Node Weekly

Playwright's exciting new page.screencast API

Thu, 23 Apr 2026 00:00:00 +0000

#621 — April 23, 2026

🎥 Playwright has added a new feature I thought was neat, so I've written a bit about it at the end of this issue – check it out!
__
Peter Cooper, your editor

aube: A New Node.js Package Manager — Yes, another one! What’s noteworthy is it comes from the developer of mise, a tool that makes managing numerous languages so much easier. aube’s selling points are raw performance and being a drop-in replacement. Its defaults are also security-focused.

Jeff Dickey

Write Better Prompts — Join GitHub's Sabrina Goldfarb for this detailed video course on generating higher quality code with AI. Learn practical prompting techniques that work consistently across tools and transform your project ideas into reality.

Frontend Masters sponsor

Writing Node.js Addons with .NET Native AOT — You can now write native Node addons in .NET languages like C#. Native AOT compiles programs to shared libraries (or executables) which can expose N-API entry points for Node to call into, much like a C/C++ extension.

Drew Noakes (Microsoft)

IN BRIEF:

🇪🇺 NodeConf EU is back. It's in Bologna, Italy this September 29-30. Tickets are on sale, and here's the CFP if you want to speak.
Maël Nison, the maintainer of Yarn, is working on a new Node feature to support package maps where Node can resolve packages using a static JSON file instead of walking node_modules.

TypeScript 7.0 Beta: A 10x Faster TypeScript Compiler — The first beta of the Go-powered native port of TypeScript boasting “about 10 times faster” performance. TypeScript 6.0 remains important as a transitional release in your upgrade process, as TS 7.0 shares 6.0’s default config changes and 6.0’s deprecations are now hard errors. There are also changes to how to write your code to take into account.

Microsoft

Build Durable AI Agents That Won’t Break in Production (Webinar) — Learn the open-source 4-layer stack and run durable AI agents with Agentspan across LangGraph, OpenAI, and Google SDKs.

Orkes sponsor

📄 Delivering a Dynamic Hexagonal World Map in 10KB – How a developer built a hexagon-based SVG world map using a Node-based pipeline with Turf.js to simplify GeoJSON. Ben Schwarz

📄 Features Everyone Should Steal From npmx – npmx is a fantastic way to browse the npm package registry. Andrew Nesbitt

🛠 Code & Tools

Optique 1.0: Type-Safe Combinatorial CLI Parser — Build composable parsers for CLIs with type safety, type inference, and built-in shell completion support, plus config file integration and man page generation from the same definitions. v1.0 is the first stable release and Hong compares it to Commander.js and explains why you'd use Optique.

Hong Minhee

DocMD: Build Production-Ready Docs from Markdown — A Node-powered zero-config documentation site generator with a focus on producing lean, fast output (its own docs are a good example). It has i18n and versioning built-in and, as of this week, a deploy command to produce ready-to-deploy files for Docker, Nginx, and Caddy.

docmd

rocksdb-js: New RocksDB Bindings for Node — It’s been messy using Facebook’s RocksDB key-value store from Node in recent years, but finally there’s a new, modern native addon for the task. GitHub repo.

Chris Barber (Harper)

Bun v1.3.13: Smarter Testing and Less Memory Usage — The alternative runtime enhances bun test with options for test environment isolation, parallelization, and to run only those tests affected by recent changes. The runtime uses 5% less memory and bun install gets faster, among other things.

Jarred Sumner

pnpm/action-setup@v6 – The GitHub Action to install/configure pnpm adds pnpm v11 support.
node-mssql 12.5 – Microsoft SQL Server client library. You can now set per-request timeouts.
type-flag 4.2 – Strongly typed command-line arguments parser.
MongoDB Node.js Driver v7.2.0 – The official MongoDB driver.
Mongoose 9.5 – MongoDB object modeling library for Node.
pg-boss 12.16 – Postgres-backed job queue for Node apps.
xero-node 15.0 – Node SDK for Xero accounting software.
np 11.2 – Feature-packed alternative to npm publish.

📰 Classifieds

Skip the README archaeology. Flox delivers reproducible dev environments with no system pollution. One command, zero friction. Try it free.

Gauntlet. A 10-week no-cost fellowship building the AI skills companies need. Learn to ship faster with AI. Land a $200K+ job. Apply now.

⚙️ Build AI agents like you build APIs. Orchestrate not just LLMs — but Claude Code, Codex & full coding harnesses. Open-source TypeScript SDK. agentfield.ai.

