Bookmarks (149)

Koa 3.0: The Expressive HTTP Middleware Framework — Koa first appeared over a decade ago as a ‘next-generation’ Web framework that shared some of the lineage (and team) of Express.js, but leaning on more modern JavaScript features and ideas of the time. While Express has been making a comeback recently, Koa has progressed too and offers a compelling alternative. v3.0 release notes.

Scala.js 1.19.0: Bringing Scala and JavaScript Together — Scala is a powerful language that has grown beyond its JVM roots to also have JavaScript and native runtimes. Scala.js is a Scala to JS compiler and the homepage has some neat code and feature comparisons.

Seyfert: A Framework for Building Discord Bots — Create bots for the popular chat system starting from bots that respond to simple commands up to creating components and getting user input. Started life being Node only but recent versions support Deno and Bun too. GitHub repo.

Giving V8 a Heads-Up: Faster Startup with Explicit Compile Hints — Not Node specific but a look at a V8 optimization that may become relevant in time. Explicit Compile Hints let you direct V8 to eagerly compile specific files as a way to speed up startup. It ships with Chrome 136.

The Node.js Test CI Security Incident Explained — The Node.js project recently experienced a critical security incident with its test CI infrastructure. Attackers exploited a flaw in the Jenkins pipeline and this post goes into detail about how it came about and was resolved.

Node v22.15.0 (LTS) Released — With over 300 commits, this is a meaty update for the most up to date LTS release of Node, though with no huge features. You can now use system certificates on Windows and macOS, numerous dependencies are updated, doc tweaks, and process.execve makes an appearance.

Microsoft Warns About Node.js' Role in Modern Malware — Microsoft’s security team is observing a sharp increase in the use of Node.js to deliver malware and other malicious payloads. This post digs into a couple of examples and what's going on behind the scenes.

Repomix: Pack Your Codebase Into AI-Friendly Formats — Enter a GitHub URL and choose various settings for the output (XML, MD, etc). It’s Node.js-based and available to use in a library-like form for your own tooling creations too. GitHub repo.

🤖 node-mlx 0.4: Machine Learning Framework for Node.js — Based upon Apple’s MLX framework targeting Apple’s own chips, node-mlx brings its power into the Node world.

Node v20.19.1 (LTS) Released — You know it’s a quiet week when a .1 release is feature-worthy news. Little here except dependency bumps, though, but it’s always good to see an update of what remains a popular Node version (though Node 22 ‘Jod’ should now be your LTS version of choice, ideally).

Optimizing Node Performance with V8 GC Optimization — Matteo recently ▶️ gave a talk at dotJS about Node’s memory usage and decided to write it up into a blog post too. Matteo notes that high memory usage doesn’t necessarily mean you have a memory leak, explains how V8’s garbage collector works, and how you can tune things specifically for your own use case.

Bi-Weekly Demo: Find & Fix Errors in Your Application — In this fast-paced 25-min demo, see how Sentry (and Codecov) help you catch Node errors, spot slowdowns, and ship cleaner code—without getting buried in logs. Hosted biweekly by a real human who’s broken plenty of apps, too. 👉 Save your spot.

Chrono 2.8: A Natural Language Date Parser — Give it a string like “today”, “last Friday”, “2 weeks from now”, or even an entire date and time, and it’ll come up with a date object to suit.

Prisma ORM 6.6.0 Released — Introduces a new prisma-client generator that’s more flexible and comes with ESM support, plus a preview of an MCP server to let AI agents and tools manage Postgres.

Lexe: Package a Node App into a Single Executable — Node actually has a mechanism for creating single executable applications and there are numerous other tools to do it, but Lexe takes the approach of using Amazon’s lightweight LLRT engine to make binaries of under 10MB in size. Note, however, "Lexe is not a drop-in replacement for Node.js. It only supports a subset of Node.js APIs."

Some Features Every JavaScript Developer Should Know in 2025 — A quick list post breezing through a few more modern areas of JavaScript including iterator helpers, structuredClone(), and set operations.

Comparing Tauri and Electron for Building Desktop Apps — Electron is a natural choice for building JS and HTML-powered cross-platform desktop apps but numerous alternatives have appeared like Neutralinojs and the Rust-based Tauri. This post does a good job of quickly showing how Tauri differs and why you might choose it.

