--- title: "Node.js 26.4 lands package maps" publication: "Node Weekly" issue: 630 published_at: "2026-06-25" canonical_url: "https://nodeweekly.com/issues/630" --- Plus npm 12 in preview, Deno's desktop app feature, and Vercel's new framework for building agents. #​630 — June 25, 2026 [Read on the Web](https://nodeweekly.com/issues/630) Together with [![Tiger Data logo\](https://res.cloudinary.com/cpress/image/upload/c_fill,g_auto,w_1280,h_282/e_make_transparent/co_white,e_outline:30/px1u7kjyvz7xnbm6ytir.png)](https://www.tigerdata.com/go/trial?utm_source=content-syndication&utm_medium=referral&utm_campaign=node-weekly-newsletter) ![Node.js Weekly](https://res.cloudinary.com/cpress/image/upload/v1653576619/lgfqinzbdqttwmhvljxb.png) [![\](https://res.cloudinary.com/cpress/image/upload/w_1280,e_sharpen:60,q_auto/z3a4qdwxuxpfyblgqzw4.jpg)](https://nodejs.org/en/blog/release/v26.4.0) [Node.js 26.4 Adds Package Maps](https://nodejs.org/en/blog/release/v26.4.0) — A minor release whose headline feature is the (experimental) implementation of [package maps](https://nodejs.org/api/packages.html#package-maps) (which let Node resolve packages from a static JSON file rather than walking `node_modules`). Matteo Collina’s [node:vfs subsystem](https://github.com/nodejs/node/pull/63115) also _begins_ to make an appearance. Antoine du Hamel 💡 [Node v24.18.0 (LTS)](https://nodejs.org/en/blog/release/v24.18.0) and [v22.23.1 (LTS)](https://nodejs.org/en/blog/release/v22.23.1) have also been released. [![\](https://res.cloudinary.com/cpress/image/upload/c_limit,w_480,h_480,q_auto/copm/2c2408da.png)](https://www.tigerdata.com/go/trial?utm_source=content-syndication&utm_medium=referral&utm_campaign=node-weekly-newsletter) [That Analytics Route is Blocking Your Event Loop](https://www.tigerdata.com/go/trial?utm_source=content-syndication&utm_medium=referral&utm_campaign=node-weekly-newsletter) — Crunching big result sets in Node ties up the event loop and stalls other requests. TimescaleDB extends Postgres so the database aggregates instead. Hypertables, 95% compression, continuous aggregates. No second database. [Get $1000 credit to start](https://www.tigerdata.com/go/trial?utm_source=content-syndication&utm_medium=referral&utm_campaign=node-weekly-newsletter). Tiger Data (creators of TimescaleDB) sponsor [Blocking Install Scripts is Not a Silver Bullet](https://nodesource.com/blog/npm-v12-install-scripts-not-a-silver-bullet) — [npm v12](https://github.blog/changelog/2026-06-09-upcoming-breaking-changes-for-npm-v12/) won't run install scripts by default, but Ulises argues that only removes one attack trigger, not a capability, since a compromised dependency’s code still runs on import! He shows why, even then, Node's [permissions model](https://nodejs.org/api/permissions.html) and sandboxing are the layers that actually limit what that code can do. Ulises Gascon **IN BRIEF:** - The [first preview release of `npm` 12 is here](https://github.com/npm/cli/releases/tag/v12.0.0-pre.1) if you want to get testing. - [Deno](https://deno.com/) has begun to show off a [new feature to create cross-platform desktop apps](https://docs.deno.com/runtime/desktop/). Think Electron-style apps, but on top of Deno with cross-compilation, framework auto-detection, and a choice between bundling a Chromium runtime or using the system's WebView. - Vercel has opened [a public beta of WebSockets support](https://vercel.com/changelog/websocket-support-is-now-in-public-beta) in Vercel Functions. You can write normal Node.js code using `ws` with no extra setup. - The `pnpm` project is [working on `pnpr`](https://pnpm.io/pnpr/), an experimental pnpm-compatible npm registry server, written in Rust. [What If npm Ran on AT Protocol?](https://www.jasnell.me/posts/what-if-npm-ran-on-atproto) — James, a long-standing Node core contributor, ponders what a package system built atop the protocol Bluesky uses could look like: _“It’s just an idea I couldn’t get out of my head until I wrote it down.”_ James M Snell [Benchmarking 5 WebSocket Servers for Node.js](https://evilmartians.com/chronicles/choose-your-fighter-benchmarking-5-websocket-servers-for-nodejs) — A banned IP, a lying load generator, and a 20× latency illusion turned a routine benchmark run into quite the detective story. Irina Nazarova [Your Node App Has an N+1 Problem. AppSignal Shows You Where](https://www.appsignal.com/?utm_source=node-weekly&utm_medium=newsletter&utm_campaign=appsignal_q2_2026&utm_content=n-plus-1) — Auto-detects N+1 queries in Prisma, Express, and Koa. One install, minutes to first trace. [Free 30-day trial, no card](https://www.appsignal.com/?utm_source=node-weekly&utm_medium=newsletter&utm_campaign=appsignal_q2_2026&utm_content=n-plus-1). AppSignal sponsor 📄 [JavaScript