Philippe Serhal
@philippeserhal.com
💼 Staff Engineer @netlify.com, frameworks, build system, CLI 🔨 Open source @npmx.dev, forges, gatsby. Vite team advisor.
It's Groundhog Day again! 7 new Next.js CVEs have been published. We received proactive disclosures and worked with the Next.js team to secure @netlify.com Next.js projects. TL;DR: Upgrade asap. 👉🏼 www.netlify.com/changelog/20...
Next.js security release (Nov 2026): what to know
Seven Next.js vulnerabilities disclosed: cache leaks, cookie exposure, and cache poisoning. Some affect Netlify. Affected projects should upgrade.
netlify.com
I don't hear this said much: knip.dev is a security hardening tool. The lowest hanging fruit to secure your supply chain is to remove parts of it that aren't even used. Automatically. Tell your boss that's why you need to spend some time setting it up due to the current cybersecurity outlook.
Declutter your JavaScript & TypeScript projects
Project linter to find unused dependencies, exports and files
knip.dev
In a "The cobbler’s children have no shoes" situation, the (12 year old!) @netlify.com app codebase is still on webpack. In an effort to improve DX/AX by speeding up builds and dev and so on, I've been slowly trudging through a migration to @vite.dev. 4 more small PRs to go, then The Big One. 🤞
We have an open position for a senior engineer in the @storybook.js.org team again! 🏠 Fully remote 🤗 OSS work every single day 🛠️ Developer tooling and JS ecosystem 🌍 Europe ❌🎨 Not much UI work, mostly behind the scenes details like parsers, rendering, Node.js CLIs, web servers etc.
Chromatic • Senior Software Engineer (Storybook)
Our mission is to improve the UX of the internet.
chromatic.com
👀 @brandonroberts.dev have you considered emitting a fetchable.org server entry by default in analog v3? TanStack Start and SolidStart 2 (www.netlify.com/changelog/20...) 'just work' in dev and prod via the Netlify Vite plugin. Analog next?
Fetchable specification
fetchable.org
Brandon Roberts@brandonroberts.dev · 2d ago🛒 In @analogjs.org v3, you can Bring Your Own Server and use Analog features (SSR, server functions, page load functions) NestJS 🤝 Analog Hono 🤝 Analog @nodejs.org http 🤝 Analog v3.analogjs.org/docs/feature... #angular
so uh we're all drowning in security work lately, yeah? I'm tired, boss
We made npmx even faster! Fun origin story: just for fun, I was trying to get npmx deployed to @netlify.com at full fidelity, and it's while benchmarking differences that I discovered all these (six!) perf optimization opportunities. I feel like there's a lesson here, but I don't know what it is.
npmx@npmx.dev · 5d agonpmx v0.22 is out!
I already upgraded a small app of mine. Check it out: 📉 build time 7s → 4.3s (-39%) 📉 server output (Netlify function): 4248 KB → 1168 KB (-73%) 📉 first SSR: 771 ms → 36ms (!!!) 📉 -82 dependencies (21 MB) in my tree 🫢 Worth the wait!
daniel r(ooooooh) at jsconf mx 🇲🇽@danielroe.dev · 5d agothe latest nuxt nightly version with nitro rc is out now if you want to play around! 🔥
Nitro v3 RC is out with a stable API. 5× smaller install size, runtime mode, Vitest support, and so much more ⚡️
Huh, anyone else unable to log in anymore? Looks like a CORS error 🤔.
Tangled@tangled.org · 6d agoWe're back up! This was most certainly not how we'd planned for our launch to go, and we're incredibly sorry for the downtime. For now, please enjoy the new version of Tangled. Our team is catching some much needed sleep and will be back for a do over.
Finally got around to a maintenance update for boarding.js 👌 Dropped the install size and went pure ESM. Thanks @npmx.dev for the chart! npmx.dev/package/boar...
