Node Weekly

When worker threads beat processes for Node efficiency

Thu, 8 Oct 2026 00:00:00 +0000

#643 — October 8, 2026

📝 We're back after taking last week off – you didn't miss an issue :-) If you want one neat thing to check out today, look for the voice synth package below, it's a fun way to relive a bit of 80s nostalgia!
__
Peter Cooper, your editor

How Booking.com Cut the Cost of Its Biggest Node.js Service by 38% — The online travel company moved its biggest React SSR service from pm2’s process-based cluster approach to Platformatic’s Watt and worker threads, then tuned load balancing and V8’s GC to get noteworthy gains.

Ilya Malyavin (Booking.com)

100+ Search Engines. One Simple API — Build with real-time search data from Google, YouTube, Amazon, and more. SerpApi delivers structured results in JSON and Markdown for AI agents and your next app. Skip scraping headaches. Start building with a simple API.

SerpApi sponsor

Node.js 26.11.0 (Current) Released — A more substantial minor release than usual with a new --process-timeout flag that ends a process after a set time (even mid-busy-loop), node:sqlite gets virtual table support, Buffer.stringLength(), and Alpine (x64) is promoted to tier 2 support.

Antoine du Hamel

⚠️ 26.11 also rolled out the new docs design, but a bug was found that caused the docs to not render to HTML, so v26.11.1 reverts back to the old docs design for now.

IN BRIEF:

While we were away last week, VoidZero dropped Vite+ 1.0, its single command (vp) Node.js version, package, and frontend toolchain manager. Node's download page has already updated to offering Vite+ as an option.
With this commit, future releases of Node should load most ES modules synchronously, only taking the async path for top-level await, loader hooks and the like.
V8 15.5 has landed on Node's main branch, ahead of Node 27. A big jump from Node 26's V8 14.6.

Optimizing Objects with null Prototypes — In V8, objects created with { __proto__: null } or Object.create(null) start off in a slower ‘dictionary mode’. Creating a plain object and nulling the prototype afterwards keeps it fast, as Matteo shows.

Matteo Collina

I Tested 11 HTTP Resilience Libraries — ffetch's creator tests how a variety of fetch wrappers (like Ky, ofetch, and Wretch) handle retries, timeouts and cancellation, and where those policies interact badly.

Gabor Koos

Find Auth Gaps in Your Node APIs Before Hackers Do — SonarQube Hunter Agent hunts intent-based vulnerabilities and drops verified findings right into your issue list.

SonarSource sponsor

📄 Node.js Thread Pools on Busy Machines – Why sizing the thread pool from the CPU count backfires when other processes share the machine. Matteo Collina (Platformatic)

📄 Maintaining wait-on at Agent Speed – wait-on's new co-maintainer reflects on his first week managing things agent-style. Kevin Old

📄 How to Compile JavaScript into a Single Executable – A comparison of the Node, Bun and Deno approaches. Flavio Copes

🛠 Code & Tools

DOCX 9.9: Generate Word .docx Files from JavaScript — A comprehensive library for generating docx files. 9.8 recently added support for charts, shapes and watermarks, and 9.9 adds a way to lay out documents the way Word itself does. Homepage.

Dolan Miu

H3 v2: The UnJS HTTP Framework is Rebuilt on Web Standards — A minimal HTTP framework best known for powering Nitro and Nuxt’s server layer. v2 is a rewrite around standard Request and Response, so one app runs on Node, Bun, Deno and Workers, with URLPattern-style routing and (event, next) middleware. More info here.

Pooya Parsa

🤖 Klattsch: Retro 1980s Vocal Synthesis — 1980s-style phonemes to speech in a single npm package! It's very flexible, you can even make it sing, akin to HAL in 2001. Works in Node but you can also run it in the browser.

Crash United

Feedsmith 3.0: Fast Web Feed Parser and Generator — Parse and generate RSS, Atom, and JSON feeds from JavaScript, in both browsers and Node. v2.x users will find this migration guide useful.

Maciej Lamberski

pnpm 12.10 – An experimental loaded linker lets Node load dependencies straight from pnpm's store, skipping node_modules linking.
Hono 5.0 RC – The web-standards server framework goes ESM-only, requires Node 22.12+, and moves runtime adapters into separate packages.
Execa 10.1 – The process execution library fixes behaviors you may have relied on, like extendEnv: false still inheriting process.env.
Effect 4.0 – The TypeScript effect system gets a rewritten dependency-free core and consolidated packages.
⚠️ Handlebars 4.7.10 – Fixes two critical JavaScript injection flaws. Earlier 4.x releases are affected.
he 2.0 – Mathias Bynens' HTML entity encoder/decoder gets its first release in 8 years and moves to ESM with named exports.

