10JS - 10JS - Issue #93 - Newsletterest

10JS - Issue #93

By Yanis • Issue #93 • View online

The happy second week of November, everyone!

I hope you are doing well.

The Christmas season seems to get started earlier every year. My wife already tortures me with a long list of absolutely unbearable songs, including those by Mariah Carey and George Michael (you all know what I’m talking about).

So the dark times are coming.

Brace yourself.

But we will get through ✊🎄

$ sudo rm -rf / === npm install

It’s been a tough week for web security. This week we have seen the popular coa npm library hijacked to install malicious software collecting the login info.

The author makes his point that nowadays, it’s too easy to execute malicious code on your machine just by using npm.

Our projects contain hundreds of packages, most of which are transitive dependencies. It’s only a question of time when some of it blows up.

One of the precautions suggested on the HackerNews discussion page is to set `{npm, yarn} config set ignore-scripts true` configuration, which prevents any package from executing any scripts.

ghuntley.com • Share

SemVer: The Tricky Parts

Semantic versioning is not as straightforward as it seems. First of all, the rules that affect the version of the package only talk about the API that is, the public behavior. But what if you made a refactoring? Should you upgrade the patch version in this case? Are there bug fixes that should change the minor version? There’s a long list. The author of the article answers those questions.

thoughtspile.github.io • Share

Exclusive Or and the Optional never Trick

Just today, my favorite TypeScript guru and the author of the Effective TypeScript book published a new article after a long delay. As usual, it’s highly educative.

💡 Also, I didn’t know about this beautiful library with tons of TypeScript helpers.

effectivetypescript.com • Share

An introduction to atomic state management libraries in React

Here’s your quick introduction to the atomic state. This is to say a new fancy technique which seems to allow to manually manage which component depends on what “atom” of the state (by subscribing to changes) and that way providing several benefits: avoiding extra re-renderings, composability capabilities, etc.

I didn’t quite yet form my opinion about this new approach to state management. I’m pretty sure though there are use-cases, where those techniques are perfectly valid.

dev.to • Share

Publications That Pay You To Write Technical Articles

Do you know you could make good money by writing tech articles? Catalin Pit collected a nice list of the websites that pay you $200-$500 per article. Could be a good opportunity to get some extra money and pay off that mortgage a bit earlier 😄

catalins.tech • Share