🎥 Playwright's page.screencast API

The newest version of the popular Playwright Web testing and automation library (v1.59.0) boasts a new page.screencast API to make recording videos more flexible. I took it for a spin and liked what I saw.

You can now start and stop video recording in a more granular way than recordVideo allowed:

await page.screencast.start({ path: 'video.webm' });
// do stuff here
await page.screencast.stop();

But the real fun begins when you use its new visual annotation and custom HTML overlay features.

I created a basic HTML form and a Playwright script to test out the new features and you can basically create full screencast style videos with it:

Here's the code for the section above:

await page.screencast.showChapter('Step 4 — Interests', {
  description: 'Multiple checkboxes',
  duration: 1400,
});
await page.locator('#interests input[value="testing"]').check();
await page.locator('#interests input[value="tooling"]').check();

Read the full release notes for what you can do, but this strikes me as a fantastic way to automatically generate good-looking videos you can slot into your documentation.

There's also a new playwright-cli show command that brings up a dashboard where you can see all the currently running browsers, interact with them, and open DevTools to inspect what's going on.

Node moves toward Temporal by default

Thu, 16 Apr 2026 00:00:00 +0000

#620 — April 16, 2026

Read on the Web

Node Moves to Enable Temporal By Default — The Temporal API, designed to modernize JavaScript’s date/time handling, reached stage 4 last month. Node was waiting on V8 to make it enabled by default, which happened in V8 14.4, and the wheels are now in motion for an eventual release in Node 26.

Richard Lau

Node.js 24.15.0 (LTS) Released — The LTS release of Node gets a few goodies from v25 including require(esm) and the module compile cache being marked as stable, as well as --max-heap-size and OpenSSL 4.0 build support.

Antoine du Hamel

Stop Juggling 5 Tools to Monitor One Node App — Errors, performance, logs, uptime, host metrics — AppSignal handles all of it for your Node.js stack. Auto-instruments Express, Koa, Prisma, and BullMQ out of the box. Request-based pricing, unlimited seats. Free 30-day trial, no credit card.

AppSignal sponsor

The OWASP NPM Security Best Practices Cheat Sheet — A long-standing resource that continues to be updated and remains a useful checklist. Recent updates tackle disabling lifecycle scripts, typosquatting, trusted publishing, and dependency confusion.

OWASP Cheat Sheet Series

Uses for Nested Promises — James revisits 2013's Promises/A+ monads debate and has changed his mind, thanks to a real concurrency problem he ran into. Demanding but rewarding.

James Coglan

📄 The Simplest C-to-WebAssembly-to-Node Pipeline – The simplest steps to take a function written in C and compile it to run from Node with WASM. A 2018 experiment of mine updated for the modern day. Peter Cooper

📄 What We Learned Building a Rust Runtime for TypeScript Ivan Cernja (Encore)

📄 Build a Movie Watchlist with Node.js, TypeScript, and MongoDB Nic Raboy

🛠 Code & Tools

🦠 Pompelmi 1.0: Antivirus File Scanning from Node — A wrapper for ClamAV, originally designed for scanning for malicious uploads in Node apps. It’s standalone and no daemons are required as it spawns ClamAV as-needed. v1.0 landed a few days ago as its first stable release. GitHub repo.

pompelmi contributors

📄 officeParser: A Library to Parse Common Office-Related Formats — Covers formats like docx, pptx, xlsx, odt and others used by tools like Microsoft Office and LibreOffice. GitHub repo.

Harsh Ankur

You Already Have Postgres. Why Not Make It Handle Analytics? — TimescaleDB adds hypertables, 95% compression, and continuous aggregates. No second database, no pipeline. Try for free.

Tiger Data (creators of TimescaleDB) sponsor

📈 Micro-ML: A Toolkit of Forecasting and Clustering Algorithms — A ~56KB WASM-powered library with algorithms for regression and smoothing. Cluster points, classify data, or predict the next value in a series without dragging in TensorFlow.js.

Adam Perliński

🔊 Audio: High-Level Audio Manipulation in Node — Take audio, trim it, normalize loudness, add fading, detect notes/chords, perform filtering, and more. No ffmpeg needed. From the same creators as the web-audio-api project featured last week.

audiojs project

x-win: Inspect Open and Active Windows from Node — Obtain the position, size, app icon, and title of windows open on macOS, Linux, and Windows, as well as the process info and memory usage of their underlying processes.

