Node.js 20 is now available
nodejs.org
nodejs.org
I have been confused recently with the moving best practices. What is the server architecture Next.js is most often plugged into?
expressjs at this point is battle-tested, minimal, easy to understand (both in usage and internals) and have a huge community still. It's very mature and does what it does well.
Since iirc you send responses directly from handlers in Express, I'm not sure the latter is possible even with express-promise-router since you basically need downstream routes/middleware to return a Response object rather than send it directly.
I think Express is never going to unify with Koa's direction since it's just too disruptive to Express' ecosystem (the v5.x branch is stale) which is probably for the best.
const db = {
async getUsers() {
throw new Error("failed to connect to database");
},
};
app.get("/", async (req, res) => {
const result = await db.getUsers();
return result;
});
> Starting with Express 5, route handlers and middleware that return a Promise will call next(value) automatically when they reject or throw an error. For example:
> app.get('/user/:id', async (req, res, next) => { const user = await getUserById(req.params.id); res.send(user) })
> If getUserById throws an error or rejects, next will be called with either the thrown error or the rejected value. If no rejected value is provided, next will be called with a default Error object provided by the Express router.
There hasn't been a new beta in a long time. Last release about a year ago and then the 1 before that about 3 years ago. Not a very convincing beta.
The maintainer said this three months ago in a comment on that issue:
> Express 5 is pretty much completed at this point, and we're just finishing up the last code merges in upstream modules in order to bump the dependencies finally in the 5.0 branch.
Like how Windows XP on an old computer still "works just fine"?
What does work just fine in terms of software that's ever updating mean? It doesn't matter if it's called 4 or 5 or any other label.
On the comments: my point is more that we should not base the NodeJs standard on something that's not regularly maintained / updated. There are infinite amount of things that can be improved on for a "standard" server framework used by millions. You don't say Node "is done" and leave it? People would definitely fork it or move on (as happened in the past).
Is it? It performs slower than e.g. Fastify. Don't see how that's doing well.
> Who cares how old something is, if it works well, why not use it?
It doesn't. That's the whole point. Software is always evolving and I doubt it's even close to complete. There hasn't been meaningful updates to Express in a long time. Why do people use it and/or promote it as a standard?
It's such a marginal difference when you consider real-life applications built with either express or Fastify though. Seldom is the actual bottleneck which HTTP library you use (unless you're at a really, really, really big scale), and more about how you structure your code, database and general architecture. I can count on one hand the number of times I've had to care deeply about the HTTP stack in order to optimize something, while I've probably had to optimize 100s of web products over the years, all done without touching the HTTP parts at all.
> It doesn't. That's the whole point. Software is always evolving and I doubt it's even close to complete. There hasn't been meaningful updates to Express in a long time. Why do people use it and/or promote it as a standard?
How to handle HTTP requests kind of doesn't. HTTP 1.1 continues to work, and will continue to be sufficient for at least 90% of all the use cases on the web for a long time.
I know that the JS community generally suffers from "If it hasn't been updated in the last year, it's probably broken and not modern enough" syndrome, but some software actually end up being "finished" and good enough for the task at hand. What improvements could you actually add to express without breaking the API interface that millions of applications depend on? Sometimes stability is wanted and needed, and that's how you get mature software. Who wants to rewrite their application and architecture every time some library you happen to use decides to "improve" it?
If you take out your 386 and boot up Dos 3.1 it'll; continue to work too. Let's just not improve, right?
> but some software actually end up being "finished" and good enough for the task at hand
Like dead? Do you ever stop learning and growing? Are you "finished" too? There are new vulnerabilities, new compatibilities, existing bugs, different use cases, etc - you think it's finished = turning a blind eye.
> It's such a marginal difference when you consider real-life applications built with either express or Fastify though.
That's how we get Electron and everything become a resource hog. Oh it doesn't matter. Oh marginal difference. No don't recycle, don't do good for the environment and anything in life because it's all marginal. Why even reply? It's a marginal difference.
No, we can do better and will.
Because for the most part - it doesn't need them.
Can you build a better express? Maybe. Lots of folks are trying that still, and you're welcome to use the tooling they put out.
Is express dead? Hell no.
Express is well documented, well supported, getting security patches, and comes up entirely clean for a new install (including most of the optional packages you might add).
Express has some sharp edges (it's been mentioned plenty above, but mainly because the framework predates the wide adoption of native promises in the JS space), but again, they're well known and relatively straight forward to work around.
---
Long story short, this:
> It doesn't. That's the whole point. Software is always evolving and I doubt it's even close to complete. There hasn't been meaningful updates to Express in a long time. Why do people use it and/or promote it as a standard?
