Last month, the Security Working Group initiatives focused on the Permission Model and Automated Update Dependencies.
There were 10 security reports in April with more people participating than the previous month. Response time in April was 18 hours before the first response back from us, which is less than our goal of a 48 hour response time.
As always, thank you to OpenSSF and Project Alpha Omega for their continued support. The exact details of the partnership are outlined here in the Security Support Role 2023 document.
Automation Update Dependencies
In total, 11 dependency update automation were completed this month, which included undici, openssl, v8, npm and more. There are only 2 more automations to go.
As a reminder, the Security Working Group started investigating dependencies in Node.js in November last year. They identified automated updates, and which ones should be prioritized: https://github.com/nodejs/security-wg/issues/828. We can already see the benefits of this work by looking at the increased number of pull requests for dependency updates automatically submitted to the project.
Security Release Automation
The Security Working Group is focusing on implementing automation for the key dependencies in the build. This makes the overall process easier and less prone to error, and it makes it possible in the future for different stewards to complete the process.
There are currently 26 steps in doing a Node.js security release.If greater automation works, it will be a big step forward. Please expect more information on this topic soon!
Permission Model
There have been over 10 months of work on building a new Permission Model. To help clarify next steps and guide the discussion, a roadmap issue (#898) was created to discuss the future of the Permission Model.
Are you interested in getting involved? The new Permission Model is still experimental, which makes it the right time for you to try it. Any bugs are considered vulnerabilities because they are security features.
JavaScriptLandia Awards: Pathfinder for Security
Last week at OpenJS World 2023, the OpenJS Foundation held their second annual JavaScriptLandia awards and recognized Rafael Gonzaga from Nearform.
Rafael has made significant contributions to Node.js security and has received positive feedback on his efforts to improve the security ecosystem. His contributions to reports and blogs have generated great visibility from social media, and he has personally trained and brought engineers into the Node.js Security Working Group to build the community towards self sufficiency.
Node.js 20 is now available! Highlights include the new Node.js experimental Permission Model, a synchronous import.meta.resolve, a stable test_runner module, updates of the V8 JavaScript engine to 11.3, single executable apps, Ada to 2.0, and more.
Fastify is moving from Incubation stage to a Growth Project! Within the OpenJS Foundation, this is a major step forward.
New projects at OpenJS start as incubation projects while maintainers complete the on-boarding checklist to join the Foundation. This includes documenting its infrastructure, transferring the IP, and adopting the OpenJS Code of Conduct. When a project graduates, they’ve readied their project for Foundation support. At OpenJS, we share best practices and reduce redundant administrative work across projects, such as non-technical governance, to help projects grow.
The Cross Project Council (CPC) centralizes coordination among projects as well as certain technical governance and moderation processes, and oversees the progression of projects between stages of their life cycles. Fastify has passed all of its requirements and we are happy to welcome them as a Growth Project!
To find out more about Fastify and what’s next, we talked with Matteo Collina, one of the Lead Maintainers of the Fastify team, Technical Director at NearForm, Node.js Technical Steering Committee member and OpenJS Foundation Cross Project Council member.
Are there any benchmarks that people should pay attention to regarding web performance?
I often say that “performance does not matter, until it absolutely does.” Most websites and applications do not need to be fast or scale to thousands of servers. Most developers at small and big companies alike will not (and should not) care about performance at all. Their bigger concerns are maintainability and speed of delivery. As a result, applications become bigger and slower.
As an example, a lot of developers care only about the latency of a single request when the server is idle, completely avoiding the latency and load introduced by server-side processing. Providing a snappy user experience requires both the front end and the backend to work in concert and play to each other strengths.
What are the most important metrics people should pay attention to with regard to web performance (faster networks, run time)?
The most important metric for Node.js applications is event loop latency. We define this as the time needed to process some part of an incoming http request. The higher the throughput of our application, the smaller this needs to be. Let’s make a quick example. Let’s imagine a Node.js server that can process an http request in 10 milliseconds of CPU time. Do you think this server is fast? Given that most deployments have 1 CPU per container (or even less), we can say that a single container can process around 100 requests per second.
