--- title: "12 Node built-ins that replace npm packages" publication: "Node Weekly" issue: 642 published_at: "2026-09-24" canonical_url: "https://nodeweekly.com/issues/642" --- Plus a safer eval(), Node 26.10, and Intel Macs losing official builds in Node 27. #​642 — September 24, 2026 [Read on the Web](https://nodeweekly.com/issues/642) ⚠️ We're taking a week off next week, so we'll be back on Thursday, October 8. __ _Your editor, Peter Cooper_ Together with [![agentfield.ai\](https://res.cloudinary.com/cpress/image/upload/c_fill,g_auto,e_trim,w_1280,h_314/e_make_transparent/co_white,e_outline:10/dy2daidfoserzvblukbv.jpg)](https://agentfield.ai/github/codeaf/?utm_source=node&utm_medium=newsletter&utm_campaign=node-260924&utm_id=node-260924-codeaf&utm_content=codeaf) ![Node.js Weekly](https://res.cloudinary.com/cpress/image/upload/v1653576619/lgfqinzbdqttwmhvljxb.png) [![\](https://res.cloudinary.com/cpress/image/upload/w_1280,e_sharpen:60,q_auto/rjkg96w3qff4rlobgivq.jpg)](https://flaviocopes.com/node-builtins/) [Node.js Built-ins That Replaced npm Packages](https://flaviocopes.com/node-builtins/) — A practical tour of 12 Node built-ins that replace packages like `axios`, `dotenv`, `nodemon` and `chalk`. Each is explained with its stability level in Node 24 LTS and gotchas that might make you want to stick with your existing dependency anyway. Flavio Copes [![\](https://res.cloudinary.com/cpress/image/upload/c_limit,w_480,h_480,q_auto/copm/9a068ba0.jpg)](https://agentfield.ai/github/codeaf/?utm_source=node&utm_medium=newsletter&utm_campaign=node-260924&utm_id=node-260924-codeaf&utm_content=codeaf) [CodeAF: The Open-Source Software Factory for Open Models](https://agentfield.ai/github/codeaf/?utm_source=node&utm_medium=newsletter&utm_campaign=node-260924&utm_id=node-260924-codeaf&utm_content=codeaf) — Instead of juggling a terminal for every agent, you get one window for every project. Hand work off: it splits it into parts, runs them in parallel, tests what comes back and merges what passes. Many models, one session: the right one for each call. AgentField.ai sponsor [Node.js 26.10.0 (Current) Released](https://nodejs.org/en/blog/release/v26.10.0) — Built-in, promise-based [`util.debounce()` and `util.throttle()`](https://github.com/nodejs/node/pull/65899) arrive, complete with `AbortSignal` support. There’s also `[util.markPromiseAsHandled()](https://github.com/nodejs/node/pull/65805)` to help retire `.catch(() => {})` hacks. Plus a little more besides. Antoine du Hamel 💡 [Node v22.23.3 (LTS)](https://nodejs.org/en/blog/release/v22.23.3) also landed with updated root certificates and dependencies (OpenSSL, npm, and Undici) plus minor fixes. **IN BRIEF:** - From Node.js 27, [Intel Macs drop to only having 'experimental' support](https://github.com/nodejs/node/pull/65427), meaning no official x64 macOS builds and an arm64-only installer. - James Snell has proposed [a `--process-timeout` flag](https://github.com/nodejs/node/pull/66138) that kills a stuck process, even one in a tight loop, and reports what kept it alive. - GitHub Actions has [removed Node 20 from its runners](https://github.blog/changelog/2026-09-23-node-20-is-no-longer-available-in-github-actions) so if you maintain an action, switch `runs.using` to `node24` and publish a new release. - Yagiz Nizipli has opened [a PR that shrinks the `node` binary by about a third](https://github.com/nodejs/node/pull/66186) (147MB to 95MB on macOS arm64) using extra compression and stripping symbols. Notably, 𝕏 [Grok was used](https://x.com/yagiznizipli/status/2102476047786844494) to do this work. - Daniel Lemire explains how AI-assisted experimentation [made several libraries that ship in Node faster](https://lemire.me/blog/2026/09/22/a-summer-of-ai-optimization/), including Ada, simdjson and simdutf. [npm Tokens Can Now Stage Releases Without Publishing Them](https://github.blog/changelog/2026-09-18-stage-only-npm-tokens-for-safer-automation/) — A new token permission lets CI stage npm releases but not publish them, with a maintainer approving each staged version with 2FA. It offers a migration path ahead of npm's planned ending of direct publishing using bypass-2FA tokens in January 2027 if you can’t use [trusted publishing](https://docs.npmjs.com/trusted-publishers) yet. GitHub / npm team 📄 [How I Traced a Node.js Streams Bug in `Duplex.from()`](https://amanchadha.substack.com/p/how-i-traced-a-nodejs-streams-bug) – A first-time core contributor's path from issue to PR. Aman Chadha 📄 [Publishing a Subfolder to npm for Cleaner Package Paths](https://www.bram.us/2026/09/20/npm-publish-subfolder/) – How to keep `dist/` (or `src/`) out of your package's import paths. Bramus 📄 [Faster SSE Responses with Async Generators and `Promise.race()`](https://thecodebarbarian.com/sse-yield-star.html) Valeri Karpov 🛠 Code & Tools [![\](https://res.cloudinary.com/cpress/image/upload/w_1280,e_sharpen:60,q_auto/ooj579buk2rduxf6awis.jpg)](https://blog.platformatic.dev/introducing-secure-eval-worker) [secure-eval-worker: A Safer `eval()` via Node's Permission Model](https://blog.platformatic.dev/introducing-secure-eval-worker) — A