It's been a while... Introducing Devframe v1.0 🚀 The framework for building DevTools that can run everywhere, for any meta-framework, for both humans and agents. Check out the announcement post and join our Discord 👇

Pluggable, Extensible, and Playful DevTools

Introduction to Devframe, a framework for building pluggable, extensible, and playful DevTools.

devfra.me

I wrote this one! 🙋‍♂️ In CJK languages, hitting Enter to confirm an IME candidate can accidentally submit the form in chat textareas The guide shows how to safely implement "Enter to submit" including how to work around a Safari event-ordering bug with isComposing github.com/GoogleChrome...

modern-web-guidance/skills/modern-web-guidance/guides/forms/ime-safe-enter-submit.md at v0.0.186 · GoogleChrome/modern-web-guidance

Keep your coding agent up to date with the latest web best practices - GoogleChrome/modern-web-guidance

github.com

Chrome for Developers@developer.chrome.com · last mo.

Here's what's new in Modern Web Guidance v0.0.186 → goo.gle/4xcsdWW ⌨️ New guide on IME-safe textarea submission, along with recs for handling KeyboardEvent.isComposing for IME 🔎 Mandatory code verification step for agents in the global MWG skill

I just sponsored sxzz. Go sponsor your open source dependencies!

Sponsor @sxzz on GitHub Sponsors

An open sourceror. Working on Vue, Vite, VueUse, and their ecosystems.

github.com

If you’re not stalking TypeScript PRs, you might be surprised how much you can do with the API in nightlies (and even in 7.0 stable), so here’s a tiny demo that I think hits some of the highlights. 🧵

Changesets is using tsdown

Mateusz Burzyński@andarist.bsky.social · 2mo ago

Changesets v3 is here! 🦋 After months of chipping away at issues alongside @bluwy.me, @haglund.dev, and many other contributors, we’re excited to finally share it. changesets.dev/blog/announc...

Just like this is Johnson’s project, he can do whatever he wants. After using such disrespectful language toward someone (regardless of where), I thought you knew you could always directly fork an OSS project instead of impotently raging like an asshole. No community welcomes you.

TIL: Domains like .dev, .app are required to use HTTPS.

❯ pnpm run release && claude --dangerously-skip-permissions /review-npm-stage github.com/sxzz/review-...

GitHub - sxzz/review-npm-stage

Contribute to sxzz/review-npm-stage development by creating an account on GitHub.

github.com

Glad to help move the ecosystem toward: - ESM-only - TypeScript - OIDC + staged publishing - Runtime-agnostic design wherever possible - No bundled deps unless needed - Like-minded dependencies I’ve replaced `debug` and `semver` with `obug` and `verkit`. What’s next? 🤔

James@43081j.com · 3mo ago

good timeline. this is magic-string, 140M dls/week. a week ago i asked if it could go ESM only - @sxzz.dev dropped a PR <1 day later 🎉 later, I removed sourcemaps and did 2 big CPU perf speed ups 🚀 love seeing a high impact package like this shrink and speed up

The tsdown ecosystem, visualized ✨ Each circle = a project owner using tsdown, sized by GitHub stars. 873 projects over 100 stars and counting. Grateful to everyone shipping with it.

magic-string got more than half smaller btw!

Anthony Fu@antfu.me · 3mo ago

magic-string v1.0.0 gets released with pure-ESM, thanks to @sxzz.dev!

Volar now has first-class support in tsdown and rolldown-plugin-dts. It can generate `.d.ts` files for all file types supported by Volar, including Vue and Astro. github.com/sxzz/rolldow...

feat: support multiple volar plugins · sxzz/rolldown-plugin-dts@7cb4ee8

github.com

magic-string v1.0.0 gets released with pure-ESM, thanks to @sxzz.dev!

