--- title: "Node is getting a built-in benchmark runner" publication: "Node Weekly" issue: 640 published_at: "2026-09-10" canonical_url: "https://nodeweekly.com/issues/640" --- Plus rendering WebGPU shaders in Node, Rslib 1.0, MikroORM 7.2, and Node's role in VS Code's history. #​640 — September 10, 2026 [Read on the Web](https://nodeweekly.com/issues/640) Together with [![Master.dev\](https://res.cloudinary.com/cpress/image/upload/c_fill,g_auto,w_1280,h_245/co_white,e_outline:17/cgiteem1q7kgf8yoheqo.png)](https://master.dev/courses/kubernetes/?utm_source=email&utm_medium=nodeweekly&utm_content=kubernetescooper) ![Node.js Weekly](https://res.cloudinary.com/cpress/image/upload/v1653576619/lgfqinzbdqttwmhvljxb.png) [![\](https://res.cloudinary.com/cpress/image/upload/w_1280,e_sharpen:60,q_auto/euwt3muj9vbng2e7z9gu.jpg)](https://blog.cloudflare.com/workers-module-registry-nodejs/) [Cloudflare Workers Gets a New, Node.js-Aligned Module Registry](https://blog.cloudflare.com/workers-module-registry-nodejs/) — _Workers_ [enabled Node.js compatibility](https://developers.cloudflare.com/changelog/post/2026-08-04-nodejs-compat-default/) by default last month, meaning you can use most of Node’s built-in APIs in your Workers. Now there’s an opt-in way to load modules that resolves import paths as proper URLs, bringing `import.meta` and Node's `require(esm)` rules with it. Logan Gatlin and James Snell (Cloudflare) [![\](https://res.cloudinary.com/cpress/image/upload/c_limit,w_480,h_480,q_auto/copm/3d7cb94a.png)](https://master.dev/courses/kubernetes/?utm_source=email&utm_medium=nodeweekly&utm_content=kubernetescooper) [Confidently Deploy and Manage Containerized Apps on Kubernetes](https://master.dev/courses/kubernetes/?utm_source=email&utm_medium=nodeweekly&utm_content=kubernetescooper) — Join this detailed video course with Erik Reinert and learn how to deploy and manage production-grade containerized applications on Kubernetes. You'll cover infrastructure, testing, rollbacks, autoscaling and more, all before pushing your cluster to EKS. Master.dev sponsor 📊 [`node:bench`: Node Core Gets a Built-In Benchmark Runner](https://www.jasnell.me/posts/a-node-bench-module) — Node has had a built-in test runner for years but no benchmark runner. James's experimental `node:bench` module has [landed on main](https://github.com/nodejs/node/pull/65606), so expect to see it soon. It's modelled on `node:test`, with a `node --bench` CLI and JSON reporter. James M Snell **IN BRIEF:** - [Node.js v26.8.2 (Current)](https://nodejs.org/en/blog/release/v26.8.2) and [v24.21.0 (LTS)](https://nodejs.org/en/blog/release/v24.21.0) are out, both including a security release of Undici that fixes [several vulnerabilities](https://github.com/nodejs/undici/releases/tag/v8.10.2), plus OpenSSL 3.5.8 and numerous tweaks and fixes. - 🔒 Researchers at GitLab found [a CVSS 10.0 sandbox escape in `vm2`](https://about.gitlab.com/blog/critical-remote-code-execution-in-vm2/), the widely used Node sandboxing library. The reported escape was patched in 3.11.7+, but the writeup argues `vm2` shouldn't be used for genuinely untrusted code (though `vm2`'s own docs [are also honest about this](https://github.com/patriksimek/vm2#the-fundamental-challenge)). - Zod creator Colin McDonnell has landed [a change that speeds up Node's startup](https://github.com/nodejs/node/pull/65796) (by a millisecond or so, granted) by seeding V8's non-cryptographic entropy from the OS rather than OpenSSL. - This year's TSC