Month: February 2023

N|Solid v4.9.2 is now available

Posted on by

NodeSource is excited to announce N|Solid v4.9.2 which contains the following changes:

General stability improvements and bug fixes
Node.js v14.21.3 (LTS): Includes a Node.js security release captured in Node.js v14.21.3 (LTS).
Node.js v16.19.1 (LTS): Includes a Node.js security release captured in Node.js v16.19.1 (LTS).
Node.js v18.14.1 (LTS): Includes a Node.js security release captured in Node.js v18.14.1 (LTS).
Support for a new action in N|Solid saved views to capture traces automatically.

IMPORTANT: N|Solid v4.9.1 contains a Node.js security release!

For detailed information on installing and using N|Solid, please refer to the N|Solid User Guide.

Changes

N|Solid v4.9.2 contains the following changes:

General stability improvements and bug fixes
Node.js v14.21.3 (LTS): Includes a Rebase of N|Solid on Node.js v14.21.3 (LTS).
Node.js v16.19.1 (LTS): Includes a Rebase of N|Solid on Node.js v16.19.1 (LTS).
Node.js v18.14.2 (LTS): Includes a Rebase of N|Solid on Node.js v18.14.2 (LTS).

IMPORTANT: N|Solid v4.9.1 contains a Node.js security release. This release includes patches for these vulnerabilities:

CVE-2023-23918: Node.js Permissions policies can be bypassed via process.mainModule (High)
CVE-2023-23919: Node.js OpenSSL error handling issues in nodejs crypto library (Medium)
CVE-2023-23936: Fetch API in Node.js did not protect against CRLF injection in host headers (Medium)
CVE-2023-24807: Regular Expression Denial of Service in Headers in Node.js fetch API (Low)
CVE-2023-23920: Node.js insecure loading of ICU data through ICU_DATA environment variable (Low).
With the new action in N|Solid saved views, you can activate the tracing automatically when one or more processes cross over performance thresholds or match query parameters that you set.

N|Solid

N|Solid v4.9.2 Fermium ships with Node.js v14.21.3.

N|Solid v4.9.2 Gallium ships with Node.js v16.19.1.

N|Solid v4.9.2 Hydrogen ships with Node.js v18.14.1.

Node.js

The Node.js 14 Fermium LTS release line will continue to be supported until April 30, 2023.
The Node.js 16 Gallium LTS release line will continue to be supported until September 11, 2023.
The Node.js 18 Hydrogen LTS release line will continue to be supported until April 30, 2025.

Supported Operating Systems for N|Solid Runtime and N|Solid Console

Please note that The N|Solid Runtime is supported on the following operating systems:

Windows:

Windows 10
Microsoft Windows Server 1909 Core
Microsoft Windows Server 2012
Microsoft Windows Server 2008

macOS:
macOS 10.11 and newer

RPM based 64-bit Linux distributions (x86_64):

Amazon Linux AMI release 2015.09 and newer
RHEL7 / CentOS 7 and newer
Fedora 32 and newer

DEB based 64-bit Linux distributions (x86_64, arm64 and armhf):

Ubuntu 16.04 and newer
Debian 9 (stretch) and newer

Alpine
Alpine 3.3 and newer

Download the latest version of N|Solid

You can download the latest version of N|Solid via http://accounts.nodesource.com or visit https://downloads.nodesource.com/ directly.

New to N|Solid?

If you’ve never tried N|Solid, this is a great time to do so. N|Solid is a fully compatible Node.js runtime that has been enhanced to address the needs of the Enterprise. N|Solid provides meaningful insights into the runtime process and the underlying systems. Click ???? [HERE]

AIOps Observability: Going Beyond Traditional APM

Posted on by

AIOps is an emerging technology that applies machine learning and analytics techniques to IT operations. AIOps enables IT teams to leverage advanced algorithms to identify performance issues, predict outages, and optimize system performance. Nodesource sees significant advantages for developers and teams to increase software quality by leveraging AIOPS. We have extended our platform’s (N|Solid) observability capabilities to include AIOps, enabling developers to leverage advanced machine learning and analytics techniques to optimize their Node.js applications.

Our N|Solid platform provides the most advanced visibility into Node.js applications, enabling developers to quickly identify performance issues, detect security vulnerabilities, and troubleshoot errors. N|Solid achieves this level of observability through real-time performance monitoring, comprehensive metrics, and detailed instrumentation of Node.js applications.

Last year, we integrated OpenTelemetry into our runtime and were nearing the release of an extension of this layer into our console. This advancement will further extend our platform to support AIOps. Santiago Gimeno, a Senior Architect, sums up our vision of the integration with OTel (Open Telemetry) and N|Solid:

“In today’s world, where applications are becoming more complex and distributed, having a good observability solution is more important than ever. The emergence of OpenTelemetry as the de-facto standard for observability is key. It allows application developers to select solutions that adapt better to their needs. Even more, it allows for healthy competition between observability solution vendors. We support this approach and continue to take steps to ensure N|Solid stays compliant with the OpenTelemetry specification, so everyone can use what we believe is the best observability solution for Node.js.”

