🔒 Security release for undici (the HTTP client powering Node.js fetch). We've shipped fixes for 8 advisories across all supported lines. Please upgrade: • v8 → 8.5.0 • v7 → 7.28.0 • v6 → 6.27.0 npm i undici@latest Details 🧵👇

A default set from May 2015 was just changed for the first time. One number. One constant. And it was quietly costing Node.js up to 26% of its throughput on the workloads you run every day: file reads, HTTP parsing, and stream chunking. streamyard.com/watch/9y9Q4G...

Memory vs performance. Everyone treats it like a fight where you have to pick a side. The new episode of The Node (and more) Banter asks a better question: can we have both instead?

If you need a nudge to submit your proposal to NodeConfEU, let me tell you I just did and it was the shortest CFP form ever! 😉

Your Node.js service has rate limiting. You tested it. You shipped it. And it is quietly lying to you.

Blind tickets for NodeConf EU are *gone* — but regular tickets are live 🎟️ If you're planning to join us in Bologna, Italy for the best Node.js conference of the year, now's the time. CFP is open too — come speak! www.nodeconf.eu

You set a CPU limit. The node is mostly idle. And your Node.js service still grinds. Latency spikes. Throughput drops. The dashboards say you have headroom. You don't. You're being throttled, and nothing in your app metrics tells you why. Join us May 27th 👇 🔗 streamyard.com/watch/ikRMfg...

OpenSSF welcomes five new members including ActiveState, Aikido, Minimus, TuxCare, and FreeBSD Foundation to strengthen open source software security standards.

We (Platformatic) made Doom run in your terminal. With sound. At 35 fps. Powered by Node.js FFI. It started as a joke at the Node Collaborator Summit in London. Then we actually built it. Meet Destino. 🧵 youtu.be/AtKZjMPAU2A

🎤 NodeConf EU CFP is open! Got something to share about Node.js, performance, or the ecosystem? Come speak in Ireland this fall. ## Tweet 2/2 And yes — tickets are on sale now (blind batch already sold out, so don't sleep on it). Submit + grab your spot: www.nodeconf.eu

Bun rewrote itself from Zig to Rust. AI did most of the work. 98% of the test suite passed on the first run. The question isn't hypothetical anymore. Should we rewrite Node.js in Rust?

Just released AgentScan action v1.6.0, now including support for the workflow on issues as well. Thank you @nodeland.dev github.com/marketplace/...

Everyone setting --max-old-space-size in Kubernetes is doing it wrong. Here's why your Node.js app keeps getting OOMKilled despite your "careful" heap tuning 🧵

I've just updated node-caged to Node.js 26.1.0. Enjoy a @nodejs consuming 50% less RAM. hub.docker.com/r/platformat...

The TanStack supply-chain compromise is a masterclass in why "trusted publishing" isn't enough. 🧵

🔥 NEW BANTER: "We Ran DOOM in a Node.js Terminal. Now There's No Excuse for Your Legacy Native Code" 35fps. With sound. Inside your terminal. Powered by Node.js FFI. 📅 May 13th 🔗 streamyard.com/watch/bagFGb...

NodeConf EU is back in Bologna, Italy and it's going to be special 🇮🇹 Great talks, better people, and the kind of hallway track you can't replicate online. Blind tickets? Already gone. CFP open. Regular tickets moving. Join us: www.nodeconf.eu

Trust me, @nodeland.dev and I talked A LOT about that. I helped kill @expressjs.bsky.social usage at my work, but the numbers keep going up year over year. We need real transition plans, and that takes *work* that is not glamorous.

For those who build or redistribute Node.js - as the V8 implementation of temporal depends on temporal_rs, this also means starting from v26 building Node.js fully requires a Rust toolchain. See github.com/nodejs/node/...

The hidden gem is that @nodejs.org majors and LTS cycles got WAY easier to understand: 2026 -> v26 2027 -> v27 2028 -> v28 ... Aall of them go LTS for 18 months meaning each major is supported for 2 years. The new graphic tells the best story here: nodejs.org/en/blog/anno...

The Axios npm compromise was a social engineering attack — not a leaked password, not a stolen key. The attacker hijacked the maintainer's *live browser session*. As far as npm was concerned, they *were* the maintainer. This exposes a dangerous gap in how we think about supply chain security. 👇

The 2026 Node.js London Collaboration Summit trip report is officially live! 🚀 We gathered 50+ contributors to discuss the biggest technical shifts coming to the runtime. Big thanks to Bloomberg for hosting! 🇬🇧 Check out the full recap and recordings here: https://bit.ly/3OHPLmz

Most teams think autoscaling is solved. Set a CPU threshold. Let Kubernetes do the rest. Then a 3-min spike hits, your pods take 2 min to boot, and the party is over before they show up. New episode of The Node (and more) Banter drops May 6th. 🧵

20x lower median latency than HPA. 6x lower than KEDA. 17x fewer failed requests than HPA. 9x fewer than KEDA. Same app. Same cluster. Same metric. The only thing we changed was the autoscaler. 🧵

Medusa is a flexible open source commerce platform for Node.js. It pushes you toward a multi-app architecture from day one: - backend API - admin UI - storefront - image optimizer - shared env vars - public + internal URLs The repo sprawl problem starts here.