However, we cannot say if our server is fast or slow, as it depends on the load. If our server will receive less than 100 req/sec it would appear snappy and “fast.” But if it’s over 100 req/sec, the service will now “lag behind” and the latency of every request will start increasing.
Fastify helps deploy Node.js applications at scale by applying some load-shedding techniques in the under-pressure plugin. Essentially if the server is busy it will start rejecting requests: the load balancer will try to serve them from another instance.
Now that Fastify has graduated incubation, what’s next for the project in terms of big milestones?
We’ll rest and recover! The last few months has been a race to ship Fastify v3, and now we are graduating!
Fastify, an incubation project at the OpenJS Foundation, has just released it’s latest version, Fastify v3.
Fastify is the fast, open source Node.js web framework that focuses on low-performance overhead, an excellent developer experience, and a flexible plugin architecture.
Key updates include:
1. Better support for Typescript
2. Ability to embed Express (for reusing custom modules/libraries)
3. Simplified validation support with schema references
Read about all the details on the Fastify Blog, and hear it directly from Matteo Collina, one of the Lead Maintainers of the Fastify team, Technical Director at NearForm, Node.js Technical Steering Committee member and OpenJS Foundation Cross Project Council member.
Node+JS Interactive Day Two Day two of Node+JS Interactive was filled with incredible talks and break out sessions, workshops on certifications and keynotes highlighting new projects and key research and trends important to developers. We even had Nick Nisi from JS Party, an awesome podcaster from the JavaScript community, join us on-site for a live taping of the show!
Below are just a few highlights!
Breakouts Marian from Pioneerasdev talks about her journey founding an amazing organization that helps women and girls in Colombia learn how to code and find tech jobs. Their group has skyrocketed in numbers going from 5 members to more than 1,200 in less than five years.
Members of the Node.js Technical Steering Committee spend some time talking about the health of the project, what’s to come, and where they could use some help.
Joe Sepi, IBM Software Engineer and Dev Advocate, as well as CPC Chair, gave his presentation on Promises API in Node.js Core to a packed room
Nick Nisi, a panelist at JS Party, is shown here, interviewing Vladamir de Turckiem on Node.JS loader hooks. Nick also did a great job getting a bunch of folks on the show including Marian Villa, founder of Pioneerasdev, Rich Trott and Anna Henningsen on Node.js worker threads and Chris Wilcox and Jason Etcovitch on bots.
Felix Rieseberg, Senior Staff Engineer at Slack and a member of the Electron outreach working group gave a talk on Electron and how to build cross-platform applications.
Ben Morss and Kristofer Baxter, both Googlers, talk about productive Web development powered by AMP.
Keynotes The afternoon keynotes kicked off with the wonderful Christian Bromann, Senior Lead Software Engineer at Sauce Labs and a Programming Committee Leader for Node+JS Interactive, as Master of Ceremony. In addition to being a great MC, he was a great partner in getting quality talks and keynotes selected.
Jory Burson moderates a panel with two new OpenJS Foundation incubation projects, AMP and Electron. John Kleinschmidt, Senior Software Engineer at Microsoft and Ben Morss, Developer Advocate from Google, talk through their respective projects and the benefits of joining the Foundation.
Kadir Topal from Mozilla delivered key results of the recently finalized MDN Developers needs assessment.
The keynotes were capped off with a panel on 2020 Tech Trends. The panel brought together developer advocates, industry experts and influencers within the media to discuss big topics inclusion security, monoculture in tech and diversity trends. Day one keynoter, Ellie Galloway, also got a much-deserved shout out! Panelists include moderate Nick Niki from JS Party, Liz Parody from NodeSource, Alex Williams from The New Stack and Chris Aniszczyk from the Linux Foundation.
This year’s event wouldn’t be possible without the generous support from our sponsors:
Google Cloud – Diamond Microsoft Azure – Platinum Heroku, IBM and Sentry – Gold NearForm, Red Hat Openshift, Universite, de Montreal – Silver
Finally, we look forward to seeing everyone in Austin, TX June 23 and 24th at the next global OpenJS Foundation conference!
Thanks to the amazing community for making our time together so worthwhile!
