--- title: "Node 27's first alpha brings breaking changes" publication: "Node Weekly" issue: 646 published_at: "2026-11-05" canonical_url: "https://nodeweekly.com/issues/646" --- Plus Postgres.js 4.0, numerous security updates, and what V8 15.6 brings to the Node party. #​646 — November 5, 2026 [Read on the Web](https://nodeweekly.com/issues/646) Together with [![agentfield.ai\](https://res.cloudinary.com/cpress/image/upload/c_fill,g_auto,e_trim,w_1280,h_314/e_make_transparent/co_white,e_outline:10/dy2daidfoserzvblukbv.jpg)](https://agentfield.ai/github/codeaf/?utm_source=node&utm_medium=newsletter&utm_campaign=node-261105&utm_id=node-261105-codeaf&utm_content=codeaf) ![Node.js Weekly](https://res.cloudinary.com/cpress/image/upload/v1653576619/lgfqinzbdqttwmhvljxb.png) [![\](https://res.cloudinary.com/cpress/image/upload/w_1280,e_sharpen:60,q_auto/hnxmfhto3xr3zd6fwsd1.jpg)](https://nodejs.org/en/blog/release/v27.0.0-alpha.0.0.0) [Node.js 27 Alpha: The First Release Under Node's New Schedule](https://nodejs.org/en/blog/release/v27.0.0-alpha.0.0.0) — Under Node's [new release model](https://nodejs.org/en/blog/announcements/evolving-the-nodejs-release-schedule), each major release spends six months in alpha before stable release — so v27's final is due next April. Alphas are built from `main` with breaking changes, and are meant for library authors / testing rather than prod. - **V8 15.6** brings [`Math.sumPrecise()`](https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Math/sumPrecise), [`Iterator.zip()`](https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Iterator/zip) and other iterator helpers by default, and [`import defer`](https://github.com/tc39/proposal-defer-import-eval) and [immutable `ArrayBuffer`s](https://github.com/tc39/proposal-immutable-arraybuffer) are available behind flags. - **There's a new default heap limit** of half of physical memory (clamped between 256MB and 4GB), and memory held by `Buffer`s [counts toward it](https://github.com/nodejs/node/pull/66601). If you relied on the old defaults, you can set`--max-old-space-size`. - `v8.serialize()`, `structuredClone()` and `postMessage()` use a new format unreadable by older Nodes, so take care with mixed-version use. - [`fs.glob`](https://nodejs.org/docs/v27.0.0-alpha.0.0.0/api/fs.html#fsglobpattern-options-callback) is now implemented natively, there's an experimental [`net/promises`](https://nodejs.org/docs/v27.0.0-alpha.0.0.0/api/net.html#netpromises-api) API, and [`--allow-env`](https://nodejs.org/docs/v27.0.0-alpha.0.0.0/api/cli.html#--allow-env) joins the permission model. - [npm 12(.1)](https://github.com/npm/cli/releases/tag/v12.0.0) is now bundled so [there are breaking changes](https://github.blog/changelog/2026-06-09-upcoming-breaking-changes-for-npm-v12/) to be aware of. Rafael Gonzaga (Node.js Release Team) [![\](https://res.cloudinary.com/cpress/image/upload/c_limit,w_480,h_480,q_auto/copm/d44103ba.png)](https://agentfield.ai/github/codeaf/?utm_source=node&utm_medium=newsletter&utm_campaign=node-261105&utm_id=node-261105-codeaf&utm_content=codeaf) [Stop Babysitting Chats. Run Your Own Software Factory](https://agentfield.ai/github/codeaf/?utm_source=node&utm_medium=newsletter&utm_campaign=node-261105&utm_id=node-261105-codeaf&utm_content=codeaf) — A chat per agent, each one waiting on you. CodeAF does the middle: it splits the work, runs the parts in parallel, tests what came back, merges what passed and asks only when it must. #1 of ten coding harnesses on DeepSWE, at the lowest cost per fix. CodeAF by AgentField AI sponsor [Notable V8 Changes from Node.js 26 to 27](https://nodejs.org/en/blog/announcements/notable-v8-changes-from-node-js-26-to-27-alpha) — Further to the Node 27 updates above, here's a fantastic roundup of what new things V8 15.6 brings to the table for Node users. It's a big update as Node 26 uses V8 14.6. Joyee Cheung ['Nothing Installs at Our Company Until It's a Week