🔥 I've been debugging @nodejs.org performance for over a decade. The hardest part? Making sense of thousands of stack frames in a flamegraph. What if your AI assistant could do that for you? Today, we're releasing a new feature in `@platformatic/flame`. 🧵

Mike Arnaldi wrote that software development is dead. He's right about a lot of things. But he's missing something critical. I wrote a response 👇 🧵 adventures.nodeland.dev/archive/the-...

Do you like a free tool? Send money. Do you use a tool at work? Convince your employer to sponsor it. Stop marketing OSS as free stuff to your employer, and treat it as a cost for the company. You only endanger the OSS project, if you don't give something in return.

On @netlify.com this has minimal impact: a malicious request can't affect other requests on our serverless architecture, but cold starts + function costs could increase. If your Functions use v18, please upgrade. All others will receive automatic rolling patches: www.netlify.com/changelog/20....

🔥 NEW BANTER: "When Recursion Crashes Your App: The Async Hooks DoS Nobody Expected" Your try-catch blocks won't save you. Your uncaughtException handlers won't fire. Your server just... dies. @lucamaraschi and I break down why. 📅 Jan 21st 🔗 streamyard.com/watch/dwZbc7...

Bun is fast, until latency matters for Next.js. We benchmarked the same Next.js app across Node.js, Deno, Bun, and Watt (our multi-threaded Node-based runtime) under identical load on AWS EKS. Throughput looked fine across the board. Latency told a very different story. 🧵

Today the Temporal proposal has entered the stable stream shipping Chrome 144. This opens the gates for attaining Stage 4 at TC39. That means tonight I will be purchasing a supply of champagne in preparation. It’s been a long journey and so very worthwhile!

Today, we published a security release for @nodejs.org that fixes a critical bug affecting virtually every production Node.js app. If you use React Server Components, Next.js, or ANY APM tool (Datadog, New Relic, OpenTelemetry), your app could be vulnerable to DoS attacks. 👇

"Just use markdown and git. No CMS. No backend. Pure simplicity." Until you need to share content across pages. Until you need permissions. Until you need AI agents to actually understand your content. Then you're building a backend again 🧵

🔥 10,000 requests. 2 approaches to multi-threading. 1 React-Router. PM2 failed on nearly 70% of requests. Watt? Only 38%. Here's what we learned about Node.js scaling 🧵

Oh hi. 👋 We're back with the latest Security Snapshot that covers how to publish to npm safely and with ease. ✨ @rafaelgss.dev breaks down why local publishing with 2FA gives you the safest setup right now.

Deno v2.6.2 will ship with a major improvement to the debugger - Web workers, `node:worker_threads` and stopping in any test file will now be supported! This will work in both VS Code and Chrome DevTools. PRs for the curious: github.com/denoland/den... github.com/denoland/den...

A strange-looking payload broke React Server Components. One missing safety check. Prototype pollution meets dynamic evaluation. Remote code execution on any vulnerable server. Security researchers called it "CTF-level" complexity. But the root cause? Surprisingly simple 🧵

🚀 Big news: @platformatic/python-node v2.0.0 is here! Full HTTP streaming + bidirectional WebSocket support. Build real-time apps with Python ASGI frameworks like FastAPI running directly inside Node.js. No separate server, no proxy overhead. Thread 🧵

🔥 NEW BANTER: "The Node.js (R)evolution Started: AWS Just Made It Official" AWS re:Invent just unlocked multi-concurrency for Lambda Node.js. 64 concurrent requests per vCPU. Up to 90% cost reduction at scale. Lambda finally caught up with Node.js 🧵 📅 Dec 10th 🔗 streamyard.com/watch/RMrhyz...