Day one at Node+JS Interactive has come to a close and was jam-packed! Today, more than 500 OpenJS Foundation Community members convened at the Montreal Convention Center. We had thought-provoking keynotes, welcomed a brand new project (Hey, Electron!), announced dates for next year’s conference (mark the calendar for June 23 and 24 in Austin, TX) networked during a buzz-worthy sponsor showcase and joined some amazing breakouts.
The popular web framework for building desktop apps plays an important role in the adoption and development of JavaScript.
MONTREAL- December 11, 2019 – The OpenJS Foundation today announced the open source web framework Electron has been accepted into the Foundation’s incubation program. Electron, an open source framework created for building desktop apps using JavaScript, HTML, and CSS, is based on Node.js and Chromium. Additionally, it is widely used on many well-known applications including Discord, Microsoft Teams, OpenFin, Skype, Slack, Trello, Visual Studio Code, and many more.
The OpenJS Foundation, which provides vendor-neutral support for sustained growth within the open source JavaScript community, delivered the news at the Foundation’s flagship event, Node+JS Interactive, in Montreal.
“We’re heading into 2020 excited and honored by the trust the Electron project leaders have shown through this significant contribution to the new OpenJS Foundation,” said Robin Ginn, Executive Director of the OpenJS Foundation. “Electron is a powerful development tool used by some of the most well-known companies and applications. On behalf of the community, I look forward to working with Electron and seeing the amazing contributions they will make.”
Electron’s cross-platform capabilities make it possible to build and run apps on Windows, Mac, and Linux computers. Initially developed by GitHub in 2013, today the framework is maintained by a number of developers and organizations. Electron is suited for anyone who wants to ship visually consistent, cross-platform applications, fast and efficiently.
“We’re excited about Electron’s move to the OpenJS Foundation and we see this as the next step in our evolution as an open source project,” said Jacob Groundwater, Manager at ElectronJS and Principal Engineering Manager at Microsoft. “With the Foundation, we’ll continue on our mission to play a prominent role in the adoption of web technologies by desktop applications and provide a path for JavaScript to be a sustainable platform for desktop applications. This will enable the adoption and development of JavaScript in an environment that has traditionally been served by proprietary or platform-specific technologies.”
“We’re committed to open source and developer collaboration, and thrilled for Electron to be a part of the Foundation’s incubation program,” said Sarah Novotny, Partner PM Manager, Azure, Microsoft. “We look forward to further enhancing the open source project for contributors, maintainers, and developers building on the framework; while exposing the project to a broader audience.”
“Electron is a great example of how interconnected the JavaScript ecosystem can be. Built on Chromium and Node.js, Electron is an amazing tool that empowers developers to create great cross-platform desktop experiences,” said Myles Borins, OpenJS Foundation Board member and Developer Advocate at Google. “It’s extremely exciting to see this project join the Foundation and stepping towards a more open governance model.”
“The Cross Project Council is thrilled to bring Electron into the OpenJS Foundation community,” said Joe Sepi, Cross Project Council Chair, and Open Source Engineer & Advocate at IBM. “Collectively, we are building something sustainable for the long-term benefit of community members and end-users. We are excited to work with Electron, and to have them be part of our mission.”
“On behalf of the OpenJS Foundation Board of Directors, it’s my pleasure to welcome Electron as the newest incubating project to the Foundation,” said Todd Moore, OpenJS Foundation Board Chair and Vice President of Open Technology and Developer Advocacy at IBM. “Bringing Electron into the Foundation is a great way to cap 2019, and continue to build our momentum into next year.”
Representatives from Electron will be featured in both a keynote and breakout session at Node+JS Interactive.
On December 12, at 11:20 am ET, Felix Rieseberg will present a breakout session titled “Electron: Desktop Apps with JavaScript,”and give a technical introduction to Electron. Building a small code editor live on stage, he’ll cover the basics and explain both benefits and challenges of using Node.js and JavaScript to build major desktop applications. (ADD LINK)
About OpenJS Foundation
The OpenJS Foundation is committed to supporting the healthy growth of the JavaScript ecosystem and web technologies by providing a neutral organization to host and sustain projects, as well as collaboratively fund activities for the benefit of the community at large. The OpenJS Foundation is made up of 32 open source JavaScript projects including Appium, Dojo, jQuery, Node.js, and webpack and is supported by 30 corporate and end-user members, including GoDaddy, Google, IBM, Intel, Joyent, and Microsoft. These members recognize the interconnected nature of the JavaScript ecosystem and the importance of providing a central home for projects which represent significant shared value.