Is an ignorant take. People promote it because it's a good tool.
Next you'll be telling me that I shouldn't use Bash because Bash 5.0 came out in 2018 and only got two minor point releases over the next 5 years. But that sounds dumb, huh?
What's dumb is not being able to tell the difference. It's not about the numbers.
https://git.savannah.gnu.org/cgit/bash.git/ shows there are constant updates. Things are being worked on. Your example proves my whole point. There are updates every year for many years.
Express? Not so. There are many gaps in its history. And for a tool like Express that has way more surface area it is in need of a lot more testing and updating e.g. if NodeJs changes something it breaks.
Does Bash need to make sure it works with HTTP3, Brotli or many other things that came out? No.
> Because for the most part - it doesn't need them.
Right, let's go back to the Stone Age. You don't need clothes either - just a leaf. You're just so dismissive on innovation then why bother? You don't even need NodeJs. Back to assembly and punch cards...
> Is an ignorant take.
Yes, yours. As shown above by your example.
> People promote it because it's a good tool.
And how do you know that? Where are the stats? Or people just google for NodeJs server, see the top response being Express and just do that. The cycle then repeats. Have people promoting it actually benchmarked, compared and investigated all the tools before making this informed decision? I'm sure you've heard from each and everyone 1 of them to know the answer eh.
I thought this was slightly awkward due to error handling, but it looks like Express 5 (in beta) supports async callbacks natively.
Imo the docs need a major re-write, beginning at "getting started". New users don't know whether they should use "fastify-cli gen", "npm init fastify" or copy manually from the "getting started"-guide.
And people also tried to push their fastify-plugins to the top of the plugins-site by adding a "@username" for every plugin: https://i.imgur.com/hHyI6JO.png (left are the old docs, right are the current docs where ppl try to game the system).
Also, fastify-cli needs to rework the custom options in typescript projects imo.
Ok, that's all. Other than that, fastify rocks!
One thing nice about Koa is that it's simple, so it's timeless in that way—it's not a moving target nor does it try to do something that needs a lot of core maintainers.
They recently pushed their long awaited v5 update, which adds a Koa transport alongside the historic express transport, and improves the "code reuse between client & server" story for schemas/models/types.
I really like express + routing-controllers [1], if you're on typescript.
Express was really cool and different from what was out there at the time (at least in terms of simplicity and JS support).
But nowadays there's not a lot of difference between them. Sure, some are more ergonomic than others in certain areas but the patterns are almost the same in all of them.
The only exception is when I’m working inside an established Node shop where they already have a prolific framework, I’ll reach for what they already have in that case to avoid fragmenting their stack. Almost always, that’s express.
fastify is performant, thoughtfully designed, and well architected.
So I'd still say Express is the main choice. Personally I've never loved the Express API as it encourages a lot of heavy mutation (Koa does too), so I tend to be on the lookout for good alternatives - I haven't seen any that seem to be sticking (gaining significant enough community to bet on) more than Express.
There's a few things like Next/SvelteKit that cover all bases in one, from your web app backend -> SSR frontend -> client states, but if you're looking at pure backend for e.g. an API, Express is still going strong.
- With a bunch of middleware included and pre-configured, like body-parser, cookies, Helmet, etc. All express middleware works with Server.js
- async/await routers as expected: get('/users', async (ctx) => {...}); (ctx inspired by Koa)
- Websockets, where messages behave just as another route: socket('message', async ctx => { ... });
fastify https://www.fastify.io/
nest.js https://nestjs.com/
hapi.dev https://hapi.dev/
You write your own middleware stack, and router every time you start a new "typescript" server project?
Of course not. If you're not using a third party library you're using your own framework. The Node.js API is too barebone for any serious web application.
That is still framework nonsense. If I wanted framework nonsense I would just use a framework.
Architect serverless (https://arc.codes) is pretty good for serverless.
They added the feature to "enabl[e] developers to transition from existing Node projects with ease."
I generally chose tape/ava in the past and vitest these days, but it’s awesome that now a very simple testing mechanism is available in core
Another reason Jest is slow is due to how it's usually configured to build code using Babel or tsc. Like vitest, you can configure Jest to use esbuild which makes it much faster than using Babel or tsc.
I am not a big Jest fan, but it seems like the most pragmatic test runner when you have 100+ engineers working on a project.
The refactoring of expect to a reusable library (that hopefully everyone could depend on) would be awesome as well. AFAIK there are multiple expect() implementations out there right now, would be nice if there was one.
Currently I use vitest and https://github.com/jest-community/jest-extended which gets you a reasonable amount of usable matchers.
expect(me).to.barf.when(i.see(shit.like(this)));assert(Object.is(foo.bar(), baq));
(where assert is magic that fails woth a friendly message when it's argument is falsy.
