Node Weekly
Plus node:ffi's progress, srvx 1.0, porting a Node service to Go with AI, and diffing your tarballs before publishing a package.

#​639 — September 3, 2026

Read on the Web

Together with  Tiger Data logo
Node.js Weekly

NestJS 12 Released with ESM-First Packages, Rspack and Vitest — The progressive framework gets its biggest release in years, going ESM-first (CJS is still an option), replacing webpack with Rspack, adding Standard Schema support for easy interop with Zod, Valibot and friends, plus structured logging, a brand new homepage, and more.

Kamil Mysliwiec

One Slow Query Starves Your Whole Connection Pool — A heavy analytics query holds a connection while everything else waits. TimescaleDB extends Postgres so those queries return fast, freeing the pool. Hypertables, compression, continuous aggregates. One database, not two. Get $1000 credit to start.

Tiger Data (creators of TimescaleDB) sponsor

📊 Bun 1.4 Now Passes 80% of Node's Test SuiteBun 1.4's headline feature is a big jump in Node.js compatibility as part of its goal of being a "drop-in replacement". This page lets you see the project's progress and where Bun is strong and weak.

Bun Project

IN BRIEF:

Rewriting a Node.js Service in Go with AI Agents — A very 2026 tale of an overnight porting run, with a focus on doing agentic engineering well. Good takeaways on building a test harness first and the rollout experience.

Edvinas Janusevicius (Checkly)

Your Trace Shows the Slow Span. Not the Exception — OTLP carries traces and logs, not errors. Sentry's OtlpIntegration connects both in one trace waterfall. Learn more about Sentry’s OTLP.

Sentry sponsor

📄 Detecting SQLite Full Table Scans in Node.js – Did you know SQLite counts the rows scanned by statements and you can read it after the query runs? CodeSilva

📄 Workers vs Processes in Node Ishtmeet Singh

🛠 Code & Tools

Drydock: Diff Your npm Tarballs Before You Publish — From a Preact core team member comes a tool to diff built npm tarballs against the last published version, flagging install scripts, network access and new binaries. It can then gate your Actions publish job or watch npm's new staged publishing flow.

Jovi De Croock

💡 You can get a quick taste without installing anything: this web-based diff viewer can compare two versions of an npm package file by file.

srvx 1.0: One fetch Handler for Node, Deno and Bun — You can export a handler that takes a web-standard Request and returns a Response, then run it unchanged on Node, Deno or Bun. Includes a CLI with watcher and static serving, and srvx fetch can hit your handler without starting a server.

Pooya Parsa

NVM for Windows 2.0: Node Version Manager for Windows — A modern Node workflow for Windows users with version pinning, native integrations, auto-install of missing versions, and more. v2 is a rewrite that introduces a lighter shim-based mechanism and no longer needs admin privileges. GitHub repo.

Author Software Inc

Got 16.0: Built-In HTTP/2 and QUERY Method Support — The popular Node HTTP client now has a built-in HTTP/2 client, its own DNS cache, fewer dependencies, and support for the newly standardized QUERY HTTP method.

Sindre Sorhus

SimpleWebAuthn 14.0: Now with Post-Quantum Passkeys — The passkeys library now verifies post-quantum ML-DSA passkeys and, on Node 24.7 and up, prefers ML-DSA-44 at registration by default.

Matthew Miller

  • Restify 12.0 – The REST API framework returns after a two and a half year gap with Node 26 support and url.parse() replaced with WHATWG URL. Existing users have a few breaking changes to note.

  • Zod 4.5 – A big performance release for the popular TypeScript-first schema validation library.

  • np 12.1 – Sindre Sorhus's improved npm publish workflow gets some speedups.

  • express-rate-limit 8.7 – Rate-limiting middleware for Express.

📰 Classifieds

Zuplo puts every API, AI, and MCP request behind one gateway. Route traffic, guard your MCP servers, and cap your AI costs. Try it free.


📉 Headout cut chargebacks 90% with Fingerprint. Stop payment fraud with 100+ signals such as Browser Bot and VPN detection.


🎟️ Join us at Supabase Select on Oct 2. Learn from the industry’s best builders and meet people building dev tools. Apply to attend with 25% off: SUPAWEEKLY.

📢  Elsewhere in the ecosystem

  • htmx 4.0 has landed, the first major release in two years, with lots of changes. It remains a neat way to add interactivity to server-rendered pages without reaching for a frontend framework.

  • 🤔 Upon finding eight versions of glob across five major version lines in his employer's monorepo, James Healy is imploring library maintainers to bump their major versions as rarely as they can.

  • A developer shares the techniques behind squeezing an implementation of Minesweeper into just 247 bytes of JavaScript.

  • 🤚 The 2026 Node.js user survey is still open. Your responses guide the core team and its priorities.

Issue 638 #639