Node Weekly

12 Node built-ins that replace npm packages

Thu, 24 Sep 2026 00:00:00 +0000

#642 — September 24, 2026

⚠️ We're taking a week off next week, so we'll be back on Thursday, October 8.
__
Your editor, Peter Cooper

Node.js Built-ins That Replaced npm Packages — A practical tour of 12 Node built-ins that replace packages like axios, dotenv, nodemon and chalk. Each is explained with its stability level in Node 24 LTS and gotchas that might make you want to stick with your existing dependency anyway.

Flavio Copes

CodeAF: The Open-Source Software Factory for Open Models — Instead of juggling a terminal for every agent, you get one window for every project. Hand work off: it splits it into parts, runs them in parallel, tests what comes back and merges what passes. Many models, one session: the right one for each call.

AgentField.ai sponsor

Node.js 26.10.0 (Current) Released — Built-in, promise-based util.debounce() and util.throttle() arrive, complete with AbortSignal support. There’s also util.markPromiseAsHandled() to help retire .catch(() => {}) hacks. Plus a little more besides.

Antoine du Hamel

💡 Node v22.23.3 (LTS) also landed with updated root certificates and dependencies (OpenSSL, npm, and Undici) plus minor fixes.

IN BRIEF:

From Node.js 27, Intel Macs drop to only having 'experimental' support, meaning no official x64 macOS builds and an arm64-only installer.
James Snell has proposed a --process-timeout flag that kills a stuck process, even one in a tight loop, and reports what kept it alive.
GitHub Actions has removed Node 20 from its runners so if you maintain an action, switch runs.using to node24 and publish a new release.
Yagiz Nizipli has opened a PR that shrinks the node binary by about a third (147MB to 95MB on macOS arm64) using extra compression and stripping symbols. Notably, 𝕏 Grok was used to do this work.
Daniel Lemire explains how AI-assisted experimentation made several libraries that ship in Node faster, including Ada, simdjson and simdutf.

npm Tokens Can Now Stage Releases Without Publishing Them — A new token permission lets CI stage npm releases but not publish them, with a maintainer approving each staged version with 2FA. It offers a migration path ahead of npm's planned ending of direct publishing using bypass-2FA tokens in January 2027 if you can’t use trusted publishing yet.

GitHub / npm team

📄 How I Traced a Node.js Streams Bug in Duplex.from() – A first-time core contributor's path from issue to PR. Aman Chadha

📄 Publishing a Subfolder to npm for Cleaner Package Paths – How to keep dist/ (or src/) out of your package's import paths. Bramus

📄 Faster SSE Responses with Async Generators and Promise.race() Valeri Karpov

🛠 Code & Tools

secure-eval-worker: A Safer eval() via Node's Permission Model — A new way to run untrusted (or AI-generated) JavaScript in a locked-down worker with timeouts, memory caps, and access only to the host functions you choose. Node 26 only, and not a true sandbox.

Matteo Collina and Luca Maraschi

🔒 CVE Lite CLI: Scan Your Lockfile, Get the Upgrades to Run — An OWASP-backed scanner that reads your lockfile, checks it against OSV and npm’s advisories, and gives you npm/pnpm/Yarn/Bun commands to use, including which parent package(s) to bump for transitive issues.

Sonu Kapoor and OWASP

Your Nightly Rollup Job Is a Query That Got Too Big — TimescaleDB extends Postgres with continuous aggregates to keep rollups fresh. No batch job. Get $1000 credit to start.

Tiger Data (creators of TimescaleDB) sponsor

🤖 Transformers.js v4.3: Run AI Models from JavaScript — Adds support for structured output (e.g. JSON), using WebGPU on Safari 26+, and DeepSeek v4. The docs have had an overhaul and there’s now an agent skill you can use.

Hugging Face

vitest-gpu and jest-gpu: Test WebGL and WebGPU Code Without a Browser — Vitest and Jest environments that give tests WebGL and WebGPU contexts in Node, so you can compile shaders, run compute passes, or diff frames against baselines sans browser.

Ben Houston

Superdiff 4.3 – A library that produces diffs of objects, arrays and text. v4.3 can now diff code by line and token too (above).
dotenv 18.0 – The popular .env file loader. v18 adds a CLI and a faster opt-in parser, but drops -r dotenv/config preloading in favor of dotenv run --.
Tinypool 2.2 – Minimal worker thread pool and Piscina fork. Now accepts a URL instance as the filename.
NestJS 12.1 – Now with built-in cookie support, CSRF protection, and security headers.
mongodb-memory-server 11.3 – Spin up real MongoDB servers for tests.
SuperTest 7.3 – Library for testing Node HTTP servers using a fluent API.
SQL Formatter 15.9 – Library for pretty-printing SQL queries.

