211–220 of 448 posts
Earlier quoted context omitted.
And now we need to throw the entire article out because we have no idea whether any of these features are just hallucinations.
I think we have enough node developers here to know its truthfulness.
Node test also I dont think is great, because in isomorphic apps you’ll have 2 syntax for testing.
I think the permissions are the core thing we should do, even if we run the apps in docker/dev containers.
Aliases is nice, node:fetch but I guess will break all isomorphic code.
I think top level async is bad because won’t converge with js browser. Node test also I dont think is great, because in isomorphic apps you’ll have 2 syntax for testing. I think the permissions are the core thing we should do, even if we run the apps in docker/dev containers. Aliases is nice, node:fetch but I guess will break all isomorphic code.
You no longer need to install chalk or picocolors either, you can now style text yourself: `const { styleText } = require('node:util');` Docs: https://nodejs.org/api/util.html#utilstyletextformat-text-op...
I never needed those. I would just have an application wide object property like: text: { angry : "\u001b[1m\u001b[31m", blue : "\u001b[34m", bold : "\u001b[1m", boldLine : "\u001b[1m\u001b[4m", clear : "\u001b[24m\u001b[22m", cyan : "\u001b[36m", green : "\u001b[32m", noColor : "\u001b[39m", none : "\u001b[0m", purple : "\u001b[35m", red : "\u001b[31m", underline: "\u001b[4m", yellow : "\u001b[33m" } And then you ca…
Also, I'm guessing if I pipe your logs to a file you'll still write escapes into it? Why not just make life easier?
Whoa, I didn't know about this: # Run with restricted file system access node --experimental-permission \ --allow-fs-read=./data --allow-fs-write=./logs app.js # Network restrictions node --experimental-permission \ --allow-net=api.example.com app.js Looks like they were inspired by Deno. That's an excellent feature. https://docs.deno.com/runtime/fundamentals/security/#permiss...
PHP used to have (actually, still has) an "open_basedir" setting to restrict where a script could read or write, but people found out a number of ways to bypass that using symlinks and other shenanigans. It took a while for the devs to fix the known loopholes. Looks like node has been going through a similar process in the last couple of years.
Similarly, I won't be surprised if someone can use DNS tricks to bypass --allow-net restrictions in some way. Probably not worth a vulnerability in its own right, but it could be used as one of the steps in a targeted attack. So don't trust it too much, and always practice defense in depth!
Earlier quoted context omitted.
Insane but worked well. At least we could get download progress.
You can get download progress with fetch. You can't get upload progress. Edit: Actually, you can even get upload progress, but the implementation seems fraught due to scant documentation. You may be better off using XMLHttpRequest for that. I'm going to try a simple implementation now. This has piqued my curiosity.
The killer upgrade here isn’t ESM. It’s Node baking fetch + AbortController into core. Dropping axios/node-fetch trimmed my Lambda bundle and shaved about 100 ms off cold-start latency. If you’re still npm i axios out of habit, 2025 Node is your cue to drop the training wheels.
There has to be something wrong with a tech stack (Node + Lambda) that adds 100ms latency for some requests, just to gain the capability [1] to send out HTTP requests within an environment that almost entirely communicates via HTTP requests. [1] convenient capability - otherwise you'd use XMLHttpRequest
2. You don't need to use axios. The main value was that it provides a unified API that could be used across runtimes and has many convenient abstractions. There were plenty of other lightweight HTTP libs that were more convenient than the stdlib 'http' module.
Earlier quoted context omitted.
I've heard it recommended; other than speed, what does it have to offer? I'm not too worried about shaving off half-a-second off of my personal projects' 5-second test run :P
It has native TS and JSX support, excellent spy, module, and DOM mocking, benchmarking, works with vite configs, and parallelises tests to be really fast.
In many ways, this debacle is reminiscent of the Python 2 to 3 cutover. I wish we had started with bidirectional import interop and dual module publications with graceful transitions instead of this cold turkey "new versions will only publish ESM" approach.