Node Weekly

Bun now passes 80.5% of Node's test suite

Thu, 3 Sep 2026 00:00:00 +0000

#639 — September 3, 2026

NestJS 12 Released with ESM-First Packages, Rspack and Vitest — The progressive framework gets its biggest release in years, going ESM-first (CJS is still an option), replacing webpack with Rspack, adding Standard Schema support for easy interop with Zod, Valibot and friends, plus structured logging, a brand new homepage, and more.

Kamil Mysliwiec

One Slow Query Starves Your Whole Connection Pool — A heavy analytics query holds a connection while everything else waits. TimescaleDB extends Postgres so those queries return fast, freeing the pool. Hypertables, compression, continuous aggregates. One database, not two. Get $1000 credit to start.

Tiger Data (creators of TimescaleDB) sponsor

📊 Bun 1.4 Now Passes 80% of Node's Test Suite — Bun 1.4's headline feature is a big jump in Node.js compatibility as part of its goal of being a "drop-in replacement". This page lets you see the project's progress and where Bun is strong and weak.

Bun Project

IN BRIEF:

Matteo Collina has landed node:ffi enabled by default, so calling into a native C library will no longer need --experimental-ffi, an addon, or node-gyp. It remains experimental, warns on first load, and hasn't shipped in a release yet.
Matteo has also added support for Single Executable Applications to mount their bundled assets as a read-only virtual file system by setting "useVfs": true in the config.
🔒 Express has patched six vulnerabilities across hbs, multer and morgan.
Node's issue tracker reaches issue 2**16 with a proposal to remove dual ESM/CJS code samples in the API docs.

Rewriting a Node.js Service in Go with AI Agents — A very 2026 tale of an overnight porting run, with a focus on doing agentic engineering well. Good takeaways on building a test harness first and the rollout experience.

Edvinas Janusevicius (Checkly)

Your Trace Shows the Slow Span. Not the Exception — OTLP carries traces and logs, not errors. Sentry's OtlpIntegration connects both in one trace waterfall. Learn more about Sentry’s OTLP.

Sentry sponsor

📄 Detecting SQLite Full Table Scans in Node.js – Did you know SQLite counts the rows scanned by statements and you can read it after the query runs? CodeSilva

📄 Workers vs Processes in Node Ishtmeet Singh

🛠 Code & Tools

Drydock: Diff Your npm Tarballs Before You Publish — From a Preact core team member comes a tool to diff built npm tarballs against the last published version, flagging install scripts, network access and new binaries. It can then gate your Actions publish job or watch npm's new staged publishing flow.

Jovi De Croock

💡 You can get a quick taste without installing anything: this web-based diff viewer can compare two versions of an npm package file by file.

srvx 1.0: One fetch Handler for Node, Deno and Bun — You can export a handler that takes a web-standard Request and returns a Response, then run it unchanged on Node, Deno or Bun. Includes a CLI with watcher and static serving, and srvx fetch can hit your handler without starting a server.

Pooya Parsa

NVM for Windows 2.0: Node Version Manager for Windows — A modern Node workflow for Windows users with version pinning, native integrations, auto-install of missing versions, and more. v2 is a rewrite that introduces a lighter shim-based mechanism and no longer needs admin privileges. GitHub repo.

Author Software Inc

Got 16.0: Built-In HTTP/2 and QUERY Method Support — The popular Node HTTP client now has a built-in HTTP/2 client, its own DNS cache, fewer dependencies, and support for the newly standardized QUERY HTTP method.

Sindre Sorhus

SimpleWebAuthn 14.0: Now with Post-Quantum Passkeys — The passkeys library now verifies post-quantum ML-DSA passkeys and, on Node 24.7 and up, prefers ML-DSA-44 at registration by default.

Matthew Miller

Restify 12.0 – The REST API framework returns after a two and a half year gap with Node 26 support and url.parse() replaced with WHATWG URL. Existing users have a few breaking changes to note.
Zod 4.5 – A big performance release for the popular TypeScript-first schema validation library.
np 12.1 – Sindre Sorhus's improved npm publish workflow gets some speedups.
express-rate-limit 8.7 – Rate-limiting middleware for Express.

