Bookmarks (176)

Announcing TypeScript 5.8 Beta: A Big One for Node Developers — It's unusual for a TypeScript beta to be exciting for Node developers in particular, but while TypeScript 5.8 is low on features generally, it's really Node focused with support for require() of ES modules in the nodenext mode, a stable --module node18, and most notably a --erasableSyntaxOnly option for ensuring the use of TypeScript...

http-status: Another Way to Work with HTTP Status Codes — For example: status[418] returns "I'm a teapot" and status.IM_A_TEAPOT returns 418.

📄 docxtemplater: Generate docx and pptx Documents from Templates — Generate Word and PowerPoint files dynamically by merging against template documents (e.g. invoices, contracts, certificates) It’s open source (MIT/GPLv3) but the creator offers commercial extensions (such as for supporting Excel). GitHub repo and feature demos.

Feluda: A Tool to Analyze the Licences of Dependencies — It’s a Rust-powered project but one which can be used to process the dependencies of Node, Go, or Rust projects and return a report (or show a TUI interface) on potentially restrictive licenses that apply.

Node File Trace (NFT): Node Dependency Tracing Utility — A tool to determine exactly which files are necessary for an app to run. Finally, a type of NFT I can actually comprehend!

parse-duration 2.0: Convert a Human Readable Duration to Milliseconds — You might wonder why a library that converts 1hr 20mins into 4800000 needs a version 2. Well, it now supports more units (mo, mth, microsec, and nanosec), has moved to ESM, and supports locales.

Start Selling to Enterprise Faster with WorkOS — Add SSO, SCIM, and RBAC to your B2B SaaS app in minutes—not months.

The Modern Way to Write JavaScript Servers? — The irony is that while Node popularized JavaScript on the server (if we ignore Netscape's attempts in the 90s) this modern, standardized cross-runtime approach doesn’t quite work on bare Node (yet – though you can polyfill it.)

Standard Schema: A Common Interface to Schema / Validation Libraries — From the creators of Zod, Valibot and ArkType comes a fantastic bit of collaboration to define a common interface to use JavaScript and TypeScript schema libraries.

Introducing Mentoss: The fetch Mocker — A new approach to mocking global fetch() calls (in both browsers and server-side runtimes) inspired by previous attempts like Nock and MSW.

Things People Get Wrong About Electron — A proud maintainer of the wildly successful Electron cross-platform app framework stands by the technical choices made over the years and defends it against some of the more common criticisms here. If an hour of Netflix is 7 gigabytes, what’s 100MB for an app?

Emittery: A Simple, Modern Async Event Emitter — A small, async event emitter for Node and the browser, and now with support for AbortController.

🎨 node-canvas 3.1: A Cairo-Backed Canvas Implementation — We recently linked to Skia Canvas, a Skia and GPU-powered canvas drawing API for Node, but node-canvas is the longer standing library and is particularly easy to deploy and use, especially as it no longer has libuv or V8 dependencies.

Bun 1.2: A Big Step Forward for the Fast JS/TS Runtime — I know it's not Node, but JavaScriptCore based Bun continues to up the server-side runtime game with major strides forward in Node.js compatibility in particular with this release. I often try Node scripts with bun and it Just Works™ – this is a good thing.

DBOS Transact v2: Lightweight Durable Execution in TypeScript — An open source library for lightweight durable execution built on Postgres. Durable execution means persisting the execution state of your program while it runs, so if it’s interrupted or crashes, it resumes from where it left off – ideal for long-running or business-critical workflows. Docs.

Is Heroku Still Worth It in 2025? 💸 — You might want to give this guide a read — we took a tour through PaaS alley and found some worthy (💵) alternatives.

How I Open-Sourced My Secret Access Tokens from GitHub, Slack, and NPM (and Who Cared) — A developer accidentally published API tokens to npm via a misconfigured CI pipeline. npm and Slack detected and revoked said tokens, though GitHub did not. The author shares his tale and some advice.

