Node Weekly

The life of a ~200ms HTTP request to a Node app

Thu, 16 Jul 2026 00:00:00 +0000

#633 — July 16, 2026

Follow a Single HTTP Request Through Its ~200ms Life — From the creator of NodeBook, a thorough guide to Node's internals, comes a scroll-driven visualization following every step a single HTTP POST request takes from the user's click to Node's event loop and on to a database behind it.

Ishtmeet Singh

The Best Harness Wins, Not the Best Model. Learn Harness Engineering — Scott Moss (Netflix) teaches you to wrap an LLM in a production-grade harness. Learn durable execution, sandboxing, memory, and multi-agent orchestration.

Master.dev sponsor

Fetch Needs Error Codes — e.cause.code lets you find out why a fetch() failed in Node, but the spec says failures are just bare TypeErrors, so HTTP/2/3 typed signals like "safe to retry this POST" go missing. James, who created Node's error code convention, is pushing a TC39 proposal to standardize a fix.

James M Snell

IN BRIEF:

Ant is a new entry to the growing field of JavaScript runtimes. This time, it's an independent engine written in C packed into a 9MB binary that boasts very low cold start times and can run Hono apps.
If you're considering using Go at all, this 'from Express to Fiber' guide with examples in both JavaScript and Go (on the Express-inspired Fiber framework) could be helpful.
🇮🇹 NodeConf EU 2026 takes place this September 29-30 in Italy. Tickets are still available.
Vercel is deprecating Node 20 for Builds and Functions on October 1, 2026.

Proxy and Reflect: Redefining How Objects Fundamentally Work — A deep dive into intercepting the internal operations of JavaScript objects, covering why Reflect exists at all, and ending with a small reactive state system.

Mat Marquis

Telegram Serverless: Run Telegram Bots on Telegram's Servers — Creating a bot for Telegram is easy (it has a great API) with libraries like node-telegram-bot-api, but it's starting to support running them on its own servers.

💡 The serverless program is in beta, so not all users will have access to it yet.

📄 A Gentle Introduction to Git Worktrees – For when you need to check out multiple branches into separate directories simultaneously. Nicholas C. Zakas

📄 Playwright on GitHub Actions: A Setup That Actually Runs Fast – How to cut Playwright CI time by caching browser binaries, lifting the scaffold's one-worker cap, and more. Jakob Norlin

📄 6 Security Settings Every GitHub Maintainer Should Enable This Week Joseph Katsioloudes (GitHub)

🛠 Code & Tools

LiteParse 2: Fast, Light PDF Document Parsing — A PDF parser built in Rust with bindings for Node (plus WASM, Rust, and Python) — it worked great in my testing. It includes OCR, handles layouts/is spatially aware, and is fast (a complex 140-page PDF took ~10 seconds). Here's how to get started from Node.

LlamaIndex

One Postgres for Your API and Your Analytics — TimescaleDB extends Postgres so your app and analytics run in one database at scale. Get $1000 credit to start.

Tiger Data (creators of TimescaleDB) sponsor

actions/setup-node@v7: Install Node in GitHub Actions — The popular way to set up an Actions workflow with a version of Node brings changes supporting GitHub's cache-poisoning defenses, inspired by recent exploits. There are also new docs on publishing to npm with Trusted Publisher (OIDC).

GitHub

🎬 Mediabunny: A Full Media Toolkit for JavaScript — It's been a year since we mentioned this library for reading/writing/converting media formats (MP4, MP3, and more). Since then, it's added Apple ProRes, HLS read/write, and a new server package that makes it all even easier to use from Node.

Vanilagy

Tinbase: A Supabase-Compatible Backend in a Single Binary — Provides a local Supabase-like dev experience using a JS backend built atop PGlite and pg-mem. A sort of mini, local-only Postgres wrapped in the same APIs as Supabase, so supabase-js works unchanged.

Sanket Sahu

@neon/sdk: Neon's New TypeScript Client Library — For users of the Neon Postgres platform to manage projects, branches, and databases from code.

Andre Landgraf (Neon)

Nano ID 6.0 – Generate tiny URL-friendly unique string identifiers. Now 4x faster and drops Node 18/20 support.
c8 12.0 – Istanbul-compatible coverage reports using Node's built-in V8 data. Node's test runner also has its own experimental code coverage reporting.
np 12.0 – Sindre Sorhus's "better npm publish" adds support for npm 12 and staged publishing.
HyperExpress 7.0 – A high performance Node server powered by uWebSockets.js.
Helmet 8.3 – HTTP security header hardening for Express apps.
node-auth0 6.0 – One for Auth0 users.
ESLint 10.7

