DEV Community: Yass1n

Bro.JS v3.1.0 – Massive Security & Stability Fixes

Yass1n — Tue, 29 Sep 2026 15:53:58 +0000

Hey folks! 🎉

If you’ve been using Bro.JS for anything beyond a quick prototype, you’ll want to grab v3.1.0 right away. The last few weeks were spent on a deep‑dive security and stability audit, and 14 critical issues have been patched.

What’s fixed?

IP spoofing – The framework now only trusts the real client IP from your load balancer.
Rate‑limiter DoS – Keys are tied to verified IPs or API keys, stopping key‑bloat attacks.
Cross‑tenant IDOR – User tokens win over any X‑Tenant‑Id header unless you explicitly enable TRUST_TENANT_HEADER.
Plugin sandbox escape – Proxy traps fully isolate plugin contexts again.
Dev dashboard XSS – All HTML output is now safely escaped.

Runtime improvements

Edge upload limits are enforced with a ReadableStream interceptor.
File logger is now async (fs.promises.appendFile).
Redis distributed locks use UUIDs and atomic Lua scripts.
Background tasks get an AbortController signal to avoid overlap.
Pino logger redaction and circular‑reference crashes have been fixed.

Developer experience tweaks

SDK generator now correctly maps hyphenated routes for React Query hooks.
Native FormData uploads work out‑of‑the‑box.
Windows path resolution for bro start is fixed via file:// URLs.
.env API key arrays (API_KEY=key1,key2) are parsed automatically.
CommonJS ERR_REQUIRE_ESM issues are resolved.

Give it a spin and let me know what you think. If it saves you time, a ⭐ on the repo would be awesome! Happy coding!

bro.js v3.0.0 – What’s new

Yass1n — Sun, 20 Sep 2026 22:44:20 +0000

Tired of flaky state leaking between tests or worrying about insecure defaults?

bro.js just hit v3.0.0 and brings a bunch of practical upgrades that let you focus on code, not on runtime quirks.

Edge & Web Standard Runtime

Separate entry points for Node (bro-framework), Next.js (bro-framework/next), and Edge/worker (bro-framework/edge).
No more node:crypto or node:fs in Edge – it now uses the native Web Crypto API and Response.json().
Guarded process.env lookups make the runtime portable for Cloudflare Workers and Next.js Edge.

Immutable Instance‑Scoped Engine

All global singletons are gone. State lives inside the createBro(config) or createServer() instance, giving you true isolation per request or tenant.

Strict TypeScript Contracts

Core context is generic‑typed via AppContext. No more any – you can type ctx.db, ctx.env, and ctx.user precisely.
Updated declaration files (src/index.d.ts, src/next.d.ts) now compile with zero errors.

Contract Studio (`bro studio`)

Generates strongly‑typed React Query hooks and MSW handlers straight from Zod schemas.
OpenAPI output now includes request/auth/multipart metadata and RFC 9457 problem details.

In‑Process Testing (`bro.test()`)

A self‑contained HTTP testing harness that shuts down cleanly.
testRoute() lets you call a handler directly without starting a server.
Built‑in hooks for DB transaction rollbacks and fake timers.

Production Observability & Security

OpenTelemetry spans, metrics, and W3C trace propagation.
createPinoAdapter redacts PII (Authorization, Cookie) by default.
Scaffolding no longer embeds literal secrets. In production, a missing or short JWT secret crashes the app early.
CORS is now strict – you must provide an explicit allowlist.
API keys are hashed; OIDC and JWKS caching via jose.

Lifecycle Adapters & CLI

TaskManager now handles workers, dead‑letter queues, exponential backoff, and Redis lease locks.
PostgresAdapter is production‑ready, and S3/Local upload adapters are secure.
bro init scaffolds bro.config.js, a Dockerfile, Vitest config, and an example env file.
CLI commands (bro doctor, bro sdk, bro studio) all target the default routes/ folder.

All of this is aimed at making bro.js a solid, secure, and edge‑ready framework for production workloads. Give it a spin and let us know how it fits your stack!