Key differences between an APM and Observability

APM (Application Performance Management) and observability are both methods of monitoring and managing the performance and health of software applications, but there are key differences between the two:

Scope: APM is focused on monitoring the performance of applications, while observability is a more comprehensive approach that includes monitoring the infrastructure and application stack, as well as the performance of individual services.

Metrics: APM typically relies on predefined metrics and thresholds to identify performance issues, while observability takes a more flexible approach to collect a wide range of data, including logs, metrics, and traces.

Root cause analysis: APM is designed to quickly identify the root cause of performance issues, often through alerting and automated remediation, while observability takes a more holistic approach that emphasizes the need to understand the relationships between different parts of the system to identify and fix issues.

Proactivity: APM is often reactive, focusing on identifying and fixing issues as they arise, while observability is more proactive, focusing on continuous monitoring and analysis to identify potential issues before they become critical.

Tooling: APM is often built around specific tools and technologies designed to monitor and analyze application performance, while observability is more flexible and adaptable, focusing on integrating a wide range of tools and technologies to provide a comprehensive system view.

You need to have both; they are important to monitoring and managing the performance and health of software applications.

This is why N|Solid is not only an APM but also has observability within its functionalities. And now, with the implementation of ML and SBOM, it goes beyond APM and supports the growing discipline of AIOps.

AIOps: Fundamental concept in Modern IT Operations

AIOps (Artificial Intelligence for IT operations) is an approach to IT operations that leverages machine learning and artificial intelligence to automate and optimize IT tasks. AIOps aims to enhance the efficiency and effectiveness of IT operations by leveraging the vast amount of data generated by various IT systems and applications.

Observability refers to IT teams’ ability to observe and understand the behavior of complex systems in real-time, using a combination of monitoring, logging, and analytics tools.

AIOps and observability enable IT teams to proactively monitor and manage IT systems, applications, and infrastructure, allowing them to identify and resolve issues quickly. AIops uses machine learning and AI algorithms to identify patterns in large amounts of data, while observability provides the visibility and context needed to understand the behavior of complex systems.

Modern Observability in Place

Support for open-source tracing tools and standards like OpenTelemetry facilitates team collaboration in resolving issues. Open Telemetry is the second most active CNCF project, behind only Kubernetes, showcasing its importance to the industry.

_Image Twitter Michael Haberman @hab_mic
_

Following this standard, N|Solid (since N|Solid 4.8.0) supports OTEL:
– Implements the OpenTelemetry TraceAPI, allowing users to use the de-facto standard API to instrument their code.
– It supports using many instrumentation modules available in the Open Telemetry ecosystem. It supports exporting traces using the Open Telemetry Protocol(OTLP) over HTTP.
– With this feature is now possible to send N|Solid runtime monitoring information (metrics and traces) to backends supporting the Open Telemetry standard like multiple APMS (Dynatrace, Datadog, Newrelic, etc.).

Additionally, we included OTEL in the ‘APM performance dashboard,’ an open-source tool we released to the community, enabling developers and organizations to understand the impact of APM tools’ performance.

_Img APM’s Performance Dashboard View
_

Recent enhancements to the tool include the following:

Updated the data with N|Solid 4.8.0 -> 16.16.0 and 14.20.0
Added a few new tests: especially with different solutions for graphql.
Added more APMs: opentelemetry, AppDynamics

Added testing of N|Solid against Datadog, Dynatrace, and NewRelic.

Do you want to implement OTel in your Node.js application? ????

Enriching telemetry data with metadata is an important aspect of observability, and OpenTelemetry provides a flexible and extensible framework for doing so. However, there can be challenges in implementing this in practice, especially when dealing with multiple tools and technologies.

One approach to addressing this challenge is to use a centralized configuration management tool to ensure consistency in metadata enrichment across your observability stack. Please review the following articles to give you an accurate guide to implementing Opentelemetry in your project.

Enhance Observability with Opentelemetry tracing – Part 1

Instrument your Nodejs Applications with Open Source Tools – Part 2

However, if you want this implementation out of the box and have other useful features, we invite you to try N|Solid.

Conclusion

N|Solid Supports OpenTelemetry Features, Integrates SBOM and ML at its Core.

By supporting OpenTelemetry features, N|Solid provides seamless integration with this framework, enabling customers to understand their applications, infrastructure behavior, and performance. This integration enhances the ability of developers and operators to troubleshoot issues, identify bottlenecks, and optimize application performance.

N|Solid’s integration of Software Bill of Materials (SBOM) provides a comprehensive list of all software components used in an application, including open-source libraries and dependencies, which helps organizations to mitigate security risks and ensure compliance with regulations. By integrating SBOM at its core, N|Solid provides organizations with an efficient and reliable way to manage the security and compliance of their software applications.

