--- title: "Security releases all round" publication: "Node Weekly" issue: 370 published_at: "2021-01-07" canonical_url: "https://nodeweekly.com/issues/370" --- Plus a Node powered Android transfer app and new npm releases too. | #370 — January 7, 2021 [Read on the Web](https://nodeweekly.com/issues/370) Node Weekly [![\](https://res.cloudinary.com/cpress/image/upload/w_1280,e_sharpen:60/s0zh9f2htcpw6womjm1a.jpg)](https://napi.rs/) [napi-rs: A Minimal Library for Building Node Addons in Rust](https://napi.rs/) — [Neon](https://neon-bindings.com/) appeared in 2019 as a way to _‘electrify your Node with the power of Rust’_ ([Rust](https://www.rust-lang.org/) being an increasingly popular, high performance, safety-first systems language) and `napi-rs` gives us more of the same with a [slightly different take.](https://napi.rs/neon) It supports all recent Node versions, has Apple Silicon support out of the box, and is [easy to get started with](https://napi.rs/introduction/getting-started). LongYinan [The January 2021 Node Security Releases](https://nodejs.org/en/blog/vulnerability/january-2021-security-releases/) — As promised in December, we have new versions of Node all round, including [Node 15.5.1](https://nodejs.org/en/blog/release/v15.5.1/), [14.15.4](https://nodejs.org/en/blog/release/v14.15.4/) [12.20.1](https://nodejs.org/en/blog/release/v12.20.1/), and [10.23.1](https://nodejs.org/en/blog/release/v10.23.1/). Why? A bug in the TLS implementation mostly, but also a HTTP request header smuggling bug – neither of which you want in your production environments. Michael Dawson [![\](https://copm.s3.amazonaws.com/930abfe0.png)](https://ter.li/hkt7ie) [Spend Less Time Debugging and More Time Building](https://ter.li/hkt7ie) — Scout APM uses tracing logic that ties bottlenecks to source code so you know the exact line of code causing performance issues. Continually track N+1 database queries, sources of memory bloat, performance abnormalities, and more with Scout APM. Scout APM sponsor [Meow: A Straightforward CLI App Helper](https://github.com/sindresorhus/meow) — Not a new project but one of Sindre’s projects I hadn’t seen before. It’s simple and straightforward. You define flags, help text, and other features in a single object and it handles all the processing for you. Sindre Sorhus [npm 7.3.0 (and 7.2.0) Released](https://blog.npmjs.org/post/637875064602296320/release-v730) — Two new `npm` releases dropped in just before Christmas. `npm config` now supports getting and setting multiple values at once and `npm rebuild` now accepts paths as an argument. The npm Blog - NodeSource has [unveiled N|Solid 4.4.0](https://nodesource.com/blog/arm64-support-C++-API-event-profiler-to-NSolid) with ARM64 support, a C++ API, and a new event profiling tool. 💻 **Jobs** [Full Stack Senior JavaScript/Node.js Developer - Video Platform](https://www.seek.com.au/job/51237586) — Melbourne based, remote friendly role, working on exciting AI powered video creation SAAS product. Apply[here](https://www.seek.com.au/job/51237586). Vidnami [Find Your Next Job Through Vettery](https://www.vettery.com/tech?utm_source=newsletter&utm_medium=cooper-nodeweekly&utm_term=tech&utm_content=grouped&utm_campaign=ad-88879) — Create a profile on Vettery to connect with hiring managers at startups and Fortune 500 companies. It's free for job-seekers. Vettery 📗 **Tutorials and Stories** [Experimenting Producing AVIF Images from Node](https://www.jameslmilner.com/post/node-avif/) — [AVIF is a new image format](https://jakearchibald.com/2020/avif-has-landed/) that’s not _widely_ supported yet, but with widespread support on the way. Given its many advantages, though, developers are keen to use it. The [Sharp module](https://www.npmjs.com/package/sharp) recently added AVIF support too and here’s how it operates. James Milner [The Four 'Creational' Design Patterns in Node.js You Should Know](https://catalins.tech/the-4-creational-design-patterns-in-nodejs-you-should-know) — Design patterns are used in numerous scenarios such as for handling object interactions, object design, and also how objects are _created_ which is the focus here. Singleton, Factory, Builder, and Prototype patterns are covered. Catalin Pit [How We Built Scalable Spatial Indexing in