Node Weekly

The NodeConf EU 2026 talks are online

Thu, 15 Oct 2026 00:00:00 +0000

#644 — October 15, 2026

📝 We're taking next week off and will be back on Thursday, October 29.
__
Peter Cooper, your editor

Skia Canvas 4.0: A Fast Canvas Environment for Node — Based on Google's Skia graphics engine, it produces results similar to Chrome's own canvas. GPU accelerated and can render images, paths, fonts, shapes, etc. both to static images and live in a native window. v4.0 is faster, lighter, and adds native PDF loading. GitHub repo.

Christian Swinehart

Cut Your GitHub Actions Times and Costs in Half — Faster Node builds with better hardware, unlimited concurrency, no queueing delays, and no commitments. Change one line and get started with $50 in free credits using code START50.

WarpBuild sponsor

▶ The NodeConf EU 2026 Talks — NodeConf EU took place in Italy a few weeks ago and the talks just dropped onto YouTube today, covering topics from Node's new FFI features and Emscripten and WebAssembly to V8 heap management and performance profiling.

NodeConf EU / YouTube

IN BRIEF:

Deno is joining Cloudflare to work on folding celld into workerd. Deno itself will get a year of updates before, hopefully, becoming community-maintained.
Node.js v26.12.0 (Current) has been released. Configuration files are now stable as a way to define runtime, test, watch and permission settings.
Node.js v24.22.0 (LTS) has also been released and brings util.throttle and util.debounce to the LTS release.
🔒 Security releases of Node are expected next Wednesday, October 21 across 26.x, 24.x and 22.x release lines to fix at least one 'HIGH' severity issue. Also, Node 24 enters maintenance on October 20, and Node 26 becomes the active LTS line on October 28, the day Node 27's first alpha is expected.

Using AWS Lambda Web Functions for Deploying Node Apps — Amazon has launched AWS Lambda Web Functions, a way to run standard HTTP apps (using Express, Hono, Fastify, etc.) on Lambda without needing to rewrite your code around an event handler.

Wood, Wendt, and Karak (Amazon)

📊 WebSocket Servers in JavaScript: Node.js vs Bun vs Deno — It's great to see a win for Node 26 with uWebSockets.js here, with its results getting close to C's low levels of latency, ahead of Bun and Deno.

Daniel Lemire

Up to 10x Faster Postgres for I/O-Heavy Workloads — Managed Postgres on local NVMe, natively integrated with ClickHouse for real-time analytics.

ClickHouse Managed Postgres sponsor

📄 Zod 4 Got Rid of a Bunch of CPUs for Us – Up to 31% less CPU after upgrading from Zod 3. Chris Arderne (Trigger.dev)

📄 Fast Node.js is Mostly About Doing Less Ishtmeet Singh (NodeBook)

📄 The Disappointing Death of Deno Brett Chalupa

🛠 Code & Tools

TanStack Start 1.0: A Full-Stack Framework Reaches Stability — The increasingly popular full-stack framework for React and Solid goes stable, bringing typed server functions and streaming SSR to apps deployed on Node, Bun, Cloudflare Workers and other targets. Here's how it compares to Next.js.

Tanner Linsley et al.

ImapKit: A Scriptable IMAP Server for Testing Email Clients — An embeddable IMAP server for testing mail clients, with in-memory mailboxes, extensions for numerous IMAP features, and scripted 'faults' to test robustness. Runs inside your tests or can be driven from other languages via a REST API.

Postal Systems OÜ

⭐ Express 5.3 Released — No big new features, but a large number of bug fixes and minor improvements, including to security.

Express.js Team

caniname: CLI Tool to Check Project Name Availability on Netlify and npm — It's also easy to add checks for other systems.

Bramus van Damme

fast-cli 6.0 – Sindre Sorhus's tool to run download/upload speed tests. A neat way to quickly test speeds as you can run it with npx -y fast-cli.
p-queue 10.0 – Promise queue with concurrency control and rate limiting. v10 has zero dependencies, becomes an EventTarget, and runs tasks in the caller's AsyncLocalStorage context.
actions/setup-node 7.1 – GitHub's official Action for installing Node in CI workflows. It can now read the Node version from a mise.toml file.
Happy DOM 21.0 – JavaScript implementation of a browser without a GUI, popular for testing. v21 disables external stylesheet and iframe loading by default.
p-map 7.1 – Library to map over promises concurrently. Now with pMapSettled, keyed variants for objects and Maps, and pMapStop to break out early.
RandExp.js 0.6 – Library to generate random strings that match a regex.
node-oracledb 26.0 – Oracle's official Oracle Database driver.

