Ulises Gascón
@ulisesgascon.com
#OpenSource Maintainer (@nodejs.org, @expressjs.bsky.social, Lodash, Yeoman...), #TC39 Delegate and #Maker | He/Him
Pinned
Ulises Gascón
@ulisesgascon.com
· Nov 11
🌍 Hello, BlueSky! 🤠
I'm Ulises Gascón from Spain! Passionate about #Nodejs, #Express, #JavaScript, and the world of #OpenSource.
I spend my days building, maintaining, and improving tools and libraries for our #devCommunity 🫶
👉 Check out my projects and support my work:
github.com/sponsors/Uli...
I'm Ulises Gascón from Spain! Passionate about #Nodejs, #Express, #JavaScript, and the world of #OpenSource.
I spend my days building, maintaining, and improving tools and libraries for our #devCommunity 🫶
👉 Check out my projects and support my work:
github.com/sponsors/Uli...
🚨 Moderate-severity security fix in [email protected] just released!
- Patches CVE-2025-13466 — vulnerable to denial of service when url encoding is used
github.com/expressjs/bo...
- Patches CVE-2025-13466 — vulnerable to denial of service when url encoding is used
github.com/expressjs/bo...
Release v2.2.1 · expressjs/body-parser
Important: Security
Security fix for CVE-2025-13466 (GHSA-wqch-xfxh-vrr4)
What's Changed
ci: add dependabot by @Phillip9587 in #593
ci: use full SHAs for github action versions by @Phillip9587 i...
github.com
November 24, 2025 at 6:44 PM
🚨 Moderate-severity security fix in [email protected] just released!
- Patches CVE-2025-13466 — vulnerable to denial of service when url encoding is used
github.com/expressjs/bo...
- Patches CVE-2025-13466 — vulnerable to denial of service when url encoding is used
github.com/expressjs/bo...
✍️ El open source no falla por el código.
Falla por problemas de gobernanza, burnout y trabajo invisible.
He escrito sobre lo que aprendí trabajando en #Expressjs y #Lodash:
blog.ulisesgascon.com/el-open-sour...
Falla por problemas de gobernanza, burnout y trabajo invisible.
He escrito sobre lo que aprendí trabajando en #Expressjs y #Lodash:
blog.ulisesgascon.com/el-open-sour...
El open source no falla por el código
Nos gusta culpar al código cuando el open source se rompe. La realidad es más incómoda: gobernanza, burnout y trabajo invisible son las verdaderas líneas de fractura. Esto es lo que aprendí trabajando...
blog.ulisesgascon.com
November 24, 2025 at 8:24 AM
✍️ El open source no falla por el código.
Falla por problemas de gobernanza, burnout y trabajo invisible.
He escrito sobre lo que aprendí trabajando en #Expressjs y #Lodash:
blog.ulisesgascon.com/el-open-sour...
Falla por problemas de gobernanza, burnout y trabajo invisible.
He escrito sobre lo que aprendí trabajando en #Expressjs y #Lodash:
blog.ulisesgascon.com/el-open-sour...
✍️ Open source doesn’t fail because of code.
It fails because of governance gaps, burnout, and invisible work.
I wrote down what I learned working on #Expressjs and #Lodash
blog.ulisesgascon.com/open-source-...
It fails because of governance gaps, burnout, and invisible work.
I wrote down what I learned working on #Expressjs and #Lodash
blog.ulisesgascon.com/open-source-...
Open Source Doesn’t Fail Because of Code!
We like to blame code when open source breaks. The reality is uglier: governance, burnout and invisible work are the real fault lines. This reflects what I learned during our work on Express and Lodas...
blog.ulisesgascon.com
November 24, 2025 at 8:22 AM
✍️ Open source doesn’t fail because of code.
It fails because of governance gaps, burnout, and invisible work.
I wrote down what I learned working on #Expressjs and #Lodash
blog.ulisesgascon.com/open-source-...
It fails because of governance gaps, burnout, and invisible work.
I wrote down what I learned working on #Expressjs and #Lodash
blog.ulisesgascon.com/open-source-...
📺 ¿Qué viene después del caos?
Lecciones de revivir #Expressjs y reimaginar #Lodash.
www.youtube.com/watch?v=NHsI...
Lecciones de revivir #Expressjs y reimaginar #Lodash.
www.youtube.com/watch?v=NHsI...
Del caos a la transformación: los casos de Express y Lodash
YouTube video by Orbitant
www.youtube.com
November 21, 2025 at 3:32 PM
📺 ¿Qué viene después del caos?
