Bookmarks (163)

web-worker 1.5: Consistent Web Workers for the Browser and Node — Want to publish npm modules that use Web Workers and that work in both Node anbd client-side? In Node, it works as a web-compatible Worker implementation atop worker_threads. In the browser, it’s an alias for Worker.

Human Regex: Human-Friendly Regular Expression Builder with English-Like Syntax — After 8 years of Perl, regexes are my bread and butter, but I’d say most developers aren’t big fans ;-) This library offers a more natural fluent-style option. Magic Regexp and Super Expressive are other options in this space.

ffast: An Experimental Node.js FFI Library — A proof of concept for bringing all the low level bindings necessary into JS-land for creating FFI wrappers from JavaScript itself, without needing things like libffi. Works (with many caveats, the author says) on Linux x64/ARM64 and macOS/ARM64.

import-in-the-middle: A Module Loading Interceptor — Back in my day Malcolm was in the middle, but now you can intercept the loading of ES modules in Node with this – handy if you want to modify them in some way. There’s also require-in-the-middle if you’re a bit more oldschool.

Want to Roll Your Own Autoscaling? Here Are Our Secrets 🤫 — Does it make sense for us to write this guide? No! Did we do it anyway? Yes! We did it for you ❤️

Node v20.18.3 (LTS) Released — The main update is the backporting of import attributes and JSON modules is now considered stable.

Why to Move On to 'ESM-Only' — The march to using ES modules has been going on for years now and if you’re still holding out, there’s probably a good reason why. While you can maintain packages that support both ESM and CommonJS approaches, Anthony thinks it’s finally time to go ‘ESM only’ and explains why here.

Troubleshoot Node.js App Performance with Datadog APM — Datadog’s distributed tracing provides end-to-end visibility into requests wherever they go, across hosts, containers, and service boundaries. With rich dashboards, and algorithmic alerts, Datadog provides your team with the tools they need to optimize modern applications.

Node v22.14.0 (LTS) Released — The latest stable/LTS release of Node gets the usual raft of bug fixes and tweaks. Among the more notable ones are TypeScript support for code evalled via stdin, a new --disable-sigusr1 flag, assert.register(), and t.assert.fileSnapshot().

How to Publish ESM-Based npm Packages with TypeScript — Now that you can use the ES modules (almost) everywhere, it’s worth understanding how to package them up for use with npm. Axel digs into everything you need to know and shares some useful tools too.

Pundit-TS: Organize Your Authorization Logic with Full Type-Safety — Inspired by Ruby’s Pundit library, Pundit-TS offers a TypeScript flavored way to implement role-based and attribute-based access control models in your app.

Standard Schema: A Common Interface to Schema / Validation Libraries — From the creators of Zod, Valibot and ArkType comes a fantastic bit of collaboration to define a common interface to use JavaScript and TypeScript schema libraries.

http-status: Another Way to Work with HTTP Status Codes — For example: status[418] returns "I'm a teapot" and status.IM_A_TEAPOT returns 418.

📄 docxtemplater: Generate docx and pptx Documents from Templates — Generate Word and PowerPoint files dynamically by merging against template documents (e.g. invoices, contracts, certificates) It’s open source (MIT/GPLv3) but the creator offers commercial extensions (such as for supporting Excel). GitHub repo and feature demos.

Introducing Mentoss: The fetch Mocker — A new approach to mocking global fetch() calls (in both browsers and server-side runtimes) inspired by previous attempts like Nock and MSW.

Feluda: A Tool to Analyze the Licences of Dependencies — It’s a Rust-powered project but one which can be used to process the dependencies of Node, Go, or Rust projects and return a report (or show a TUI interface) on potentially restrictive licenses that apply.

Node File Trace (NFT): Node Dependency Tracing Utility — A tool to determine exactly which files are necessary for an app to run. Finally, a type of NFT I can actually comprehend!

parse-duration 2.0: Convert a Human Readable Duration to Milliseconds — You might wonder why a library that converts 1hr 20mins into 4800000 needs a version 2. Well, it now supports more units (mo, mth, microsec, and nanosec), has moved to ESM, and supports locales.