Fastify + React – 7x Faster than Next.js? — Node’s Fastify framework has a mature plugin for Vite integration (explained in detail here), including @fastify/react which just hit version 1.0 and makes it easy to create fast, featureful (though obviously less so than Next.js) React apps atop Fastify. How fast? Very, it seems.

🎵 Communicate with Ableton Live via WebSockets — Ableton Live is a popular DAW (digital audio workstation) and this opens up a way to control it from Node.js code.

Node.js Testing Best Practices — A detailed guide to modern testing in Node from a group of developers who know all about it. It’s on GitHub but is essentially written like a free book covering over 50 battle-tested tips covering areas as diverse as the ‘Testing Diamond’, testing microservices, checking contracts, verifying OpenAPI correctness, and simulating flaky network conditions.

Memetria K/V: Efficient Redis & Valkey Hosting — Memetria K/V hosts Redis OSS and Valkey for Node.js apps, featuring large key tracking and detailed analytics to manage and optimize application data effectively.

A Practical Guide to Llama Stack for Node Developers — Red Hat’s Node team has been digging deep into LLM coding in recent months, and now shares its discoveries in using Meta’s Llama Stack (not to be confused with their Llama LLM) – it’s a unified set of APIs for working with numerous parts of the modern LLM-powered stack including models, evals, RAG, tool...

How the Node Team Makes Node.js Downloads Reliable — I’m sure most of us rely on just clicking and downloading Node.js (or having a package manager or CI process do it) and it Just Works™. Turns out there’s a lot going on behind the scenes to keep Node.js quick and easy to download and this tells the full story of an operation that serves...

Could JavaScript Have Synchronous Await? — Our favorite JavaScript doctor explores the idea of a synchronous await to erase the divide between sync and async code, explains why it’s enticing, and digs into why performance hits and concurrency headaches make it impractical.

Bare: A New Lightweight Runtime for Modular JS Apps — Imagine something like Node.js but really stripped back: bare, if you will. Like Node, it’s built on top of V8 and libuv, but Bare’s approach is to provide as little as possible (a module system, addon system, and thread support) and then rely upon userland modules that can evolve independently of Bare itself. It’s...

java-bridge: A Bridge Between Node.js and Java — Last week we were bridging Ruby and Node, this week we’re going between Node and Java using a Rust-powered bridge. Yes, running System.out.println('Hello world!'); directly in Node could well be in your future..

Playwright MCP: Connect LLMs to Browsers with Playwright — MCP (Model Context Protocol) servers enable certain LLM-based agents (such as Claude Desktop, Claude Code, and Cursor) to perform actions on systems outside of their usual sandbox. This new project from Microsoft enables such LLMs to interact with Web pages via Playwright.

Land Ahoy: Leaving the Sea of Nodes — A deeply technical post from a core member of the V8 JavaScript engine team that explains the limitations of Turbofan, one of V8’s optimizing compilers. If you don’t care for the internals of how your JavaScript is compiled and run, just be assured the V8 team is working to make it run even faster!

Teable: Open Source Airtable Alternative atop Postgres — Airtable is a popular data table database SaaS, but here’s a NestJS-powered open-source alternative in a similar manner that sits atop Postgres. GitHub repo.

Nōdo: A Way to Call Node.js from Ruby — A mechanism for letting Ruby scripts make calls to Node.js-based functions via a Unix socket-based IPC approach. (We also learn that “ノード” means “node” in Japanese.)

Express 5.1: Express 5 Finally Becomes the 'Latest' Release — After a period of some dormancy, Express 5.0 was released last year, but remained a somewhat experimental ‘edge’ release as it went through a security audit and process of building up new governance. With 5.1, however, Express 5.x finally becomes the ‘latest’ tagged release on npm, so be careful with those upgrades (luckily there’s...

Neutralinojs 6.0: Alternative Cross-Platform Desktop App Approach — Neutralinojs offers an interesting lightweight alternative to something like Electron, as it still lets you build apps that run on Linux, Windows and macOS, but Chromium isn’t bundled – instead the existing installed browser engine is used.

