SolidStart v2 is out now 🥳🥂! github.com/solidjs/soli...

SolidStart v2 is now Stable · solidjs solid-start · Discussion #2281

SolidStart v2 is now stable Documentation We’re thrilled to announce that SolidStart v2 is now stable. SolidStart v2 modernizes the foundation for building full-stack applications with Solid v1. Bu...

github.com

Excited to share vlt 1.0 along with our hosted registries & ecosystem mirrors now GA! A drop-in npm replacement, built so nothing runs on your machine just because you typed install. → faster delivery → malware blocking at the registry layer → graph-native querying

🚨 Update: Watching this npm worm propagate in real time, we’re now tracking 2,234 affected package artifacts across 444 unique packages, and it’s still spreading. Average detection time: 5 min and 18 seconds after publication. Our campaign page includes all affected packages/versions.

Socket@socket.dev · yesterday

🚨 Active npm supply chain attack: keyv​@​6.0.0 and 13 other packages have been compromised. keyv alone gets 154M weekly downloads. The worm steals cloud and CI credentials, then uses stolen npm tokens to publish trojanized versions of more packages.

🧾 Introducing npm.tax Estimate the probability of being impacted by a breach in your npm supply chain. Adjust the knobs to see how slimming your node_modules lowers your risk. Look up a package to see its own risk profile, then share the report, e.g. npm.tax?direct=59&tr.... What's your npm tax?

npm.tax: npm supply-chain risk explorer

Explore how your code, npm dependency count, breach probability, and time horizon combine into cumulative supply-chain risk.

npm.tax

ANNOUNCEMENT: I’ve been working on putting together something between a retreat and a hackathon for #atproto builders for the past several weeks. I’ve been in discussion with potential funders and some funding has become available to make this a reality. now, I need your help!! KEEP READING 👇🏽

Humans enjoying and valuing something you came up with and made: put this in my veins.

George Rodier@georgerodier.com · 5d ago

We were looking at some dependency decisions at work today, and let me tell you, the @npmx.dev open compare feature proved to be super useful!!!

What other way to start the day but joy and cringing at watching myself speak. @patak.cat and my talk is up now!! 🧵 www.youtube.com/watch?v=FqdJ...

Matias Capeletto & Willow (GHOST) - npmx: a fast, community-built browser for the npm registry

YouTube video by Local-First Conf

youtube.com

new @e18e.dev blog post about when to publish source maps to npm 📦 source maps are often the reason behind bloated install sizes, but sometimes necessary. here we try to explain some of the balance, do/don't

Source maps or not?

Source maps are great for debugging, but should we be shipping them in production?

e18e.dev

WHAT. Where has this been all my life?

Lars@webpro.nl · last wk.

✂️ Knip strict mode is about to detect which type-only packages are production dependencies. If their types appear in published declarations, consumers need them too. Try it out, welcoming feedback: PR: github.com/webpro-nl/kn... Docs: issue-1909-exact-type-depend.knip.pages.dev/guides/handl...

i built a thing 👀 i noticed a huge amount of packages have broken sourcemaps, and some of the existing linters/checkers didn't work quite the way i wanted. so here's `maplint`! it can lint your local sourcemaps or those of an npm package

GitHub - 43081j/maplint: A tiny linter to validate sourcemap files.

A tiny linter to validate sourcemap files. Contribute to 43081j/maplint development by creating an account on GitHub.

github.com

@netlify.com has signed the open letter in support of open weights 👁️👁️ Coincidentally, more news on this front soon

Netlify@netlify.com · last wk.

Netlify signed the Open Weights and American AI Leadership document. Matt's post on why starts in East Berlin in the late 80s, looking at a technology frontier he couldn't reach from where he was standing. www.netlify.com/blog/open-we...

Summer break is over: The @e18e.dev & friends show is coming back next week 🎉 And we got nobody else than the one and only @honk.foo talking about Porforr and how a future for natively compiled JavaScript could look like! Swing by at 7pm CEST / 1pm EDT on August 4th 👌 youtube.com/live/L8Edgas...

e18e & friends E004 - Oliver Medhurst

What if you could compile JavaScript to Native but ahead of time? W...

youtube.com

the best news! 🎉 this is the kind of community collaboration i'd love to see more orgs doing. CodeRabbit can now flag redundant packages amongst other things 🧹

Santosh Yadav | GDE 🅰️ | GitHub ⭐ | MVP@santoshyadav.dev · last wk.

CodeRabbit's ESLint reviews now run the e18e ESLint plugin v0.5.1by default. It was great to collaborate with @43081j.com to make this possible 😍

the bsky design team is working on communities and looking for feedback. one core idea we have is builders should be able to create apps and websites for their communities. they shouldn't only show up on bsky. community builders: would you want to create a separate custom app/site?

this year i've carved a big chunk of my time out to officially work on OSS. if you like what I do, or use the things I work on, sponsorships go a long way. these help me keep the balance I have, and allow me to dedicate a lot more time to open source. thank you to those who already sponsor me 💙

Sponsor @43081j on GitHub Sponsors

Maintainer of clack, chai, parse5, unjs, vueuse, tinylibs, & more. One of the e18e.dev leads. Core contributor to lit and modernweb.

github.com

Worry no more about your colleagues accidentally publishing a wide-open internal financial report microsite to the internet from ChatGPT. Hypothetically, right? 🔒 New sites are now private by default. Opt in to make it public with one click.

