Ulises Gascón
@ulisesgascon.com
#OpenSource Maintainer (@nodejs.org, @expressjs.bsky.social, Lodash, Yeoman...), #TC39 Delegate and #Maker | He/Him
Pinned
Ulises Gascón
@ulisesgascon.com
· Nov 11
🌍 Hello, BlueSky! 🤠
I'm Ulises Gascón from Spain! Passionate about #Nodejs, #Express, #JavaScript, and the world of #OpenSource.
I spend my days building, maintaining, and improving tools and libraries for our #devCommunity 🫶
👉 Check out my projects and support my work:
github.com/sponsors/Uli...
I'm Ulises Gascón from Spain! Passionate about #Nodejs, #Express, #JavaScript, and the world of #OpenSource.
I spend my days building, maintaining, and improving tools and libraries for our #devCommunity 🫶
👉 Check out my projects and support my work:
github.com/sponsors/Uli...
Just shipped a new newsletter to my GitHub Sponsors! 🎁
This one includes my latest talk, secure publishing research, #Expressjs and #OSSF #Scorecard updates, and a bunch of ecosystem news.
It will be public soon, but you can read it early and support my OSS work here: github.com/sponsors/Uli...
This one includes my latest talk, secure publishing research, #Expressjs and #OSSF #Scorecard updates, and a bunch of ecosystem news.
It will be public soon, but you can read it early and support my OSS work here: github.com/sponsors/Uli...
December 3, 2025 at 3:43 PM
Just shipped a new newsletter to my GitHub Sponsors! 🎁
This one includes my latest talk, secure publishing research, #Expressjs and #OSSF #Scorecard updates, and a bunch of ecosystem news.
It will be public soon, but you can read it early and support my OSS work here: github.com/sponsors/Uli...
This one includes my latest talk, secure publishing research, #Expressjs and #OSSF #Scorecard updates, and a bunch of ecosystem news.
It will be public soon, but you can read it early and support my OSS work here: github.com/sponsors/Uli...
Security incident? Don’t panic. Have a plan. 🤝
A clear incident response plan keeps open source projects steady when things go wrong 😏
www.youtube.com/shorts/mqPlC...
A clear incident response plan keeps open source projects steady when things go wrong 😏
www.youtube.com/shorts/mqPlC...
Incident Response Plan
YouTube video by OpenJS Foundation
www.youtube.com
December 2, 2025 at 9:03 PM
Security incident? Don’t panic. Have a plan. 🤝
A clear incident response plan keeps open source projects steady when things go wrong 😏
www.youtube.com/shorts/mqPlC...
A clear incident response plan keeps open source projects steady when things go wrong 😏
www.youtube.com/shorts/mqPlC...
Reposted by Ulises Gascón
Woah. String.prototype.startsWith() supports two arguments:
"my string".startsWith("string", 3) => true
I had no idea this was possible.
developer.mozilla.org/en-US/docs/W...
"my string".startsWith("string", 3) => true
I had no idea this was possible.
developer.mozilla.org/en-US/docs/W...
a man with glasses is surrounded by a glowing circle and the website pmitf.com is displayed below him
ALT: a man with glasses is surrounded by a glowing circle and the website pmitf.com is displayed below him
media.tenor.com
December 2, 2025 at 1:51 PM
Woah. String.prototype.startsWith() supports two arguments:
"my string".startsWith("string", 3) => true
I had no idea this was possible.
developer.mozilla.org/en-US/docs/W...
"my string".startsWith("string", 3) => true
I had no idea this was possible.
developer.mozilla.org/en-US/docs/W...
🚨 We’ve published our Nov security update, including moderate fix for body-parser.
expressjs.com/2025/12/01/s...
expressjs.com/2025/12/01/s...
November 2025 Security Releases
Security release for body-parser has been published. We recommend that all users upgrade as soon as possible.
expressjs.com
December 1, 2025 at 3:37 PM
🚨 We’ve published our Nov security update, including moderate fix for body-parser.
expressjs.com/2025/12/01/s...
expressjs.com/2025/12/01/s...
Reposted by Ulises Gascón
📣 New WebPerf Snippet
Analyze all @media rules in CSS to identify classes and properties targeting viewports bigger than a specified breakpoint. Results are grouped by inline CSS and external files, with byte size estimates for potential mobile savings.
#WebPerfSnippets #WebPerf
Analyze all @media rules in CSS to identify classes and properties targeting viewports bigger than a specified breakpoint. Results are grouped by inline CSS and external files, with byte size estimates for potential mobile savings.
#WebPerfSnippets #WebPerf
November 30, 2025 at 7:33 PM
📣 New WebPerf Snippet
Analyze all @media rules in CSS to identify classes and properties targeting viewports bigger than a specified breakpoint. Results are grouped by inline CSS and external files, with byte size estimates for potential mobile savings.
