Playing in the sandbox

#​476 — March 2, 2023

Read on the Web

zx 7.2: A Tool for Writing Better Shell Scripts — Always a popular tool when we link it!

is an alternative way to run Node that makes it more useful for shell scripting by bringing along a variety of niceties like process management, argument handling, and including useful packages like Chalk for text coloring. v7.2 adds

and

helpers (for retrying callbacks and showing a spinner UI element, respectively).

Google

Node.js Toolbox: A New Way to Find Node.js Packages — If you’ve worked in the Ruby/Rails space, you might know Ruby Toolbox as a long-time way to find and compare libraries. It’s early days but Node.js Toolbox is an unrelated, but similar effort curating Node packages in areas like HTTP frameworks, browser testing and query builders.

Maxim Orlov

Memetria: Secure, Scalable, Full-Featured Redis 7 Hosting — The latest Redis features, instrumented and scaled with the tools teams need as they grow.

Memetria sponsor

Sandbox Security Concerns with Node’s

Module — node:vm lets you compile and run code within separate contexts of the underlying V8 engine. Great for sandboxing, right? Not so fast. Even the docs say it’s not for running untrusted code. Liran looks at the implications.

Liran Tal

IN BRIEF:

• Yet again, npm supply chain security issues have reared their head with a supposed flood of 15,000 phishing packages on February 20/21.

• You can now add pronouns to your GitHub profile.

• Strapi is an open source Node.js-based headless CMS but the company behind it has unveiled Strapi Cloud, a commercial option for running it in the cloud.

Experiments in Mitigating Serverless Cold Start Delays — If you’re using Node for serverless functions on Vercel or Netlify, is a ‘cold start’ delay still a thing, and would frequently pinging a function mitigate against it? Due to how Vercel and Netlify specifically work, those pings may not be as useful as you’d suspect..

Punit Sethi

Sandboxing JavaScript Code — Val Town is an interesting, rather minimalist platform for running JavaScript in the cloud, and if you’re going to let folks run JavaScript on your server, good sandboxing is a must – they use Node and vm2 (well, for now anyway.) Andrew’s route to V8 sandboxing bliss, however, was Deno rather than Node, as he demonstrates here.

Andrew Healey

Bitmovin Handbook – The Definitive Guide to Video Codecs — A quick overview into the history and application of the most used codecs to help you select the ideal codec application.

Bitmovin Inc. sponsor

▶  A Deep Dive into the Node.js Event Loop

Tyler Hawkins

🛠 Code & Tools

Remult: A CRUD Framework for Full-Stack TypeScript — Promises a ‘zero-boilerplate’ CRUD API experience by using your TypeScript entities as a single source of truth for your API, frontend type-safe API client and backend ORM. There are tutorials for using it alongside React, Angular, Vue and Next.js.

Remult Team

BullMQ 3.9: Reliable, Redis-Based Distributed Queue for Node — A fast, reliable Redis-based distributed queue for Node with a focus on stability and atomicity.

Taskforce.sh Inc.

Need to Upgrade to Node 18? Don’t Have Time? Our Experts Can Help 🚀

UpgradeJS.com: JavaScript Upgrade Services sponsor

A Boilerplate Express.js + MongoDB Node.js App — ‘express-mongodb-rest-api-boilerplate’ doesn’t really roll off the tongue, but there’s a lot baked in here.

watscho

Official MongoDB Node.js Driver 5.1 — The official MongoDB driver now supports BigInt values with automatic serialization to BSON longs and vice versa.

MongoDB, Inc.

• ↑ eta (η) 2.0.1
  ↳ Embedded template engine for Node, Deno & browser.

• Restify 11.1
  ↳ Middleware-driven REST API framework.

• csvToJson 2.0
  ↳ Convert CSV files to JSON with Node.

• mojo.js 1.23
  ↳ Real-time web framework for Node. (Their example of how easily you can spin up a WebSocket system is pretty neat.)

• Slonik 33.1
  ↳ Type-safe Postgres client library.

• pnpm 7.28
  ↳ Alternative, efficient package manager.