Finally, N|Solid’s integration of machine learning (ML) at its core is another critical feature that helps to identify patterns and anomalies in data, allowing developers and operators to gain insights that are not easily detectable using traditional monitoring tools. This integration of ML at the core of N|Solid enables organizations to improve the overall reliability, performance, and security of their applications and services.

N|Solid’s support of OpenTelemetry features, integration of SBOM, and integration of ML at its core provides developers and operators with a comprehensive set of tools to manage and optimize their applications and infrastructure, making N|Solid a valuable platform in the modern software development and operations landscape.

Ready to connect?

If you want to know more about our APM’S Benchmark project and get the most out of your Node.js application, read this incredible article by our VP of engineering, Adrián Estrada, ‘In-depth analysis of the APMs performance cost in Node.js.‘

We also invite you to ????️ Use the ✨APM’s Performance Dashboard✨here:
???? Read the full blog post here: https://nsrc.io/4xFaster
???? Contribute here: https://github.com/nodesource/node-APMs-benchmark
If you have any questions, please contact us at [email protected] or through this form.

Experience the Benefits of N|Solid’s Integrated Features
Sign up for a Free Trial Today

To get the best out of Node.js and experience the benefits of its integrated features, including OpenTelemetry support, SBOM integration, and machine learning capabilities. Sign up for a free trial and see how N|Solid can help you achieve your development and operations goals. #KnowyourNode

JavaScript sans build systems?

Posted on by

#​626 — February 17, 2023

Read on the Web

JavaScript Weekly

Writing JavaScript Without a Build System — Using a variety of build tools for things like bundling and transpiling is reasonably standard in modern JavaScript development, but what if you want to keep things simple? For simple things, it’s not necessary, says Julia. This led to a lot of discussion on Hacker News.

Julia Evans

Ryan Dahl, Node.js Creator, Wants to Rebuild the Runtime of the Web — A neat bit of journalism about the alternative JavaScript runtime Deno and what Ryan Dahl is trying to achieve with it and how Ryan handled the stress of being known as the creator of Node.js.

Harry Spitzer / Sequoia

Broadcasting a Live Stream With Nothing but JavaScript — Live streams typically use third-party software to broadcast, but with Amazon Interactive Video Service, you can build a powerful, interactive broadcasting interface with the Web Broadcast SDK and JavaScript. Click here to learn more.

Amazon Web Services (AWS) sponsor

core-js’s Maintainer Complains Open Source Is ‘Broken’ — core-js is a popular universal polyfill for JavaScript features and its author has run into his fair share of bad luck which has culminated in this lengthy post on the state of the project, his issues in securing an income and, well, the downsides to living in Russia. The Register has tried to balance out the story.

The Register

IN BRIEF:

🐒 The just released Firefox 110 for Android now supports Tampermonkey, an extension for running JavaScript ‘userscripts’ on sites you visit.

The Angular project is taking steps to revamp its reactivity model to enable fine-grained change detection via signals.

The latest beta of iOS and iPadOS 16.4 supports the Web Push API for home screen webapps.

🐦 A fun Twitter thread where Qwik’s Miško Hevery attempted to demonstrate why a = 0-x is about 3-10x faster than a = -x before being told about a flaw in his benchmark. There is still a performance difference, though.

▶️ The React.js documentary we mentioned last week has now been released and it’s a heck of a watch – you’ll need 78 minutes of your time though.

RELEASES:

Node.js 19.6.1, 18.14.1, 16.19.1 and 14.21.3.

JavaScript Obfuscator 4.0 – Code scrambler.

Shoelace 2.1
↳ Framework agnostic Web components.

Mermaid 9.4
↳ Text to diagram generator. Now with timeline diagram support.

Cypress 12.6

📒 Articles & Tutorials

Use a MutationObserver to Handle DOM Nodes that Don’t Exist Yet — Comparing the effectiveness of the MutationObserver API with the conventional method of constantly checking for the creation of nodes.

Alex MacArthur

Well-Known Symbols in JavaScript — Hemanth, a TC39 delegate, shows off 14 symbols and where they can come in useful.

Hemanth HM

🚀 Monitor and Optimize Website Speed to Rank Higher in Google — Monitor Google’s Core Web Vitals and optimize performance using in-depth reports built for developers. Improve SEO & UX.

DebugBear sponsor

Why to Use Maps More and Objects Less — A journey down a performance rabbit hole.

Steve Sewell

Adopting React in the Early Days — A personal history lesson providing context around React’s evolution. While React might be an obvious, even safe, choice now, that wasn’t always true.

Sébastien Lorber

An Animated Flythrough with Theatre.js and React Three Fiber — How to fly through a 3D scene using the Theatre.js JavaScript animation library and the React Three Fiber 3D renderer. This is the sort of thing that used to be Very Difficult™ but is now relatively trivial.