AMP enters the open source foundation to broaden open governance, drive diverse, cross-industry adoption and continue improving the web for all.
NEW YORK– October 10, 2019 — The OpenJS Foundation, providing vendor-neutral support for sustained growth within the open source JavaScript community, announced today that the open source web component framework AMP will be joining the Foundation’s incubation program. The news was delivered at the AMP Contributor Summit 2019 in New York City.
“AMP is a great example of a community and technology focused on improving web performance and experience for all,” said Robin Ginn, Executive Director of the OpenJS Foundation, “On behalf of the Foundation, I am happy to welcome AMP and I look forward to seeing their progress to support a faster, open web.”
Now in its fourth year, AMP, a multi-stakeholder open source project initially backed by Google and used across a broad range of organizations, allows any publisher to have pages load quickly on mobile devices. Used in billions of pages on more than 30 million domains, AMP integrates with countless products and companies, including Google and Microsoft who each implement their own AMP Cache.
As a continuation of its adoption of an open governance model in late 2018, AMP’s cross-industry Technical Steering Committee agreed that the next step would be to submit an application for the project to join the OpenJS Foundation. This decision was further supported by its Advisory Committee representing constituencies from publishers, CDNs, browser vendors, open web advocates, and e-commerce and platform companies.
After completing the incubation process and officially joining the OpenJS Foundation, AMP will enable a wider variety of contributions from a wider audience, both technical and strategic. Additionally, a move to the OpenJS Foundation aims to develop and showcase the entirety of AMP’s benefits and capabilities, outside of the advantages to publishers.
“Now in our fourth year, AMP is excited for the next step on our journey,” said Malte Ubl, Member of the AMP Project Technical Steering Committee. “We’ve been considering the best home for AMP for some time. We decided on the OpenJS Foundation because we feel it’s the best place for us to help us to cater to our diverse group of constituencies. This step builds on previous moves we’ve made toward open governance and helps us focus on transparency and openness.”
“As a Platinum member of the OpenJS Foundation and huge proponent for thriving open-source communities, we are thrilled to see AMP take this step with the Foundation,” said Myles Borins, Developer Advocate for Google and OpenJS Foundation Board Vice Chairperson.“The opportunity to improve the web is vast, and AMP has a role to play in that. We see no better place for AMP to accomplish these goals than with the OpenJS Foundation.”
“As an AMP contributor and framework user having integrated AMP into different products including owning our own AMP Cache, we fully support and encourage this move,” said Saulo Santos, Engineering Manager, Bing Experiences, Microsoft. “AMP is helping to improve the web, and entering it into the Foundation will only be a continuation of these efforts.”
About OpenJS Foundation
The OpenJS Foundation is committed to supporting the healthy growth of the JavaScript ecosystem and web technologies by providing a neutral organization to host and sustain projects, as well as collaboratively fund activities for the benefit of the community at large. The OpenJS Foundation is made up of 32 open source JavaScript projects including Appium, Dojo, jQuery, Node.js, and webpack and is supported by 30 corporate and end-user members, including GoDaddy, Google, IBM, Intel, Joyent, and Microsoft. These members recognize the interconnected nature of the JavaScript ecosystem and the importance of providing a central home for projects which represent significant shared value.
Frequently Asked Questions
Why is AMP joining the OpenJS Foundation?
AMP has been taking very thoughtful steps to ensure its long-term commitment to its vision (A strong, user-first open web forever) and mission (Provide a user-first format for web content, supporting the long-term success of every web publisher, merchant, and advertiser).
In 2018, after community concerns around its ties to Google as well as concerns around scaling the project, AMP adopted an open governance model that is mirrored after the Node.js Foundation and JS Foundation. They adopted this model to scale as well as to give a voice to all constituents of the community, including those who cannot contribute code themselves, such as end-users.
