/vulnerability/july-2025-security-releases) — Mentioned in passing last week, but landing hours after we sent the newsletter came the releases of [Node.js v24.4.1 (Current)](https://nodejs.org/en/blog/release/v24.4.1/), [v22.17.1 (LTS)](https://nodejs.org/en/blog/release/v22.17.1/) and [v20.19.4](https://nodejs.org/en/blog/release/v20.19.4/) to resolve some security vulnerabilities (a path traversal issue on Windows, and an issue related to hashing in V8). The Node.js Project [![\](https://res.cloudinary.com/cpress/image/upload/c_limit,w_480,h_480,q_auto/copm/a96ce80a.png)](https://fusionauth.link/4nZ12LI) [Skip Building Auth from Scratch in Your Node.js App](https://fusionauth.link/4nZ12LI) — FusionAuth integrates with Express, Fastify, and Node.js backends. Add enterprise-grade auth in minutes, not months. Download locally, test in CI/CD pipelines. API-first design lets you focus on your app logic. [Start Building for free](https://fusionauth.link/4nZ12LI). FusionAuth sponsor **IN BRIEF:** - [The eslint-config-prettier package was recently compromised](https://safedep.io/eslint-config-prettier-major-npm-supply-chain-hack/) and we get a pretty thorough analysis of how it worked and how it happened. - [Node's `http` and `https` built-ins are gaining support for proxies](https://github.com/nodejs/node/pull/58980), enabled by way of an environment variable. - [Bun v1.2.19 has been released](https://bun.sh/blog/bun-v1.2.19) with a new option to use a pnpm-style isolated, symlinked `node_modules` with `bun install`, an interactive package updater, a VS Code Test Explorer integration, a faster integrated Postgres client, and more. - The next version of [`pnpm` will let you lock your Node.js version in the lockfile](https://bsky.app/profile/pnpm.io/post/3lud4fkjfes2j), like with any other dependency. [How to Create an NPM Package in 2025](https://www.totaltypescript.com/how-to-create-an-npm-package) — One of JavaScript’s most essential tasks, but one with numerous steps involved if you want to follow best practices, integrate useful tools, and get things just right. Matt Pocock rounds up the overall process and, notably, drops CommonJS in this 2025 update. Matt Pocock [Endor: Add Services (Like Postgres) as Node Dependencies](https://endor.dev/blog/node-postgres) — A curious new effort to make it possible to spin up quick, sandboxed environments and servers, covering things like Postgres, MariaDB and Valkey, with a simple `npm install` and `endor run`. Angel M Miguel (Endor) 📄 [We Migrated Our Site to Eleventy and Increased Performance by 24%](https://etch.co/blog/we-migrated-our-site-to-eleventy-and-increased-performance-by-24-percent) – [Eleventy (11ty)](https://www.11ty.dev/) is a popular Node-based static site generator. Dan Webb 📄 [Build Your Own Font Search Engine](https://lui.ie/guides/semantic-search-fonts) – Using vision language models to index and search the fonts. Lúí Smyth 📄 [A Full Code Agent in 200 Lines – Here’s How](https://cthiriet.com/blog/nano-claude-code) Clément Thiriet 🛠 Code & Tools [![\](https://res.cloudinary.com/cpress/image/upload/w_1280,e_sharpen:60,q_auto/yhwtmaqt1yph1ueg03yo.jpg)](https://github.com/lirantal/npq) [npq: Safely Install Packages by Auditing Them Pre-Install](https://github.com/lirantal/npq) — `npq` performs several extra steps compared to `npm`. It consults Snyk’s database of vulnerabilities, looks at the package’s age, download count, and docs, and tries to paint a better picture of what you’re really installing. Liran Tal [Announcing NAPI-RS v3: The Way to Build Node Addons in Rust](https://napi.rs/blog/announce-v3) — [NAPI-RS](https://github.com/napi-rs/napi-rs) is a framework for building compiled Node.js add-ons in Rust via [Node-API.](https://nodejs.org/api/n-api.html#node-api) v3 adds support for targeting WebAssembly, which opens up some interesting possibilities