Hocine Benkhadra

🖼️ terminal-image 4.3 – Display images in the terminal, whether by colorized ANSI blocks or full resolution (in terminals that support it).
Jazzer.js 4.0 – Coverage-guided, in-process fuzzer for Node based on LLVM's libFuzzer. Now supports pure ESM code.
📊 Chartbrew 5.0 – Powerful Node and React-powered live data dashboard app.
Happy DOM 20.9 – JS implementation of a web browser without the GUI.
🎨 Color Thief 3.0 – Extract color palettes from images.
node-mssql 12.3 – Microsoft SQL Server client.
🤖 GramIO 0.9 – Telegram Bot API framework.

📰 Classifieds

💌 What is happening at Heroku?? Judoscale wrote a letter from the dev community, expressing our concerns.

Gauntlet. A 10-week no-cost fellowship building the AI-first engineers hiring managers need. Ship production AI. Land a $200K–$950K job.

📢 Elsewhere in the ecosystem

FluidCAD (above) is a new project bringing parametric CAD to the JavaScript world where you can write code to create/manipulate objects and see a live update of what you're making. It's built on top of OpenCascade.js, a JS/WASM port of the open source OpenCascade 3D geometry library.
A full Windows 95 experience in an Electron app. v5.0 lets you share a local folder as a Z: drive, mount ISOs, and share the clipboard.
A quick ten year flashback to when the V8 project blogged about Orinoco, its then-under-development parallel and concurrent garbage collector which is now a fundamental part of Node's performance story.
Ally Piechowski shares the git commands she runs before reading any code. They provide a handy way to get a quick grasp on what's happening in larger, multi-contributor repos.
A cautionary read for anyone running Node on AWS Lambda with MySQL or MariaDB: The AWS Lambda 'Kiss of Death' walks through how connection reuse can leave transactions dangling, causing InnoDB's history list to grow unchecked until the database freezes.
GitHub has opened a private preview of Stacked PRs, giving native support for a workflow where one big change is split into a chain of dependent PRs.

Social engineering attacks target high-impact Node.js maintainers

Thu, 9 Apr 2026 00:00:00 +0000

#619 — April 9, 2026

Read on the Web

A Post-Mortem of the Axios Compromise — The Axios team has shared a detailed post-mortem of the recent supply chain compromise where a trojan was pulled in as a malicious dependency. The attack was well planned and involved a sophisticated bit of social engineering.

Jason Saayman / axios

⚠️ Axios isn't the only target. Sarah Gooding reports on ongoing attempts to socially engineer 'high-impact Node.js maintainers.' It's worth being aware of these techniques if you maintain any public npm packages.

You Don’t Have To Attend All 44 Postgres Talks — POSETTE: An Event for Postgres 2026 is a free & virtual developer event on 16-18 Jun. All 44 talks stream live & will be available later. Join live to take part in discussions with speakers & attendees. Check out the schedule and mark your calendar.

Microsoft | AMD sponsor

You Can't Cancel a Promise (Except Sometimes You Can) — You can’t cancel a promise, but you can halt an async function by making it await a promise that never resolves. The function silently stops, and GC cleans up after it. It’s not just a trick; Inngest uses it in production to interrupt long-running workflow functions.

Aaron Harper (Inngest)

IN BRIEF:

Google's compilers team has proposed a high-level IR for JavaScript and shared a tool (JSIR) it's already using internally to take advantage of it for analysis and source-to-source transformation.
Microsoft has announced the end of support for Node 20.x in the Azure SDK for JavaScript.
npm trusted publishing now supports CircleCI as an OIDC provider.
🎤 A 50-minute chat (with transcript) from two of the developers behind the npmx project — an increasingly popular way to browse the npm registry.

Node's Security Bug Bounty Program Paused Due to Loss of Funding — Since 2016, the Node.js project has offered bounties for qualifying security vulnerability reports. This was funded by the Internet Bug Bounty program which is on hiatus as it figures out its role in an AI-assisted landscape. Reports can still be made, but with no monetary reward.

The Node.js Project

tsdown Can Now Generate Executable Files for Node Apps — tsdown, the library bundler from VoidZero (Evan You's company), now supports building standalone executables using Node's Single Executable Applications (SEA) feature.