Overheard on Hacker News

“Why reimplement Node? It works. Marginal performance or UX or security benefits are not enough.”

___
Ryan Dahl on the news that Deno is joining Cloudflare.

When worker threads beat processes for Node efficiency

Thu, 8 Oct 2026 00:00:00 +0000

#643 — October 8, 2026

Read on the Web

📝 We're back after taking last week off – you didn't miss an issue :-) If you want one neat thing to check out today, look for the voice synth package below, it's a fun way to relive a bit of 80s nostalgia!
__
Peter Cooper, your editor

How Booking.com Cut the Cost of Its Biggest Node.js Service by 38% — The online travel company moved its biggest React SSR service from pm2’s process-based cluster approach to Platformatic’s Watt and worker threads, then tuned load balancing and V8’s GC to get noteworthy gains.

Ilya Malyavin (Booking.com)

100+ Search Engines. One Simple API — Build with real-time search data from Google, YouTube, Amazon, and more. SerpApi delivers structured results in JSON and Markdown for AI agents and your next app. Skip scraping headaches. Start building with a simple API.

SerpApi sponsor

Node.js 26.11.0 (Current) Released — A more substantial minor release than usual with a new --process-timeout flag that ends a process after a set time (even mid-busy-loop), node:sqlite gets virtual table support, Buffer.stringLength(), and Alpine (x64) is promoted to tier 2 support.

Antoine du Hamel

⚠️ 26.11 also rolled out the new docs design, but a bug was found that caused the docs to not render to HTML, so v26.11.1 reverts back to the old docs design for now.

IN BRIEF:

While we were away last week, VoidZero dropped Vite+ 1.0, its single command (vp) Node.js version, package, and frontend toolchain manager. Node's download page has already updated to offering Vite+ as an option.
With this commit, future releases of Node should load most ES modules synchronously, only taking the async path for top-level await, loader hooks and the like.
V8 15.5 has landed on Node's main branch, ahead of Node 27. A big jump from Node 26's V8 14.6.

Optimizing Objects with null Prototypes — In V8, objects created with { __proto__: null } or Object.create(null) start off in a slower ‘dictionary mode’. Creating a plain object and nulling the prototype afterwards keeps it fast, as Matteo shows.

Matteo Collina

I Tested 11 HTTP Resilience Libraries — ffetch's creator tests how a variety of fetch wrappers (like Ky, ofetch, and Wretch) handle retries, timeouts and cancellation, and where those policies interact badly.

Gabor Koos

Find Auth Gaps in Your Node APIs Before Hackers Do — SonarQube Hunter Agent hunts intent-based vulnerabilities and drops verified findings right into your issue list.

SonarSource sponsor

📄 Node.js Thread Pools on Busy Machines – Why sizing the thread pool from the CPU count backfires when other processes share the machine. Matteo Collina (Platformatic)

📄 Maintaining wait-on at Agent Speed – wait-on's new co-maintainer reflects on his first week managing things agent-style. Kevin Old

📄 How to Compile JavaScript into a Single Executable – A comparison of the Node, Bun and Deno approaches. Flavio Copes

🛠 Code & Tools

DOCX 9.9: Generate Word .docx Files from JavaScript — A comprehensive library for generating docx files. 9.8 recently added support for charts, shapes and watermarks, and 9.9 adds a way to lay out documents the way Word itself does. Homepage.

Dolan Miu

H3 v2: The UnJS HTTP Framework is Rebuilt on Web Standards — A minimal HTTP framework best known for powering Nitro and Nuxt’s server layer. v2 is a rewrite around standard Request and Response, so one app runs on Node, Bun, Deno and Workers, with URLPattern-style routing and (event, next) middleware. More info here.

Pooya Parsa

🤖 Klattsch: Retro 1980s Vocal Synthesis — 1980s-style phonemes to speech in a single npm package! It's very flexible, you can even make it sing, akin to HAL in 2001. Works in Node but you can also run it in the browser.

