~nodeweekly | Bookmarks (140)

The January 21, 2025 Security Releases — Not yet released at the time of publication, but coming to you any moment soon, are fresh releases of the Node 23.x, 22.x, 20.x, and 18.x release lines to tackle some as yet undisclosed security issues.

file-type 20.0: Detect the File Type of a Buffer, Uint8Array or ArrayBuffer — For example, give it the raw data from a PNG file, and it’ll tell you it’s a PNG file. Uses a ‘magic number’ approach so is targeted solely at non text-based formats. v20 adds support for yet more formats, including JARs, Word/Excel templates, and now supports ZIP decompression.

Protect Against Bots, Fraud, and Abuse in Real Time — WorkOS Radar protects your app with advanced device fingerprinting — stop fake signups, free tier abuse, bot attacks and brute force attempts today.

A New Chapter for Express.js — 2024 saw the still-extremely-popular Express project awaken from a slumber, of sorts, with work being made to update things to modern standards, a security audit, and the release of Express v5. Here, the team explains what’s been going on behind the scenes to get Express back on the tracks, as well as a “bold vision for 2025.”

How to Create Your Own AI Agent — Join Scott Moss for this video course exploring how to build an AI agent from scratch — covering LLM options, transformers, token limits, AI memory, function calling, agent loops, prompting, and much more.

Node v23.6.0 (Current) Released — In last week’s issue, we said Node 23.6 was imminent, and it came out a few hours later ;-) Along with the usual dependency updates and bug fixes, the big news is type stripping is now enabled by default, enabling that node yourapp.ts magic, described in more detail below..

Node’s New Built-in Support for TypeScript Explained — Node.js v23.6.0 (Current) (above) makes Node’s new type-stripping features work by default. Dr. Axel digs into how it works and what the limitations are. A handy primer.

Horizontal, Vertical, Diagonal? What Even Is Scaling?! 👀 — Up, down, left, right… A+B, A+B?? No no.. scaling isn’t that complicated. Let’s unpack horizontal vs. vertical scaling.

Node Web Audio API 1.0: A Web Audio API Implementation for Node — More accurately, it’s a set of Node bindings for a Rust-powered non-browser implementation of the Web Audio API.

pnpm 10.0: The Alternative, Efficient Package Manager — Long admired for its performance and efficiency improvements over npm, pnpm is now thinking hard about security too with v10 no longer running lifestyle scripts of dependencies by default, improved hashing, and a myriad of other tweaks.

Citizen: A Node.js MVC Web Application Framework — Comes with all the usual helpful stuff out of the box: routing, serving, caching, session management, even hot module replacement. It’s currently a lightly updated (though complete) project, but it shows a lot of promise and the author is keen for bug reports and feature requests.

PostalMime: Email Parser for Browser Environments — An email parsing library happy in most JS runtimes, including Node. Takes the raw source of emails and parses them into their constituent parts.

Node.js Now Supports TypeScript By Default — It’s been possible to run TypeScript directly with Node.js since v22.6 introduced experimental ‘type stripping’ support, but in the to-be-released-at-any-moment Node 23.6 (or the current Node nightly) you’ll be able to run node yourapp.ts and it’ll Just Work™. Matt provides some details on how it works and what you’ll be able to do.

Node v23.5.0 (Current) Released — A Node release that slipped in just before 2024 ended. WebCryptoAPI’s Ed25519 and X25519 algorithms are now stable and on-thread hooks are now back.

Tackling the '1 Billion Row Challenge' with Node — The 1 Billion Row Challenge (1BRC) arose about a year ago to see how quickly different languages and techniques can be used to aggregate data from a 1 billion line text file. Here’s what one developer learnt trying to optimize the task with Node.

Introducing @smoores/epub: A Package for Working with EPUB Files — EPUB is a popular e-book file format and this new library provides a way to both read and write them. npm package link.

Securing Node.js Express APIs with Clerk and React — A guide that teaches you how to authenticate API requests using ClerkExpressWithAuth() and ClerkExpressRequireAuth() middleware.

zx 8.3: A Tool for Writing Better Shell Scripts — zx is an alternative way to run Node that makes it more useful for shell scripting by offering various niceties like process management, argument handling, and commonly used packages like Chalk. v8.3 makes it possible to iterate over a processes’ output using for await (thanks to Symbol.asyncIterator), plus there are enhancements to using pipes.

Release It 18.0: A CLI Tool to Automate Package Publishing Tasks — Think things like bumping versions, tagging, creating releases at GitHub or GitLab, changelog generation, etc.

MicroDiff 1.5: No Dependency Object and Array Comparison Library — Given two objects or arrays, it returns the differences (think diff but for JavaScript objects). Boasts high performance and TypeScript support. There’s also an article from 2022 about how it works.

jsesc: Get a Stringified, ASCII-Safe Representation of Any Data — Think JSON.stringify() but instead it returns JavaScript meaning it can support things like maps, sets, and BigInts.

node-datachannel: libdatachannel Bindings for Node.js — libdatachannel is a standalone C++17-based implementation of various WebRTC standards, as well as WebSockets, for use on POSIX platforms.

Schemalint: A Linter for Postgres Schemas — A linter that lets you raise errors on a variety of common matters like name casing, enforcing row level security, or the presence of mandatory columns (so think more like ESLint than a basic formatter). You can also write your own custom rules.

sqs-consumer 11.3: Build Amazon SQS-Based Apps Without Boilerplate — Build SQS-based (Simple Queue Service) apps without the boilerplate. Just define an async function to handle the SQS message processing. If it’s good enough for the BBC..