node-boilerplate

Dependency freshness

Declared = lowest version the kit's dependency file (package.json, pyproject.toml or requirements.txt) allows. Latest = the npm "latest" tag or the newest PyPI release. TypeScript, the Stripe SDK, FastAPI and other 0.x packages are shown but not counted in the verdict.

What's in the stack

Framework

Express

Testing

Jest

Detected from declared dependencies. A listed package means it's installed, not necessarily fully wired up.

What the README says you get

• API
  Swagger UI docsSwagger UI mounted at `/docs` in non-production.
• Auth
  Header-based auth demoDemo of header-based auth (requires `x-internal-authorization` and `Authorization`)
• Deploy
  Hardened DockerfileMulti-stage Dockerfile on `node:22-bookworm-slim`, runs as non-root with `tini` as PID 1, healthcheck baked in.
• Deploy
  Hardened docker-compose`docker-compose.yml` with `read_only`, `cap_drop: ALL`, `no-new-privileges` and resource limits.
• Deploy
  Graceful shutdownGraceful shutdown on `SIGINT` / `SIGTERM` with a 10 s drain window.
• Other
  Helmet security headersHelmet (HSTS in prod), `x-powered-by` disabled, `x-request-id` propagation.
• Other
  CORS allow-listAllow-list driven CORS via `CORS_ORIGINS`.
• Other
  Global rate limiterGlobal rate limiter (`express-rate-limit`, draft-7 standard headers).
• Other
  Body size limitBody size capped at 1 MB by default (configurable via `BODY_LIMIT`).
• Other
  AES-256-GCM encryptionPBKDF2-HMAC-SHA512 key derivation at OWASP-2023 strength (600 000 iters) + AES-256-GCM with per-message salt + IV embedded in the ciphertext.
• Other
  Config validationCentralized config validation – the app refuses to boot with bad/missing values.
• Other
  Structured Winston loggingStructured Winston logging (separate `error.log`, JSON format, level via `LOG_LEVEL`).
• Other
  Health and readiness endpoints`/healthz` and `/readyz` liveness/readiness endpoints (skipped from rate-limit).
• Other
  Request ID middlewarePer-request id middleware (echoes/forwards `x-request-id`, falls back to `crypto.randomUUID()`).

Extracted from the kit's README by a local AI model (deepseek-flash) on Sep 29, 2026. Every item is checked against an exact README quote. A README claim is the maker's description, not something we tested.