Crash United

Feedsmith 3.0: Fast Web Feed Parser and Generator — Parse and generate RSS, Atom, and JSON feeds from JavaScript, in both browsers and Node. v2.x users will find this migration guide useful.

Maciej Lamberski

pnpm 12.10 – An experimental loaded linker lets Node load dependencies straight from pnpm's store, skipping node_modules linking.
Hono 5.0 RC – The web-standards server framework goes ESM-only, requires Node 22.12+, and moves runtime adapters into separate packages.
Execa 10.1 – The process execution library fixes behaviors you may have relied on, like extendEnv: false still inheriting process.env.
Effect 4.0 – The TypeScript effect system gets a rewritten dependency-free core and consolidated packages.
⚠️ Handlebars 4.7.10 – Fixes two critical JavaScript injection flaws. Earlier 4.x releases are affected.
he 2.0 – Mathias Bynens' HTML entity encoder/decoder gets its first release in 8 years and moves to ESM with named exports.

📰 Classifieds

CodeAF fixed 2x OpenCode's issues and nearly 4x Claude Code's on the same model, at up to 4.8x less per fix. New release, open source.

🚫 Ban the device, not just the account. Fingerprint's visitor ID catches ban evaders — even incognito or behind a proxy.

📢 Elsewhere in the ecosystem

.node domains? Confused by the huge number of TLDs available to register? Get ready for more as ICANN has unveiled a whole new round of them – you can browse the proposed new gTLDs here which… includes .node!
Sindre Sorhus, the prolific npm package author, has disabled outside pull requests on his repos due to AI, but will keep maintaining them.
Daniel Lemire timed linking the Node binary with GNU ld, gold, and mold. Mold won easily, which may be useful if you're rebuilding Node a lot.
Theo Browne's ts-rust is an experimental Rust port of the TypeScript 7 compiler, built almost entirely by AI agents.
📊 The 2026 Stack Overflow Developer Survey results are out, drawing on 30,903 responses.

12 Node built-ins that replace npm packages

Thu, 24 Sep 2026 00:00:00 +0000

#642 — September 24, 2026

Read on the Web

⚠️ We're taking a week off next week, so we'll be back on Thursday, October 8.
__
Your editor, Peter Cooper

Node.js Built-ins That Replaced npm Packages — A practical tour of 12 Node built-ins that replace packages like axios, dotenv, nodemon and chalk. Each is explained with its stability level in Node 24 LTS and gotchas that might make you want to stick with your existing dependency anyway.

Flavio Copes

CodeAF: The Open-Source Software Factory for Open Models — Instead of juggling a terminal for every agent, you get one window for every project. Hand work off: it splits it into parts, runs them in parallel, tests what comes back and merges what passes. Many models, one session: the right one for each call.

AgentField.ai sponsor

Node.js 26.10.0 (Current) Released — Built-in, promise-based util.debounce() and util.throttle() arrive, complete with AbortSignal support. There’s also util.markPromiseAsHandled() to help retire .catch(() => {}) hacks. Plus a little more besides.

Antoine du Hamel

💡 Node v22.23.3 (LTS) also landed with updated root certificates and dependencies (OpenSSL, npm, and Undici) plus minor fixes.

IN BRIEF:

From Node.js 27, Intel Macs drop to only having 'experimental' support, meaning no official x64 macOS builds and an arm64-only installer.
James Snell has proposed a --process-timeout flag that kills a stuck process, even one in a tight loop, and reports what kept it alive.
GitHub Actions has removed Node 20 from its runners so if you maintain an action, switch runs.using to node24 and publish a new release.
Yagiz Nizipli has opened a PR that shrinks the node binary by about a third (147MB to 95MB on macOS arm64) using extra compression and stripping symbols. Notably, 𝕏 Grok was used to do this work.
Daniel Lemire explains how AI-assisted experimentation made several libraries that ship in Node faster, including Ada, simdjson and simdutf.

npm Tokens Can Now Stage Releases Without Publishing Them — A new token permission lets CI stage npm releases but not publish them, with a maintainer approving each staged version with 2FA. It offers a migration path ahead of npm's planned ending of direct publishing using bypass-2FA tokens in January 2027 if you can’t use trusted publishing yet.