📰 Classifieds

CodeAF fixed 2x OpenCode's issues and nearly 4x Claude Code's on the same model, at up to 4.8x less per fix. New release, open source.

🚫 Ban the device, not just the account. Fingerprint's visitor ID catches ban evaders — even incognito or behind a proxy.

📢 Elsewhere in the ecosystem

.node domains? Confused by the huge number of TLDs available to register? Get ready for more as ICANN has unveiled a whole new round of them – you can browse the proposed new gTLDs here which… includes .node!
Sindre Sorhus, the prolific npm package author, has disabled outside pull requests on his repos due to AI, but will keep maintaining them.
Daniel Lemire timed linking the Node binary with GNU ld, gold, and mold. Mold won easily, which may be useful if you're rebuilding Node a lot.
Theo Browne's ts-rust is an experimental Rust port of the TypeScript 7 compiler, built almost entirely by AI agents.
📊 The 2026 Stack Overflow Developer Survey results are out, drawing on 30,903 responses.

12 Node built-ins that replace npm packages

Thu, 24 Sep 2026 00:00:00 +0000

#642 — September 24, 2026

Read on the Web

⚠️ We're taking a week off next week, so we'll be back on Thursday, October 8.
__
Your editor, Peter Cooper

Node.js Built-ins That Replaced npm Packages — A practical tour of 12 Node built-ins that replace packages like axios, dotenv, nodemon and chalk. Each is explained with its stability level in Node 24 LTS and gotchas that might make you want to stick with your existing dependency anyway.

Flavio Copes

CodeAF: The Open-Source Software Factory for Open Models — Instead of juggling a terminal for every agent, you get one window for every project. Hand work off: it splits it into parts, runs them in parallel, tests what comes back and merges what passes. Many models, one session: the right one for each call.

AgentField.ai sponsor

Node.js 26.10.0 (Current) Released — Built-in, promise-based util.debounce() and util.throttle() arrive, complete with AbortSignal support. There’s also util.markPromiseAsHandled() to help retire .catch(() => {}) hacks. Plus a little more besides.

Antoine du Hamel

💡 Node v22.23.3 (LTS) also landed with updated root certificates and dependencies (OpenSSL, npm, and Undici) plus minor fixes.

IN BRIEF:

From Node.js 27, Intel Macs drop to only having 'experimental' support, meaning no official x64 macOS builds and an arm64-only installer.
James Snell has proposed a --process-timeout flag that kills a stuck process, even one in a tight loop, and reports what kept it alive.
GitHub Actions has removed Node 20 from its runners so if you maintain an action, switch runs.using to node24 and publish a new release.
Yagiz Nizipli has opened a PR that shrinks the node binary by about a third (147MB to 95MB on macOS arm64) using extra compression and stripping symbols. Notably, 𝕏 Grok was used to do this work.
Daniel Lemire explains how AI-assisted experimentation made several libraries that ship in Node faster, including Ada, simdjson and simdutf.

npm Tokens Can Now Stage Releases Without Publishing Them — A new token permission lets CI stage npm releases but not publish them, with a maintainer approving each staged version with 2FA. It offers a migration path ahead of npm's planned ending of direct publishing using bypass-2FA tokens in January 2027 if you can’t use trusted publishing yet.

GitHub / npm team

📄 How I Traced a Node.js Streams Bug in Duplex.from() – A first-time core contributor's path from issue to PR. Aman Chadha

📄 Publishing a Subfolder to npm for Cleaner Package Paths – How to keep dist/ (or src/) out of your package's import paths. Bramus

📄 Faster SSE Responses with Async Generators and Promise.race() Valeri Karpov

🛠 Code & Tools

secure-eval-worker: A Safer eval() via Node's Permission Model — A new way to run untrusted (or AI-generated) JavaScript in a locked-down worker with timeouts, memory caps, and access only to the host functions you choose. Node 26 only, and not a true sandbox.

Matteo Collina and Luca Maraschi

🔒 CVE Lite CLI: Scan Your Lockfile, Get the Upgrades to Run — An OWASP-backed scanner that reads your lockfile, checks it against OSV and npm’s advisories, and gives you npm/pnpm/Yarn/Bun commands to use, including which parent package(s) to bump for transitive issues.

Sonu Kapoor and OWASP

Your Nightly Rollup Job Is a Query That Got Too Big — TimescaleDB extends Postgres with continuous aggregates to keep rollups fresh. No batch job. Get $1000 credit to start.

