and the future

of JavaScript

NEJS Conf, 2018-07-27

https://slides.com/seldo/future-of-javascript

Read these slides on your device:

Who is this guy?

Laurie Voss

COO & co-founder, npm Inc.

@seldo

What are we talking about?

Part 1:

What you should know about npm

npm and the future of JavaScript

Part 2:

What npm knows about you

npm and the future of JavaScript

(Creepy!)

Part 3:

The future of JavaScript

npm and the future of JavaScript

npm is popular

Part 1: what you should know about npm

JavaScript is enormously popular

Top 5 languages on GitHub

by number of pull requests opened

npm is the package manager for all JavaScript

• 93% in the browser
• 70% on the server
• 44% on mobile devices
• 6% on embedded platforms

But npm is especially for web developers

97% of the code in a modern web app comes from npm

npm is super fast now

Upgrade right now!

npm install npm -g

Wait, is it faster

than yarn?

package.community

npm 6

locks by default

npm 6

saves by default

3. npm ci will double the speed of your builds

npm ci

You can use

anywhere you used to use

npm install

and it will be twice as fast

npm Security

A bunch of new features

npm 6 has 2FA:

two-factor auth

http://go.npm.me/2fa

Secure your npm account in 30 seconds:

npm Quick Audits

Just run npm install!

npm Quick Audit stats

• 3.5 million scans per week
• 51% vulnerable
• 37% high
• 11% critical

Yikes!

npm audit

Just run in your current project:

npm audit

Learn more:

http://go.npm.me/audits

npm audit fix

Just run in your current project:

npm audit fix

or

npm audit fix --force

for the adventurous

npm.community

npx

npx create-react-app

Try it out!

Other new npm stuff

• Everybody gets a @scope!
• Organizations are free!
• Run scripts will save you time!
• npm init can standardize setup for you!
• Other stuff, probably!
• Maybe you should read our blog!
• Or follow us on Twitter: @npmjs!

npm is a company that sells good and services that you will find useful

Part 2:

What npm knows about you

• 1.5 billion log events per day
• 16,000+ survey responses

Part 2A: demographics

Please stand up!

(If you can't stand up, raise a hand)

Sit down if you don't match the description.

Stay standing if you

use npm

Stay standing if you

write JavaScript that runs in browsers

Stay standing if you

write JavaScript

at work

Stay standing if you

are concerned about security of open source code

Stay standing if you

mostly taught yourself JavaScript

Stay standing if you

also write PHP or Java sometimes

Stay standing if you

work at a company that isn't considered a "tech company"

So we know some stuff about you

npm is for websites you build at work

npm users don't always write JavaScript

The programming language you pick is determined by the libraries available

http://sns.cs.princeton.edu/docs/asr-oopsla13.pdf

Users pick JavaScript because of npm

npm users are concerned about security

• 77% are concerned
• 52% said current tools aren't adequate

npm Enterprise can help your security

npm users

also use Yarn

npm 6

is safer than Yarn

npm recommends using npm

https://mixmax.com/blog/to-yarn-and-back-again-npm

https://npm.im/deyarn

Yarn to npm migration tool:

A user journey from Yarn back to npm:

npm users are mostly new

• 25% have been using JavaScript < 2 years
• 51% have been using npm < 2 years

People are still learning about npm!

npm users work

at every size of company

npm users work in every industry

Only 45% of npm users describe themselves as "in tech"

Part 2B:

the tools we use

I am about to make you angry

with graphs

Growth in context

Everything in npm grows

Share of registry

Front end frameworks

Frameworks never die; they only fade away

React

60% of npm users say they use React

Preact

Is it stealing React's thunder?

Angular

Angryler

Angular is seeing fewer downloads,

please don't yell at me about it.

Ember

The comeback kid

Vue

The next big thing?

So what should I pick?

I'll tell you at the end.

The React ecosystem

React Router

React is a triumph of modular design

Flux

Redux

MobX

RxJS

What on earth...?

RxJS has non-React uses

I guess that's it?

GraphQL

Back-end frameworks

Koa

Sails

Hapi

Ironically, they're not happy with us at all.

Next.js

This looks weird

Next.js since relaunch

Team A / Team B

Tooling

Everyone would like less tooling

What tools do we use?

Frameworks

Transpilers

46% of npm users are using TypeScript

Linters

So about ESLint...

The ESLint Credentials Harvester

😱

npm Security

in action

😊

Take JavaScript security seriously

😐

Bundlers

Testing

Splitting developers by experience

Best practices come with experience

Security is associated with experience

Part 3:

the future of JavaScript

Learning from history:

nothing last forever

jQuery, we barely knew ye.

Front-end frameworks

Ill-advised prediction

Modularity drives all

Ill-advised prediction

Will React be reusable enough to last?

Ill-advised prediction

A good collection of modules is self-perpetuating

Ill-advised prediction

What about that slowdown in React?

Ill-advised prediction

What should I do?

Pick React.

Ill-advised prediction

Pick Angular

Ill-advised prediction

Pick Vue

Ill-advised prediction

Pick Ember

Ill-advised prediction

Pick Next.js

Ill-advised prediction

Pick GraphQL

Ill-advised prediction

You will be bundling, transpiling and linting for quite some time

Ill-advised prediction

Use TypeScript

Ill-advised prediction

What happens to npm in the future?

npm is not only JavaScript

and it hasn't been for some time

WASM is coming

WASM is already here

https://hacks.mozilla.org/2018/04/hello-wasm-pack/

npm is for the web

The future looks fun

The web will remain under construction

Thank you!

https://slides.com/seldo/future-of-javascript

@seldo

These slides

Talk to me