--- title: "Node 26.9 turns on FFI by default" publication: "Node Weekly" issue: 641 published_at: "2026-09-17" canonical_url: "https://nodeweekly.com/issues/641" --- Plus util.debounce() is coming to core, GitHub's port of Copilot's runtime from Node to Rust, and an AI-assisted speed boost for jsdom. #​641 — September 17, 2026 [Read on the Web](https://nodeweekly.com/issues/641) Together with [![Tiger Data\](https://res.cloudinary.com/cpress/image/upload/c_fill,g_auto,w_1280,h_282/e_make_transparent/co_white,e_outline:30/px1u7kjyvz7xnbm6ytir.png)](https://www.tigerdata.com/go/trial?utm_source=content-syndication&utm_medium=referral&utm_campaign=node-weekly-newsletter) ![Node.js Weekly](https://res.cloudinary.com/cpress/image/upload/v1653576619/lgfqinzbdqttwmhvljxb.png) [![\](https://res.cloudinary.com/cpress/image/upload/w_1280,e_sharpen:60,q_auto/p1qsibnkmb1pqggvhpdk.jpg)](https://github.blog/ai-and-ml/generative-ai/migrating-the-github-copilot-runtime-to-rust-using-copilot/) [Why (and How) GitHub Ported Copilot's Runtime from Node to Rust](https://github.blog/ai-and-ml/generative-ai/migrating-the-github-copilot-runtime-to-rust-using-copilot/) — GitHub's _Copilot_ runtime moved to Rust, ported in pieces behind [napi-rs](https://napi.rs/) shims while shipping daily. Startup times and memory usage inspired the move, but the gold for porters is in the regressions they hit involving number types, `||` semantics, and blocking the event loop. Stephen Toub (Microsoft) [![\](https://res.cloudinary.com/cpress/image/upload/c_limit,w_480,h_480,q_auto/copm/fe329987.png)](https://www.tigerdata.com/go/trial?utm_source=content-syndication&utm_medium=referral&utm_campaign=node-weekly-newsletter) [That p99 Spike Is One Slow Analytics Query](https://www.tigerdata.com/go/trial?utm_source=content-syndication&utm_medium=referral&utm_campaign=node-weekly-newsletter) — One endpoint runs an analytics query over millions of rows, and latency spikes for everyone. TimescaleDB extends Postgres so that query returns in milliseconds at scale. Hypertables, compression, continuous aggregates. [Get $1000 credit to start](https://www.tigerdata.com/go/trial?utm_source=content-syndication&utm_medium=referral&utm_campaign=node-weekly-newsletter). Tiger Data (creators of TimescaleDB) sponsor **IN BRIEF:** - Node is to get [`util.debounce()` and `util.throttle()` functions](https://github.com/nodejs/node/pull/65899), two staples of utility libraries. They've landed on main for a future release. - 🔒 [Moment.js 2.31.0](https://github.com/moment/moment/releases/tag/2.31.0) is a key update. The date library is in 'maintenance mode', but gets 25M downloads a week, and v2.31.0 [fixes a path traversal vulnerability](https://github.com/moment/moment/security/advisories/GHSA-4p3w-j4w9-5jqw). - The Node.js Web Team's [redesigned API docs](https://beta.docs.nodejs.org/) have [been merged](https://github.com/nodejs/node/pull/62045#issuecomment-5689768930) and should reach `nodejs.org/api` alongside a release soon. - In Node 27, the HTTP client will [reject responses with more headers than `request.maxHeadersCount`](https://github.com/nodejs/node/pull/65010) (1000 by default right now) instead of just truncating them. [Node.js 26.9.0 (Current) Released](https://nodejs.org/en/blog/release/v26.9.0) — A reasonably significant minor release that brings a few new things to the table: - [`node:ffi`](https://nodejs.org/api/ffi.html#ffi) is enabled by default (but still _experimental_), so you can call functions in native libraries without writing an addon. - [`node:bench`](https://www.jasnell.me/posts/a-node-bench-module) is a new benchmarking module modeled on `node:test`. - [Web Workers now have an experimental implementation](https://nodejs.org/api/globals.html#class-worker) (behind a flag), so browser-style `new Worker()` and `postMessage`, etc. can be used. - [Worker threads start up to twice as fast](https://github.com/nodejs/node/pull/65336) (per initial benchmarks) and use less memory, as they now start from Node's [built-in snapshot](https://joyeecheung.github.io/blog/2024/09/28/reproducible-nodejs-builtin-snapshots-1/). Antoine du Hamel (Node.js Team) [Stay Sharp in the Age of AI](https://master.dev/sale/?utm_source=nodeweekly&utm_medium=newsletter&utm_campaign=buildersale) — Master.dev instructors build at Anthropic, OpenAI, Netflix, Google, and Stripe. Learn from them via courses, workshops, and AI learning paths. [New members get $100 off a yearly membership](https://master.dev/sale/?utm_source=nodeweekly&utm_medium=newsletter&utm_campaign=buildersale). Master.dev sponsor 📄 [Connection Reuse is the Money](https://thelazyweb.dev/connection-reuse-is-the-money) – How a webhook sender cut its repeat TLS handshakes with one Undici [Agent](https://undici.nodejs.org/api/Agent) per destination. Mike Murray 📄 [Email, Decoupled from Where and How](https://hackers.pub/@hongminhee/2026/upyo-email-decoupled-from-where-and-how) – The design behind [Upyo](https://upyo.org/), a web-standards-based email library for Node, Deno, Bun and edge runtimes that works with many providers. Hong Minhee 📄 [A Deep Dive into JavaScript Engines: Writing Code That Makes V8 Happy](https://www.audreydoyen.com/blog/en/js-engines-and-v8-en) Audrey Doyen 📄 [Five Software Engineering Roles for Working with AI](https://humanwhocodes.com/blog/2026/09/five-roles-working-ai/) Nicholas C. Zakas 📄 [How to Implement a Distributed Circuit Breaker](https://blog.gaborkoos.com/posts/2026-09-14-How-to-Implement-a-Distributed-Circuit-Breaker/) Gabor Koos 🛠 Code & Tools [![\](https://res.cloudinary.com/cpress/image/upload/w_1280,e_sharpen:60,q_auto/wyik6kkj35wmos4bkr2r.jpg)](https://www.eraser.io/blog/open-sourcing-eraser-diagrams) [Eraser Diagrams: Diagrams as Code, Minus the Layout Engine](https://www.eraser.io/blog/open-sourcing-eraser-diagrams) — A Node API/CLI for rendering JSON diagrams to PNG or HTML. Unlike Mermaid or D2, there's no auto-layout engine, so you (or your LLM!) get to control just where things go, while connection routing, icons and styling are handled for you. Eraser [`@platformatic/memcached`: A Faster memcached Client](https://blog.platformatic.dev/introducing-platformatic-memcached) — A zero-dependency [memcached](https://memcached.org/) client built on the modern meta protocol, pipelining over a single connection. Claims to be "roughly 3x" the speed of alternatives. Matteo Collina (Platformatic) [jsdom 30.1: The Release That's 'Feeling the AGI'](https://github.com/jsdom/jsdom/releases/tag/v30.1.0) — The pure-JS DOM implementation gets faster DOM construction, mutations, `getComputedStyle()` and event dispatch, plus lower memory use. Much of it came from Scott's Codex-assisted PRs, which Domenic praises for being carefully curated. Domenic Denicola and Scott Cooper - [XO 5.0](https://github.com/xojs/xo/releases/tag/v5.0.0) – The zero-config ESLint wrapper now lints `package.json` files and enforces import file extensions in TypeScript. - [officeParser 8.0](https://github.com/harshankur/officeParser) – Parse Office files (`docx`, `pptx`, `xlsx`, etc.) and PDFs into an AST. Now with a rewritten PDF extractor. - [oclif 6.0](https://github.com/oclif/oclif) – Salesforce's framework for building Node CLIs drops support for installing legacy plugins. - [pg-boss 12.33](https://github.com/timgit/pg-boss/releases/tag/12.33.0) – The Postgres-backed job queue adds a `TestClock` so tests needn't wait on timers. - [Aedes 1.2](https://github.com/moscajs/aedes) – Barebone MQTT broker that runs on any stream server. - 🔒 [Express 4.22.3](https://github.com/expressjs/express/releases/tag/v4.22.3) – A security release for those on Express 4. 📰 Classifieds ⚡ [Zuplo](https://zuplo.link/vuib4cV) puts every API, AI, and MCP request behind one gateway. Route traffic, guard your MCP servers, and cap your AI costs. [Try it free](https://zuplo.link/vuib4cV). --- 🛡️ Not all bots deserve blocking. [Fingerprint Bot Detection](https://fingerprint.com/try/bot-detection/?utm_source=NodeWeekly09172026) stops content scrapers while letting legit AI agents through. [Try for free](https://fingerprint.com/try/bot-detection/?utm_source=NodeWeekly09172026). --- 🎟️ Join us at [Supabase Select](https://supabase.link/ai2Y3Ck) on October 2. Bring your hardest questions to the engineers building Supabase at the Ask Supabase booth. [Apply to attend with 25% off: SUPAWEEKLY](https://supabase.link/ai2Y3Ck). 📢 Elsewhere in the ecosystem [![\](https://res.cloudinary.com/cpress/image/upload/w_1280,e_sharpen:60,q_auto/ztdu0xshlulicymdyo7u.jpg)](https://www.npmchart.com/) - [npmchart.com](https://www.npmchart.com/) _(above)_ is a new option for tracking download trends and repo activity of npm packages. [Here's the chart for `express`](https://www.npmchart.com/p/express), for example. - [A review of sixteen weeks of package manager releases](https://nesbitt.io/2026/09/10/package-manager-trends.html) across ecosystems finds similar new defences rolling out, like cooldowns, blocking install scripts (as in [npm 12](https://github.com/npm/cli/releases/tag/v12.0.0)), and publish-time scans, which [npm has done since July](https://github.blog/changelog/2026-07-28-npm-publish-time-malware-scanning-and-dual-use-metadata/). - Those npm 12 defaults won't reach current Node lines, though. Last month, the Release WG [decided npm 12 is _"far too disruptive"_](https://github.com/nodejs/Release/issues/1161) for Node 22, 24 or 26, so it'll arrive in Node 27. - GitHub Actions has [a new `cache-mode` setting](https://socket.dev/blog/github-actions-cache-mode) to limit cache access per workflow or job, a defence against the kind of cache poisoning that [compromised TanStack's npm packages in May](https://tanstack.com/blog/npm-supply-chain-compromise-postmortem). **Got a link for us?** Reply and tell us. We can't include everything but we'll look at anything you send. _Thanks!_ --- **Sponsorship:** Email `[kristina@cooperpress.com](mailto:kristina@cooperpress.com)` for details. --- Published by Cooper Press Ltd. Fairfield Enterprise Centre, Louth, LN11 0LS, United Kingdom [Cancel your subscription](https://nodeweekly.com/leave/*|UID|*) or [change your address](https://nodeweekly.com/edit_subscription/*|UID|*).