VoidZero

📄 Building a Runtime with QuickJS Andrew Healey

🛠 Code & Tools

web-audio-api: Use the Web Audio API from Node — Get full Web Audio API support in Node and play audio on your machine or render it to file (and, yes, Tone.js works too). There are lots of examples to enjoy. v1.0/1.3 supports all 26 audio node types and has a 100% pass rate against the WPT test suite.

Sébastien Piquemal

🗣️ TinyTTS: English Text-to-Speech with a 3.4MB Model — Fast text-to-speech on the CPU with a tiny 3MB model for both Node.js and Python. Has an AI-generated vibe, but it worked well when I used it like this. There’s a demo on the Web to hear what it sounds like.

tronghieuit

Analytics Doesn't Need Its Own Infrastructure — TimescaleDB extends Postgres so analytics runs on live data. Same connection, no pipeline, no second database. Start for free.

Tiger Data (creators of TimescaleDB) sponsor

Marked.js 18.0: Fast Markdown Parser Library — A low level Markdown compiler built for speed, available as both a client and server-side library. The demo shows off the basics. v18 is a bug fix release that also bumps it up to TypeScript 6. GitHub repo.

Christopher Jeffrey

🤖 grammY: An Up-to-Date Telegram Bot Framework — “Make creating Telegram bots so simple you already know how to do it.” This week’s release supports the latest Telegram Bot API 9.6. GitHub repo.

KnorpelSenf

tokenu: du-Like CLI Tool to Count Token Usage in Files and Directories — Could be useful to see if your codebase can fit entirely into a sensible context window, say.

Liran Tal

ky 2.0 – Sindre Sorhus's popular, elegant HTTP client library that wraps fetch gets a big upgrade including setting a totalTimeout across all retries, and baseURL for standard URL resolution to make your calls even simpler.
npm-check-updates 20.0 – Upgrade package.json dependencies while preserving semantic versioning policies. Now supports cooldowns.
ESLint 10.2 – Adds support for language-aware rules through a new meta.languages property. Temporal is now supported too.
Ink 7.0 – Build CLI/TUI apps using React. Now uses React 19, requires Node 22+, and adds a lot of useful hooks.
content-disposition 1.1 – Work with HTTP Content-Disposition headers.
Orange ORM 5.3 – The Node and TypeScript ORM adds MariaDB support.
Axios 1.15.0 – The popular HTTP client adds Bun and Deno support.
RedisSMQ 10.0 – Simple Redis-backed message queue for Node.
node-ical 0.26.0 – iCalendar/ICS (RFC 5545) parsing library.
Undici 8.0 – HTTP/1.1 client written from scratch for Node.
pnpm v11.0 Beta 8

📰 Classifieds

⚡Route product events to HubSpot, Salesforce, Slack & more in one API call. Retries, fan-out, and delivery guarantees built in.

Ship production AI. Land $200K–$950K. Gauntlet's 10-week no-cost fellowship builds the AI-first engineers hiring managers actually want.

📢 Elsewhere in the ecosystem

Keen to brush up your knowledge of modern JavaScript? Chris Coyier's What To Know in JavaScript (2026 Edition) tours the latest language features, plus the state of the most popular runtimes and build tools.
🤖 A developer discovered an npm package where the postinstall script copied Markdown files into Claude Code's config. While likely not malicious in this case, it's a vector ripe for abuse and worth knowing about. Ignoring postinstall scripts is a wise option, and something pnpm v10+ does by default.
🇷🇴 The popular JSHeroes conference is back this May 14-15 in Romania.
Engineers at the Railway cloud hosting platform shared their story of moving their frontend off Next.js to Vite and TanStack Router.
Puru is a new project offering a channels-inspired 'Go-style concurrency' option in Node and Bun.

Node.js 25.9 brings --max-heap-size and better, iterable streams

Thu, 2 Apr 2026 00:00:00 +0000

#618 — April 2, 2026

Read on the Web

Node.js 25.9.0 (Current) Released — Including a --max-heap-size option to set the maximum heap size for a process, James Snell’s experimental ‘better streams API’ implementation lands as stream/iter (docs here), plus test runner module mocking improvements.

Antoine du Hamel

Memetria K/V: Efficient Redis & Valkey Hosting — Memetria K/V hosts Redis OSS and Valkey for Node.js apps, featuring large key tracking and detailed analytics.

Memetria sponsor

The Hidden Blast Radius of the Axios Compromise — You’ve probably heard about the supply chain attack via Axios this week (if not, be sure to check if you’re affected). Ahmad reflects on the mechanics of such attacks and why their effects spread further than you might think.