GitHub / npm team

📄 How I Traced a Node.js Streams Bug in Duplex.from() – A first-time core contributor's path from issue to PR. Aman Chadha

📄 Publishing a Subfolder to npm for Cleaner Package Paths – How to keep dist/ (or src/) out of your package's import paths. Bramus

📄 Faster SSE Responses with Async Generators and Promise.race() Valeri Karpov

🛠 Code & Tools

secure-eval-worker: A Safer eval() via Node's Permission Model — A new way to run untrusted (or AI-generated) JavaScript in a locked-down worker with timeouts, memory caps, and access only to the host functions you choose. Node 26 only, and not a true sandbox.

Matteo Collina and Luca Maraschi

🔒 CVE Lite CLI: Scan Your Lockfile, Get the Upgrades to Run — An OWASP-backed scanner that reads your lockfile, checks it against OSV and npm’s advisories, and gives you npm/pnpm/Yarn/Bun commands to use, including which parent package(s) to bump for transitive issues.

Sonu Kapoor and OWASP

Your Nightly Rollup Job Is a Query That Got Too Big — TimescaleDB extends Postgres with continuous aggregates to keep rollups fresh. No batch job. Get $1000 credit to start.

Tiger Data (creators of TimescaleDB) sponsor

🤖 Transformers.js v4.3: Run AI Models from JavaScript — Adds support for structured output (e.g. JSON), using WebGPU on Safari 26+, and DeepSeek v4. The docs have had an overhaul and there’s now an agent skill you can use.

Hugging Face

vitest-gpu and jest-gpu: Test WebGL and WebGPU Code Without a Browser — Vitest and Jest environments that give tests WebGL and WebGPU contexts in Node, so you can compile shaders, run compute passes, or diff frames against baselines sans browser.

Ben Houston

Superdiff 4.3 – A library that produces diffs of objects, arrays and text. v4.3 can now diff code by line and token too (above).
dotenv 18.0 – The popular .env file loader. v18 adds a CLI and a faster opt-in parser, but drops -r dotenv/config preloading in favor of dotenv run --.
Tinypool 2.2 – Minimal worker thread pool and Piscina fork. Now accepts a URL instance as the filename.
NestJS 12.1 – Now with built-in cookie support, CSRF protection, and security headers.
mongodb-memory-server 11.3 – Spin up real MongoDB servers for tests.
SuperTest 7.3 – Library for testing Node HTTP servers using a fluent API.
SQL Formatter 15.9 – Library for pretty-printing SQL queries.

📰 Classifieds

🚫 Ban the device, not just the account. Fingerprint's visitor ID catches ban evaders — even incognito or behind a proxy.

🎟️ Join us at Supabase Select on October 2. Get first-hand information about what's coming soon in Supabase. Apply to attend with 25% off: SUPAWEEKLY.

📢 Elsewhere in the ecosystem

pnpm 12.6 can now dedupe dependency versions across a workspace as it installs, keeps node_modules working after a project is moved (macOS and Linux only), and adds --save-types for @types/* packages.
Coding agents quadrupled Linear's test suite, so its team reworked their CI to get costs down: rewriting type-aware ESLint rules as plain AST checks cut lint time 55%, and selectively disabling Vitest's isolation saved a further 17% a month.
Cloudflare's Sunil Pai wrote about the senior engineer 'death spiral', where you go quiet for weeks to prove yourself in a new role and end up burning out.
🧪 A 'periodic table' of all 115 standard HTML elements!

Node 26.9 turns on FFI by default

Thu, 17 Sep 2026 00:00:00 +0000

#641 — September 17, 2026

Read on the Web

Why (and How) GitHub Ported Copilot's Runtime from Node to Rust — GitHub's Copilot runtime moved to Rust, ported in pieces behind napi-rs shims while shipping daily. Startup times and memory usage inspired the move, but the gold for porters is in the regressions they hit involving number types, || semantics, and blocking the event loop.

Stephen Toub (Microsoft)

That p99 Spike Is One Slow Analytics Query — One endpoint runs an analytics query over millions of rows, and latency spikes for everyone. TimescaleDB extends Postgres so that query returns in milliseconds at scale. Hypertables, compression, continuous aggregates. Get $1000 credit to start.

