--- title: "npm v12 and TypeScript 7 released" publication: "Node Weekly" issue: 632 published_at: "2026-07-09" canonical_url: "https://nodeweekly.com/issues/632" --- Plus Node 26.5 intros ESM text imports, Sindre's new node:test ESLint rules, and displaying images in the terminal. #​632 — July 9, 2026 [Read on the Web](https://nodeweekly.com/issues/632) Together with [![Sentry logo\](https://res.cloudinary.com/cpress/image/upload/c_fill,g_auto,e_trim,w_350,h_100/e_make_transparent/co_white,e_outline:7/xdmchdxkka938lxfr86f.png)](https://blog.sentry.io/nextjs-export-traces-opentelemetry/?utm_source=nodeweekly&utm_medium=paid-community&utm_campaign=nextjs-fy27q2-evergreen&utm_content=newsletter-primary-traces-otel-blog-learnmore) ![Node.js Weekly](https://res.cloudinary.com/cpress/image/upload/v1653576619/lgfqinzbdqttwmhvljxb.png) [![\](https://res.cloudinary.com/cpress/image/upload/w_1280,e_sharpen:60,q_auto/yl9a45qyggteictlikwu.jpg)](https://github.blog/changelog/2026-07-08-npm-install-time-security-and-gat-bypass2fa-deprecation/) [npm v12 Ships with Install Scripts Off by Default](https://github.blog/changelog/2026-07-08-npm-install-time-security-and-gat-bypass2fa-deprecation/) — npm 12 is now GA with [many breaking changes](https://github.com/npm/cli/releases/tag/v12.0.0). The headline change is lifecycle scripts and implicit `node-gyp` builds no longer run by default. Socket’s Sarah Gooding [writes more about the practical implications](https://socket.dev/blog/npm-12) including, thankfully, that unknown `.npmrc` keys will now only [_warn_ rather than error](https://github.com/npm/cli/pull/9729) as they did in the pre-releases. GitHub [![\](https://res.cloudinary.com/cpress/image/upload/c_limit,w_480,h_480,q_auto/copm/b3c40c31.jpg)](https://blog.sentry.io/nextjs-export-traces-opentelemetry/?utm_source=nodeweekly&utm_medium=paid-community&utm_campaign=nextjs-fy27q2-evergreen&utm_content=newsletter-primary-traces-otel-blog-learnmore) [Your Next.js App Is Already Tracing. Now Make It Useful](https://blog.sentry.io/nextjs-export-traces-opentelemetry/?utm_source=nodeweekly&utm_medium=paid-community&utm_campaign=nextjs-fy27q2-evergreen&utm_content=newsletter-primary-traces-otel-blog-learnmore) — When a Next.js page is slow, the hard part is finding which part is responsible: middleware, SSR, an API route, a query, or a fetch call. 🔍 Next.js is already tracing all of it. [Here's how to actually see it and put it to use](https://blog.sentry.io/nextjs-export-traces-opentelemetry/?utm_source=nodeweekly&utm_medium=paid-community&utm_campaign=nextjs-fy27q2-evergreen&utm_content=newsletter-primary-traces-otel-blog-learnmore). Sentry sponsor [Node.js 26.5.0 (Current) Released](https://nodejs.org/en/blog/release/v26.5.0) — Key additions include the ability to [import text files into ES modules](https://github.com/tc39/proposal-import-text) via import attributes (behind [an experimental flag](https://github.com/nodejs/node/pull/62300)), `blob.textStream()` (good for streaming large blob content), and being able to [sample event-loop delay per iteration](https://github.com/nodejs/node/pull/62935) via `perf_hooks`. Richard Lau **IN BRIEF:** - Bun's Jarred Sumner wrote up [the full story of rewriting Bun in Rust](https://bun.com/blog/bun-in-rust), a somewhat controversial AI-powered port that will power Bun 1.4 onward. The cost? ~$165k of [Fable](https://www.anthropic.com/claude/fable) usage, at API prices. - James Snell has [a TC39 proposal to standardize a `code` property on `Error`](https://github.com/tc39/proposal-error-code-property) (as has long been common in Node). - [Better Auth](https://better-auth.com/), the framework-agnostic auth library, [is joining Vercel](https://better-auth.com/blog/better-auth-joins-vercel). [TypeScript 7.0 Released](https://devblogs.microsoft.com/typescript/announcing-typescript-7-0/) — Over a year after [announcing TypeScript would be ported to Go](https://devblogs.microsoft.com/typescript/typescript-native-port/), the final release is out. Don't rush to upgrade: TS 7.0 doesn't ship with an API yet, and [6.0](https://devblogs.microsoft.com/typescript/announcing-typescript-6-0/) is still a good stepping stone. If you _do_ upgrade, expect to see huge build time speedups, once `moduleResolution: node` is switched to `nodenext` and you've sorted out `"types": ["node"]`. Microsoft [CVE-2026-48931 Shouldn't Have Been a CVE](https://adventures.nodeland.dev/archive/cve-2026-48931-shouldnt-have-been-a-cve/) — A