What’s New in Node.js 20 — SitePoint

Model 20 of Node.js was launched on 18 April 2023. It addresses some points and criticisms already “solved” by Deno and Bun, together with a brand new permission mannequin and a secure native check runner. This text examines the brand new choices accessible to builders utilizing the world’s most-used JavaScript runtime.

Contents:

1. The Node.js Launch Schedule
2. New Permission Mannequin
3. Native Take a look at Runner
4. Compiling a Single Executable Software
5. Up to date V8 JavaScript Engine
6. Miscellaneous Updates

The Node.js Launch Schedule

Node.js has a six-month launch schedule:

• The April even-numbered releases (14, 16, 18, and so forth.) are secure and obtain long-term assist (LTS) updates for 3 years.

• The October odd-numbered launch (15, 17, 19, and so forth.) are extra experimental and updates usually finish after one yr.

Generally, you must go for the even-numbered LTS model until you require a selected function in an experimental launch and intend to improve later. That stated, Node.js 20 is new and the web site advises you proceed with model 18 whereas the event crew fixes any late-breaking points.

Node.js 20 has the next new options …

New Permission Mannequin

Operating node somescript.js is just not with out danger. A script can do something: delete important recordsdata, ship non-public information to a server, or run a cryptocurrency miner in a baby course of. It’s troublesome to ensure your individual code received’t break one thing: are you able to make sure that every one modules and their dependencies are secure?

The brand new (experimental) Node.js Permission Mannequin restricts what script can do. To make use of it, add the --experimental-permission flag your node command line adopted by:

1. --allow-fs-read to grant read-access to recordsdata. You’ll be able to restrict read-access to:

   • particular directories: --allow-fs-read=/tmp/
   • particular recordsdata: --allow-fs-read=/house/me/information.json
   • or wildcard file patterns: --allow-fs-read=/house/me/*.json

2. --allow-fs-write to grant write-access to recordsdata with similar listing, file, or wildcard patterns.

3. --allow-child-process to allow youngster processes similar to executing different scripts maybe written in different languages.

4. --allow-worker to allow employee threads, which execute Node.js code in parallel to the principle processing thread.

Within the following instance, somescript.js can learn recordsdata within the /house/me/information/ listing:

node --experimental-permission --enable-fs-learn=/house/me/information/ somescript.js

Any try to put in writing a file, execute one other course of, or launch an online employee raises a ERR_ACCESS_DENIED error.

You’ll be able to examine permissions inside your utility utilizing the brand new course of.permission object. For instance, right here’s the way to examine whether or not the script can write recordsdata:

course of.permission.has('fs.write');

Right here’s the way to examine if the script can write to a selected file:

if ( !course of.permission.has('fs.write', '/house/me/mydata.json') ) {
  console.error('Can not write to file');
}

JavaScript permission administration was first launched by Deno, which presents fine-grained management over entry to recordsdata, atmosphere variables, working system data, time measurement, the community, dynamically-loaded libraries, and youngster processes. Node.js is insecure by default until you add the --experimental-permission flag. That is much less efficient, however ensures current scripts proceed to run with out modification.

Native Take a look at Runner

Traditionally, Node.js has been a minimal runtime so builders may select what instruments and modules they required. Operating code assessments required a third-party module similar to Mocha, AVA, or Jest. Whereas this resulted in loads of selections, it may be troublesome to make the finest choice, and switching instruments might not be simple.

Different runtimes took an alternate view and supplied built-in instruments thought of important for growth. Deno, Bun, Go, and Rust all provide built-in check runners. Builders have a default selection however can go for an alternate when their challenge has particular necessities.

Node.js 18 launched an experimental check runner which is now secure in model 20. There’s no want to put in a third-party module, and you’ll create check scripts:

• in your challenge’s /check/ listing
• by naming the file check.js, check.mjs, or check.cjs
• utilizing test- originally of the filename — similar to test-mycode.js
• utilizing check on the finish of the filename with previous interval (.), hyphen (-) or underscore (_) — similar to mycode-test.js, mycode_test.cjs, or mycode.check.mjs

