Node.js 26.4 Adds Package Maps — A minor release whose headline feature is the (experimental) implementation of package maps (which let Node resolve packages from a static JSON file rather than walking node_modules). Matteo Collina’s node:vfs subsystem also begins to make an appearance.

Antoine du Hamel

That Analytics Route is Blocking Your Event Loop — Crunching big result sets in Node ties up the event loop and stalls other requests. TimescaleDB extends Postgres so the database aggregates instead. Hypertables, 95% compression, continuous aggregates. No second database. Get $1000 credit to start.

Tiger Data (creators of TimescaleDB) sponsor

Blocking Install Scripts is Not a Silver Bullet — npm v12 won't run install scripts by default, but Ulises argues that only removes one attack trigger, not a capability, since a compromised dependency’s code still runs on import! He shows why, even then, Node's permissions model and sandboxing are the layers that actually limit what that code can do.

Ulises Gascon

What If npm Ran on AT Protocol? — James, a long-standing Node core contributor, ponders what a package system built atop the protocol Bluesky uses could look like: “It’s just an idea I couldn’t get out of my head until I wrote it down.”

James M Snell

Benchmarking 5 WebSocket Servers for Node.js — A banned IP, a lying load generator, and a 20× latency illusion turned a routine benchmark run into quite the detective story.

Irina Nazarova

Your Node App Has an N+1 Problem. AppSignal Shows You Where — Auto-detects N+1 queries in Prisma, Express, and Koa. One install, minutes to first trace. Free 30-day trial, no card.

AppSignal sponsor

🤖 Eve: A Next.js-Style Framework for Building Agents — A new framework from Vercel that provides Next.js-esque structure for building AI-powered agents using TypeScript and Markdown. It's quite Vercel-flavored by default, but I found you can run it entirely independently of Vercel with a few settings tweaks and your own keys. Project homepage.

Vercel

TypeScript 7.0 Release Candidate — A step closer for the Go-powered TypeScript compiler that promises ~10x faster build performance. A reminder that moduleResolution: node / node10 are no longer supported and @types packages you need have to be listed explicitly.

Daniel Rosenwasser (Microsoft)

🔐 AccessControl 3.0: Role and Attribute-based Access Control — A role and attribute-based (RBAC/ABAC) access control library that, as of v3, now has a real policy engine available to apply conditions to grants, enforced ownership, mandatory restriction gates, audit hooks, and more. GitHub repo.

Onur Yıldırım

Camaro 6.5: A High Performance XML to JSON Converter — Uses bindings to pugixml, a fast C++ XML parser.

Tuan Anh Tran