Release v1.0.0 · Rich-Harris/magic-string

In magic-string v1.0.0, it's now pure ESM, and the type declarations are built from the TypeScript source. This means the previous CJS, UMD, and IIFE builds are now dropped as we believe the ecosys...

github.com

🎉 magic-string is now fully migrated to pure ESM and TypeScript, and its long-awaited v1.0 release is finally here! github.com/Rich-Harris/...

feat!: migrate build to pure ESM and TypeScript by sxzz · Pull Request #310 · Rich-Harris/magic-string

closes #309, closes #301

github.com

⚡ After `rolldown-plugin-dts` migrated Babel toolchain to yuku, tsdown has cut ~5 MB from its install size and is now smaller than tsup. ❤️ Huge thanks to arshad-yaseen for the help!

i am cool

Alexander Lichter@thealexlichter.com · 3mo ago

vue is cool

tsdown #1000 issue github.com/rolldown/tsd...

@tsdown/css should reuse sass-embedded AsyncCompiler instead of spawning a compiler per SCSS transform · Issue #1000 · rolldown/tsdown

Clear and concise description of the problem @tsdown/css currently loads Sass via loadSass() and compiles SCSS with the module-level API: const sass = await loadSass(); const result = await sass.co...

github.com

We've started by verifying npmx maintainers. Log in to mu.social to see the verified badges! We'd like to discuss the best strategy for our communities with OSS maintainers. Should all large enough OSS projects be verifiers? Or would it be better for a few orgs/foundations to take on the task?

Eurosky Social@eurosky.social · 4mo ago

We're delighted to launch with multiple trusted verifiers: @france-atmosphe.re @npmx.dev and @medsky.network. Trusted organizations, businesses and professional networks can become verifiers and verify their people and accounts - reach out at verification@mu.social

Open-sourced now! github.com/regesta-dev/...

I deployed an instance at registry.regesta.dev If anyone is interested, I can invite you to the GitHub repo!

Kevin Deng@sxzz.dev · 4mo ago

I’m designing a transparent, ecosystem-neutral package registry. Content-addressed releases, append-only events, mirrorable state, and projections for npm/PyPI/Cargo/Go/OCI. Feedback welcome: regesta.dev

Hello friends and welcome to another “how’s ESM vs CJS doing?!” A big win this time, at a year of `require(esm)` available! 38.0% of the popular npm packages now have ESM, up from 33.4% half a year ago. ESM-only is up from 12.6% to 16.0%. Particularly this non-dual, “vanilla” growth is very big!

I’m designing a transparent, ecosystem-neutral package registry. Content-addressed releases, append-only events, mirrorable state, and projections for npm/PyPI/Cargo/Go/OCI. Feedback welcome: regesta.dev

📦 @pnpm.io 11.5 adds support for recognizing npm staged publishes after staged approval metadata triggered a false downgrade signal. As npm adds more release paths, registry metadata needs to make it clear how each package version was published. socket.dev/blog/pnpm-11...

pnpm 11.5 Adds Support for Recognizing npm Staged Publishes ...

pnpm 11.5 now recognizes npm staged publish approvals in release metadata, preventing those releases from being mistaken for lower-trust package publi...

socket.dev

I now own VoidZero.

I'm designing and creating a new registry

happy pride month 🎉

i made a new game called js crossword where you have to solve it by literally writing javascript code that eval()'s into the correct values! check it out if you're into ctfs or wanna challenge your javascript skills lyra.horse/fun/jscrossw... <3

It’s been really encouraging to see tsdown adopted by companies like @vercel.com and @cloudflare.social, as well as open-source projects like OpenClaw and LobeHub. If tsdown has been useful to you or your project, please consider sponsoring my work ❤️ github.com/rolldown/tsd...

Who's using tsdown? · rolldown tsdown · Discussion #143

Which Projects Are Using tsdown? Share Your Insights! Hey everyone! 🚀 We're curious to know which projects or teams are currently using tsdown. Whether it's a personal side project, a startup, or a...

github.com

npm increasingly feels like a zombie org under GitHub. As someone who's been around the JS ecosystem and part of multiple OSS orgs for years, what I'm seeing isn't just "big co moves slow." It's quiet neglect of critical infrastructure the entire JS world runs on. A short thread 🧵

PSA: the safest way to publish an npm package today is staged publish + OIDC + provenance. "But it can't stop every attack." Sure, and seatbelts don't prevent every injury either. We still wear them. Security is layers, not silver bullets.