Mar 29, 2022

So many releases and other Adventures in Nodeland - Issue #53

Matteo Collina

Hi Folks! Another week has passed and we had a flurry of activity on Pino, Fastify and Mercurius! Last week I was back on the road to speak at CityJS Conference. After more than 2 years it felt amazing to be on stage!

Matteo Collina

@matteocollina

Last week I did my first in-person conference from 2019! I missed the stage and connecting with the users of my modules so much!

Thank you Aris and all the CityJS team! https://t.co/iUPsi9AnBQ

6:04 PM - 28 Mar 2022

Pino

Last week I have been on a journey to fix failing tests in CITGM. Some of the changes required a change in thread-stream’s flush() implementation to avoid release zalgo!

Release v0.14.0 · pinojs/thread-stream · GitHub

A streaming way to send data to a Node.js Worker Thread - Release v0.14.0 · pinojs/thread-stream

github.com

thread-stream v0.15.0 changes how transpiled code is loaded.

Release v0.15.0 · pinojs/thread-stream · GitHub

A streaming way to send data to a Node.js Worker Thread - Release v0.15.0 · pinojs/thread-stream

github.com

pino v7.9.2 fixed embedded those changes and reverted https://github.com/pinojs/pino/pull/1367, which caused a regression.

Release v7.9.2 · pinojs/pino · GitHub

🌲 super fast, all natural json logger. Contribute to pinojs/pino development by creating an account on GitHub.

github.com

[email protected] changed how we log errors to actually log the error message.

Release v9.3.0 · pinojs/hapi-pino · GitHub

🌲 Hapi plugin for the Pino logger. Contribute to pinojs/hapi-pino development by creating an account on GitHub.

github.com

pino-pretty v7.6.0 ships a new option to fallback custom levels and colors to default values: https://github.com/pinojs/pino-pretty/pull/317.

Release v7.6.0 · pinojs/pino-pretty · GitHub

🌲Basic prettifier for Pino log lines. Contribute to pinojs/pino-pretty development by creating an account on GitHub.

github.com

Mercurius

Mercurius v9.3.6 and v8.12.2 ships a fundamental fix in how Federation is implemented: now they keep the requires directive in the gateway schema.

Keep requires directive in gateway schema by aleccool213 · Pull Request #756 · mercurius-js/mercurius · GitHub

Fixes #729

github.com

Release v9.3.6 · mercurius-js/mercurius · GitHub

Implement GraphQL servers and gateways with Fastify - Release v9.3.6 · mercurius-js/mercurius

github.com

Release v8.12.2 · mercurius-js/mercurius · GitHub

Implement GraphQL servers and gateways with Fastify - Release v8.12.2 · mercurius-js/mercurius

github.com

Fastify

How would you do hot module replacement for Frontend applications with Fastify? You could always wrap an express based solution… however

GitHub - gajus/fastify-webpack-hot: A Fastify plugin for serving files emitted by Webpack with Hot Module Replacement (HMR).

A Fastify plugin for serving files emitted by Webpack with Hot Module Replacement (HMR).

github.com

light-my-request, the module that provides the http injection capabilities to Fastify, got an update: the json() method can now be destructured. Thanks Simen!

Release v4.9.0 · fastify/light-my-request · GitHub

Fake HTTP injection library. Contribute to fastify/light-my-request development by creating an account on GitHub.tg

github.com

[email protected] was released with a few dependency upgrades and a fix for patternProperties.

Release v5.1.0 · fastify/fastify-swagger · GitHub

Swagger documentation generator for Fastify. Contribute to fastify/fastify-swagger development by creating an account on GitHub.

github.com

The new release of point-of-view includes an improved caching algorithm for partials. Check out v5.2.0:

Release v5.2.0 · fastify/point-of-view · GitHub

Template rendering plugin for Fastify. Contribute to fastify/point-of-view development by creating an account on GitHub.

github.com

Other modules

[email protected] add cli options to pass certificate information:

Release v7.8.0 · mcollina/autocannon · GitHub

fast HTTP/1.1 benchmarking tool written in Node.js - Release v7.8.0 · mcollina/autocannon

github.com

The power of “small modules” that “do one thing and one thing well” is that they could be “done” - no more features are needed. This was the case for the loopbench module which had its last update in 2016. Given the recent updates to Node.js a new version was needed and last week I released v2.0.0!