Old'](https://brunoj.com/nothing-installs-at-our-company-until-its-a-week-old/) — Bruno put a proxy between his company and npm that refuses releases under seven days old. Twelve days on, he shares the numbers, the lockfiles it broke, and some practical advice if you want to do it yourself. Bruno Jurković **IN BRIEF:** - Express's [October security roundup](https://expressjs.com/en/blog/2026-10-31-security-releases/) covers DoS fixes in `body-parser` and `multer`, plus its official line on the Brotli flaw: upgrade Node (but there's a workaround if you can't). - Vercel builds now [block known-malicious npm package versions](https://vercel.com/changelog/blocking-malicious-npm-packages-before-and-during-installation) before and during install, with no configuration needed. - 🔒 It's a busy week for server framework security updates: [Fastify 5.12.8](https://github.com/fastify/fastify/releases/tag/v5.12.8) heads a wave of Fastify advisories including a [critical proxy prefix escape](https://github.com/fastify/fastify-http-proxy/security/advisories/GHSA-h3vp-4jfr-v364), [Hono 4.13.16](https://github.com/honojs/hono/releases/tag/v4.13.16) fixes several issues, and [Nuxt 4.6.4 and Nitro 2.13.6](https://github.com/nuxt/nuxt/releases/tag/v4.6.4) close eleven more. [Signing and Attestations Across Package Registries](https://nesbitt.io/2026/10/30/signing-and-attestations-across-package-registries.html) — A registry-by-registry survey of what npm, PyPI, RubyGems, crates.io, Go and others sign, which produce provenance attestations, and which offer trusted publishing, concluding with a handy comparison table. Andrew Nesbitt 💡 Related: [mise now verifies npm provenance by default](https://github.com/jdx/mise/releases/tag/v2026.11.1) and pins tools it installs to the repos that built them. [Parcel 3 Alpha: The Bundler Now Rewritten in Rust](https://v3.parceljs.org/blog/v3-alpha/) — Parcel's core is now a standalone Rust binary, with builds up to 100x faster on a large monorepo as a result. Plugins can be written in Rust, Go, Swift or C, or in JS/TS on a custom runtime, and there's HMR for Node targets. Devon Govett 📄 [Fuzzers vs. AI: Six Months of Hunting V8 Bugs](https://projectzero.google/2026/10/fuzzing-v-AI.html) – Fuzzilli and the BigSleep LLM agent compared on real production counts. Google Project Zero 📄 [No, npm, `estee` Is Not a Typo of `testem`](https://smoores.dev/post/no_npm_estee_is_not_a_typo/) – On npm's typosquat heuristic and the math of four-letter names. Shane Friedman 🛠 Code & Tools [![\](https://res.cloudinary.com/cpress/image/upload/w_1280,e_sharpen:60,q_auto/mgn4x8vitsmy06gi578a.jpg)](https://js.wiki/) [Wiki.js 3: A Modern Wiki App Built on Node](https://js.wiki/) — A mature project packed with features and an ecosystem of modules to integrate with other systems. Note that it's AGPL licensed. [GitHub repo.](https://github.com/Requarks/wiki) Requarks [Should You Use a Log or a Metric?](https://blog.sentry.io/when-you-need-a-metric/?utm_source=nodeweekly&utm_medium=paid-community&utm_campaign=observability-fy27q4-evergreen&utm_content=newsletter-sponsored-link-blog-log-metric-learnmore) — Learn when to reach for a log and when for a metric, with one signup handler as the example. [Read the post](https://blog.sentry.io/when-you-need-a-metric/?utm_source=nodeweekly&utm_medium=paid-community&utm_campaign=observability-fy27q4-evergreen&utm_content=newsletter-sponsored-link-blog-log-metric-learnmore). Sentry sponsor [Postgres.js 4.0: A Ground-Up Rewrite of the Popular Postgres Client](https://github.com/porsager/postgres/releases/tag/v4.0.0) — The public API is largely unchanged, but the rewrite gains a scheduler that stops fast queries waiting behind slow ones, `AbortSignal` support, and more. It's ESM-only and param typing has changed, so [the upgrade guide](https://github.com/porsager/postgres#upgrading-from-v3) is a must-read for users. Rasmus Porsager [NestJS 12.3: A Native node:http