Backend JavaScript News Brief (Q2 2021)

Honeybadger's quarterly briefings keep you up to date on the most important developments in your programming communities. We curate the news so you can spend more time focusing on what's really important.

• Events: Conferences and meetups. Upcoming and recently completed.
• Security: Recent vulnerability reports
• Projects: News about major community projects
• Trending Topics: Summaries of the big topics everyone's talking about
• Standout Content: Content that didn't fit in other sections, but that was too cool to leave out.

Events

iJS NEW YORK HYBRID 2021 on Sep 27-30

The International JavaScript Hybrid Conference takes place in New York this year, with topics varying on JavaScript practices and tools, Vue/Angular/React, and Node.js.

• Jun 20: JavaScript has come a long way from the early days of being a scripting language. Join our exciting sessions and workshops at International JavaScript Conference to take your JS skills to the next level.
• Jun 17: DevOpsCon & International JavaScript Conference New York early bird sale ends June 17.

OpenJS World 2021 on Jun 29

OpenJS World is a free, fully virtual event in which developers, advocates, and business leaders talked about the latest highlights on Dojo, Electron, JS, and Node.js.

• Jun 1: Red Hat is excited to be back at the OpenJS World conference again this year. We look forward to connecting with you to explore the impact Node.js and JavaScript are having on technologies of all kinds, especially in the area of cloud-native development.
• May 25: OpenJS World 2021 features contributions from five NearForm speakers. This year's event features keynotes on Fastify, Node.js HTTP throughput, serverless, and more.

JSNation Live on Jun 9-11

Discover the future of the JavaScript development ecosystem and get connected to its stellar crowd! Attend JSNation Live, a 3-day conference on all things JS, gathering international software engineers in the cloud.

Special attention to Evan You (creator of Vue.js) that'll be talking about Vite and frontend rethinking.

• Jun 15: Panel Discussion: Next Gen Build Tools, JSNation Live 2021 with Evan You, Shawn Wang, and more.
• May 14: Go Make Things will be speaking at JSNation Live about service workers in June.

Ajv Online Event on May 20

Ajv, an incubation project at the OpenJS Foundation and a JSON Schema validator for both server-side and client-side JavaScript apps, is hosting an online event where the audience will learn about project updates and get an in-depth look into Ajv version 8.

• May 9: Reddit discussion of some speakers on the keynotes and ajv.
• Apr 24: Official Ajv news post on the agenda and speakers.

NodeConf Remote 2021 on Oct 18-21

Europe's largest fully remote Node.js conference is run by the organizers of NodeConf EU and will focus on keynotes on Node.js Core, Apps, Community, and related.

• Apr 24: Announcing the conference dates, initial ideas on keynotes, and call for action.

IBM Day of Workshops on Jun 3

IBM sponsored OpenJS World 2021 and provided the community with a full day of virtual workshops and resources on Node.js, Node-RED, Cloud, Loopback, and more.

• May 25: OpenJS Foundation calling for the devs who want to join the keynotes and sessions live as a great opportunity to learn from experts who work on the Node.js platform and built robust Node apps in the field.

jsday on Jul 6-7

The jsday 2021 is the 10th edition of the online Italian JavaScript conference, organized by GrUSP, and many others.

Conf42: JavaScript 2021 on Oct 28

Join us for the online conference Conf42.com: JavaScript, which’s all about JavaScript and the crazy things you can do with it! Presentations on new frameworks and libs for JS, Node.js, innovative uses of JS, and games.

Node.TLV on Nov 14-15

The 2nd edition of the Node.js international conference in Tel Aviv, Israel, brought to you by Node.js-IL and EventHandler, is going to be 100% Node.js. Topics will vary from Node apps scalability & performance, trends/hot topics in 2021, security, ops, tests, and much more.

nz.js(con); on Jun 21-22

nz.js(con); is New Zealand’s dedicated national JavaScript conference was held in person in Wellington covering a broad variety of JavaScript related topics.