30 years ago today (1995-12-04): “Netscape and Sun announce JavaScript, the open, cross-platform object scripting language for enterprise networks and the internet” web.archive.org/web/20070916... #JavaScript

🔥 NEW BANTER: "93% Faster Next.js: What Our Benchmarks Really Reveal" Running Next.js in Kubernetes should be simple. Spoiler: It's not. Your pods are fighting each other while your users wait. @lucamaraschi and I break down what's actually happening. 📅 Dec 3rd

We made @platformatic/kafka 223% faster. But the real story? We discovered our benchmarks were lying to us. Here's what happened 🧵

We just made Next.js 93% faster in Kubernetes. Not a typo. Median latency: 182ms → 11.6ms Success rate: 91.9% → 99.8% How? We stopped fighting the Linux kernel and started working with it. Thread on why your Node.js pods are slower than they should be 🧵

Your Next.js app feels fast locally. Under real traffic while self-hosting? 🔥 Request timeouts spike 🔥 Tail latencies explode 🔥 Random slowdowns appear 🔥 CPU usage makes no sense The culprit isn't your code. It's how rendering fights for the event loop 🧵

🚀 Self-hosting Next.js has just received a massive upgrade! @platformatic Watt v3.18 brings Vercel-level distributed caching to YOUR infrastructure with Next.js 16's 'use cache' directive + Redis/Valkey. No more cache inconsistencies. No more wasted resources. Production-ready scale. Here's how 🧵

Next.js made React development "easy." But self-hosting on Kubernetes? 🔥 Event loop blocked by SSR rendering 💀 One slow component blocks ALL pods 💾 Memory leaks compound under load 🚫 No platform magic to save you Time to face the reality 🧵

Yes, say open source advocates and @platformatic.dev founders @nodeland.dev and Luca Maraschi. They also discussed how React needs to evolve. By @lorainelawson.bsky.social

Ever built a "simple" distributed system that turned into a 3 AM production nightmare? 💀 You started with Kafka (or RabbitMQ) and a few services. Now you're juggling retries, compensations, and correlation IDs like it's a circus act. Time to talk about the workflow orchestration wars 🎧⬇️

🔒 We just shipped application-level file system permissions in @platformatic.dev Watt! The simplest way to segregate your Node.js microservices - leveraging Node.js's native permission model to control exactly what files each service can touch. Here's why this matters 🧵

Don’t comment on individual commits on GitHub. Thanks.

🚀 Noop Functions vs Optional Chaining: A Performance Deep Dive I ran benchmarks comparing `noop()` vs `obj?.fn?.()` and the results surprised me. Spoiler: Noop functions are 5.5x to 8.8x faster. Here's what you need to know 🧵

Having poured my soul into open source since 2008, I was nodding hard at @cory.laviska.com’s post. “It's all take and no give. And I've already given more than enough for two lifetimes.” There’s something especially irritating in watching companies profit off your work without contributing a dime.

🚀 New blog post: "From curl Commands to Type-Safe API Clients" Ever copied curl commands from DevTools to reverse-engineer an API? What if you could turn those into production-ready, type-safe HTTP clients automatically? Here's how 👇

Profiling Node.js used to feel like surgery with a rusty spoon 🩸— kernel tools, V8 magic, pain. Meet @platformatic/flame: zero-config, instant flame graphs. npx flame run server.js → 60 fps insights, no fuss. Performance, democratized. 🔥 @nodeland.dev talk 👉 youtu.be/v7oc80C9vlg #NodeJS #OSS

🔥 BIG NEWS: @platformatic/flame and Watt Runtime now support heap profiling! Finally tackle those memory leaks and optimize your Node.js apps with comprehensive insights into BOTH CPU time AND memory usage. No more guessing where your memory is going 🎯

🎙️ NEW PODCAST: "Node.js Loves Python" What if you could run Python ASGI apps inside your Node.js services? No proxies. No overhead. Just seamless integration. @lucamaraschi & @matteocollina explore how @platformatic/python makes this possible 🚀

🚨 A spurious CVE against fast-redact forced us to rethink everything about log redaction in Node.js The result? slow-redact - a new package that's not actually slow, but guarantees your objects are never mutated Here's why immutability beats speed every time 🧵

#TodayMyPullRequest Make @fastify.dev's etag 70% to 110% faster on medium (2 KiB) to large (2 MiB) inputs: github.com/fastify/fast...