Tiger Data (creators of TimescaleDB) sponsor

IN BRIEF:

Node is to get util.debounce() and util.throttle() functions, two staples of utility libraries. They've landed on main for a future release.
🔒 Moment.js 2.31.0 is a key update. The date library is in 'maintenance mode', but gets 25M downloads a week, and v2.31.0 fixes a path traversal vulnerability.
The Node.js Web Team's redesigned API docs have been merged and should reach nodejs.org/api alongside a release soon.
In Node 27, the HTTP client will reject responses with more headers than request.maxHeadersCount (1000 by default right now) instead of just truncating them.

Node.js 26.9.0 (Current) Released — A reasonably significant minor release that brings a few new things to the table:

node:ffi is enabled by default (but still experimental), so you can call functions in native libraries without writing an addon.
node:bench is a new benchmarking module modeled on node:test.
Web Workers now have an experimental implementation (behind a flag), so browser-style new Worker() and postMessage, etc. can be used.
Worker threads start up to twice as fast (per initial benchmarks) and use less memory, as they now start from Node's built-in snapshot.

Antoine du Hamel (Node.js Team)

Stay Sharp in the Age of AI — Master.dev instructors build at Anthropic, OpenAI, Netflix, Google, and Stripe. Learn from them via courses, workshops, and AI learning paths. New members get $100 off a yearly membership.

Master.dev sponsor

📄 Connection Reuse is the Money – How a webhook sender cut its repeat TLS handshakes with one Undici Agent per destination. Mike Murray

📄 Email, Decoupled from Where and How – The design behind Upyo, a web-standards-based email library for Node, Deno, Bun and edge runtimes that works with many providers. Hong Minhee

📄 A Deep Dive into JavaScript Engines: Writing Code That Makes V8 Happy Audrey Doyen

📄 Five Software Engineering Roles for Working with AI Nicholas C. Zakas

📄 How to Implement a Distributed Circuit Breaker Gabor Koos

🛠 Code & Tools

Eraser Diagrams: Diagrams as Code, Minus the Layout Engine — A Node API/CLI for rendering JSON diagrams to PNG or HTML. Unlike Mermaid or D2, there's no auto-layout engine, so you (or your LLM!) get to control just where things go, while connection routing, icons and styling are handled for you.

Eraser

@platformatic/memcached: A Faster memcached Client — A zero-dependency memcached client built on the modern meta protocol, pipelining over a single connection. Claims to be "roughly 3x" the speed of alternatives.

Matteo Collina (Platformatic)

jsdom 30.1: The Release That's 'Feeling the AGI' — The pure-JS DOM implementation gets faster DOM construction, mutations, getComputedStyle() and event dispatch, plus lower memory use. Much of it came from Scott's Codex-assisted PRs, which Domenic praises for being carefully curated.

Domenic Denicola and Scott Cooper

XO 5.0 – The zero-config ESLint wrapper now lints package.json files and enforces import file extensions in TypeScript.
officeParser 8.0 – Parse Office files (docx, pptx, xlsx, etc.) and PDFs into an AST. Now with a rewritten PDF extractor.
oclif 6.0 – Salesforce's framework for building Node CLIs drops support for installing legacy plugins.
pg-boss 12.33 – The Postgres-backed job queue adds a TestClock so tests needn't wait on timers.
Aedes 1.2 – Barebone MQTT broker that runs on any stream server.
🔒 Express 4.22.3 – A security release for those on Express 4.

📰 Classifieds

⚡ Zuplo puts every API, AI, and MCP request behind one gateway. Route traffic, guard your MCP servers, and cap your AI costs. Try it free.

🛡️ Not all bots deserve blocking. Fingerprint Bot Detection stops content scrapers while letting legit AI agents through. Try for free.

🎟️ Join us at Supabase Select on October 2. Bring your hardest questions to the engineers building Supabase at the Ask Supabase booth. Apply to attend with 25% off: SUPAWEEKLY.

📢 Elsewhere in the ecosystem

npmchart.com (above) is a new option for tracking download trends and repo activity of npm packages. Here's the chart for express, for example.
A review of sixteen weeks of package manager releases across ecosystems finds similar new defences rolling out, like cooldowns, blocking install scripts (as in npm 12), and publish-time scans, which npm has done since July.
Those npm 12 defaults won't reach current Node lines, though. Last month, the Release WG decided npm 12 is "far too disruptive" for Node 22, 24 or 26, so it'll arrive in Node 27.
GitHub Actions has a new cache-mode setting to limit cache access per workflow or job, a defence against the kind of cache poisoning that compromised TanStack's npm packages in May.