Node.js Built-ins That Replaced npm Packages — A practical tour of 12 Node built-ins that replace packages like axios, dotenv, nodemon and chalk. Each is explained with its stability level in Node 24 LTS and gotchas that might make you want to stick with your existing dependency anyway.

Flavio Copes

CodeAF: The Open-Source Software Factory for Open Models — Instead of juggling a terminal for every agent, you get one window for every project. Hand work off: it splits it into parts, runs them in parallel, tests what comes back and merges what passes. Many models, one session: the right one for each call.

AgentField.ai sponsor

Node.js 26.10.0 (Current) Released — Built-in, promise-based util.debounce() and util.throttle() arrive, complete with AbortSignal support. There’s also util.markPromiseAsHandled() to help retire .catch(() => {}) hacks. Plus a little more besides.

Antoine du Hamel

npm Tokens Can Now Stage Releases Without Publishing Them — A new token permission lets CI stage npm releases but not publish them, with a maintainer approving each staged version with 2FA. It offers a migration path ahead of npm's planned ending of direct publishing using bypass-2FA tokens in January 2027 if you can’t use trusted publishing yet.

GitHub / npm team

secure-eval-worker: A Safer eval() via Node's Permission Model — A new way to run untrusted (or AI-generated) JavaScript in a locked-down worker with timeouts, memory caps, and access only to the host functions you choose. Node 26 only, and not a true sandbox.

Matteo Collina and Luca Maraschi

🔒 CVE Lite CLI: Scan Your Lockfile, Get the Upgrades to Run — An OWASP-backed scanner that reads your lockfile, checks it against OSV and npm’s advisories, and gives you npm/pnpm/Yarn/Bun commands to use, including which parent package(s) to bump for transitive issues.

Sonu Kapoor and OWASP

Your Nightly Rollup Job Is a Query That Got Too Big — TimescaleDB extends Postgres with continuous aggregates to keep rollups fresh. No batch job. Get $1000 credit to start.

Tiger Data (creators of TimescaleDB) sponsor

🤖 Transformers.js v4.3: Run AI Models from JavaScript — Adds support for structured output (e.g. JSON), using WebGPU on Safari 26+, and DeepSeek v4. The docs have had an overhaul and there’s now an agent skill you can use.

Hugging Face

vitest-gpu and jest-gpu: Test WebGL and WebGPU Code Without a Browser — Vitest and Jest environments that give tests WebGL and WebGPU contexts in Node, so you can compile shaders, run compute passes, or diff frames against baselines sans browser.

Ben Houston