📰 Classifieds

🚫 Ban the device, not just the account. Fingerprint's visitor ID catches ban evaders — even incognito or behind a proxy.

🎟️ Join us at Supabase Select on October 2. Get first-hand information about what's coming soon in Supabase. Apply to attend with 25% off: SUPAWEEKLY.

📢 Elsewhere in the ecosystem

pnpm 12.6 can now dedupe dependency versions across a workspace as it installs, keeps node_modules working after a project is moved (macOS and Linux only), and adds --save-types for @types/* packages.
Coding agents quadrupled Linear's test suite, so its team reworked their CI to get costs down: rewriting type-aware ESLint rules as plain AST checks cut lint time 55%, and selectively disabling Vitest's isolation saved a further 17% a month.
Cloudflare's Sunil Pai wrote about the senior engineer 'death spiral', where you go quiet for weeks to prove yourself in a new role and end up burning out.
🧪 A 'periodic table' of all 115 standard HTML elements!

Node 26.9 turns on FFI by default

Thu, 17 Sep 2026 00:00:00 +0000

#641 — September 17, 2026

Read on the Web

Why (and How) GitHub Ported Copilot's Runtime from Node to Rust — GitHub's Copilot runtime moved to Rust, ported in pieces behind napi-rs shims while shipping daily. Startup times and memory usage inspired the move, but the gold for porters is in the regressions they hit involving number types, || semantics, and blocking the event loop.

Stephen Toub (Microsoft)

That p99 Spike Is One Slow Analytics Query — One endpoint runs an analytics query over millions of rows, and latency spikes for everyone. TimescaleDB extends Postgres so that query returns in milliseconds at scale. Hypertables, compression, continuous aggregates. Get $1000 credit to start.

Tiger Data (creators of TimescaleDB) sponsor

IN BRIEF:

Node is to get util.debounce() and util.throttle() functions, two staples of utility libraries. They've landed on main for a future release.
🔒 Moment.js 2.31.0 is a key update. The date library is in 'maintenance mode', but gets 25M downloads a week, and v2.31.0 fixes a path traversal vulnerability.
The Node.js Web Team's redesigned API docs have been merged and should reach nodejs.org/api alongside a release soon.
In Node 27, the HTTP client will reject responses with more headers than request.maxHeadersCount (1000 by default right now) instead of just truncating them.

Node.js 26.9.0 (Current) Released — A reasonably significant minor release that brings a few new things to the table:

node:ffi is enabled by default (but still experimental), so you can call functions in native libraries without writing an addon.
node:bench is a new benchmarking module modeled on node:test.
Web Workers now have an experimental implementation (behind a flag), so browser-style new Worker() and postMessage, etc. can be used.
Worker threads start up to twice as fast (per initial benchmarks) and use less memory, as they now start from Node's built-in snapshot.

Antoine du Hamel (Node.js Team)

Stay Sharp in the Age of AI — Master.dev instructors build at Anthropic, OpenAI, Netflix, Google, and Stripe. Learn from them via courses, workshops, and AI learning paths. New members get $100 off a yearly membership.

Master.dev sponsor

📄 Connection Reuse is the Money – How a webhook sender cut its repeat TLS handshakes with one Undici Agent per destination. Mike Murray

📄 Email, Decoupled from Where and How – The design behind Upyo, a web-standards-based email library for Node, Deno, Bun and edge runtimes that works with many providers. Hong Minhee

📄 A Deep Dive into JavaScript Engines: Writing Code That Makes V8 Happy Audrey Doyen

📄 Five Software Engineering Roles for Working with AI Nicholas C. Zakas

📄 How to Implement a Distributed Circuit Breaker Gabor Koos

🛠 Code & Tools

Eraser Diagrams: Diagrams as Code, Minus the Layout Engine — A Node API/CLI for rendering JSON diagrams to PNG or HTML. Unlike Mermaid or D2, there's no auto-layout engine, so you (or your LLM!) get to control just where things go, while connection routing, icons and styling are handled for you.

Eraser

@platformatic/memcached: A Faster memcached Client — A zero-dependency memcached client built on the modern meta protocol, pipelining over a single connection. Claims to be "roughly 3x" the speed of alternatives.

