I write about my journey as a core contributor of Node.js, an author, and a maintainer of many modules - including [Fastify](https://www.fastify.io) and [Pino](https://www.getpino.io). I will also write about my journey as the Co-Founder & CTO of [Platformatic](https://platformatic.dev). In addition, I speak at conferences and will add links to all my talks in case you missed one. If you like my Open Source work, consider sponsoring me on [GitHub](https://github.com/sponsors/mcollina)
Hey Everyone! This edition is a bit different. I want to talk about something that takes up a surprising amount of my week: triaging security vulnerabilities. I receive 20-40 reports to triage a week. That's work that must be done, and there are plenty of other people doing it too, but I try to pull my fair share. Here's the thing that's changed: almost all of those reports are now AI-written. On…
Every few weeks, a security report lands that follows the same template. Someone has found a new gadget: a spot where code reads a property it expected to be absent and does something dangerous with it. child_process picking up a shell it was never passed. A router honouring an option out of nowhere. An ORM resolving a field it should not. Sometimes the gadget is in Node.js core; more often it is…
I reported and fixed the HTTP/1.1 response queue poisoning issue in Node.js http.Agent that became CVE-2026-48931 , and the Node.js team reviewed it and shipped it through the security process. Looking back, two things about that were mistakes, and one of them broke a lot of people's deploys. This post is me owning the parts that were mine. The short version: The underlying behavior is real and…
Hey Everyone! I want to talk about something that’s been bothering me since the Axios compromise . This issue goes beyond just one package. First, a quick definition: In the npm ecosystem, “trusted publishing” means using tools (like Sigstore and OIDC) to confirm that a package was published by a verified identity and built using a verified process, typically through a secure continuous…
In recent months, I’ve shared thoughts on the human role in AI , the future of software engineering , what these changes mean for businesses , and why coding skills still matter . My perspective comes from hands-on experience: maintaining projects like Node.js , Fastify , Pino , and Undici , building Platformatic , and reviewing thousands of pull requests where AI handled the code and I made the…
AI-assisted development is already a reality, and the open source community is coming together to figure out how to manage it. Many major projects and organizations now agree on a few key ideas: people must stay accountable, being open builds trust, and existing contribution rules like the Developer Certificate of Origin (DCO) still matter. The Linux kernel community, Red Hat’s legal team, and the…
A few weeks ago, I wrote about the human in the loop and why review is now the bottleneck in software development. Then I wrote about what this means for careers and students entering the field. But one question kept coming up in conversations: what does this mean for organizations? Not startups. Not tech companies. Enterprises. The banks, insurers, manufacturers, and retailers that run on…
Hey Everyone! I've been thinking about something for a while: can coding agents stop making the same mistakes? You know the drill — you fix a bug, then three weeks later you hit the exact same issue in a different file. Or your AI assistant forgets a lesson you taught it yesterday. Frustrating, right? Well, I built something to fix that. Introducing pi-self-learning — a pi extension that gives…
Hey Everyone! I've been working on something I want to share with you. As you know, I've started relying on AI assistants to do most of my coding, but I review everything that is being generated . I've grown frustrated by the slop being generated and the amount of corrections I had to do. After years of building with Node.js, Fastify, and TypeScript, I've learned a lot: patterns that work, tools…
Every few weeks, someone shares a bold opinion: "Don't bother learning to code, AI will do it all." I've seen this from VCs, influencers, and people who have never actually shipped a production system. They're wrong. In the past few weeks, I've written about the human-in-the-loop , the future of software engineering , and what these changes mean for enterprise organizations . The core point across…
A few weeks ago, I wrote about the human in the loop and why review is now the bottleneck in software development. That post triggered a lot of conversations, and one question kept coming up: What does this mean for someone starting their career today? If you're a student, a career changer, or someone advising young people on their path into tech, this post is for you. Fundamentals Matter Again…
Like everyone else, I had to build something over the end-of-year break. I wanted to fix a burning problem I had: how could I review the code my agents produced before I pushed. GitHuman was born. AI coding agents are transforming how we write software. Cursor, Copilot, Claude Code: they can generate hundreds of lines in seconds. But there's a problem: by the time you've pushed to a branch and…
Mike Arnaldi wrote a thought-provoking piece titled " The Death of Software Development ." I respect Mike a lot. Effect is brilliant work, and his analysis of the current AI moment is sharper than most. But I think he's missing something critical. My Workflow Has Changed Let me be clear: I'm not here to argue that AI isn't transforming our industry. It is. My own workflow has changed dramatically.…
Hi Folks, This week I want to talk about something that might surprise you: the performance cost of optional chaining in JavaScript. A question came up recently about whether using a noop function pattern is faster than optional chaining, and the answer might make you rethink some of your coding patterns. After a pull request review I did, Simone Sanfratello created a comprehensive benchmark to…
