jay-esのブックマーク - はてなブックマーク

Choosing the best Node.js Docker image | Snyk
Updated recommended Node.js version, examples and vulnerability scan results to reflect the up-to-date Node.js LTS releases Choosing a Node.js Docker image may seem like a small thing, but image sizes and potential vulnerabilities can have dramatic effects on your CI/CD pipeline and security posture. So, how do you choose the best Node.js Docker image? It can be easy to miss the potential risks of
jay-es 2022/10/15
node:16.17.0-bullseye-slim の形が理想的。ただの node はフルサイズなので推奨されない。:latest より :lts が望ましく、バージョン指定はさらによい。buster(Debian10) は 2024 年にサポート終了。alpine は互換性の問題あり。

Docker

Node.js
リンク
Best practices for creating a modern npm package with security in mind | Snyk
Techno logy is always changing and your processes and practices need to keep up with those changes. So while npm is 12 years old, your practices around npm package creation should hopefully be a lot more modern. If you have a feeling they may be a little out of date, though, keep reading. In this tutorial, we’re going to walk step by step through creating an npm package using modern best practices
jay-es 2022/09/15
CJS と ESM 両方に対応させる。ユニットテストを書いて CI で実行。Snyk （この記事のプロダクト）などを使ってセキュリティーチェック。GitHub Actions + Semantic Release でリリースを自動化

npm

best practices
リンク
Choose the best package - Snyk Open Source Advisor
Popularity Understand the prevalence of an open source package using metrics such as downloads and source code repository stars to measure popularity. Maintenance Get insights about an open source dependency health and assess the sustainability of the project. Security Quickly assess the security posture of an open source project and its past versions. Further connecting your project with Snyk wil
jay-es 2021/12/21
バッケージの人気、脆弱性、メンテされているか、類似パッケージなど。npm, PyPI, Docker を検索できる

package

npm

技術選定

Webサービス
リンク
1