Announcing TypeScript 5.8 Beta: A Big One for Node Developers — It's unusual for a TypeScript beta to be exciting for Node developers in particular, but while TypeScript 5.8 is low on features generally, it's really Node focused with support for require() of ES modules in the nodenext mode, a stable --module node18, and most notably a --erasableSyntaxOnly option for ensuring the use of TypeScript...

Start Selling to Enterprise Faster with WorkOS — Add SSO, SCIM, and RBAC to your B2B SaaS app in minutes—not months.

The Modern Way to Write JavaScript Servers? — The irony is that while Node popularized JavaScript on the server (if we ignore Netscape's attempts in the 90s) this modern, standardized cross-runtime approach doesn’t quite work on bare Node (yet – though you can polyfill it.)

DBOS Transact v2: Lightweight Durable Execution in TypeScript — An open source library for lightweight durable execution built on Postgres. Durable execution means persisting the execution state of your program while it runs, so if it’s interrupted or crashes, it resumes from where it left off – ideal for long-running or business-critical workflows. Docs.

A Failed Attempt to Shrink All npm Packages by 5% — What if you could shrink all npm package sizes by 5%.. wouldn’t that benefit all of us? Here’s how one developer did just that using Zopfli compression and then made a proposal to the npm maintainers to implement it. While promising, the proposal was ultimately rejected due to a variety of challenges and...

Things People Get Wrong About Electron — A proud maintainer of the wildly successful Electron cross-platform app framework stands by the technical choices made over the years and defends it against some of the more common criticisms here. If an hour of Netflix is 7 gigabytes, what’s 100MB for an app?

Troubles with Multipart Form Data and fetch in Node — One developer’s pain in debugging somethng that ‘should have just worked’ could be your relief if you run into issues where using fetch for multipart/form-data requests simply isn’t working (due to a missing trailing CRLF).

How I Open-Sourced My Secret Access Tokens from GitHub, Slack, and NPM (and Who Cared) — A developer accidentally published API tokens to npm via a misconfigured CI pipeline. npm and Slack detected and revoked said tokens, though GitHub did not. The author shares his tale and some advice.

Is Heroku Still Worth It in 2025? 💸 — You might want to give this guide a read — we took a tour through PaaS alley and found some worthy (💵) alternatives.

Bun 1.2: A Big Step Forward for the Fast JS/TS Runtime — I know it's not Node, but JavaScriptCore based Bun continues to up the server-side runtime game with major strides forward in Node.js compatibility in particular with this release. I often try Node scripts with bun and it Just Works™ – this is a good thing.

🎨 node-canvas 3.1: A Cairo-Backed Canvas Implementation — We recently linked to Skia Canvas, a Skia and GPU-powered canvas drawing API for Node, but node-canvas is the longer standing library and is particularly easy to deploy and use, especially as it no longer has libuv or V8 dependencies.

Emittery: A Simple, Modern Async Event Emitter — A small, async event emitter for Node and the browser, and now with support for AbortController.

NodeBB v4.0.0 Released: Node.js Powered Forums — Now almost 12 years old, NodeBB continues to offer a classic forum experience in a modern Node.js-shaped guise. The big update for v4 is support for federation between NodeBB instances and the wider fediverse generally. Note that the open source project (repo) is GPL licensed with NodeBB Inc providing a hosted service.

file-type 20.0: Detect the File Type of a Buffer, Uint8Array or ArrayBuffer — For example, give it the raw data from a PNG file, and it’ll tell you it’s a PNG file. Uses a ‘magic number’ approach so is targeted solely at non text-based formats. v20 adds support for yet more formats, including JARs, Word/Excel templates, and now supports ZIP decompression.

