--- title: "NodeBB, the Node.js powered forum system" publication: "Node Weekly" issue: 563 published_at: "2025-01-21" canonical_url: "https://nodeweekly.com/issues/563" --- Plus more nasty npm typosquatting, ArkType 2.0, and using React's lifecycle in Node. | #​563 — January 21, 2025 [Read on the Web](https://nodeweekly.com/issues/563) Together with [![Stytch logo\](https://res.cloudinary.com/cpress/image/upload/c_fill,g_auto,e_trim,w_250,h_100/e_make_transparent/co_white,e_outline:7/ybmf19rrsbnymq3rn7n3.png)](https://stytch.com?utm_source=node-weekly&utm_medium=paid_sponsorship&utm_campaign=node-weekly-01-21-2025&utm_content=primary-listing) ![Node.js Weekly](https://res.cloudinary.com/cpress/image/upload/v1653576619/lgfqinzbdqttwmhvljxb.png) [![\](https://res.cloudinary.com/cpress/image/upload/w_1280,e_sharpen:60,q_auto/oju3qygxxqjehtvwpayn.jpg)](https://community.nodebb.org/topic/18545/nodebb-v4.0.0-federate-good-times-come-on) [NodeBB v4.0.0 Released: Node.js Powered Forums](https://community.nodebb.org/topic/18545/nodebb-v4.0.0-federate-good-times-come-on) — Now almost 12 years old, NodeBB continues to offer a classic forum experience in a modern Node.js-shaped guise. The big update for v4 is [support for _federation_](https://wedistribute.org/2025/01/nodebb-officially-joins-fediverse/) between NodeBB instances and the wider fediverse generally. Note that the open source project ([repo](https://github.com/NodeBB/NodeBB)) is GPL licensed with [NodeBB Inc](https://nodebb.org/) providing a hosted service. NodeBB, Inc. [The January 21, 2025 Security Releases](https://nodejs.org/en/blog/vulnerability/january-2025-security-releases) — Not yet released at the time of publication, but coming to you any moment soon, are fresh releases of the Node 23.x, 22.x, 20.x, and 18.x release lines to tackle some as yet undisclosed security issues. The Node.js Project [![\](https://res.cloudinary.com/cpress/image/upload/c_limit,w_480,h_480,q_auto/copm/c4bf8464.png)](https://stytch.com?utm_source=node-weekly&utm_medium=paid_sponsorship&utm_campaign=node-weekly-01-21-2025&utm_content=primary-listing) [Skip the Auth0 Headaches](https://stytch.com?utm_source=node-weekly&utm_medium=paid_sponsorship&utm_campaign=node-weekly-01-21-2025&utm_content=primary-listing) — [Stytch](https://stytch.com?utm_source=node-weekly&utm_medium=paid_sponsorship&utm_campaign=node-weekly-01-21-2025&utm_content=primary-listing) cuts engineering time for auth and fraud, while giving you more control with pre-built UIs, [headless SDKs](https://stytch.com/docs/b2b/sdks?utm_source=node-weekly&utm_medium=paid_sponsorship&utm_campaign=node-weekly-01-21-2025&utm_content=primary-listing), backend SDKs, and APIs. Plus, no rate limits or price gouging, and expert support on every plan. [Check out our Node quickstart guide](https://stytch.com/docs/quickstarts/node?utm_source=node-weekly&utm_medium=paid_sponsorship&utm_campaign=node-weekly-01-21-2025&utm_content=primary-listing). Stytch sponsor **IN BRIEF:** - [Version 11.0](https://github.com/nestjs/nest/releases/tag/v11.0.0) of the popular [NestJS framework](https://nestjs.com/) has been released. We're waiting for the full blog post to land, but it seems to be a big update (and now uses Express v5). There's [a v10 to v11 migration guide.](https://docs.nestjs.com/migration-guide) - [Vercel is deprecating the use of Node 18](https://vercel.com/changelog/node-js-18-is-being-deprecated) on August 1, 2025. - GitHub's Dependabot (the automated dependency update system) [no longer supports npm 6](https://github.blog/changelog/2025-01-20-dependabot-will-no-longer-support-npm-v6/) and demands npm 9 or later. [TypeScript Enums: Use Cases and Alternatives](https://2ality.com/2025/01/typescript-enum-patterns.html) — A look into one of TypeScript’s features that has no direct JavaScript parallel (and hence _won’t_ survive Node’s type stripping approach, though there’s always `--experimental-transform-types` or [tsx](https://nodejs.org/api/typescript.html#full-typescript-support)). Dr. Axel Rauschmayer [Kill Switch Hidden in npm Packages Typosquatting Chalk and Chokidar](https://socket.dev/blog/kill-switch-hidden-in-npm-packages-typo-squatting-chalk-and-chokidar) — Recent research has found several malicious packages ‘typosquatting’ the terminal string styling library [Chalk](https://www.npmjs.com/package/chalk) and file-watching library [Chokidar](https://www.npmjs.com/package/chokidar) — targeting Node devs with security issues. Kush Pandya (Socket) 📄 [`Promise.race` and `Promise.all` Are Not “Fair”](https://v5.chriskrycho.com/notes/javascript-promise-race-and-promise-all-are-not-fair/) – That is to say, they have bias and aren’t entirely random. Chris Krycho 📄 [Fetch and HTTP/2 Support in Node, Bun and Deno](https://blog.disintegrator.dev/posts/http2-support-in-js-runtimes/) Georges