Node Weekly

Domenic Denicola's modern dev setup

Thu, 23 Jul 2026 00:00:00 +0000

#634 — July 23, 2026

No, We Can't Harden Node.js Against Prototype Pollution — An explanation of why the Node team rejects prototype pollution reports against core: each assumes the attacker can already write to Object.prototype, by which point the game is over. The true fix lives at the boundary where untrusted JSON becomes objects.

Matteo Collina

Full-Text Search in Drizzle Without a Second System — Try the official ParadeDB integration for Drizzle. Search your live Postgres tables. No stale results, no ETL, no Elasticsearch cluster.

ParadeDB sponsor

Domenic Denicola's Agentic Coding Setup — It's fascinating when a prolific developer (Domenic was a key figure in the adoption of promises in JavaScript, creating jsdom, and much more) shares their workflow. This is no exception, covering areas like disposable VMs, Tailscale, and worktrees.

Domenic Denicola

IN BRIEF:

⚠️ A round of July 27 Node.js security releases has been announced, with Node 26.x, 24.x, 22.x being updated to resolve a HIGH severity issue.
🏆 The OpenJS Foundation is showcasing a ranking of the top contributors to its projects (which include Node, Express, and Electron) in the past year. Matteo Collina leads the way…just!
Over on 𝕏, the Bun team is teasing the imminent release of Bun 1.4, which will have the "biggest jump in Node.js compatibility since Bun v1.0".
pnpm has had a flurry of releases introducing native workspace release management, a doctor command to diagnose installation issues, and more.
ESLint now provides official 'codemods' for automating ESLint version migrations, with v8→v9 and v9→v10 available.

better-sqlite3 13.0: The Popular SQLite Library Moves to N-API — The good news is prebuilt binaries should now work across different versions of Node and Electron. There's also a new db.explain() method and a preparedStatement.toString() method to get the expanded SQL of a prepared statement.

Joshua Wise

High-Ingest Analytics, Still Just Postgres — TimescaleDB extends Postgres to ingest and query events at scale. One database, standard SQL. Get $1000 credit to start.

Tiger Data (creators of TimescaleDB) sponsor

📄 Unpacking the AsyncAPI npm Supply Chain Compromise – It seems attackers have already adapted to a world where post-install scripts are no longer run. Microsoft Security Research

📄 New Study Identifies 53 Slopsquatting Targets Across 5 Popular LLMs – LLMs continue to make up npm package names. Sarah Gooding

📄 Running Background Jobs in Node.js with BullMQ Flavio Copes

🛠 Code & Tools

Execa 10.0: Better Process Execution from Node — A powerful way to run processes that makes passing in input, processing output, handling errors, piping things around, and handling streams easy. v10 trims the API and adds new stream conversion powers and a killDescendants option to terminate a subprocess's descendant processes.

Sindre Sorhus

eslint-package-json: Powerful ESLint Rules for package.json — An ESLint plugin that catches package.json mistakes like invalid names, bad version ranges, broken exports, redundant files entries, and more, and fixes many of them automatically.

Sindre Sorhus

🤖 BotKit: Build Standalone ActivityPub Bots — A way to run a bot (or multiple bots) that Mastodon users can see and follow but without needing an account anywhere. Write it all in JavaScript and self-host. I spun one up with Node (temporarily) and it worked well.

Fedify

Nub 0.5 – The all-in-one toolkit that augments Node's feature set. v0.5 adds nub init as a way to quickly scaffold new projects.
odiff 4.5 – Fast SIMD-powered image comparison library. Written in Zig with Node bindings.
node-html-to-image 6.2 – A function to generate images from HTML.
find-my-way 9.7 – Fast radix-tree based HTTP router used by Fastify.
Gitify 7.0 – Electron-powered Git notifications menu bar app.
Verdaccio 6.8 – Self-hostable Node.js private proxy registry.
Piscina 5.3 – Popular worker thread pool implementation.
Prisma 7.9

📰 Classifieds

⚡ Zuplo puts every API, AI, and MCP request behind one gateway. Route traffic, guard your MCP servers, and cap your AI costs. Try it free.

The life of a ~200ms HTTP request to a Node app

Thu, 16 Jul 2026 00:00:00 +0000

#633 — July 16, 2026

Read on the Web

Follow a Single HTTP Request Through Its ~200ms Life — From the creator of NodeBook, a thorough guide to Node's internals, comes a scroll-driven visualization following every step a single HTTP POST request takes from the user's click to Node's event loop and on to a database behind it.