Matteo Collina (Platformatic)

jsdom 30.1: The Release That's 'Feeling the AGI' — The pure-JS DOM implementation gets faster DOM construction, mutations, getComputedStyle() and event dispatch, plus lower memory use. Much of it came from Scott's Codex-assisted PRs, which Domenic praises for being carefully curated.

Domenic Denicola and Scott Cooper

XO 5.0 – The zero-config ESLint wrapper now lints package.json files and enforces import file extensions in TypeScript.
officeParser 8.0 – Parse Office files (docx, pptx, xlsx, etc.) and PDFs into an AST. Now with a rewritten PDF extractor.
oclif 6.0 – Salesforce's framework for building Node CLIs drops support for installing legacy plugins.
pg-boss 12.33 – The Postgres-backed job queue adds a TestClock so tests needn't wait on timers.
Aedes 1.2 – Barebone MQTT broker that runs on any stream server.
🔒 Express 4.22.3 – A security release for those on Express 4.

📰 Classifieds

⚡ Zuplo puts every API, AI, and MCP request behind one gateway. Route traffic, guard your MCP servers, and cap your AI costs. Try it free.

🛡️ Not all bots deserve blocking. Fingerprint Bot Detection stops content scrapers while letting legit AI agents through. Try for free.

🎟️ Join us at Supabase Select on October 2. Bring your hardest questions to the engineers building Supabase at the Ask Supabase booth. Apply to attend with 25% off: SUPAWEEKLY.

📢 Elsewhere in the ecosystem

npmchart.com (above) is a new option for tracking download trends and repo activity of npm packages. Here's the chart for express, for example.
A review of sixteen weeks of package manager releases across ecosystems finds similar new defences rolling out, like cooldowns, blocking install scripts (as in npm 12), and publish-time scans, which npm has done since July.
Those npm 12 defaults won't reach current Node lines, though. Last month, the Release WG decided npm 12 is "far too disruptive" for Node 22, 24 or 26, so it'll arrive in Node 27.
GitHub Actions has a new cache-mode setting to limit cache access per workflow or job, a defence against the kind of cache poisoning that compromised TanStack's npm packages in May.

Node is getting a built-in benchmark runner

Thu, 10 Sep 2026 00:00:00 +0000

#640 — September 10, 2026

Read on the Web

Cloudflare Workers Gets a New, Node.js-Aligned Module Registry — Workers enabled Node.js compatibility by default last month, meaning you can use most of Node’s built-in APIs in your Workers. Now there’s an opt-in way to load modules that resolves import paths as proper URLs, bringing import.meta and Node's require(esm) rules with it.

Logan Gatlin and James Snell (Cloudflare)

Confidently Deploy and Manage Containerized Apps on Kubernetes — Join this detailed video course with Erik Reinert and learn how to deploy and manage production-grade containerized applications on Kubernetes. You'll cover infrastructure, testing, rollbacks, autoscaling and more, all before pushing your cluster to EKS.

Master.dev sponsor

📊 node:bench: Node Core Gets a Built-In Benchmark Runner — Node has had a built-in test runner for years but no benchmark runner. James's experimental node:bench module has landed on main, so expect to see it soon. It's modelled on node:test, with a node --bench CLI and JSON reporter.

James M Snell

IN BRIEF:

Node.js v26.8.2 (Current) and v24.21.0 (LTS) are out, both including a security release of Undici that fixes several vulnerabilities, plus OpenSSL 3.5.8 and numerous tweaks and fixes.
🔒 Researchers at GitLab found a CVSS 10.0 sandbox escape in vm2, the widely used Node sandboxing library. The reported escape was patched in 3.11.7+, but the writeup argues vm2 shouldn't be used for genuinely untrusted code (though vm2's own docs are also honest about this).
Zod creator Colin McDonnell has landed a change that speeds up Node's startup (by a millisecond or so, granted) by seeding V8's non-cryptographic entropy from the OS rather than OpenSSL.
This year's TSC elections went uncontested: Matteo Collina staying Chair and Rafael Gonzaga becoming Vice-Chair.

Fuzzing the State Machines Inside My HTTP Client — A practical case for property-based testing, made by adding fast-check properties to ffetch’s 206 passing tests. Thousands of generated cases found 11 real bugs in code considered fully tested.