Tiger Data (creators of TimescaleDB) sponsor

🤖 Transformers.js v4.3: Run AI Models from JavaScript — Adds support for structured output (e.g. JSON), using WebGPU on Safari 26+, and DeepSeek v4. The docs have had an overhaul and there’s now an agent skill you can use.

Hugging Face

vitest-gpu and jest-gpu: Test WebGL and WebGPU Code Without a Browser — Vitest and Jest environments that give tests WebGL and WebGPU contexts in Node, so you can compile shaders, run compute passes, or diff frames against baselines sans browser.

Ben Houston

Superdiff 4.3 – A library that produces diffs of objects, arrays and text. v4.3 can now diff code by line and token too (above).
dotenv 18.0 – The popular .env file loader. v18 adds a CLI and a faster opt-in parser, but drops -r dotenv/config preloading in favor of dotenv run --.
Tinypool 2.2 – Minimal worker thread pool and Piscina fork. Now accepts a URL instance as the filename.
NestJS 12.1 – Now with built-in cookie support, CSRF protection, and security headers.
mongodb-memory-server 11.3 – Spin up real MongoDB servers for tests.
SuperTest 7.3 – Library for testing Node HTTP servers using a fluent API.
SQL Formatter 15.9 – Library for pretty-printing SQL queries.

📰 Classifieds

🚫 Ban the device, not just the account. Fingerprint's visitor ID catches ban evaders — even incognito or behind a proxy.

🎟️ Join us at Supabase Select on October 2. Get first-hand information about what's coming soon in Supabase. Apply to attend with 25% off: SUPAWEEKLY.

📢 Elsewhere in the ecosystem

pnpm 12.6 can now dedupe dependency versions across a workspace as it installs, keeps node_modules working after a project is moved (macOS and Linux only), and adds --save-types for @types/* packages.
Coding agents quadrupled Linear's test suite, so its team reworked their CI to get costs down: rewriting type-aware ESLint rules as plain AST checks cut lint time 55%, and selectively disabling Vitest's isolation saved a further 17% a month.
Cloudflare's Sunil Pai wrote about the senior engineer 'death spiral', where you go quiet for weeks to prove yourself in a new role and end up burning out.
🧪 A 'periodic table' of all 115 standard HTML elements!

Node 26.9 turns on FFI by default

Thu, 17 Sep 2026 00:00:00 +0000

#641 — September 17, 2026

Read on the Web

Why (and How) GitHub Ported Copilot's Runtime from Node to Rust — GitHub's Copilot runtime moved to Rust, ported in pieces behind napi-rs shims while shipping daily. Startup times and memory usage inspired the move, but the gold for porters is in the regressions they hit involving number types, || semantics, and blocking the event loop.

Stephen Toub (Microsoft)

That p99 Spike Is One Slow Analytics Query — One endpoint runs an analytics query over millions of rows, and latency spikes for everyone. TimescaleDB extends Postgres so that query returns in milliseconds at scale. Hypertables, compression, continuous aggregates. Get $1000 credit to start.

Tiger Data (creators of TimescaleDB) sponsor

IN BRIEF:

Node is to get util.debounce() and util.throttle() functions, two staples of utility libraries. They've landed on main for a future release.
🔒 Moment.js 2.31.0 is a key update. The date library is in 'maintenance mode', but gets 25M downloads a week, and v2.31.0 fixes a path traversal vulnerability.
The Node.js Web Team's redesigned API docs have been merged and should reach nodejs.org/api alongside a release soon.
In Node 27, the HTTP client will reject responses with more headers than request.maxHeadersCount (1000 by default right now) instead of just truncating them.

Node.js 26.9.0 (Current) Released — A reasonably significant minor release that brings a few new things to the table:

node:ffi is enabled by default (but still experimental), so you can call functions in native libraries without writing an addon.
node:bench is a new benchmarking module modeled on node:test.
Web Workers now have an experimental implementation (behind a flag), so browser-style new Worker() and postMessage, etc. can be used.
Worker threads start up to twice as fast (per initial benchmarks) and use less memory, as they now start from Node's built-in snapshot.

Antoine du Hamel (Node.js Team)

Stay Sharp in the Age of AI — Master.dev instructors build at Anthropic, OpenAI, Netflix, Google, and Stripe. Learn from them via courses, workshops, and AI learning paths. New members get $100 off a yearly membership.