Still Can't Ship a 'Full-Stack Module'](https://wasp.sh/blog/2026/06/22/javascript-still-cant-ship-a-full-stack-module) – Thoughts on modules which provide frontend and backend code ready to go, as you might see in ecosystems like Rails and Laravel. Mihovil Ilakovac 📊 [The Performance of WebAssembly Runtimes in 2026](https://00f.net/2026/06/23/webassembly-runtimes-2026/) – Mostly focused on dedicated options, but also including Node/V8. Frank Denis 🛠 Code & Tools [![\](https://res.cloudinary.com/cpress/image/upload/w_1280,e_sharpen:60,q_auto/b1kuykh8i2jmbor2kxdh.jpg)](https://vercel.com/blog/introducing-eve) 🤖 [Eve: A Next.js-Style Framework for Building Agents](https://vercel.com/blog/introducing-eve) — A new framework from Vercel that provides Next.js-esque structure for building AI-powered agents using TypeScript and Markdown. It's quite Vercel-flavored by default, but I found you can run it entirely independently of Vercel with a few settings tweaks and your own keys. [Project homepage.](https://vercel.com/eve) Vercel [TypeScript 7.0 Release Candidate](https://devblogs.microsoft.com/typescript/announcing-typescript-7-0-rc/) — A step closer for the Go-powered TypeScript compiler that promises ~10x faster build performance. A reminder that `moduleResolution: node` / `node10` are no longer supported and `@types` packages you need have to be listed explicitly. Daniel Rosenwasser (Microsoft) 🔐 [AccessControl 3.0: Role and Attribute-based Access Control](https://onury.io/accesscontrol/) — A role and attribute-based (RBAC/ABAC) access control library that, [as of v3](https://onury.io/accesscontrol/whats-new/), now has a real policy engine available to apply conditions to grants, enforced ownership, mandatory restriction gates, audit hooks, and more. [GitHub repo](https://github.com/onury/accesscontrol). Onur Yıldırım [Camaro 6.5: A High Performance XML to JSON Converter](https://github.com/tuananh/camaro) — Uses bindings to [pugixml](https://pugixml.org/), a fast C++ XML parser. Tuan Anh Tran - [Tedious 20.0](https://github.com/tediousjs/tedious) – TDS module for connecting to SQL Server. A related release is the SQL Server client library [node-mssql 12.6](https://github.com/tediousjs/node-mssql) which uses Tedious (or [msnodesqlv8](https://github.com/TimelordUK/node-sqlserver-v8)). - [Chardet 2.2](https://github.com/runk/node-chardet) – Character encoding detection library that uses statistical methods to detect [around 30 different encodings](https://github.com/runk/node-chardet#supported-encodings). - [cookie 2.0](https://github.com/jshttp/cookie/releases/tag/v2.0.0) – HTTP cookie parser and serializer library. Now faster and ESM only. 📰 Classifieds 🧐 Where to host? Judoscale’s [cost comparison calculator](https://judoscale.com/tools/paas-pricing-calculator?utm_source=node-weekly&utm_medium=newsletter&utm_campaign=calculator&utm_content=paas-alternatives-head-to-head) puts the PaaS alternatives head-to-head. --- ⚙️ Run AI agents like microservices — every agent an auto-generated API: schemas, versioning, no glue code. 100+ recipes, TypeScript SDK. [→ Star on GitHub](https://agentfield.ai/github/?utm_source=node&utm_medium=newsletter&utm_campaign=node-260625&utm_id=node-260625-github-cta&utm_content=github-cta). 📢 Elsewhere in the ecosystem A roundup of some other interesting stories in the broader landscape: - Cloudflare has added the ability to [create and deploy Workers on 'temporary accounts'](https://blog.cloudflare.com/temporary-accounts/). Ostensibly 'for AI agents', but you can use them yourself too, and get a Worker (which have [increased Node.js compatibility](https://developers.cloudflare.com/workers/runtime-apis/nodejs/) nowadays) running for 60 minutes with no strings attached. - The Bun team has proposed [adding shared-memory threads to JavaScriptCore](https://github.com/oven-sh/WebKit/pull/249) (a more traditional threading approach versus [worker threads](https://nodejs.org/api/worker_threads.html#worker-threads)). - 🔒 GitHub has [released `actions/checkout` v7](https://github.blog/changelog/2026-06-18-safer-pull_request_target-defaults-for-github-actions-checkout/) that _"refuses common pwn request patterns by default"_ including refusing to fetch fork pull request code in `pull_request_target` and `workflow_run` workflows. **Got a link for us?** Reply and tell us. We can't include everything but we'll look at anything you send. _Thanks!_ --- **Sponsorship:** Email `[kristina@cooperpress.com](mailto:kristina@cooperpress.com)` for details. --- Published by Cooper Press Ltd. Fairfield Enterprise Centre, Louth, LN11 0LS, United Kingdom [Cancel your subscription](https://nodeweekly.com/leave/*|UID|*) or [change your address](https://nodeweekly.com/edit_subscription/*|UID|*).