As of August 16, 2019, when I create a new SPFx project via the Yeoman SharePoint Generator, I get a nasty NPM warning that says:
"found 2012 vulnerabilities (1806 low, 12 moderate, 194 high)"

My understanding is that most of these "vulnerabilities" are related to the development environment and will not wind up in production; unfortunately, I don't really have the expertise needed to know that for sure. I'm trusting in Microsoft to provide me with a technology that is safe to use in an enterprise environment. Warning messages like this do not help my confidence.

Please fix the Yeoman @microsoft/sharepoint generator so that these vulnerabilities are eliminated.

See also:
https://sharepoint.stackexchange.com/questions/266206/excessive-vulnerability-count-in-yeoman-sharepoint-generator

I want to thank Microsoft for creating TypeScript. As an absentminded person, plain JavaScript drives me nuts. TypeScript is a welcome enhancement to baseline JavaScript; however, I think there might be a better option in development today.

A possible alternative to TypeScript is PureScript. It is a strongly typed "pure" functional language that compiles to JavaScript. Pure functional languages greatly reduce bugs from side effects. Additionally, PureScript has a Haskell like syntax. The "pure" nature of PureScript combined with it's Haskell like syntax may offer advantages that TypeScript cannot currently provide.

Other possible interesting options are to add support for GHCJS (Haskell to JS) or maybe even F# to JS but while GHCJS is pure, F# is not a pure functional language.

See:
https://en.wikipedia.org/wiki/PureScript
https://github.com/purescript/purescript
https://github.com/ghcjs/ghcjs

Extension - Application Customizer footer not rendered correctly on Iphone when using sharepoint App
We have build Application customizer footer. The footer is working fine on all mobile browser, but there is issue when we are using Sharepoint App to open the site. Footer is not rendering correctly(somewhere middle of the screen). But on mobile browser from Iphone itself, it is working fine. There is challenge in rendering when we are using Sharepoint App. I have already raised this concern to Microsoft team. But sharepoint online support team told me o raise this concern to your forum. From sharepoint app, we are unable to debug it to find the root cause of issue. If you provide us any fix for the same, it will be a great help.

When running a gulp task, I frequently have tasks I want to perform BEFORE the task runs. Considering there are now hooks to add sub-tasks before/after the build, the bundle, typescript, and you can hook into the webpack configuration, it would make sense to me to add a hook so you can add a "pre (or post) task" hook. A subtask that runs BEFORE/AFTER everything else does.

I use this especially when running 'gulp serve', to start a proxy service that allows me to use live sharepoint data while using the local workbench. However, I frequently want to use different site contexts in different builds, so I like to pick the context from a list. For this purpose, I have a task that prompts the user to select from a list of options, then starts the server based on their selection. Because it is waiting for input, I need to block the rest of the build chain until the selections have been made.

Because the task needs to block, I can't run it as a concurrent npm script. I also want it to run FIRST, instead of in the middle of a build, so using the existing "addPost/addPre" hooks aren't what I'm looking for. I have been able to get it to work by creating my own task, but I also want it to run the originally desired task, without having to reverse engineer and completely redesign that task (which I was able to do, but it is fragile).

The solutions I've managed to get to work reliably so far are pretty hacky. I either create my own task, and run some serial sub-tasks, starting with collecting the user input and starting the proxy server, then use gulp.start() to start the task I originally wanted to run. Or, I listen for gulp.on('start'), overwrite the task sequence with my starting task, then run gulp.start() on the original sequence. So, either way, I am hacking into the gulp chain, or trying to re-engineer the whole build chain...

Using SPFx App Customizer I'm using a _fetchFromSPList() call to populate a MegaMenu (MM) from a SharePoint list onto modern pages. Site Owner permissions can see the MM from any modern page, list, or library, so no problem there, but users with Member (contribute) permissions and Visitor (read-only) can not see the MM on modern pages, but can see the MM list in Site Contents.

I created a new permission level and assign it to a test user aiming for only Read access to the MM list. But specifically, the "Manage Lists" checkbox must be selected for this user to see the MM on modern pages.

Within the user's permission level, I've cut off most everything including Add, Edit, and Delete Items, so when visiting the list in Site Contents the user can see the items without editing them, but the 'Manage Lists" permissions gives the user access to the MM List Settings, with access to create new columns and even delete the list.

Why would a user need Manage List permissions to view a SPFx application customizer?

Troubleshooting Ideas:
On MS docs: https://docs.microsoft.com/en-us/sharepoint/dev/sp-add-ins/add-in-permissions-in-sharepoint I've tried placing the <AppPermissionRequests> elements in for scoping rights to the specific web and the specific list, but all of the documentation points to an AppManifest.xml file, which does not exist in my SPFx solution.

The most similar file in my solution is the package-solution.json file which states the package version and just so happens to have a "webApiPermissionRequests" attribute, but intelecense gives me no options to scope the permissions specifically. Anyone have examples to target my specific list with a permission level to Read access without List Management permission?

Another suspicion is in the Node Modules > sp-pnp-js > lib > sharepoint > lists.d.ts file there's a ListEnsureResult boolean that being used when I call for my list data using _fetchFromSPList(). I suspect there could be something here that's relying on a permission level not given to all users.

Expected or Desired Behavior
SP Field Customizer loads on demand when switching to a view that contains the field and the view renders/displays.

Observed Behavior
If the initial view loaded contains the custom field then all views that have the custom field render correctly. However, if the initial view does not contain the custom field then when trying to switch to a view that contains the custom column the view does not load. The view id in the query string changes. Views without the custom column will load without a problem.

The following console log is written when clicking the view from the drop down:
sp-client module loader promise does not exist

Steps to Reproduce
1) Build a field customizer based on https://docs.microsoft.com/en-us/sharepoint/dev/spfx/extensions/get-started/building-simple-field-customizer
2) Deploy solution via Office 365 CDN based on https://docs.microsoft.com/en-us/sharepoint/dev/spfx/extensions/get-started/hosting-extension-from-office365-cdn
3) Add app to site
4) Add custom column to library, do not add it to the default view
5) Add custom column to a non default view
6) Navigate to default view in modern ui
7) Attempt to switch to the view that contains the custom field