XtremeJS Online Conference on Dec 22

This year's online conference is looking for talks on JavaScript, micro frontend, DevOps, Data Science, IOT, and more.

Security

• Jun 8: npm upgrade - hosted-git-info Regular Expression Denial of Service (ReDoS) (Medium) (CVE-2021-23362)
• Jun 1: Windows installer - Node Installer Local Privilege Escalation (Medium) (CVE-2021-22921)
• Jun 1: libuv upgrade - Out of bounds read (Medium) (CVE-2021-22918)
• May 18: npm upgrade - ssri Regular Expression Denial of Service (ReDoS) (High) (CVE-2021-27290)
• May 12: In Deno versions 1.5.0 to 1.10.1, modules that are dynamically imported through import() or new Worker might have been able to bypass network and file system permission checks when statically importing other modules.

Projects

Node

The most popular JavaScript runtime built on Chrome's V8 JavaScript engine.

• Jun 16: Introducing Undici@4. Undici is a fast, reliable, and spec-compliant HTTP client for Node.js that's being supported by the official Node team in exchange for the current Node core HTTP stack (which presents several design issues).
• May 4: V8 release v9.1, which is in beta until its release in coordination with Chrome 91 Stable in several weeks, and brings new goodies such as default top-level await, private branch checks, and short builtin calls.
• May 3: N-API was renamed to Node-API. N-API (which stood for Node-API) has changed to avoid mispronunciation.
• Apr 20: Node.js 16 available. Highlights include the update of the V8 JavaScript engine to 9.0, prebuilt Apple Silicon binaries, and additional stable APIs.
• Apr 1: New release of Node v15.13.0, which upgraded npm to 7.7.6 and added workspaces to support npm run and exec, as well as support for Base64 encoding of binary data.

Deno

A growing-in-popularity secure runtime for JavaScript and TypeScript that uses V8 and is built in Rust.

• Jun 23: Deno Deploy Beta 1. Deno Deploy is a multi-tenant JavaScript engine that deeply integrates cloud infrastructure with the V8 virtual machine, allowing users to quickly script distributed HTTPS servers.
• Jun 8: Deno 1.11 has been released with many updates such as several new Docker images on Dockerhub, abortable ongoing fetch requests, more web crypto APIs, support for the browser API to broadcast messages, and much more.
• May 27: Velociraptor 1.0.0 released. Velociraptor brings package.json-style scripts to Deno along with Git hooks, Deno options, config files, env variables, and more.
• May 11: Deno 1.10 has been tagged and released. It adds Web Storage API support and contains new features, performance improvements, and bug fixes.

TypeScript

The Microsoft programming language for strict syntactical JavaScript with optional static typing.

• Jul 1: Announcing TypeScript 4.4 Beta. Among the major highlights, we have control flow analysis of aliased conditions, symbol and template string pattern index signatures, exact optional property types, and some performance improvements.
• May 26: Announcing TypeScript 4.3. The latest version brings lots of great changes such as template string type improvements, always-truth promise checks, static index signatures, more efficient compilation, import autocomplete, support for @link tags, and more.

Adonis

The fully-featured productivity-focused web framework for Node.js to create functional web apps or API servers.

• May 20: Adonis v5 Now Out. v5 brings easier social authentication support and improved asset management, amongst other things.
• Jun 20: The first release after v5 brings asynchronous local storage, HTTP Context, more social auth drivers, support for calendar events, better error handling, and much more.

commander.js

The complete solution for Node.js to make command-line interfaces easy.

• Jun 25: Release v8.0.0 of commander.js. Among the changes, we have several improvements in the TypeScript support, and lots of new args for hooks, and error handling.

pkg

The command-line interface that enables to package Node.js apps into an executable that can be run even on devices without Node.js installed.

• Apr 22: pkg 5.0 released. Latest version has support for symlink and pnpm, faster build times on Windows, and lots more.

node-dev

Node-dev is a development tool for Node.js that automatically restarts the node process when a file is modified.