candid post-mortem from a Node maintainer explaining a recent snafu around an HTTP/1.1 poisoning issue he now argues shouldn’t have been a CVE, especially after the fix broke node-fetch, Firebase, and the official Docker images. Matteo Collina [What's New in ECMAScript 2026](https://pawelgrzybek.com/whats-new-in-ecmascript-2026/) — The [ECMAScript 2026 spec](https://ecma-international.org/publications-and-standards/standards/ecma-262/) was approved last week, and this round-up covers several main new features that made the cut, with all (except `Math.sumPrecise`) available in Node today. Pawel Grzybek 📄 [You Shouldn't Trust Trusted Publishing](https://blog.yossarian.net/2026/07/07/You-shouldnt-trust-trusted-publishing) – npm [added trusted publishing](https://docs.npmjs.com/trusted-publishers), but it’s authentication, not a safety or quality badge. Matteo Collina has also [written about this from the npm perspective](https://adventures.nodeland.dev/archive/why-trusted-publishing-can-t-save-us/) before. William Woodruff 📄 [Node.js Worker Threads in Production](https://www.inngest.com/blog/node-worker-threads-production) – Hard-won lessons from running worker threads at scale. Aaron Harper (Inngest) 🛠 Code & Tools [![\](https://res.cloudinary.com/cpress/image/upload/w_1280,e_sharpen:60,q_auto/ufi8jm6wnm93dzs3zqdo.jpg)](https://github.com/sindresorhus/terminal-image) [terminal-image 5.0: Display Images in the Terminal](https://github.com/sindresorhus/terminal-image) — Works in any terminal that supports colors by rendering colored blocks, but can render images inline in terminals that support inline graphics. v5.0 improves iTerm2 support by using its native inline image support, rather than the Kitty protocol. Sindre Sorhus [Full-Text Search in Drizzle Without a Second System](https://github.com/paradedb/drizzle-paradedb) — Try the official ParadeDB integration for Drizzle. Search your live Postgres tables. No ETL, no Elasticsearch cluster. ParadeDB sponsor [eslint-node-test: ESLint Rules for Node's Built-In Test Runner](https://github.com/sindresorhus/eslint-node-test) — In Sindre’s own words: _“If you use the Node.js test runner (`node:test`), you may like the new ESLint plugin I cooked up. 64_ [now 82] _rules to improve your tests, prevent mistakes, and enforce style.”_ Sindre Sorhus ✉️ [Upyo 0.5: A Cross-Runtime Email Sending Library](https://upyo.org/) — A unified, type-safe API for sending emails both on SMTP and HTTP-based (e.g. SendGrid or Amazon SES) providers from Node, Deno, Bun, and edge function runtimes. Hong Minhee [webpack-dev-server 6.0: The Official webpack Dev Server](https://github.com/webpack/webpack-dev-server/releases/tag/v6.0.0) — Bumps Express up to v5, drops support for older Node versions, adds support to be used as a webpack plugin, and switches to ESM. webpack - [XO 4.0](https://github.com/xojs/xo) – Opinionated but configurable ESLint wrapper that includes numerous popular ESLint plugins and rules out of the box. - [ESLint Plugin Perfectionist 5.10](https://github.com/azat-io/eslint-plugin-perfectionist) – For when you're _really_ particular about the ordering of things like objects, imports, and types. - [MongoDB Node.js Driver 7.5](https://github.com/mongodb/node-mongodb-native/releases/tag/v7.5.0) – Official driver for MongoDB. Now supports Queryable Encryption string queries on MongoDB 9.0. - 🐍 [node-calls-python 1.2](https://github.com/hmenyus/node-calls-python) – Call Python from Node directly, in-process, without spawning processes. - [FoalTS 5.3](https://foalts.org/blog/2026/07/09/version-5.3-release-notes/) – The full-featured Node.js app framework adds a new `dev-verbose` logging format. - [Fastify 5.10.0](https://github.com/fastify/fastify/releases/tag/v5.10.0) – The fast and low overhead web framework. - [feed 6.0](https://github.com/jpmonette/feed) – RSS, JSON, and Atom feed generator library. 📰 Classifieds 📈 [Crystallize seeks a remote SRE](https://crystallize.com/careers/senior-sre) who thinks in SLOs, not heroics. Node/TS, GraphQL. **Got a link for us?** Reply and tell us. We can't include everything but we'll look at anything you send. _Thanks!_ --- **Sponsorship:** Email `[kristina@cooperpress.com](mailto:kristina@cooperpress.com)` for details. --- Published by Cooper Press Ltd. Fairfield Enterprise Centre, Louth, LN11 0LS, United Kingdom [Cancel your subscription](https://nodeweekly.com/leave/*|UID|*) or [change your address](https://nodeweekly.com/edit_subscription/*|UID|*).