#WebPerfSnippets #WebPerf
Analyze all @media rules in CSS to identify classes and properties targeting viewports bigger than a specified breakpoint. Results are grouped by inline CSS and external files, with byte size estimates for potential mobile savings.
#WebPerfSnippets #WebPerf
🚨 Moderate-severity security fix in body-parser@2.2.1 just released!
- Patches CVE-2025-13466 — vulnerable to denial of service when url encoding is used
github.com/expressjs/bo...
- Patches CVE-2025-13466 — vulnerable to denial of service when url encoding is used
github.com/expressjs/bo...
Release v2.2.1 · expressjs/body-parser
Important: Security
Security fix for CVE-2025-13466 (GHSA-wqch-xfxh-vrr4)
What's Changed
ci: add dependabot by @Phillip9587 in #593
ci: use full SHAs for github action versions by @Phillip9587 i...
github.com
November 24, 2025 at 6:44 PM
🚨 Moderate-severity security fix in body-parser@2.2.1 just released!
- Patches CVE-2025-13466 — vulnerable to denial of service when url encoding is used
github.com/expressjs/bo...
- Patches CVE-2025-13466 — vulnerable to denial of service when url encoding is used
github.com/expressjs/bo...
✍️ El open source no falla por el código.
Falla por problemas de gobernanza, burnout y trabajo invisible.
He escrito sobre lo que aprendí trabajando en #Expressjs y #Lodash:
blog.ulisesgascon.com/el-open-sour...
Falla por problemas de gobernanza, burnout y trabajo invisible.
He escrito sobre lo que aprendí trabajando en #Expressjs y #Lodash:
blog.ulisesgascon.com/el-open-sour...
El open source no falla por el código
Nos gusta culpar al código cuando el open source se rompe. La realidad es más incómoda: gobernanza, burnout y trabajo invisible son las verdaderas líneas de fractura. Esto es lo que aprendí trabajando...
blog.ulisesgascon.com
November 24, 2025 at 8:24 AM
✍️ El open source no falla por el código.
Falla por problemas de gobernanza, burnout y trabajo invisible.
He escrito sobre lo que aprendí trabajando en #Expressjs y #Lodash:
blog.ulisesgascon.com/el-open-sour...
Falla por problemas de gobernanza, burnout y trabajo invisible.
He escrito sobre lo que aprendí trabajando en #Expressjs y #Lodash:
blog.ulisesgascon.com/el-open-sour...
✍️ Open source doesn’t fail because of code.
It fails because of governance gaps, burnout, and invisible work.
I wrote down what I learned working on #Expressjs and #Lodash
blog.ulisesgascon.com/open-source-...
It fails because of governance gaps, burnout, and invisible work.
I wrote down what I learned working on #Expressjs and #Lodash
blog.ulisesgascon.com/open-source-...
Open Source Doesn’t Fail Because of Code!
We like to blame code when open source breaks. The reality is uglier: governance, burnout and invisible work are the real fault lines. This reflects what I learned during our work on Express and Lodas...
blog.ulisesgascon.com
November 24, 2025 at 8:22 AM
✍️ Open source doesn’t fail because of code.
It fails because of governance gaps, burnout, and invisible work.
I wrote down what I learned working on #Expressjs and #Lodash
blog.ulisesgascon.com/open-source-...
It fails because of governance gaps, burnout, and invisible work.
I wrote down what I learned working on #Expressjs and #Lodash
blog.ulisesgascon.com/open-source-...
📺 ¿Qué viene después del caos?
Lecciones de revivir #Expressjs y reimaginar #Lodash.
www.youtube.com/watch?v=NHsI...
Lecciones de revivir #Expressjs y reimaginar #Lodash.
www.youtube.com/watch?v=NHsI...
Del caos a la transformación: los casos de Express y Lodash
YouTube video by Orbitant
www.youtube.com
November 21, 2025 at 3:32 PM
📺 ¿Qué viene después del caos?
Lecciones de revivir #Expressjs y reimaginar #Lodash.
www.youtube.com/watch?v=NHsI...
Lecciones de revivir #Expressjs y reimaginar #Lodash.
www.youtube.com/watch?v=NHsI...
Reposted by Ulises Gascón
ok so... I'm writing a book. It's called JavaScript In Depth (www.manning.com/books/javasc...) ... the first four chapters are available by Manning.
This has been a difficult project and will continue to be so. The reason is that it isn't a How To book that focuses only on how to use the langauge
This has been a difficult project and will continue to be so. The reason is that it isn't a How To book that focuses only on how to use the langauge
JavaScript in Depth - James M. Snell
Explore the inner workings of the world’s most popular programming language and enjoy the power and control that comes only from deep knowledge! In JavaScript in Depth, JavaScript and Node legend Jame...
www.manning.com
November 20, 2025 at 9:37 PM
ok so... I'm writing a book. It's called JavaScript In Depth (www.manning.com/books/javasc...) ... the first four chapters are available by Manning.
