~nodeweekly | Bookmarks (144)

The January 21, 2025 Security Releases — Not yet released at the time of publication, but coming to you any moment soon, are fresh releases of the Node 23.x, 22.x, 20.x, and 18.x release lines to tackle some as yet undisclosed security issues.

TypeScript Enums: Use Cases and Alternatives — A look into one of TypeScript’s features that has no direct JavaScript parallel (and hence won’t survive Node’s type stripping approach, though there’s always --experimental-transform-types or tsx).

react-nil 2.0: A React 'Null Renderer' — An interesting experiment to use React in situations where you don’t need it to render anything, but you want to use hooks, suspense, context, and other bits of the React lifecycle. Like in, say, a Node app.

Protect Against Bots, Fraud, and Abuse in Real Time — WorkOS Radar protects your app with advanced device fingerprinting — stop fake signups, free tier abuse, bot attacks and brute force attempts today.

file-type 20.0: Detect the File Type of a Buffer, Uint8Array or ArrayBuffer — For example, give it the raw data from a PNG file, and it’ll tell you it’s a PNG file. Uses a ‘magic number’ approach so is targeted solely at non text-based formats. v20 adds support for yet more formats, including JARs, Word/Excel templates, and now supports ZIP decompression.

Node Web Audio API 1.0: A Web Audio API Implementation for Node — More accurately, it’s a set of Node bindings for a Rust-powered non-browser implementation of the Web Audio API.

pnpm 10.0: The Alternative, Efficient Package Manager — Long admired for its performance and efficiency improvements over npm, pnpm is now thinking hard about security too with v10 no longer running lifestyle scripts of dependencies by default, improved hashing, and a myriad of other tweaks.

A New Chapter for Express.js — 2024 saw the still-extremely-popular Express project awaken from a slumber, of sorts, with work being made to update things to modern standards, a security audit, and the release of Express v5. Here, the team explains what’s been going on behind the scenes to get Express back on the tracks, as well as a “bold vision for 2025.”

PostalMime: Email Parser for Browser Environments — An email parsing library happy in most JS runtimes, including Node. Takes the raw source of emails and parses them into their constituent parts.

Citizen: A Node.js MVC Web Application Framework — Comes with all the usual helpful stuff out of the box: routing, serving, caching, session management, even hot module replacement. It’s currently a lightly updated (though complete) project, but it shows a lot of promise and the author is keen for bug reports and feature requests.

How to Create Your Own AI Agent — Join Scott Moss for this video course exploring how to build an AI agent from scratch — covering LLM options, transformers, token limits, AI memory, function calling, agent loops, prompting, and much more.

Node v23.6.0 (Current) Released — In last week’s issue, we said Node 23.6 was imminent, and it came out a few hours later ;-) Along with the usual dependency updates and bug fixes, the big news is type stripping is now enabled by default, enabling that node yourapp.ts magic, described in more detail below..

Node’s New Built-in Support for TypeScript Explained — Node.js v23.6.0 (Current) (above) makes Node’s new type-stripping features work by default. Dr. Axel digs into how it works and what the limitations are. A handy primer.

Horizontal, Vertical, Diagonal? What Even Is Scaling?! 👀 — Up, down, left, right… A+B, A+B?? No no.. scaling isn’t that complicated. Let’s unpack horizontal vs. vertical scaling.