Ishtmeet Singh

The Best Harness Wins, Not the Best Model. Learn Harness Engineering — Scott Moss (Netflix) teaches you to wrap an LLM in a production-grade harness. Learn durable execution, sandboxing, memory, and multi-agent orchestration.

Master.dev sponsor

Fetch Needs Error Codes — e.cause.code lets you find out why a fetch() failed in Node, but the spec says failures are just bare TypeErrors, so HTTP/2/3 typed signals like "safe to retry this POST" go missing. James, who created Node's error code convention, is pushing a TC39 proposal to standardize a fix.

James M Snell

IN BRIEF:

Ant is a new entry to the growing field of JavaScript runtimes. This time, it's an independent engine written in C packed into a 9MB binary that boasts very low cold start times and can run Hono apps.
If you're considering using Go at all, this 'from Express to Fiber' guide with examples in both JavaScript and Go (on the Express-inspired Fiber framework) could be helpful.
🇮🇹 NodeConf EU 2026 takes place this September 29-30 in Italy. Tickets are still available.
Vercel is deprecating Node 20 for Builds and Functions on October 1, 2026.

Proxy and Reflect: Redefining How Objects Fundamentally Work — A deep dive into intercepting the internal operations of JavaScript objects, covering why Reflect exists at all, and ending with a small reactive state system.

Mat Marquis

Telegram Serverless: Run Telegram Bots on Telegram's Servers — Creating a bot for Telegram is easy (it has a great API) with libraries like node-telegram-bot-api, but it's starting to support running them on its own servers.

💡 The serverless program is in beta, so not all users will have access to it yet.

📄 A Gentle Introduction to Git Worktrees – For when you need to check out multiple branches into separate directories simultaneously. Nicholas C. Zakas

📄 Playwright on GitHub Actions: A Setup That Actually Runs Fast – How to cut Playwright CI time by caching browser binaries, lifting the scaffold's one-worker cap, and more. Jakob Norlin

📄 6 Security Settings Every GitHub Maintainer Should Enable This Week Joseph Katsioloudes (GitHub)

🛠 Code & Tools

LiteParse 2: Fast, Light PDF Document Parsing — A PDF parser built in Rust with bindings for Node (plus WASM, Rust, and Python) — it worked great in my testing. It includes OCR, handles layouts/is spatially aware, and is fast (a complex 140-page PDF took ~10 seconds). Here's how to get started from Node.

LlamaIndex

One Postgres for Your API and Your Analytics — TimescaleDB extends Postgres so your app and analytics run in one database at scale. Get $1000 credit to start.

Tiger Data (creators of TimescaleDB) sponsor

actions/setup-node@v7: Install Node in GitHub Actions — The popular way to set up an Actions workflow with a version of Node brings changes supporting GitHub's cache-poisoning defenses, inspired by recent exploits. There are also new docs on publishing to npm with Trusted Publisher (OIDC).

GitHub

🎬 Mediabunny: A Full Media Toolkit for JavaScript — It's been a year since we mentioned this library for reading/writing/converting media formats (MP4, MP3, and more). Since then, it's added Apple ProRes, HLS read/write, and a new server package that makes it all even easier to use from Node.

Vanilagy

Tinbase: A Supabase-Compatible Backend in a Single Binary — Provides a local Supabase-like dev experience using a JS backend built atop PGlite and pg-mem. A sort of mini, local-only Postgres wrapped in the same APIs as Supabase, so supabase-js works unchanged.

Sanket Sahu

@neon/sdk: Neon's New TypeScript Client Library — For users of the Neon Postgres platform to manage projects, branches, and databases from code.

Andre Landgraf (Neon)

Nano ID 6.0 – Generate tiny URL-friendly unique string identifiers. Now 4x faster and drops Node 18/20 support.
c8 12.0 – Istanbul-compatible coverage reports using Node's built-in V8 data. Node's test runner also has its own experimental code coverage reporting.
np 12.0 – Sindre Sorhus's "better npm publish" adds support for npm 12 and staged publishing.
HyperExpress 7.0 – A high performance Node server powered by uWebSockets.js.
Helmet 8.3 – HTTP security header hardening for Express apps.
node-auth0 6.0 – One for Auth0 users.
ESLint 10.7

📢 Elsewhere in the ecosystem

TypeScript-using AWS SDK for JavaScript v3 users need to be aware of changes to the library's support for TypeScript versions.
GitHub's Dependabot is now giving packages a three-day default cooldown before opening version update PRs, though security fixes are exempt.
TC39's 115th meeting takes place next week. Here's the agenda, including Await Dictionary aiming for Stage 3, plus Decimal, Import Defer, and Map.take.
📁 Cloudflare has launched 'Drop', a way to quickly get a site live by dropping a folder or ZIP onto a page, similar to Netlify's service of the same name.
plx is a transpiler for Postgres stored functions that converts JavaScript, PHP, Python, Ruby, and even COBOL, to Postgres's own PL/pgSQL language.

