--- title: "Domenic Denicola's modern dev setup" publication: "Node Weekly" issue: 634 published_at: "2026-07-23" canonical_url: "https://nodeweekly.com/issues/634" --- Plus prototype pollution, building standalone Mastodon bots, and ESLint rules for package.json files. #​634 — July 23, 2026 [Read on the Web](https://nodeweekly.com/issues/634) Together with [![ParadeDB\](https://res.cloudinary.com/cpress/image/upload/c_fill,g_auto,e_trim,w_1280,h_164/e_make_transparent/co_white,e_outline:17/cdd8ciarsq6m8xam8oc3.png)](https://github.com/paradedb/drizzle-paradedb) ![Node.js Weekly](https://res.cloudinary.com/cpress/image/upload/v1653576619/lgfqinzbdqttwmhvljxb.png) [![\](https://res.cloudinary.com/cpress/image/upload/w_1280,e_sharpen:60,q_auto/phw1ia6ck6daytvjsy7q.jpg)](https://adventures.nodeland.dev/archive/no-we-cant-harden-nodejs-against-prototype/) [No, We Can't Harden Node.js Against Prototype Pollution](https://adventures.nodeland.dev/archive/no-we-cant-harden-nodejs-against-prototype/) — An explanation of why the Node team rejects prototype pollution reports against core: each assumes the attacker can already write to `Object.prototype`, by which point the game is over. The true fix lives at the boundary where untrusted JSON becomes objects. Matteo Collina [![\](https://res.cloudinary.com/cpress/image/upload/c_limit,w_480,h_480,q_auto/copm/9fdaa696.png)](https://github.com/paradedb/drizzle-paradedb) [Full-Text Search in Drizzle Without a Second System](https://github.com/paradedb/drizzle-paradedb) — Try the official ParadeDB integration for Drizzle. Search your live Postgres tables. No stale results, no ETL, no Elasticsearch cluster. ParadeDB sponsor [Domenic Denicola's Agentic Coding Setup](https://domenic.me/agentic-coding-setup/) — It's fascinating when a prolific developer (Domenic was a key figure in [the adoption of promises in JavaScript](https://domenic.me/youre-missing-the-point-of-promises/), creating [jsdom](https://github.com/jsdom/jsdom), and [much more](https://domenic.me/)) shares their workflow. This is no exception, covering areas like disposable VMs, Tailscale, and worktrees. Domenic Denicola **IN BRIEF:** - ⚠️ [A round of July 27 Node.js security releases](https://nodejs.org/en/blog/vulnerability/july-2026-security-releases) has been announced, with Node 26.x, 24.x, 22.x being updated to resolve a HIGH severity issue. - 🏆 The OpenJS Foundation is showcasing [a ranking of the top contributors to its projects](https://insights.linuxfoundation.org/collection/details/ojsf/contributors?timeRange=past365days&start=2025-07-23&end=2026-07-23) (which [include](https://openjsf.org/projects) Node, Express, and Electron) in the past year. Matteo Collina leads the way…just! - Over on 𝕏, [the Bun team is teasing](https://x.com/bunjavascript/status/2079863261630267773) the imminent release of [Bun](https://bun.com/) 1.4, which will have the _"biggest jump in Node.js compatibility since Bun v1.0"._ - [pnpm has had a flurry of releases](https://pnpm.io/blog/releases/11.11-11.14) introducing native workspace release management, a `doctor` command to diagnose installation issues, and more. - ESLint now provides [official 'codemods' for automating ESLint version migrations](https://eslint.org/blog/2026/07/eslint-codemod-migrations/), with v8→v9 and v9→v10 available. [better-sqlite3 13.0: The Popular SQLite Library Moves to N-API](https://github.com/WiseLibs/better-sqlite3/releases/tag/v13.0.0) — The good news is prebuilt binaries should now work across different versions of Node and Electron. There's also a new `db.explain()` method and a `preparedStatement.toString()` method to get the expanded SQL of a prepared statement. Joshua Wise [High-Ingest Analytics, Still Just