An array of important security releases

#377 — February 25, 2021

Read on the Web

Node Weekly

Tauri: A New(ish) Framework for Building Desktop Apps with a Web Frontend — Electron is the big cheese in the ‘build desktop apps with JavaScript, HTML and CSS’ space but other contenders are now coming along including this Rust-based one. You still use Node under the hood and you can get running on Linux, macOS and Windows. It’s still a work in progress but they’ve got a lot done so far.

Tauri Contributors

The February 2021 Security Releases Are Here — Updates are now available for each release line being maintained, including v15.10.0, v14.16.0, v12.21.0, and v10.24.0 to fix three security issues, one crucial. The crucial one is an HTTP2 DoS resource exhaustion vulnerability where a large number of specially crafted connection attempts could cause a file descriptor leak.

Node.js Project

A Friendly Introduction to Functional Programming with JavaScript by Anjana Vakil — Learn what Functional Programming (FP) is and how it differs from other programming styles (such as OO and imperative), and use key concepts of functional to improve your everyday coding.

Frontend Masters sponsor

Introducing Env: A Better Way to Read Environment Variables — If you write server-side JavaScript, chances are you’ve needed to read information from environment variables, such as access tokens for third party APIs. Env is Nicholas’s approach to making this process safer and less error-prone.

Nicholas C. Zakas

Quick Bits

• The Linux Foundation is offering a free, edX-based “introduction to Node.js” course that starts today.
• JOSS (JS Open Serialization Scheme) is an interesting new serialization format that tackles data JSON can’t handle (e.g. ArrayBuffer, BigInt, regexes..) It works in both static and streaming mode and there are reference implementations for browsers and Node. Here’s a blog post about it.
• ‘Why you should drop Express.js in 2021’ is an undoubtedly controversial opinion piece (and not one we agree with) but provoked some interesting responses.

💻 Jobs

Backend Developer – Remote or in Beautiful Norway — Do you have a passion for GraphQL, NodeJS, and message drive distributed architectures? Join our remote-first engineering team.

Crystallize

Find Your Next Job Through Hired — Create a profile on Hired to connect with hiring managers at growing startups and Fortune 500 companies. It’s free for job-seekers.

Hired

📗 Tutorials and Stories

Working with Protobufs in Node — Protocol buffers (a.k.a. protobufs) are a language and platform neutral format for sending structured data around (think XML or JSON but lower level).

Valeri Karpov

Building a Real-Time Webapp with Node and Socket.io — Want to create an app that does real-time data synchronization across multiple machines without introducing a third-party service like Pusher or Firebase? This is the first in a three part series but cuts to the heart of the matter.

Norbert Kovacs and Ferenc Hámori

Introducing SPOTcon 2021! Get Your Free Early Bird Ticket Today — Scout APM’s digital event on performance & observability. Register before 2/28 & we’ll donate $5 to OSS when you attend.

Scout APM sponsor

▶  Building Your First AWS Lambda Function in VS Code — A tight tutorial screencast that clocks in at under 10 minutes.

Dylan Albertazzi

One Developer’s Contribution to Node.js Core — Jarrod had long been keen to contribute to a large open source project like Node but, like most, found it daunting to figure out how. This brief piece touches on what he contributed, what resources he read to learn more, and how his code landed in the project.

Jarrod Connolly

How to Extract Data From PDFs with PDF.js

Ammon Victor

A Few Node.js Logging Best Practices

Victor Jonah

How to Use Vue.js Environment Modes with a Node.js Mock Data Layer

Dave Berning

tldts: Library to Work with Complex Domain Names, Subdomains and URIs — A ‘blazing fast’ library for extracting hostnames, domains, public suffixes, and more from URLs, with full Unicode/IDA support, TS type definitions, and more.

Parisot and Berson

cron-parser: Node Library for Parsing

Rules —

is a commonly used mechanism on Unix-based systems for running recurring tasks and such tasks are defined in a very specific format. This package lets you parse this format for your own ends.

Harri Siirak

Hexo 5.4: A Node-Powered Blog Framework — A new version just came out.

Tommy Chen

An Engineering Leader’s Guide to OpenTelemetry

Lightstep sponsor

PKCS11js: A Node Implementation of the PKCS#11 2.3 Interface — PKCS#11 is a public key cryptographic standard for working with tokens generated by hardware crypto devices/smart cards/etc.

PeculiarVentures

Tree-Sitter: A Parser Generator Tool and Incremental Parsing Library — It can build a concrete syntax tree for a source file and efficiently update the syntax tree as the source file is edited. General enough to parse any language and claims to be fast enough “to parse on every keystroke in a text editor.” It’s written in Rust but has bindings to be used from Node.

Max Brunsfeld

Raw Node.js Release Data — I can’t immediately think of a use for this, but maybe such data would be useful to you. It includes things like version numbers, architectures, dates, and whether releases are LTS or not.

Sergey Rubanov

ZWS: A URL Shortener Based on Invisible Spaces — Do I recommend this approach? Not at all. Do I think it’s funny/clever? Yes. The actual service is here.

zws.im