npm v12 and TypeScript 7 released

Thu, 9 Jul 2026 00:00:00 +0000

#632 — July 9, 2026

Read on the Web

npm v12 Ships with Install Scripts Off by Default — npm 12 is now GA with many breaking changes. The headline change is lifecycle scripts and implicit node-gyp builds no longer run by default. Socket’s Sarah Gooding writes more about the practical implications including, thankfully, that unknown .npmrc keys will now only warn rather than error as they did in the pre-releases.

GitHub

Your Next.js App Is Already Tracing. Now Make It Useful — When a Next.js page is slow, the hard part is finding which part is responsible: middleware, SSR, an API route, a query, or a fetch call. 🔍 Next.js is already tracing all of it. Here's how to actually see it and put it to use.

Sentry sponsor

Node.js 26.5.0 (Current) Released — Key additions include the ability to import text files into ES modules via import attributes (behind an experimental flag), blob.textStream() (good for streaming large blob content), and being able to sample event-loop delay per iteration via perf_hooks.

Richard Lau

IN BRIEF:

Bun's Jarred Sumner wrote up the full story of rewriting Bun in Rust, a somewhat controversial AI-powered port that will power Bun 1.4 onward. The cost? ~$165k of Fable usage, at API prices.
James Snell has a TC39 proposal to standardize a code property on Error (as has long been common in Node).
Better Auth, the framework-agnostic auth library, is joining Vercel.

TypeScript 7.0 Released — Over a year after announcing TypeScript would be ported to Go, the final release is out. Don't rush to upgrade: TS 7.0 doesn't ship with an API yet, and 6.0 is still a good stepping stone. If you do upgrade, expect to see huge build time speedups, once moduleResolution: node is switched to nodenext and you've sorted out "types": ["node"].

Microsoft

CVE-2026-48931 Shouldn't Have Been a CVE — A candid post-mortem from a Node maintainer explaining a recent snafu around an HTTP/1.1 poisoning issue he now argues shouldn’t have been a CVE, especially after the fix broke node-fetch, Firebase, and the official Docker images.

Matteo Collina

What's New in ECMAScript 2026 — The ECMAScript 2026 spec was approved last week, and this round-up covers several main new features that made the cut, with all (except Math.sumPrecise) available in Node today.

Pawel Grzybek

📄 You Shouldn't Trust Trusted Publishing – npm added trusted publishing, but it’s authentication, not a safety or quality badge. Matteo Collina has also written about this from the npm perspective before. William Woodruff

📄 Node.js Worker Threads in Production – Hard-won lessons from running worker threads at scale. Aaron Harper (Inngest)

🛠 Code & Tools

terminal-image 5.0: Display Images in the Terminal — Works in any terminal that supports colors by rendering colored blocks, but can render images inline in terminals that support inline graphics. v5.0 improves iTerm2 support by using its native inline image support, rather than the Kitty protocol.

Sindre Sorhus

Full-Text Search in Drizzle Without a Second System — Try the official ParadeDB integration for Drizzle. Search your live Postgres tables. No ETL, no Elasticsearch cluster.

ParadeDB sponsor

eslint-node-test: ESLint Rules for Node's Built-In Test Runner — In Sindre’s own words: “If you use the Node.js test runner (node:test), you may like the new ESLint plugin I cooked up. 64 [now 82] rules to improve your tests, prevent mistakes, and enforce style.”

Sindre Sorhus

✉️ Upyo 0.5: A Cross-Runtime Email Sending Library — A unified, type-safe API for sending emails both on SMTP and HTTP-based (e.g. SendGrid or Amazon SES) providers from Node, Deno, Bun, and edge function runtimes.

Hong Minhee

webpack-dev-server 6.0: The Official webpack Dev Server — Bumps Express up to v5, drops support for older Node versions, adds support to be used as a webpack plugin, and switches to ESM.

webpack

XO 4.0 – Opinionated but configurable ESLint wrapper that includes numerous popular ESLint plugins and rules out of the box.
ESLint Plugin Perfectionist 5.10 – For when you're really particular about the ordering of things like objects, imports, and types.
MongoDB Node.js Driver 7.5 – Official driver for MongoDB. Now supports Queryable Encryption string queries on MongoDB 9.0.
🐍 node-calls-python 1.2 – Call Python from Node directly, in-process, without spawning processes.
FoalTS 5.3 – The full-featured Node.js app framework adds a new dev-verbose logging format.
Fastify 5.10.0 – The fast and low overhead web framework.
feed 6.0 – RSS, JSON, and Atom feed generator library.

