Node Congress 2022

The talk discusses the importance of supply chain security in the open source ecosystem, highlighting the risks of relying on open source code without proper code review. It explores the trend of supply chain attacks and the need for a new approach to detect and block malicious dependencies. The talk also introduces Socket, a tool that assesses the security of packages and provides automation and analysis to protect against malware and supply chain attacks. It emphasizes the need to prioritize security in software development and offers insights into potential solutions such as realms and Deno's command line flags.

There is a need for a standard library of APIs for JavaScript runtimes, as there are currently multiple ways to perform fundamental tasks like base64 encoding. JavaScript runtimes have historically lacked a standard library, causing friction and difficulty for developers. The idea of a small core has both benefits and drawbacks, with some runtimes abusing it to limit innovation. There is a misalignment between Node and web browsers in terms of functionality and API standards. The proposal is to involve browser developers in conversations about API standardization and to create a common standard library for JavaScript runtimes.

This talk covers various techniques for getting diagnostics information out of Node.js, including debugging with environment variables, handling warnings and deprecations, tracing uncaught exceptions and process exit, using the v8 inspector and dev tools, and generating diagnostic reports. The speaker also mentions areas for improvement in Node.js diagnostics and provides resources for learning and contributing. Additionally, the responsibilities of the Technical Steering Committee in the TS community are discussed.

Deno aims to provide Node.js compatibility to make migration smoother and easier. While Deno can run apps and libraries offered for Node.js, not all are supported yet. There are trade-offs to consider, such as incompatible APIs and a less ideal developer experience. Deno is working on improving compatibility and the transition process. Efforts include porting Node.js modules, exploring a superset approach, and transparent package installation from npm.

The Talk discusses the current state of the Node HTTP client and the problems it faces, including the lack of support for HTTP pipelining and the intrinsic link between request and response objects. The speaker introduces the library Indichy, which aims to provide a more user-friendly API for HTTP in Node. The Talk highlights the performance advantages of using WebAssembly in the Umidigi HTTP client and the plans to include it in Node Core. The speaker also mentions the support for signals and the ability to post requests in Umidigi. Additionally, the Talk covers the customization options in Undici, the different types of dispatchers available, and the potential inclusion of Indichy in Node Core. Future plans include support for HTTP 2 and 3, DNS lookup enhancements, and improvements to fetch and pool scheduling. The Talk concludes by discussing the differences in TCP implementations across operating systems and the considerations for adding Web APIs and standards to Node Core.

Verdash is a lightweight and proxy private Node.js registry that allows you to host and publish private packages. It offers five ways to use it, including publishing packages with npm workspaces and handling conflicts. Verdash improves project productivity and continuous integration by caching dependencies and versions. Security considerations are important, and Verdash provides security features like rate limiting. It can be used as a registry for open source projects and offers flexibility and customization options.

This Talk explores error handling in Node.js, including types of errors, handling techniques, and debugging. It discusses the use of exceptions, callbacks, and promises for error handling. The importance of proper error handling and the benefits of using error classes, expressive error messages, and automated testing are emphasized. The speaker also addresses the use of TypeScript and test-driven development for error prevention. Overall, the Talk provides valuable insights and techniques for mastering error handling in Node.js.

Today's Talk explores the concepts of compilation and transpilation in JavaScript, highlighting the three steps involved: parsing, code transformation, and code generation. The process of traversing an abstract syntax tree is discussed, with examples of tools like Babel and ESLint that can be used for code transformations. Code transformation tools and techniques, such as CodeShift and T-TypeScript plugin, are introduced, emphasizing the power of abstract syntax trees and the visitor pattern. The summary concludes by encouraging further exploration of code refactoring and transformations using tools like Babel, TSLint, and astexplorer.net.

This Talk discusses database access on the edge with CloudFlare workers and the challenges of serverless platforms. It explores solutions for database access, including CloudFlare-specific solutions and using Prisma data proxy. The Prisma toolkit and demo are showcased, demonstrating how to convert an application to use a database. The process of setting up Prisma Data Platform and deploying the application to CloudFlare workers is explained. The Talk concludes with insights on database usage and the differences between serverless, CDN, and the Edge.

Let's write Node like it's 2022. We can now iterate over objects more easily with the for-in loop. Template literals make string concatenation and multi-line strings much simpler. The structured clone feature allows us to clone complex objects without the need for hacks like stringifying and parsing. Default parameters in JavaScript are now much more convenient. Async await eliminates the need for callbacks. Arrow functions inherit the scope, eliminating the need for 'this equals that'. Const prevents variable reassignment. Let helps catch errors earlier. Write code like it's 2022!

