Adventures in Nodeland logo

Adventures in Nodeland

Subscribe
Archives
March 29, 2022

So many releases and other Adventures in Nodeland - Issue #53

Hi Folks! Another week has passed and we had a flurry of activity on Pino, Fastify and Mercurius! Last week I was back on the road to speak at CityJS Conference. After more than 2 years it felt amazing to be on stage!

Pino

Last week I have been on a journey to fix failing tests in CITGM. Some of the changes required a change in thread-stream’s flush() implementation to avoid release zalgo!

Release v0.14.0 · pinojs/thread-stream · GitHub
Release v0.14.0 · pinojs/thread-stream · GitHub
A streaming way to send data to a Node.js Worker Thread - Release v0.14.0 · pinojs/thread-stream
github.com
Release v0.14.0 · pinojs/thread-stream · GitHub
Release v0.14.0 · pinojs/thread-stream · GitHub
A streaming way to send data to a Node.js Worker Thread - Release v0.14.0 · pinojs/thread-stream
github.com

thread-stream v0.15.0 changes how transpiled code is loaded.

Release v0.15.0 · pinojs/thread-stream · GitHub
Release v0.15.0 · pinojs/thread-stream · GitHub
A streaming way to send data to a Node.js Worker Thread - Release v0.15.0 · pinojs/thread-stream
github.com
Release v0.15.0 · pinojs/thread-stream · GitHub
Release v0.15.0 · pinojs/thread-stream · GitHub
A streaming way to send data to a Node.js Worker Thread - Release v0.15.0 · pinojs/thread-stream
github.com

pino v7.9.2 fixed embedded those changes and reverted https://github.com/pinojs/pino/pull/1367, which caused a regression.

Release v7.9.2 · pinojs/pino · GitHub
Release v7.9.2 · pinojs/pino · GitHub
🌲 super fast, all natural json logger. Contribute to pinojs/pino development by creating an account on GitHub.
github.com
Release v7.9.2 · pinojs/pino · GitHub
Release v7.9.2 · pinojs/pino · GitHub
🌲 super fast, all natural json logger. Contribute to pinojs/pino development by creating an account on GitHub.
github.com

hapi-pino@9.3.0 changed how we log errors to actually log the error message.

Release v9.3.0 · pinojs/hapi-pino · GitHub
Release v9.3.0 · pinojs/hapi-pino · GitHub
🌲 Hapi plugin for the Pino logger. Contribute to pinojs/hapi-pino development by creating an account on GitHub.
github.com
Release v9.3.0 · pinojs/hapi-pino · GitHub
Release v9.3.0 · pinojs/hapi-pino · GitHub
🌲 Hapi plugin for the Pino logger. Contribute to pinojs/hapi-pino development by creating an account on GitHub.
github.com

pino-pretty v7.6.0 ships a new option to fallback custom levels and colors to default values: https://github.com/pinojs/pino-pretty/pull/317.

Release v7.6.0 · pinojs/pino-pretty · GitHub
Release v7.6.0 · pinojs/pino-pretty · GitHub
🌲Basic prettifier for Pino log lines. Contribute to pinojs/pino-pretty development by creating an account on GitHub.
github.com
Release v7.6.0 · pinojs/pino-pretty · GitHub
Release v7.6.0 · pinojs/pino-pretty · GitHub
🌲Basic prettifier for Pino log lines. Contribute to pinojs/pino-pretty development by creating an account on GitHub.
github.com

Mercurius

Mercurius v9.3.6 and v8.12.2 ships a fundamental fix in how Federation is implemented: now they keep the requires directive in the gateway schema.

Keep requires directive in gateway schema by aleccool213 · Pull Request #756 · mercurius-js/mercurius · GitHub
Keep requires directive in gateway schema by aleccool213 · Pull Request #756 · mercurius-js/mercurius · GitHub
Fixes #729
github.com
Keep requires directive in gateway schema by aleccool213 · Pull Request #756 · mercurius-js/mercurius · GitHub
Keep requires directive in gateway schema by aleccool213 · Pull Request #756 · mercurius-js/mercurius · GitHub
Fixes #729
github.com
Release v9.3.6 · mercurius-js/mercurius · GitHub
Release v9.3.6 · mercurius-js/mercurius · GitHub
Implement GraphQL servers and gateways with Fastify - Release v9.3.6 · mercurius-js/mercurius
github.com
Release v9.3.6 · mercurius-js/mercurius · GitHub
Release v9.3.6 · mercurius-js/mercurius · GitHub
Implement GraphQL servers and gateways with Fastify - Release v9.3.6 · mercurius-js/mercurius
github.com
Release v8.12.2 · mercurius-js/mercurius · GitHub
Release v8.12.2 · mercurius-js/mercurius · GitHub
Implement GraphQL servers and gateways with Fastify - Release v8.12.2 · mercurius-js/mercurius
github.com
Release v8.12.2 · mercurius-js/mercurius · GitHub
Release v8.12.2 · mercurius-js/mercurius · GitHub
Implement GraphQL servers and gateways with Fastify - Release v8.12.2 · mercurius-js/mercurius
github.com

