JSer.info #652 - Node.jsのnode:vmモジュールはSandbox(信用できないコードの実行環境)としては利用できませんが、vm2はnode:vmをラップしてSandboxを提供するモジュールでした。 今回、vm2の仕組み的に修正できないSandboxに関する脆弱性が発見されたため、メンテナンスを終了することが宣言されています。脆弱性の詳細はまだ公開されていませんが、Sandboxを破ることができる脆弱性で、PoCは8月ごろに公開される予定です。 Discontinued · Issue #533 · patriksimek/vm2 vm2 Sandbox Escape vulnerability · CVE-2023-37466 · GitHub Advisory Database Sandbox機能が欲しい場合は、QuickJSをWebAssemblyにコンパイ
はじめに 駆け出して約１ヶ月ほどのひよこエンジニアです。 Vercel の以下のアナウンスを受けて、社内のフロントエンド開発で利用している Node.js を v14 から v18 にアップデートしましたので、そのときにやったことやハマったことを簡単にまとめていきます。 方針 そもそも Node.js をアップデートするときに同時に考慮すべき問題としては、OS 起因の問題や Node.js Runtime 由来の問題など様々あります。 が、だいたいは 「プロジェクトで利用しているライブラリの問題」 にぶつかることが多いです。（以下記事など参照。また今回担当しているプロジェクトでは Docker イメージを用いていたため OS 起因の問題などは起こり得ない。） そのため、基本的には 「依存ライブラリの更新」 をメインで進めていくことにしました。 ただとはいえ 「とりあえずyarn upgra
Notable Changes Ada 2.0 Node.js v18.17.0 comes with the latest version of the URL parser, Ada. This update brings significant performance improvements to URL parsing, including enhancements to the url.domainToASCII and url.domainToUnicode functions in node:url. Ada 2.0 has been integrated into the Node.js codebase, ensuring that all parts of the application can benefit from the improved performanc
We’re excited to share the 5.0.0 release today 🎉 Prisma 5.0.0 contains a lot of changes that improve Prisma’s performance, especially in serverless environments. If you want to learn more about the performance improvements, we wrote a blog post that sums up all the changes we made: Prisma 5: Faster by Default. As this is a major release, it includes a few breaking changes that might affect a smal
npm, yarn and pnpm are now supported natively in WebContainers The road to innovation is a long and winding one and includes constant improvements and reiterations. This is very much the story of WebContainers as well. Our team reimagined and redesigned its building blocks multiple times to ensure their utmost speed and safety. In this spirit, we have been working tirelessly the past year on shipp
Notable Changes Mock Timers The new feature allows developers to write more reliable and predictable tests for time-dependent functionality. It includes MockTimers with the ability to mock setTimeout, setInterval from globals, node:timers, and node:timers/promises. The feature provides a simple API to advance time, enable specific timers, and release all timers. import assert from 'node:assert'; i
Secretlint v7でCommonJS からES Modulesへの移行を行いました。 Secretlint v7.0.0をリリースしました。Pure ESMへの書き直し この記事では、CommonJS(CJS)からES Modules(ESM)への移行を行った経緯と、移行する方法について紹介します。 CJSからESMへの移行は、率直に言えば単調な作業で、メリットが見えにくい作業です。 しかし、将来的にCJSよりもESMが主流になることは間違いないので、移行することは必要です。 移行の作業は、移行方法が決まれば大部分は機械的な書き換えが可能です。 では、実際にどうやって移行したのかを紹介します。 ESMへの移行の影響は依存元へと連鎖する Secretlintのリポジトリはmonorepoになっていて、だいたい40コぐらいのパッケージが含まれています。 そしてパッケージ間で依存関係があ
IntroductionIn this article I describe a simple architecture for an early stage SAAS. As a solo founder, I report some choices made to launch Feelback, a small-scale SAAS for collecting users signals about any content. This article will cover the technical side of designing and running a simple SAAS. It will also include some details about coding and evolving the initial feature set ready at launc
What's Changed BREAKING CHANGES Dropped support for Node 10 and 12. (Note: cross-fetch will likely continue working on those versions, but specs tests are not running on those Node versions and no support will be provided if issues come up.) Please check implementation conflicts in the Fetch API tests. FEATURES Added support for Node 18 and 20. Added support for Service and Cloudflare Workers (Fix
JavaScript, the undisputed king of web development, is being sabotaged — not by a rival language or a revolutionary new technology, but by its own baggage from the past. This insidious saboteur is none other than CommonJS, the antique module system that we’ve tolerated for far too long. The rise of CommonJS About 15 years after its invention, JavaScript started expanding beyond the browser to the
Commercial support for versions past the Maintenance LTS phase is available through our OpenJS Ecosystem Sustainability Program partner HeroDevs (Update 20-June-2023) Security releases available Updates are now available for all supported Node.js release lines for the following issues. OpenSSL Security updates This security release includes the following OpenSSL security updates OpenSSL security a
v10.0.0 (2023-06-15) Article: https://trilon.io/blog/nestjs-10-is-now-available Migration guide: https://docs.nestjs.com/migration-guide ⚠️ Node v12 is no longer supported (>= v16 is required). Bug fixes core #11785 fix(core): apply middleware to versioned controllers (ctrl-level) (@kamilmysliwiec) #11650 fix(core): global prefix exclude when versioning is turned on (@kamilmysliwiec) platform-fast
Notable Changes [bfcb3d1d9a] - deps: upgrade to libuv 1.45.0, including significant performance improvements to file system operations on Linux (Santiago Gimeno) #48078 [5094d1b292] - doc: add Ruy Adorno to list of TSC members (Michael Dawson) #48172 [2f5dbca690] - doc: mark Node.js 14 as End-of-Life (Richard Lau) #48023 [b1828b325e] - (SEMVER-MINOR) lib: implement AbortSignal.any() (Chemi Atlow)
The year is 2023 and we’ve released Node.js v20. It’s a significant accomplishment, and this article aims to use scientific numbers to assess the state of Node.js’ performance. All the benchmark results contain a reproducible example and hardware details. To reduce the noise for regular readers, the reproducible steps will be collapsed at the beginning of all sections. This article aims to provide
Notable Changes [c092df9094] - doc: add ovflowd to collaborators (Claudio Wunder) #47844 [4197a9a5a0] - (SEMVER-MINOR) http: prevent writing to the body when not allowed by HTTP spec (Gerrard Lindsay) #47732 [c4596b9ce7] - (SEMVER-MINOR) sea: add option to disable the experimental SEA warning (Darshan Sen) #47588 [17befe008c] - (SEMVER-MINOR) test_runner: add skip, todo, and only shorthands to tes
To keep dependency-cruiser future proof (and sweeter to use) it was necessary to make some breaking changes in v13. Most of the breaking changes impact only the API/ library. We've worked hard to avoid it, but some affect the CLI as well. Summary Improvements Support for ESM in dependency-cruiser, babel and webpack configurations No need to pass --config anymore dot reporters: dynamic dependencies
リリース、障害情報などのサービスのお知らせ
最新の人気エントリーの配信
j次のブックマーク
k前のブックマーク
lあとで読む
eコメント一覧を開く
oページを開く