📢 Elsewhere in the ecosystem

TypeScript-using AWS SDK for JavaScript v3 users need to be aware of changes to the library's support for TypeScript versions.
GitHub's Dependabot is now giving packages a three-day default cooldown before opening version update PRs, though security fixes are exempt.
TC39's 115th meeting takes place next week. Here's the agenda, including Await Dictionary aiming for Stage 3, plus Decimal, Import Defer, and Map.take.
📁 Cloudflare has launched 'Drop', a way to quickly get a site live by dropping a folder or ZIP onto a page, similar to Netlify's service of the same name.
plx is a transpiler for Postgres stored functions that converts JavaScript, PHP, Python, Ruby, and even COBOL, to Postgres's own PL/pgSQL language.

npm v12 and TypeScript 7 released

Thu, 9 Jul 2026 00:00:00 +0000

#632 — July 9, 2026

Read on the Web

npm v12 Ships with Install Scripts Off by Default — npm 12 is now GA with many breaking changes. The headline change is lifecycle scripts and implicit node-gyp builds no longer run by default. Socket’s Sarah Gooding writes more about the practical implications including, thankfully, that unknown .npmrc keys will now only warn rather than error as they did in the pre-releases.

GitHub

Your Next.js App Is Already Tracing. Now Make It Useful — When a Next.js page is slow, the hard part is finding which part is responsible: middleware, SSR, an API route, a query, or a fetch call. 🔍 Next.js is already tracing all of it. Here's how to actually see it and put it to use.

Sentry sponsor

Node.js 26.5.0 (Current) Released — Key additions include the ability to import text files into ES modules via import attributes (behind an experimental flag), blob.textStream() (good for streaming large blob content), and being able to sample event-loop delay per iteration via perf_hooks.

Richard Lau

IN BRIEF:

Bun's Jarred Sumner wrote up the full story of rewriting Bun in Rust, a somewhat controversial AI-powered port that will power Bun 1.4 onward. The cost? ~$165k of Fable usage, at API prices.
James Snell has a TC39 proposal to standardize a code property on Error (as has long been common in Node).
Better Auth, the framework-agnostic auth library, is joining Vercel.

TypeScript 7.0 Released — Over a year after announcing TypeScript would be ported to Go, the final release is out. Don't rush to upgrade: TS 7.0 doesn't ship with an API yet, and 6.0 is still a good stepping stone. If you do upgrade, expect to see huge build time speedups, once moduleResolution: node is switched to nodenext and you've sorted out "types": ["node"].

Microsoft

CVE-2026-48931 Shouldn't Have Been a CVE — A candid post-mortem from a Node maintainer explaining a recent snafu around an HTTP/1.1 poisoning issue he now argues shouldn’t have been a CVE, especially after the fix broke node-fetch, Firebase, and the official Docker images.

Matteo Collina

What's New in ECMAScript 2026 — The ECMAScript 2026 spec was approved last week, and this round-up covers several main new features that made the cut, with all (except Math.sumPrecise) available in Node today.

Pawel Grzybek

📄 You Shouldn't Trust Trusted Publishing – npm added trusted publishing, but it’s authentication, not a safety or quality badge. Matteo Collina has also written about this from the npm perspective before. William Woodruff

📄 Node.js Worker Threads in Production – Hard-won lessons from running worker threads at scale. Aaron Harper (Inngest)

🛠 Code & Tools

terminal-image 5.0: Display Images in the Terminal — Works in any terminal that supports colors by rendering colored blocks, but can render images inline in terminals that support inline graphics. v5.0 improves iTerm2 support by using its native inline image support, rather than the Kitty protocol.

Sindre Sorhus

Full-Text Search in Drizzle Without a Second System — Try the official ParadeDB integration for Drizzle. Search your live Postgres tables. No ETL, no Elasticsearch cluster.

ParadeDB sponsor

eslint-node-test: ESLint Rules for Node's Built-In Test Runner — In Sindre’s own words: “If you use the Node.js test runner (node:test), you may like the new ESLint plugin I cooked up. 64 [now 82] rules to improve your tests, prevent mistakes, and enforce style.”

Sindre Sorhus

✉️ Upyo 0.5: A Cross-Runtime Email Sending Library — A unified, type-safe API for sending emails both on SMTP and HTTP-based (e.g. SendGrid or Amazon SES) providers from Node, Deno, Bun, and edge function runtimes.

Hong Minhee

webpack-dev-server 6.0: The Official webpack Dev Server — Bumps Express up to v5, drops support for older Node versions, adds support to be used as a webpack plugin, and switches to ESM.

webpack

XO 4.0 – Opinionated but configurable ESLint wrapper that includes numerous popular ESLint plugins and rules out of the box.
ESLint Plugin Perfectionist 5.10 – For when you're really particular about the ordering of things like objects, imports, and types.
MongoDB Node.js Driver 7.5 – Official driver for MongoDB. Now supports Queryable Encryption string queries on MongoDB 9.0.
🐍 node-calls-python 1.2 – Call Python from Node directly, in-process, without spawning processes.
FoalTS 5.3 – The full-featured Node.js app framework adds a new dev-verbose logging format.
Fastify 5.10.0 – The fast and low overhead web framework.
feed 6.0 – RSS, JSON, and Atom feed generator library.