Haidar 🛠 Code & Tools [![\](https://res.cloudinary.com/cpress/image/upload/w_1280,e_sharpen:60,q_auto/kc1c5w6dgduqvg5apbcd.jpg)](https://arktype.io/docs/blog/2.0) [ArkType 2.0: Runtime Validation Library](https://arktype.io/docs/blog/2.0) — An [easy-to-deploy](https://arktype.io/docs/intro/setup) solution for schema validation that can infer TypeScript definitions 1:1 and use them as optimized validators for your data, both at runtime and for immediate type-level feedback in your editor. ArkType [react-nil 2.0: A React 'Null Renderer'](https://github.com/pmndrs/react-nil) — An interesting experiment to use React in situations where you don’t need it to render anything, but you want to use hooks, suspense, context, and other bits of the React lifecycle. Like in, say, a Node app. Poimandres [Protect Against Bots, Fraud, and Abuse in Real Time](https://workos.com/radar?utm_source=cpnode&utm_medium=newsletter&utm_campaign=q12025) — WorkOS Radar protects your app with advanced device fingerprinting — stop fake signups, free tier abuse, bot attacks and brute force attempts today. WorkOS sponsor [Electron 34.0.0](https://www.electronjs.org/blog/electron-34-0) — The JS, HTML and CSS desktop app framework updates to Chromium 132, Node 20.18.1, and adds a way to access the JavaScript call stack of unresponsive renderers. Electron Team [file-type 20.0: Detect the File Type of a Buffer, Uint8Array or ArrayBuffer](https://github.com/sindresorhus/file-type) — For example, give it the raw data from a PNG file, and it’ll tell you it’s a PNG file. Uses a ‘magic number’ approach so is targeted solely at non text-based formats. v20 adds support for yet more formats, including JARs, Word/Excel templates, and now supports ZIP decompression. Sindre Sorhus - 😀 [Happy DOM 16.7](https://github.com/capricorn86/happy-dom) – Cross-runtime JS implementation of a web browser _sans_UI. Now with support for [simulating local HTTP servers](https://github.com/capricorn86/happy-dom/wiki/IVirtualServer) that serve files from the local fileNBSPsystem. - [better-sqlite 11.8](https://github.com/WiseLibs/better-sqlite3) – A neat way to use SQLite from Node. Now supporting [SQLite 3.48.0](https://www.sqlite.org/releaselog/3_48_0.html). - [Faker 9.4](https://github.com/faker-js/faker/releases/tag/v9.4.0) – Generate fabricated data to your heart's content. - 🎶 [Ableton.js 3.6](https://github.com/leolabs/ableton-js) – Control instances of the Ableton DAW from Node. - [Nightwatch.js 3.11](https://github.com/nightwatchjs/nightwatch) – Node.js end-to-end testing framework. - [pg-diff 3.0](https://michaelsogos.github.io/pg-diff/) – PostgreSQL schema and data comparing tool. - [qs 6.14](https://github.com/ljharb/qs) – Query string parsing and stringifying library. - [YouTube.js 13.0](https://github.com/LuanRT/YouTube.js) – JS client for YouTube's private API. - [Commander.js 13.1](https://github.com/tj/commander.js/releases/tag/v13.1.0) – Node.js CLI app framework. 📰 Classifieds 💭 How can I help my Node.js app to [adapt to changing demand?](https://blog.platformatic.dev/how-can-i-enable-my-nodejs-app-to-adapt-to-changing-demand) A simple how-to-guide, in three parts. --- 🚀 Master Fullstack, JS Backends & DevOps [at Node Congress 2025!](https://nodecongress.com?utm_source=Newsletter&utm_medium=nodeweekly) Join 5K devs worldwide on April 17-18. 2 days of talks & workshops! 📢 Elsewhere in JavaScript A quick roundup of some of other interesting stories in the broader JavaScript landscape, in case you've missed them: - [Learn Yjs](https://learn.yjs.dev/) is a nifty, still in-development, set of tutorials for learning how to build realtime collaborative apps using the [Yjs CDRT library.](https://github.com/yjs/yjs) - [The latest version of Bun](https://bun.sh/blog/bun-v1.1.44) has added on-demand front-end bundling to its `Bun.serve()` feature. - If you've not worked with WASM yet, [Hemath has an accessible introduction to the basics of WebAssembly.](https://hemath.dev/blog/webassembly/introduction-to-webassembly/) - The popular [Astro](https://astro.build/) framework has published [a review of what happened with Astro in 2024.](https://astro.build/blog/year-in-review-2024/) - Google has [begun to _require_ JavaScript](https://techcrunch.com/2025/01/17/google-begins-requiring-javascript-for-google-search/) for users making searches. **Got a link for us?** Reply and tell us. We can't include everything but we'll look at anything you send. _Thanks!_ --- **Sponsorship:** Email `[kristina@cooperpress.com](mailto:kristina@cooperpress.com)` for details. --- Published by Cooper Press Ltd. Fairfield Enterprise Centre, Louth, LN11 0LS, United Kingdom [Cancel your subscription](https://nodeweekly.com/leave/*|UID|*) or [change your address](https://nodeweekly.com/edit_subscription/*|UID|*).