Newsletter Roundup — Week of October 19 📬
This week's scan covers JavaScript Weekly #806, React Status #493, and Node Weekly #644. React Status was off this week, so its latest issue is from October 9; the other issues landed October 13 and 15. The practical themes: dependency security, Node releases, and a few shifts in how teams choose their runtime and UI platform.
JavaScript tooling and security
Express 5.3 closes five dependency vulnerabilities
Express 5.3.0 is a maintenance release that updates qs, proxy-addr, and body-parser to address five CVEs. If an application uses Express, review the release and update rather than treating a framework maintenance release as optional.
Aliz stack connection: Express is part of the broader Node.js ecosystem. Keep dependencies current and continue applying the npm supply-chain security guidance, especially when security fixes arrive through transitive packages.
Bun adds a built-in TypeScript checker
Bun 1.4.3 adds bun check, a TypeScript checker based on the TypeScript 7 checker. Bun says it reads tsconfig.json and reports errors compatible with tsc; the speed comparison in the announcement is the project's own claim.
Aliz stack connection: We recommend TypeScript and npm, not Bun as the default runtime. This is worth tracking for teams already using Bun, but does not by itself justify switching a project’s runtime or type-checking workflow.
React ecosystem
React Status's latest issue is #493 from October 9, which was also included in last week's roundup. Two additional items stand out:
- Coinbase says it is moving its app off React Native, following Shopify. The rationale—that AI agents make implementing features twice affordable—is a company-specific trade-off, not evidence that React Native is no longer a good fit.
- React Aria 1.22 adds a swipeable Sheet, with an implementation write-up. For teams using React Aria, it is a new UI primitive to evaluate before building a custom interaction.
Aliz stack connection: These are product and component choices around our React guidance, not changes to React itself. Compare platform reach, accessibility, and the cost of maintaining separate implementations against your app's requirements.
Node.js and production
Node 24 and 26 releases add features; a security release is expected October 21
Node.js 26.12.0 is a Current release, while Node.js 24.22.0 is on the LTS line. Node Weekly notes that configuration files are now stable for runtime, test, watch, and permission settings, and that Node 24.22 includes util.throttle() and util.debounce().
Node Weekly also reports that security releases are expected on October 21 for the 26.x, 24.x, and 22.x lines, including at least one high-severity issue. Treat that as a scheduled release notice: check the Node.js security releases page for the published fixes and update the runtime line you deploy.
Aliz stack connection: The Node.js runtime guidance remains the place to start when choosing a supported version. Prefer the LTS line for production unless a project has a reason to use Current, and check deployment support before adopting newer runtime features.
AWS Lambda can run ordinary Node HTTP applications
AWS Lambda Web Functions let standard port-listening HTTP applications—such as Express, Hono, or Fastify—run on Lambda without rewriting them around a Lambda handler. AWS describes billing based on active CPU time, with memory billed separately.
This is a deployment option to evaluate against an application's traffic pattern and operational needs, not a general replacement for other hosting models.