How will joining the Foundation solve some of the past issues pertaining to governance AMP has faced and currently faces?
The OpenJS Foundation prides itself on vendor neutrality. Our vested interest resides solely in the ecosystem and the projects that contribute to that ecosystem. The OpenJS Foundation’s Cross Project Council is committed to supporting AMP in addressing these issues and ensure continued progress. During onboarding, AMP will also go through a multi-step process including adopting the OpenJS Foundation Code of Conduct, transferring domains and trademarks and more to graduation from incubation. AMP has made incredible strides by adopting a new governance model and by joining the OpenJS Foundation, they’ve made their intentions clear-AMP is committed to its vision of “A strong, user-first open web forever.”
Currently, the AMP runtime is hosted on the same infrastructure as the Google AMP Cache. Doesn’t this present serious issues?
The end goal is to separate the AMP runtime from the Google AMP Cache. The Project is currently in the incubating stage and Project leaders are still determining the next steps. Ideally, hosting and deployment of the AMP runtime to the CDN would fall under the purview of the OpenJS Foundation, much like the foundation is handling other projects CDNs, such as the jQuery CDN.
Untangling the runtime from the cache is a complex endeavor requiring significant investments of time and effort which would be planned and implemented in collaboration with the foundation and industry stakeholders during and after incubation.
The OpenJS Foundation CPC is committed to having a long-term strategy in place to address this issue by the end of AMP’s incubation.
How will AMP joining the Foundation address the lack of contributor diversity/inclusion? Currently, only past or current Google employees have commit rights.
AMP has taken key steps to guide how decisions are made in a more open and transparent way. The first step was to adopt a new governance model represented by multiple stakeholders. By joining the Foundation, which is a vendor neutral organization, AMP will be able to continue down this path. One of the reasons AMP is joining the Foundation is so they can have more of an inclusive contributor base. The Cross Project Council and AMP will be working on this together.
If you build Node.js applications, you may end up needing to use different versions of Node. Fortunately, there is a convenient way to install and manage different versions thanks to Node Version Manager (nvm). nvm is a POSIX-compliant bash script to manage multiple active Node.js versions.
nvm will be the first project to enter the OpenJS Foundation’s incubation process after the merger of the JS Foundation and the Node.js Foundation. nvm is the most common and widely used method to install Node.js, and the most common tool to manage multiple installed Node.js versions.
nvm offers many benefits to help developers accomplish tasks in a more efficient way. Some of these advantages include:
The ability to easily switch between node versions per-shell, which enables testing of both libraries, for maximum backwards compatibility, and apps, for smoother node upgrades on multiple node versions.
The ability to install node on any posix-compliant system that has curl/wget
Stores node versions, and thus globally installed modules, inside the user directory, removing the need for sudo when used with npm
Handles compilation for most systems that don’t have prebuilt binaries available, simplifying the install process
Provides the ease and convenience of a package manager without needing to obtain node from an unofficial distribution channel which cuts down on delays before newly released node versions are installable.
By joining the OpenJS Foundation, there are multiple organizational and infrastructure areas that will be better supported, helping both current users and future users including ensuring no single point of failure for the nvm.sh domain, GitHub repo, and more. Furthermore, nvm will be able to ensure governance and Code of Conduct enforcement to make sure that nvm will continue to be stable if there are personnel changes with the sole maintainer. Joining will also help nvm to grow and gain contributors, providing more overall stability for the project. If you are interested in getting involved, check out contributing guidelines on GitHub.
Quotes from the Community
“It’s great to have nvm join the OpenJS Foundation because it’s an important part of the overall ecosystem and a tool that makes Node.js version management easier for our users,” said Bethany Griggs, member of the Node.js Release Working Group and Node.js Project Technical Steering Committee. “nvm is a valuable tool that makes upgrading to new or switching between existing versions of Node.js much more simple. This is especially useful when developers are working on various projects that have different minimum required Node.js versions.”
