Adventures in Nodeland - Issue #72

                August 16, 2022

            Adventures in Nodeland - Issue #72

            Hi folks, I’m sorry for the delayed send - yesterday it was a national holiday here in Italy and I went on a boat trip on the lake created by the dam of Ridracoli with my family. Our daughter loved it!

      Fastify

fastify-cli v5.0.1 fixes a bug introduced with the latest eject refactor. fastify-cli v5.1.0 makes the graceful termination timeout configurable.

@fastify/cookie v7.4.0 integrate cookie-signature. @fastify/cookie v8.0.0 avoids decorating the application instance with signCookie and unsignCookie if a plugin secret was not set.

@fastify/reply-from v8.2.0 replaces http-errors with @fastify/errors and fixes a typescript issue. The typescript change was reverted in v8.2.1.

github-action-merge-dependabot v3.2.2 resolves a security vulnerability due to the @actions/core v1.9.0 dependency.

fastify-plugin v4.2.0 adds generics for RawServer and TypeProvider.

@fastify/nextjs v9.0.0 updates to the latest Next.js and Fastify versions.

@fastify/under-pressure v8.0.0 updates dependencies.

@fastify/postgres v5.1.0 Adding types to declaration merge for route transact option in typescript.

      Pino

In v9 of pino-pretty, We drastically simplified the logged line from pino-pretty to focus on a development workflow by default; check it out!

pino v8.4.1 complete the fix done in v8.4.0 to support usage within worker_threads to pino.destination().

      Node.js

Release v5.8.2 · nodejs/undici · GitHub
This release contains two security fixes:

CRLF Injection in Nodejs ‘undici’ via Content-Type GHSA-f772-66g8-q5h3 CVE-2022-35948

undici.request vulnerable to SSRF using absolute URL on pathname GHSA-8qr4-xgw6-wmr3 CVE-2022-35949

github.com

CRLF Injection in Nodejs ‘undici’ via Content-Type GHSA-f772-66g8-q5h3 CVE-2022-35948

undici.request vulnerable to SSRF using absolute URL on pathname GHSA-8qr4-xgw6-wmr3 CVE-2022-35949

Release v5.8.2 · nodejs/undici · GitHub
This release contains two security fixes:

CRLF Injection in Nodejs ‘undici’ via Content-Type GHSA-f772-66g8-q5h3 CVE-2022-35948

undici.request vulnerable to SSRF using absolute URL on pathname GHSA-8qr4-xgw6-wmr3 CVE-2022-35949

github.com

I’m always fascinated by what people can do with Open Source software, this week is a PR to Node.js that adds iOS as a compilation target: https://github.com/nodejs/node/pull/44210

      News

What would it take to secure NPM against supply chain attacks? According to npm, strong cryptography and a ledger. Check it out:

New request for comments on improving npm security with Sigstore is now open | The GitHub Blog
Supply chain attacks exploit our implicit trust of open source to hurt developers and our customers. Read our proposal for how npm will significantly reduce supply chain attacks by signing packages with Sigstore.

github.blog

I find this interview with Sam Lambert of PlanetScale incredibly fascinating. Read up:

PlanetScale CEO on Cloud-Prem and Climbing the Engineering Ladder
Sam Lambert is CEO of PlanetScale, a MySQL-compatiable serverless database provider. Prior to joining PlanetScale (then as chief product officer), he was VP of engineering at GitHub. In this interview, Lambert discusses a number of topics related to cloud native software-delivery models, including what good serverless looks like, who should run Kubernetes, and the emergence of “cloud-prem” — a deployment model that combines the strengths of on-prem software and SaaS offerings.

future.com

Are you using JavaScript? Igalia was key to some of the amazing work TC39 has done over the years.

Igalia: the Open Source Powerhouse You’ve Never Heard of
Earlier this year Mozilla decided to stop development on its mixed reality browser. Rather than shuttering the project completely, it passed the source code to open source consultancy Igalia, which is using it to build the Wolvic browser.

thenewstack.io

JSON Schema with Fastify how to validate and serialize
Many developers have complained about the fact that Fastify uses ajv and fast-json-stringify under the hood to provide validation and serialization of JSON data, but those instances have never been exposed. In this way, developers can’t use those instances to process JSON schemas on their routes’ handlers. Thanks to @metcoder95, this pain was finally relieved!

backend.cafe

Faster page loads using server think-time with Early Hints - Chrome Developers
Remember HTTP/2 push? Early hints is the new take on the problem. It’s simpler, backward compatible and simple. It just works. Check it out!

developer.chrome.com

Ignoring mass reformatting commits with git blame – Rob Allen's DevNotes
I’m a huge fan of git blame to identify which commit broke some use case (usually added by me). Therefore I was really scared of changing the formatting of the code - one of my favorite tool would stop work. No more, thanks to .git-blame-ignore-revs.

akrabat.com

The biggest news is Deno doing a massive turnaround in its relationship with Node.js and npm, adding support for fetching modules from the npm registry. It’s a great win for the ecosystem!

Big Changes Ahead for Deno
Learnings from our recent survey and feedback from across our community. We’ll discuss how we’re addressing this feedback and the features to expect from Deno in the coming months.

deno.com

Don't miss what's next. Subscribe to Adventures in Nodeland: