Node.js

Since Node.js v20.6 instead of using the popular dotenv package to read your .env file and make its values available under process.env, you can now pass --env-file .env to node to achieve the same, without a dependency.

Find out more...

Here is an example of the changes needed to upgrade:

config.ts

package.json

Tipp: If you deploy your app as a Docker container, don't forget to add .env to your .dockerignore file, as typically you will explicitly set your environment variables in your deployment and don't want your .env file to interfere with that.

I’ve been intrigued by FxTS and radash lately

Very happy that with the new --experimental-default-type module in Node.js v21 I can write my little helper commands, that I run directly in the terminal using --eval/-e, in ESM syntax now. E.g. to generate a hex JWT secret:

node --experimental-default-type module -e "import crypto from 'node:crypto'; console.log(crypto.randomBytes(32).toString('hex'));"

Find out more...

Key bit:

POLY1305 MAC implementation corrupts XMM registers on Windows (CVE-2023-4807) - Low

Node.js is affected by this vulnerability. The CVE-2023-4807 affects Windows users, and the vulnerability is rated as LOW by the OpenSSL Security Team.

Saved you a click: NIST National Vulnerability Database: CVE-2023-4807

I'm a full stack web dev that uses Node on the server-side. When I see job postings for a NodeJS developer I'm not really quite sure what that means.

Node is just javascript + a standard library/API + an ecosystem.

When someone is looking for a Node developer, are they just wanting someone who knows the ins and outs of the standard library?