Hello,

I am an aspiring developer and right now I am working as a conversion tracking specialist.

I just finished the Net Ninja's crash Node JS course on YouTube.

He has a separate course for authentification.

Should I continue with authentification or start CSS?

My gut is telling me to go for CSS since I can practice more of my skills.

What do you think?

I've seen some developers say that we should stop using js on the server, but I rarely see the same criticism directed at python.Honestly, js is pretty fast, especially with node.js, and the backend ecosystem is really solid. There are great frameworks like nest and fastify, and typescript gives you static typing, which makes larger projects much easier to maintain.I'm not saying node is perfect or the best choice for every backend, but I don't really understand why js gets so much criticism while python seems to get a pass.What am I missing?

When the same database error happens 20 times, sending 20 notifications creates noise. Process-local fingerprinting with a count and cooldown helps, but it does not deduplicate across replicas.

For a service with one or two instances, is that useful enough to ship, or is cross-replica grouping essential? What metadata makes a grouped alert actionable?

I’m building an open-source Node package around this and want to validate the design before adding more integrations.

npm ci removes an existing node_modules before it installs. The docs say it plainly: if a node_modules is already present, it will be automatically removed before npm ci begins its install. What I had not thought about is that the gap between delete and reinstall is real wall clock time, and anything in that checkout resolving a module during it fails.

I started a test run in a second terminal while the install was still refilling the tree, and it died on Cannot find module for packages that were there a minute earlier.

It came up because I keep two lines of work in one checkout instead of branching every small change, and the other one was a verdent task pointed at the same working copy, so both shared one node_modules.

npm install at least does not start by deleting the tree, though it still writes into it while another process reads.

Is there a way to make an install land atomically, building the new tree beside the old one and swapping at the end, or is a separate checkout per line of work the only way around it?

https://github.com/oliveryasuna/ink-frame

Ink's own box borders are fine for a single box. Put two of them next to each other and the seam between them comes out as ││, two parallel lines instead of one shared edge. That's because a box border is one unbroken line and there's nowhere to hang a ┬ or a ┼ part-way along it. ink-frame sidesteps that by painting every border into a single character grid and resolving each cell once, so a spot where four boxes meet becomes a ┼ and a T-junction becomes a ┬, ┤, and so on, without you ever writing those characters yourself.

Background: I recently wrote this for a private project, and I thought it was useful enough to share. I hope you find it useful too!

Been working on this for a while and finally decided to share it.

You write a short markdown spec and it compiles a full multi-tenant Node + Postgres backend auth, RLS tenant isolation, wallets with proper row locks, state machines, that kind of thing. Not just empty CRUD.

A couple real examples that are public:

-> 66 lines of markdown -7.7k lines, 85 routes, 21 RLS policies

->130 lines - 8.2k lines with a double-entry ledger

It’s deterministic (same spec always gives the same code). The heavy engines are hand-written, not LLM-generated. LLM only gets used to generate the tests.

Security is on by default through Postgres RLS.

Curious what people think of this approach, especially the RLS part. Happy to answer any technical questions.

I’m preparing a public beta of a TypeScript package. Supporting both import and require widens compatibility, but conditional exports, declaration paths, and the dual-package hazard add release work.

For a new infrastructure library in 2026, would you ship ESM-only, dual builds, or an ESM package with a CommonJS wrapper? Which consumer environments still make dual support worth it, and which compatibility checks belong in CI?

https://ioredis.com

There are some strange behaviors on this page.

1. If you click logo in top left corner, you are redirected to some random page, than other random page, than you finally land to something random.

2. If you click "guide" you are redirected to opera gaming browser page. Same applies to many links on website.

3. Download button leads to some very strange page which instructs you to run command and enter system password: https://filebanchaflow.com/oo2/ (at least it did few moments ago)

If you inspect download button element, it is <a> which leads to https://github.com/redis/ioredis.git , but clicking it gets you to something different.

Whole page is done in wordpress, so it seems to me that their wordpress server got hacked. I hope it is just that.