Platform Adapter](https://github.com/nestjs/nest/releases/tag/v12.3.0) — The server framework has long sat on top of Express or Fastify. [A third adapter](https://github.com/nestjs/nest/pull/18063) now runs on `node:http`, with Express-style request helpers but no Express dependency. NestJS [jsdom 31.0: A New CSS Engine and a Switch to @napi-rs/canvas](https://github.com/jsdom/jsdom/releases/tag/v31.0.0) — The pure-JS DOM behind countless test suites gains an integrated CSS implementation (supporting cascade layers, nesting, and `@scope`), swaps `canvas` for `@napi-rs/canvas`, and pauses parsing at blocking scripts. Domenic Denicola et al. [Vitest 5.1: Run Only the Tests Your Last Change Affected](https://vitest.dev/blog/vitest-5-1) — An experimental `--since-last-run` flag records which files each test loaded and reruns only what your edits touched, with no Git involved. Vitest Team [Nitro v3 Reaches Release Candidate](https://nitro.build/blog/v3-rc) — The server toolkit under Nuxt and friends gets a frozen API, an install a fraction of v2's size, Vitest-based route testing, and an experimental `nitro serve` that runs your source in production with no build step. Pooya Parsa (UnJS) 📰 Classifieds 🤖 Your free AI tier is being farmed by a person with fifty accounts. [Fingerprint](https://fingerprint.com/use-cases/ai-token-fraud/?utm_source=NodeWeekly110526&utm_medium=newsletter) recognizes the device behind every signup. [Try it free](https://fingerprint.com/use-cases/ai-token-fraud/?utm_source=NodeWeekly110526&utm_medium=newsletter). --- 🕐 Calgary or Winnipeg an hour off since Nov 1? Node 22 and 24 bundle tz data an OS update won't fix. [Tested fixes](https://cybernative.ai/guides/canada-time-zone-change-2026-runtimes/?utm_source=nodeweekly&utm_medium=classified&utm_campaign=paid1-canada-node) from an AI-run company. [![\](https://res.cloudinary.com/cpress/image/upload/w_1280,e_sharpen:60,q_auto/hmdgewt2uh5ustlkqfmu.jpg)](https://github.com/sindresorhus/ora) - [ora 10](https://github.com/sindresorhus/ora) – The elegant terminal spinner _(above)_ now requires Node 22 and erases only its own frame, leaving your program's output intact. - [Vite+ 1.5](https://github.com/voidzero-dev/vite-plus/releases/tag/v1.5.0) – VoidZero's all-in-one toolchain adds a `node --import vite-plus/register` hook so the built-in test runner, AVA or `NODE_OPTIONS` can run TypeScript through its loader. - [Got 16.2](https://github.com/sindresorhus/got/releases/tag/v16.2.0) – Sindre Sorhus's "human-friendly" HTTP request library. `.json()` now accepts a Standard Schema validator (Zod, Valibot, ArkType) so responses are validated and typed in one call. - [fast-json-stringify 7.3](https://github.com/fastify/fast-json-stringify/releases/tag/v7.3.0) – Fastify's serializer gains an option to lean on V8's new `JSON.stringify` fast path (in Node 25+) for [double the throughput](https://github.com/fastify/fast-json-stringify/pull/906). - [express-fileupload 1.6](https://github.com/richardgirges/express-fileupload/releases/tag/v1.6.0) – Fixes a ReDoS in its `Content-Type` check where a run of semicolons could stall the event loop. - [marked-terminal 8.0](https://github.com/mikaelbr/marked-terminal/releases/tag/v8.0.0) – Render Markdown in the terminal. A TypeScript rewrite with a new `mt` CLI and support for images via the Kitty and iTerm2 graphics protocols. - [Koa 3.3](https://github.com/koajs/koa/releases/tag/v3.3.0) – A hardening-flavored minor for the Express successor. **Got a link for us?** Reply and tell us. We can't include everything but we'll look at anything you send. _Thanks!_ --- **Sponsorship:** Email `[kristina@cooperpress.com](mailto:kristina@cooperpress.com)` for details. --- Published by Cooper Press Ltd. Fairfield Enterprise Centre, Louth, LN11 0LS, United Kingdom [Cancel your subscription](https://nodeweekly.com/leave/*|UID|*) or [change your address](https://nodeweekly.com/edit_subscription/*|UID|*).