~nodeweekly | Bookmarks (169)

react-nil 2.0: A React 'Null Renderer' — An interesting experiment to use React in situations where you don’t need it to render anything, but you want to use hooks, suspense, context, and other bits of the React lifecycle. Like in, say, a Node app.

ArkType 2.0: Runtime Validation Library — An easy-to-deploy solution for schema validation that can infer TypeScript definitions 1:1 and use them as optimized validators for your data, both at runtime and for immediate type-level feedback in your editor.

file-type 20.0: Detect the File Type of a Buffer, Uint8Array or ArrayBuffer — For example, give it the raw data from a PNG file, and it’ll tell you it’s a PNG file. Uses a ‘magic number’ approach so is targeted solely at non text-based formats. v20 adds support for yet more formats, including JARs, Word/Excel templates, and now supports ZIP decompression.

Kill Switch Hidden in npm Packages Typosquatting Chalk and Chokidar — Recent research has found several malicious packages ‘typosquatting’ the terminal string styling library Chalk and file-watching library Chokidar — targeting Node devs with security issues.

Electron 34.0.0 — The JS, HTML and CSS desktop app framework updates to Chromium 132, Node 20.18.1, and adds a way to access the JavaScript call stack of unresponsive renderers.

Protect Against Bots, Fraud, and Abuse in Real Time — WorkOS Radar protects your app with advanced device fingerprinting — stop fake signups, free tier abuse, bot attacks and brute force attempts today.

NodeBB v4.0.0 Released: Node.js Powered Forums — Now almost 12 years old, NodeBB continues to offer a classic forum experience in a modern Node.js-shaped guise. The big update for v4 is support for federation between NodeBB instances and the wider fediverse generally. Note that the open source project (repo) is GPL licensed with NodeBB Inc providing a hosted service.

The January 21, 2025 Security Releases — Not yet released at the time of publication, but coming to you any moment soon, are fresh releases of the Node 23.x, 22.x, 20.x, and 18.x release lines to tackle some as yet undisclosed security issues.

TypeScript Enums: Use Cases and Alternatives — A look into one of TypeScript’s features that has no direct JavaScript parallel (and hence won’t survive Node’s type stripping approach, though there’s always --experimental-transform-types or tsx).

pnpm 10.0: The Alternative, Efficient Package Manager — Long admired for its performance and efficiency improvements over npm, pnpm is now thinking hard about security too with v10 no longer running lifestyle scripts of dependencies by default, improved hashing, and a myriad of other tweaks.

A New Chapter for Express.js — 2024 saw the still-extremely-popular Express project awaken from a slumber, of sorts, with work being made to update things to modern standards, a security audit, and the release of Express v5. Here, the team explains what’s been going on behind the scenes to get Express back on the tracks, as well as a “bold vision for 2025.”

How to Create Your Own AI Agent — Join Scott Moss for this video course exploring how to build an AI agent from scratch — covering LLM options, transformers, token limits, AI memory, function calling, agent loops, prompting, and much more.

Node v23.6.0 (Current) Released — In last week’s issue, we said Node 23.6 was imminent, and it came out a few hours later ;-) Along with the usual dependency updates and bug fixes, the big news is type stripping is now enabled by default, enabling that node yourapp.ts magic, described in more detail below..

Node’s New Built-in Support for TypeScript Explained — Node.js v23.6.0 (Current) (above) makes Node’s new type-stripping features work by default. Dr. Axel digs into how it works and what the limitations are. A handy primer.

Horizontal, Vertical, Diagonal? What Even Is Scaling?! 👀 — Up, down, left, right… A+B, A+B?? No no.. scaling isn’t that complicated. Let’s unpack horizontal vs. vertical scaling.

Node Web Audio API 1.0: A Web Audio API Implementation for Node — More accurately, it’s a set of Node bindings for a Rust-powered non-browser implementation of the Web Audio API.

Citizen: A Node.js MVC Web Application Framework — Comes with all the usual helpful stuff out of the box: routing, serving, caching, session management, even hot module replacement. It’s currently a lightly updated (though complete) project, but it shows a lot of promise and the author is keen for bug reports and feature requests.

PostalMime: Email Parser for Browser Environments — An email parsing library happy in most JS runtimes, including Node. Takes the raw source of emails and parses them into their constituent parts.

Node.js Now Supports TypeScript By Default — It’s been possible to run TypeScript directly with Node.js since v22.6 introduced experimental ‘type stripping’ support, but in the to-be-released-at-any-moment Node 23.6 (or the current Node nightly) you’ll be able to run node yourapp.ts and it’ll Just Work™. Matt provides some details on how it works and what you’ll be able to do.

Schemalint: A Linter for Postgres Schemas — A linter that lets you raise errors on a variety of common matters like name casing, enforcing row level security, or the presence of mandatory columns (so think more like ESLint than a basic formatter). You can also write your own custom rules.

jsesc: Get a Stringified, ASCII-Safe Representation of Any Data — Think JSON.stringify() but instead it returns JavaScript meaning it can support things like maps, sets, and BigInts.

MicroDiff 1.5: No Dependency Object and Array Comparison Library — Given two objects or arrays, it returns the differences (think diff but for JavaScript objects). Boasts high performance and TypeScript support. There’s also an article from 2022 about how it works.

zx 8.3: A Tool for Writing Better Shell Scripts — zx is an alternative way to run Node that makes it more useful for shell scripting by offering various niceties like process management, argument handling, and commonly used packages like Chalk. v8.3 makes it possible to iterate over a processes’ output using for await (thanks to Symbol.asyncIterator), plus there are enhancements to using pipes.

Tackling the '1 Billion Row Challenge' with Node — The 1 Billion Row Challenge (1BRC) arose about a year ago to see how quickly different languages and techniques can be used to aggregate data from a 1 billion line text file. Here’s what one developer learnt trying to optimize the task with Node.