Troubles with Multipart Form Data and fetch in Node — One developer’s pain in debugging somethng that ‘should have just worked’ could be your relief if you run into issues where using fetch for multipart/form-data requests simply isn’t working (due to a missing trailing CRLF).

A Failed Attempt to Shrink All npm Packages by 5% — What if you could shrink all npm package sizes by 5%.. wouldn’t that benefit all of us? Here’s how one developer did just that using Zopfli compression and then made a proposal to the npm maintainers to implement it. While promising, the proposal was ultimately rejected due to a variety of challenges and...

Kill Switch Hidden in npm Packages Typosquatting Chalk and Chokidar — Recent research has found several malicious packages ‘typosquatting’ the terminal string styling library Chalk and file-watching library Chokidar — targeting Node devs with security issues.

NodeBB v4.0.0 Released: Node.js Powered Forums — Now almost 12 years old, NodeBB continues to offer a classic forum experience in a modern Node.js-shaped guise. The big update for v4 is support for federation between NodeBB instances and the wider fediverse generally. Note that the open source project (repo) is GPL licensed with NodeBB Inc providing a hosted service.

The January 21, 2025 Security Releases — Not yet released at the time of publication, but coming to you any moment soon, are fresh releases of the Node 23.x, 22.x, 20.x, and 18.x release lines to tackle some as yet undisclosed security issues.

TypeScript Enums: Use Cases and Alternatives — A look into one of TypeScript’s features that has no direct JavaScript parallel (and hence won’t survive Node’s type stripping approach, though there’s always --experimental-transform-types or tsx).

ArkType 2.0: Runtime Validation Library — An easy-to-deploy solution for schema validation that can infer TypeScript definitions 1:1 and use them as optimized validators for your data, both at runtime and for immediate type-level feedback in your editor.

react-nil 2.0: A React 'Null Renderer' — An interesting experiment to use React in situations where you don’t need it to render anything, but you want to use hooks, suspense, context, and other bits of the React lifecycle. Like in, say, a Node app.

Protect Against Bots, Fraud, and Abuse in Real Time — WorkOS Radar protects your app with advanced device fingerprinting — stop fake signups, free tier abuse, bot attacks and brute force attempts today.

Electron 34.0.0 — The JS, HTML and CSS desktop app framework updates to Chromium 132, Node 20.18.1, and adds a way to access the JavaScript call stack of unresponsive renderers.

file-type 20.0: Detect the File Type of a Buffer, Uint8Array or ArrayBuffer — For example, give it the raw data from a PNG file, and it’ll tell you it’s a PNG file. Uses a ‘magic number’ approach so is targeted solely at non text-based formats. v20 adds support for yet more formats, including JARs, Word/Excel templates, and now supports ZIP decompression.

Node’s New Built-in Support for TypeScript Explained — Node.js v23.6.0 (Current) (above) makes Node’s new type-stripping features work by default. Dr. Axel digs into how it works and what the limitations are. A handy primer.

Citizen: A Node.js MVC Web Application Framework — Comes with all the usual helpful stuff out of the box: routing, serving, caching, session management, even hot module replacement. It’s currently a lightly updated (though complete) project, but it shows a lot of promise and the author is keen for bug reports and feature requests.

PostalMime: Email Parser for Browser Environments — An email parsing library happy in most JS runtimes, including Node. Takes the raw source of emails and parses them into their constituent parts.

Node v23.6.0 (Current) Released — In last week’s issue, we said Node 23.6 was imminent, and it came out a few hours later ;-) Along with the usual dependency updates and bug fixes, the big news is type stripping is now enabled by default, enabling that node yourapp.ts magic, described in more detail below..

How to Create Your Own AI Agent — Join Scott Moss for this video course exploring how to build an AI agent from scratch — covering LLM options, transformers, token limits, AI memory, function calling, agent loops, prompting, and much more.

