--- title: "Node.js 26.7, vlt 1.0, and Shai-Hulud Returns" publication: "Node Weekly" issue: 636 published_at: "2026-08-06" canonical_url: "https://nodeweekly.com/issues/636" --- Plus debugging stuck Node processes, an X11 client library, and ZIP support lands in node:zlib. #​636 β€” August 6, 2026 [Read on the Web](https://nodeweekly.com/issues/636) Together with [![Sentry logo\](https://res.cloudinary.com/cpress/image/upload/c_fill,g_auto,e_trim,w_350,h_100/e_make_transparent/co_white,e_outline:7/xdmchdxkka938lxfr86f.png)](https://sentry.io/resources/etsy-workshop/?utm_source=nodeweekly&utm_medium=paid-community&utm_campaign=ecommerce-fy27q3-etsyworkshop&utm_content=newsletter-primary-register) ![Node.js Weekly](https://res.cloudinary.com/cpress/image/upload/v1653576619/lgfqinzbdqttwmhvljxb.png) [![\](https://res.cloudinary.com/cpress/image/upload/w_1280,e_sharpen:60,q_auto/bc5keokbeeeetqnie36v.jpg)](https://nodejs.org/en/blog/release/v26.7.0) [Node.js 26.7.0 (Current) Released](https://nodejs.org/en/blog/release/v26.7.0) β€” Landing just two days after [26.6](https://nodejs.org/en/blog/release/v26.6.0), coverage reports can now include files your tests didn't touch with [`--test-coverage-include-all`](https://github.com/nodejs/node/pull/64830), FFI and SQLite pick up crash fixes, and Perfetto tracing support lands, though you'll need a custom build to use it. Antoine du Hamel πŸ’‘ [Node v24.19.0 (LTS)](https://nodejs.org/en/blog/release/v24.19.0) is also a noteworthy update, adding `--experimental-import-text`, `fs.readFile()` can reuse a buffer you supply, and `setKeepAlive` exposes `TCP_KEEPINTVL` and`TCP_KEEPCNT`. [![\](https://res.cloudinary.com/cpress/image/upload/c_limit,w_480,h_480,q_auto/copm/2fc0d85b.jpg)](https://sentry.io/resources/etsy-workshop/?utm_source=nodeweekly&utm_medium=paid-community&utm_campaign=ecommerce-fy27q3-etsyworkshop&utm_content=newsletter-primary-register) [Join Sentry Live: How Etsy Stays Crash-Free](https://sentry.io/resources/etsy-workshop/?utm_source=nodeweekly&utm_medium=paid-community&utm_campaign=ecommerce-fy27q3-etsyworkshop&utm_content=newsletter-primary-register) β€” Sentry and Etsy break down how Etsy's engineering team preps for peak traffic, debugs in real time, and ties crashes to revenue impact. Real stories and practical takeaways for teams running services at scale. Sentry sponsor 🚨 [Shai-Hulud Strikes Again, Affecting `keyv` and 400+ Packages](https://research.jfrog.com/post/shai-hulud-is-back-august/) β€” A credential-stealing worm was rolled out as part of a false [keyv](https://github.com/jaredwray/keyv) 6.0 release this week, and quickly spread. A reminder to check out [npm v12](https://github.blog/changelog/2026-06-09-upcoming-breaking-changes-for-npm-v12/), [pnpm](https://pnpm.io/), or vlt (below), all of which block install scripts by default, the mechanism this worm relied on. Shavit Satou (JFrog) [vlt 1.0: An `npm` Alternative With CSS-Like Selectors](https://www.vlt.io/blog/1-0) β€” After two years, Darcy Clarke's drop-in `npm` alternative hits 1.0. A key draw is `vlt query`, which lets you use 60+ CSS-like selectors over your dependency graph (half of which are security related). vlt also offers hosted private package registries. Darcy Clarke πŸ’‘ In 2023, Darcy wrote ["The massive bug at the heart of the npm ecosystem"](https://www.vlt.io/blog/the-massive-hole-in-the-npm-ecosystem), a post that was prescient of current packaging headaches. **IN BRIEF:** - ⚠️ The Express team has [announced security releases for `body-parser`](https://expressjs.com/en/blog/2026-07-31-security-releases/) to address a DoS vulnerability. - [`net.BlockList`](https://nodejs.org/api/net.html#class-netblocklist), used to prevent network access to/from specified IP addresses and ranges, is [gaining new methods and getting much faster](https://github.com/nodejs/node/pull/64974). - There's a proposal and initial implementation to [bring the HTML spec's _Web Worker API_ to Node](https://github.com/nodejs/node/pull/64894). - [ZIP archive support is coming to `node:zlib`](https://github.com/nodejs/node/commit/5ba72ae7bc42fb3f884c860e7a4f7800794984f8) in a future release. πŸ“„ [What's New in Mongoose 9.9: Major Performance Improvements](https://thecodebarbarian.com/mongoose-99-perf.html) – [Mongoose](https://github.com/Automattic/mongoose) is a popular MongoDB object modelling solution. Valeri Karpov πŸ“„ [Debugging Stuck Node.js Processes](https://engineering.myhoai.com/posts/debugging-stuck-node-js-processes/) – A trick for catching event loop blockers that never yield. Winona Schroeer-Smith πŸ›  Code & Tools [![\](https://res.cloudinary.com/cpress/image/upload/w_1280,e_sharpen:60,q_auto/kpdqracqa9nmngvovohb.jpg)](https://firecrawl.github.io/anydoc/) [anydoc: Convert 14 Document Formats into Markdown](https://firecrawl.github.io/anydoc/) β€” A Rust-powered library (with Node.js and WASM bindings) that converts