Release v2.0.0 · mcollina/loopbench · GitHub

Benchmark your event loop. Contribute to mcollina/loopbench development by creating an account on GitHub.

github.com

News

Minimist received a public security vulnerability disclosure on March 15th, leading to a lot of security scanners flagging a lot of dependencies insecure. However that’s not the case as prototype pollution hardly affect command line parsing. Anyway, this was fixed in [email protected] Read up the initial report:

insufficient fix for prototype pollution in setKey() CVE-2021-44906 · Issue #164 · substack/minimist

Jkovarik added a commit to nasa/cumulus that referenced this issue 11 hours ago

github.com

Last week was interrupted by the public disclaimer of an Okta breach. Okta provides the corporate Single Sign On solution for most of the brands we use every day: potentially this could have enable somebody to access your data. Please read the Okta statement and the CloudFlare analysis.

Updated Okta Statement on LAPSUS$

The Okta service has not been breached and remains fully operational. There are no corrective actions that need to be taken by our customers. In January 2022, Okta detected an unsuccessful attempt to compromise the account of a customer support engineer working for a third-party provider.

www.okta.com

Cloudflare’s investigation of the January 2022 Okta compromise

Today, March 22, 2022 at 03:30 UTC we learnt of a compromise of Okta. We use Okta internally for employee identity as part of our authentication stack. We have investigated this compromise carefully and do not believe we have been compromised as a result.

blog.cloudflare.com

Event listeners and garbage collection

Imagine a bit of code like this: async function showImageSize(url) { const blob = await fetch(url).then(® => r.blob());

jakearchibald.com

What manager would you like to be? Should you care about your direct reports or not? What would be most beneficial to you in the long term?

Gergely Orosz

@GergelyOrosz

As a manager, what approach would you choose?

Option 1: put the careers of your direct reports first.

Option 2: put the company first, and not be supportive for any external opportunities.

It's so clear when written down like this. So why do so many managers practice Option 2? https://t.co/rfTu1P45BC

3:17 PM - 24 Mar 2022

I probably have missed the news back then, but Quirrel was acquired by Netlify. Why is this important for you? Quirrel is built on Fastify. That’s great news for the team!

Netlify Announces Acquisition of Quirrel to Extend Serverless Functions Capabilities

Open source and serverless expertise brings a better experience for Jamstack developers SAN FRANCISCO – February 1, 2022 – Netlify, the workflow for the modern web, today announced the acquisition of Quirrel, an open source solution and service for managing and scheduling the execution of serverless functions and jobs.

www.netlify.com

Have you had an hard time understanding NFTs? I compare them to collecting coins (or stamps) like my grandad used to do.

NFT Unpack | No Mercy / No Malice

Last week, Mark Zuckerberg announced NFTs are coming to Instagram. What does that … mean? The announcement was a word salad of platitudes, so we don’t know how the Zuck will bolt this latest thing onto his Frankenstein product structure.

www.profgalloway.com

Gergely Orosz

@GergelyOrosz

"What should worry about if I want to retain software engineers / engineering managers on my team?"

My way of thinking about the four key areas you should make sure people feel good about. If they do: unlikely they will leave. If 2 or more are missing: they are likely to go. https://t.co/LvzLUfkrv6

1:58 PM - 27 Mar 2022

Did you enjoy this issue? Yes No

Matteo Collina @matteocollina

I write about my journey as a core contributor of Node.js, as an author and a maintainer of many modules - including Fastify and Pino. In addition, I speak at conferences, and I will add links to all my talks in case you missed one.

In order to unsubscribe, click here.

If you were forwarded this newsletter and you like it, you can subscribe here.

Created with Revue by Twitter.