--- title: "Why Node permissions are experimental for now" publication: "Node Weekly" issue: 492 published_at: "2023-06-27" canonical_url: "https://nodeweekly.com/issues/492" --- Plus naughty npm packages, end to end web testing, and some Eleventy news. | #​492 — June 27, 2023 [Read on the Web](https://nodeweekly.com/issues/492) Together with [![Snyk logo\](https://res.cloudinary.com/cpress/image/upload/c_fill,g_auto,e_trim,w_250,h_120/e_make_transparent/co_white,e_outline:7/sdeteoqcmni8srbzlfbm.png)](https://go.snyk.io/day-in-the-life-of-an-ethical-hacker.html?utm_campaign=aom_2023&utm_medium=paid-email&utm_source=cooperpress-node-weekly&utm_content=day-in-the-life-of-an-ethical-hacker) ![Node.js Weekly](https://res.cloudinary.com/cpress/image/upload/v1653576619/lgfqinzbdqttwmhvljxb.png) [![\](https://res.cloudinary.com/cpress/image/upload/w_1280,e_sharpen:60,q_auto/rcwrlzc9tgctzki9mdka.jpg)](https://kysely.dev/) [Kysely: A Type-Safe SQL Query Builder](https://kysely.dev/) — Inspired by Knex and targeting Node, it also works in Deno and the browser. It boasts a good autocomplete experience thanks to its fluent API. [GitHub repo](https://github.com/kysely-org/kysely). Sami Koskimäki [The June 20 Node.js Security Releases](https://nodejs.org/en/blog/vulnerability/june-2023-security-releases) — As we suggested last week, the Node.js 16.x, 18.x, and 20.x lines all got updates in the form of [v20.3.1 (Current)](https://nodejs.org/en/blog/release/v20.3.1), [v18.16.1 (LTS)](https://nodejs.org/en/blog/release/v18.16.1), and [v16.20.1 (LTS)](https://nodejs.org/en/blog/release/v16.20.1). The vulnerabilities are explained in the post and are primarily related to OpenSSL or the use of the experimental [permissions feature](https://nodejs.org/api/permissions.html) behind the `--experimental-permission` flag. (This is _why_ it's an experimental feature, while initial weaknesses are discovered and fixed.) Rafael Gonzaga [![\](https://copm.s3.amazonaws.com/a8a6b4b0.png)](https://go.snyk.io/day-in-the-life-of-an-ethical-hacker.html?utm_campaign=aom_2023&utm_medium=paid-email&utm_source=cooperpress-node-weekly&utm_content=day-in-the-life-of-an-ethical-hacker) [A Day in the Life of an Ethical Hacker](https://go.snyk.io/day-in-the-life-of-an-ethical-hacker.html?utm_campaign=aom_2023&utm_medium=paid-email&utm_source=cooperpress-node-weekly&utm_content=day-in-the-life-of-an-ethical-hacker) — Ethical hackers proactively identify security weaknesses before they can be exploited by malicious actors. Learn practical steps for getting started with ethical hacking, from reconnaissance and vulnerability exploitation to responsible disclosure. Snyk sponsor [A Look at TypeScript 5.2's New Keyword: `using`](https://www.totaltypescript.com/typescript-5-2-new-keyword-using) — `using` brings something akin to Python’s `with` context management into TypeScript with a way to automatically run a function when an object leaves scope. You could use it to shut down a database connection, close file handles, etc. Matt Pocock _ASIDES:_ - **NPM NASTIES:** On Twitter, Feross Aboukhadijeh takes us on an illuminating, if mildly depressing, [🐦 tour of some of the worst malware](https://twitter.com/feross/status/1672401333893365761) that [Socket](https://socket.dev/) detected landing on npm recently. - **SAFER ACTIONS:** GitHub has [a new tool to secure your GitHub Actions.](https://github.blog/2023-06-26-new-tool-to-secure-your-github-actions/) It monitors your workflows and recommends the minimum permissions they _really_ need to run. - **NESTJS v10:** We mentioned the release of NestJS v10 last week, but somehow missed the [official NestJS v10 release post](https://trilon.io/blog/nestjs-10-is-now-available) that goes into more detail of what's new in the popular server-side Node framework. - **11TY NEWS:** Zach Leatherman, the creator of the [Eleventy (11ty)](https://www.11ty.dev/) static site generator, says that due to the conclusion of Netlify's (appreciated) sponsorship of the project, [Eleventy will be returning to 'side project' status](https://www.zachleat.com/web/eleventy-side-project/). If you're a user, there's [a community survey](https://docs.google.com/forms/d/e/1FAIpQLSdawdaJjMxF4CW2P7jaWeeiF5C8Ph7Bj9Hgauh2LuXy2Rf8ng/viewform?pli=1) to help guide what Zach does next. [A Look at the Architecture of an Early Stage SaaS](https://www.feelback.dev/blog/feelback-saas-launch-architecture/) — [Feelback](https://www.feelback.dev/) is a hosted feedback collection app and their team explains their app’s architecture in detail. Their API is built on Node, hosted on Fly, with a React SPA up front. Feelback Team [An Intro to Command Injection