Bookmarks (168)

Transformational Auth & Identity | Userfront — "Compared to our previous experiences in the security/auth space, Userfront is an order of magnitude simpler to use."

Better-SSE: A Dependency-Free Server-Sent Events Library — Server-sent events (SSE) is an API supported by browsers for allowing server-side processes to send events in realtime to frontends without WebSockets. Better-SSE makes working with SSE a smoother experience in Node.

GraphQL Yoga: A Full-Featured GraphQL Server — Create a schema, spin up a server, and you’re good to go (then you get to wire everything up). Supports GraphQL subscriptions via SSE. Designed to run across numerous environments from Node to AWS Lambda, Deno, Bun etc. GitHub repo.

'How I Made My GitHub Profile README Dynamic' — There’s no Node here, alas, but I thought it was a good demo of how it’s not too tricky to give your GitHub profile some extra flair by pulling in your blog posts or other stats of choice.

🪝 Hot Hook: Simple Hot Module Replacement for Node + ESM — Following directly on from the Adonis news (above), Hot Hook is the library they use to pull it off, but it can be used to enhance apps that aren’t Adonis-based, too.

Hot Module Replacement (HMR) Now in AdonisJS — AdonisJS is a popular TypeScript-first Web framework for Node and you can now use HMR to modify your dev app on the fly without restarting.

Node v20.13.0 (LTS) Released — A lot of small backports to boost the performance of the current LTS release of Node a little. Most notably, watch mode becomes stable, but also base64 and base64url are now a lot faster, CustomEvent goes stable, and typed arrays are supported in streams. 20.13.1 landed a few days later to fix a Windows related bug.

Secure M2M Authentication and Authorization in Node.js — Learn how to implement the OAuth 2.0 client credentials grant flow for secure machine-to-machine (M2M) authentication in Node.js with Stytch. Plus, get started with 1,000 M2M tokens free.

Execa 9.0: The Better child_process Gets Even Better — Less shell-oriented than zx, execa focuses on making executing external commands secure, cross-platform, and easy to debug. v9 lets you make commands iterable so you can process their output on the fly, map/filter both input and output, pipe multiple commands, and more. GitHub repo.

NodeBB 3.7.5: Node-Based Forum Software — It’s been over a year since we linked to the mature Node-based forum system, but it’s still going strong. There’s a demo forum if you want to see how it looks.

Ink 5.0: Build Interactive CLI Apps using React — A terminal-based React renderer so you can build command line apps using React-style components. While it’s a major release, there’s nothing new - the version number has been updated to reflect that Node 18+ is now a requirement.

Better SQLite3 10.0: Fast and Simple SQLite3 Library — ..and with good docs too. Supports a lot of SQLite specific functionality, has a synchronous API that boasts better concurrency than an async one (why?), and worker thread support.

Poor Express Authentication Patterns and How to Avoid Them — Node security guru Liran has been bothered by a lot of poor authentication patterns doing the rounds in various tutorials and lays out some things to consider if you’re ‘rolling your own.’

A Last Push Towards Express 5.0 — You may recall that several months ago a plan to reignite development on Express was formed, and it’s already bearing fruit with a final version of Express 5.0 due to land soon. (You can already install 5.0.0-beta.3 if you want to play.)

node-screenshots: Native Node Screenshot Library — Boasts support for Node 16, 18, and 20 across Windows, macOS and Linux on multiple architectures.

node-mlx: Machine Learning Framework for Node.js — Based upon Apple’s MLX framework targeting Apple’s own silicon, node-mlx brings its power into the Node world (it’ll run on CPU instead on x86-64 platforms). llama3.js provides a demo of what node-mlx can do.

Pechkin: Asynchronous Node File Upload Handling — Based around Busboy and retaining access to its lower level functions, Pechkin boasts flexibility, strong error handling, and the use of full async/await/iterator syntax when processing files.