Word, PowerPoint, Excel, OpenDocument, RTF, EPUB, CSV, and PDF documents into Markdown. I tried it on a 1,600 page PDF and it took less than 2 seconds. There's also an in-browser demo to try it out. [GitHub repo](https://github.com/firecrawl/anydoc). Firecrawl πŸ’‘ Firecrawl also has [pdf-inspector](https://github.com/firecrawl/pdf-inspector) focused specifically on extracting text from PDFs (with positional awareness). [Liteparse](https://github.com/run-llama/liteparse#liteparse) is also worth considering if you want OCR for scanned / non-text PDFs. [You Added a Cache to Hide a Slow Query](https://www.tigerdata.com/go/trial?utm_source=content-syndication&utm_medium=referral&utm_campaign=node-weekly-newsletter) β€” TimescaleDB makes the query fast in Postgres, so you cache less and serve fresh data. [Get $1000 credit to start](https://www.tigerdata.com/go/trial?utm_source=content-syndication&utm_medium=referral&utm_campaign=node-weekly-newsletter). Tiger Data (creators of TimescaleDB) sponsor [ioredis 6.0: Robust, Full-Featured Redis Client for Node](https://github.com/redis/ioredis) β€” v6.0, the first major release in four years, adds [RESP3](https://redis.io/docs/latest/develop/reference/protocol-spec/) and support for new [Redis 8.10](https://redis.io/docs/latest/operate/oss_and_stack/stack-with-enterprise/release-notes/redisce/redisos-8.10-release-notes/)features. The ioredis Team [MicroDiff 1.6: Fast Object and Array Comparison Library](https://github.com/AsyncBanana/microdiff) β€” Given two objects or arrays, it returns the differences (think `diff` but for JS objects). This week's release adds support for Temporal types. Jacob Jackson [Devalue 5.9: Get the Job Done When `JSON.stringify` Can't](https://github.com/sveltejs/devalue) β€” A library from the Svelte project that's like `JSON.stringify` but can tackle cyclical and repeated references, regexes, `Map`/`Set`, and custom types. [Try it here](https://svelte.dev/playground/138d70def7a748ce9eda736ef1c71239). Svelte - [node-x11 3.8](https://sidorares.github.io/node-x11/) – An X Window System protocol client library with no dependencies, GLX / OpenGL support, and even the ability to [work in the browser](https://sidorares.github.io/node-x11/playground) against a JavaScript X-server emulator. - [pnpm 11.20](https://pnpm.io/blog/releases/11.20) – Mostly security hardening, but also adds an `npmjs:` prefix you can use to more succinctly pin a dependency to the public registry. Note that [pnpm 12.0](https://github.com/pnpm/pnpm/releases/tag/v12.0.0-rc.0) has also reached RC stage. - [Hono 4.13.0](https://github.com/honojs/hono/releases/tag/v4.13.0) – The small, fast Web standards-based web framework focuses on performance and adds HTTP QUERY method support. - [graphql-upload 18.0](https://github.com/jaydenseric/graphql-upload) – Middleware that adds support for GraphQL multipart requests to Node.js GraphQL servers. - [cron-parser 5.7](https://github.com/harrisiirak/cron-parser) – Library for parsing and manipulating `cron` expressions. πŸ“° Classifieds ⚑ [Zuplo](https://zuplo.link/vuib4cV) puts every API, AI, and MCP request behind one gateway. Route traffic, guard your MCP servers, and cap your AI costs. [Try it free](https://zuplo.link/vuib4cV). πŸ“’ Elsewhere in the ecosystem [![\](https://res.cloudinary.com/cpress/image/upload/w_1280,e_sharpen:60,q_auto/rsttgpy4jk534dz2b9m8.jpg)](https://www.youtube.com/watch?v=o98XmRVjxWs) - Did you know JavaScript supports a third type of comment (beyond `//` and `/* */`)? [▢️ Mat Marquis shows off hashbang comments](https://www.youtube.com/watch?v=o98XmRVjxWs) in a short YouTube video. And yes, [they're in the language spec!](https://tc39.es/ecma262/multipage/ecmascript-language-lexical-grammar.html#sec-hashbang) - πŸ€– Fred K. Schott, of [Astro](https://astro.build/) fame, has [unveiled Flue 2.0](https://flueframework.com/blog/flue-2/), the latest version of his TypeScript-based open agent framework. - βš–οΈ The _Deno vs Oracle_ JavaScriptβ„’ trademark case rumbles on with [Deno consenting to a _fifth_ extension request](https://ttabvue.uspto.gov/ttabvue/v?pno=92086835&pty=CAN&eno=26) as discovery continues. - πŸ“Ί SQLite's Richard Hipp gave [▢️ a detailed 50-minute talk on SQLite's reliability](https://www.youtube.com/watch?v=V_qzqY1bb7I) and the tools, practices, and design choices that have given it its strong reputation. - πŸ“Š The [results of the _State of CSS 2026_ survey](https://2026.stateofcss.com/en-US/) have been released. **Got a link for us?** Reply and tell us. We can't include everything but we'll look at anything you send. _Thanks!_ --- **Sponsorship:** Email `[kristina@cooperpress.com](mailto:kristina@cooperpress.com)` for details. --- Published by Cooper Press Ltd. Fairfield Enterprise Centre, Louth, LN11 0LS, United Kingdom [Cancel your subscription](https://nodeweekly.com/leave/*|UID|*) or [change your address](https://nodeweekly.com/edit_subscription/*|UID|*).