This talk explores using Rust and WebAssembly to enhance the performance of Node.js applications. By leveraging Rust's efficiency and safety features, and compiling it into WebAssembly bytecode, developers can achieve high-performance computations while ensuring security. WebAssembly enables direct communication with native hardware and is optimized for server-side applications, making it suitable for tasks like AI inference and storage databases. Overall, this talk highlights the potential of combining JavaScript, Rust, and WebAssembly to build performant and portable applications.

The Talk covers the historical landscape of web development, the rise of static site generators, the serverless revolution, edge computing, and using Cloudflare services to enhance static websites. It explores the challenges of early web development, the shift to static sites and client-side rendering, and the advantages of server-side and client-side rendering. It also discusses Cloudflare services like Cloudflare workers, KV, durable objects, and HTML rewriter for building fast and minimal hosting solutions. The Talk highlights the use of DurableObjects for analytics and integration, dynamic content on static sites, JAMstack, and the advantages of using Cloudflare Workers for automatic deployment, multiple language support, and combining static pages with JavaScript functions. It introduces the concept of edge computing and the difference between Cloudflare Pages and Workers. It also touches on error handling and the use of HTML rewriter, Cloudflare KVstore, and DurableObjects for managing state and storing dynamic data.

Today's Talk focused on the future of full-stack web development with Blitz.js. Blitz is a React framework built on top of Next.js, offering direct database access and authentication with authorization. The core features of Blitz include the zero-API layer and the ability to run server code directly from the frontend. The future of Blitz includes expanding to other frameworks and runtime environments. The new Blitz toolkit will be decoupled from any specific framework, allowing developers to choose their preferred foundation. It will retain the core value of Blitz while adding additional features like JWT authentication and advanced data-aware authorization. The migration to the new toolkit will be seamless for existing Blitz projects. The Blitz toolkit will have a plugin system for customization and support multiple resolvers. The Blitz project is currently going through a pivot and will focus on the Blitz toolkit. The goal is to release the toolkit by the end of March. The most exciting part of the toolkit is the plugin system design that allows users to customize their experience.

Today's Talk explores the future of JavaScript runtimes, their evolution, and impact on software development. It discusses the historical trends of JavaScript, the adoption of new tools and libraries, and the convergence of Node and Deno. The emergence of isolate clouds and their potential to replace traditional VMs and containers is also highlighted. Additionally, the talk touches on the possibilities of JavaScript in exotic use cases, its impact on machine learning, and the potential for TypeScript to become the de facto language for JavaScript development.

This Talk provides valuable insights for those considering serverless in 2022, with a focus on troubleshooting and observability using Lumigo. It emphasizes the use of multiple AWS accounts and Org Formation for better control and scalability. Security considerations include securely loading secrets at runtime and implementing zero-trust networking. Optimizing Lambda performance is discussed, along with updates on serverless frameworks and the role of Terraform. The Talk also compares Honeycomb and Lumigo for observability in serverless applications.

Sentry is code monitoring for developers, specifically designed for the application layer. It helps identify error details, frequency, release, user information, and stack trace. Source maps can be uploaded to see the original source code and suspect commits can be identified. Performance monitoring helps identify slowdowns and determine the cause. Automating alerts and investigating errors helps gain instant context and trace errors across different projects.

Today's Talk is a demo of the DnSimple node client, including the installation process, authentication, domain availability check, and registration. The speaker emphasizes testing in the sandbox environment before moving to production. Setting up DNS records and registering domains are also covered, with the importance of verifying the code's functionality. Additional information about other clients and the DNSimple API is available at dnsimple.com/API.

StackHawk is a dynamic application security testing tool that integrates with CI-CD workflows and simplifies finding and fixing security issues. The scan results include detailed descriptions of identified issues, along with links and request/response details for replaying the attack. The StackHawk YAML configuration allows for specifying application location, environment, and additional options for authentication and scanning exclusions.

npm install can be a mysterious process, but understanding how package managers work is essential. NPM solved problems like large node_modules, circular dependencies, and multiple instances of the same package. Managing package versions and conflicts is crucial for consistency across projects. Alternative approaches to package management, like PNPM and Yarn2, provide insights into the hidden complexities of package managers.

Today's talk covers the evolution of deploying Node on servers and platforms, including physical servers, monolith servers, PaaS, containers, and serverless. Node deployment has become easier over the years thanks to the evolution of Node.js. Each deployment method has its pros and cons, with serverless offering lower costs and simpler backend code. However, it also has drawbacks like vendor locking and unsuitability for long-term tasks. Overall, Node.js deployment has evolved from on-premise to containers to serverless.

The Talk discusses the relationship between complexity and collaboration in software development. It highlights that collaboration is not always the answer to solving problems and that communication is crucial in software development. The concept of collective intelligence is introduced, which describes a group's capability to perform well together across tasks. The study mentioned in the Talk shows that collective intelligence is transferable among tasks, and skilled players rely on nonverbal cues and understanding the software. Lack of understanding can lead to difficulties in team performance and deployment.