📰 Classifieds

📈 Crystallize seeks a remote SRE who thinks in SLOs, not heroics. Node/TS, GraphQL.

37 CLI best practices for Node devs

Thu, 2 Jul 2026 00:00:00 +0000

#631 — July 2, 2026

Read on the Web

So You Want to Land Your First Node.js Core Contribution? — Joyee Cheung has put together a new, official guide for anyone considering making their first contribution to the Node project, including where to look for issues to work on and how to improve the chances of your work making the cut.

Joyee Cheung

Your Autonomous Engineering Team, in TypeScript — One call spins up an orchestrated fleet — planner, architect, coders, QA, reviewers — that plans, builds, tests and ships production-grade PRs. TypeScript SDK, agents as typed APIs, open- and closed-source models.

AgentField.ai sponsor

37 Node CLI App Best Practices — A long-standing, but now modernized, set of guidelines for building “successful, empathic and user-friendly” CLI tools, plus an appendix rounding up the most popular CLI framework options. Now also includes a SKILL.md file you can point agents to.

Liran Tal

IN BRIEF:

Nub, a toolkit that adds useful features to Node (rather than replacing it), is now a single self-contained binary and has added a web-standard Worker mechanism to Node.
🔒 npm now locks 'high impact accounts' (those maintaining the most popular packages) into a 72-hour read-only mode when they change their email or use a 2FA recovery code.
npm 11.18.0 promotes the linked install strategy to stable, where packages are installed in node_modules/.store and linked in place, so code can only reach dependencies it actually declared. More info here.

Why Drizzle ORM Couldn't Publish New Releases on npm for a Month — As well as explaining why the popular ORM ran into the problem, Evert shares tips to see if you run a similar risk, and how to mitigate it.

Evert Pot

Iterating Faster on VS Code with TypeScript 7 — The tale of how the VS Code team adopted the Go-based TypeScript 7 compiler and got a 7x reduction in type checking time.

The VS Code Team (Microsoft)

📄 Roll Your Own File-Based Router in Under 50 Lines of Code – One for users of Wasp, the Node.js + React + Prisma full-stack framework. Carlos Precioso (Wasp)

📄 Finding Memory Leaks with Heap Snapshot Analysis in N|Solid – Using the N|Solid extension to capture a heap snapshot to trace a memory leak in VS Code. Estefany Aguilar (NodeSource)

🛠 Code & Tools

Node-GTK 4.0: GTK Bindings for Node — Bindings to the popular GTK desktop widget toolkit for building Linux, macOS and Windows apps. Now supports Node 26 and includes an npx node-gtk create app-name command to spin up a project. Worked well on macOS once I had the dependencies in place!

Rom Grk et al.

Schedule Node.js Scripts Across Your Server Fleet with xyOps — Run unlimited Node, Shell, HTTP, and Docker jobs with live logs, alerts, snapshots, and visual workflows. Self-hosted.

xyOps sponsor

🤖 Vercel AI SDK 7: An SDK for Working with AI Model Providers — Provider-agnostic library for building AI apps (no Vercel services needed). v7 focuses on agents, but adds WebSocket sessions for real-time transcription/voice agents, and video generation support for several providers.

Martynus, Grammel, Arntz, et al.

Electron 43: Faster Startup and V8 15 — Updates to Chromium 150, Node 24.17, and V8 15, with faster startup via a Node boot snapshot and bytecode-cached preloads. Adds rounded corners on Linux, matching Windows and macOS. v43 is also the final line to ship 32-bit binaries.

John Kleinschmidt

Deno 2.9 – The alternative runtime rolls out its new desktop app generator, improves support for npm/pnpm/yarn/Bun lockfiles, improves its test runner substantially, and more.
Git 2.55 – Adds git history fixup for 'fixing up' earlier commits, faster git status on Linux, and more.
pg-promise 12.7 – Node 26 is now officially supported by the popular Postgres client library.
Middy 7.7 – Node.js middleware engine for AWS Lambda. (Release notes)
Fastify 5.9 – Lots of bug fixes, and introduces request.mediaType.
Knex 3.3 – Batteries-included, multi-dialect SQL query builder.
JS YAML 5.2 – Fast YAML 1.2 parser and writer library. (Demo.)

📰 Classifieds

🚀 Crystallize is hiring a remote SRE: Node/TS, GraphQL, AWS, MongoDB, Cloudflare Workers.