Lecciones de revivir #Expressjs y reimaginar #Lodash.
www.youtube.com/watch?v=NHsI...
Lecciones de revivir #Expressjs y reimaginar #Lodash.
www.youtube.com/watch?v=NHsI...
Reposted by Ulises Gascón
ok so... I'm writing a book. It's called JavaScript In Depth (www.manning.com/books/javasc...) ... the first four chapters are available by Manning.
This has been a difficult project and will continue to be so. The reason is that it isn't a How To book that focuses only on how to use the langauge
This has been a difficult project and will continue to be so. The reason is that it isn't a How To book that focuses only on how to use the langauge
JavaScript in Depth - James M. Snell
Explore the inner workings of the world’s most popular programming language and enjoy the power and control that comes only from deep knowledge! In JavaScript in Depth, JavaScript and Node legend Jame...
www.manning.com
November 20, 2025 at 9:37 PM
ok so... I'm writing a book. It's called JavaScript In Depth (www.manning.com/books/javasc...) ... the first four chapters are available by Manning.
This has been a difficult project and will continue to be so. The reason is that it isn't a How To book that focuses only on how to use the langauge
This has been a difficult project and will continue to be so. The reason is that it isn't a How To book that focuses only on how to use the langauge
Reposted by Ulises Gascón
Before automated workflows, releasing @nodejs.org meant 20 manual steps. Now it’s one command. 👀
@ulisesgascon.com and @rafaelgss.dev share how the Node.js build team went from a rack of Raspberry Pis in someone’s garage to full release automation.
👉Build Team on GitHub: github.com/nodejs/build
@ulisesgascon.com and @rafaelgss.dev share how the Node.js build team went from a rack of Raspberry Pis in someone’s garage to full release automation.
👉Build Team on GitHub: github.com/nodejs/build
November 20, 2025 at 3:29 PM
Before automated workflows, releasing @nodejs.org meant 20 manual steps. Now it’s one command. 👀
@ulisesgascon.com and @rafaelgss.dev share how the Node.js build team went from a rack of Raspberry Pis in someone’s garage to full release automation.
👉Build Team on GitHub: github.com/nodejs/build
@ulisesgascon.com and @rafaelgss.dev share how the Node.js build team went from a rack of Raspberry Pis in someone’s garage to full release automation.
👉Build Team on GitHub: github.com/nodejs/build
Reposted by Ulises Gascón
On Cloud 9.0 😶🌫️
Release details ⇣
Release details ⇣
November 19, 2025 at 1:31 AM
On Cloud 9.0 😶🌫️
Release details ⇣
Release details ⇣
We’ve kicked off a discussion on selecting #Astro as the new foundation for the @expressjs.bsky.social website.
🎖️ The goal: simpler docs, better i18n, easier contributions, and long-term stability.
🔖 If you have thoughts, now’s the time to share: github.com/expressjs/di...
🎖️ The goal: simpler docs, better i18n, easier contributions, and long-term stability.
🔖 If you have thoughts, now’s the time to share: github.com/expressjs/di...
Technical decision: Selecting Astro for the new expressjs.com site · Issue #451 · expressjs/discussions
In today’s meeting, during the discussion about the technology for the website redesign, the following key points were considered: The need for a simple authoring experience, preferably based on Ma...
github.com
November 20, 2025 at 10:50 AM
We’ve kicked off a discussion on selecting #Astro as the new foundation for the @expressjs.bsky.social website.
🎖️ The goal: simpler docs, better i18n, easier contributions, and long-term stability.
🔖 If you have thoughts, now’s the time to share: github.com/expressjs/di...
🎖️ The goal: simpler docs, better i18n, easier contributions, and long-term stability.
🔖 If you have thoughts, now’s the time to share: github.com/expressjs/di...
