Issue #638: Node 26.8 reads and writes ZIP files

#638 — August 27, 2026

🗓️ We're back! If you missed us last week, we took a brief summer vacation :-)
__
Your editor, Peter Cooper

Together with

A Recap of Node.js Interactive 2026 — Node.js Interactive returned for the first time since 2019 as part of this month's RenderATL event with Node contributors and invited speakers tackling Node's near-term roadmap in areas like AI, supply chain security, WinterCG becoming Ecma TC55, work on QUIC and HTTP/3 support, and Node's move to one major release a year.

Aviv Keller

Open Source Just Out-Reviewed the Commercial Tools — PR-AF places #2 of 42 on Martian's Code-Review-Bench, ahead of CodeRabbit, Copilot, and Devin, at ~10x lower cost per review. It plans the review per PR, runs reviewer agents in parallel, and verifies every finding against your source. Self-hosted.

AgentField.ai sponsor

Node.js 26.8.0 (Current) Released — Among a variety of additions, Node can read and write ZIP archives without a third-party dependency. Plus Node's REPL now has basic syntax highlighting support. v26.8.1 landed hours later to fix a broken version string.

Antoine du Hamel

💡 Node 24.20.0 (LTS) also landed with several backported features including package maps, permission auditing, node:stream/iter, and WebAssembly JSPI.

IN BRIEF:

🤚 The latest annual Node.js user survey has just launched. As always, your responses help shape the future priorities of the Node.js team.
💡 Aviv Keller has proposed reimplementing fs.glob natively in C++, calling straight into libuv and benching at over twice the speed of the current version. Not landed yet, but there are some big names on this thread.
James Snell is seeking early feedback on a proposed Fetch Server API, part of Node's unified HTTP API initiative, offering one handler model for HTTP/1.1, 2 and 3.
TermDOM, featured in our last issue, lets you build TUI apps with HTML and CSS in Node, and now supports CSS Grid for layout.
AWS Lambda has introduced a new Node.js 26 runtime in preview.

🤖 Node's Official AI Use Policy and Guidelines — Merged into Node's contributing docs after months of debate, PRs with AI code you haven't understood or tested can be closed unreviewed, bot-opened PRs need pre-approval, and more to be aware of. Plus, don't use AI to claim "good first issue" tasks!

Node.js Project

📄 Query Pipelining in node-postgres: 2-3x More Throughput – More throughput and lower latency from one config change is always worth looking into. Matteo Collina

📄 ESM vs CommonJS: What import and require Actually Do Gabor Koos

🛠 Code & Tools

pnpm 12: Rewritten in Rust, Same Commands and Lockfile — The Rust rewrite is stable, but all of v11's commands, flags and lockfile format carry over with only a handful of changes. A global node now follows the version your project pins, too. Note that npm's latest tag still points to pnpm 11, so you'll need pnpm self-update next-12 to upgrade.

Zoltan Kochan

Better Auth 1.7 Ships a Standards-Based OAuth Server — A big OAuth provider release with DPoP, per-API token rules and device code flow, plus MCP auth in its own package. Breaking changes make the upgrade guide required reading.

Gustavo Valverde

Outgrowing Cron? Meet xyOps for Self-Hosted Ops Automation — Schedule jobs, run Node scripts, monitor servers, and automate response. Open source, from the Cronicle team.

xyOps sponsor

GTKX: Build Linux Desktop Apps with Node, GTK and React — Build Linux desktop apps with real GTK4 and Adwaita widgets with no webview involved. Write JSX and get real widgets in an ordinary Node process with npm package and Fast Refresh support.

Eugenio Depalo

Stryker Mutator 10.0: Test Your Tests with Mutation Testing — Stryker deliberately changes your code to see if your test suite catches the mutations. If not, your tests are too lax and need work. Here's how to get started.

Jansen, de Lang, et al.

SVGO 4.1: Node-Powered SVG Optimizer — SVGs often contain redundant information. You can use SVGO as a CLI tool or Node library to slim them down. v4.1 has stricter XML validation and security improvements.

Kir Belevich

Electron 44 – 32-bit builds are gone, macOS 13+ is now required, clipboard is aligned with the W3C Clipboard API, net.WebSocket is added, plus the ability to set window opacity on Linux.
lz4-napi 2.10.0 – N-API bindings for LZ4 compression/decompression, implemented in Rust and backed by lz4_flex.
🤖 grammY 1.46.0 – The framework for building Telegram bots from Node now supports the latest Telegram Bot API 10.3.
Axios 1.20.0 – The long-standing HTTP client for the browser and Node.js.
node-mongodb-native 7.6 – MongoDB 4.2 support has been dropped entirely.
📺 YouTube.js 18.0 – JavaScript client for YouTube's internal API.
node-x11 4.1 – Feature-rich X11 protocol client library.