Fastify

How would you do hot module replacement for Frontend applications with Fastify? You could always wrap an express based solution… however

GitHub - gajus/fastify-webpack-hot: A Fastify plugin for serving files emitted by Webpack with Hot Module Replacement (HMR).
GitHub - gajus/fastify-webpack-hot: A Fastify plugin for serving files emitted by Webpack with Hot Module Replacement (HMR).
A Fastify plugin for serving files emitted by Webpack with Hot Module Replacement (HMR).
github.com
GitHub - gajus/fastify-webpack-hot: A Fastify plugin for serving files emitted by Webpack with Hot Module Replacement (HMR).
GitHub - gajus/fastify-webpack-hot: A Fastify plugin for serving files emitted by Webpack with Hot Module Replacement (HMR).
A Fastify plugin for serving files emitted by Webpack with Hot Module Replacement (HMR).
github.com

light-my-request, the module that provides the http injection capabilities to Fastify, got an update: the json() method can now be destructured. Thanks Simen!

Release v4.9.0 · fastify/light-my-request · GitHub
Release v4.9.0 · fastify/light-my-request · GitHub
Fake HTTP injection library. Contribute to fastify/light-my-request development by creating an account on GitHub.tg
github.com
Release v4.9.0 · fastify/light-my-request · GitHub
Release v4.9.0 · fastify/light-my-request · GitHub
Fake HTTP injection library. Contribute to fastify/light-my-request development by creating an account on GitHub.tg
github.com

fastify-swagger@5.1.0 was released with a few dependency upgrades and a fix for patternProperties.

Release v5.1.0 · fastify/fastify-swagger · GitHub
Release v5.1.0 · fastify/fastify-swagger · GitHub
Swagger documentation generator for Fastify. Contribute to fastify/fastify-swagger development by creating an account on GitHub.
github.com
Release v5.1.0 · fastify/fastify-swagger · GitHub
Release v5.1.0 · fastify/fastify-swagger · GitHub
Swagger documentation generator for Fastify. Contribute to fastify/fastify-swagger development by creating an account on GitHub.
github.com

The new release of point-of-view includes an improved caching algorithm for partials. Check out v5.2.0:

Release v5.2.0 · fastify/point-of-view · GitHub
Release v5.2.0 · fastify/point-of-view · GitHub
Template rendering plugin for Fastify. Contribute to fastify/point-of-view development by creating an account on GitHub.
github.com
Release v5.2.0 · fastify/point-of-view · GitHub
Release v5.2.0 · fastify/point-of-view · GitHub
Template rendering plugin for Fastify. Contribute to fastify/point-of-view development by creating an account on GitHub.
github.com

Other modules

Autocannon@7.8.0 add cli options to pass certificate information:

Release v7.8.0 · mcollina/autocannon · GitHub
Release v7.8.0 · mcollina/autocannon · GitHub
fast HTTP/1.1 benchmarking tool written in Node.js - Release v7.8.0 · mcollina/autocannon
github.com
Release v7.8.0 · mcollina/autocannon · GitHub
Release v7.8.0 · mcollina/autocannon · GitHub
fast HTTP/1.1 benchmarking tool written in Node.js - Release v7.8.0 · mcollina/autocannon
github.com

The power of “small modules” that “do one thing and one thing well” is that they could be “done” - no more features are needed. This was the case for the loopbench module which had its last update in 2016. Given the recent updates to Node.js a new version was needed and last week I released v2.0.0!

