Open Source Contributions — Joris Dugué

Contributions to Sharp, Fastify and other open-source projects involving new features, optimization, maintenance, compatibility and responsible security disclosure.

Cover Open Source
JavascriptNode.jsFastifyOAuth 2.0MongoDBSharpGitGitHub

I regularly contribute to different open-source projects, mainly when I use a library, identify a possible improvement, or encounter a technical issue that can be fixed or responsibly reported to the maintainers.

These contributions can take several forms: implementing new features, improving or simplifying code, adapting projects to dependency changes, removing deprecated behavior, improving compatibility, or identifying and responsibly reporting security vulnerabilities.

The goal is not only to solve an immediate technical need, but also to contribute improvements that can benefit the wider community using these projects.

Sharp — JP2 / JPEG 2000 Support

I contributed to Sharp by implementing support for the JP2 / JPEG 2000 image format.

The contribution included support for generating JP2 files and buffers, together with several encoding options:

  • output quality;
  • lossless compression;
  • tile dimensions;
  • chroma subsampling;
  • support for JP2, JPX, J2K and J2C extensions.

The implementation also required integration with libvips and OpenJPEG to properly handle the image format at the processing layer.

The contribution was later integrated into the project through a maintainer commit.

Fastify OAuth2

I also contributed to Fastify's OAuth2 plugin.

One contribution focused on dependency updates and adding configuration support for GitLab as an OAuth2 provider.

Another contribution implemented OAuth2 token revocation, including mechanisms based on RFC 7009.

This work also included support for revoking multiple tokens and refactoring parts of the existing implementation.

Main contributions

  • GitLab OAuth2 provider support;
  • dependency updates;
  • OAuth2 token revocation;
  • multiple-token revocation;
  • RFC 7009-related implementation;
  • code refactoring and maintenance.

Fastify MongoDB

My contribution to Fastify MongoDB mainly focused on maintenance and adapting the plugin to changes in the MongoDB driver.

The work included code optimization and removing deprecated MongoDB options that generated warnings with newer driver versions.

Main points

  • code optimization;
  • removal of deprecated MongoDB options;
  • compatibility with newer driver versions;
  • general maintenance.

Fastify Caching

On Fastify Caching, I contributed code cleanup and optimization together with dependency updates.

The goal was to simplify parts of the implementation while keeping project dependencies current and reducing compatibility and maintenance risks associated with obsolete versions.

Main points

  • code cleanup;
  • import and method-call optimization;
  • dependency updates;
  • preventive maintenance.

Security and Responsible Disclosure

Some of my open-source contributions also involve security.

When I identify behavior that could represent a vulnerability, I prefer responsible disclosure to the project maintainers so the issue can be reviewed and addressed appropriately.

I notably reported a vulnerability affecting Fastify Express that was later published as GHSA-3wf5-7852-vcfq.

In this case, my contribution was the identification and responsible disclosure of the vulnerability, not the implementation of the final patch.

Example

Types of Contributions

My work across open-source projects can cover different areas:

  • implementation of new features;
  • support for new formats or use cases;
  • code optimization and refactoring;
  • dependency maintenance;
  • removal of deprecated APIs or options;
  • compatibility improvements;
  • new or improved integrations;
  • security research and responsible vulnerability disclosure.

Open Source

I see open-source contribution as a way to improve the tools I use and share improvements that can benefit other developers.

It also gives me the opportunity to work with codebases, architectures and technical constraints that differ from my own projects.