Master.dev sponsor

📄 Connection Reuse is the Money – How a webhook sender cut its repeat TLS handshakes with one Undici Agent per destination. Mike Murray

📄 Email, Decoupled from Where and How – The design behind Upyo, a web-standards-based email library for Node, Deno, Bun and edge runtimes that works with many providers. Hong Minhee

📄 A Deep Dive into JavaScript Engines: Writing Code That Makes V8 Happy Audrey Doyen

📄 Five Software Engineering Roles for Working with AI Nicholas C. Zakas

📄 How to Implement a Distributed Circuit Breaker Gabor Koos

🛠 Code & Tools

Eraser Diagrams: Diagrams as Code, Minus the Layout Engine — A Node API/CLI for rendering JSON diagrams to PNG or HTML. Unlike Mermaid or D2, there's no auto-layout engine, so you (or your LLM!) get to control just where things go, while connection routing, icons and styling are handled for you.

Eraser

@platformatic/memcached: A Faster memcached Client — A zero-dependency memcached client built on the modern meta protocol, pipelining over a single connection. Claims to be "roughly 3x" the speed of alternatives.

Matteo Collina (Platformatic)

jsdom 30.1: The Release That's 'Feeling the AGI' — The pure-JS DOM implementation gets faster DOM construction, mutations, getComputedStyle() and event dispatch, plus lower memory use. Much of it came from Scott's Codex-assisted PRs, which Domenic praises for being carefully curated.

Domenic Denicola and Scott Cooper

XO 5.0 – The zero-config ESLint wrapper now lints package.json files and enforces import file extensions in TypeScript.
officeParser 8.0 – Parse Office files (docx, pptx, xlsx, etc.) and PDFs into an AST. Now with a rewritten PDF extractor.
oclif 6.0 – Salesforce's framework for building Node CLIs drops support for installing legacy plugins.
pg-boss 12.33 – The Postgres-backed job queue adds a TestClock so tests needn't wait on timers.
Aedes 1.2 – Barebone MQTT broker that runs on any stream server.
🔒 Express 4.22.3 – A security release for those on Express 4.

📰 Classifieds

⚡ Zuplo puts every API, AI, and MCP request behind one gateway. Route traffic, guard your MCP servers, and cap your AI costs. Try it free.

🛡️ Not all bots deserve blocking. Fingerprint Bot Detection stops content scrapers while letting legit AI agents through. Try for free.

🎟️ Join us at Supabase Select on October 2. Bring your hardest questions to the engineers building Supabase at the Ask Supabase booth. Apply to attend with 25% off: SUPAWEEKLY.

📢 Elsewhere in the ecosystem

npmchart.com (above) is a new option for tracking download trends and repo activity of npm packages. Here's the chart for express, for example.
A review of sixteen weeks of package manager releases across ecosystems finds similar new defences rolling out, like cooldowns, blocking install scripts (as in npm 12), and publish-time scans, which npm has done since July.
Those npm 12 defaults won't reach current Node lines, though. Last month, the Release WG decided npm 12 is "far too disruptive" for Node 22, 24 or 26, so it'll arrive in Node 27.
GitHub Actions has a new cache-mode setting to limit cache access per workflow or job, a defence against the kind of cache poisoning that compromised TanStack's npm packages in May.

Node is getting a built-in benchmark runner

Thu, 10 Sep 2026 00:00:00 +0000

#640 — September 10, 2026

Read on the Web

Cloudflare Workers Gets a New, Node.js-Aligned Module Registry — Workers enabled Node.js compatibility by default last month, meaning you can use most of Node’s built-in APIs in your Workers. Now there’s an opt-in way to load modules that resolves import paths as proper URLs, bringing import.meta and Node's require(esm) rules with it.

Logan Gatlin and James Snell (Cloudflare)

Confidently Deploy and Manage Containerized Apps on Kubernetes — Join this detailed video course with Erik Reinert and learn how to deploy and manage production-grade containerized applications on Kubernetes. You'll cover infrastructure, testing, rollbacks, autoscaling and more, all before pushing your cluster to EKS.

Master.dev sponsor

📊 node:bench: Node Core Gets a Built-In Benchmark Runner — Node has had a built-in test runner for years but no benchmark runner. James's experimental node:bench module has landed on main, so expect to see it soon. It's modelled on node:test, with a node --bench CLI and JSON reporter.

