Node Weekly

37 CLI best practices for Node devs

Thu, 2 Jul 2026 00:00:00 +0000

#631 — July 2, 2026

So You Want to Land Your First Node.js Core Contribution? — Joyee Cheung has put together a new, official guide for anyone considering making their first contribution to the Node project, including where to look for issues to work on and how to improve the chances of your work making the cut.

Joyee Cheung

Your Autonomous Engineering Team, in TypeScript — One call spins up an orchestrated fleet — planner, architect, coders, QA, reviewers — that plans, builds, tests and ships production-grade PRs. TypeScript SDK, agents as typed APIs, open- and closed-source models.

AgentField.ai sponsor

37 Node CLI App Best Practices — A long-standing, but now modernized, set of guidelines for building “successful, empathic and user-friendly” CLI tools, plus an appendix rounding up the most popular CLI framework options. Now also includes a SKILL.md file you can point agents to.

Liran Tal

IN BRIEF:

Nub, a toolkit that adds useful features to Node (rather than replacing it), is now a single self-contained binary and has added a web-standard Worker mechanism to Node.
🔒 npm now locks 'high impact accounts' (those maintaining the most popular packages) into a 72-hour read-only mode when they change their email or use a 2FA recovery code.
npm 11.18.0 promotes the linked install strategy to stable, where packages are installed in node_modules/.store and linked in place, so code can only reach dependencies it actually declared. More info here.

Why Drizzle ORM Couldn't Publish New Releases on npm for a Month — As well as explaining why the popular ORM ran into the problem, Evert shares tips to see if you run a similar risk, and how to mitigate it.

Evert Pot

Iterating Faster on VS Code with TypeScript 7 — The tale of how the VS Code team adopted the Go-based TypeScript 7 compiler and got a 7x reduction in type checking time.

The VS Code Team (Microsoft)

📄 Roll Your Own File-Based Router in Under 50 Lines of Code – One for users of Wasp, the Node.js + React + Prisma full-stack framework. Carlos Precioso (Wasp)

📄 Finding Memory Leaks with Heap Snapshot Analysis in N|Solid – Using the N|Solid extension to capture a heap snapshot to trace a memory leak in VS Code. Estefany Aguilar (NodeSource)

🛠 Code & Tools

Node-GTK 4.0: GTK Bindings for Node — Bindings to the popular GTK desktop widget toolkit for building Linux, macOS and Windows apps. Now supports Node 26 and includes an npx node-gtk create app-name command to spin up a project. Worked well on macOS once I had the dependencies in place!

Rom Grk et al.

Schedule Node.js Scripts Across Your Server Fleet with xyOps — Run unlimited Node, Shell, HTTP, and Docker jobs with live logs, alerts, snapshots, and visual workflows. Self-hosted.

xyOps sponsor

🤖 Vercel AI SDK 7: An SDK for Working with AI Model Providers — Provider-agnostic library for building AI apps (no Vercel services needed). v7 focuses on agents, but adds WebSocket sessions for real-time transcription/voice agents, and video generation support for several providers.

Martynus, Grammel, Arntz, et al.

Electron 43: Faster Startup and V8 15 — Updates to Chromium 150, Node 24.17, and V8 15, with faster startup via a Node boot snapshot and bytecode-cached preloads. Adds rounded corners on Linux, matching Windows and macOS. v43 is also the final line to ship 32-bit binaries.

John Kleinschmidt

Deno 2.9 – The alternative runtime rolls out its new desktop app generator, improves support for npm/pnpm/yarn/Bun lockfiles, improves its test runner substantially, and more.
Git 2.55 – Adds git history fixup for 'fixing up' earlier commits, faster git status on Linux, and more.
pg-promise 12.7 – Node 26 is now officially supported by the popular Postgres client library.
Middy 7.7 – Node.js middleware engine for AWS Lambda. (Release notes)
Fastify 5.9 – Lots of bug fixes, and introduces request.mediaType.
Knex 3.3 – Batteries-included, multi-dialect SQL query builder.
JS YAML 5.2 – Fast YAML 1.2 parser and writer library. (Demo.)

📰 Classifieds

🚀 Crystallize is hiring a remote SRE: Node/TS, GraphQL, AWS, MongoDB, Cloudflare Workers.

Node.js 26.4 lands package maps

Thu, 25 Jun 2026 00:00:00 +0000

#630 — June 25, 2026

Read on the Web

Node.js 26.4 Adds Package Maps — A minor release whose headline feature is the (experimental) implementation of package maps (which let Node resolve packages from a static JSON file rather than walking node_modules). Matteo Collina’s node:vfs subsystem also begins to make an appearance.

Antoine du Hamel

💡 Node v24.18.0 (LTS) and v22.23.1 (LTS) have also been released.