Five Node Version Managers Compared — In an ideal world, the latest version of Node would slot well into every project, but in reality we often need to switch versions, and a variety of tools are available to make it simple. NVM is perhaps the best known, but maybe N, FNM, Volta, or even pnpm could suit you better?

Node v22.1.0 (Current) Released — Fewer than two weeks on from Node 22.0 comes Node 22.1 with an optional on-disk code caching feature that can speed up compilation by leaning on V8’s caching. A cool potential performance improvement, but one you’ll want to experiment with to see its effects. More details here.

▶  Exploring What's New in Node 22 — With Matteo Collina of the Node TSC, no less! It’s a movie-length effort, but he walks through everything significant about Node 22 (and 22.1) including improvements introduced by V8, the --run feature, the new compile cache in 22.1, and performance improvements across the board.

DerbyJS 4.0: The Mature MVC Web Framework — It’s never been the most popular of the frameworks, but Derby has lived through most of Node’s history and remains a viable option for building realtime, collaborative apps in particular. GitHub repo.

get-windows: Get Metadata About Active and Open Windows — Get titles, ids, bounds, etc. for windows on a desktop system. Works on macOS 10.14+, Linux (though not Wayland), and Windows 7 and up.

Node.js 22.0 (Current) Released — The latest major version of Node is here. Note that it’s a ‘Current’ release for now, so gets all the newest features first, but is due to become Node's main active LTS release this October. As an even numbered release, Node 22 should be around and maintained for a long time, most likely out to 2027 or so (see image above).We'll...

Stytch: Auth0 Alternative for AuthN, AuthZ, Fraud Prevention — Use Stytch for enterprise-grade multi-tenant B2B auth with SSO, RBAC, and SCIM. Use pre-built UIs, go headless, or integrate directly with the API. Plus, Stytch has device fingerprinting built-in to detect bots and prevent abuse. Get started free.

Native Support for CJS/ESM Interoperability Begins in Node 22 — An overview of a new era for Node when working with both CommonJS and ECMAScript modules.

TypeScript 5.5 Beta — There’s a lot going on here (like inferred type predicates) but we’ll be focusing on it more in JavaScript Weekly. On the Node side, if you’re writing an ECMAScript module, you can now use named imports from TypeScript’s npm package.

JSR is Not 'Another Package Manager' — Node, npm and CommonJS brought a packaging standard to JavaScript, and while tools like Yarn or pnpm added their own twists to the process, Ryan says it’s time for a transformation. JSR is not 'a new npm' but a reshaping of how packages are distributed, designed for the ESM era.

You Might Not Need dotenv: Node Now Natively Supports .env File Loading — This isn’t a super new feature (it’s existed since Node 20.6.0) but a handy reminder that you can trim another dependency if you have basic .env environment variable reading requirements.

📺 YouTube.js: An Unofficial YouTube API Client Library — ‘InnerTube’ is an API used by YouTube’s clients, and you can use it too, although they might not like it. It runs on Node.js, Deno, and modern browsers.

browser-or-node 3.0: Figure Out Where Your Code is Running — Provides a simple way to tell if your code is currently running in a browser, in Node, in a Web Worker, or in Deno. Works with both ESM and CJS imports.

cron-schedule 5.0: Cron Parser and Scheduler — Parse and query cron style expressions in the browser, Node or Deno.

Odiff: A Fast Pixel-by-Pixel Image Diffing Tool and Library — Claims to provide results in milliseconds. You can use it as a CLI tool or from Node (though it’s written in OCaml, primarily). It supports PNG, JPG, and BMP, including cross-file comparisons.

Hexo 7.2: Node.js-Powered SSG-Style Blog Framework — If you want to create a blog, write GitHub-Flavored Markdown, and have Node put it all together as a static site, this is for you (it’s a bit like Jekyll but using Node). The 7.2 release isn’t a big one feature-wise, but we haven’t covered Hexo for years :-)

pnpm 9.0: The Efficiency-Focused Package Manager — pnpm has long been a fantastic option for folks looking to save disk space and CPU cycles (or for its great monorepo support) while maintaining most of what makes npm great. v9.0 drops Node 16 and 17 compatibility, honors the packageManager field in package.json, makes some default config changes, and adopts Lockfile v9.

