Excited to share vlt 1.0 along with our hosted registries & ecosystem mirrors now GA! A drop-in npm replacement, built so nothing runs on your machine just because you typed install. → faster delivery → malware blocking at the registry layer → graph-native querying

Every recursive algorithm can be exploited to cause a crash in most languages. Prefer iteration whenever possible.

🥁 𝐒𝐩𝐞𝐚𝐤𝐞𝐫 𝐀𝐧𝐧𝐨𝐮𝐧𝐜𝐞𝐦𝐞𝐧𝐭🎙️ Thrilled to have Filip Skokan on the NodeConf EU 2026 stage! He'll tell us the story of "𝐏𝐨𝐬𝐭-𝐐𝐮𝐚𝐧𝐭𝐮𝐦 𝐂𝐫𝐲𝐩𝐭𝐨𝐠𝐫𝐚𝐩𝐡𝐲 𝐢𝐧 𝐍𝐨𝐝𝐞.𝐣𝐬". 🎟️Don't miss it out, secure your tickets www.nodeconf.eu

Don't forget! Tickets are on sale now for @nodeconf.eu The conference is being held in beautiful Bologna, Italy on September 29th and 30th We've got a fantastic agenda, wonderful sponsors, and Italian food. The food alone is worth the trip.

Did you know Node.js is redesigning its API documentation? The new beta brings faster navigation, improved search, richer type information, better mobile support, version switching, and so much more. Learn more & preview today at nodejs.org/en/blog/anno...

Node.js — Check out the New Node.js API Documentation Preview

Node.js® is a free, open-source, cross-platform JavaScript runtime environment that lets developers create servers, web apps, command line tools and scripts.

nodejs.org

Have been thinking recently about adding `diagnostics_channel` support to Piscina as part of v6, and possibly dropping the `histogram` support from the instance. Wondering if there are thoughts wether this can or cannot be a good idea or something appealing to be used. github.com/piscinajs/pi...

Use `diagnostics_channel` for Histograms · Issue #1116 · piscinajs/piscina

Goal Deliver metadata around pool performance using diagnostics_channel Proposal Instead of directly accessing pool performance metadata from Piscina#<histogram|utilization> provide it as a diagnos...

github.com

Using Ai as a “reference” sucks because it’s a dead end to learning and curiosity. There are more artists and writers whose work I can be inspired by and I can always dig deeper into them to learn more, but Ai flattens it to the result with no way to find out what parts were stolen from who.

Sketching some ideas for a unified http server api (supporting h1, h2, and h3, webtransport, websockets, extended connect, multi-runtime, etc) ... www.jasnell.me/posts/http-s...

Nearly 5 years of work later, I've successfully closed the Node.js TLS fingerprinting issue: github.com/nodejs/node/.... As of Node 26.4.0, it's possible to match most common TLS fingerprints in Node directly. I've published a library to do all the hard work here: github.com/httptoolkit/...

GitHub - httptoolkit/node-tls-impersonate: TLS fingerprint control within Node.js's normal networking APIs

TLS fingerprint control within Node.js's normal networking APIs - httptoolkit/node-tls-impersonate

github.com

Node.js 26.4.0 is out with a new `node:vfs` built-in module (behind `--experimental-vfs` flag). It also adds support for package maps, and many bug fixes, including a fix for a regression shipped with last week security release. Full changelog and download links at nodejs.org/en/blog/rele...

Node.js — Node.js 26.4.0 (Current)

Node.js® is a free, open-source, cross-platform JavaScript runtime environment that lets developers create servers, web apps, command line tools and scripts.

nodejs.org

Matteo Collina@nodeland.dev · 5mo ago

npm install @platformatic/vfs When node:vfs ships in core, migrating is a one-line import change. Full blog post with all the details, code examples, and the story behind the PR: blog.platformatic.dev/why-nodejs-n...

I did some writing about @nodejs.org streams earlier this year that I think you will all enjoy. First article is about custom stream implementations, and the second is all about optimization. Enjoy ✨ 🚀 🐢 ethanarrowood.com/blog/buildin... ethanarrowood.com/blog/profili...