• May 4: New release of node-dev v7.0.0, including command-line parsing, restore support for --require, and security updates.

create-node-cli

CLI to create new Node.js CLI applications in minutes.

• May 15: create-node-cli 1.6.0: CLI to Create New Node CLI Apps. Yeah, similarly to what we have with Create React App, this tool allows for boilerplate app creation for Node.js apps.

Socket.IO

Socket.IO enables real-time bidirectional event-based communication in various languages.

• May 14: Socket.IO 4.1.0 is released, including support for inter-server communication, customizable headers, and better connection error handling.

Mocha

Mocha is a feature-rich JavaScript test framework running on Node.js and in the browser, making asynchronous testing simple and fun.

• Jun 7: Mocha 9.0 Released. It now drops Node 10.x support and is going ‘ES modules first’ by using ESM import rather than CommonJS require to load test files by default.

Electron

The Electron framework lets you write cross-platform desktop applications using JavaScript, HTML and CSS.

• Mar 25: Electron 13.0 Released. It includes upgrades to Chromium 91, Node 14.16, and V8 9.1, plus several API updates, bug fixes, and general improvements.

Vendure

Vendure is a new headless e-commerce framework built for the developers who are building the modern web.

• May 19: Announcing Vendure v1.0. Vendure is a headless open-source e-commerce framework built on Node.js, TypeScript & GraphQL that achieved its first stable release!

Node-RED

Node-RED is a ‘low code’ programming environment built on top of Node that makes it easy to ‘wire up’ event flows in a visual way.

• Apr 8: The new version drops support for Node 8 to 10, adds npm packaged subflows, and function node use of npm modules.

ts-node

TypeScript execution and REPL for Node.js.

• May 23: ts-node 10.0 is out: TypeScript Execution and REPL for Node introduced several changes to resolve configs, redefine defaults, and add more command options.

PM2

PM2 is a great production process manager for Node.js with a built-in load balancer, keeping your apps always alive.

• Jun 7: PM2 5.0 released with a new embedded system monitoring allowing to monitor numerous vital server metrics.

Clinic.js

Clinic.js helps you diagnose and pinpoint performance issues with Node.js by collecting metrics, assessing health, and then offering recommendations for your Node.js apps.

• May 13: Clinic.js 9.0 is out. Version 9.0 drops support for Node 10.

Trending Topics

Node.js 10 EOL (8)

• Node.js 10 is going EOL
  • Node.js 10 went 'end of life' last Friday, so you'll need to be using Node 12 or above (ideally 14+) if you want ongoing security releases.
• Announcing the end of support for Node.js <10.x in the AWS SDK for JavaScript
  • Trivikram Kamat
  • As Node.js <= 10.x versions have reached end-of-life, AWS SDK will no longer support EOL Node runtimes.
• Node.js 10 is being EOL today, what does it all mean?
  • Alex Lakatos
  • A great explanatory article on what's going to change, the before vs after comparison, and what to do from now on.

Monorepos (5)

• Microfrontends in the Monorepo
  • Manfred Steyer
  • Microfrontends, each usually placed in its own repository, can find a home together in a monorepo. Monorepos simplify tasks that arise around microfrontends, but have a few intentional limitations.
• Scaling out JavaScript Monorepos with Yarn Workspaces
  • Tomas Fernandez
  • Monorepos are becoming so popular that even npm v7, the latest release, comes with native support for them. Let's explore how to structure JS workspaces and leverage Semaphore's monorepos.

Standout Content

• Next 10 years of Node.js — Understanding the needs of the Node.js future: Node.js is nearly twelve years old now, but the core team are thinking about the future and have launched an effort called Next 10 to engage the entire community to think about Node’s future.
• Introducing GitHub Copilot — The AI pair programmer: GitHub is launching a preview of its Copilot, a new AI pair programmer that helps writing better code via suggestions for whole lines or entire functions right inside your editor.