Today I'm announcing slow-redact , a new package that provides the same API as fast-redact but with a crucial difference: immutability guarantees . This package was born out of necessity after a spurious CVE filing against fast-redact and our decision to prioritize safety in the pino ecosystem. Protecting Sensitive Data in Logs Log redaction is a critical security feature for production logging…
Many years ago, I got incredibly excited about a new technology for writing any application: Node.js. What made it special then (and now)? I firmly believe that its scripting nature, its “tolerance” to mistakes, the easiness of reusing code, and the “good enough” performance make a combination of speed, flexibility, and ease of use that is hard to resist, like a Swiss Army knife for developers,…
URLPattern is a Web Specification, which recently landed in Node.js thanks to the outstanding work of Yagiz Nizipli and Daniel Lemire in Ada v3 . It will soon be available in Node.js v23. You can see the evolution of the spec at https://github.com/whatwg/urlpattern . The API was designed with client side routing in mind and did not consider the use case of servers and the learnings of running…
123 Hi Folks, This issue covers how adding a "fast path" to make some benchmark shine can confuse users and introduce "traps" that could be extremely surprising if not properly documented. Hono RegExpRouter and TrieRouter analysis A month ago, a question about Hono claims of their router performance was made into the find-my-way repository. I set up to investigate because I thought there wasn't…
Hi Folks, A few weeks have passed, and I've been so busy catching up with my backlog. As this issue goes out, I'd be back at inbox zero. I'm glad I had some time to catch up, as the last few months have been incredibly hectic. This issue covers a topic that is very dear to me: OSS sustainability. We have seen plenty of ways to fund Open Source in the last few years, and a move to commercial…
Hi Folks, I have been silent for long, and I've lost the habit of writing my thoughts in this newsletter. The weekly frequency that once was my target has been slipping for the last six months, leading to two months and a half of silence. I need to get back my writing mojo, and keep you all up to date. This edition includes: An in-depth explanation of why deferring work with setImmediate() worsen…
Hi Folks, This release features something I've been working on and off for the last few months, mostly adding feature as I needed them: a companion for the node:test module. This edition also includes all releases in modules I maintain as well as the usual article list.. in case you missed any of them! Introducing Borp: Combining TypeScript with node:test When using the new node:test library, I…
Hi Folks, This newsletter comes back to a theme I love: Node.js streams. I expect more contents about the fundamentals in the future, as I'm scavenging some old research to help folks prioritize work on Node.js itself. 3x Faster Stream Proessing 8 years ago, I explored how to make Node.js Streams significantly faster. This research never landed in Node.js, but given the renewed interest in…
Hi Folks, Here is a short & sweet newsletter to show you the analysis I did on the performance of the HTTP clients of Node.js, as well as the burning question of the bond between Node.js and npm. Which HTTP client for Node.js Quite a few people have asked me what HTTP client I recommend for Node.js. In concert with my friend Ethan Arrowood , we have prepared a benchmark for you to decide. Node.js…
Happy new year folks! This is our first edition of 2024, and I expect to deliver one of this to you every month or so. This edition includes a full celebration of last year, including most of my talks and key videos. There are also a ton of releases that happened in December and over the break. 22 Billions of Downloads in 2023 Modules I maintain have been downloaded 22 billion times last year.…
Hello Everybody, I'm stoked by the impressive download growth we are seeing in Platformatic. Last month, our Open Source tool was downloaded over 60k thousand times from just 5k last August. Thank you all for the trust. Last week was exciting for me and the team at Platformatic – we did our last big launch of 2023! We shipped an Electron app to easily build your microservice system, something new…
Hi Folks, I'm sorry that almost a month as passed from the latest edition of Adventures in Nodeland. The last few weeks have been incredibly busy as I traveled across Europe (Dublin, Milan, Dublin, London) for multiple events, usually to promote Node.js, Fastify and Platformatic. In the meanwhile, Platformatic usage has been skyrocketing, and now we are close to 10k weekly downloads! If you want…
Hi folks, It's been a couple of weeks since the last email, and this is packed with updates. It includes two talks that I published on YouTube, links to the ongoing debate on open-source licensing, a brief explanation of the recent Node.js security release, many releases, and quite a few interesting articles. Talks How to speed up your Node.js API by 5x I recorded a short video on how we made…
Hi Folks, Last week was a big week for me and the team at Platformatic– we finally launched v1.0.0 , and I could not be more excited to share it all with you! This launch is important because it includes features I was desperate to have during my many years as a software consultant. What we released last week would have saved me countless hours, headaches, and deployment errors. While I can’t turn…
Hi Folks, As I'm writing this, I have been working hard for the Platformatic v1.0.0 launch on Tuesday, the 26th of September (tomorrow as you are reading this). Register to be part of the excitement! I wrote a (research) paper! After almost 10 years of defending my Ph.D., I would have never imagined that. I got back to writing a research paper as part of my startup. As part of our business…
Hi Folks! As I write this, I'm on a plane to London, where I will spend the entire week working with my co-founder, Luca Maraschi. Since I last wrote, there has been quite a bit of news. Bun 1.0 Bun hit the 1.0 release , and I'm both excited and disappointed. I really like what Jarred Sumner is building with Bun, but I'm a bit frustrated by their compatibility claim with Node.js. In my experience,…