📰 Classifieds

⚡ Zuplo puts every API, AI, and MCP request behind one gateway. Route traffic, guard your MCP servers, and cap your AI costs. Try it free.

📉 Headout cut chargebacks 90% with Fingerprint. Stop payment fraud with 100+ signals such as Browser Bot and VPN detection.

🎟️ Join us at Supabase Select on Oct 2. Learn from the industry’s best builders and meet people building dev tools. Apply to attend with 25% off: SUPAWEEKLY.

📢 Elsewhere in the ecosystem

htmx 4.0 has landed, the first major release in two years, with lots of changes. It remains a neat way to add interactivity to server-rendered pages without reaching for a frontend framework.
🤔 Upon finding eight versions of glob across five major version lines in his employer's monorepo, James Healy is imploring library maintainers to bump their major versions as rarely as they can.
A developer shares the techniques behind squeezing an implementation of Minesweeper into just 247 bytes of JavaScript.
🤚 The 2026 Node.js user survey is still open. Your responses guide the core team and its priorities.

Node 26.8 reads and writes ZIP files

Thu, 27 Aug 2026 00:00:00 +0000

#638 — August 27, 2026

Read on the Web

🗓️ We're back! If you missed us last week, we took a brief summer vacation :-)
__
Your editor, Peter Cooper

A Recap of Node.js Interactive 2026 — Node.js Interactive returned for the first time since 2019 as part of this month's RenderATL event with Node contributors and invited speakers tackling Node's near-term roadmap in areas like AI, supply chain security, WinterCG becoming Ecma TC55, work on QUIC and HTTP/3 support, and Node's move to one major release a year.

Aviv Keller

Open Source Just Out-Reviewed the Commercial Tools — PR-AF places #2 of 42 on Martian's Code-Review-Bench, ahead of CodeRabbit, Copilot, and Devin, at ~10x lower cost per review. It plans the review per PR, runs reviewer agents in parallel, and verifies every finding against your source. Self-hosted.

AgentField.ai sponsor

Node.js 26.8.0 (Current) Released — Among a variety of additions, Node can read and write ZIP archives without a third-party dependency. Plus Node's REPL now has basic syntax highlighting support. v26.8.1 landed hours later to fix a broken version string.

Antoine du Hamel

💡 Node 24.20.0 (LTS) also landed with several backported features including package maps, permission auditing, node:stream/iter, and WebAssembly JSPI.

IN BRIEF:

🤚 The latest annual Node.js user survey has just launched. As always, your responses help shape the future priorities of the Node.js team.
💡 Aviv Keller has proposed reimplementing fs.glob natively in C++, calling straight into libuv and benching at over twice the speed of the current version. Not landed yet, but there are some big names on this thread.
James Snell is seeking early feedback on a proposed Fetch Server API, part of Node's unified HTTP API initiative, offering one handler model for HTTP/1.1, 2 and 3.
TermDOM, featured in our last issue, lets you build TUI apps with HTML and CSS in Node, and now supports CSS Grid for layout.
AWS Lambda has introduced a new Node.js 26 runtime in preview.

🤖 Node's Official AI Use Policy and Guidelines — Merged into Node's contributing docs after months of debate, PRs with AI code you haven't understood or tested can be closed unreviewed, bot-opened PRs need pre-approval, and more to be aware of. Plus, don't use AI to claim "good first issue" tasks!

Node.js Project

📄 Query Pipelining in node-postgres: 2-3x More Throughput – More throughput and lower latency from one config change is always worth looking into. Matteo Collina

📄 ESM vs CommonJS: What import and require Actually Do Gabor Koos

🛠 Code & Tools

pnpm 12: Rewritten in Rust, Same Commands and Lockfile — The Rust rewrite is stable, but all of v11's commands, flags and lockfile format carry over with only a handful of changes. A global node now follows the version your project pins, too. Note that npm's latest tag still points to pnpm 11, so you'll need pnpm self-update next-12 to upgrade.

