12 Node built-ins that replace npm packages

#​642 — September 24, 2026

Read on the Web

⚠️ We're taking a week off next week, so we'll be back on Thursday, October 8.
__
Your editor, Peter Cooper

Node.js Built-ins That Replaced npm Packages — A practical tour of 12 Node built-ins that replace packages like axios, dotenv, nodemon and chalk. Each is explained with its stability level in Node 24 LTS and gotchas that might make you want to stick with your existing dependency anyway.

Flavio Copes

CodeAF: The Open-Source Software Factory for Open Models — Instead of juggling a terminal for every agent, you get one window for every project. Hand work off: it splits it into parts, runs them in parallel, tests what comes back and merges what passes. Many models, one session: the right one for each call.

AgentField.ai sponsor

Node.js 26.10.0 (Current) Released — Built-in, promise-based util.debounce() and util.throttle() arrive, complete with AbortSignal support. There’s also util.markPromiseAsHandled() to help retire .catch(() => {}) hacks. Plus a little more besides.

Antoine du Hamel

💡 Node v22.23.3 (LTS) also landed with updated root certificates and dependencies (OpenSSL, npm, and Undici) plus minor fixes.

IN BRIEF:

• From Node.js 27, Intel Macs drop to only having 'experimental' support, meaning no official x64 macOS builds and an arm64-only installer.

• James Snell has proposed a --process-timeout flag that kills a stuck process, even one in a tight loop, and reports what kept it alive.

• GitHub Actions has removed Node 20 from its runners so if you maintain an action, switch runs.using to node24 and publish a new release.

• Yagiz Nizipli has opened a PR that shrinks the node binary by about a third (147MB to 95MB on macOS arm64) using extra compression and stripping symbols. Notably, 𝕏 Grok was used to do this work.

• Daniel Lemire explains how AI-assisted experimentation made several libraries that ship in Node faster, including Ada, simdjson and simdutf.

npm Tokens Can Now Stage Releases Without Publishing Them — A new token permission lets CI stage npm releases but not publish them, with a maintainer approving each staged version with 2FA. It offers a migration path ahead of npm's planned ending of direct publishing using bypass-2FA tokens in January 2027 if you can’t use trusted publishing yet.

GitHub / npm team

📄 How I Traced a Node.js Streams Bug in Duplex.from() – A first-time core contributor's path from issue to PR. Aman Chadha

📄 Publishing a Subfolder to npm for Cleaner Package Paths – How to keep dist/ (or src/) out of your package's import paths. Bramus

📄 Faster SSE Responses with Async Generators and Promise.race() Valeri Karpov

🛠 Code & Tools

secure-eval-worker: A Safer eval() via Node's Permission Model — A new way to run untrusted (or AI-generated) JavaScript in a locked-down worker with timeouts, memory caps, and access only to the host functions you choose. Node 26 only, and not a true sandbox.

Matteo Collina and Luca Maraschi

🔒 CVE Lite CLI: Scan Your Lockfile, Get the Upgrades to Run — An OWASP-backed scanner that reads your lockfile, checks it against OSV and npm’s advisories, and gives you npm/pnpm/Yarn/Bun commands to use, including which parent package(s) to bump for transitive issues.

Sonu Kapoor and OWASP

Your Nightly Rollup Job Is a Query That Got Too Big — TimescaleDB extends Postgres with continuous aggregates to keep rollups fresh. No batch job. Get $1000 credit to start.

Tiger Data (creators of TimescaleDB) sponsor

🤖 Transformers.js v4.3: Run AI Models from JavaScript — Adds support for structured output (e.g. JSON), using WebGPU on Safari 26+, and DeepSeek v4. The docs have had an overhaul and there’s now an agent skill you can use.

Hugging Face

vitest-gpu and jest-gpu: Test WebGL and WebGPU Code Without a Browser — Vitest and Jest environments that give tests WebGL and WebGPU contexts in Node, so you can compile shaders, run compute passes, or diff frames against baselines sans browser.

Ben Houston

• Superdiff 4.3 – A library that produces diffs of objects, arrays and text. v4.3 can now diff code by line and token too (above).

• dotenv 18.0 – The popular .env file loader. v18 adds a CLI and a faster opt-in parser, but drops -r dotenv/config preloading in favor of dotenv run --.

• Tinypool 2.2 – Minimal worker thread pool and Piscina fork. Now accepts a URL instance as the filename.

• NestJS 12.1 – Now with built-in cookie support, CSRF protection, and security headers.

• mongodb-memory-server 11.3 – Spin up real MongoDB servers for tests.

• SuperTest 7.3 – Library for testing Node HTTP servers using a fluent API.

• SQL Formatter 15.9 – Library for pretty-printing SQL queries.

📢  Elsewhere in the ecosystem

• pnpm 12.6 can now dedupe dependency versions across a workspace as it installs, keeps node_modules working after a project is moved (macOS and Linux only), and adds --save-types for @types/* packages.

• Coding agents quadrupled Linear's test suite, so its team reworked their CI to get costs down: rewriting type-aware ESLint rules as plain AST checks cut lint time 55%, and selectively disabling Vitest's isolation saved a further 17% a month.

• Cloudflare's Sunil Pai wrote about the senior engineer 'death spiral', where you go quiet for weeks to prove yourself in a new role and end up burning out.

• 🧪 A 'periodic table' of all 115 standard HTML elements!