--- title: "How TypeScript 6.0 affects Node developers" publication: "Node Weekly" issue: 617 published_at: "2026-03-26" canonical_url: "https://nodeweekly.com/issues/617" --- Plus Knip v6, reducing module bloat, and a look into pnpm's future. #​617 — March 26, 2026 [Read on the Web](https://nodeweekly.com/issues/617) 🟦 [TypeScript 6.0 landed this week](https://devblogs.microsoft.com/typescript/announcing-typescript-6-0/). We've put together a quick bulletpoint list of the Node-relevant changes and considerations at the end of the issue for you to check out before upgrading. ____ _Your editor, Peter Cooper_ Together with [![Clerk\](https://res.cloudinary.com/cpress/image/upload/c_fill,g_auto,w_220,h_64/e_make_transparent/co_white,e_outline:5/j3vhv1hnwqeffgkzzlvu.png)](https://go.clerk.com/CvvIYIp) ![Node.js Weekly](https://res.cloudinary.com/cpress/image/upload/v1653576619/lgfqinzbdqttwmhvljxb.png) [![\](https://res.cloudinary.com/cpress/image/upload/w_1280,e_sharpen:60,q_auto/osbtlcss4015epc6ff5z.jpg)](https://nodejs.org/en/blog/vulnerability/march-2026-security-releases) [The Node.js March 24, 2026 Security Releases](https://nodejs.org/en/blog/vulnerability/march-2026-security-releases) — [Node.js v25.8.2 (Current)](https://nodejs.org/en/blog/release/v25.8.2), [v24.14.1 (LTS)](https://nodejs.org/en/blog/release/v24.14.1), [v22.22.2 (LTS)](https://nodejs.org/en/blog/release/v22.22.2), and [v20.20.2 (LTS)](https://nodejs.org/en/blog/release/v20.20.2) have just been released to address nine vulnerabilities (two of ‘high’ severity) covering a broad variety of areas like TLS, HTTP/HTTP2, the permission model, HMAC verification, URL processing, and V8 hashing _(more on that next!)_ The Node.js Team [Developing a Minimally HashDoS Resistant, Yet Quickly Reversible Integer Hash for V8](https://nodejs.org/en/blog/vulnerability/march-2026-hashdos) — Can a hash be both resistant to [hash flooding](https://en.wikipedia.org/wiki/Collision_attack#Hash_flooding) (a.k.a. HashDoS) _and_ quickly reversible? That’s the puzzle the Node team had to tackle in V8 for this week’s security release. This post on the official Node blog is _extremely_ technical, but one of the most educational in years. Joyee Cheung [![\](https://res.cloudinary.com/cpress/image/upload/c_limit,w_480,h_480,q_auto/copm/f0e67078.png)](https://go.clerk.com/CvvIYIp) [Clerk M2M Tokens Now Support JWT Format for Faster Auth](https://go.clerk.com/CvvIYIp) — Verify machine-to-machine tokens locally with no network request. Self-contained JWTs carry machine ID, claims, and expiration. Clerk sponsor **IN BRIEF:** - [pnpm 11 Beta](https://github.com/pnpm/pnpm/releases/tag/v11.0.0-beta.0) offers a sneak peek of the future for the popular, alternative efficiency-focused package manager, including a new SQLite-powered store, config overhaul, and stricter build security by default. - Last week, several [Deno](https://deno.com/) employees departed the company. Though _not_ officially speaking for the company, [Josh Collinsworth noted](https://bsky.app/profile/collinsworth.dev/post/3mhdpgmoao22j) _"Deno is not going away. These are just hard times."_ - ⚠️ [Fastify](https://fastify.dev/) users should upgrade to [v5.8.3 / 5.8.4](https://github.com/fastify/fastify/releases) to avoid a now-fixed [protocol/host spoofing vulnerability.](https://github.com/advisories/GHSA-444r-cwp2-x5xf) [Where Did 400 Megabytes of Memory Go?](https://frn.sh/pmem/) — A meticulous deep dive into working out why a Node-powered WebSocket k8s pod was using way more memory than its peers, despite `process.memoryUsage()` painting a rosy picture. Powerful techniques worth referring to when you need to investigate similar issues. Fernando S. [The Three Pillars of JavaScript Bloat](https://43081j.com/2026/03/three-pillars-of-javascript-bloat) — Three reasons your `node_modules` is bigger than it should be: needless ES3-era compat packages, micro-libraries with a single consumer, and [ponyfills](http://ponyfill.com/) for APIs that shipped years ago. Luckily, this article offers some solutions for trimming the fat. James Garbutt 🛠 Code & Tools [![\](https://res.cloudinary.com/cpress/image/upload/w_1280,e_sharpen:60,q_auto/wfzkdllh4jlwjqicw1em.jpg)](https://knip.dev/blog/knip-v6) [Announcing Knip v6: The Fast Way to Declutter Your Projects](https://knip.dev/blog/knip-v6) — [Knip](https://knip.dev/) has established itself as a go-to tool for finding and removing unused files, exports, and dependencies. v6 leans on [oxc-parser](https://oxc.rs/docs/guide/usage/parser) for 2-4x performance gains (tearing through a huge repo like _Astro_ in two seconds) and is a drop-in upgrade. Lars Kappert [Your API Shouldn't Wait on a Pipeline for Fresh Data](https://www.tigerdata.com/timescaledb?utm_source=cooperpress&utm_medium=referral&utm_campaign=node-weekly-newsletter) — TimescaleDB extends Postgres so analytics hits live data. No second database, no sync lag, no stale responses. [Get started for free](https://www.tigerdata.com/timescaledb?utm_source=cooperpress&utm_medium=referral&utm_campaign=node-weekly-newsletter). Tiger Data (creators of TimescaleDB) sponsor [Knex.js 3.2: The SQL Query Builder is _Back_](https://knexjs.org/) — Knex is a popular ‘batteries included’ SQL query builder that supports Postgres, MySQL, SQL Server, SQLite3, and other SQL oriented database systems. knex 💡 The Knex.js team has [written a blog post announcing a revival of active development](https://knexjs.org/blog/posts/2026-03-23-welcome/) after an intensive period of catching up on a backlog of issues. _"Knex deserves to thrive, and we’re committed to getting it there."