Securing Node.js Express APIs with Clerk and React — Learn to secure Node.js/Express APIs with Clerk & React. Implement JWT authentication, protect routes, manage users, and handle sessions seamlessly. Ideal for scalable full-stack apps.

Node.js TSC Votes to Stop Distributing Corepack — Corepack was introduced as an (experimental) tool bundled with Node to help with managing versions of your package managers. Corepack will live on as a separately installable tool, but will be phased out from future Node releases following a recent TSC vote.

New URLPattern API Brings Improved Pattern Matching to Node — The Cloudflare Workers team has implemented the URLPattern API in the Ada URL parser, used by both Node.js and Cloudflare Workers. The API lets you take patterns like /blog/:year/:month/:slug and test whether URLs match against them. If you’re using Node 23.8+, you can start using it today.

gosync: Go-Style Channels and WaitGroup for Node — Possibly of interest to you if you’re familiar with Go and channels.

node-rate-limiter-flexible 6.2: Limit Number of Actions by Key and Protect Apps from Brute Force Attacks — Can use Redis, in-process memory, memcached, MongoDB, Postgres or, newly, SQLite, to count actions in either a single process or distributed environment.

The Ultimate PaaS Pricing Calculator — We wanted a tool to compare prices between Heroku, Render, Fly.io, and more. So we built one.

SuperTest 7.1: HTTP Assertions Made Easy — Got an HTTP API to test? SuperTest provides a fluent API for chaining together requests and expectations. See some examples here.

Errsole.js: Collect, Store, and Visualize Node App Logs — Rather than leaning on a third-party service for log monitoring, the idea of Errsole is you just drop its package into your app and you get logging and a basic UI for looking at those logs all ‘out of the box’. It supports numerous storage mechanisms, from SQLite in dev to MySQL, Postgres and MongoDB...

🔐 Protect.js: 'Encryption in Use' for Data in Node Apps — Designed to work with any Node framework or ORM, Protect.js provides AES-256 based ‘encryption in use’ functionality. GitHub repo.

Node v20.19.0 (LTS) Released with require(esm) — Node v20 is in maintenance mode, which usually means no new features, but it lands a significant one here: support for require(esm) enabled by default. This means all Node v20+ releases now support loading native ES modules with require out of the box. Ideal if you have dependencies to update and you’re still on v20.

Node v23.10.0 (Current) Released — Node gains a new --experimental-config-file option for writing a JSON-based config file that contains options that would otherwise litter your command line flags – ideal for configuring the test runner, say.

Node.js Gets an Official Community Space on Discord — While there have been numerous IRC channels and Discord and Slack servers where Node developers can congregate, the Nodeiflux Discord server has been promoted to being an official one – here’s the invite link if you’re a Discord user. There are already 15k members, so it’s hopping.

OTPAuth: One Time Password (HOTP/TOTP) Library — When you log in to a site with 2FA and you’re asked for six digits from your authentication app, that’s a Time-based One-Time Password (or TOTP). This library for Node, Deno, Bun and the browser lets you work with both TOTPs and HOTPs (HMAC-based OTPs) from JavaScript.

Refractor 5.0: Virtual Syntax Highlighting using Prism — Wraps the powerful Prism syntax highlighter to output objects instead of an HTML string so you can manipulate and render it as you wish (e.g. in a VDOM or at the terminal). Lowlight, by the same author, offers the same functionality but backed by highlight.js.

Piscina 4.9: A Fast Worker Thread Pool Implementation — Node’s worker threads bring true multithreading to Node apps and Piscina is a pool for tracking and controlling the number of such threads.

How to Get Deep Traces in Your Node Backend with OTel and Deno — The Deno project turns up the heat by demonstrating how to add OpenTelemetry to a Node app before showing how much easier it is with Deno (as long as your Node app runs well under it).

🔎 Node Modules Inspector — A tool that runs pnpm inside your browser, “installs” a package, then analyzes its dependencies. This can be useful for analyzing packages you already use, but also for simplifying your own projects, as 11ty’s Zach Leatherman did here.

Node Added TypeScript Support, But What Does That Mean for Deno? — The Deno team, learning from previous experiences with Node, went ‘all in’ with TypeScript from day one. Now, Node can work with TypeScript too, but the experience is still very different, and the Deno team explains how here.