👀 The otel npm packages are so huge. Looking forward to this landing someday.
bryan english@bengl.dev · last wk.A fun thing I'm working on: A minimalist implementation of @opentelemetry.io auto tracing and egress via OTLP/JSON for @nodejs.org, with the intention of baking it into Node.js itself for OOTB observability. It's not ready yet! But here it is. github.com/nodejs/micro...
GitHub, you are hereby absolved of all your sins. Go in peace. github.blog/changelog/20...
Pull requests: Saved whitespace preferences and improved split view - GitHub Changelog
Two improvements make it easier to review pull requests in the “Files changed” page: You can save your whitespace visibility preference across pull requests New and deleted files now use…
github.blog
talking about coherence, collaboration in the community is as strong as ever behind the noise. they're going to unlock so many paths to explore with this project. check it out and get involved 🧡
daniel r(ooooooh) at jsconf mx 🇲🇽@danielroe.dev · 2w ago🙋♂️ what if one client worked on every forge? 𝔣𝔬𝔯𝔤𝔢𝔰 is a new TypeScript library for issues, PRs, notifications, checks and webhooks across 12 forges ✨ forges.link
Daniel Roe, the creator of Nuxt, and the NPMX team released a JS client that can connect to any Git forge and they were gracious enough to include Pushin! Thanks to then and their valuable feedback, Pushin’s API is now much better. Thank you, NPMX team! ❤️
daniel r(ooooooh) at jsconf mx 🇲🇽@danielroe.dev · 2w ago🙋♂️ what if one client worked on every forge? 𝔣𝔬𝔯𝔤𝔢𝔰 is a new TypeScript library for issues, PRs, notifications, checks and webhooks across 12 forges ✨ forges.link
🚀 Check out what I've been spending my evenings working on with some OSS friends! 👀 It's so exhaustive and ambitious already. 💭 What will you build on top of this? Does this give you ideas? What didn't seem possible before that may now be in reach?
daniel r(ooooooh) at jsconf mx 🇲🇽@danielroe.dev · 2w ago🙋♂️ what if one client worked on every forge? 𝔣𝔬𝔯𝔤𝔢𝔰 is a new TypeScript library for issues, PRs, notifications, checks and webhooks across 12 forges ✨ forges.link
I'm sorry to vaguepost, but there are multiple really exciting things coming to @netlify.com in the next 1-2 months. I can't wait for these launches! Ahhhhh.
Nervous Shaking
Alt: Kenneth from 30 Rock nervously shaking while drinking from a water bottle
static.klipy.com
has anyone slop forked the typescript compiler in coffeescript yet? opportunities abound.
I've put together a web component for embedding npm package information on your site. Ready for use on your blog or in your documentation. However, it's better than that because it does it the cool, funky, rad, fantastic @npmx.dev way. tangled.org/vale.rocks/n... #npm #npmx
vale.rocks/npmx-embed
A web component for embedding npm packages on the web.
tangled.org
github.com/withastro/ro... Composition: so hot right now
daniel r(ooooooh) at jsconf mx 🇲🇽@danielroe.dev · 3w agoI'll be talking about how nuxt v4.6 went agnostic and shipped `nuxt/server` … and `@nuxt/vite-server` 👀 can't wait to see people using some of these new APIs in the wild 😁 we have some exciting things planned as a team.
Since last ViteConf, @pi0.io has spent his time on @nitro.build v3: H3 rewritten on web standards, a compiled router, route rules in core. Wondering what is left before stable? Tune in for his talk "Nitro v3: the road to stable" @viteconf.org 2026, TODAY 2pm UTC. Free and online.
You can't stop maintainers getting phished. But what you can is stopping bad release reaching your lockfile! Set a minimum publish age, approve install scripts per version, let pnpm reject trust downgrades. @43081j.com in "Securing the JavaScript Ecosystem" 🔒️ @viteconf.org, today, 14:00 UTC
Around 70% of open source maintainers work alone or in small teams, and most are unpaid. @mirandaheath.website, Director and psychologist at the @stewardshiplab.org on the four drivers of burnout and what AI does to each. @viteconf.org 2026, 15 oct (TODAY) 2pm UTC. Free and online. viteconf.org