Andrew Prifer (Codrops)

How to Change the Tab Bar Color Dynamically with JavaScript

Amit Merchant

Is Deno Ready for Primetime? One Dev’s Opinion

Max Countryman

Using Playwright to Monitor Third-Party Resources That Could Impact User Experience

Stefan Judis

🛠 Code & Tools

Dependency Cruiser: Validate and Visualize JavaScript Dependencies — If you want a look at the output, there’s a whole page of graphs for popular, real world projects including Chalk, Yarn, and React.

Sander Verweij

Devalue: Like JSON.stringify, But.. — “Gets the job done when JSON.stringify can’t.” Namely, it can handle cyclical and repeated references, regular expressions, Map and Set, custom types, and more.

Rich Harris

🧡 JavaScript Scratchpad for VS Code (2m+ Downloads) — Get Quokka.js ‘Community’ for free: #1 tool for exploring/testing JavaScript with edit-continue experience to see realtime execution and runtime values.

Wallaby.js sponsor

NodeGUI: Build Native Cross-Platform Desktop Apps with Node.js — Unlike Electron which leans upon webviews and HTML, NodeGui uses a Qt based approach. This week’s 0.58.0 release is the first stable release based on Qt 6 and offering high DPI support.

NodeGui

DOMPurify 3.0: Fast, Tolerant XSS Sanitizer for HTML and SVG — A project that’s nine years old today but still actively developed. Supports all modern browsers (IE support was only just dropped) and is heavily tested. There’s a live demo here.

Cure53

Pythagora: Generate Express Integration Tests by Recording Activity — This is a neat idea still in its early stages. Add a line of code after setting up an Express.js app and this will capture app usage and generate integration tests based on the interactions. (▶️ Screencast demo.)

zvone187 and LeonOstrez

Try Stream’s Free Trial of SDKs for In-App Chat

Stream sponsor

grep.app: Search Code Across a Half Million GitHub Repos — A code search engine that lets you use regexes or syntax in your search. Considering what it is, it’s pretty fast and has an extensive index (over half a million public repos from GitHub, allegedly).

grep.app

tsParticles: Particles, Confetti and Fireworks for Your Pages — Create customizable particle related effects for use on the Web. Uses the regular 2D canvas for broad support.

Matteo Bruni

💻 Jobs

Software Engineer — Join our happy team. Stimulus is a social platform started by Sticker Mule to show what’s possible if your mission is to increase human happiness.

Stimulus

Find JavaScript Jobs with Hired — Hired makes job hunting easy-instead of chasing recruiters, companies approach you with salary details up front. Create a free profile now.

Hired

QUICK RELEASES:

Minimatch 6.2
↳ Glob matcher library, as used in npm.
    minimatch(“bar.foo”, “*.foo”)

React Accordion 1.2
↳ Unstyled WAI-ARIA-compliant accordion library.

ScrollTrigger 1.0.6
↳ Have your page react to scroll changes.

VeeValidate 4.7.4
↳ Popular Vue.js form library

Express Admin 2.0
↳ Admin interface for data in MySQL/Postgres/SQLite.

Execa 7.0
↳ Improved process execution from Node.js.

React Tooltip 5.8

Bringing JavaScript to WebAssembly

Posted on by

#​625 — February 10, 2023

Read on the Web

It looked quiet at first but wow, what an epic week this turned out to be. There’s a lot to chew on here, and we even have a variety of bonus items at the very end of this issue. Enjoy!
__
Your editor, Peter Cooper

JavaScript Weekly

Speeding Up the JS Ecosystem: It’s ESLint’s Turn — Last year we featured an article from the same author about how he was finding, and fixing, low-hanging performance fruit in popular JavaScript projects. He’s back, and he’s found a lot of potential for savings in ESLint this time.

Marvin Hagemeister

The Future (and the Past) of the Web is Server Side Rendering — It’s fair to say the Deno folks have some skin in this game, but nonetheless this is a neat brief history of server-side rendering and why they feel it’s the right approach for modern web development.

Andy Jiang (Deno)

Monitoring Your NestJS Application with AppSignal — With AppSignal, you can monitor your NestJS app with ease and rely on OpenTelemetry to handle third-party instrumentations. AppSignal even provides helper functions to help you build comprehensive custom instrumentation. A box of 🍪 included!

AppSignal sponsor

Ten Web Development Trends in 2023 — Following the State of JS survey results Robin takes a considered look at new web dev trends that we should be paying attention to this year, and why they matter.

Robin Wieruch

Bringing JavaScript to WebAssembly for Shopify Functions — As much as this is focused on a specific use case at Shopify, this is a fascinating look at how they’re integrating JavaScript and WebAssembly under tight constraints. They also talk about Javy, a JS to WebAssembly toolchain being built at Shopify that lets you run JS code on a WASM-embedded JS runtime.

Surma (Shopify)

Google Touts Web-Based Machine Learning with TensorFlow.js

Richard MacManus (The New Stack)

IN BRIEF:

🎉 Time to celebrate — a recent survey allegedly found that JavaScript applications ‘have fewer flaws’ than Java and .NET ones. So there you go.