Zoltan Kochan

Better Auth 1.7 Ships a Standards-Based OAuth Server — A big OAuth provider release with DPoP, per-API token rules and device code flow, plus MCP auth in its own package. Breaking changes make the upgrade guide required reading.

Gustavo Valverde

Outgrowing Cron? Meet xyOps for Self-Hosted Ops Automation — Schedule jobs, run Node scripts, monitor servers, and automate response. Open source, from the Cronicle team.

xyOps sponsor

GTKX: Build Linux Desktop Apps with Node, GTK and React — Build Linux desktop apps with real GTK4 and Adwaita widgets with no webview involved. Write JSX and get real widgets in an ordinary Node process with npm package and Fast Refresh support.

Eugenio Depalo

Stryker Mutator 10.0: Test Your Tests with Mutation Testing — Stryker deliberately changes your code to see if your test suite catches the mutations. If not, your tests are too lax and need work. Here's how to get started.

Jansen, de Lang, et al.

SVGO 4.1: Node-Powered SVG Optimizer — SVGs often contain redundant information. You can use SVGO as a CLI tool or Node library to slim them down. v4.1 has stricter XML validation and security improvements.

Kir Belevich

Electron 44 – 32-bit builds are gone, macOS 13+ is now required, clipboard is aligned with the W3C Clipboard API, net.WebSocket is added, plus the ability to set window opacity on Linux.
lz4-napi 2.10.0 – N-API bindings for LZ4 compression/decompression, implemented in Rust and backed by lz4_flex.
🤖 grammY 1.46.0 – The framework for building Telegram bots from Node now supports the latest Telegram Bot API 10.3.
Axios 1.20.0 – The long-standing HTTP client for the browser and Node.js.
node-mongodb-native 7.6 – MongoDB 4.2 support has been dropped entirely.
📺 YouTube.js 18.0 – JavaScript client for YouTube's internal API.
node-x11 4.1 – Feature-rich X11 protocol client library.

Building terminal UIs with HTML and CSS

Thu, 13 Aug 2026 00:00:00 +0000

#637 — August 13, 2026

Read on the Web

🗓️ We're taking a summer break next week, so will be back in your inbox on August 27.
__
Your editor, Peter Cooper

TermDOM: Build Terminal UIs with HTML, CSS and the DOM — Like the look of Ink but don't like React? TermDOM implements a DOM, cascade and layout engine that paints to the terminal, so you can write a TUI with HTML and CSS. Pure JS, no native or WASM dependencies, and the official TodoMVC runs with only a stylesheet swap. Early days, but I like the idea!

Brian Kim

Harness Engineering: How to Wrangle Your Agents — The models keep changing. The harness is the part you build. Scott Moss (Netflix) shows how: durable execution, sandboxed tool calls, memory systems, and multi-agent handoffs.

Master.dev sponsor

Fastify 6.0 Enters Alpha — It's been two years since Fastify, the popular low overhead web framework, dropped v5, but v6 is coming into sight. It's largely shaping up as a 'spring clean' release requiring Node 24 at minimum but should be good for initial testing. More background here.

The Fastify Team

IN BRIEF:

Node maintainer Matteo Collina explains how he 'triages the AI horde' when it comes to handling 20-40 security reports each week.
Bun 1.4's release appears to be imminent with 𝕏 Node.js compatibility teased as the biggest enhancement. It hasn't dropped as we go to press, but keep an eye on their blog, as no doubt it'll land minutes after we hit send! 😂
node:domain, deprecated in the docs since 2015, could become runtime-deprecated in Node 27 — if you're still using it, speak up now.
⚠️ Several teams are reporting out-of-memory crashes after upgrading from Node 24.18.1 to 24.19.0 (and rolling back fixes it). Nothing confirmed yet, so add your data if affected.
Vercel now offers a one-click Node.js upgrade mechanism for deprecated Node.js versions (notably new Node 20-based builds will fail after Oct 1).