📰 Classifieds

📈 Crystallize seeks a remote SRE who thinks in SLOs, not heroics. Node/TS, GraphQL.

37 CLI best practices for Node devs

Thu, 2 Jul 2026 00:00:00 +0000

#631 — July 2, 2026

Read on the Web

So You Want to Land Your First Node.js Core Contribution? — Joyee Cheung has put together a new, official guide for anyone considering making their first contribution to the Node project, including where to look for issues to work on and how to improve the chances of your work making the cut.

Joyee Cheung

Your Autonomous Engineering Team, in TypeScript — One call spins up an orchestrated fleet — planner, architect, coders, QA, reviewers — that plans, builds, tests and ships production-grade PRs. TypeScript SDK, agents as typed APIs, open- and closed-source models.

AgentField.ai sponsor

37 Node CLI App Best Practices — A long-standing, but now modernized, set of guidelines for building “successful, empathic and user-friendly” CLI tools, plus an appendix rounding up the most popular CLI framework options. Now also includes a SKILL.md file you can point agents to.

Liran Tal

IN BRIEF:

Nub, a toolkit that adds useful features to Node (rather than replacing it), is now a single self-contained binary and has added a web-standard Worker mechanism to Node.
🔒 npm now locks 'high impact accounts' (those maintaining the most popular packages) into a 72-hour read-only mode when they change their email or use a 2FA recovery code.
npm 11.18.0 promotes the linked install strategy to stable, where packages are installed in node_modules/.store and linked in place, so code can only reach dependencies it actually declared. More info here.

Why Drizzle ORM Couldn't Publish New Releases on npm for a Month — As well as explaining why the popular ORM ran into the problem, Evert shares tips to see if you run a similar risk, and how to mitigate it.

Evert Pot

Iterating Faster on VS Code with TypeScript 7 — The tale of how the VS Code team adopted the Go-based TypeScript 7 compiler and got a 7x reduction in type checking time.

The VS Code Team (Microsoft)

📄 Roll Your Own File-Based Router in Under 50 Lines of Code – One for users of Wasp, the Node.js + React + Prisma full-stack framework. Carlos Precioso (Wasp)

📄 Finding Memory Leaks with Heap Snapshot Analysis in N|Solid – Using the N|Solid extension to capture a heap snapshot to trace a memory leak in VS Code. Estefany Aguilar (NodeSource)

🛠 Code & Tools

Node-GTK 4.0: GTK Bindings for Node — Bindings to the popular GTK desktop widget toolkit for building Linux, macOS and Windows apps. Now supports Node 26 and includes an npx node-gtk create app-name command to spin up a project. Worked well on macOS once I had the dependencies in place!

Rom Grk et al.

Schedule Node.js Scripts Across Your Server Fleet with xyOps — Run unlimited Node, Shell, HTTP, and Docker jobs with live logs, alerts, snapshots, and visual workflows. Self-hosted.

xyOps sponsor

🤖 Vercel AI SDK 7: An SDK for Working with AI Model Providers — Provider-agnostic library for building AI apps (no Vercel services needed). v7 focuses on agents, but adds WebSocket sessions for real-time transcription/voice agents, and video generation support for several providers.

Martynus, Grammel, Arntz, et al.

Electron 43: Faster Startup and V8 15 — Updates to Chromium 150, Node 24.17, and V8 15, with faster startup via a Node boot snapshot and bytecode-cached preloads. Adds rounded corners on Linux, matching Windows and macOS. v43 is also the final line to ship 32-bit binaries.

John Kleinschmidt

Deno 2.9 – The alternative runtime rolls out its new desktop app generator, improves support for npm/pnpm/yarn/Bun lockfiles, improves its test runner substantially, and more.
Git 2.55 – Adds git history fixup for 'fixing up' earlier commits, faster git status on Linux, and more.
pg-promise 12.7 – Node 26 is now officially supported by the popular Postgres client library.
Middy 7.7 – Node.js middleware engine for AWS Lambda. (Release notes)
Fastify 5.9 – Lots of bug fixes, and introduces request.mediaType.
Knex 3.3 – Batteries-included, multi-dialect SQL query builder.
JS YAML 5.2 – Fast YAML 1.2 parser and writer library. (Demo.)

📰 Classifieds

🚀 Crystallize is hiring a remote SRE: Node/TS, GraphQL, AWS, MongoDB, Cloudflare Workers.

