Knowledge Updates

Observations while developing web applications and creating great software.

  • Upcoming CVE for End-of-Life Node.js Versions ↗

    The Node.js Project will soon issue a CVE for EOL versions of Node.js such as Node.js 16 — which is still downloaded 11 million times per month.

    You can run is-my-node-vulnerable to check if you are using an EOL version of any version with a CVE issued to it.

    npx is-my-node-vulnerable

    These versions are supported as of this writing:

    • Node.js 23 (Current)
    • Node.js 22 (LTS)
    • Node.js 20 (Maintenance LTS)
    • Node.js 18 (Maintenance LTS)

    Why issue a CVE? Node.js aims to warn users by issuing a CVE:

    • Raise Awareness: Inform users that running EOL versions exposes their applications to potential vulnerabilities.
    • Encourage Upgrades: Prompt organizations and developers to update to actively supported Node.js versions.
    • Improve Security: Reduce the number of applications running outdated and unsupported versions of Node.js.
  • 95% Conviction ↗

    Neil Panchal of U.S. Graphics, who recently released the excellent Berkeley Mono 2.0 typeface for professionals:

    Not a fan of “building in public” culture. You end up creating an average of all loud opinions, burn yourself to mediocrity by pleasing everyone—sacrificing originality. The end result will be made by the people for the people, not by the artist.

    Feedback is useful if it is objective. It kills if it is subjective. Accept/Ignore either, it will chip away at your conviction.

    I think a good operating scheme is 95% conviction, 5% feedback. Or may be even 99%.

    The designer who voluntarily presents his client with a batch of layouts does so not out prolificacy, but out of uncertainty or fear. He thus encourages the client to assume the role of referee.

    Paul Rand

    In 1993, Steve Jobs recalled working with Paul Rand to create the NeXT brand:

    I asked him if he would come up with a few options, and he said, ‘No, I will solve your problem for you. And you will pay me.’

    Via X
  • React Hook Form vs. Formik ↗

    This discussion on X favors React Hook Form over Formik due to Formik falling behind with features and performance. Also some goodies for why native form handling isn’t yet good enough: you cannot style native validation errors.

    The preference for React Hook Form isn’t too surprising as it’s also supported by Vercel.

  • How to hire the best people you’ve ever worked with ↗

    Marc Andreessen, co-founder of Netscape and Andreessen Horowitz, on driven people:

    I define drive as self-motivation—people who will walk right through brick walls, on their own power, without having to be asked, to achieve whatever goal is in front of them. 

    People with drive push and push and push and push and push until they succeed. 

    Winston Churchill after the evacuation of Dunkirk:

    “We shall not flag or fail. We shall go on to the end, we shall fight in France, we shall fight on the seas and oceans, we shall fight with growing confidence and growing strength in the air, we shall defend our Island, whatever the cost may be, we shall fight on the beaches, we shall fight on the landing grounds, we shall fight in the fields and in the streets, we shall fight in the hills; we shall never surrender.”

    Winston Churchill

    That’s what you want.

  • Introducing a ViewTransition component in React ↗

    View Transitions in React may be coming soon with this newly opened PR by Sebastian Markbåge.

    Conceptually the <ViewTransition> component is like a DOM fragment that transitions its children in its own isolate/snapshot. The API works by wrapping a DOM node or inner component:

    import { ViewTransition } from 'react';
    
    <ViewTransition>
      <Component />
    </ViewTransition>

    The default is name="auto" which will automatically assign a view-transition-name to the inner DOM node. That way you can add a View Transition to a Component without controlling its DOM nodes styling otherwise.

    Via X