Adding a Second Middleware Broke Our TypeScript Types — A TypeScript detective story in which adding a second middleware could collapse a return type to {}. The culprit was a widely used key-filtering idiom that leaks undefined when properties are optional.

Linell Bonnette (Inngest)

📄 5 Useful npx Helpers – A reminder that npx makes it easy to run one-off tools. Jens shares five he likes for spell checking, cleaning up JS projects, and more. Jens Oliver Meiert

📄 Fixing the Dual-Write Problem in Node.js with the Outbox Pattern – Making your database and message queue agree. Gabor Koos

📄 A Deep Dive into How Hono Is Built Flavio Copes

🛠 Code & Tools

DeepSeek Harness: DeepSeek's New Node-Powered Agent Harness — Today, the popular Chinese model lab unveiled its own Claude Code-alike and already racked up 30k stars. It's not a typical CLI harness, though, but runs through a web UI. Curiously, everything is a plugin, built atop Cordis, an existing Node plugin system whose author DeepSeek has hired. GitHub repo.

DeepSeek

unbash: Fast 0-Dependency Bash Parsing Library — The parser Knip uses to make sense of shell scripts, as a standalone library. It turns bash code into a typed AST that can then be used for classification, permission checks, rewriting commands, and more.

Lars Kappert

Full-Text Search in Drizzle Without a Second System — Try the official ParadeDB integration for Drizzle. Search your live Postgres tables. No ETL, no Elasticsearch cluster.

ParadeDB sponsor

njsscan 1.0: A Semantic-Aware SAST Tool for Node — A pip-installable, zero-config security scanner that finds insecure patterns in Node apps using ~70 semgrep-powered rules for XSS, SSRF, eval, JWT and NoSQL injection.

Ajin Abraham (OpenSecurity)

Hucre 1.0: A Zero-Dependency Spreadsheet Engine — A library for reading and writing common spreadsheet formats, including things like embedded images, hyperlinks, password protection, and tables.

Wind

NodeBB 4.15.0 – The Node-powered forum software (demo site here) gets lots of bug fixes and enhances fediverse support.
smol-toml 1.8 – Small, fast, spec-compliant TOML 1.1 parser/serializer.
BullMQ 6.1 – Fast, reliable Redis- or Postgres-based distributed queue.
swift-node 0.1.2 – Write the native part of a Node module in Swift.
Vitest 5.0 Release Candidate

We'll be back in two weeks on August 27 – see you then! Unless you're a React Status subscriber too, in which case… see you tomorrow ;-)

Node.js 26.7, vlt 1.0, and Shai-Hulud Returns

Thu, 6 Aug 2026 00:00:00 +0000

#636 — August 6, 2026

Read on the Web

Node.js 26.7.0 (Current) Released — Landing just two days after 26.6, coverage reports can now include files your tests didn't touch with --test-coverage-include-all, FFI and SQLite pick up crash fixes, and Perfetto tracing support lands, though you'll need a custom build to use it.

Antoine du Hamel

💡 Node v24.19.0 (LTS) is also a noteworthy update, adding --experimental-import-text, fs.readFile() can reuse a buffer you supply, and setKeepAlive exposes TCP_KEEPINTVL and TCP_KEEPCNT.

Join Sentry Live: How Etsy Stays Crash-Free — Sentry and Etsy break down how Etsy's engineering team preps for peak traffic, debugs in real time, and ties crashes to revenue impact. Real stories and practical takeaways for teams running services at scale.

Sentry sponsor

🚨 Shai-Hulud Strikes Again, Affecting keyv and 400+ Packages — A credential-stealing worm was rolled out as part of a false keyv 6.0 release this week, and quickly spread. A reminder to check out npm v12, pnpm, or vlt (below), all of which block install scripts by default, the mechanism this worm relied on.