_ [Vavite 6: Develop Server-Side Applications with Vite](https://github.com/cyco130/vavite) — Use Vite for your backend Node.js code too, so you get one unified toolchain for everything, including hot reloading for both front and back-end. v6 brings Vite 7/8 support, server-side HMR, and separate server mode (e.g. for`Bun.serve`). Fatih Aygün [htmlparser2 12.0: A Fast and Forgiving HTML and XML Parser](https://github.com/fb55/htmlparser2) — Consumes documents and calls callbacks, but it can generate a DOM as well. There’s [a live demo here.](https://astexplorer.net/#/2AmVrGuGVJ) Works in both Node and browser. Felix Böhm - [Deno 2.7.6-2.7.8](https://github.com/denoland/deno/releases) – Now with `NodeRuntime` CDP (Chrome DevTools Protocol) support, `deno eval` auto-detects CJS vs ESM, and `--cpu-prof-flamegraph` generates interactive SVG flamegraphs. - [`pnpm/action-setup` 5.0](https://github.com/pnpm/action-setup) – GitHub Action to install and configure [pnpm](https://pnpm.io/). Now uses Node.js v24. - [pnpm 10.33](https://github.com/pnpm/pnpm/releases/tag/v10.33.0) – Adds a new `dedupePeers` setting that reduces peer dependency duplication. - [Faker 10.4](https://github.com/faker-js/faker/releases/tag/v10.4.0) – Generate realistic data for testing and development. - [ws 8.20.0](https://github.com/websockets/ws) – Long-standing WebSocket client and server library. - 🤖 [OpenAI Node v6.33.0](https://github.com/openai/openai-node/releases/tag/v6.33.0) 🟦 TypeScript 6.0 for Node developers [Announcing TypeScript 6.0](https://devblogs.microsoft.com/typescript/announcing-typescript-6-0/) — TypeScript 6.0 is designed to bridge the way from its [self-hosted compiler](https://github.com/microsoft/TypeScript/tree/main/src/compiler) to [the Go-powered native compiler future](https://devblogs.microsoft.com/typescript/typescript-native-port/) of TypeScript 7.0 (which, we're told, is almost ready to go, too). As always, the release post is _huge_ but here are the things that jumped out to me as affecting Node developers the most: - [**`types` now defaults to `[\]`**](https://devblogs.microsoft.com/typescript/announcing-typescript-6-0/#types-now-defaults-to-%5B%5D). TypeScript will no longer pull in potentially thousands of type declarations at build time. Great for performance, but... if you were relying on it, your project will break! `"types": ["node"]` or `"types": ["*"]` may be your friend at first. - [**`strict` is now `true` by default.**](https://devblogs.microsoft.com/typescript/announcing-typescript-6-0/#simple-default-changes) Many of you will already be working in strict mode, but if not, get ready for a flood of new type errors unless you explicitly set it to `false`. - [**`--moduleResolution node` is deprecated.**](https://devblogs.microsoft.com/typescript/announcing-typescript-6-0/#deprecated:---moduleresolution-node-%28a.k.a.---moduleresolution-node10%29) If you're targeting Node, you'll now use `--moduleResolution nodenext` which reflects how modern versions of Node resolve modules. - **`module` now defaults to `esnext`.** CommonJS projects must now set `"module": "commonjs"` explicitly. - [**`#/` subpath imports now work.**](https://devblogs.microsoft.com/typescript/announcing-typescript-6-0/#subpath-imports-starting-with-#/) Available in Node [since v25.4](https://github.com/nodejs/node/pull/60864) (and backported into LTS releases), but now in TypeScript too. - [**`rootDir` now defaults to `.`**](https://devblogs.microsoft.com/typescript/announcing-typescript-6-0/#rootdir-now-defaults-to-.) If you have source files deeper than your `tsconfig.json` and were relying on TypeScript to infer a common root directory, you now need to explicitly set `rootDir`. - [**`--esModuleInterop false` and `--allowSyntheticDefaultImports false` no longer work.**](https://devblogs.microsoft.com/typescript/announcing-typescript-6-0/#deprecated:---esmoduleinterop-false-and---allowsyntheticdefaultimports-false) So if you're still using syntax like `import * as express from "express"` it won't work, you'd need to use `import express from "express"`. In short, TypeScript 6.0 tightens defaults across the board and throws enough changes into the works that many projects will need at least a tsconfig tweak.. good luck with your upgrades! 🤞 **Got a link for us?** Reply and tell us. We can't include everything but we'll look at anything you send. _Thanks!_ --- **Sponsorship:** Email `[kristina@cooperpress.com](mailto:kristina@cooperpress.com)` for details. --- Published by Cooper Press Ltd. Fairfield Enterprise Centre, Louth, LN11 0LS, United Kingdom [Cancel your subscription](https://nodeweekly.com/leave/*|UID|*) or [change your address](https://nodeweekly.com/edit_subscription/*|UID|*).