This has been a difficult project and will continue to be so. The reason is that it isn't a How To book that focuses only on how to use the langauge
This has been a difficult project and will continue to be so. The reason is that it isn't a How To book that focuses only on how to use the langauge
Reposted by Ulises Gascón
Before automated workflows, releasing @nodejs.org meant 20 manual steps. Now it’s one command. 👀
@ulisesgascon.com and @rafaelgss.dev share how the Node.js build team went from a rack of Raspberry Pis in someone’s garage to full release automation.
👉Build Team on GitHub: github.com/nodejs/build
@ulisesgascon.com and @rafaelgss.dev share how the Node.js build team went from a rack of Raspberry Pis in someone’s garage to full release automation.
👉Build Team on GitHub: github.com/nodejs/build
November 20, 2025 at 3:29 PM
Before automated workflows, releasing @nodejs.org meant 20 manual steps. Now it’s one command. 👀
@ulisesgascon.com and @rafaelgss.dev share how the Node.js build team went from a rack of Raspberry Pis in someone’s garage to full release automation.
👉Build Team on GitHub: github.com/nodejs/build
@ulisesgascon.com and @rafaelgss.dev share how the Node.js build team went from a rack of Raspberry Pis in someone’s garage to full release automation.
👉Build Team on GitHub: github.com/nodejs/build
Reposted by Ulises Gascón
On Cloud 9.0 😶🌫️
Release details ⇣
Release details ⇣
November 19, 2025 at 1:31 AM
On Cloud 9.0 😶🌫️
Release details ⇣
Release details ⇣
We’ve kicked off a discussion on selecting #Astro as the new foundation for the @expressjs.bsky.social website.
🎖️ The goal: simpler docs, better i18n, easier contributions, and long-term stability.
🔖 If you have thoughts, now’s the time to share: github.com/expressjs/di...
🎖️ The goal: simpler docs, better i18n, easier contributions, and long-term stability.
🔖 If you have thoughts, now’s the time to share: github.com/expressjs/di...
Technical decision: Selecting Astro for the new expressjs.com site · Issue #451 · expressjs/discussions
In today’s meeting, during the discussion about the technology for the website redesign, the following key points were considered: The need for a simple authoring experience, preferably based on Ma...
github.com
November 20, 2025 at 10:50 AM
We’ve kicked off a discussion on selecting #Astro as the new foundation for the @expressjs.bsky.social website.
🎖️ The goal: simpler docs, better i18n, easier contributions, and long-term stability.
🔖 If you have thoughts, now’s the time to share: github.com/expressjs/di...
🎖️ The goal: simpler docs, better i18n, easier contributions, and long-term stability.
🔖 If you have thoughts, now’s the time to share: github.com/expressjs/di...
Reposted by Ulises Gascón
ECMAScript excitement 😉
This week TC39 advanced these proposals 🎉
4️⃣ Intl.Locale Info
4️⃣ Iterator.concat
4️⃣ JSON.parse Source Text
3️⃣ Iterator.zip
2️⃣.7️⃣ Iterator.prototype.join
2️⃣.7️⃣ Promise.allKeyed
2️⃣ Error.captureStackTrace
2️⃣ Import Text
2️⃣ Object.keysLength
1️⃣ Intl Energy Units
1️⃣ Intl Unit Protocol
🧵
This week TC39 advanced these proposals 🎉
4️⃣ Intl.Locale Info
4️⃣ Iterator.concat
4️⃣ JSON.parse Source Text
3️⃣ Iterator.zip
2️⃣.7️⃣ Iterator.prototype.join
2️⃣.7️⃣ Promise.allKeyed
2️⃣ Error.captureStackTrace
2️⃣ Import Text
2️⃣ Object.keysLength
1️⃣ Intl Energy Units
1️⃣ Intl Unit Protocol
🧵
November 20, 2025 at 8:20 AM
ECMAScript excitement 😉
This week TC39 advanced these proposals 🎉
4️⃣ Intl.Locale Info
4️⃣ Iterator.concat
4️⃣ JSON.parse Source Text
3️⃣ Iterator.zip
2️⃣.7️⃣ Iterator.prototype.join
2️⃣.7️⃣ Promise.allKeyed
2️⃣ Error.captureStackTrace
2️⃣ Import Text
2️⃣ Object.keysLength
1️⃣ Intl Energy Units
1️⃣ Intl Unit Protocol
🧵
This week TC39 advanced these proposals 🎉
4️⃣ Intl.Locale Info
4️⃣ Iterator.concat
4️⃣ JSON.parse Source Text
3️⃣ Iterator.zip
2️⃣.7️⃣ Iterator.prototype.join
2️⃣.7️⃣ Promise.allKeyed
2️⃣ Error.captureStackTrace
2️⃣ Import Text
2️⃣ Object.keysLength
1️⃣ Intl Energy Units
1️⃣ Intl Unit Protocol
🧵
🍕 The slides for my talk “What Comes After Chaos?” are now available
Stories and lessons from reviving #ExpressJS and reimagining #Lodash.