A New Chapter for Express.js — 2024 saw the still-extremely-popular Express project awaken from a slumber, of sorts, with work being made to update things to modern standards, a security audit, and the release of Express v5. Here, the team explains what’s been going on behind the scenes to get Express back on the tracks, as well as a “bold vision for 2025.”

pnpm 10.0: The Alternative, Efficient Package Manager — Long admired for its performance and efficiency improvements over npm, pnpm is now thinking hard about security too with v10 no longer running lifestyle scripts of dependencies by default, improved hashing, and a myriad of other tweaks.

Node Web Audio API 1.0: A Web Audio API Implementation for Node — More accurately, it’s a set of Node bindings for a Rust-powered non-browser implementation of the Web Audio API.

Horizontal, Vertical, Diagonal? What Even Is Scaling?! 👀 — Up, down, left, right… A+B, A+B?? No no.. scaling isn’t that complicated. Let’s unpack horizontal vs. vertical scaling.

Release It 18.0: A CLI Tool to Automate Package Publishing Tasks — Think things like bumping versions, tagging, creating releases at GitHub or GitLab, changelog generation, etc.

Node.js Now Supports TypeScript By Default — It’s been possible to run TypeScript directly with Node.js since v22.6 introduced experimental ‘type stripping’ support, but in the to-be-released-at-any-moment Node 23.6 (or the current Node nightly) you’ll be able to run node yourapp.ts and it’ll Just Work™. Matt provides some details on how it works and what you’ll be able to do.

zx 8.3: A Tool for Writing Better Shell Scripts — zx is an alternative way to run Node that makes it more useful for shell scripting by offering various niceties like process management, argument handling, and commonly used packages like Chalk. v8.3 makes it possible to iterate over a processes’ output using for await (thanks to Symbol.asyncIterator), plus there are enhancements to using pipes.

Introducing @smoores/epub: A Package for Working with EPUB Files — EPUB is a popular e-book file format and this new library provides a way to both read and write them. npm package link.

Securing Node.js Express APIs with Clerk and React — A guide that teaches you how to authenticate API requests using ClerkExpressWithAuth() and ClerkExpressRequireAuth() middleware.

Node v23.5.0 (Current) Released — A Node release that slipped in just before 2024 ended. WebCryptoAPI’s Ed25519 and X25519 algorithms are now stable and on-thread hooks are now back.

Tackling the '1 Billion Row Challenge' with Node — The 1 Billion Row Challenge (1BRC) arose about a year ago to see how quickly different languages and techniques can be used to aggregate data from a 1 billion line text file. Here’s what one developer learnt trying to optimize the task with Node.

sqs-consumer 11.3: Build Amazon SQS-Based Apps Without Boilerplate — Build SQS-based (Simple Queue Service) apps without the boilerplate. Just define an async function to handle the SQS message processing. If it’s good enough for the BBC..

Schemalint: A Linter for Postgres Schemas — A linter that lets you raise errors on a variety of common matters like name casing, enforcing row level security, or the presence of mandatory columns (so think more like ESLint than a basic formatter). You can also write your own custom rules.

node-datachannel: libdatachannel Bindings for Node.js — libdatachannel is a standalone C++17-based implementation of various WebRTC standards, as well as WebSockets, for use on POSIX platforms.

CSV Parse: Convert CSV Text into Arrays / Objects — Extends Node’s native transform stream API so you can get up and running quickly – see some example code. Part of a suite of CSV libraries that can also generate and transform CSV more generally.

jsesc: Get a Stringified, ASCII-Safe Representation of Any Data — Think JSON.stringify() but instead it returns JavaScript meaning it can support things like maps, sets, and BigInts.

MicroDiff 1.5: No Dependency Object and Array Comparison Library — Given two objects or arrays, it returns the differences (think diff but for JavaScript objects). Boasts high performance and TypeScript support. There’s also an article from 2022 about how it works.