Bookmarks (194)

Are Half of New npm Packages Just Junk? — Sandworm is the creator of the Sandworm Audit package analysis tool and as part of that work, the claim is made that “more than half of all new packages” on the official npm registry are just placeholders with READMEs that contain links to various nefarious sites.

Sharp 0.32.0: High Performance Image Processing from Node — It’s been a few years since we included this properly, but it’s so good. It uses libvips behind the scenes to provide what it claims is ‘the fastest module to resize JPEG, PNG, WebP and TIFF images’. You can also rotate, do gamma correction, crop, etc. Image resizing API and examples.

pnpm 8.1: Alternative Fast and Space Efficient Package Manager — “A new setting has been added called dedupe-direct-deps, which is disabled by default. When set to true, dependencies that are already symlinked to the root node_modules directory of the workspace will not be symlinked to subproject node_modules directories. This feature was enabled by default in v8.0.0 but caused issues, so it’s best to disable...

Concurrent.js: Load Modules into Background Threads — Billed as a concurrent computing approach for JavaScript environments including the browser, Node and Deno, this library lets you dynamically import modules into worker threads (in Node) or Web Workers (in the browser).

Nano JSX: A Lightweight SSR-First JSX Library — Features include no Virtual DOM, no external dependencies, on-demand hydration, and support for Node and Deno-based server-side rendering situations.

np 7.7.0: A Better npm publish — Makes the process of publishing a package smoother with an interactive UI, checks that you’re publishing the right thing, runs tests, pushes commits and tags, etc.

A Business Case for SvelteKit — A good post covering the experience of migrating from Meteor to SvelteKit, the process this team undertook, and the outcomes from both a performance and UX point of view.

Navigate the Pitfalls and Returns of Using Node.js Worker Threads — Review the pros and cons of worker threads, and how they differ from other multithreading implementations, in Snyk's recent Node.js article.

The Landscape of npm Packages for CLI Apps — If you want to create a CLI app, there are a lot of options nowadays for covering areas like pretty output, parsing arguments, and accepting user input. This post rounds up some of the options in these various areas.

Node.js Compatibility for Cloudflare Workers — Cloudflare Workers is a popular serverless platform that uses V8 isolates rather than a Node runtime. This has meant support for Node functions has been lacking, but things are changing with support for AsyncLocalStorage, EventEmitter, Buffer, assert, and parts of util now available to use with more to follow.

Speeding Up the JavaScript Ecosystem: npm Scripts — The latest in a fascinating series on finding ‘low hanging fruit’ when it comes to performance. The author explains this one best himself: “‘npm scripts’ are executed by JavaScript developers … all the time. Despite their high usage they are not particularly well optimized and add about 400ms of overhead. In this article we were able...

Smooth Log Management for Node.js Developers — Unlock the power of logs with AppSignal. Find all the key information in a few clicks in our clean and intuitive interface. Monitoring doesn’t need to be a hassle, AppSignal is here to help.

Node v16.20.0 (LTS) Released — Not a big release. Mostly updates to dependencies like npm (to 8.19.4) and undici. The version bump is justified by the backporting of support for externally shared JS builtins.

🚀 Monitor And Optimize Website Speed To Rank Higher in Google — Monitor Google's Core Web Vitals and optimize performance using in-depth reports built for developers. Improve SEO & UX.

🔒  npm Granular Access Tokens Now Generally Available — The granular access token feature on the npm registry is now generally available, allowing you to restrict token access to specific packages, set expiration dates, limit access by IP range, and more.

Automatic npm Publishing with GitHub Actions and Granular Tokens — As mentioned above, GitHub has announced granular access tokens for the npm registry. Tim explains why this is a big deal, not only from a security point of view for us all, but also for anyone publishing packages.

Deno 1.32 Released with Enhanced Node Compatibility — I know this is a Node newsletter, but given Deno’s provenance and continuing insistence for Node.js compatibility, this is Node news in a round about way. 1.32 ships with TypeScript 5 and extends package.json support in particular.

Why We Added package.json Support to Deno — Further to the above item and Deno’s Node and npm compatibility continuing to improve, the Deno team has been facing questions about the runtime’s core priorities. Ryan Dahl explains more about the thinking here.

Migrating from ts-node to Bun — Everyone’s coming after Node.js this week! Now it’s the turn of performance oriented Bun. John runs us through porting a console app from ts-node over to Bun — something he calls “a pretty easy process”.

Create a CLI Chatbot with the ChatGPT API and Node — If you can’t beat AI, join them..?

OTPAuth: One Time Password (HOTP/TOTP) Library — When you log in on a site with 2FA and you’re asked for six digits from your authentication app, that’s probably a so-called Time-based One-Time Password (or TOTP). This library for Node, Deno, Bun and the browser lets you work with both TOTPs and HOTPs (HMAC-based OTPs) from JavaScript.

DOCX 8.0: Generate Word .docx Files from Node or Browser — The code to lay out your documents is verbose but there’s a lot of functionality baked in. Here’s a CodePen-based example and the v8.0 release notes – GitHub repo.