Reposted by Ulises Gascón
ECMAScript excitement 😉
This week TC39 advanced these proposals 🎉
4️⃣ Intl.Locale Info
4️⃣ Iterator.concat
4️⃣ JSON.parse Source Text
3️⃣ Iterator.zip
2️⃣.7️⃣ Iterator.prototype.join
2️⃣.7️⃣ Promise.allKeyed
2️⃣ Error.captureStackTrace
2️⃣ Import Text
2️⃣ Object.keysLength
1️⃣ Intl Energy Units
1️⃣ Intl Unit Protocol
🧵
This week TC39 advanced these proposals 🎉
4️⃣ Intl.Locale Info
4️⃣ Iterator.concat
4️⃣ JSON.parse Source Text
3️⃣ Iterator.zip
2️⃣.7️⃣ Iterator.prototype.join
2️⃣.7️⃣ Promise.allKeyed
2️⃣ Error.captureStackTrace
2️⃣ Import Text
2️⃣ Object.keysLength
1️⃣ Intl Energy Units
1️⃣ Intl Unit Protocol
🧵
November 20, 2025 at 8:20 AM
ECMAScript excitement 😉
This week TC39 advanced these proposals 🎉
4️⃣ Intl.Locale Info
4️⃣ Iterator.concat
4️⃣ JSON.parse Source Text
3️⃣ Iterator.zip
2️⃣.7️⃣ Iterator.prototype.join
2️⃣.7️⃣ Promise.allKeyed
2️⃣ Error.captureStackTrace
2️⃣ Import Text
2️⃣ Object.keysLength
1️⃣ Intl Energy Units
1️⃣ Intl Unit Protocol
🧵
This week TC39 advanced these proposals 🎉
4️⃣ Intl.Locale Info
4️⃣ Iterator.concat
4️⃣ JSON.parse Source Text
3️⃣ Iterator.zip
2️⃣.7️⃣ Iterator.prototype.join
2️⃣.7️⃣ Promise.allKeyed
2️⃣ Error.captureStackTrace
2️⃣ Import Text
2️⃣ Object.keysLength
1️⃣ Intl Energy Units
1️⃣ Intl Unit Protocol
🧵
🍕 The slides for my talk “What Comes After Chaos?” are now available
Stories and lessons from reviving #ExpressJS and reimagining #Lodash.
✨ Thanks to #Orbitant for the invitation!
slides.ulisesgascon.com/what-comes-a...
Stories and lessons from reviving #ExpressJS and reimagining #Lodash.
✨ Thanks to #Orbitant for the invitation!
slides.ulisesgascon.com/what-comes-a...
What Comes After Chaos?
Lessons from Reviving Express and Reimagining Lodash
slides.ulisesgascon.com
November 19, 2025 at 6:12 PM
🍕 The slides for my talk “What Comes After Chaos?” are now available
Stories and lessons from reviving #ExpressJS and reimagining #Lodash.
✨ Thanks to #Orbitant for the invitation!
slides.ulisesgascon.com/what-comes-a...
Stories and lessons from reviving #ExpressJS and reimagining #Lodash.
✨ Thanks to #Orbitant for the invitation!
slides.ulisesgascon.com/what-comes-a...
Reposted by Ulises Gascón
In case you're curious... blog.cloudflare.com/18-november-...
Cloudflare outage on November 18, 2025
Cloudflare suffered a service outage on November 18, 2025. The outage was triggered by a bug in generation logic for a Bot Management feature file causing many Cloudflare services to be affected.
blog.cloudflare.com
November 18, 2025 at 11:50 PM
In case you're curious... blog.cloudflare.com/18-november-...
Reposted by Ulises Gascón
Security incident? Don’t panic. Have a plan. 🤝
@ulisesgascon.com explains how a clear incident response plan keeps open source projects steady when things go wrong in the latest JavaScript Security Snapshot.
Check out the Incident Response Plan here on GitHub: github.com/lodash/lodas...
@ulisesgascon.com explains how a clear incident response plan keeps open source projects steady when things go wrong in the latest JavaScript Security Snapshot.
Check out the Incident Response Plan here on GitHub: github.com/lodash/lodas...
November 18, 2025 at 9:31 PM
Security incident? Don’t panic. Have a plan. 🤝
@ulisesgascon.com explains how a clear incident response plan keeps open source projects steady when things go wrong in the latest JavaScript Security Snapshot.
Check out the Incident Response Plan here on GitHub: github.com/lodash/lodas...
@ulisesgascon.com explains how a clear incident response plan keeps open source projects steady when things go wrong in the latest JavaScript Security Snapshot.
Check out the Incident Response Plan here on GitHub: github.com/lodash/lodas...
📝 An initial version of the @openjsf.org Incident Response Plan has landed!
I plan to keep iterating on it over the next few weeks.
github.com/openjs-found...
I plan to keep iterating on it over the next few weeks.
github.com/openjs-found...
Initial version: Foundation Incident Response Plan by UlisesGascon · Pull Request #289 · openjs-foundation/security-collab-space
This is a draft version of the Foundation’s Incident Response Plan.
Please feel free to comment per line or add general feedback directly in this PR.
The main goal is to kick off the discussion so ...
github.com
November 18, 2025 at 12:54 PM
📝 An initial version of the @openjsf.org Incident Response Plan has landed!
I plan to keep iterating on it over the next few weeks.
github.com/openjs-found...
I plan to keep iterating on it over the next few weeks.
github.com/openjs-found...