Node.js 26.4 lands package maps

Thu, 25 Jun 2026 00:00:00 +0000

#630 — June 25, 2026

Read on the Web

Node.js 26.4 Adds Package Maps — A minor release whose headline feature is the (experimental) implementation of package maps (which let Node resolve packages from a static JSON file rather than walking node_modules). Matteo Collina’s node:vfs subsystem also begins to make an appearance.

Antoine du Hamel

💡 Node v24.18.0 (LTS) and v22.23.1 (LTS) have also been released.

That Analytics Route is Blocking Your Event Loop — Crunching big result sets in Node ties up the event loop and stalls other requests. TimescaleDB extends Postgres so the database aggregates instead. Hypertables, 95% compression, continuous aggregates. No second database. Get $1000 credit to start.

Tiger Data (creators of TimescaleDB) sponsor

Blocking Install Scripts is Not a Silver Bullet — npm v12 won't run install scripts by default, but Ulises argues that only removes one attack trigger, not a capability, since a compromised dependency’s code still runs on import! He shows why, even then, Node's permissions model and sandboxing are the layers that actually limit what that code can do.

Ulises Gascon

IN BRIEF:

The first preview release of npm 12 is here if you want to get testing.
Deno has begun to show off a new feature to create cross-platform desktop apps. Think Electron-style apps, but on top of Deno with cross-compilation, framework auto-detection, and a choice between bundling a Chromium runtime or using the system's WebView.
Vercel has opened a public beta of WebSockets support in Vercel Functions. You can write normal Node.js code using ws with no extra setup.
The pnpm project is working on pnpr, an experimental pnpm-compatible npm registry server, written in Rust.

What If npm Ran on AT Protocol? — James, a long-standing Node core contributor, ponders what a package system built atop the protocol Bluesky uses could look like: “It’s just an idea I couldn’t get out of my head until I wrote it down.”

James M Snell

Benchmarking 5 WebSocket Servers for Node.js — A banned IP, a lying load generator, and a 20× latency illusion turned a routine benchmark run into quite the detective story.

Irina Nazarova

Your Node App Has an N+1 Problem. AppSignal Shows You Where — Auto-detects N+1 queries in Prisma, Express, and Koa. One install, minutes to first trace. Free 30-day trial, no card.

AppSignal sponsor

📄 JavaScript Still Can't Ship a 'Full-Stack Module' – Thoughts on modules which provide frontend and backend code ready to go, as you might see in ecosystems like Rails and Laravel. Mihovil Ilakovac

📊 The Performance of WebAssembly Runtimes in 2026 – Mostly focused on dedicated options, but also including Node/V8. Frank Denis

🛠 Code & Tools

🤖 Eve: A Next.js-Style Framework for Building Agents — A new framework from Vercel that provides Next.js-esque structure for building AI-powered agents using TypeScript and Markdown. It's quite Vercel-flavored by default, but I found you can run it entirely independently of Vercel with a few settings tweaks and your own keys. Project homepage.

Vercel

TypeScript 7.0 Release Candidate — A step closer for the Go-powered TypeScript compiler that promises ~10x faster build performance. A reminder that moduleResolution: node / node10 are no longer supported and @types packages you need have to be listed explicitly.

Daniel Rosenwasser (Microsoft)

🔐 AccessControl 3.0: Role and Attribute-based Access Control — A role and attribute-based (RBAC/ABAC) access control library that, as of v3, now has a real policy engine available to apply conditions to grants, enforced ownership, mandatory restriction gates, audit hooks, and more. GitHub repo.

Onur Yıldırım

Camaro 6.5: A High Performance XML to JSON Converter — Uses bindings to pugixml, a fast C++ XML parser.

Tuan Anh Tran

Tedious 20.0 – TDS module for connecting to SQL Server. A related release is the SQL Server client library node-mssql 12.6 which uses Tedious (or msnodesqlv8).
Chardet 2.2 – Character encoding detection library that uses statistical methods to detect around 30 different encodings.
cookie 2.0 – HTTP cookie parser and serializer library. Now faster and ESM only.

📰 Classifieds

🧐 Where to host? Judoscale’s cost comparison calculator puts the PaaS alternatives head-to-head.

⚙️ Run AI agents like microservices — every agent an auto-generated API: schemas, versioning, no glue code. 100+ recipes, TypeScript SDK. → Star on GitHub.

📢 Elsewhere in the ecosystem

A roundup of some other interesting stories in the broader landscape:

Cloudflare has added the ability to create and deploy Workers on 'temporary accounts'. Ostensibly 'for AI agents', but you can use them yourself too, and get a Worker (which have increased Node.js compatibility nowadays) running for 60 minutes with no strings attached.
The Bun team has proposed adding shared-memory threads to JavaScriptCore (a more traditional threading approach versus worker threads).
🔒 GitHub has released actions/checkout v7 that "refuses common pwn request patterns by default" including refusing to fetch fork pull request code in pull_request_target and workflow_run workflows.