Introducing DevPipe: One-Click Release Publishing for Open-Source

Yass1n — Thu, 17 Sep 2026 21:35:45 +0000

Hey fellow devs! 🎉

Ever spent hours tweaking the same release notes for GitHub, Dev.to, Hashnode, and Reddit? I felt the same, so I built DevPipe – a dashboard that lets you write your draft once and hit publish everywhere in a single click.

🚀 Live Demo: devpipe.yessindevs.me

💻 Source: github.com/medyass1ne/devpipe

How it works

1️⃣ Write a standard Markdown draft.

2️⃣ DevPipe runs it through a Groq + gpt-oss-120b engine.

3️⃣ Choose “First Release” and it rewrites the narrative for each platform, auto‑generating titles and tags.

Publishing modes

Direct API – Plug in your Dev.to token or GitHub OAuth and let DevPipe push automatically.
1‑Click Copy – For platforms that are not connected, it copies the formatted Markdown and opens the submit page, so you just paste.

Give it a spin next time you launch a side project. It’s open‑source, so feel free to remix the hybrid publishing logic! 🙌

🚀 bro.js v2.4.5 – Next.js Adapter & AI‑First DX

Yass1n — Thu, 17 Sep 2026 17:58:29 +0000

Hey devs! 🎉

I’m super excited to share bro.js v2.4.5 – the biggest leap we’ve made yet. Imagine dropping zero‑boilerplate Express magic straight into a Next.js serverless route. No more fighting Turbopack or juggling busboy for file uploads. 🚀

What’s fresh?

Next.js App Router Adapter – use defineRoute and createBro right inside app/api. Multipart/form‑data is parsed for you, rate‑limiting works out of the box, and caching is a one‑liner (cache: 60).
AI‑First CLI – create-bro-app now asks if you want a plain Node backend or a full‑stack Next.js app, then writes an agents.md file so AI tools like Copilot stay on script.
Core upgrades – hot‑reloading tasks, JSON locale watching, and a unified error shape so you can trust the same { error, details } everywhere.

How to get it?

npm i bro-framework@latest   # upgrade existing projects
npx create-bro-app@latest    # start a brand‑new zero‑boilerplate app

Give it a spin and let me know what you build! ✨

bro.js v2.4.0 - Redis clustering, API key rotation, and a rate limiter that actually survives outages

Yass1n — Mon, 14 Sep 2026 22:06:41 +0000

Pushed v2.4.0 of bro.js (my zero-boilerplate Express alternative) and figured I'd write up what changed instead of just dumping a changelog.

The Redis integration got a lot less annoying

Used to be you had to wire up your own Redis client and babysit connection state. Now you just drop a redisUrl in the config and most of it's handled for you:

export default {
  redisUrl: process.env.REDIS_URL
}

From there:

Caching is basically one line. cache: 60 on a route caches the response, and keys get hashed per user + locale + api key so you can't accidentally leak someone else's cached data.
Self-healing cache. If a cached JSON blob ever gets corrupted (happens more than you'd think), it catches the parse error, deletes the bad key, and rebuilds instead of throwing a 500 at your users.
WebSockets that scale automatically. If it detects a Redis connection it wires up the Socket.io Redis adapter for you, so load-balancing sockets across multiple instances just works instead of silently breaking.

Rate limiter no longer panics when Redis dies

This was the annoying one to get right. If your Redis instance drops or crashes mid-request, the old behavior was... not great. Now it falls back cleanly to a single pre-instantiated in-memory limiter, so your API keeps running and stays rate-limited instead of either falling over or spawning a new limiter per request.

Actual API key auth, not just JWT workarounds

JWTs are fine for user sessions, kind of a pain for CLI tools and service-to-service calls. So:

routes: {
  '/admin/stats': {
    auth: 'api-key',
    apiKey: [process.env.OLD_KEY, process.env.NEW_KEY]
  }
}

auth: 'api-key' self-documents in the auto-generated Swagger/Scalar docs as a proper apiKeyAuth header scheme.
Passing an array of keys means you can rotate credentials with zero downtime — old key stays valid until you're ready to drop it.
auth: ['admin'] gives you basic RBAC out of the box.
Helmet is on by default now.

Smaller stuff

shutdown() now properly kills both the primary Redis client and the pub/sub duplicates, so your process actually exits instead of hanging on ghost handles.
Fixed the Multer typings, so single/array/fields uploads get real TS autocomplete now instead of any.