That Analytics Route is Blocking Your Event Loop — Crunching big result sets in Node ties up the event loop and stalls other requests. TimescaleDB extends Postgres so the database aggregates instead. Hypertables, 95% compression, continuous aggregates. No second database. Get $1000 credit to start.

Tiger Data (creators of TimescaleDB) sponsor

Blocking Install Scripts is Not a Silver Bullet — npm v12 won't run install scripts by default, but Ulises argues that only removes one attack trigger, not a capability, since a compromised dependency’s code still runs on import! He shows why, even then, Node's permissions model and sandboxing are the layers that actually limit what that code can do.

Ulises Gascon

IN BRIEF:

The first preview release of npm 12 is here if you want to get testing.
Deno has begun to show off a new feature to create cross-platform desktop apps. Think Electron-style apps, but on top of Deno with cross-compilation, framework auto-detection, and a choice between bundling a Chromium runtime or using the system's WebView.
Vercel has opened a public beta of WebSockets support in Vercel Functions. You can write normal Node.js code using ws with no extra setup.
The pnpm project is working on pnpr, an experimental pnpm-compatible npm registry server, written in Rust.

What If npm Ran on AT Protocol? — James, a long-standing Node core contributor, ponders what a package system built atop the protocol Bluesky uses could look like: “It’s just an idea I couldn’t get out of my head until I wrote it down.”

James M Snell

Benchmarking 5 WebSocket Servers for Node.js — A banned IP, a lying load generator, and a 20× latency illusion turned a routine benchmark run into quite the detective story.

Irina Nazarova

Your Node App Has an N+1 Problem. AppSignal Shows You Where — Auto-detects N+1 queries in Prisma, Express, and Koa. One install, minutes to first trace. Free 30-day trial, no card.

AppSignal sponsor

📄 JavaScript Still Can't Ship a 'Full-Stack Module' – Thoughts on modules which provide frontend and backend code ready to go, as you might see in ecosystems like Rails and Laravel. Mihovil Ilakovac

📊 The Performance of WebAssembly Runtimes in 2026 – Mostly focused on dedicated options, but also including Node/V8. Frank Denis

🛠 Code & Tools

🤖 Eve: A Next.js-Style Framework for Building Agents — A new framework from Vercel that provides Next.js-esque structure for building AI-powered agents using TypeScript and Markdown. It's quite Vercel-flavored by default, but I found you can run it entirely independently of Vercel with a few settings tweaks and your own keys. Project homepage.

Vercel

TypeScript 7.0 Release Candidate — A step closer for the Go-powered TypeScript compiler that promises ~10x faster build performance. A reminder that moduleResolution: node / node10 are no longer supported and @types packages you need have to be listed explicitly.

Daniel Rosenwasser (Microsoft)

🔐 AccessControl 3.0: Role and Attribute-based Access Control — A role and attribute-based (RBAC/ABAC) access control library that, as of v3, now has a real policy engine available to apply conditions to grants, enforced ownership, mandatory restriction gates, audit hooks, and more. GitHub repo.

Onur Yıldırım

Camaro 6.5: A High Performance XML to JSON Converter — Uses bindings to pugixml, a fast C++ XML parser.

Tuan Anh Tran

Tedious 20.0 – TDS module for connecting to SQL Server. A related release is the SQL Server client library node-mssql 12.6 which uses Tedious (or msnodesqlv8).
Chardet 2.2 – Character encoding detection library that uses statistical methods to detect around 30 different encodings.
cookie 2.0 – HTTP cookie parser and serializer library. Now faster and ESM only.

📰 Classifieds

🧐 Where to host? Judoscale’s cost comparison calculator puts the PaaS alternatives head-to-head.

⚙️ Run AI agents like microservices — every agent an auto-generated API: schemas, versioning, no glue code. 100+ recipes, TypeScript SDK. → Star on GitHub.

📢 Elsewhere in the ecosystem

A roundup of some other interesting stories in the broader landscape:

Cloudflare has added the ability to create and deploy Workers on 'temporary accounts'. Ostensibly 'for AI agents', but you can use them yourself too, and get a Worker (which have increased Node.js compatibility nowadays) running for 60 minutes with no strings attached.
The Bun team has proposed adding shared-memory threads to JavaScriptCore (a more traditional threading approach versus worker threads).
🔒 GitHub has released actions/checkout v7 that "refuses common pwn request patterns by default" including refusing to fetch fork pull request code in pull_request_target and workflow_run workflows.

Extending Node instead of replacing it

Thu, 18 Jun 2026 00:00:00 +0000

#629 — June 18, 2026

Read on the Web

Nub: An All-in-One Toolkit That Augments Node — While Bun and Deno try to replace Node, this project from Zod’s creator (and a former Bun employee) extends your existing Node and package manager with nice-to-haves, like fuller TypeScript support (beyond what type stripping offers), faster and more secure package installation, and fuller .env handling.

