--- title: "Node.js 25.9 brings --max-heap-size and better, iterable streams" publication: "Node Weekly" issue: 618 published_at: "2026-04-02" canonical_url: "https://nodeweekly.com/issues/618" --- Plus more on the Axios attack, a step-by-step guide to publishing to npm, and running LLMs from Node. #​618 — April 2, 2026 [Read on the Web](https://nodeweekly.com/issues/618) Together with [![Memetria\](https://res.cloudinary.com/cpress/image/upload/c_fill,g_auto,w_600,h_145/e_make_transparent/co_white,e_outline:7/vvpdctzacmq3xehpvwps.png)](https://dashboard.memetria.com/nodeweekly/) ![Node.js Weekly](https://res.cloudinary.com/cpress/image/upload/v1653576619/lgfqinzbdqttwmhvljxb.png) [![\](https://res.cloudinary.com/cpress/image/upload/w_1280,e_sharpen:60,q_auto/z8z8ak6sfky2qi5mg7y0.jpg)](https://nodejs.org/en/blog/release/v25.9.0) [Node.js 25.9.0 (Current) Released](https://nodejs.org/en/blog/release/v25.9.0) — Including a `--max-heap-size` option to set the maximum heap size for a process, James Snell’s experimental [‘better streams API’](https://blog.cloudflare.com/a-better-web-streams-api/) implementation lands as `stream/iter` ([docs here](https://nodejs.org/docs/latest/api/stream_iter.html#iterable-streams)), plus test runner module mocking improvements. Antoine du Hamel [![\](https://res.cloudinary.com/cpress/image/upload/c_limit,w_480,h_480,q_auto/copm/8052a322.png)](https://dashboard.memetria.com/nodeweekly/) [Memetria K/V: Efficient Redis & Valkey Hosting](https://dashboard.memetria.com/nodeweekly/) — Memetria K/V hosts Redis OSS and Valkey for Node.js apps, featuring large key tracking and detailed analytics. Memetria sponsor [The Hidden Blast Radius of the Axios Compromise](https://socket.dev/blog/hidden-blast-radius-of-the-axios-compromise) — You’ve probably heard about [the supply chain attack via Axios](https://socket.dev/blog/axios-npm-package-compromised) this week (if not, be sure to [check if you’re affected](https://www.stepsecurity.io/blog/axios-compromised-on-npm-malicious-versions-drop-remote-access-trojan#am-i-affected)). Ahmad reflects on the mechanics of such attacks and why their effects spread further than you might think. Ahmad Nassri (Socket) 💡 If you want to mitigate such attacks, Dani Akash has [a guide to using 'minimum release age' cooldowns](https://daniakash.com/posts/simplest-supply-chain-defense/) with npm, pnpm, Bun, and Yarn. **IN BRIEF:** - MSW's Artem Zakharchenko shares [a step-by-step guide to publishing to npm _securely_ in 2026.](https://gist.github.com/kettanaito/debde3cabfae4f68d37cf0f8f3a6a666) - [The source code for Claude Code leaked](https://alex000kim.com/posts/2026-03-31-claude-code-source-leak/) a few days ago due to the accidental shipping of source maps in its npm package. A Bun-related [issue](https://github.com/oven-sh/bun/issues/28001)? (or [not?](https://github.com/oven-sh/bun/issues/28001#issuecomment-4164447815)) but a reminder of [how powerful source maps can be.](https://bloomberg.github.io/js-blog/post/standardizing-source-maps/) - Cloudflare has [released EmDash](https://blog.cloudflare.com/emdash-wordpress/), a _'spiritual successor to WordPress'_ that runs both on Cloudflare or _'any Node.js server'._ [A Gentle Intro to npm Workspaces](https://wasp.sh/blog/2026/03/25/gentle-intro-npm-workspaces) — With [workspaces](https://docs.npmjs.com/cli/v8/using-npm/workspaces), you can manage multiple packages in one repo and link local packages so they can import each other by name. npm may then hoist and deduplicate compatible dependencies during install. Carlos Precioso (Wasp) [Run Agents on Production-Fidelity Sandboxes](https://www.ox.build?utm_source=cooperpress&utm_medium=referral&utm_campaign=node-weekly-newsletter) — Ox spins up a sandbox for every agent task. Isolated code, compute, and data. Test against prod with zero blast radius. Ox sponsor ▶️ [Most Developers Misunderstand Node.js in Production](https://www.youtube.com/watch?v=rqmTDVdnMT8) – A quick 6-minute interview with core contributor Ulises Gascón. Beyond.js (NodeSource) 🤖 [Getting Started Building Agents with the Vercel AI SDK in Node](https://thecodebarbarian.com/getting-started-with-the-vercel-ai-sdk-agents-in-nodejs.html) Valeri Karpov 📄 [Escaping Node.js's Permission Model via Brotli](https://blig.one/2026/03/29/nodejs-brotli-uaf.html) maitai 📄 [Why We Replaced Node.js with Bun for 5x Throughput](https://trigger.dev/blog/firebun) Nick at Trigger 🛠 Code & Tools 🤖 [Transformers.js v4: Run AI Models from JavaScript](https://github.com/huggingface/transformers.js/releases/tag/4.0.0) — Run [Hugging Face](https://huggingface.co/)-hosted models to do things like LLMs, vision, and audio models from Node, in the browser, etc. v4 switches to WebGPU and is installable with npm. There are [many demos](https://huggingface.co/collections/webml-community/transformersjs-v4-demos) covering [speech transcription](https://huggingface.co/spaces/mistralai/Voxtral-Realtime-WebGPU), [using