Gabor Koos

Add MCP Server Monitoring to Your Node.js Project — A single function call. See who is connecting, which tools drag, and the failures MCP never throws.

Sentry sponsor

📄 Is Prisma 8 Ready for Long-Lived Production Apps? – A response to community worries about Prisma 8's new migration model. Will Madden (Prisma)

📄 Containerizing and Slimming Node Apps with Paketo Buildpacks Costas Papastathis (Paketo)

📄 What await fetch() Actually Waits For Gabor Koos

🛠 Code & Tools

Rslib 1.0: A Build Tool for JavaScript Libraries and CLIs — Rspack's answer to tsup/tsdown goes 1.0 with a stable config and JS API. It can infer syntax targets from engines.node, generates declarations faster with TypeScript 7, and (experimentally) build Node SEA executables.

Chenwei Dai, Elecmonkey, et al.

vgpu: Render WebGPU Shaders in the Browser or Node.js — Provides a way to use the same shader in the browser or render headlessly with Node (to a high-resolution PNG or MP4 video). WGSL modules import and export like TypeScript does.

Vercel

MikroORM 7.2: Row Level Security, a WASM SQLite Driver, and More — A TypeScript ORM for SQL databases and MongoDB. 7.2 adds native Postgres row level security, with policies as entity metadata, plus through relations and a WASM sql.js driver (yes, you can now use MikroORM in the browser!)

Martin Adámek

Javet 6.0: A Way to Embed Node.js and V8 in Java — A Java library that embeds a real Node.js runtime (now v26) in the JVM. Java code can load npm packages, call into running Node code, and run multiple Node instances side by side. GitHub repo.

Sam Cao

eslint-plugin-regexp 3.3: ESLint Plugin for Finding Regex Mistakes — There’s a neat online demo to show off the things it can catch.

Yosuke Ota

parse-xml 5.0 – The fast, compliant XML parser goes ESM-only. The API is unchanged and require() still works on Node 22+.
dhcp.js 1.0 – DHCPv4 client, server, and tools for Node. We covered the explainer blog post about this project nine years ago!
pnpm 12.4 – The fast drop-in npm replacement can now manage npm, Python, and Cargo dependencies in the same workspace.
✉️ Nodemailer 10.0 – The popular e-mail sending library has migrated to TypeScript with ESM and CJS builds.
⚠️ Fastify 5.12.2 – Includes fixes for four high-severity issues, including validation and auth bypasses.
tinybench 6.2 – Simple, tiny and lightweight benchmarking library with precise timing.
🌐 supercluster 9.1 – Mapbox's fast geospatial point clustering library.

📰 Classifieds

🎯 Catch promo abuse at signup. Fingerprint’s visitor ID persists for months, not days, so abusers can’t hide. Try it for free.

Your API is fast until it hits analytics. TimescaleDB extends Postgres so those queries return in ms at scale. Get $1000 credit.

📢 Elsewhere in the ecosystem

React 19.3 is out with stable view transitions and fragment refs, Trusted Types support, and a browser() API used via use(browser()) to let components skip server-side rendering when they need browser-only APIs.
📺 Microsoft released a movie-length documentary about VS Code, directed by Stefan Kingham. It covers the editor's technical roots, touching on Node's arrival on Windows and its evolution through node-webkit (now NW.js) and Electron.
The team behind Tailwind CSS is joining Shopify, though they say "nothing changes with Tailwind CSS or any of our other open-source projects."
🔒 Two men have been arrested over the TeamPCP npm supply chain attacks. TeamPCP is suspected of cloning the Shai-Hulud worm, resulting in the so-called 'Mini Shai-Hulud' waves.
📺 How can someone actually change JavaScript? A two-minute explainer of the basics from TC39 delegate Mikhail Barash.

Bun now passes 80.5% of Node's test suite

Thu, 3 Sep 2026 00:00:00 +0000

#639 — September 3, 2026

Read on the Web

NestJS 12 Released with ESM-First Packages, Rspack and Vitest — The progressive framework gets its biggest release in years, going ESM-first (CJS is still an option), replacing webpack with Rspack, adding Standard Schema support for easy interop with Zod, Valibot and friends, plus structured logging, a brand new homepage, and more.

Kamil Mysliwiec

One Slow Query Starves Your Whole Connection Pool — A heavy analytics query holds a connection while everything else waits. TimescaleDB extends Postgres so those queries return fast, freeing the pool. Hypertables, compression, continuous aggregates. One database, not two. Get $1000 credit to start.