Malibu: Framework-Agnostic CSRF Middleware — ESM only, zero-dependency, and TypeScript types are included. It’s compatible with Express, Tinyhttp, and most modern frameworks based around the core HTTP package.

pg-anonymizer 0.7.0: Anonymized Data Dumping from Postgres — A Node-powered tool for taking anonymized exports of databases. Sensitive data is replaced with faked data of equivalent types.

eslint-formatter-pretty 5.0: Pretty ESLint Formatter — Nicer output than the default. Sort results by severity. Get stylized inline code blocks, and more.

Express-Ts-Auth-Service: A Ready-to-Use Authentication Service — A pre-built authentication server built around Express.js, JSON Web Tokens, TypeScript and MySQL (via Prisma).

Shell-Free Scripts with Execa 7.1 — Execa is a popular process execution library for Node and the latest version includes an interesting $ method feature for writing zx-style scripts with it, making it even more useful for shell scripting style usecases.

▶  Unlock the Power of AI with Defer and Next.js 13 — Defer is a new (and commercial) Node.js background job execution platform.

Voici.js 2.0: Library for Printing Data on the Terminal — Pretty printing in tabular form, to be precise. It’ll take care of column sizing, sorting, let you style rows and columns, etc. GitHub repo.

Introducing Mongoose 7: The MongoDB ODM for Node — Popular MongoDB modeling library Mongoose 7 landed a month ago and Valeri wants to show off a few of the updates (though it’s not a big feature packed release).

Dynaboard: A Visual Web App IDE Made for Developers — Build high performance public and private web applications in a collaborative — full-stack — development environment.

Drizzle: An ORM That Lets You Just Write SQL — Drizzle takes a middle of the road approach where not everything is abstracted away but there’s a bit more structure than just writing raw SQL queries. Type safety is the order of the day here too. GitHub repo.

MiniSearch: Small In-Memory Fulltext Search Engine for Browser and Node — The strength of this solution is that the data from which it fetches is stored locally, thus allowing it to work offline and has good performance.

Find My Way: Fast HTTP Router That Uses Radix Trees — We first linked this many years ago but the author reached out to us and it continues to be updated. (If you’re a Fastify or Restify user, you’re already using it!)

Node v19.8 (Current) Released — Mostly a minor collection of changes, right down to commits adding trailing commas! Buffer gains a new copyBytesFrom method, fs.openAsBlob is introduced to support File-backed blobs, and a wide variety of dependencies get updates too (e.g. npm to 9.5.1), but there’s little of significant note in 19.8.0. ⚠️ Node v19.8.1 quickly followed to fix a regression that was causing...

Improve Login for Your Web Apps with Web Authentication APIs — Upgrade from basic passwords to new APIs like Credentials, WebAuthn API, and Passkeys to use FaceID and biometrics to make passwordless web apps!

Turbowatch: File Change Detector and Task Orchestrator — Not just that but it claims to be extremely fast and “if you ever wanted something like Nodemon but more capable, then you are at the right place.” This looks very promising and the README is full of examples.

How Cloudflare Built an SEO Tool on Workers, D1, and Queues — It’s an open-source tool for monitoring new site content called Prospector. If you use Cloudflare’s serverless platform at all, though, you may be more interested in this post which explains just how such a tool came together, including their use of Hono, an Express-like framework targeting edge compute cases.

How to Debug Node Segmentation Faults — Normal execptions are one thing, but when you’re faced with something as cryptic as “segmentation fault (core dumped)”, what are you to do? Tim has some pointers.

Civet: It's Like CoffeeScript for TypeScript — This example alone shows off the power. In a world where build toolchains are the norm, maybe this could take off, but my CoffeeScript experiences of yesteryear give me pause.

Introducing nsuv: A C++ Wrapper Around libuv — An interesting look at a new project from NodeSource that lets you work with libuv in a safer way from C++. libuv is the library that provides Node with event-driven I/O and timers and this could be useful if interacting with Node at a low level.

Ink 4.0: React, but for Building Interactive CLI Apps — Build your command line apps using React-style components. As of v4.0, Ink is now pure ESM, requires React 18, and requires Node 14.16+.

Feathers 5: The API and Real-Time App Framework — Feathers isn’t as well known as Nest or Fastify, say, but it’s a powerful and mature option if you want to spin up a Node CRUD app tied to a database and now it’s “TypeScript all the way down” too (though you can choose to use plain JS, if you prefer). Feather’s creator tells the...

Deploying to ECS, Simplified with IaSQL — Shows off using IaSQL, a sort of ‘use SQL to manage infrastructure’ tool, to deploy a basic Express app to Amazon Elastic Container Service.

Easy to Use, Full-Stack Monitoring — Use TelemetryHub for flexible and affordable monitoring of your logs, traces, and metrics - all in one place!

A Complete Guide to Pino Logging in Node — Pino is a low overhead JSON-driven Node.js structured logging library. Usually the term “complete guide” gets me going “oh, really?” but in this case they deliver.

Crawling Weather Forecasts with Cypress — Even if you don’t care for the weather, this is a neat code-led demonstration of using the Cypress browser oriented testing tool for performing a variety of productive activities.

Deno Says: You Don't Need a Build Step — Of course the Deno folks have an alternative JS runtime to promote, but they make good points. A build step has helped with getting things to run in the browser or to transpile and bundle code elsewhere. But with modern tooling, do we still need a build step?

rimraf 4.4: It's rm -rf for Node.js — Isaac may have invented npm which filled up your hard drive with Node modules, but he also has the solution for deleting directories as quickly as possible from Node.