I like Deno: https://deno.com/. It has golang-like package management and you can runtime-restrict its code: https://docs.deno.com/runtime/fundamentals/security/.

It's been a few years since I evaluated its web frameworks though.