Netlify@netlify.com · last wk.

For most of Netlify's history, every new project deployed straight to a public URL. That made sense when going live took real effort. Now a deploy is often a work in progress: prototypes, internal tools, early client work, agent builds. So new projects can start private. ntl.fyi/4yF4LU9

Svelte Summit tickets are coming in the next few days 🎟️ Join the launch list and we’ll email you a discount code when they go live. See you in Ljubljana on November 19–20. → sveltesummit.com/ticket-updates

Nuxt security update: multiple vulns patched in 4.5.1 and 3.21.10. Watch the route rule auth bypass. Uppercase keys like /Admin were silently skipped. It's a regression, so 4.4.7 / 3.21.7 isn't enough. www.netlify.com/changelog/20...

8 new @nuxt.com CVEs have just been published, including one critical vulnerability in dev. 👉🏼 Nuxt users on @netlify.com: www.netlify.com/changelog/20...

Nuxt security vulnerabilities: what Netlify users need to know

The Nuxt team has disclosed several vulnerabilities fixed in Nuxt 4.5.1 and 3.21.10. Affected Netlify projects should upgrade.

netlify.com

Nuxt@nuxt.com · last wk.

🔐 Nuxt 4.5.1 and 3.21.10 are out, fixing several security issues, plus a critical dev-only fix in @​nuxt/devtools 3.3.1. Please upgrade as soon as you can: npx nuxt upgrade --dedupe 👉 Read more at nuxt.com/blog/v4-5-s....

Huge thanks to the researchers who reported these issues responsibly, and to the teams at Vercel, Netlify and Cloudflare who helped put protections in place ahead of disclosure. ❤️ 👉 If you've found something, report privately: github.com/nuxt/nuxt/s...

GitHub

GitHub is where people build software. More than 150 million people use GitHub to discover, fork, and contribute to over 420 million projects.

github.com

I’ve been working on an Exaclidraw fork for about a week that syncs your drawings to your Atmosphere account as well as uses Iroh for realtime encrypted end to end collaborative work. I feel like it’s at a stage where I can share it. Meet lexidraw.app!

Lexidraw, an Excalidraw fork where your drawings follow you

Lexidraw is an Excalidraw fork where your drawings follow you. Share publicly with the Atmosphere or privately with iroh.

lexidraw.app

My first contribution to @tangled.org has landed! You can now configure PR webhook events (opened, reopened, resubmitted, merged, and closed). Notably, this brings us one step closer to first-class integrations with platforms like @netlify.com 😈.

Philippe Serhal@philippeserhal.com · 2w ago

Oops, I somehow ended up adding pull request webhook events to @tangled.org instead? tangled.org/tangled.org/...

diagnose me: ❯ vite dev Port 3000 is in use, trying another one... Port 3001 is in use, trying another one... Port 3002 is in use, trying another one... Port 3003 is in use, trying another one... VITE v8.1.5 ready in 3134 ms ➜ Local: localhost:3004

@npmx.dev is not just a browser for packages, it's mostly a reminder that we can take internet back in our hands. You want it, you build it.

Mocha is donating $20k to more active open source projects: Knip, @nodejs.org, Prettier, and Unified. 🤎 mochajs.org/blog/2026-co...

TypeScript RFC: `as` → `unsafe_as` `any` → `unsafe_any` `!` → `!!!` and a tsconfig strict flag to disallow each (I know linters support this already!)

The framework CVEs will continue until morale improves. (But seriously, go upgrade if you have any React Router sites.)

Netlify@netlify.com · 2w ago

Five security vulnerabilities were disclosed in React Router today. All patched in react-router 7.18.0. Upgrade, then check your deploy previews. Public previews and branch deploys stay vulnerable until deleted. What Netlify users need to know: www.netlify.com/changelog/20...

Type-aware Linting via Oxlint is now stable 🎉 oxc.rs/blog/2026-07...

Type-Aware Linting Stable

A collection of high-performance JavaScript tools written in Rust

oxc.rs

something i've been hacking away at lately it converts GitHub workflows to @tangled.org pipelines and vice versa. it doesn't support a huge amount of things yet but i'm still improving it. it can convert basic JS CI workflows today

GitHub - 43081j/tangleflow: Convert GitHub actions workflows to tangled pipelines and vice versa.

Convert GitHub actions workflows to tangled pipelines and vice versa. - 43081j/tangleflow

github.com

9 more Next.js CVEs have just been published. TL;DR: Upgrade to 16.2.11 or 15.5.21. 👉🏼 @netlify.com user impact details: www.netlify.com/changelog/20...

Next.js security release (July 2026): what to know

Nine Next.js vulnerabilities disclosed: SSRF, middleware auth bypass, DoS, and cache issues. Affected projects should upgrade to 15.5.21 or 16.2.11.

netlify.com

Next.js@nextjs.org · 2w ago

Following our move to scheduled, pre-announced security updates, the July release is out. This release addresses several security issues in Next.js 16 and 15. Update to 16.2.11 (Active LTS) or 15.5.21 (Maintenance LTS) now. nextjs.org/blog/july-2... x.com/nextjs/stat...