Ahmad Nassri (Socket)

💡 If you want to mitigate such attacks, Dani Akash has a guide to using 'minimum release age' cooldowns with npm, pnpm, Bun, and Yarn.

IN BRIEF:

MSW's Artem Zakharchenko shares a step-by-step guide to publishing to npm securely in 2026.
The source code for Claude Code leaked a few days ago due to the accidental shipping of source maps in its npm package. A Bun-related issue^? (or not?) but a reminder of how powerful source maps can be.
Cloudflare has released EmDash, a 'spiritual successor to WordPress' that runs both on Cloudflare or 'any Node.js server'.

A Gentle Intro to npm Workspaces — With workspaces, you can manage multiple packages in one repo and link local packages so they can import each other by name. npm may then hoist and deduplicate compatible dependencies during install.

Carlos Precioso (Wasp)

Run Agents on Production-Fidelity Sandboxes — Ox spins up a sandbox for every agent task. Isolated code, compute, and data. Test against prod with zero blast radius.

Ox sponsor

▶️ Most Developers Misunderstand Node.js in Production – A quick 6-minute interview with core contributor Ulises Gascón. Beyond.js (NodeSource)

🤖 Getting Started Building Agents with the Vercel AI SDK in Node Valeri Karpov

📄 Escaping Node.js's Permission Model via Brotli maitai

📄 Why We Replaced Node.js with Bun for 5x Throughput Nick at Trigger

🛠 Code & Tools

🤖 Transformers.js v4: Run AI Models from JavaScript — Run Hugging Face-hosted models to do things like LLMs, vision, and audio models from Node, in the browser, etc. v4 switches to WebGPU and is installable with npm. There are many demos covering speech transcription, using Qwen 3.5, and video captioning.

Hugging Face

💡 The browser demos use large model downloads, so server-side use with Node may be the best use case, even if not the coolest.

node-re2: Bindings for Google's RE2 Regex Library — RE2 is a regular expression library with linear-time matching, making it immune to ReDoS attacks caused by backtracking. node-re2 offers it as a near drop-in replacement for RegExp.

Eugene Lazutkin

Defuddle: Extract the Main Content from Pages — Strips clutter from HTML leaving only the primary content for you to use. There’s a demo where you can try it out.

Steph Ango

dotenv 17.4 – Loads environment variables from .env files into process.env. While now a built-in Node feature, dotenv is a popular dependency with 100M+ downloads a week and offers finer-grained control over the process.
numpy-ts 1.2 – NumPy implementation for TS/JS. Now at ~50% native perf and with Float16 support. (Homepage)
Path-to-RegExp 8.4 – Library to convert path strings with parameters into regexes.
globby 16.2 – Promise-based glob matching, now with global gitignore file support.
ts-blank-space 0.8 – Pure JS type-stripper using the TypeScript 6 parser.
Aedes 1.0.2 – Node.js MQTT broker that runs on any stream server.
Ky 2.0 Prerelease – Popular HTTP client based on the Fetch API.
Got 15.0 – Human-friendly, powerful HTTP request library.
ESLint Markdown Plugin 8.0 – Lint Markdown with ESLint.
file-type 22.0 – Detect the file type of binary files.

📰 Classifieds

🧐 A cheaper Heroku? Our cost comparison calculator puts the PaaS alternatives head-to-head.

Become an AI-first engineer. Gauntlet is a full-time fellowship, no cost. $200K+ roles. Next cohort starts 4/27. Apply Today

SerpApi is a Web Search API for accessing Google and other search engine results in structured JSON. Try SerpApi for free.

📢 Elsewhere in the ecosystem

WWWBasic is a curious Google-hosted project to use the BASIC language in script tags or within Node apps. It's had its first update in years (1.0.2) to add ESM support and improve a few things. This seems to be a true labor of love for Googler Brad Nelson.
QuickBEAM is a JavaScript runtime for Erlang's BEAM VM, as also used by Elixir. It offers compatibility with core Node.js APIs.
Deno v2.7.11 has been released with "tons of Node.js compatibility improvements" covering crypto, child_process, workers, and TTY handling on Windows to match libuv's behavior.
wasm-git is a WASM-compiled version of Git you can use directly from Node. We first linked to this six years ago when it was a mere experiment, but it's come a long way since then.