Qwen 3.5](https://huggingface.co/spaces/webml-community/Qwen3.5-WebGPU), and [video captioning.](https://huggingface.co/spaces/LiquidAI/LFM2-VL-WebGPU) Hugging Face 💡 The browser demos use large model downloads, so server-side use with Node may be the best use case, even if not the _coolest_. [node-re2: Bindings for Google's RE2 Regex Library](https://github.com/uhop/node-re2) — [RE2](https://en.wikipedia.org/wiki/RE2_%28software%29) is a regular expression library with linear-time matching, making it immune to [ReDoS](https://owasp.org/www-community/attacks/Regular_expression_Denial_of_Service_-_ReDoS) attacks caused by backtracking. node-re2 offers it as a near drop-in replacement for `RegExp`. Eugene Lazutkin [Defuddle: Extract the Main Content from Pages](https://github.com/kepano/defuddle) — Strips clutter from HTML leaving only the primary content for you to use. There’s [a demo](https://defuddle.md/) where you can try it out. Steph Ango - [dotenv 17.4](https://github.com/motdotla/dotenv) – Loads environment variables from `.env` files into `process.env`. While now [a built-in Node feature](https://nodejs.org/api/environment_variables.html#cli-options), dotenv is a popular dependency with 100M+ downloads a week and offers finer-grained control over the process. - [numpy-ts 1.2](https://github.com/dupontcyborg/numpy-ts/releases/tag/v1.2.0) – NumPy implementation for TS/JS. Now at ~50% native perf and with Float16 support. ([Homepage](https://numpyts.dev/)) - [Path-to-RegExp 8.4](https://github.com/pillarjs/path-to-regexp) – Library to convert path strings with parameters into regexes. - [globby 16.2](https://github.com/sindresorhus/globby) – Promise-based glob matching, now with [global gitignore file support.](https://github.com/sindresorhus/globby?tab=readme-ov-file#globalgitignore) - [ts-blank-space 0.8](https://github.com/bloomberg/ts-blank-space) – Pure JS type-stripper using the TypeScript 6 parser. - [Aedes 1.0.2](https://github.com/moscajs/aedes) – Node.js MQTT broker that runs on any stream server. - [Ky 2.0 Prerelease](https://github.com/sindresorhus/ky/releases/tag/v2.0.0-0) – Popular HTTP client based on the Fetch API. - [Got 15.0](https://github.com/sindresorhus/got/releases/tag/v15.0.0) – Human-friendly, powerful HTTP request library. - [ESLint Markdown Plugin 8.0](https://github.com/eslint/markdown) – Lint Markdown with ESLint. - [file-type 22.0](https://github.com/sindresorhus/file-type/releases/tag/v22.0.0) – Detect the file type of binary files. 📰 Classifieds 🧐 A cheaper Heroku? Our [cost comparison calculator](https://judoscale.com/tools/paas-pricing-calculator?utm_source=node-weekly&utm_medium=newsletter&utm_campaign=calculator&utm_content=paas-alternatives-head-to-head) puts the PaaS alternatives head-to-head. --- Become an AI-first engineer. Gauntlet is a full-time fellowship, no cost. $200K+ roles. Next cohort starts 4/27. [Apply Today](https://gauntletai.com/apply?utm_source=node_weekly&utm_medium=referral&utm_campaign=april_1&utm_content=learn_more.) --- SerpApi is a [Web Search API](https://serpapi.com/?utm_source=cooperpress&utm_campaign=node_classified) for accessing Google and other search engine results in structured JSON. Try SerpApi for free. 📢 Elsewhere in the ecosystem [![\](https://res.cloudinary.com/cpress/image/upload/w_1280,e_sharpen:60,q_auto/ke7osegtjy2uvzmaphus.jpg)](https://github.com/google/wwwbasic) - [WWWBasic](https://github.com/google/wwwbasic) is a curious Google-hosted project to use the [BASIC](https://en.wikipedia.org/wiki/BASIC) language in `script` tags or within Node apps. It's had its first update in years (1.0.2) to add ESM support and improve a few things. This seems to be a true labor of love for Googler Brad Nelson. - [QuickBEAM](https://github.com/elixir-volt/quickbeam) is a JavaScript runtime for Erlang's BEAM VM, as also used by [Elixir.](https://elixir-lang.org/) It offers compatibility with core Node.js APIs. - [Deno v2.7.11 has been released](https://github.com/denoland/deno/releases/tag/v2.7.11) with _"tons of Node.js compatibility improvements"_ covering `crypto`, `child_process`, `workers`, and [TTY handling on Windows](https://github.com/denoland/deno/pull/32999) to match `libuv`'s behavior. - [wasm-git](https://github.com/petersalomonsen/wasm-git) is a WASM-compiled version of Git you can use directly from Node. We first linked to this six years ago when it was a mere experiment, but it's come a long way since then. **Got a link for us?** Reply and tell us. We can't include everything but we'll look at anything you send. _Thanks!_ --- **Sponsorship:** Email `[kristina@cooperpress.com](mailto:kristina@cooperpress.com)` for details. --- Published by Cooper Press Ltd. Fairfield Enterprise Centre, Louth, LN11 0LS, United Kingdom [Cancel your subscription](https://nodeweekly.com/leave/*|UID|*) or [change your address](https://nodeweekly.com/edit_subscription/*|UID|*).