Colin McDonnell et al.

Free Claude Code Course from Anthropic + Master.Dev — Coding is changing fast, and the engineers who thrive will be the ones who direct AI instead of guessing at it. Lydia Hallie from Anthropic teaches exactly that in our Claude Code course, now free for everyone.

Master.dev sponsor

Node.js 26.3.1, 24.17.0, and 22.23.0 Released — The latest round of security releases is here, with 26.3.1 (Current), 24.17.0 (LTS), and 22.23.0 (LTS) fixing eleven vulnerabilities. Two are of 'high' severity: one around normalizing hostnames for server identity checks in tls, and the other in WebCrypto.

Antoine du Hamel

🔒 The releases above also include Undici 8.5.0 which has addressed some security advisories of its own.

IN BRIEF:

As npm prepares to disable install scripts by default, Andrew Nesbitt looks at how other tools and ecosystems handle install-script allow-listing.
Iroh 1.0 is a peer-to-peer encrypted networking stack that punches through NAT and firewalls. It's built in Rust but has official Node.js bindings.
Babel 8.0 has been released: no new features, but with a focus on modernization. It's ESM-only, ships TypeScript types, and no longer compiles to ES5 and CommonJS by default.

Shipping psql Without psql: A Pure-TypeScript Postgres Client — Postgres platform Neon wanted the experience of Postgres’ psql client in their own Node-powered CLI, without the binary dependency. Here’s how they did it using AI, a strong conformance harness, and a security review.

Vadim Kharitonov (Neon)

A Backdoor in a LinkedIn Job Offer — A hacker, posing as a recruiter on LinkedIn, asked the author to diagnose an issue in a Node project, but the dependencies had a backdoor included. Both the recruiter and the git repo involved also used real identities of people unrelated to the scam.

Roman Imankulov

How LinkedIn Unlocked 18x Code Review Throughput — See how LinkedIn used Orkes and multi-agent workflows to scale code reviews 18x.

Orkes sponsor

📄 What are Git Worktrees, And Why Should I Use Them? – A decade-old git feature that's seen a boost in the AI agent era. Cassidy Williams (GitHub)

📄 Setting Node and pnpm Versions in Cloudflare Workers Programmatically – “I’ve wasted a couple of hours so you don’t have to.” Sen Hongo

📄 Wasp Now Lets You Write Your Full-Stack Logic as a Spec in TypeScript – Say goodbye to the React + Node.js + Prisma full-stack framework’s custom .wasp DSL. Martin Sosic (Wasp)

📄 Why pnpm No Longer Expands Environment Variables in .npmrc Zoltan Kochan

🛠 Code & Tools

✉️ Nodemailer 9.0: Easily Send Emails from Node.js — A long-standing, popular way to send emails over SMTP, through SES, or Sendmail. v9.0 now validates TLS connections by default when fetching remote content.

Andris Reinman

zod-compiler: Compile Zod Schemas Into Zero-Overhead Validators — A build-time compiler that plugs into Vite, webpack, et al. and rewrites existing schemas into optimized, tree-shakeable validators, with the full Zod API preserved.

Gajus Kuizinas

💬 Node Telegram Bot API 1.0/1.1 — Interact with the official Telegram Bot API from Node. Now modernized, rewritten in TypeScript, and ESM-only, with Telegram Bot API 10.1 support.

Yago

eslint-plugin-unicorn 67.0: 200+ Powerful Linting Rules — Sindre’s set of rules that will seriously challenge (and improve) your code, whether it's comments, the depth of nested calls, preferring Temporal over Date, and more.

Sindre Sorhus et al.

📰 Classifieds

⚙️ clerk deploy walks your app to production: instance clone, DNS setup, OAuth credentials, SSL check. Guided, resumable, and available now.

AI writes a growing share of Node services, but your reviewer hasn't caught up to its mistakes. pr-af is AgentField's multi-agent low cost reviewer: compiled per PR, runs on open/closed models. → Star & deploy.

XO 3.0 – Opinionated ESLint wrapper that enforces strict and readable code with zero configuration. Includes eslint-plugin-unicorn (above).
Playwright 1.61 – You can now register and test passkeys, as well as read/write to localStorage and sessionStorage via a new WebStorage API.
ESLint v10.5.0 – Five core rules now highlight smaller ranges of code to avoid shadowing other problems in editors.
Axios 1.18.0 – Security fixes and hardening for the promise-based HTTP client.
node-gyp 13.0 – Cross-platform tool for compiling native addon modules.
graphql-js 17.0 – Official reference implementation of GraphQL for JavaScript.
Faker 10.5 – Generate realistic but fake data for testing and development.
Nx 23.0 – Build system for TypeScript and polyglot monorepos.
BSON Parser 7.3 – BSON parser library.

npm install is (finally) getting safer

Thu, 11 Jun 2026 00:00:00 +0000

#628 — June 11, 2026

Read on the Web

npm v12 to Stop Running Install Scripts by Default — After a year of supply chain attacks, npm v12 will no longer execute preinstall, install, or postinstall scripts, unless you allow them with a new npm approve-scripts workflow. You can prepare today by upgrading to npm 11.16.0 which prints warnings about anything v12 would block.