Vulnerabilities](https://www.nodejs-security.com/blog/introduction-command-injection-vulnerabilities-nodejs-javascript) — Think SQL injection but with commands. If your app, or even one of its dependencies, constructs commands from user/third party input and runs them locally, there’s potential for trouble. Liran Tal [How to Create a Multi-Region Node.js Lambda API](https://thenewstack.io/tutorial-how-to-create-a-multi-region-node-js-lambda-api/) — …using Serverless Framework and pairing it with a serverless multi-region CockroachDB database. Paul Scanlon (Cockroach Labs) [Using PlanetScale with Serverless Framework Node Apps on AWS](https://planetscale.com/blog/using-planetscale-with-serverless-framework-node-apps-on-aws) Matthieu Napoli (PlanetScale) 🛠 Code & Tools [![\](https://res.cloudinary.com/cpress/image/upload/w_1280,e_sharpen:60,q_auto/y3dzvegaqnv1ucrtkyae.jpg)](https://nightwatchjs.org/) [Nightwatch.js 3.0: End-to-End Web Testing Framework](https://nightwatchjs.org/) — [v3](https://github.com/nightwatchjs/nightwatch/releases/tag/v3.0.1) includes some new selectors, features a revamped experience, lets you test Angular components in isolation, adds test double support for unit tests, and more. [GitHub repo](https://github.com/nightwatchjs/nightwatch). BrowserStack Limited ☕️ Along similar lines, [TestCafé 3.0](https://github.com/DevExpress/testcafe/releases/tag/v3.0.0) has also been released. It takes a more direct approach than Nightwatch's Selenium-derived [WebDriver API](https://www.w3.org/TR/webdriver/) approach, and v3.0 has added support for directly driving Chromium-based browsers over the Chrome DevTools Protocol. [Shiki: A Syntax Highlighter Using VS Code Themes](https://github.com/shikijs/shiki) — Supports over 100 languages and you can specify a VS Code theme in the settings to get the look you want. Works in both Node.js and even on static sites (via a CDN build) and you can see [some examples here](https://shiki.matsu.io/). Shiki [Save $1 Off Your Next Domain Name Registration at Porkbun.com](https://porkbun.com?coupon=AWESOMENESS&utm_source=NodeWeekly&utm_medium=Newsletter&utm_campaign=nwjune2023) — Create your next project on a domain from Porkbun.com. The best prices, services, and support of any domain registrar! Porkbun.com sponsor [google-spreadsheet 4.0: Interact with Google Sheets](https://theoephraim.github.io/node-google-spreadsheet/#/) — Sheets is Google’s cloud-based spreadsheet app and it has [an API](https://developers.google.com/sheets/api) so you can work with documents from your own code. Theo Ephraim [DerbyJS 2.1: Mature MVC Web Framework](https://derbyjs.com/) — It’s never been the _most_ popular option, but at 12 years old, Derby has lived through most of Node’s history and remains an option for building realtime, collaborative apps. [GitHub repo](https://github.com/derbyjs/derby). Nate Smith et al. [Node Dependency Management UI for VS Code](https://npm.kasper.io/) — Supports npm, yarn, pnpm and lets you manage dependencies from the VS Code sidebar with a few extra features. [Visual Studio Marketplace listing](https://marketplace.visualstudio.com/items?itemName=idered.npm). Kasper Mikiewicz [![\](https://res.cloudinary.com/cpress/image/upload/w_1280,e_sharpen:60,q_auto/ftra6mxyzfrbeivjj6vn.jpg)](https://docx.js.org/) - [DOCX 8.1](https://docx.js.org/) ↳ Generate Word / `.docx` documents from JS. ([90 demos!](https://github.com/dolanmiu/docx/tree/master/demo)) - [BullMQ 4.1](https://github.com/taskforcesh/bullmq) ↳ Redis-based distributed queue for Node. - [Octokit.js 2.1](https://github.com/octokit/octokit.js) ↳ Batteries-included GitHub SDK. - [PureORM 4.0.1](https://github.com/craigmichaelmartin/pure-orm) ↳ ORM that maps SQL query results to objects. - [Wallpaper 7.0](https://github.com/sindresorhus/wallpaper) ↳ Get / set desktop wallpaper cross-platform. - [N|Solid v4.9.4](https://nodesource.com/blog/announcing-NSolid-version-494) 💻 Jobs [Find Tech Jobs with Hired](https://hired.com/join/?utm_source=newsletter&utm_medium=sponsor&utm_campaign=%28b2c%29%28l-all%29%28r-all%29%28cooper-nodeweekly%29&utm_content=find-your-next-job) — Hired makes job hunting easy-instead of chasing recruiters, companies approach you with salary details up front. Create a free profile now. Hired **Got a link for us?** Reply and tell us. We can't include everything but we'll look at anything you send. _Thanks!_ --- **Sponsorship:** Email `[kristina@cooperpress.com](mailto:kristina@cooperpress.com)` for details. --- Published by Cooper Press Ltd. Fairfield Enterprise Centre, Louth, LN11 0LS, United Kingdom [Cancel your subscription](https://nodeweekly.com/leave/*|UID|*) or [change your address](https://nodeweekly.com/edit_subscription/*|UID|*).