✨ Thanks to #Orbitant for the invitation!
slides.ulisesgascon.com/what-comes-a...
Stories and lessons from reviving #ExpressJS and reimagining #Lodash.
✨ Thanks to #Orbitant for the invitation!
slides.ulisesgascon.com/what-comes-a...
What Comes After Chaos?
Lessons from Reviving Express and Reimagining Lodash
slides.ulisesgascon.com
November 19, 2025 at 6:12 PM
🍕 The slides for my talk “What Comes After Chaos?” are now available
Stories and lessons from reviving #ExpressJS and reimagining #Lodash.
✨ Thanks to #Orbitant for the invitation!
slides.ulisesgascon.com/what-comes-a...
Stories and lessons from reviving #ExpressJS and reimagining #Lodash.
✨ Thanks to #Orbitant for the invitation!
slides.ulisesgascon.com/what-comes-a...
Reposted by Ulises Gascón
In case you're curious... blog.cloudflare.com/18-november-...
Cloudflare outage on November 18, 2025
Cloudflare suffered a service outage on November 18, 2025. The outage was triggered by a bug in generation logic for a Bot Management feature file causing many Cloudflare services to be affected.
blog.cloudflare.com
November 18, 2025 at 11:50 PM
In case you're curious... blog.cloudflare.com/18-november-...
Reposted by Ulises Gascón
Security incident? Don’t panic. Have a plan. 🤝
@ulisesgascon.com explains how a clear incident response plan keeps open source projects steady when things go wrong in the latest JavaScript Security Snapshot.
Check out the Incident Response Plan here on GitHub: github.com/lodash/lodas...
@ulisesgascon.com explains how a clear incident response plan keeps open source projects steady when things go wrong in the latest JavaScript Security Snapshot.
Check out the Incident Response Plan here on GitHub: github.com/lodash/lodas...
November 18, 2025 at 9:31 PM
Security incident? Don’t panic. Have a plan. 🤝
@ulisesgascon.com explains how a clear incident response plan keeps open source projects steady when things go wrong in the latest JavaScript Security Snapshot.
Check out the Incident Response Plan here on GitHub: github.com/lodash/lodas...
@ulisesgascon.com explains how a clear incident response plan keeps open source projects steady when things go wrong in the latest JavaScript Security Snapshot.
Check out the Incident Response Plan here on GitHub: github.com/lodash/lodas...
📝 An initial version of the @openjsf.org Incident Response Plan has landed!
I plan to keep iterating on it over the next few weeks.
github.com/openjs-found...
I plan to keep iterating on it over the next few weeks.
github.com/openjs-found...
Initial version: Foundation Incident Response Plan by UlisesGascon · Pull Request #289 · openjs-foundation/security-collab-space
This is a draft version of the Foundation’s Incident Response Plan.
Please feel free to comment per line or add general feedback directly in this PR.
The main goal is to kick off the discussion so ...
github.com
November 18, 2025 at 12:54 PM
📝 An initial version of the @openjsf.org Incident Response Plan has landed!
I plan to keep iterating on it over the next few weeks.
github.com/openjs-found...
I plan to keep iterating on it over the next few weeks.
github.com/openjs-found...
🔖 Just wrapped up reorganizing and prioritizing the @expressjs.bsky.social packages release backlog!
The main issue is now updated with where we’re at and what’s coming next. If something looks weird or you think we missed anything, just shout!
github.com/expressjs/di...
The main issue is now updated with where we’re at and what’s coming next. If something looks weird or you think we missed anything, just shout!
github.com/expressjs/di...
Backlog for next releases · Issue #380 · expressjs/discussions
This is the current releases backlog in terms of status and priorities Important notes: The state of the backlog is always reflected in the latest edition of this message. Packages and releases are...
github.com
November 17, 2025 at 3:32 PM
🔖 Just wrapped up reorganizing and prioritizing the @expressjs.bsky.social packages release backlog!
The main issue is now updated with where we’re at and what’s coming next. If something looks weird or you think we missed anything, just shout!
github.com/expressjs/di...
The main issue is now updated with where we’re at and what’s coming next. If something looks weird or you think we missed anything, just shout!
github.com/expressjs/di...