Building Custom Node.js Streams: Splitting a 1GB File Without Running Out of Memory | Ethan Arrowood

What started as generating prime numbers for Project Euler problems evolved into a ~1GB file that broke my development tools. Follow along as I build custom Node.js Writable and Transform streams to e...

ethanarrowood.com

High Severity Vulnerability fix for Piscina landed - github.com/piscinajs/pi... Prototype pollution upon constructor params and function params when executing a task can lead to arbitrary RCE. Fixed on: - >=5.2.0 - >=4.9.3 - >= piscina@6.0.0-rc.2

Prototype Pollution Gadget → RCE via inherited options.filename

## Summary Sister bug to the prototype-pollution-gadget I reported against pino earlier today; same root-cause class, different library. **Filing as a separate PSA because the fix lives in pisci...

github.com

Is time to stop thinking, and start writing blog.metcoder.dev/this-is-wher...

Hello, World! Yes it's actually me - just a few years late to the party. Not sure exactly how much I will participate here; I'm still avoiding unnecessary scrolling and reducing my screen time. The best way to keep up with and contact me is at my personal site: ethanarrowood.com 🏔️⛷️🚀

Ethan Arrowood

Personal website for Ethan Arrowood. Head of Open Source Engineering at Harper. Node.js contributor. OpenJS Foundation and WinterTC collaborator. Breckenridge ski instructor.

ethanarrowood.com

Today I gave a talk JSNation about the life cycle of ESM in Node.js, how it differs in other environments and the new features that will affect these stages. Slides: github.com/joyeecheung/...

Node.js 26.3.0 is out with a bunch of various fixes, and a new `process.permission.drop()` API (shoutout to @rafaelgss.dev!). Full changelog and download links available at nodejs.org/en/blog/rele...

First RC for Piscina@v6 is out! Remove support for v20 Include support for v26 Improved Generics Support for `using` syntax ...and more! npm install piscina@rc github.com/piscinajs/pi...

Everytime that I have to deal with Jest issues, I just remind myself how much I dislike Jest 🫤

I suppose, if the only thing you've ever experienced is chaos, SDD seems like an improvement, but believe me, it's not. In my experience, incremental feedback-driven approaches always yield better outcomes. 6/7

Everyone setting --max-old-space-size in Kubernetes is doing it wrong. Here's why your Node.js app keeps getting OOMKilled despite your "careful" heap tuning 🧵

Nice to see Sentry investing in TracingChannel so we can eliminate monkey-patches. 🎉

Sentry@sentry.io · 3mo ago

We've been monkey-patching JS libraries for observability for too long now. It's fragile, ESM-breaking, and runtime-locked. So we started adding TracingChannel support upstream in 44 libraries 👀 Check out our latest blog post to see how and why: blog.sentry.io/fixing-javascript-observability/

If you are at @devworldconference.bsky.social , come to the Auth0 stand to say hi! 👋

NodeConf EU is back in Bologna, Italy and it's going to be special 🇮🇹 Great talks, better people, and the kind of hallway track you can't replicate online. Blind tickets? Already gone. CFP open. Regular tickets moving. Join us: www.nodeconf.eu

NodeConf EU 2026 | Bologna, Italy

NodeConf EU 2026 returns to Bologna with tickets, CFP, venue info, and conference links in one fast single-page experience.

nodeconf.eu

Node.js 26.1.0 is out, with a new `node:ffi` module, `crypto.randomUUIDv7()`, and many more features and bug fixes. Full changelog and download links at nodejs.org/en/blog/rele...

Node.js — Node.js 26.1.0 (Current)

Node.js® is a free, open-source, cross-platform JavaScript runtime environment that lets developers create servers, web apps, command line tools and scripts.

nodejs.org

www.jasnell.me/posts/quic-c...

legallayer.substack.com/p/who-owns-t...

Kermit the Frog Sips 'None Of My Business' Tea

ALT: Kermit the Frog Sips 'None Of My Business' Tea

static.klipy.com

www.nodeconf.eu

The Axios npm compromise was a social engineering attack — not a leaked password, not a stolen key. The attacker hijacked the maintainer's *live browser session*. As far as npm was concerned, they *were* the maintainer. This exposes a dangerous gap in how we think about supply chain security. 👇

The hidden gem is that @nodejs.org majors and LTS cycles got WAY easier to understand: 2026 -> v26 2027 -> v27 2028 -> v28 ... Aall of them go LTS for 18 months meaning each major is supported for 2 years. The new graphic tells the best story here: nodejs.org/en/blog/anno...

Rafael Gonzaga | Node.js@rafaelgss.dev · 3mo ago

Node.js v26.0.0 is out 💚 Temporal API enabled by default, V8 14.6, Undici 8, and key deprecations as we keep modernizing the platform. Check it out nodejs.org/en/blog/rele...

Do not unleash your AI-powered bot into people's GitHub repos without asking first. If you do that on any of the repos I maintain, your bot is likely to get banned. (I've already banned a few).