Honeypot’s highly anticipated ▶️ React.js documentary drops later today – it’ll probably be out by the time you read this.

Vanilla List is a directory of ‘vanilla’ JavaScript controls and plugins.

▶️ Evan You tells us what to expect in 2023 from Vue.js.

The Scala.js project is celebrating its ten year anniversary – it’s now a mature way to build Web projects using Scala, if you prefer.

📅 Vue.js Live is a JavaScript event taking place both in London and online on May 12 & 15. From the same folks as the also forthcoming JSNation conference.

A history of criticisms levelled at React.

RELEASES:

Eleventy / 11ty 2.0
↳ Popular Node.js static site generator.

pnpm 7.27 – The efficient package manager.

RxDB 14.0 – Offline-first, reactive database.

📒 Articles & Tutorials

Design Patterns in TypeScript — OO-inspired patterns aren’t for everyone or every use case, but this is a fantastic catalog of examples, complete with diagrams and explanations, if you need to learn to tell apart factory methods from decorators, facades, or proxies.

Refactoring Guru

Resumable React: How To Use React Inside Qwik — Building React apps without ever loading React in the user’s browser? “Sounds too good to be true? Let’s see how this works.”

Yoav Ganbar

Did You Know That You’re Already a Distributed Systems Developer?

Temporal Technologies sponsor

Build a Hacker News Client using Alpine.js — Alpine.js is a thin and elegant reactivity library that lets you add dynamic functionality to your site directly in markup. This is a short and sweet practical example of what you can quickly do with it.

Salai Vedha Viradhan

▶  TypeScript Speedrun: A Crash Course for Beginners — If you want to pick up TypeScript and would find a video guide useful, this is for you. Matt has become well known recently for his educational TypeScript tweets and videos, and this is another good one that flies through the basics. (23 minutes.)

Matt Pocock

Using Notion as a Headless CMS with Nuxt

Trent Brew

The Options API vs Composition API in Vue.js

Charles Allotey

🛠 Code & Tools

Bookmarklet Editor: Easily Work on JavaScript Bookmarklets — Useful because who can remember the exact syntax for a bookmarklet? 🤔 This also can instantly convert code to and from bookmarklet form and includes some examples in the help section (click the big ? to get all the details).

Marek Gibney

Breakpoints and console.log Is the Past, Time Travel Is the Future — 15x faster JavaScript debugging than with breakpoints and console.log, now with support for Vitest.

Wallaby.js sponsor

Yup 1.0: Super Simple Object Schema Validation — Define a schema, transform a value to match, assert the shape of an existing value, or both. Very extensive docs here.

Jason Quense

Material React Table: A Full-Featured React Table Component — Built upon Material UI 5 and TanStack Table 8. The docs include lots of interactive examples.

Kevin Van Cott

BlockNote: Notion-Style Block-Based Text Editor — Built on top of Prosemirror and Tiptap, this is for you if you like the way the Notion note-taking service’s text editor feels. There’s a live demo.

Yousef

TresJS: Build 3D Experiences with Vue.js — Create 3D scenes with Vue components and Three.js. Think React-three-fiber but Vue flavored.

Alvaro Sabu

depngn: Find Out if Dependencies Support a Given Node.js Version — A CLI tool that establishes whether or not the dependencies in your package.json will work against a specified version of Node.

OmbuLabs

Open-Source JS Form Libraries to Automate Your Form Workflow — Self-host SurveyJS to configure and modify multiple forms, convert them to fillable PDF files, and analyze collected data in interactive dashboards.

SurveyJS sponsor

Lawnmower: Build VR Scenes with Custom HTML Tags — A web component library that leans on Three.js and aims “to make building a basic VR website as easy to make as your first HTML site”.

Gareth Marland

Electron 23.0 Released — The popular cross platform JavaScript, HTML + CSS desktop app framework gets bumped up to Node 18.12.1, Chromium 110, and V8 11.0. Windows 7/8/8.1 support has also been dropped, so we might start to see those versions of Windows lose the support of a lot of Electron based apps soon.

Electron Core Team

Run: Run User-Provided Code in a Web Worker

SLASHD Analytics

💻 Jobs

Software Engineer (Backend) — Join our “kick ass” team. Our software team operates from 17 countries and we’re always looking for more exceptional engineers.

Sticker Mule

Find JavaScript Jobs with Hired — Hired makes job hunting easy-instead of chasing recruiters, companies approach you with salary details up front. Create a free profile now.

Hired

QUICK RELEASES:

vue-easytable 2.23
↳ A data table/grid control for Vue.js. (Demo.)

React-Custom-Scroll 5.0
↳ Customize the browser scroll bar. (Demo.)

react-jsonschema-form 5.1
↳ Component to build Web forms from JSON Schema.

AlaSQL.js 3.1
↳ JavaScript-based SQL database.

jest-puppeteer 7.0
↳ Run tests using Jest & Puppeteer.

MDX 2.3
↳ Markdown for the component era.