new way to run untrusted (or AI-generated) JavaScript in a locked-down worker with timeouts, memory caps, and access only to the host functions you choose. Node 26 only, and not a true sandbox. Matteo Collina and Luca Maraschi 🔒 [CVE Lite CLI: Scan Your Lockfile, Get the Upgrades to Run](https://owasp.github.io/cve-lite-cli/) — An OWASP-backed scanner that reads your lockfile, checks it against OSV and npm’s advisories, and gives you npm/pnpm/Yarn/Bun commands to use, including which parent package(s) to bump for transitive issues. Sonu Kapoor and OWASP [Your Nightly Rollup Job Is a Query That Got Too Big](https://www.tigerdata.com/go/trial?utm_source=content-syndication&utm_medium=referral&utm_campaign=node-weekly-newsletter) — TimescaleDB extends Postgres with continuous aggregates to keep rollups fresh. No batch job. [Get $1000 credit to start](https://www.tigerdata.com/go/trial?utm_source=content-syndication&utm_medium=referral&utm_campaign=node-weekly-newsletter). Tiger Data (creators of TimescaleDB) sponsor 🤖 [Transformers.js v4.3: Run AI Models from JavaScript](https://github.com/huggingface/transformers.js/releases/tag/4.3.0) — Adds support for structured output (e.g. JSON), using WebGPU on Safari 26+, and DeepSeek v4. [The docs](https://huggingface.co/docs/transformers.js/index) have had an overhaul and there’s now an [agent skill](https://github.com/huggingface/transformers.js/blob/main/.ai/skills/transformers-js/SKILL.md) you can use. Hugging Face [vitest-gpu and jest-gpu: Test WebGL and WebGPU Code Without a Browser](https://ben3d.ca/blog/native-gpu-testing-for-vitest-and-jest) — Vitest and Jest environments that give tests WebGL and WebGPU contexts in Node, so you can compile shaders, run compute passes, or diff frames against baselines _sans_ browser. Ben Houston [![\](https://res.cloudinary.com/cpress/image/upload/w_1280,e_sharpen:60,q_auto/lsy7rbj3vk6l9lzqxhgd.jpg)](https://github.com/DoneDeal0/superdiff/releases/tag/v4.3.0) - [Superdiff 4.3](https://github.com/DoneDeal0/superdiff) – A library that produces diffs of objects, arrays and text. [v4.3 can now diff code](https://github.com/DoneDeal0/superdiff/releases/tag/v4.3.0) by line and token too_(above)_. - [dotenv 18.0](https://github.com/motdotla/dotenv) – The popular `.env` file loader. [v18 adds a CLI](https://github.com/motdotla/dotenv/blob/master/CHANGELOG.md#1800-2026-09-17) and a faster opt-in parser, but drops `-r dotenv/config` preloading in favor of`dotenv run --`. - [Tinypool 2.2](https://github.com/tinylibs/tinypool) – Minimal worker thread pool and Piscina fork. Now [accepts a `URL` instance](https://github.com/tinylibs/tinypool/pull/141) as the filename. - [NestJS 12.1](https://github.com/nestjs/nest/releases/tag/v12.1.0) – Now with [built-in cookie support](https://github.com/nestjs/nest/pull/17834), [CSRF](https://github.com/nestjs/nest/pull/17836) protection, and security headers. - [mongodb-memory-server 11.3](https://github.com/typegoose/mongodb-memory-server) – Spin up real MongoDB servers for tests. - [SuperTest 7.3](https://github.com/forwardemail/supertest) – Library for testing Node HTTP servers using a fluent API. - [SQL Formatter 15.9](https://github.com/sql-formatter-org/sql-formatter) – Library for pretty-printing SQL queries. 📰 Classifieds 🚫 Ban the device, not just the account. [Fingerprint's visitor ID](https://fingerprint.com/use-cases/new-account-fraud-prevention/?utm_source=NodeWeekly09242026) catches ban evaders — even incognito or behind a proxy. --- 🎟️ Join us at [Supabase Select](https://supabase.link/ai2Y3Ck) on October 2. Get first-hand information about what's coming soon in Supabase. [Apply to attend with 25% off: SUPAWEEKLY](https://supabase.link/ai2Y3Ck). 📢 Elsewhere in the ecosystem - [pnpm 12.6](https://pnpm.io/blog/releases/12.6) can now dedupe dependency versions across a workspace as it installs, keeps `node_modules` working after a project is moved (macOS and Linux only), and adds `--save-types` for `@types/*`packages. - Coding agents quadrupled Linear's test suite, so [its team reworked their CI](https://linear.app/now/ci-bottleneck-reworked) to get costs down: rewriting type-aware ESLint rules as plain AST checks cut lint time 55%, and selectively disabling Vitest's isolation saved a further 17% a month. - Cloudflare's Sunil Pai wrote about [the senior engineer 'death spiral'](https://sunilpai.dev/posts/the-senior-engineer-death-spiral/), where you go quiet for weeks to prove yourself in a new role and end up burning out. - 🧪 [A 'periodic table' of all 115 standard HTML elements!](https://blog.alena.rocks/en/artifacts/html-elements/) **Got a link for us?** Reply and tell us. We can't include everything but we'll look at anything you send. _Thanks!_ --- **Sponsorship:** Email `[kristina@cooperpress.com](mailto:kristina@cooperpress.com)` for details. --- Published by Cooper Press Ltd. Fairfield Enterprise Centre, Louth, LN11 0LS, United Kingdom [Cancel your subscription](https://nodeweekly.com/leave/*|UID|*) or [change your address](https://nodeweekly.com/edit_subscription/*|UID|*).