You’ll be able to then import node:check and node:assert and write testing features:

import { check, mock } from 'node:check';
import assert from 'node:assert';
import fs from 'node:fs';

check('my first check', (t) => {
  assert.strictEqual(1, 1);
});

check('my second check', (t) => {
  assert.strictEqual(1, 2);
});


mock.methodology(fs, 'readFile', async () => 'Node.js check');
check('my third check', async (t) => {
  assert.strictEqual( await fs.readFile('anyfile'), 'Node.js check' );
});

Run the assessments with node --test check.mjs and study the output:

✔ my first check (0.9792ms)
✖ my second check (1.2304ms)
  AssertionError: Anticipated values to be strictly equal:

  1 !== 2

      at TestContext.<nameless> (check.mjs:10:10)
      at Take a look at.runInAsyncScope (node:async_hooks:203:9)
      at Take a look at.run (node:inner/test_runner/check:547:25)
      at Take a look at.processPendingSubtests (node:inner/test_runner/check:300:27)
      at Take a look at.postRun (node:inner/test_runner/check:637:19)
      at Take a look at.run (node:inner/test_runner/check:575:10)
      at async startSubtest (node:inner/test_runner/harness:190:3) {
    generatedMessage: false,
    code: 'ERR_ASSERTION',
    precise: 1,
    anticipated: 2,
    operator: 'strictEqual'
  }

✔ my third check (0.1882ms)
ℹ assessments 3
ℹ move 2
ℹ fail 1
ℹ cancelled 0
ℹ skipped 0
ℹ todo 0
ℹ duration_ms 72.6767

You’ll be able to add a --watch flag to mechanically re-run assessments when the file adjustments:

node --test --watch check.mjs

You may as well run all assessments discovered within the challenge:

node --test

Native testing is a welcome addition to the Node.js runtime. There’s much less have to study totally different third-party APIs, and I not have an excuse when forgetting so as to add assessments to smaller tasks!

Compiling a Single Executable Software

Node.js tasks require the runtime to execute. This generally is a barrier when distributing purposes to platforms or customers who can’t simply set up or preserve Node.js.

Model 20 presents an experimental function which lets you create a single executable utility (SEA) that you could deploy with out dependencies. The guide explains the method, though it’s a bit convoluted:

1. You will need to have a challenge with a single entry script. It should use CommonJS slightly than ES Modules.

2. Create a JSON configuration file used to construct your script right into a blob which runs contained in the runtime. For instance, sea-config.json:

   {
     "foremost": "myscript.js",
     "output": "sea-prep.blob"
   }
   

3. Generate the blob with node --experimental-sea-config sea-config.json.

4. In keeping with your OS, you have to then copy the node executable, take away the binary’s signature, inject the blob into the binary, re-sign it, and check the ensuing utility.

Whereas it really works, you’re restricted to older CommonJS tasks and may solely goal the identical OS as you’re utilizing. It’s sure to enhance, given the superior Deno compiler can create an executable for any platform in a single command from JavaScript or TypeScript supply recordsdata.

You also needs to concentrate on the ensuing executable’s file dimension. A single console.log('Howdy World'); generates a file of 85MB, as a result of Node.js (and Deno) have to append the entire V8 JavaScript engine and normal libraries. Choices to scale back file sizes are being thought of, but it surely’s unlikely to go under 25MB.

Compilation received’t be sensible for small command-line instruments, but it surely’s a extra viable choice for bigger tasks similar to a full internet server utility.

Up to date V8 JavaScript Engine

Node.js 20 contains the most recent model of the V8 engine, which incorporates the next JavaScript options:

Miscellaneous Updates

The next updates and enhancements are additionally accessible:

Abstract

Node.js 20 is a serious step ahead. It’s a extra important launch, and implements a few of Deno’s higher options.

Nonetheless, this begs the query: do you have to use Deno as a substitute?

Deno is nice. It’s secure, natively helps TypeScript, reduces growth instances, requires fewer instruments, and receives common updates. On the draw back, it’s been round much less time, has fewer modules, they usually’re usually shallower imitations of Node.js libraries.

Deno and Bun are price contemplating for brand new tasks, however there are literally thousands of current Node.js purposes. Deno and Bun are making it simpler to transition code, however there received’t at all times be a transparent benefit for shifting away from Node.js.

The excellent news is we’ve a thriving JavaScript ecosystem. The runtime groups are studying from one another and speedy evolution advantages builders.