🚨 Another major npm supply-chain attack just hit — and it’s a wake-up call for anyone building on open source. I join @nodeland.dev — creator of Fastify, Node.js core maintainer, and an open-source legend — and Luca Maraschi to break down how attackers are infiltrating npm.

🚀 BIG NEWS: We just shipped @platformatic/python - run Python ASGI apps INSIDE your Node.js process! This changes everything for AI/ML + Node.js apps 🧵 youtu.be/8eAAP9IF4xA

🚨 The npm ecosystem just got hit with another major supply chain attack. If your app uses npm packages (spoiler: it does), you must hear this. We're sitting down with @feross from @SocketSecurity to dissect what happened and how to protect yourself. Thread 👇

🎉 Proud to announce @platformatic.dev is renewing our Open Source Pledge for 2025! We have committed $12,500+ to support the maintainers and projects that power the Node.js ecosystem. Because sustainable open source requires more than code—it requires financial backing.

🎙️ “Be curious and don’t trust everything you read online.” Join our conversation with @nodeland.dev — Co-Founder & CTO of @platformatic.dev, Node.js TSC member, creator of Fastify & Pino, and prolific open source contributor with modules downloaded over 17 billion times a year.

Thanks you @lnugOrg tickets go fast everyone wants to meet and learn from @nodeland.dev and @platformatic.dev - our events next week will be packed! Make sure you get the last few tickets - just 4 left - Final 4 cityjsconf.org/workshops

Remember that thread about Node.js + Kubernetes performance issues? Plot twist: K8s and Node.js are actually a PERFECT match. The problem? Most teams are using 2010 patterns for 2025 architecture. On October 1st, we will discuss how to do it right. Time to level up 🧵

This is the @nodeland.dev effect! He decides to do a workshop in London and this gets #Soldout Register for the free meetup - 30/9 guild.host/events/jsmonth…

Five days until my Node.js workshop in London and this is it - final call for seats If you've been following along for the past 6 weeks, you know this isn't another basic tutorial This Monday, September 29th, we're diving deep into production Node.js 🧵

🚀 Enterprise Node.js apps are powerful but complex. Over-provisioned clusters, slow autoscaling, and disconnected metrics are silently killing your budget and risking outages. What if you could predict problems before they happen? Join us tomorrow, Sep 24th 👇

Open source foundations don’t run on “magic piles of money.” Registries, CDNs, CI pipelines, security response and compliance work all require sustained support. Read why OpenJS joined peers in signing “Open Infrastructure is Not Free.” 🔗 hubs.la/Q03KtFgr0

🚀 BIG NEWS: We just open-sourced the Intelligent Command Center (ICC) for Node.js! After years of watching teams struggle with Node.js on Kubernetes, we're changing the game. The problem? K8s was built for Java/.NET, not Node.js's async model. The cost? 40% overprovisioning. 🧵

We need to talk about Node.js in Kubernetes. The platform meant to deliver elasticity is actually slowing Node.js down and making it more expensive to run. Here's why your "autoscaling" might be bleeding money 🧵👇

Given all the questions about native TypeScript support in Node.js, I should prepare some content to explain it. Maybe somebody already did, and I couldn't find it. Do you know about content explaining it from the user perspective (like how to convert from a compiled app to type stripping)?

ℹ️ Don't know who needs to hear this but npm has had a --before=<date> flag since v6.9.0 (02/2019): github.com/npm/cli/blob/v… Setting a relative date is easy w/: $ npm install --before="$(date -v -7d)" # & only get registry deps that are over a week olddocs.npmjs.com/cli/v11/usin...re

Moving a client's old email system from Meteor + MJML to @fastify.dev + react.email 💌 - Actual @react.dev for templating (w/ Context for nested components) - TailwindCSS for styling - Type-safe props on render (no more failed/missing expansions) Neat.