🎁 The Bonus Round

✈️ Watching someone wrestle with Python and JavaScript to fly (virtual) planes with Microsoft Flight Simulator tickled me a lot.

A beautiful WebGL2-based fluid simulation. It’s even happy on mobile. Pretty!

Go-like channels in 10 lines of JavaTypeScript..?

🐦 Misko Hevery: “useSignal() is the future of web frameworks and is a better abstraction than useState(), which is showing its age.” (source)

Mike Pennisi asks: when is an object property not a property?

Do you use Postgres at all? Check out Postgres Weekly – one of our sister newsletters. So much is going on in the Postgres space lately and it’s a great way to keep up.

SBOM: The Essential Building Block for Cybersecurity

Posted on by

Software Bill of Materials (SBOMs) is how companies provide a comprehensive inventory of all the components, libraries, and dependencies used in a software system. This information helps organizations identify potential vulnerabilities and manage the risk of software supply chain attacks.

SBOM is a detailed list of all the components, libraries, and dependencies that make up a software system. It includes information such as the names and versions of the components, their sources, and any associated risks or vulnerabilities.

Just as a supply chain document in manufacturing and product development outlines the origin and journey of raw materials and components, a software bill of materials (SBOM) does the same for software components.

SBOM Adoption via Executive Order from the EEUU

On May 12, 2021, President Joe Biden released the Executive Order (EO) on Improving the Nation’s Cybersecurity with a specific requirement for SBOMs. Read here the executive order.

SBOM includes information on their origin, version, and security risk. Just as manufacturers rely on supply chain documentation to ensure the quality and safety of their products, organizations can use SBOMs to manage software supply chain risks and ensure the security and compliance of their software systems. In both cases, having accurate and up-to-date information is critical to making informed decisions and avoiding potential harm.

Since December 2022, in its v4.9.0, N|Solid has SBOM support (Software Bill of Materials).

N|Solid has added support for SBOM reporting in all applications connected to the N|Solid console; the report is offered in two formats: JSON and PDF; it contains the information for the dependency inventory of a specific application; it includes valuable information like licensing and the security status for each dependency used.

Start using SBOM in all applications connected to the N|Solid console START NOW

The role of SBOM:

The Linux Foundation released the results of a survey: The State of Software Bill of Materials (SBOM) and Cybersecurity Readiness, carried out within the framework of the US presidential order on SBOM, where 412 organizations worldwide participated in a survey. Here is the infographic with the highlights.

With the ever-increasing use of third-party components in software development, having an accurate and up-to-date SBOM is essential for ensuring the security and integrity of a company’s software systems; an organization can use SBOMs for many purposes. Some of them are:

Allow organizations visibility and control over their software supply chain, enabling them to make informed decisions about software security, compliance, and licensing.

Companies can proactively manage software risk, improve their cybersecurity posture, and protect their customers and critical data.

Comply with industry standards and regulations. This refers to the process of ensuring that an organization is using software in accordance with its license agreements. This includes ensuring that the software is being used within the terms of the license agreement and that the organization uses only the licenses it has purchased.

Compliance and customer Audit. Ensure that it meets the specified quality criteria. This may include testing, inspections, and reviews to identify any issues or defects and make sure that the product or service meets the customer’s requirements and the high standards of quality that the industry expects.

Despite the clear benefits of SBOMs, the use of SBOMs has traditionally been limited to more than just the largest and most advanced organizations. However, the increasing threat of software supply chain attacks and the growing recognition of the importance of SBOMs are expected to drive the widespread adoption of SBOMs in the near future.

The United States Executive Order on the Nation’s Cybersecurity outlines new requirements for SBOMs and other security measures for software used by federal agencies. This order highlights the importance of SBOMs in ensuring the security of software systems and demonstrates the growing recognition of their value in the industry.

Implementing SBOM in Your Organization

Companies are increasingly aware of their risks by needing to be clearer about their technologies, especially in the open-source ecosystem. according to the Linux Foundation survey, what are the key activities for securing the software supply chain? These answers serve as a basis for understanding the importance of this concept in the ecosystem.

Understanding the process of implementing an SBOM in your organization, from assessing your current software landscape to integrating the SBOM with your existing security and compliance tools, will help you to effectively manage software supply chain risks and ensure the security and compliance of your software systems.

Assessment: The first step is to assess the organization’s current software landscape and identify which software systems and components need to be included in the SBOM.

Inventory: Once the software systems and components have been identified, the next step is to create an inventory of all the components and their attributes, such as name, version, source, and any associated risks or vulnerabilities.

Automation: To ensure the SBOM is accurate and up-to-date, consider automating the SBOM creation process through tools or scripts that can extract information from source code and dependencies.

Integration: The SBOM should be integrated with the organization’s existing security and compliance tools, such as security assessment and license compliance tools, to ensure that the information contained in the SBOM can be effectively utilized.

Monitoring: Regular monitoring of the SBOM should be implemented to ensure that it remains up-to-date and that any changes or updates to software components are accurately reflected in the SBOM.