If you expect `assert(...)` to be magic enough to provide diffing and smart error messages because it's actually some kind of macro... then I guess we have different views on magic.
My point about completion is that if you do expect(a).<tab> with a smart library, the library can complete the list of assertions that apply to the type of `a`. Eg, if `a` is an Iterable, a good assertion library could complete `expect(a).toInclude(`. Jest doesn't do type-narrowed assertions (sad) but it could.
The macro isn't deeply magic, it just prints the text of the tokens passed to it (ie foo.bar()) alongside the value. assert_eq can add a diff.
Sure the error message isn't perfect, so you stick a console.log or two in your test and run it again if you're confused.
Falling back to manual debugging is essentially admitting the test framework isn't helpful.
I think expect(a).toXXX(b) will provide better velocity for most engineering teams. I'd rather see a detailed failure message at the end of a 15 minute CI run than an unhelpful one that needs code edits to understand. Especially as the team & codebase have grown, I've found the detailed failure messages helpful when people ask for assistance – experts are more likely to figure things out on sight, turning tens-of-minutes-to-resolve into seconds-to-resolve.
> The benefit of this style are better error messages. Instead of just “false is not true”, the testing framework can print values for x and y.
> I don’t find this useful. Using the check style testing, there are very few assertions actually written in code. Usually, I start with plain asserts without messages. The first time I debug an actual test failure for a particular function, I spend some time to write a detailed assertion message. To me, fluent assertions are not an attractive point on the curve that includes plain asserts and hand-written, context aware explanations of failures. A notable exception here is pytest approach — this testing framework overrides the standard assert to provide a rich diff without ceremony.
I was doing this to show people I could do it. I wasn't thinking of the people using my software but rather myself.
It's close enough to English that my brain tries to context switch from coding to writing English, but it's not close enough for that to actually work. It feels like I end up fighting my own mind.
I'm glad somebody has tried it so we know what it looks like, but personally I prefer the more "traditional" syntax.
Deno and Node are converging more and more on every release, such a deja vu. The main difference being that deno offers much more as a business than just the "deno" product itself, so an eventual merge wouldn't be so trivial.
Denode or Nodeno? Who wants to place bets?
Hopefully, NodeJS learned from the whole Npm Inc history and tries to remain more independent from for-profit companies.
The whole io.js thing was a very different thing than Deno. Contributors tired of slow pace of NodeJS forked NodeJS into another FOSS version, with no for-profit motives, which meant it could eventually be merged back once the people behind the two projects reconciled.
It made us see a world where javascript can be (much more) secure and typed without a compilation step, and this is an important contribution I would like to still acknowledge.
Now the fact that NodeJS is learning from Deno and making strides to support capabilities (are you related? lol) is extremely exciting to me and it will surely improve the state of the Javascript/Typescript ecosystem and pull along a lot of projects/devs who would never have moved to something like this purely due to inertia and dev cost. One can dream.
> NodeJS is a FOSS project under the Linux foundation
Deno is not maintained by a non-profit organization, and Deno Land Inc are unlikely to want to let someone else control their project, that'd be kind of suicidal.
> is not driven by profit
The organization who maintain Deno is explicitly for-profit, meaning it has to be driven by profit. If they give the project to the Linux Foundation, I guess that could change, but again, unlikely they'd do something like that.
> NodeJS learned from the whole Npm Inc history and tries to remain more independent from for-profit companies
Deno arguably did learn from that story and did package management differently. They didn't avoid the whole for-profit angle, as again, the maintainers are working for a incorporation.
> Contributors tired of slow pace of NodeJS
As far as I can tell as an outsider, Deno seems to be moving forward at a decent speed and I haven't seen any noise in their community about a possible fork because of slow development pace.
But it shouldn't matter whether or not they want it. You can fork Deno right now, change nothing but the name, and sell it as a commercial product. The MIT licence permits that. iirc SQLite is a private organisation that produces a public domain product. Should we quake in our boots and boycott SQLite? Nothing is stopping the proverbial io.js from drawing a line in the sand, forking Deno or SQLite, changing the name, and taking it from there.
EDIT: Similarly, React and React native are open source but controlled by Facebook. Swift is an open source programming language that's controlled by Apple. .NET Core is open source but controlled by Microsoft. Docker is open source but controlled by Docker Inc. MongoDB is open source but controlled by MongoDB Inc. GitLab is open source but controlled by GitLab Inc. OpenJDK is open source but controlled by Oracle. Redis is open source but controlled by Redis Labs.
This. Microsoft owns NPM so it basically owns Node.js ecosystem.