Shavit Satou (JFrog)

vlt 1.0: An npm Alternative With CSS-Like Selectors — After two years, Darcy Clarke's drop-in npm alternative hits 1.0. A key draw is vlt query, which lets you use 60+ CSS-like selectors over your dependency graph (half of which are security related). vlt also offers hosted private package registries.

Darcy Clarke

💡 In 2023, Darcy wrote "The massive bug at the heart of the npm ecosystem", a post that was prescient of current packaging headaches.

IN BRIEF:

⚠️ The Express team has announced security releases for body-parser to address a DoS vulnerability.
net.BlockList, used to prevent network access to/from specified IP addresses and ranges, is gaining new methods and getting much faster.
There's a proposal and initial implementation to bring the HTML spec's Web Worker API to Node.
ZIP archive support is coming to node:zlib in a future release.

📄 What's New in Mongoose 9.9: Major Performance Improvements – Mongoose is a popular MongoDB object modelling solution. Valeri Karpov

📄 Debugging Stuck Node.js Processes – A trick for catching event loop blockers that never yield. Winona Schroeer-Smith

🛠 Code & Tools

anydoc: Convert 14 Document Formats into Markdown — A Rust-powered library (with Node.js and WASM bindings) that converts Word, PowerPoint, Excel, OpenDocument, RTF, EPUB, CSV, and PDF documents into Markdown. I tried it on a 1,600 page PDF and it took less than 2 seconds. There's also an in-browser demo to try it out. GitHub repo.

Firecrawl

💡 Firecrawl also has pdf-inspector focused specifically on extracting text from PDFs (with positional awareness). Liteparse is also worth considering if you want OCR for scanned / non-text PDFs.

You Added a Cache to Hide a Slow Query — TimescaleDB makes the query fast in Postgres, so you cache less and serve fresh data. Get $1000 credit to start.

Tiger Data (creators of TimescaleDB) sponsor

ioredis 6.0: Robust, Full-Featured Redis Client for Node — v6.0, the first major release in four years, adds RESP3 and support for new Redis 8.10 features.

The ioredis Team

MicroDiff 1.6: Fast Object and Array Comparison Library — Given two objects or arrays, it returns the differences (think diff but for JS objects). This week's release adds support for Temporal types.

Jacob Jackson

Devalue 5.9: Get the Job Done When JSON.stringify Can't — A library from the Svelte project that's like JSON.stringify but can tackle cyclical and repeated references, regexes, Map/Set, and custom types. Try it here.

Svelte

node-x11 3.8 – An X Window System protocol client library with no dependencies, GLX / OpenGL support, and even the ability to work in the browser against a JavaScript X-server emulator.
pnpm 11.20 – Mostly security hardening, but also adds an npmjs: prefix you can use to more succinctly pin a dependency to the public registry. Note that pnpm 12.0 has also reached RC stage.
Hono 4.13.0 – The small, fast Web standards-based web framework focuses on performance and adds HTTP QUERY method support.
graphql-upload 18.0 – Middleware that adds support for GraphQL multipart requests to Node.js GraphQL servers.
cron-parser 5.7 – Library for parsing and manipulating cron expressions.

📰 Classifieds

⚡ Zuplo puts every API, AI, and MCP request behind one gateway. Route traffic, guard your MCP servers, and cap your AI costs. Try it free.

📢 Elsewhere in the ecosystem

Did you know JavaScript supports a third type of comment (beyond // and /* */)? ▶️ Mat Marquis shows off hashbang comments in a short YouTube video. And yes, they're in the language spec!
🤖 Fred K. Schott, of Astro fame, has unveiled Flue 2.0, the latest version of his TypeScript-based open agent framework.
⚖️ The Deno vs Oracle JavaScript™ trademark case rumbles on with Deno consenting to a fifth extension request as discovery continues.
📺 SQLite's Richard Hipp gave ▶️ a detailed 50-minute talk on SQLite's reliability and the tools, practices, and design choices that have given it its strong reputation.
📊 The results of the State of CSS 2026 survey have been released.