Postgres](https://www.tigerdata.com/go/trial?utm_source=content-syndication&utm_medium=referral&utm_campaign=node-weekly-newsletter) — TimescaleDB extends Postgres to ingest and query events at scale. One database, standard SQL. [Get $1000 credit to start](https://www.tigerdata.com/go/trial?utm_source=content-syndication&utm_medium=referral&utm_campaign=node-weekly-newsletter). Tiger Data (creators of TimescaleDB) sponsor 📄 [Unpacking the AsyncAPI npm Supply Chain Compromise](https://www.microsoft.com/en-us/security/blog/2026/07/15/unpacking-asyncapi-npm-supply-chain-compromise-import-time-payload-delivery/) – It seems attackers have already adapted to a world where post-install scripts are no longer run. Microsoft Security Research 📄 [New Study Identifies 53 Slopsquatting Targets Across 5 Popular LLMs](https://socket.dev/blog/slopsquatting-targets-across-frontier-llms) – LLMs continue to make up npm package names. Sarah Gooding 📄 [Running Background Jobs in Node.js with BullMQ](https://flaviocopes.com/nodejs-background-jobs-bullmq/) Flavio Copes 🛠 Code & Tools [Execa 10.0: Better Process Execution from Node](https://github.com/sindresorhus/execa) — A powerful way to run processes that makes passing in input, processing output, handling errors, piping things around, and handling streams easy. [v10](https://github.com/sindresorhus/execa/releases/tag/v10.0.0) trims the API and adds new stream conversion powers and a `killDescendants` option to terminate a subprocess's descendant processes. Sindre Sorhus [eslint-package-json: Powerful ESLint Rules for `package.json`](https://github.com/sindresorhus/eslint-package-json) — An ESLint plugin that catches `package.json` mistakes like invalid names, bad version ranges, broken `exports`, redundant `files` entries, and more, and fixes many of them automatically. Sindre Sorhus 🤖 [BotKit: Build Standalone ActivityPub Bots](https://botkit.fedify.dev/) — A way to run a bot (or multiple bots) that Mastodon users can see and follow but without needing an account anywhere. Write it all in JavaScript and self-host. I spun one up with Node (temporarily) and it worked well. Fedify - [Nub 0.5](https://github.com/nubjs/nub/releases/tag/v0.5.0) – The [all-in-one toolkit](https://nubjs.com/blog/introducing-nub) that augments Node's feature set. v0.5 adds `nub init` as a way to quickly scaffold new projects. - [odiff 4.5](https://github.com/dmtrKovalenko/odiff) – Fast SIMD-powered image comparison library. Written in Zig with Node bindings. - [node-html-to-image 6.2](https://github.com/frinyvonnick/node-html-to-image) – A function to generate images from HTML. - [find-my-way 9.7](https://github.com/delvedor/find-my-way) – Fast radix-tree based HTTP router used by Fastify. - [Gitify 7.0](https://github.com/gitify-app/gitify) – Electron-powered Git notifications menu bar app. - [Verdaccio 6.8](https://github.com/verdaccio/verdaccio/releases/tag/v6.8.0) – Self-hostable Node.js private proxy registry. - [Piscina 5.3](https://github.com/piscinajs/piscina) – Popular worker thread pool implementation. - [Prisma 7.9](https://github.com/prisma/prisma/releases/tag/7.9.0) 📰 Classifieds ⚡ [Zuplo](https://zuplo.link/vuib4cV) puts every API, AI, and MCP request behind one gateway. Route traffic, guard your MCP servers, and cap your AI costs. [Try it free](https://zuplo.link/vuib4cV). **Got a link for us?** Reply and tell us. We can't include everything but we'll look at anything you send. _Thanks!_ --- **Sponsorship:** Email `[kristina@cooperpress.com](mailto:kristina@cooperpress.com)` for details. --- Published by Cooper Press Ltd. Fairfield Enterprise Centre, Louth, LN11 0LS, United Kingdom [Cancel your subscription](https://nodeweekly.com/leave/*|UID|*) or [change your address](https://nodeweekly.com/edit_subscription/*|UID|*).