Hi folks, I’m sorry for the delayed send - yesterday it was a national holiday here in Italy and I went on a boat trip on the lake created by the dam of Ridracoli with my family. Our daughter loved it!
Fastify
- fastify-cli v5.0.1 fixes a bug introduced with the latest eject refactor. fastify-cli v5.1.0 makes the graceful termination timeout configurable.
-
@fastify/cookie v7.4.0 integrate
cookie-signature. @fastify/cookie v8.0.0 avoids decorating the application instance withsignCookieandunsignCookieif a plugin secret was not set. -
@fastify/reply-from v8.2.0 replaces
http-errorswith @fastify/errors and fixes a typescript issue. The typescript change was reverted in v8.2.1. -
github-action-merge-dependabot v3.2.2 resolves a security vulnerability due to the
@actions/corev1.9.0 dependency. -
fastify-plugin v4.2.0 adds generics for
RawServerandTypeProvider. - @fastify/nextjs v9.0.0 updates to the latest Next.js and Fastify versions.
- @fastify/under-pressure v8.0.0 updates dependencies.
- @fastify/postgres v5.1.0 Adding types to declaration merge for route transact option in typescript.
Pino
In v9 of pino-pretty, We drastically simplified the logged line from pino-pretty to focus on a development workflow by default; check it out!
pino v8.4.1 complete the fix done in v8.4.0 to support usage within worker_threads to pino.destination().
Node.js
|
- CRLF Injection in Nodejs ‘undici’ via Content-Type GHSA-f772-66g8-q5h3 CVE-2022-35948
-
undici.requestvulnerable to SSRF using absolute URL onpathnameGHSA-8qr4-xgw6-wmr3 CVE-2022-35949
- CRLF Injection in Nodejs ‘undici’ via Content-Type GHSA-f772-66g8-q5h3 CVE-2022-35948
-
undici.requestvulnerable to SSRF using absolute URL onpathnameGHSA-8qr4-xgw6-wmr3 CVE-2022-35949
|
|
- CRLF Injection in Nodejs ‘undici’ via Content-Type GHSA-f772-66g8-q5h3 CVE-2022-35948
-
undici.requestvulnerable to SSRF using absolute URL onpathnameGHSA-8qr4-xgw6-wmr3 CVE-2022-35949
I’m always fascinated by what people can do with Open Source software, this week is a PR to Node.js that adds iOS as a compilation target: https://github.com/nodejs/node/pull/44210
News
What would it take to secure NPM against supply chain attacks? According to npm, strong cryptography and a ledger. Check it out:
I find this interview with Sam Lambert of PlanetScale incredibly fascinating. Read up:
Are you using JavaScript? Igalia was key to some of the amazing work TC39 has done over the years.
ajv and fast-json-stringify under the hood to provide validation and serialization of JSON data, but those instances have never been exposed. In this way, developers can’t use those instances to process JSON schemas on their routes’ handlers. Thanks to @metcoder95, this pain was finally relieved!
.git-blame-ignore-revs.The biggest news is Deno doing a massive turnaround in its relationship with Node.js and npm, adding support for fetching modules from the npm registry. It’s a great win for the ecosystem!