elections went uncontested: [Matteo Collina staying Chair and Rafael Gonzaga becoming Vice-Chair](https://github.com/nodejs/TSC/issues/1883). [Fuzzing the State Machines Inside My HTTP Client](https://blog.gaborkoos.com/posts/2026-09-05-Fuzzing-the-State-Machines-Inside-My-HTTP-Client/) — A practical case for property-based testing, made by adding [fast-check](https://github.com/dubzzz/fast-check) properties to [ffetch](https://github.com/fetch-kit/ffetch)’s 206 passing tests. Thousands of generated cases found 11 real bugs in code considered fully tested. Gabor Koos [Add MCP Server Monitoring to Your Node.js Project](https://sentry.io/cookbook/monitor-mcp-server/?utm_source=nodeweekly&utm_medium=paid-community&utm_campaign=mcp-fy27q3-cookbook&utm_content=newsletter-sponsored-link-sentry-mcp-trysentry) — A single function call. See who is connecting, which tools drag, and the failures MCP never throws. Sentry sponsor 📄 [Is Prisma 8 Ready for Long-Lived Production Apps?](https://www.prisma.io/blog/is-prisma-8-ready-for-long-lived-production-apps) – A response to community worries about Prisma 8's new migration model. Will Madden (Prisma) 📄 [Containerizing and Slimming Node Apps with Paketo Buildpacks](https://blog.paketo.io/posts/containerizing-nodejs-apps) Costas Papastathis (Paketo) 📄 [What `await fetch()` Actually Waits For](https://blog.gaborkoos.com/posts/2026-09-08-Half-Past-Fetch/) Gabor Koos 🛠 Code & Tools [![\](https://res.cloudinary.com/cpress/image/upload/w_1280,e_sharpen:60,q_auto/pbtktrh32hrdvb3kwjjd.jpg)](https://rslib.rs/blog/v1-0) [Rslib 1.0: A Build Tool for JavaScript Libraries and CLIs](https://rslib.rs/blog/v1-0) — Rspack's answer to `tsup`/`tsdown` goes 1.0 with a stable config and JS API. It can [infer syntax targets](https://rslib.rs/guide/upgrade/v0-to-v1#default-syntax-target-update) from `engines.node`, [generates declarations faster](https://rslib.rs/blog/v1-0#declaration-generation) with TypeScript 7, and (experimentally) [build Node SEA executables](https://rslib.rs/config/lib/experiments#experimentsexe). Chenwei Dai, Elecmonkey, et al. [vgpu: Render WebGPU Shaders in the Browser or Node.js](https://vgpu.sh/) — Provides a way to use the same shader in the browser or render headlessly with Node (to a high-resolution PNG or MP4 video). WGSL modules import and export like TypeScript does. Vercel [MikroORM 7.2: Row Level Security, a WASM SQLite Driver, and More](https://mikro-orm.io/blog/mikro-orm-7-2-released) — A TypeScript ORM for SQL databases and MongoDB. 7.2 adds native Postgres row level security, with policies as entity metadata, plus `through` relations and a WASM sql.js driver (yes, [you can now use MikroORM in the browser!](https://mikro-orm.io/docs/guide/first-entity#-checkpoint-1)) Martin Adámek [Javet 6.0: A Way to Embed Node.js and V8 in Java](https://www.caoccao.com/Javet/) — A Java library that embeds a real Node.js runtime (now v26) in the JVM. Java code can load npm packages, call into running Node code, and run multiple Node instances side by side. [GitHub repo](https://github.com/caoccao/Javet). Sam Cao [eslint-plugin-regexp 3.3: ESLint Plugin for Finding Regex Mistakes](https://github.com/ota-meshi/eslint-plugin-regexp) — There’s a [neat online demo](https://ota-meshi.github.io/eslint-plugin-regexp/playground/) to show off the things it can catch. Yosuke Ota - [parse-xml 5.0](https://rgrove.github.io/parse-xml/) – The fast, compliant XML parser [goes ESM-only](https://github.com/rgrove/parse-xml/releases/tag/v5.0.0). The API is unchanged and `require()` still works on Node 22+. - [dhcp.js 1.0](https://github.com/rawify/dhcp.js) – DHCPv4 client, server, and tools for Node. We covered the [explainer blog post](https://raw.org/software/libraries/dhcp-js/) about this project nine years ago! - [pnpm 12.4](https://github.com/pnpm/pnpm/releases/tag/v12.4.0) – The fast drop-in `npm` replacement can now manage npm, Python, and Cargo dependencies in the same workspace. - ✉️ [Nodemailer 10.0](https://github.com/nodemailer/nodemailer/releases/tag/v10.0.0) – The popular e-mail sending library has migrated to TypeScript with ESM and CJS builds. - ⚠️ [Fastify 5.12.2](https://github.com/fastify/fastify/releases/tag/v5.12.2) – Includes fixes for four high-severity issues, including validation and auth bypasses. - [tinybench 6.2](https://github.com/tinylibs/tinybench) – Simple, tiny and lightweight benchmarking library with precise timing. - 🌐 [supercluster 9.1](https://github.com/mapbox/supercluster) – Mapbox's fast geospatial point clustering library. 📰 Classifieds 🎯 Catch promo abuse at signup. [Fingerprint’s visitor ID](https://fingerprint.com/igaming/?utm_source=NodeWeekly09102026) persists for months, not days, so abusers can’t hide. [Try it for free](https://fingerprint.com/igaming/?utm_source=NodeWeekly09102026). --- Your API is fast until it hits analytics. [TimescaleDB](https://www.tigerdata.com/go/trial?utm_source=content-syndication&utm_medium=referral&utm_campaign=node-weekly-newsletter) extends Postgres so those queries return in ms at scale. [Get $1000 credit](https://www.tigerdata.com/go/trial?utm_source=content-syndication&utm_medium=referral&utm_campaign=node-weekly-newsletter). 📢 Elsewhere in the ecosystem - [React 19.3 is out](https://react.dev/blog/2026/09/09/react-19-3) with stable view transitions and fragment refs, [Trusted Types](https://developer.mozilla.org/en-US/docs/Web/API/Trusted_Types_API) support, and a `browser()` API used via `use(browser())` to let components skip server-side rendering when they need browser-only APIs. - 📺 Microsoft released [a movie-length documentary about VS Code](https://www.youtube.com/watch?v=kHL3XzjpT5w), directed by Stefan Kingham. It covers the editor's technical roots, touching on Node's arrival on Windows and its evolution through node-webkit (now [NW.js](https://nwjs.io/)) and Electron. - The team behind Tailwind CSS [is joining Shopify](https://tailwindcss.com/blog/tailwind-is-joining-shopify), though they say _"nothing changes with Tailwind CSS or any of our other open-source projects."_ - 🔒 Two men have been [arrested over the TeamPCP npm supply chain attacks](https://www.aikido.dev/blog/teampcp-arrested-supply-chain). TeamPCP is suspected of cloning the Shai-Hulud worm, resulting in the so-called ['Mini Shai-Hulud'](https://www.stepsecurity.io/blog/a-mini-shai-hulud-has-appeared) waves. - 📺 [How can someone actually _change_ JavaScript?](https://www.youtube.com/watch?v=OkuNJo9tTtg) A two-minute explainer of the basics from TC39 delegate Mikhail Barash. **Got a link for us?** Reply and tell us. We can't include everything but we'll look at anything you send. _Thanks!_ --- **Sponsorship:** Email `[kristina@cooperpress.com](mailto:kristina@cooperpress.com)` for details. --- Published by Cooper Press Ltd. Fairfield Enterprise Centre, Louth, LN11 0LS, United Kingdom [Cancel your subscription](https://nodeweekly.com/leave/*|UID|*) or [change your address](https://nodeweekly.com/edit_subscription/*|UID|*).