No, We Can't Harden Node.js Against Prototype Pollution — An explanation of why the Node team rejects prototype pollution reports against core: each assumes the attacker can already write to Object.prototype, by which point the game is over. The true fix lives at the boundary where untrusted JSON becomes objects.

Matteo Collina

Full-Text Search in Drizzle Without a Second System — Try the official ParadeDB integration for Drizzle. Search your live Postgres tables. No stale results, no ETL, no Elasticsearch cluster.

ParadeDB sponsor

Domenic Denicola's Agentic Coding Setup — It's fascinating when a prolific developer (Domenic was a key figure in the adoption of promises in JavaScript, creating jsdom, and much more) shares their workflow. This is no exception, covering areas like disposable VMs, Tailscale, and worktrees.

Domenic Denicola

better-sqlite3 13.0: The Popular SQLite Library Moves to N-API — The good news is prebuilt binaries should now work across different versions of Node and Electron. There's also a new db.explain() method and a preparedStatement.toString() method to get the expanded SQL of a prepared statement.

Joshua Wise

High-Ingest Analytics, Still Just Postgres — TimescaleDB extends Postgres to ingest and query events at scale. One database, standard SQL. Get $1000 credit to start.

Tiger Data (creators of TimescaleDB) sponsor

Execa 10.0: Better Process Execution from Node — A powerful way to run processes that makes passing in input, processing output, handling errors, piping things around, and handling streams easy. v10 trims the API and adds new stream conversion powers and a killDescendants option to terminate a subprocess's descendant processes.

Sindre Sorhus

eslint-package-json: Powerful ESLint Rules for package.json — An ESLint plugin that catches package.json mistakes like invalid names, bad version ranges, broken exports, redundant files entries, and more, and fixes many of them automatically.

Sindre Sorhus

🤖 BotKit: Build Standalone ActivityPub Bots — A way to run a bot (or multiple bots) that Mastodon users can see and follow but without needing an account anywhere. Write it all in JavaScript and self-host. I spun one up with Node (temporarily) and it worked well.

Fedify