CockroachDB](https://www.cockroachlabs.com/blog/how-we-built-spatial-indexing/?utm_campaign=cooperpress-2021-Q1&utm_source=nodeweekly&utm_medium=sponsor&utm_content=nodeweekly-sponsored) — Support for spatial data _was_ the most requested feature in the history of CockroachDB. [Read about how we built it](https://www.cockroachlabs.com/blog/how-we-built-spatial-indexing/?utm_campaign=cooperpress-2021-Q1&utm_source=nodeweekly&utm_medium=sponsor&utm_content=nodeweekly-sponsored). Cockroach Labs sponsor [Comparing Emilua to Node.js](https://emilua.gitlab.io/blog/post/comparing-emilua-to-nodejs/) — Emilua is _sort of_ a Node-a-like for the [Lua](http://www.lua.org/) language. I’m unlikely to use it, but it’s a neat look at a project I was unaware of. [Git repo](https://gitlab.com/emilua/emilua). Emilua ▶[How to Cache an API Endpoint with Redis in Node](https://www.youtube.com/watch?v=z80MUl2pGjs) — A rough and ready screen recording that may be helpful to some. Chovy 🛠 Code and Tools [Pino 6.9.0: A Fast 'Very Low Overhead' JSON Logger](https://github.com/pinojs/pino) — There are code samples for using it with Fastify, Express, Hapi, Koa, and more. pino [CandyMail: Node-Powered Email Automation System](https://saasbase.dev/candymail) — If your app needs email sequences based on user activity, say, this is for you and might save you having to pay for an expensive email automation system. [GitHub repo](https://github.com/bdcorps/candymail). CandyMail [Dynamoose 2.5.0: A Modeling Tool for Amazon's DynamoDB](https://github.com/dynamoose/dynamoose) — As [Mongoose](https://mongoosejs.com/) is to MongoDB, Dynamoose hopes to be to Amazon’s DynamoDB. Dynamoose [np 7.2.0: A Better `npm publish`](https://github.com/sindresorhus/np) — Makes the process of publishing a package just a little smoother with an interactive UI, checks that you’re publishing the right thing, runs tests, pushes commits and tags, and more. Sindre Sorhus [Video for Your Node App That Streams Beautifully, Everywhere](https://get.mux.com/3ohq21N) Mux sponsor [Google Cloud Vision API Node.js Client v2.2.0](https://github.com/googleapis/nodejs-vision) — [Google Cloud Vision API](https://cloud.google.com/vision/docs/) is worth a try if you want to do things like face or landmark recognition, OCR, explicit content tagging, etc. It can now also do text detection and return a confidence score. Google [pigpio 3.3.0: Fast GPIO, PWM, Servo Control, and More on the Raspberry Pi](https://github.com/fivdi/pigpio) — One for those of you tinkering with Node on the Raspberry Pi. It wraps the pigpio C library and supports Node 10 through 15. Brian Cooke [fkill-cli 6.1.0: A Cross-Platform Way to Kill Processes](https://github.com/sindresorhus/fkill-cli) Sindre Sorhus [node-ble 1.4: A Pure Node.js Bluetooth Low Energy (BLE) Library](https://github.com/chrvadala/node-ble) — Aimed at Linux users and works via D-Bus. Christian Vadalà [![\](https://res.cloudinary.com/cpress/image/upload/w_1280,e_sharpen:60/dlh98qdryrynag1xihkr.jpg)](https://github.com/ganeshrvel/openmtp) [OpenMTP: An Advanced Android File Transfer Application for macOS](https://github.com/ganeshrvel/openmtp) — An interesting example of a full-featured desktop all that uses numerous JavaScript technologies including Node, Electron, and React. Certainly looks better than the official Android transfer app I used to use. [Official homepage](https://openmtp.ganeshrvel.com/). Ganesh Rathinavel [A Port of Google's V8 Engine to RISC-V](https://github.com/v8-riscv/v8/wiki) — An MVP of a RISC-V64 port of the V8 JavaScript engine. [RISC-V](https://en.wikipedia.org/wiki/RISC-V) is a royalty free, open instruction set architecture that’s still relatively little used but of increasing interest in a world looking more at RISC-oriented systems (such as Arm-based ones). Wei Wu and Brice Dobry **Got a new email?** You can [change your address here](https://nodeweekly.com/edit_subscription/*|UID|*). --- **Bored of us?** [Click here to stop getting Node Weekly](https://nodeweekly.com/leave/*|UID|*). --- **Got a link for us?** Reply and tell us. We can't include everything but we'll look at anything you send. Thanks! --- **Want to sponsor?** Email `[kristina@cooperpress.com](mailto:kristina@cooperpress.com)` for details. --- Published by Cooper Press Ltd. Fairfield Enterprise Centre, Louth, LN11 0LS, United Kingdom [Stop getting this newsletter.](https://nodeweekly.com/leave/*|UID|*)