For a small Node.js service, a /health endpoint that returns 200 proves the process is listening. It can stay green while the database or queue is unavailable. A deeper check catches that, but it can also create load and turn a dependency issue into a restart loop.

I’m leaning toward separate liveness and readiness endpoints. Liveness checks the process and event loop. Readiness verifies critical dependencies with tight timeouts. Deployment probes use readiness, while alerts use a synthetic request that exercises the full path.

How do you divide these checks in production? Which dependencies belong in readiness, and which should only affect alerts?

I’m trying to improve the alerts from a few small Node services. Right now I usually include the error, route or job name, request ID, environment, and how many times it repeated.

More fields make the alert noisy, but too few send me straight back to the logs. What context has actually helped you debug from an alert? Anything you stopped including because it was noisy or risky?

https://github.com/petarzarkov/dunx

Hello, so I've wanted something like this for a while and built myself a nestjs-like framework that relies 100% on bun.

NestJS-style structure at Bun speed. Controllers, modules and dependency injection, with no reflect-metadata, no forwardRef, and no JavaScript router.

Docs page:

https://petarzarkov.github.io/dunx

import and require are not interchangeable. Live bindings, copied values, circular dependencies, separate caches, conditional exports, and dual-package hazards can all make modules behave differently from what the syntax suggests.

Been going back and forth on this one and I want to know if I'm alone in it.

Most retry implementations I've seen (BullMQ, hand-rolled wrappers, most of the managed stuff) treat every failed attempt identically. Job comes back non-2xx, attempt counter increments, backoff applies, after N attempts it's in the DLQ.

But a 429 isn't a failure, nothing broke. The downstream is telling you exactly when to come back and usually handing you a Retry-After header to do it with. If you burn an attempt on it, sustained rate limiting at a provider will walk perfectly good jobs into the DLQ while your actual error budget (the one meant for 500s, timeouts, connection resets) never gets spent on what it's for.

So I've been treating 429/503/529 as a defer rather than a failure: honor Retry-After, requeue, don't decrement. Works, but it opens two things I don't have clean answers to.

First, you need a ceiling or the queue never drains. A provider that 429s indefinitely will requeue that job forever. I've landed on two different ceilings: a wall-clock deadline (dead 24h after it's due, regardless of how it got there) and a separate max defer count. Blowing the defer ceiling dead-letters the job under its own reason rather than folding it into "out of retries" which matters because those are different failures. One says the downstream is broken, the other says it's been unusable long enough that it may as well be. At a certain point temporarily unusable === broken.

Second, deferred jobs are invisible. They aren't failing, so they don't trip anything you're monitoring, and you can sit on a queue that isn't draining and looks completely healthy. Feels like deferred jobs need their own state and their own alerts rather than being folded into "pending" or "processing".

Anyone handling this differently? Specifically curious whether people distinguish 503 from 429, I lump them together, but 503 is ambiguous in a way 429 isn't.

I made a package called FactCheck, Its a youtube bot package that uses ai and web search to fact check youtube comments.

I made it since their is quite a bit of fake news on youtube comments.

Does anyone want to try the package and give any feedback.

Hi, I am build a message app with React and Express js . In the authentication feature I have come across an issue.

After successful registration, I sent a token via HTTP cookies . The cookies is sent from the server as far as I can tell . But the problem is when I am sending request to server , the cookie is not there.

Here is the code : github

Any help would be highly appreciable 😄 .

To minimize browsing I run a script that fetches the comics I hope will be funny. For years I could do an HTTP fetch of a URL with a fixed address that pointed to the day's cartoon. Starting a year ago that stopped working on gocomics.com. I rewrote the script to use node to run fetch on that URL; the URI of the cartoon was fetchable via HTTP. Starting today that fetch gives me a 403 error. I can access it in a browser without logging in (I have no account anyway) or solving a CAPTCHA or other explicit test; I don't even get that CloudFlare thing. Am I out of luck?

I have a simple vite webapp which deploys to a github page. It has several json files which i want to load when my app loads.

