Excited to be speaking at @devworld_conf 2026 in May 8th!
Join me at 16:00-16:30 on Duck Stage 2 to speak about Undici, Node.js and 85 other unique sessions & deep dives at Devworld!
Agenda is live now - check it out via devworldconference.com#devworld2026
The axios breach is a good opportunity to review your package manager settings
I recommend pnpm @pnpmjs
Default: postinstall scripts are blocked, protects against axios vector
Also try:
- minimumReleaseAge: 10080 (pkgs must be min 7 days old)
- trustPolicy
- blockExoticSubdeps
Yep all our repos use pnpm-workspace.yaml, it's the standard way of configuring many security features like allowBuilds, minimumReleaseAge, trustPolicy, etc
pnpm.io/settings
Who knows how to secure open source better than the maintainers themselves? 🛡️
In Session 3 of the GitHub Secure Open Source Fund, 67 more projects improved their defenses.
From securing the AI stack to strengthening the global supply chain, find out how these maintainers are making security improvements that benefit the entire ecosystem. 👇
github.blog/open-source/main…
I've been thinking about this project for a while and finally found the time to materialise it! github.com/metcoder95/fuse-b…
A small library with utilities to apply resiliency patterns to (almost) all kinds of workloads!
Feedback is always welcome :)
Scaling AI agents isn’t just about speed — it’s about state (and security).
In this session, @matteocollina (Co-Founder & CTO at @Platformatic) shows how to build stateful #MCP servers using Node.js, Platformatic & Fastify — and secure them with @Auth0.
There has been considerable discussion on how to implement Authentication using OAuth in MCP, including a lot of criticism on using Dynamic Client Registration (DCR).
I've partnered with Auth0 to demonstrate how it's possible to implement this and provide a secure authentication flow for your MCP users in Node.js using @platformatic technology.
Scaling AI agents isn’t just about speed — it’s about state (and security).
In this session, @matteocollina (Co-Founder & CTO at @Platformatic) shows how to build stateful #MCP servers using Node.js, Platformatic & Fastify — and secure them with @Auth0.
We're excited to welcome @LambdaTest as a new Bronze Sponsor of Piscina.js! 🙌
It directly helps fund the ongoing maintenance and future development of the project.
Thank you!
Learn more about our sponsors: piscinajs.dev
Today, @_rafaelgss Principal Open Source Engineer at NodeSouce, received the ✨ OpenJS Foundation Pathfinder Award✨ for his excellent contributions to the ecosystem.
Thank you Rafa for all you do for the community 💚
Node.js 25 is here! We have upgraded V8 to 14.1, bringing major JSON.stringify
performance improvements and JIT pipeline optimizations.
This release introduces the permission
model --allow-net, Web Storage is enabled by default, and more!
nodejs.org/en/blog/release/v…
Is your company heavily relying on Node.js?
Consider sponsoring @August1! He’s changing how you adopt the latest Node.js features.
github.com/sponsors/Augustin…
I have represented (with @metcoder95) the @nodejs team on the @github secure course, and it was awesome to see and share with many other excellent projects.
If you haven't already, I recommend that you apply your project
resources.github.com/github-…