shown in the post, along with numerous DX improvements including easier cross compilation. NAPI-RS Team [Product for Engineers Newsletter](https://newsletter.posthog.com?r=5ytvh5) — Build better products, not just better code. Learn how to build features users love. [Subscribe for free](https://newsletter.posthog.com?r=5ytvh5%20). PostHog sponsor [YouTube.js 15.0: A Very Unofficial YouTube API Client](https://github.com/LuanRT/YouTube.js) — ‘InnerTube’ is an API used by YouTube’s clients, and you can use it too, although YouTube might not be a fan of that.. Nonetheless, it runs on Node.js, Deno, and modern browsers, and [v15.0](https://github.com/LuanRT/YouTube.js/releases/tag/v15.0.0) drops CommonJS support. LuanRT [stripe-sync-engine: A Stripe-To-Postgres Sync Engine as a Standalone Library](https://supabase.com/blog/stripe-engine-as-sync-library) Kevin Grüneberg (Supabase) - [NeutralinoJS 6.2](https://github.com/neutralinojs/neutralinojs/releases/tag/v6.2.0) – Lightweight cross-platform desktop app framework. - [node-oidc-provider 9.4](https://github.com/panva/node-oidc-provider/releases/tag/v9.4.0) – OpenID Certified™ OAuth 2.0 Authorization Server implementation, now with experimental Attestation-Based Client Authentication support. - [Corepack 0.34](https://github.com/nodejs/corepack) – Node's zero-runtime-dependency bridge between projects and package managers. v0.34 drops Node 18 and 23 support. - [ESLint Markdown Language Plugin 7.0](https://github.com/eslint/markdown) – Lint Markdown with ESLint, as well JS, JSX, TypeScript, and more inside Markdown. - [Multer 2.0.2](https://github.com/expressjs/multer) – Node middleware for handling`multipart/form-data`. Fixes [a security vulnerability](https://www.cve.org/CVERecord?id=CVE-2025-7338). - [on-headers 1.1](https://github.com/jshttp/on-headers) – Execute a listener when a response is about to write headers. - [express-rate-limit 8.0](https://github.com/express-rate-limit/express-rate-limit) – Basic rate limiting for Express apps. - [Jasmine 5.9](https://github.com/jasmine/jasmine/blob/main/release_notes/5.9.0.md) – Testing framework for browsers & Node. - [node-oracledb 6.9](https://medium.com/@sharad-chandran/node-oracledb-6-9-66cd38deadff) – _Oracle Database_ driver for Node. - [Undici 7.12](https://github.com/nodejs/undici/releases/tag/v7.12.0) – Node's powerful HTTP client library. - [node-soap 1.2](https://github.com/vpulim/node-soap) – [SOAP](https://en.wikipedia.org/wiki/SOAP) client and server library. 📢 Elsewhere in the ecosystem A roundup of some other interesting stories in the broader landscape, in case you've missed them: - In an article for ACM Queue, JS and WASM engine expert Andy Wingo [presented a round up of the state of WebAssembly](https://queue.acm.org/detail.cfm?id=3746171), both in browser and server-side use cases. - The Deno team has [▶️ shared an eight minute video](https://www.youtube.com/watch?v=TYsPrXWgNS8) digging into some of the 'untold story of JavaScript' based around its recently popular [A Brief History of JavaScript](https://deno.com/blog/history-of-javascript)timeline. - 🔎 [git-quick-stats.sh](https://git-quick-stats.sh/) is a shell-based way to get a lot of statistics about your current Git repo. - [Phishers are now targeting npm package developers](https://socket.dev/blog/npm-phishing-email-targets-developers-with-typosquatted-domain) – be alert to this. **Got a link for us?** Reply and tell us. We can't include everything but we'll look at anything you send. _Thanks!_ --- **Sponsorship:** Email `[kristina@cooperpress.com](mailto:kristina@cooperpress.com)` for details. --- Published by Cooper Press Ltd. Fairfield Enterprise Centre, Louth, LN11 0LS, United Kingdom [Cancel your subscription](https://nodeweekly.com/leave/*|UID|*) or [change your address](https://nodeweekly.com/edit_subscription/*|UID|*).