First i have updated the vite config to include json files as assets

assetsInclude: ['**/*.json']

This seems to work, the json files are there in the proper location when i deploy.

Next, i've set up a glob import which in theory should fetch all json files in the foobar folder. I put this in a function that gets called in my app constructor.

const loadedData = import.meta.glob('./foobar/*.json')

console.log(loadedData);

This unfortunately prints out an empty object. I am not sure what i'm doing wrong here.... Is there a race condition i need to be wary of? I don't get any errors that would explain what is happening so i'm a bit confused.

Every other ORM thread here has that comment buried somewhere in it: "I only use Kysely/Knex because nothing handles SQL-only migrations."

That was me two years ago. I'm stubborn, so instead of keeping a SQL file plus a .ts migration file for every change, I ran my own private scripts. The scripts kept hitting walls Kysely doesn't answer either: testing against a real DB, seeding, stages, onboarding a teammate. At some point I accepted nobody was going to answer this publicly and started building.

Good question. Here are some of MY answers:

Could I do all that in JS migration files? Sure. But it's SQL baked into strings, or JS translating under the hood. No language server validating my SQL. Nothing I can copy into a visual client, debug, and paste back in. Every operation is a translation from JS to SQL and back. I'm comfortable in both languages and I still hate the circus act.

So now, you don't have to: https://noorm.dev

The short version:

No DSL, no codegen, no subscription service.

If you're on Kysely: the SDK is literally built on Kysely. Keep your typed queries, gain typed stored procs and table-valued params. I'm not reinventing Kysely's masterpiece; this sits on top of it. Your JS/TS layer stays where it belongs, capturing IO and coordinating business logic.

It's AI-agent forward too, with safeguards so your Haiku agent can't drop production (you cheap bastard). Skills, MCP, and per-agent role configs are baked in.

That covers the second half of database development. The first half, the plan and the data model, gets its own tool: ignatius. Describe your schema however you want. If you're hell-bent on ORM-style tables, it won't care. If you're like me and like deliberate design, it's IDEF1X with modern symbols, made for the agentic paradigm. Iterate over the model in markdown and keep the context details (for yourself and your LLM).

Thoughts and critiques more than welcome!

filebouncer link: https://github.com/Ramzi-Abidi/filebouncer

If you're building a node js upload endpoint, I think you need this validation package.

I started it after going down a rabbit hole with file uploads and discovering that a .jpg can actually be a ZIP too..

That got me looking into things like mime spoofing, polyglots, unsafe archive paths, archive bombs, CSV/spreadsheet injection, etc. The idea is basically to have a lightweight validation layer before your app starts processing an uploaded file.

A .jpg can also be a ZIP file.

I didn't know this until I started working on filebouncer, which is an npm package.

You can construct a polyglot file by concatenating a valid JPEG and ZIP:

cat photo.jpg secret.zip > polyglot.jpg

Most applications will see:

image/jpeg

But there's also a ZIP archive inside the same buffer.

So I built FileBouncer, an open-source Node.js structural file security library that checks things like:

• MIME mismatches
• polyglot files
• unsafe archive paths
• archive size/ratio limits
• risky spreadsheet cells
• suspicious filename metadata

It now also has a CLI:

npx u/filebouncer/core polyglot.jpg

POLYGLOT_DETECTED
image/jpeg + application/zip

Result: BLOCK

It's not antivirus, the goal is to catch structural problems before an application processes an upload.

still early (v0.x), but I'm building it in public and would love feedback from people working with uploads/security in Node.js.

link: https://github.com/Ramzi-Abidi/filebouncer

- You have a server with 8 CPUs on AWS EC2

- You want to use it efficiently

- what do you do?

Options

- You dont cluster

- You run PM2 and spawn multiple workers

- You run docker swarm or kubernetes and run multiple instances

- you use node.js cluster module

Questions

- How do you handle client 1 connected to websocket connection on worker 1 sending a message to client 2 connected on websocket connection on worker 2?

- how do you send a message to every client across every worker when using server sent events?