Still no decorators, no nested module system, just file-based routing. Wanted it to hold up under actual production traffic without turning into another framework you need a config generator for.

GitHub: https://github.com/medyassine/bro.js
Docs: https://brojs.yessindevs.me
Quickstart: npx create-bro-framework@latest my-api

Would genuinely appreciate anyone trying to break the cache or the limiter — ran it through a decent amount of testing but there's always an edge case I didn't think of.

bro.js v2.3.0: Simpler Routes, Smart Language Support, and Auto API Docs

Yass1n — Sat, 12 Sep 2026 12:56:49 +0000

When building an API framework, the hardest part is keeping code simple while making sure it doesn't break in production.

With bro.js v2.3.0, we focused on removing clutter from your route files and making everyday tasks—like handling multiple languages and documenting endpoints—as easy as possible.

Here is a quick look at what changed.

1. Cleaner, Flatter Route Validation

In earlier versions, you had to wrap your validation rules in a nested schema object:

// ❌ Old way (No longer supported)
export default defineRoute({
  schema: {
    body: z.object({ title: z.string() })
  },
  handler: async (ctx) => { ... }
});

That was unnecessary nesting. In v2.3.0, you write your checks right at the top level:

// ✅ New way (Cleaner & faster to read)
import { defineRoute, z } from 'bro-framework';

export default defineRoute({
  body: z.object({
    title: z.string()
  }),
  handler: async ({ body }) => {
    return { message: "Saved!", title: body.title };
  }
});

If your code has the old schema wrapper, bro.js catches it on startup and tells you exactly how to update it.

2. Automatic Language Detection

Browsers send a header called Accept-Language that tells the server what languages the user understands, sorted by preference (for example: "I prefer German, but French is okay too").

In v2.3.0, bro.js handles all of this for you:

1. Create a locale/ folder in your project root.

2. Add your language files:

// locale/fr.js
export default {
  welcome: "Bienvenue, {name}!",
  error: "Une erreur est survenue."
};

3. Use the built-in translator directly in your routes:

export default defineRoute({
  handler: async ({ t, locale }) => {
    return {
      message: t('welcome', { name: 'Alex' }),
      userLanguage: locale
    };
  }
});

bro.js checks the client's language list, skips any languages marked with zero preference, and picks the best match you have available.

3. Clearer API Documentation

bro.js automatically builds interactive documentation for your API.

Now, you can also tell your docs what a successful 200 OK response looks like using the new response option:

export default defineRoute({
  response: z.object({
    success: z.boolean(),
    userId: z.string()
  }),
  handler: async () => {
    return { success: true, userId: "123" };
  }
});

This is completely optional. If you just want to return a quick object without defining a schema for it, the framework stays out of your way.

4. Under-the-Hood Improvements

Upload Protection: Changing a single upload setting (like maximum file size) keeps all your other safety limits intact.
Clean Database Teardown: Added an onShutdown option to bro.config.js so you can close database pools when shutting down.
Frontend SDK Polish: Fixed dynamic route naming bugs when using $ in parameters.

Getting Started

Install or upgrade to the latest version:

npm install bro-framework@latest

Docs: brojs.yessindevs.me
GitHub: github.com/medyassine/bro.js

Got roasted by senior engineers for my framework's security, so I completely rebuilt the core engine

Yass1n — Fri, 11 Sep 2026 17:35:54 +0000

When I first launched bro.js, a zero-boilerplate Node.js backend engine, the goal was simple: bring Next.js-style file-based routing to pure backend API development.

The community response was insane. But as developers started using it to spin up APIs, a few senior engineers took a look under the hood and gave me some incredibly sharp feedback on scaling, security, and edge-case bugs.

Instead of ignoring it, I took it back to the lab. Today, I'm releasing bro.js v2.2.0, transitioning the framework from a fast prototyping tool into a production-hardened engine.

Here is what we leveled up:

1. Bulletproof Zod Validation Parity

Previously, the framework read nested Zod schemas to generate beautiful OpenAPI docs, but didn't strictly enforce them all at runtime. Now, we have 100% parity. If it's in your route's schema, it is ruthlessly validated before it ever hits your handler.

