🔥 NEW BANTER: "Should You Block the Event Loop?" Day one of Node.js, you learn one rule: never block the event loop. A customer brought us a compression problem that turned that rule on its head. Async didn't just lose. It took the app down. Luca and I go through it. 📅 Aug 12th

Must ... refrain... from logging in... during holiday... one more day. Good luck to anyone in/affected 🫂

Socket@socket.dev · yesterday

🚨 Update: Watching this npm worm propagate in real time, we’re now tracking 2,234 affected package artifacts across 444 unique packages, and it’s still spreading. Average detection time: 5 min and 18 seconds after publication. Our campaign page includes all affected packages/versions.

Congratulations for the launch!!! 🚀

Darcy Clarke@darcyclarke.me · 24h ago

Excited to share vlt 1.0 along with our hosted registries & ecosystem mirrors now GA! A drop-in npm replacement, built so nothing runs on your machine just because you typed install. → faster delivery → malware blocking at the registry layer → graph-native querying

Every recursive algorithm can be exploited to cause a crash in most languages. Prefer iteration whenever possible.

🔥 NEW BANTER: "Nitro Builds the Server. Who Runs the Fleet?" Nitro gives you a clean, portable server. Consistent builds. Familiar routing. Great DX. Then you scale to five instances with a cron job and nobody is in charge. Luca, Paolo and I dig into @platformatic/nitro. 📅 Aug 5th

I genuinely hate CSRF vulnerabilities. Fixing them always is at odd with developer experience.

I'm relatively surprised by how hard it is to operate HTTP/2 at scale. So many pitfalls for so little benefit. Today I stumbled on a fancy bug. github.com/haproxy/hapr...

HTTP/2 client streams silently aborted when reused backend connection is closed by server (no access log entry) · Issue #3414 · haproxy/haproxy

Detailed Description of the Problem When a haproxy instance serves clients over HTTP/2 and uses the default http-reuse safe backend connection pool, a fraction of client requests end with the clien...

github.com

State machines: let's teach LLMs to use state machines. LLMs, like humans, forget the "refactoring" step of TDD.

I wrote this bit on preventing prototype pollution dev.to/naugtur/but-... in response to @nodeland.dev 's recent post where he claimed we can't. It's all about pronouns. 😜

But _We_ Can Harden Node.js Against Prototype Pollution

This is a response to a post by Matteo Collina Define We Matteo's post argues that...

dev.to

Undici security release is out: v8.9.0, v7.29.0 and v6.28.0. Five advisories, one high severity and four medium. If you use Undici directly or through fetch() in Node.js, upgrade. npm i undici@^8.9.0 (or ^7.29.0 / ^6.28.0) github.com/nodejs/undic...

What do you all think of NPM adding scanning of all packages during publish- a 15-minute delay during peak times? What concerns me the most is: 1. false positives 2. the SLA for the "appeal process" Anyway, good step! github.blog/changelog/20...

npm publish-time malware scanning and dual-use metadata - GitHub Changelog

As part of our ongoing supply-chain security work, npm is introducing automatic scanning of packages at publish time. This changelog covers what publishers can expect and a new metadata requirement…

github.blog

🔥 NEW BANTER: "Your Bug Fix Will Never Reach the Runs That Need It" You find a critical bug. You fix it. You deploy. Meanwhile the 30-day subscription cycles, the compliance timers, the approvals waiting on a signature are all still running the broken workflow version. They never get your fix.

I’m developing a new product (more on that later on). I’m doing it pairing it with Fable and GPT-Sol. I made some glorious mistakes in the design. I would never have caught them without a deep code review.

An OSS maintainer wakes up knowing they will have more potential security vulnerabilities to triage. The work never ends.

I'm in London for the next two weeks! Yay!

A package registry should not be picking winners

Run Eve agents on Kubernetes with @platformatic.dev. Eve gives you Markdown instructions, TypeScript tools, and durable workflows, but production needs more than just an HTTP server. 🧵

Everyone says AI is helping developers ship more. Almost nobody asks who's paying for the compute, tokens, and time that keep the open source *behind* AI alive. New episode of The Node (and more) Banter 🧵👇

Fetch is not enough... a blog post on server-side HTTP API standardization www.jasnell.me/posts/fetch-...

🔥 NEW BANTER: "Your Node.js Gateway Is Doing Twice the Work" You launch. Thousands hit the same link at once. The cache is cold. And your app builds the exact same response hundreds of times in parallel. Luca and I sit down with Paolo Insogna to make it stop. 📅 July 8th

🔥 NEW BANTER: "How Do You Build Skew Protection? Let's Unpack It" "Zero downtime" doesn't mean zero risk. You ship new code. Half your users still have the old version open in their browser. Then a checkout fails. 📅 July 1st 🔗 streamyard.com/watch/RnVyfV...

🚀Thrilled to announce @socket.dev as #gold Sponsors of #NodeConfEU 2026! 🌟 Socket is a #cybersecurity platform that protects companies from software supply chain attacks. Find out more👉 socket.dev Thank you! Your partnership is helping us create something truly special in the #Node.js community!

Node.js 26.4.0 is out with a new `node:vfs` built-in module (behind `--experimental-vfs` flag). It also adds support for package maps, and many bug fixes, including a fix for a regression shipped with last week security release. Full changelog and download links at nodejs.org/en/blog/rele...

Node.js — Node.js 26.4.0 (Current)

Node.js® is a free, open-source, cross-platform JavaScript runtime environment that lets developers create servers, web apps, command line tools and scripts.

nodejs.org

Matteo Collina@nodeland.dev · 5mo ago

npm install @platformatic/vfs When node:vfs ships in core, migrating is a one-line import change. Full blog post with all the details, code examples, and the story behind the PR: blog.platformatic.dev/why-nodejs-n...

📢 CFP EXTENDED: NodeConf EU 2026 — Bologna, Italy We pushed the Call for Papers deadline to **June 30th**. One more week to send your talk. Node.js maintainers, production engineers, runtime nerds, tooling builders => we want your session.

🔥 NEW BANTER: "Why Shipping Fast Breaks Your Users (and How to Stop It)" You deployed at 11am. A user who opened the app at 9am clicks a button. 404. You didn't break anything. You just shipped. Luca and I get into it. 📅 Jun 24th 🔗 streamyard.com/watch/VG7m2C...

🔒 Security release for undici (the HTTP client powering Node.js fetch). We've shipped fixes for 8 advisories across all supported lines. Please upgrade: • v8 → 8.5.0 • v7 → 7.28.0 • v6 → 6.27.0 npm i undici@latest Details 🧵👇

A default set from May 2015 was just changed for the first time. One number. One constant. And it was quietly costing Node.js up to 26% of its throughput on the workloads you run every day: file reads, HTTP parsing, and stream chunking. streamyard.com/watch/9y9Q4G...

Memory vs performance. Everyone treats it like a fight where you have to pick a side. The new episode of The Node (and more) Banter asks a better question: can we have both instead?

If you need a nudge to submit your proposal to NodeConfEU, let me tell you I just did and it was the shortest CFP form ever! 😉

Matteo Collina@nodeland.dev · 2mo ago

Blind tickets for NodeConf EU are *gone* — but regular tickets are live 🎟️ If you're planning to join us in Bologna, Italy for the best Node.js conference of the year, now's the time. CFP is open too — come speak! www.nodeconf.eu

Your Node.js service has rate limiting. You tested it. You shipped it. And it is quietly lying to you.