Ben McCann

@benmccann.com

Investor and entrepreneur. SvelteKit maintainer. Co-founded Connectifier - acquired by LinkedIn

This di.day is my hardest yet. Bye discord, github and npmjs registry. (there may be some cleanup activities in the coming days but no more active contributions, accounts are inactivated to prevent imposter takeover) Unfortunately this means i also am no longer an active vite team member.

dominikg@dominikg.dev · 3mo ago

Long weekend coming up in europe with labor day on may 1st and Sunday it's di.day again. Good occasion to leave and boycott services that are outright hostile to their own users and even employees (Hey meta, microsoft, google, ...)

🎉 We're excited to finally announce TinyBase v8.1 - the one with native Svelte 5 support. We've got Svelte demos, guides, and a getting-started tool. Links below! This was fun and we want to give a huge shout out to the @svelte.dev community for being so helpful and supportive!

I just took my first brief look at the OpenClaw repository and I was shocked. 5,000 open PRs, 500 dependencies, 250 security issues! 😱 I can't imagine trying to manage a project that gets so popular so quickly.

SvelteKit 2 now fully supports Vite 8 SvelteKit 3 will require it - giving additional optimizations and functionality. E.g. SvelteKit 3 will use @rolldown.rs hook filters to spend more compilation time in rust and less in JavaScript. And SvelteKit 3 adapters use only rolldown without esbuild

It's official, you can now get paid up to $10,000 for finding security issues in Svelte and SvelteKit! Big thanks to both the security team at Vercel and the Svelte maintainers' group for coming together to make this possible. Learn more: vercel.com/blog/the-ver...

The Vercel OSS Bug Bounty program is now available - Vercel

Vercel is opening its open source software bug bounty program to the public for researchers find vulnerabilities and make OSS safer

vercel.com

Every time you update your dependencies and see that your deps tree gets slimmer, there is a high chance you're enjoying the relentless work of James or other folks from the @e18e.dev community that he inspired to get into action. Consider sponsoring him if you care about the JavaScript ecosystem.

James@43081j.com · 7mo ago

just a reminder that i have github sponsors if you'd like to sponsor the OSS work i do. i maintain quite a few projects, and contribute to many more. nobody other than these sponsors pay for that. so these help a huge amount, however small 🙏 thanks so much to those who already did ❤️

the most recent data shows Waymo's self-driving cars perform significantly *better* than human drivers. the most recent data shows Tesla Robotaxis perform significantly *worse* than human drivers, even with a safety monitor in the front seat. sherwood.news/tech/teslas-...

Tesla’s 29 Austin Robotaxis have crashed 8 times since June, as data suggests they perform much worse than human drivers

That’s a lot of crashes for such a small fleet....

sherwood.news

Guys I'm not making this up...I asked Claude, ChatGPT, Gemini and Grok what frontend framework they would pick if they only could pick the one they would enjoy writing more. They ALL said Svelte 🧡 Do your LLM a favor, switch to Svelte 🧡

Bild

I wonder why none of the literally HUNDREDS of individuals with access to publish the Zapier SDK noticed their organization was committing engineering malpractice by giving that many people access to the keys of the kingdom. And that's how you catch SHA1-Hulud... www.npmjs.com/package/@zap...

Shai Hulud 2.0 Strikes Again: Malware Supply-Chain Attack Hits Zapier & ENS Domains

The threat actor behind “Shai Hulud 2.0” launched a new malware campaign compromising the supply chain of Zapier, ENS Domains and more — exposing secrets, injecting malicious code, and enabling widesp...

aikido.dev

When reducing dependencies in Svelte projects, I was really surprised how many dependencies the typical glob library has and ended up switching most of the JS ecosystem to tinyglobby once it became available. With one final PR pending, the Svelte ecosystem is nearly free of extra glob dependencies!

James@43081j.com · 9mo ago

tinyglobby is a great success, and has shown us how much we can improve perf for everyone. here's some of the story! big thanks to @superchupu.dev and @benmccann.com for putting so much work into this and the migrations/adoption. we're lucky to have both in the @e18e.dev community 💙

@pnpm.io added a `trustPolicy` option in 10.21. It allows you to prevent installing potentially malicious dependency updates that are not signed like previous versions. pnpm.io/blog/release... Thank you for all the performance, productivity and security enhancements over the last years 💜