NodeConf, Node.js v17 and other Adventures in Nodeland - Issue #32

Hi Everyone! This edition is all about NodeConf and Node v17. I have been visiting Milan last week, it has been pretty amazing to relax after an hectic NodeConf week!

After I published a picture on social media about me being in Milan I met up with Tomas (the other Fastify lead dev) who was passing though Milan by chance. What an encounter: last time we saw each other in person was over two years ago in Austria for WorkerConf!

The next bit of news is that my NodeConf talk “Multithreaded logging with Pino” is now on Youtube together with all the others. Check it out:

I’m really proud of one of my teams. They are shipping a new GraphQL implementation that got a speed-up of 100x. How we did it? Here is the thread explaining it all:

Node.js

It’s October and it’s time to release Node v17.0.0 and promote Node v16.13.0 to LTS! I have been using Node.js as my daily driver for the last couple of months!

Read up at:

I spent some time implementing a load balancing concept inside Undici. This could be useful in case we want to interconnect some services directly without the use of Nginx or Haproxy. Check it out:

We have quickly implemented it inside Mercurius GraphQL gateway.

Pino

Every new features come with bugs, and I have put my fair share of them in the new pino@7 release. Here is me fixing one:

News

Over the weekend the maintainer of ua-parser-js was compromised and the module was released with malicious code. Read more at:

ua-parser-js vulnerabilities - GHSA-pjwm-rvh2-c87w - GitHub Advisory Database

The npm package ua-parser-js had three versions published with malicious code. Users of affected versions (0.7.29, 0.8.0, 1.0.0) should upgrade as soon as possible and check their systems for suspicious activity. See this issue for details as they unfold.

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

github.com

After meeting Shawn in Manhattan and Honolulu I started to really appreciate his deep insight and economic reasoning of the tech industry. This blog post of Cloudflare vs AWS depicts a new Cloud reality that is unfolding as we speak.