2. The "Fail-Closed" Security Model

It's too easy to accidentally deploy a dev environment JWT secret to production. bro.js now actively detects known fallback secrets on boot. If NODE_ENV=production and you haven't supplied a strong cryptographic key, the server intentionally crashes on startup to protect your application.

3. Graceful Lifecycle & Task Management

Scaling means clean deployments. I wired up a full SIGTERM/SIGINT shutdown handler. Now, when your container spins down, bro.js cleanly drains HTTP requests, gracefully closes Socket.io connections, and halts scheduled background cron tasks.

4. SDK Smart Quoting

The bro sdk command parses your backend routes and generates a strictly typed frontend client instantly. We overhauled the generator to safely encode complex URL paths and use "Smart Quoting," giving you beautiful dot-notation (api.users.get()) for standard routes without breaking on hyphenated dynamic segments.

If you are tired of writing Express middleware and want an API that just works out of the box, give the new engine a spin:

npx create-bro-framework@latest my-api

I'd love for you to try breaking it again. Check out the Docs or drop a star on GitHub.

You have to stop using standalone express.js...

Yass1n — Fri, 11 Sep 2026 13:51:30 +0000

Yass1n

Sep 9

Got tired of rewriting Express boilerplate, so I built a zero-config alternative

#backend #javascript #node #webdev

1 min read

Got tired of rewriting Express boilerplate, so I built a zero-config alternative

Yass1n — Wed, 09 Sep 2026 22:23:01 +0000

Juggling client contracts and building full-stack applications means spinning up new backends constantly. But manually wiring up Express routers, configuring JWT authentication, and setting up Zod validation for every single project was completely destroying my momentum.

I wanted the seamless developer experience of Next.js, but for a standalone Node API. Since nothing quite fit the bill, I built bro.js.

It is a zero-boilerplate engine wrapper around Express that handles the tedious infrastructure out of the box, letting you focus entirely on your logic.

File-Based Routing: Just drop [id].get.js into your routes folder, and the endpoint is instantly live.
Built-in Zod Validation: Pass a schema to the route definition, and the framework automatically rejects bad requests with a 400 error.
Native WebSockets: Socket.io is pre-configured and injected directly into your route context (ctx.io).
Auto-Generated SDKs: Run bro sdk, and it compiles a typed client SDK perfectly formatted for your frontend.

You can boot a new environment instantly right from your terminal:

npx create-bro-framework@latest my-api

I would love for the community to try it out and roast the code. You can check out the documentation here or drop a star on the GitHub Repo.

DEV Community: Yass1n

Bro.JS v3.1.0 – Massive Security & Stability Fixes

What’s fixed?

Runtime improvements

Developer experience tweaks

bro.js v3.0.0 – What’s new

Edge & Web Standard Runtime

Immutable Instance‑Scoped Engine

Strict TypeScript Contracts

Contract Studio (bro studio)

In‑Process Testing (bro.test())

Production Observability & Security

Lifecycle Adapters & CLI

Introducing DevPipe: One-Click Release Publishing for Open-Source

How it works

Publishing modes

🚀 bro.js v2.4.5 – Next.js Adapter & AI‑First DX

What’s fresh?

How to get it?

bro.js v2.4.0 - Redis clustering, API key rotation, and a rate limiter that actually survives outages

The Redis integration got a lot less annoying

Rate limiter no longer panics when Redis dies

Actual API key auth, not just JWT workarounds

Smaller stuff

bro.js v2.3.0: Simpler Routes, Smart Language Support, and Auto API Docs

1. Cleaner, Flatter Route Validation

2. Automatic Language Detection

3. Clearer API Documentation

4. Under-the-Hood Improvements

Getting Started

Got roasted by senior engineers for my framework's security, so I completely rebuilt the core engine

1. Bulletproof Zod Validation Parity

2. The "Fail-Closed" Security Model

3. Graceful Lifecycle & Task Management

4. SDK Smart Quoting

You have to stop using standalone express.js...

Got tired of rewriting Express boilerplate, so I built a zero-config alternative

Got tired of rewriting Express boilerplate, so I built a zero-config alternative

Contract Studio (`bro studio`)

In‑Process Testing (`bro.test()`)