Building an npm Package Compatible with ESM and CJS in 2024 — Publishing packages compatible with both ECMAScript Modules (ESM) and CommonJS (CJS) is a valuable skill and Liran has a few quick tips.

Learn OAuth 2.0 by Building Your Own OAuth Client — When the author was first learning OAuth, he found lots of concept heavy, code-light tutorials, so he’s built something that’s truly code-first. This is a fantastic way to show off some code (using Annotate) and worth a look even if the topic doesn’t interest you.

Fullstack & Backend Learning Path — Expand your abilities with our extensive full stack learning path — teaching you how to set up servers, create APIs, and deploy your code to the world. You'll learn VIM fundamentals, API design in Node.js, containers, DevOps, and much more.

The Perf Gains of Adding a Task Runner to Node.js — Instead of running npm run test, how does node --run test sound? First teased in a 2023 pull request, the motivation for this idea is to improve performance and get scripts running ASAP (think 20ms vs 200ms). It appears set to make it to a Current Node.js release very soon.

▶  A Node.js Streams Masterclass — What a treat! Join the creator of Fastify, as well as Node.js TSC member, on an hour long odyssey into the world of streams, a topic in which he specializes. He starts off quite poetically .. a stream is like an array over time .. before quickly getting on to some live coding and demos. This is one in...

node-pg-migrate 7.0: Database Migration Management for Postgres — Lots of cleanups and refactoring from the project’s new maintainer, Shinigami, also a core maintainer of FakerJS and Vite.

Optimize Database Performance with Crunchy Bridge — Boost your Postgres performance with Crunchy Bridge! YNAB experienced 30% more IOPS and a 10% cost reduction. Scale seamlessly, stay on vanilla Postgres, and optimize spend. Read more in the YNAB case study.

A Trip Report from the Latest Node.js Collaboration Summit — Twice a year, Node's collaborators and community members meet at collaboration summits to share knowledge, discuss problems, and flesh out new ideas. The last one took place in London earlier this month and featured discussion on Node’s HTTP stack, a new node --run feature, ES modules support, package management, and more. A good update!

Profiling Node Performance with Chrome's Performance Panel — Learn how to profile Node.js performance with the Performance panel in Chrome. (Note that the JS Profiler is going away as of Chrome 124, so if you’re still using it, you’ll want to be familiar with the newer approach shown here.)

Modern Errors 7.0: Handle Errors in a Simple, Stable, Consistent Way — Create error classes, wrap or aggregate errors, or use one of several plugins to do things like print bug reporting info, print stack traces, and more.

Madge 7.0: Create Graphs From Your Module Dependencies — A developer tool for generating a visual graph of your module dependencies, finding circular dependencies, and unearthing other useful info.

MikroORM 6.2: Say Hello to SQL Server (and libSQL) — MikroORM is a popular TypeScript-based ORM based on Data Mapper, Unit of Work and Identity Map patterns, and now it supports Microsoft SQL Server, as well as offering better type safety for custom types.

Catena: Build Type-Safe APIs on Express — Inspired by tRPC, but you can layer it on top of an existing Express codebase.

State Machines Simplified — Discover the simplicity and durability of Temporal, your solution to complex state machine challenges. Unlock efficiency now!

The April 10 Node.js Security Releases — Another week, another set of security releases, made up of v18.20.2 (LTS), v20.12.2 (LTS), and v21.7.3 (Current). The main issue relates to a command injection vulnerability on Windows.

An Introduction to the Node.js Performance API — The perf_hooks module provides a subset of the W3C Web Performance APIs and additional APIs for Node-specific perf measurements. This guide shows how to use several of its features.