🔖 Just wrapped up reorganizing and prioritizing the @expressjs.bsky.social packages release backlog!
The main issue is now updated with where we’re at and what’s coming next. If something looks weird or you think we missed anything, just shout!
github.com/expressjs/di...
The main issue is now updated with where we’re at and what’s coming next. If something looks weird or you think we missed anything, just shout!
github.com/expressjs/di...
Backlog for next releases · Issue #380 · expressjs/discussions
This is the current releases backlog in terms of status and priorities Important notes: The state of the backlog is always reflected in the latest edition of this message. Packages and releases are...
github.com
November 17, 2025 at 3:32 PM
🔖 Just wrapped up reorganizing and prioritizing the @expressjs.bsky.social packages release backlog!
The main issue is now updated with where we’re at and what’s coming next. If something looks weird or you think we missed anything, just shout!
github.com/expressjs/di...
The main issue is now updated with where we’re at and what’s coming next. If something looks weird or you think we missed anything, just shout!
github.com/expressjs/di...
¿Qué viene después del caos?
Lecciones de revivir #Expressjs y reimaginar #Lodash.
🎙️ Charla (en español) organizada por Orbitant
🗓️ 19 nov, 5 PM CET
🔑 El enlace se enviará el día del evento
🎟️ Gratis → docs.google.com/forms/d/e/1F...
Lecciones de revivir #Expressjs y reimaginar #Lodash.
🎙️ Charla (en español) organizada por Orbitant
🗓️ 19 nov, 5 PM CET
🔑 El enlace se enviará el día del evento
🎟️ Gratis → docs.google.com/forms/d/e/1F...
November 17, 2025 at 8:41 AM
¿Qué viene después del caos?
Lecciones de revivir #Expressjs y reimaginar #Lodash.
🎙️ Charla (en español) organizada por Orbitant
🗓️ 19 nov, 5 PM CET
🔑 El enlace se enviará el día del evento
🎟️ Gratis → docs.google.com/forms/d/e/1F...
Lecciones de revivir #Expressjs y reimaginar #Lodash.
🎙️ Charla (en español) organizada por Orbitant
🗓️ 19 nov, 5 PM CET
🔑 El enlace se enviará el día del evento
🎟️ Gratis → docs.google.com/forms/d/e/1F...
Reposted by Ulises Gascón
After a few months of targeted attacks on our ecosystem, followed by a confusing and rapidly changing response from @github.com, we wanted to put together some guidance for maintainers on how to help us all secure our supply chain together.
Here is that guidance 👇
Here is that guidance 👇
With npm supply chain attacks on the rise, secure publishing practices are becoming a pressing concern for anyone maintaining npm packages. ⚠️
We've released updated guidance to help maintainers reduce exposure, strengthen release processes, and protect the ecosystem: openjsf.org/blog/publish...
We've released updated guidance to help maintainers reduce exposure, strengthen release processes, and protect the ecosystem: openjsf.org/blog/publish...
Publishing More Securely on npm: Guidance from the OpenJS Security Collaboration Space | OpenJS Foundation
The OpenJS Security Collaboration Space has been working closely with GitHub’s npm team to understand how new security features affect projects and maintainers, especially as threats and tools keep ev...
openjsf.org
November 14, 2025 at 4:21 PM
After a few months of targeted attacks on our ecosystem, followed by a confusing and rapidly changing response from @github.com, we wanted to put together some guidance for maintainers on how to help us all secure our supply chain together.
Here is that guidance 👇
Here is that guidance 👇
Reposted by Ulises Gascón
With npm supply chain attacks on the rise, secure publishing practices are becoming a pressing concern for anyone maintaining npm packages. ⚠️
We've released updated guidance to help maintainers reduce exposure, strengthen release processes, and protect the ecosystem: openjsf.org/blog/publish...
We've released updated guidance to help maintainers reduce exposure, strengthen release processes, and protect the ecosystem: openjsf.org/blog/publish...
Publishing More Securely on npm: Guidance from the OpenJS Security Collaboration Space | OpenJS Foundation
The OpenJS Security Collaboration Space has been working closely with GitHub’s npm team to understand how new security features affect projects and maintainers, especially as threats and tools keep ev...
openjsf.org
November 14, 2025 at 4:02 PM
With npm supply chain attacks on the rise, secure publishing practices are becoming a pressing concern for anyone maintaining npm packages. ⚠️
We've released updated guidance to help maintainers reduce exposure, strengthen release processes, and protect the ecosystem: openjsf.org/blog/publish...
We've released updated guidance to help maintainers reduce exposure, strengthen release processes, and protect the ecosystem: openjsf.org/blog/publish...
@npmjs.bsky.social implementation of Trusted Publishing is promising for #JavaScript, but it’s not ready for critical packages just yet
openjsf.org/blog/publish...
openjsf.org/blog/publish...
Publishing More Securely on npm: Guidance from the OpenJS Security Collaboration Space | OpenJS Foundation
The OpenJS Security Collaboration Space has been working closely with GitHub’s npm team to understand how new security features affect projects and maintainers, especially as threats and tools keep ev...
openjsf.org
November 14, 2025 at 4:09 PM
@npmjs.bsky.social implementation of Trusted Publishing is promising for #JavaScript, but it’s not ready for critical packages just yet
openjsf.org/blog/publish...
openjsf.org/blog/publish...
🚀 @netlify.com deploys for @openssf.org #scorecard are live, and PR previews work great!
Jump in and grab a help-wanted issue: github.com/ossf/scoreca...
We’d love your contributions ❤️🔥
Jump in and grab a help-wanted issue: github.com/ossf/scoreca...
We’d love your contributions ❤️🔥
ossf/scorecard-webapp
Website and API for OpenSSF Scorecard. Contribute to ossf/scorecard-webapp development by creating an account on GitHub.
github.com
November 14, 2025 at 10:25 AM
🚀 @netlify.com deploys for @openssf.org #scorecard are live, and PR previews work great!
Jump in and grab a help-wanted issue: github.com/ossf/scoreca...
We’d love your contributions ❤️🔥
Jump in and grab a help-wanted issue: github.com/ossf/scoreca...
We’d love your contributions ❤️🔥
Reposted by Ulises Gascón
Too many @nodejs.org users are running old versions 😬 The team is exploring changes to the release schedule to fix that.
@rafaelgss.dev shares all the details in our latest JavaScript Security Snapshot.
Be a part of the conversation on releases: github.com/nodejs/lts-s...
@rafaelgss.dev shares all the details in our latest JavaScript Security Snapshot.
Be a part of the conversation on releases: github.com/nodejs/lts-s...
November 13, 2025 at 5:45 PM
Too many @nodejs.org users are running old versions 😬 The team is exploring changes to the release schedule to fix that.
@rafaelgss.dev shares all the details in our latest JavaScript Security Snapshot.
Be a part of the conversation on releases: github.com/nodejs/lts-s...
@rafaelgss.dev shares all the details in our latest JavaScript Security Snapshot.
Be a part of the conversation on releases: github.com/nodejs/lts-s...
🎉 @bjohansebas.bsky.social is our new Triage Captain for #ExpressJS! Grateful for your dedication, leadership, and continued impact on the community 👏👏👏
github.com/expressjs/di...
github.com/expressjs/di...
fix(docs): Add @bjohansebas as Triage Team captain by wesleytodd · Pull Request #448 · expressjs/discussions
Nominating @bjohansebas as a captain of the Triage Team. We have seen lots of great contributions from @bjohansebas this year and he is interested in helping run this effort. Thanks for the continu...
github.com
November 12, 2025 at 10:05 AM
🎉 @bjohansebas.bsky.social is our new Triage Captain for #ExpressJS! Grateful for your dedication, leadership, and continued impact on the community 👏👏👏
github.com/expressjs/di...
github.com/expressjs/di...
¿Qué viene después del caos?
Lecciones de revivir #Expressjs y reimaginar #Lodash.
🎙️ Charla (en español) organizada por Orbitant
🗓️ 19 nov, 5 PM CET
🔑 El enlace se enviará el día del evento
🎟️ Gratis → docs.google.com/forms/d/e/1F...
Lecciones de revivir #Expressjs y reimaginar #Lodash.
🎙️ Charla (en español) organizada por Orbitant
🗓️ 19 nov, 5 PM CET
🔑 El enlace se enviará el día del evento
🎟️ Gratis → docs.google.com/forms/d/e/1F...
November 11, 2025 at 2:24 PM
¿Qué viene después del caos?
Lecciones de revivir #Expressjs y reimaginar #Lodash.
🎙️ Charla (en español) organizada por Orbitant
🗓️ 19 nov, 5 PM CET
🔑 El enlace se enviará el día del evento
🎟️ Gratis → docs.google.com/forms/d/e/1F...
Lecciones de revivir #Expressjs y reimaginar #Lodash.
🎙️ Charla (en español) organizada por Orbitant
🗓️ 19 nov, 5 PM CET
🔑 El enlace se enviará el día del evento
🎟️ Gratis → docs.google.com/forms/d/e/1F...