“Having nvm enter into the incubation phase is an important and exciting milestone for the Cross Project Council and the OpenJS Foundation,” said Joe Sepi, CPC Chair. “As the first project, it shows forward progress and momentum. On behalf of the CPC, I look forward to nvm’s success as well as onboarding more projects crucial to the ecosystem”
“It’s really exciting to have node version manager (nvm) as the first project to enter into the incubation process,” said Michael Dawson, IBM Community lead for Node.js and Node.js Board representative. “nvm is an important and widely used part of the Node.js and JavaScript ecosystem, and by joining as a hosted project, nvm is ensuring its growth and impact well into the future.”
“I’ve been a user of nvm since 2011, and it is the best way to install Node.js on a developer’s machine,” said Matteo Collina, Node.js Technical Steering Committee member, and Node.js CPC representative. “It’s fantastic to see new energy on the project, and I wish nvm a brilliant future in the OpenJS Foundation.”
Supported platforms: any POSIX-compliant shell: Linux, OS X, Windows WSL
nvm is joining the OpenJS Foundation as an incubating project, and upon successful completion of onboarding, it will become an “At-Large” project. An “At -Large” project is one which is “stable projects with minimal needs.”
Apply for Hosted Project Status at the OpenJS Foundation!
The OpenJS Foundation hosts some of the most important projects in the JavaScript ecosystem. As a neutral non-profit organization, our goal is to provide a home where projects can build and support a sustainable community of diverse contributors.
Projects hosted by the OpenJS Foundation fall into one of four categories:
Impact stage is generally for large, mature projects.
Growth stage is for projects which are actively mentored, and which intend to graduate to Impact stage.
At-Large stage is for new projects, stable projects with minimal needs, and everything in between.
Emeritus stage is for projects which have completed their lifecycle and are retired.
Read through the project lifecycle Project Progression proposal to find out how the OpenJS Foundation can best support your project, and apply today!
Congrats to the webhint team on their v1 release! webhint, a linting tool for the web focused on best practices and flexibility for the end user, is a Growth project here at the OpenJS Foundation. The below post originally appears on the webhint blog.
We are thrilled to announce that the webhint browser extension has moved from beta to its v1 release and is now available for Chrome, Edge (Chromium), and Firefox!
Nellie and Firefox playing with a Chromium toy
The webhint browser extension allows you to easily scan a website and get feedback on accessibility, browser compatibility, security, performance, and more within the browser DevTools. Read more at https://webhint.io/.
Try the webhint browser extension
Once you’ve installed the extension for your browser, simply open DevTools and select the Hints tab. From here, you’ll be able to run a customizable site scan. You can select what browsers are relevant to you by using the browserslist syntax. (browserslist is the defacto standard for creating browser support matrix, and it’s used by tools such as autoprefixer.) You can also ignore certain cross-origin resources in your scan, letting you focus on the code you care about most.
What’s new for v1
Since announcing the beta in July, we’ve made a number of bug fixes, improvements, performance enhancements, and all-new features to the browser extension based on your feedback. Here are a few of the highlights.
Improvements to cross-browser compatibility hints
Making sure your website works in all the browsers you care about is a difficult task. webhint’s compat-api uses MDN’s browser compat data to help you identify possible gaps in your browser support matrix.
In v1, we added suggestions for missing vendor prefixes. These hints are especially helpful for testing cross-browser compatibility. We also improved the way in which browser versions are listed in compatibility hints, as shown in the before and after screenshots below.
Grouping of similar hints
Previously, if a hint affected numerous elements on a webpage, it could produce an overwhelming number of recommendations. We’ve improved this experience by grouping similar hints together.
Similar hints are grouped together.
More insights on accessibility
Previously, the browser extension surfaced color contrast hints but did not display the current color contrast ratio. In v1, this information has been added to color contrast hints.
We’ve also made more granular category breakdowns for accessibility to help you quickly sort through recommendations.
…and more!
webhint now utilizes axe-core version 3.3.2, giving us a great performance boost. Browser extension scans now take an average of 9 seconds. We’ve also added hints for inline SVG styles, bug fixes, and more! You can see the full changelog here.
webhint ❤ open source
We saw about 30 unique contributors active on our GitHub repo since our last browser extension announcement at the end of July. That rules! 🎉 Thank you all for being part of the webhint community!
If you have feedback or would like to get involved in the future development of webhint, please find us on GitHub, Gitter, or Twitter.