Tiger Data (creators of TimescaleDB) sponsor

📊 Bun 1.4 Now Passes 80% of Node's Test Suite — Bun 1.4's headline feature is a big jump in Node.js compatibility as part of its goal of being a "drop-in replacement". This page lets you see the project's progress and where Bun is strong and weak.

Bun Project

IN BRIEF:

Matteo Collina has landed node:ffi enabled by default, so calling into a native C library will no longer need --experimental-ffi, an addon, or node-gyp. It remains experimental, warns on first load, and hasn't shipped in a release yet.
Matteo has also added support for Single Executable Applications to mount their bundled assets as a read-only virtual file system by setting "useVfs": true in the config.
🔒 Express has patched six vulnerabilities across hbs, multer and morgan.
Node's issue tracker reaches issue 2**16 with a proposal to remove dual ESM/CJS code samples in the API docs.

Rewriting a Node.js Service in Go with AI Agents — A very 2026 tale of an overnight porting run, with a focus on doing agentic engineering well. Good takeaways on building a test harness first and the rollout experience.

Edvinas Janusevicius (Checkly)

Your Trace Shows the Slow Span. Not the Exception — OTLP carries traces and logs, not errors. Sentry's OtlpIntegration connects both in one trace waterfall. Learn more about Sentry’s OTLP.

Sentry sponsor

📄 Detecting SQLite Full Table Scans in Node.js – Did you know SQLite counts the rows scanned by statements and you can read it after the query runs? CodeSilva

📄 Workers vs Processes in Node Ishtmeet Singh

🛠 Code & Tools

Drydock: Diff Your npm Tarballs Before You Publish — From a Preact core team member comes a tool to diff built npm tarballs against the last published version, flagging install scripts, network access and new binaries. It can then gate your Actions publish job or watch npm's new staged publishing flow.

Jovi De Croock

💡 You can get a quick taste without installing anything: this web-based diff viewer can compare two versions of an npm package file by file.

srvx 1.0: One fetch Handler for Node, Deno and Bun — You can export a handler that takes a web-standard Request and returns a Response, then run it unchanged on Node, Deno or Bun. Includes a CLI with watcher and static serving, and srvx fetch can hit your handler without starting a server.

Pooya Parsa

NVM for Windows 2.0: Node Version Manager for Windows — A modern Node workflow for Windows users with version pinning, native integrations, auto-install of missing versions, and more. v2 is a rewrite that introduces a lighter shim-based mechanism and no longer needs admin privileges. GitHub repo.

Author Software Inc

Got 16.0: Built-In HTTP/2 and QUERY Method Support — The popular Node HTTP client now has a built-in HTTP/2 client, its own DNS cache, fewer dependencies, and support for the newly standardized QUERY HTTP method.

Sindre Sorhus

SimpleWebAuthn 14.0: Now with Post-Quantum Passkeys — The passkeys library now verifies post-quantum ML-DSA passkeys and, on Node 24.7 and up, prefers ML-DSA-44 at registration by default.

Matthew Miller

Restify 12.0 – The REST API framework returns after a two and a half year gap with Node 26 support and url.parse() replaced with WHATWG URL. Existing users have a few breaking changes to note.
Zod 4.5 – A big performance release for the popular TypeScript-first schema validation library.
np 12.1 – Sindre Sorhus's improved npm publish workflow gets some speedups.
express-rate-limit 8.7 – Rate-limiting middleware for Express.

📰 Classifieds

⚡ Zuplo puts every API, AI, and MCP request behind one gateway. Route traffic, guard your MCP servers, and cap your AI costs. Try it free.

📉 Headout cut chargebacks 90% with Fingerprint. Stop payment fraud with 100+ signals such as Browser Bot and VPN detection.

🎟️ Join us at Supabase Select on Oct 2. Learn from the industry’s best builders and meet people building dev tools. Apply to attend with 25% off: SUPAWEEKLY.

📢 Elsewhere in the ecosystem

htmx 4.0 has landed, the first major release in two years, with lots of changes. It remains a neat way to add interactivity to server-rendered pages without reaching for a frontend framework.
🤔 Upon finding eight versions of glob across five major version lines in his employer's monorepo, James Healy is imploring library maintainers to bump their major versions as rarely as they can.
A developer shares the techniques behind squeezing an implementation of Minesweeper into just 247 bytes of JavaScript.
🤚 The 2026 Node.js user survey is still open. Your responses guide the core team and its priorities.