Review: The SBOM should be regularly reviewed to identify potential security risks or vulnerabilities and ensure compliance with industry standards and regulations.

Training: Finally, provide training to all relevant personnel, including developers and security teams, to ensure that the SBOM is being used effectively and that everyone understands the importance of keeping the SBOM up-to-date.

By following this path, organizations can effectively implement an SBOM and use it to manage software supply chain risks, improve their overall cybersecurity posture, and ensure compliance with industry standards and regulations.

Securing Your Software Supply Chain with N|Solid

N|Solid is a runtime, and a console for managing Node.js applications, providing a secure and reliable runtime environment for Node.js applications developed and distributed by NodeSource. N|Solid includes a range of features to help organizations, including security and performance monitoring, real-time visibility into applications, and the ability to identify and resolve issues quickly.

N|Solid Console has a dedicated section for __NodeSource Certified Modules__. (NCM) are a set of open-source npm packages vetted and certified by NodeSource, a company specializing in Node.js solutions. The certification process involves thorough security, quality, and compatibility testing to ensure that these modules meet high standards for security and performance.

By using NodeSource Certified Modules, organizations can be confident that they are using high-quality, secure, and reliable components in their Node.js applications. In addition, NodeSource provides ongoing maintenance and support for these modules, ensuring that they continue to work effectively and securely over time. By using NodeSource Certified Modules, organizations can simplify the process of selecting and using npm packages in their Node.js applications, helping to ensure that their applications are secure, reliable, and performing optimally for their users.

_NCM enables you to quickly and easily generate SBOMs that:
_

Identify all open-source libraries.
Track and document each component, including direct and transitive dependencies.
Update automatically when components change.
Identify vulnerabilities.
Provide a path to remediation that ensures updates are backward compatible and won’t break the build.

Illustrative Example of Software Life Cycle and Bill of Materials Assembly Line

According to the SBOM document, to stay compliant, the data fields that must be in an SBOM are:

Component name
Component version
Unique identifier for the software
Relationship with other dependencies
Developer name
Name of tool used to create the SBOM document
Document creation date and time

N|Solid complies with the National Institute of Standards and Technology (NIST) laying out the guidelines for an SBOM document.

Conclusion:

SBOMs are an important tool in the fight against software supply chain attacks. Organizations can better track and manage their software components and identify potential risks by incorporating them into the software development process. In addition, SBOMs provide valuable insights into the supply chain history of a product, helping to ensure that all components are sourced from reputable and trustworthy sources.

As a company, ensuring the security of the code and systems you use and create is important. That’s why it is truly important:

To ensure the security of open-source components in your supply chain, it is crucial to track their licenses, vulnerabilities, and associated risks.
To avoid coding security defects and weaknesses, it is important to know common attack methods such as buffer overflows, SQL injection, and cross-site scripting. Vulnerabilities can be difficult to identify, as someone often plants malicious code with in-depth knowledge of the system.
To secure your development and delivery infrastructure, it is recommended to conduct a binary analysis of the container images to inspect component signatures and identify any open-source components and sensitive data present.
To ensure the security of APIs and protocols used for communication with other systems, a lack of visibility and control can put critical systems and sensitive information at risk.

However, implementing SBOMs effectively can be a complex and time-consuming process, and organizations need to choose the right tools and processes to ensure the accuracy and relevance of their SBOMs. We are sure that N|Solid can help! 💪

If you are interested in more information about the supply chain and its associated risks, please contact us at [email protected] or on Twitter @nodesource.
To get the best out of Node.js, try N|Solid SaaS #KnowYourNode

Ways to remove event listeners

Posted on by

#​624 — February 3, 2023

Read on the Web

JavaScript Weekly

You’ve Got Options for Removing Event Listeners — Unnecessary event listeners can cause all sorts of odd problems so it’s good to clean them up when you don’t need them anymore. How? There are several approaches and Alex looks at their pros and cons. (once is a good one to consider if your use case supports it as it’s ‘set and forget.’)

Alex MacArthur

Updates from the 94th TC39 meeting — The TC39 committee that works on the ECMAScript standard met last week and progressed a few language proposals with Change Array by Copy, Intl.NumberFormat v3 and Symbols as WeakMap Keys making it to stage 4. There’s also an interesting example of a downgrade to stage 2 for import assertions.

Hemanth HM

Fast and Flexible Gantt Chart Components for Your Web App — Bryntum’s suite of web components includes powerful Gantt and resource scheduling widgets used by thousands of businesses. The API is very flexible and allows you to configure everything from colors to details of the scheduling logic. Free 45-day trial.

Bryntum sponsor

Netlify Acquires Gatsby — The company behind the Gatsby React-based framework is joining Netlify with many Gatsby Cloud features expected to be integrated into Netlify’s own platform. This places Netlify more directly against Vercel who are behind Next.js (and don’t forget Shopify with Remix too).

