~nodeweekly | Bookmarks (176)

📄 docxtemplater: Generate docx and pptx Documents from Templates — Generate Word and PowerPoint files dynamically by merging against template documents (e.g. invoices, contracts, certificates) It’s open source (MIT/GPLv3) but the creator offers commercial extensions (such as for supporting Excel). GitHub repo and feature demos.

Feluda: A Tool to Analyze the Licences of Dependencies — It’s a Rust-powered project but one which can be used to process the dependencies of Node, Go, or Rust projects and return a report (or show a TUI interface) on potentially restrictive licenses that apply.

parse-duration 2.0: Convert a Human Readable Duration to Milliseconds — You might wonder why a library that converts 1hr 20mins into 4800000 needs a version 2. Well, it now supports more units (mo, mth, microsec, and nanosec), has moved to ESM, and supports locales.

Node File Trace (NFT): Node Dependency Tracing Utility — A tool to determine exactly which files are necessary for an app to run. Finally, a type of NFT I can actually comprehend!

Announcing TypeScript 5.8 Beta: A Big One for Node Developers — It's unusual for a TypeScript beta to be exciting for Node developers in particular, but while TypeScript 5.8 is low on features generally, it's really Node focused with support for require() of ES modules in the nodenext mode, a stable --module node18, and most notably a --erasableSyntaxOnly option for ensuring the use of TypeScript...

Introducing Mentoss: The fetch Mocker — A new approach to mocking global fetch() calls (in both browsers and server-side runtimes) inspired by previous attempts like Nock and MSW.

Standard Schema: A Common Interface to Schema / Validation Libraries — From the creators of Zod, Valibot and ArkType comes a fantastic bit of collaboration to define a common interface to use JavaScript and TypeScript schema libraries.

The Modern Way to Write JavaScript Servers? — The irony is that while Node popularized JavaScript on the server (if we ignore Netscape's attempts in the 90s) this modern, standardized cross-runtime approach doesn’t quite work on bare Node (yet – though you can polyfill it.)

Start Selling to Enterprise Faster with WorkOS — Add SSO, SCIM, and RBAC to your B2B SaaS app in minutes—not months.

http-status: Another Way to Work with HTTP Status Codes — For example: status[418] returns "I'm a teapot" and status.IM_A_TEAPOT returns 418.

🎨 node-canvas 3.1: A Cairo-Backed Canvas Implementation — We recently linked to Skia Canvas, a Skia and GPU-powered canvas drawing API for Node, but node-canvas is the longer standing library and is particularly easy to deploy and use, especially as it no longer has libuv or V8 dependencies.

A Failed Attempt to Shrink All npm Packages by 5% — What if you could shrink all npm package sizes by 5%.. wouldn’t that benefit all of us? Here’s how one developer did just that using Zopfli compression and then made a proposal to the npm maintainers to implement it. While promising, the proposal was ultimately rejected due to a variety of challenges and...

Things People Get Wrong About Electron — A proud maintainer of the wildly successful Electron cross-platform app framework stands by the technical choices made over the years and defends it against some of the more common criticisms here. If an hour of Netflix is 7 gigabytes, what’s 100MB for an app?

Troubles with Multipart Form Data and fetch in Node — One developer’s pain in debugging somethng that ‘should have just worked’ could be your relief if you run into issues where using fetch for multipart/form-data requests simply isn’t working (due to a missing trailing CRLF).

How I Open-Sourced My Secret Access Tokens from GitHub, Slack, and NPM (and Who Cared) — A developer accidentally published API tokens to npm via a misconfigured CI pipeline. npm and Slack detected and revoked said tokens, though GitHub did not. The author shares his tale and some advice.

Is Heroku Still Worth It in 2025? 💸 — You might want to give this guide a read — we took a tour through PaaS alley and found some worthy (💵) alternatives.

DBOS Transact v2: Lightweight Durable Execution in TypeScript — An open source library for lightweight durable execution built on Postgres. Durable execution means persisting the execution state of your program while it runs, so if it’s interrupted or crashes, it resumes from where it left off – ideal for long-running or business-critical workflows. Docs.

Bun 1.2: A Big Step Forward for the Fast JS/TS Runtime — I know it's not Node, but JavaScriptCore based Bun continues to up the server-side runtime game with major strides forward in Node.js compatibility in particular with this release. I often try Node scripts with bun and it Just Works™ – this is a good thing.

Emittery: A Simple, Modern Async Event Emitter — A small, async event emitter for Node and the browser, and now with support for AbortController.

NodeBB v4.0.0 Released: Node.js Powered Forums — Now almost 12 years old, NodeBB continues to offer a classic forum experience in a modern Node.js-shaped guise. The big update for v4 is support for federation between NodeBB instances and the wider fediverse generally. Note that the open source project (repo) is GPL licensed with NodeBB Inc providing a hosted service.

Electron 34.0.0 — The JS, HTML and CSS desktop app framework updates to Chromium 132, Node 20.18.1, and adds a way to access the JavaScript call stack of unresponsive renderers.

Protect Against Bots, Fraud, and Abuse in Real Time — WorkOS Radar protects your app with advanced device fingerprinting — stop fake signups, free tier abuse, bot attacks and brute force attempts today.

ArkType 2.0: Runtime Validation Library — An easy-to-deploy solution for schema validation that can infer TypeScript definitions 1:1 and use them as optimized validators for your data, both at runtime and for immediate type-level feedback in your editor.

Kill Switch Hidden in npm Packages Typosquatting Chalk and Chokidar — Recent research has found several malicious packages ‘typosquatting’ the terminal string styling library Chalk and file-watching library Chokidar — targeting Node devs with security issues.