Why is Claude Code so good? It's not just the model. It's that the harness runs in the same host where the code executes. Same filesystem. Same process tree. Same state. That co-location is the feature. And it's exactly what production agents lose.

You can use nvm to kick the tires on `node:ffi`! NVM_NODEJS_ORG_MIRROR=https://nodejs.org/download/nightly nvm install 26

Do not unleash your AI-powered bot into people's GitHub repos without asking first. If you do that on any of the repos I maintain, your bot is likely to get banned. (I've already banned a few).

🔥 NEW BANTER: "AI Agents, Kubernetes, and the Sandbox That Made It Possible" Most teams building AI agents treat Kubernetes like it is optional. Until someone asks how to scale it. Or govern it. @lucamaraschi and I did a full launch week debrief. 📅 April 22nd 🔗 streamyard.com/watch/9n4cF3...

Along with the blog post there's a recording of the interview. Listen to the full interview OR the last 10 minutes (linked). www.youtube.com/watch?v=ZbWx...

I’m so stocked that Codemotion made me as a Magic card. 🥹 See you tomorrow at conferences.codemotion.com/roma/

Another awesome post by @nodeland.dev This express 100% my vision for AI-assisted coding.

Readers spotted that compression was not applied consistently in our React SSR benchmarks. TanStack Start had it disabled while the others had it on. We disabled compression everywhere and re-ran the tests. Here are the corrected results.

🔥 NEW BANTER: "Node.js VFS: Unlocking Dynamic Code, Testing, and Multi-Tenancy" 🔗 streamyard.com/watch/qjiaVX...

I’m stoked by the amount of private feedbacks I’m receiving for leading the AI contributions discussion so far. Thank you all ❤️.

We just launched @Platformatic World 🚀 It brings durable workflow orchestration to Kubernetes with full version safety. If you use @WorkflowDevKit, your workflows now run on your own cluster with the same guarantees you get on @Vercel.

Hey I wrote a personal blog post... www.jasnell.me/posts/ai-in-os

Next.js 16.2 • Up to ~60% faster rendering • Up to ~400% faster 𝚗𝚎𝚡𝚝 𝚍𝚎𝚟 startup • Server Function 𝚍𝚎𝚟 logging • Redesigned error page • Better hydration errors • 𝙴𝚛𝚛𝚘𝚛.𝚌𝚊𝚞𝚜𝚎 display in error overlay nextjs.org/blog/next-16-2

🧵 I wrote almost 19,000 lines of code for a Virtual File System in @nodejs.org core using Claude Code. It started over Christmas and has been refined over almost three months of review. A collaborator challenged whether AI-assisted contributions can meet the DCO requirements. Here's what happened:

Now that I’m using both Claude and Codex daily, I’m seeing that Claude tries to “cheat” more often, eg deleting a failing test. What’s your experience?

Your coding agent keeps making the same mistakes? I built a fix. Introducing pi-self-learning: a pi extension that gives your coding agent actual memory. It extracts what went wrong after each task, scores learning by frequency/recency, and automatically injects them into context. 🧵 👇

.@nodejs has always been about I/O. Streams, buffers, sockets, files. But there's a gap that has bugged me for years: you can't virtualize the filesystem. You can't import a module that only exists in memory. You can't bundle assets into a Single Executable without patching half of core. 👇

Here is a fun one. Somebody is using an AI to post a message (relavant, but stating the obvious) on ALL issues on one of the orgs I’m managing on github. The net result is literally a DoS on maintainers, because he is making any kind of notification management useless. Shall I ban?

A number of years ago, @nodeland.dev and I did a keynote at Node.js Interactive in Vancouver on the theme of Open Source is Art. Nearform created some popular swag T-shirts based on the theme. (It was actually Cian O Maidin's talk but he couldn't make it so Matteo and I delivered it...

🔥 NEW BANTER: "Why Node.js Is the Critical Enabler for AI Applications" Everyone's building AI apps. Almost nobody's talking about what runs them. Hint: it's not Python. @lucamaraschi and I make the case for Node.js as the backbone of production AI. 📅 March 18th

This NodeWeekly release is the best nodeweekly.. or at least the one with the best image! nodeweekly.com/issues/615

🎯 After years of building with Node.js, I've organized my hard-won knowledge into skills: a collection of best practices, workflows, and deep expertise my AI assistant uses to write code to my standard. No more repeating myself on every code review. 👇

Grammarly uses AI trained on my talks to review articles. Especially my new articles. I find this flattering and amusing... but also a bit worried for the future. What would you do if they trained an AI after your style?

Are you hosting Next.js on K8s? Your Next.js image optimization is quietly killing your frontend performance. We (@platformatic) just shipped a way to fix it without changing a single line of your app code 🧵

🔥 NEW BANTER: Kubernetes Finally Gets Vercel-Style Deployment Safety