Release v2.0.0 · mcollina/loopbench · GitHub
Release v2.0.0 · mcollina/loopbench · GitHub
Benchmark your event loop. Contribute to mcollina/loopbench development by creating an account on GitHub.
github.com
Release v2.0.0 · mcollina/loopbench · GitHub
Release v2.0.0 · mcollina/loopbench · GitHub
Benchmark your event loop. Contribute to mcollina/loopbench development by creating an account on GitHub.
github.com

News

Minimist received a public security vulnerability disclosure on March 15th, leading to a lot of security scanners flagging a lot of dependencies insecure. However that’s not the case as prototype pollution hardly affect command line parsing. Anyway, this was fixed in minimist@1.2.6. Read up the initial report:

insufficient fix for prototype pollution in setKey() CVE-2021-44906 · Issue #164 · substack/minimist
insufficient fix for prototype pollution in setKey() CVE-2021-44906 · Issue #164 · substack/minimist
Jkovarik added a commit to nasa/cumulus that referenced this issue 11 hours ago
github.com
insufficient fix for prototype pollution in setKey() CVE-2021-44906 · Issue #164 · substack/minimist
insufficient fix for prototype pollution in setKey() CVE-2021-44906 · Issue #164 · substack/minimist
Jkovarik added a commit to nasa/cumulus that referenced this issue 11 hours ago
github.com

Last week was interrupted by the public disclaimer of an Okta breach. Okta provides the corporate Single Sign On solution for most of the brands we use every day: potentially this could have enable somebody to access your data. Please read the Okta statement and the CloudFlare analysis.

Updated Okta Statement on LAPSUS$
Updated Okta Statement on LAPSUS$
The Okta service has not been breached and remains fully operational. There are no corrective actions that need to be taken by our customers.  In January 2022, Okta detected an unsuccessful attempt to compromise the account of a customer support engineer working for a third-party provider.
www.okta.com
Cloudflare’s investigation of the January 2022 Okta compromise
Cloudflare’s investigation of the January 2022 Okta compromise
Today, March 22, 2022 at 03:30 UTC we learnt of a compromise of Okta. We use Okta internally for employee identity as part of our authentication stack. We have investigated this compromise carefully and do not believe we have been compromised as a result.
blog.cloudflare.com
Cloudflare’s investigation of the January 2022 Okta compromise
Cloudflare’s investigation of the January 2022 Okta compromise
Today, March 22, 2022 at 03:30 UTC we learnt of a compromise of Okta. We use Okta internally for employee identity as part of our authentication stack. We have investigated this compromise carefully and do not believe we have been compromised as a result.
blog.cloudflare.com
Event listeners and garbage collection
Event listeners and garbage collection
Imagine a bit of code like this: async function showImageSize(url) { const blob = await fetch(url).then(® => r.blob());
jakearchibald.com

What manager would you like to be? Should you care about your direct reports or not? What would be most beneficial to you in the long term?

I probably have missed the news back then, but Quirrel was acquired by Netlify. Why is this important for you? Quirrel is built on Fastify. That’s great news for the team!

Netlify Announces Acquisition of Quirrel to Extend Serverless Functions Capabilities
Netlify Announces Acquisition of Quirrel to Extend Serverless Functions Capabilities
Open source and serverless expertise brings a better experience for Jamstack developers SAN FRANCISCO – February 1, 2022 – Netlify, the workflow for the modern web, today announced the acquisition of Quirrel, an open source solution and service for managing and scheduling the execution of serverless functions and jobs.
www.netlify.com
Netlify Announces Acquisition of Quirrel to Extend Serverless Functions Capabilities
Netlify Announces Acquisition of Quirrel to Extend Serverless Functions Capabilities
Open source and serverless expertise brings a better experience for Jamstack developers SAN FRANCISCO – February 1, 2022 – Netlify, the workflow for the modern web, today announced the acquisition of Quirrel, an open source solution and service for managing and scheduling the execution of serverless functions and jobs.
www.netlify.com

Have you had an hard time understanding NFTs? I compare them to collecting coins (or stamps) like my grandad used to do.

NFT Unpack | No Mercy / No Malice
NFT Unpack | No Mercy / No Malice
Last week, Mark Zuckerberg announced NFTs are coming to Instagram. What does that … mean? The announcement was a word salad of platitudes, so we don’t know how the Zuck will bolt this latest thing onto his Frankenstein product structure.
www.profgalloway.com
NFT Unpack | No Mercy / No Malice
NFT Unpack | No Mercy / No Malice
Last week, Mark Zuckerberg announced NFTs are coming to Instagram. What does that … mean? The announcement was a word salad of platitudes, so we don’t know how the Zuck will bolt this latest thing onto his Frankenstein product structure.
www.profgalloway.com
Don't miss what's next. Subscribe to Adventures in Nodeland:
GitHub X YouTube LinkedIn