Kyle Mathews (Gatsby)

You May Not Need Lodash or Underscore — Inspired by the popular You Might Not Need jQuery, this extensive document provides plain JavaScript alternatives to almost 100 different functions you’d find in popular utility libraries like Lodash and Underscore.

You Don’t Need

The Future of Create React App and Why It Exists — An extensive write up from Dan Abramov on the state of Create React App, a route to take it forwards, and how he sees React as a library working within an ecosystem of frameworks.

Dan Abramov

RELEASES:

Node.js v19.6.0 (Current)

Node.js v18.14.0 (LTS)

Electron 22

TestCafe 2.3
↳ End-to-end Web testing.

Docusaurus 2.3
↳ Popular documentation site generator.

Jotai 2.0

📒 Articles & Tutorials

How To Lose Functional Programming at Work — An amusing piece you might recognize parts of. It’s certainly possible to have too much of a good thing. “If you’re looking to lose functional programming at work, here are a bunch of mistakes I’ve made on JS-heavy web teams over the years that can help you do the same.”

Robert Pearce

How Node & SWC Can Make a Lightning Fast TypeScript Runtime — If the added compilation time for TypeScript has irritated you so far, Artem has found a way to get things as fast as possible.

Artem Avetisyan

▶  Tailwind CSS, Headless UI, and Powerlifting with Adam Wathan — We talk to Adam about what motivated him to create Tailwind and why it is creating polarizing discourse among developers.

Whiskey Web and Whatnot sponsorpodcast

The Road from Ember Classic to Glimmer Components — If you’ve got a mature Ember.js project you want to modernize, this is for you.

Ignace Maes

Using JavaScript in a Swift App — One for iOS app developers. It’s not perfect but at least it’s an option.

Douglas Hill

Cleaner Unit Tests with Custom Matchers — Using custom matchers to avoid repetitive and ambiguous assertions in Jest.

Jamie King (American Express)

The Yaml Document from Hell: JS Edition — The titular problematic document was spawned in this blog post focusing on Python, but Phil looks to see if JS YAML parsers have the same problems with the much maligned format.

Phil Nash

Too Much Tech Debt and Outdated Packages? Don’t Have Time to Upgrade?

UpgradeJS by OmbuLabs sponsor

On Using Playwright in GitHub Actions

Radosław Miernik

How I Made My App 2.4x Faster Switching to Svelte

Flotes Tech Blog

🛠 Code & Tools

FeedbackPlus: Add Screenshot Tools to Your Feedback Forms — Say you’ve got a form on your app to let users submit bugs or feedback and you’d like to encourage them to send a screenshot too – this makes it easier to do. Live demo.

ColonelParrot

▶  ScrollyVideo.js: Responsive ‘Scrollable’ Videos — It’s an interesting effect and well demonstrated here. Compatible with React, Svelte, Vue, or just plain ole’ HTML.

Daniel Kao

Stop Sweating Over Supply Chain Security with Snyk — Get the security practices and tooling to bolster your build pipeline from Snyk’s article on npm security and preventing supply chain attacks.

Snyk sponsor

depngn: Find Out if Dependencies Support a Given Node Version — A CLI tool that establishes whether dependencies in your package.json will work against a specified Node version. May be helpful during upgrades.

OmbuLabs

Eta 2.0: Embedded JS Template Engine for Node, Deno, and Browser — Boasts being lighter and faster than EJS but with many of the same features (it looks a lot like Ruby’s ERB). GitHub repo.

Ben Gubler

Swiper 9.0: Mobile Touch Slider with Accelerated Transitions — Tree shakable, library agnostic, and focused entirely on modern browsers and web APIs. RTL support too. GitHub repo.

Vladimir Kharlampidi

UUID.js: RFC-Compliant UUID Generator — Supports v1 and v4 UUIDs.

LiosK

ReScript 10.1
↳ OCaml-inspired compile-to-JS language.

OrgChart 3.4
↳ Render org charts. (Lots of demos.)

clipboard-polyfill 4.0
↳ ‘Copy to clipboard’ for older browsers and edge cases.

morphdom 2.7
↳ DOM diffing/patching – no VDOM needed.

relative-time-element 4.2
↳ GitHub’s extensions for <time>

js-bson 5.0
↳ Binary JSON parser and serialization.

React Date Picker 4.10
↳ Simple date picker React component.

JustValidate 4.1
↳ Lightweight form validation library.

💻 Jobs

Platform Engineer – Dev Ops — Come help Qwire modernize how studios, composers, artists, publishers, labels, and the rest of the industry manage music rights.

Qwire

Find JavaScript Jobs with Hired — Hired makes job hunting easy-instead of chasing recruiters, companies approach you with salary details up front. Create a free profile now.

Hired

🎁 Last But Not Least

Madge 6.0: Create Graphs From Your Module Dependencies — A developer tool for generating a visual graph of your module dependencies (works with CommonJS, AMD and ES modules), finding circular dependencies, and discovering other useful info.

Patrik Henningsson