GitHub

🔒 npm install will no longer resolve git or remote URLs by default either – these can be switched on using --allow-git and --allow-remote.

Come for Great PostgreSQL Talks – Virtual and Free — Attend talks about PostgreSQL backed app development at POSETTE: An Event for Postgres 2026 (16-18 June). Join live and chat directly with PostgreSQL speakers, other developers and users. There is also swag waiting for you. Register for updates.

Microsoft | AMD sponsor

Node's New Release Schedule and Version Numbers Explained — Node’s moving to a one major release per year cadence as of Node 27 and adding a new ‘alpha’ channel for testing and experimentation. Luciano goes deep into how it’s happening, when, and why.

Luciano Mammino

IN BRIEF:

🔒 New versions of Node.js v26.x, 24.x, and 22.x will be released on, or shortly after, Wednesday, June 17 to address security issues – the highest severity of which is 'HIGH'.
🔒 As the npm worms/supply chain attacks continue, I was intrigued to see this vulnerability report from 2016 which predicted our current woes.
The Drizzle ORM team is 𝕏 unable to publish new releases to npm due to the registry's 100MB metadata limit. Their package currently has 1,397 versions published and will need some cleanup.
In less alarming registry news, an npm tooling bug briefly marked several packages with one-character names as ‘security holders’ (including c, i, n and x) by mistake. A rollback is underway.

📊 ESM Provision by Popular npm Packages Sees a Big Jump — Titus’s twice-yearly look at what popular packages ship finds 38% now expose ESM (and 16% are ESM only), up from 33.4% six months ago.

Titus Wormer

Your Event-Driven Service Deserves an Event-Ready Database — TimescaleDB is Postgres built for time-ordered data. Hypertables, 95% compression, continuous aggregates. $1000 credit.

Tiger Data (creators of TimescaleDB) sponsor

📄 Uncovering the Magic Behind Playwright's Fixtures API – Learn how Playwright knows which fixtures your test needs just from its function signature. Vladimir Ivakin

📄 I Wish Deno Would Keep Doing What It Does Best – “Early Deno set the agenda (…) What Deno is doing now runs in the opposite direction, catching up to what the ecosystem already has.” Hong Minhee

📄 Creating a VS Code Agent Hook to Respond to File Changes Nicholas C. Zakas

🛠 Code & Tools

Node-RED 5.0: The Biggest Editor Overhaul in the Project's History — The Node.js and 'node'-based low-code environment gets "the biggest change to the editor experience in [its] history": updated sidebars, dark theme (above), pausable debug output, and the ability to call Link nodes from Function nodes.

Nick O'Leary

Bonsai: A Safe Expression Language for User-Defined Rules — A fast, sandboxed expression language for when you need to evaluate user-supplied rules, filters, or templates without reaching for eval. Try the playground.

Daniel Fry

DepsGuard: A Tool to Harden npm, pnpm, Yarn and Bun Configs — Can't wait for npm v12's safer defaults? This Rust-based tool audits and rewrites your package manager config, disabling install scripts, enforcing cooldowns, and blocking provenance downgrades.

Arnica

⭐ Commander.js 15.0 – The popular CLI framework is now ESM-only. v14 will be maintained till May 2027 in case you have trouble migrating.
🎬 NodeAV 6.0 – Direct access to FFmpeg's C APIs with minimal abstractions for working with codecs, filters, streams, and more.
Neutralinojs 6.8 – The lightweight cross-platform app framework gets improved native file drag and drop, and a new default window policy to handle target="_blank" links better.
Juice 12.1 – Automattic's library to inline CSS stylesheets into HTML. A common HTML email production task, as used by MJML and node-email-templates.
Cucumber.js 13.0 – The BDD test framework rebuilds its parallel runtime atop worker threads.
Kanel 4.0 – Generate TypeScript types from a live Postgres database.
Envalid 8.2 – Environment variable validation library.

📰 Classifieds

💘 Dyno Sniper has landed! Judoscale’s latest feature solves the noisy neighbor problem for good.

📬 Debug transactional email without leaving your dashboard. Clerk Email Logs (beta) shows delivery status, bounce reasons, and open/click events.

🕹️ node_modules, Now in 3D!

Wander Around a Heap of Packages in node_modules — An interactive browser experience where you can navigate around a node_modules folder FPS-style. Which, why, how? I don’t know, but when something is by packaging expert Andrew Nesbitt of ecosyste.ms, I check it out.

Andrew Nesbitt