Electron 34.0.0 — The JS, HTML and CSS desktop app framework updates to Chromium 132, Node 20.18.1, and adds a way to access the JavaScript call stack of unresponsive renderers.

Protect Against Bots, Fraud, and Abuse in Real Time — WorkOS Radar protects your app with advanced device fingerprinting — stop fake signups, free tier abuse, bot attacks and brute force attempts today.

react-nil 2.0: A React 'Null Renderer' — An interesting experiment to use React in situations where you don’t need it to render anything, but you want to use hooks, suspense, context, and other bits of the React lifecycle. Like in, say, a Node app.

ArkType 2.0: Runtime Validation Library — An easy-to-deploy solution for schema validation that can infer TypeScript definitions 1:1 and use them as optimized validators for your data, both at runtime and for immediate type-level feedback in your editor.

Kill Switch Hidden in npm Packages Typosquatting Chalk and Chokidar — Recent research has found several malicious packages ‘typosquatting’ the terminal string styling library Chalk and file-watching library Chokidar — targeting Node devs with security issues.

TypeScript Enums: Use Cases and Alternatives — A look into one of TypeScript’s features that has no direct JavaScript parallel (and hence won’t survive Node’s type stripping approach, though there’s always --experimental-transform-types or tsx).

The January 21, 2025 Security Releases — Not yet released at the time of publication, but coming to you any moment soon, are fresh releases of the Node 23.x, 22.x, 20.x, and 18.x release lines to tackle some as yet undisclosed security issues.

How to Create Your Own AI Agent — Join Scott Moss for this video course exploring how to build an AI agent from scratch — covering LLM options, transformers, token limits, AI memory, function calling, agent loops, prompting, and much more.

PostalMime: Email Parser for Browser Environments — An email parsing library happy in most JS runtimes, including Node. Takes the raw source of emails and parses them into their constituent parts.

Citizen: A Node.js MVC Web Application Framework — Comes with all the usual helpful stuff out of the box: routing, serving, caching, session management, even hot module replacement. It’s currently a lightly updated (though complete) project, but it shows a lot of promise and the author is keen for bug reports and feature requests.

pnpm 10.0: The Alternative, Efficient Package Manager — Long admired for its performance and efficiency improvements over npm, pnpm is now thinking hard about security too with v10 no longer running lifestyle scripts of dependencies by default, improved hashing, and a myriad of other tweaks.

Node Web Audio API 1.0: A Web Audio API Implementation for Node — More accurately, it’s a set of Node bindings for a Rust-powered non-browser implementation of the Web Audio API.

Horizontal, Vertical, Diagonal? What Even Is Scaling?! 👀 — Up, down, left, right… A+B, A+B?? No no.. scaling isn’t that complicated. Let’s unpack horizontal vs. vertical scaling.

Node’s New Built-in Support for TypeScript Explained — Node.js v23.6.0 (Current) (above) makes Node’s new type-stripping features work by default. Dr. Axel digs into how it works and what the limitations are. A handy primer.

Node v23.6.0 (Current) Released — In last week’s issue, we said Node 23.6 was imminent, and it came out a few hours later ;-) Along with the usual dependency updates and bug fixes, the big news is type stripping is now enabled by default, enabling that node yourapp.ts magic, described in more detail below..

A New Chapter for Express.js — 2024 saw the still-extremely-popular Express project awaken from a slumber, of sorts, with work being made to update things to modern standards, a security audit, and the release of Express v5. Here, the team explains what’s been going on behind the scenes to get Express back on the tracks, as well as a “bold vision for 2025.”

Schemalint: A Linter for Postgres Schemas — A linter that lets you raise errors on a variety of common matters like name casing, enforcing row level security, or the presence of mandatory columns (so think more like ESLint than a basic formatter). You can also write your own custom rules.

jsesc: Get a Stringified, ASCII-Safe Representation of Any Data — Think JSON.stringify() but instead it returns JavaScript meaning it can support things like maps, sets, and BigInts.