James M Snell

IN BRIEF:

Node.js v26.8.2 (Current) and v24.21.0 (LTS) are out, both including a security release of Undici that fixes several vulnerabilities, plus OpenSSL 3.5.8 and numerous tweaks and fixes.
🔒 Researchers at GitLab found a CVSS 10.0 sandbox escape in vm2, the widely used Node sandboxing library. The reported escape was patched in 3.11.7+, but the writeup argues vm2 shouldn't be used for genuinely untrusted code (though vm2's own docs are also honest about this).
Zod creator Colin McDonnell has landed a change that speeds up Node's startup (by a millisecond or so, granted) by seeding V8's non-cryptographic entropy from the OS rather than OpenSSL.
This year's TSC elections went uncontested: Matteo Collina staying Chair and Rafael Gonzaga becoming Vice-Chair.

Fuzzing the State Machines Inside My HTTP Client — A practical case for property-based testing, made by adding fast-check properties to ffetch’s 206 passing tests. Thousands of generated cases found 11 real bugs in code considered fully tested.

Gabor Koos

Add MCP Server Monitoring to Your Node.js Project — A single function call. See who is connecting, which tools drag, and the failures MCP never throws.

Sentry sponsor

📄 Is Prisma 8 Ready for Long-Lived Production Apps? – A response to community worries about Prisma 8's new migration model. Will Madden (Prisma)

📄 Containerizing and Slimming Node Apps with Paketo Buildpacks Costas Papastathis (Paketo)

📄 What await fetch() Actually Waits For Gabor Koos

🛠 Code & Tools

Rslib 1.0: A Build Tool for JavaScript Libraries and CLIs — Rspack's answer to tsup/tsdown goes 1.0 with a stable config and JS API. It can infer syntax targets from engines.node, generates declarations faster with TypeScript 7, and (experimentally) build Node SEA executables.

Chenwei Dai, Elecmonkey, et al.

vgpu: Render WebGPU Shaders in the Browser or Node.js — Provides a way to use the same shader in the browser or render headlessly with Node (to a high-resolution PNG or MP4 video). WGSL modules import and export like TypeScript does.

Vercel

MikroORM 7.2: Row Level Security, a WASM SQLite Driver, and More — A TypeScript ORM for SQL databases and MongoDB. 7.2 adds native Postgres row level security, with policies as entity metadata, plus through relations and a WASM sql.js driver (yes, you can now use MikroORM in the browser!)

Martin Adámek

Javet 6.0: A Way to Embed Node.js and V8 in Java — A Java library that embeds a real Node.js runtime (now v26) in the JVM. Java code can load npm packages, call into running Node code, and run multiple Node instances side by side. GitHub repo.

Sam Cao

eslint-plugin-regexp 3.3: ESLint Plugin for Finding Regex Mistakes — There’s a neat online demo to show off the things it can catch.

Yosuke Ota

parse-xml 5.0 – The fast, compliant XML parser goes ESM-only. The API is unchanged and require() still works on Node 22+.
dhcp.js 1.0 – DHCPv4 client, server, and tools for Node. We covered the explainer blog post about this project nine years ago!
pnpm 12.4 – The fast drop-in npm replacement can now manage npm, Python, and Cargo dependencies in the same workspace.
✉️ Nodemailer 10.0 – The popular e-mail sending library has migrated to TypeScript with ESM and CJS builds.
⚠️ Fastify 5.12.2 – Includes fixes for four high-severity issues, including validation and auth bypasses.
tinybench 6.2 – Simple, tiny and lightweight benchmarking library with precise timing.
🌐 supercluster 9.1 – Mapbox's fast geospatial point clustering library.

📰 Classifieds

🎯 Catch promo abuse at signup. Fingerprint’s visitor ID persists for months, not days, so abusers can’t hide. Try it for free.

Your API is fast until it hits analytics. TimescaleDB extends Postgres so those queries return in ms at scale. Get $1000 credit.

📢 Elsewhere in the ecosystem

React 19.3 is out with stable view transitions and fragment refs, Trusted Types support, and a browser() API used via use(browser()) to let components skip server-side rendering when they need browser-only APIs.
📺 Microsoft released a movie-length documentary about VS Code, directed by Stefan Kingham. It covers the editor's technical roots, touching on Node's arrival on Windows and its evolution through node-webkit (now NW.js) and Electron.
The team behind Tailwind CSS is joining Shopify, though they say "nothing changes with Tailwind CSS or any of our other open-source projects."
🔒 Two men have been arrested over the TeamPCP npm supply chain attacks. TeamPCP is suspected of cloning the Shai-Hulud worm, resulting in the so-called 'Mini Shai-Hulud' waves.
📺 How can someone actually change JavaScript? A two-minute explainer of the basics from TC39 delegate Mikhail Barash.