TIL: Domains like .dev, .app are required to use HTTPS.

❯ pnpm run release && claude --dangerously-skip-permissions /review-npm-stage github.com/sxzz/review-...

GitHub - sxzz/review-npm-stage

Contribute to sxzz/review-npm-stage development by creating an account on GitHub.

github.com

Glad to help move the ecosystem toward: - ESM-only - TypeScript - OIDC + staged publishing - Runtime-agnostic design wherever possible - No bundled deps unless needed - Like-minded dependencies I’ve replaced `debug` and `semver` with `obug` and `verkit`. What’s next? 🤔

James@43081j.com · 2w ago

good timeline. this is magic-string, 140M dls/week. a week ago i asked if it could go ESM only - @sxzz.dev dropped a PR <1 day later 🎉 later, I removed sourcemaps and did 2 big CPU perf speed ups 🚀 love seeing a high impact package like this shrink and speed up

The tsdown ecosystem, visualized ✨ Each circle = a project owner using tsdown, sized by GitHub stars. 873 projects over 100 stars and counting. Grateful to everyone shipping with it.

magic-string got more than half smaller btw!

Anthony Fu@antfu.me · 3w ago

magic-string v1.0.0 gets released with pure-ESM, thanks to @sxzz.dev!

Volar now has first-class support in tsdown and rolldown-plugin-dts. It can generate `.d.ts` files for all file types supported by Volar, including Vue and Astro. github.com/sxzz/rolldow...

feat: support multiple volar plugins · sxzz/rolldown-plugin-dts@7cb4ee8

github.com

magic-string v1.0.0 gets released with pure-ESM, thanks to @sxzz.dev!

Release v1.0.0 · Rich-Harris/magic-string

In magic-string v1.0.0, it's now pure ESM, and the type declarations are built from the TypeScript source. This means the previous CJS, UMD, and IIFE builds are now dropped as we believe the ecosys...

github.com

🎉 magic-string is now fully migrated to pure ESM and TypeScript, and its long-awaited v1.0 release is finally here! github.com/Rich-Harris/...

feat!: migrate build to pure ESM and TypeScript by sxzz · Pull Request #310 · Rich-Harris/magic-string

closes #309, closes #301

github.com

⚡ After `rolldown-plugin-dts` migrated Babel toolchain to yuku, tsdown has cut ~5 MB from its install size and is now smaller than tsup. ❤️ Huge thanks to arshad-yaseen for the help!

i am cool

Alexander Lichter@thealexlichter.com · 4w ago

vue is cool

tsdown #1000 issue github.com/rolldown/tsd...

@tsdown/css should reuse sass-embedded AsyncCompiler instead of spawning a compiler per SCSS transform · Issue #1000 · rolldown/tsdown

Clear and concise description of the problem @tsdown/css currently loads Sass via loadSass() and compiles SCSS with the module-level API: const sass = await loadSass(); const result = await sass.co...

github.com

We've started by verifying npmx maintainers. Log in to mu.social to see the verified badges! We'd like to discuss the best strategy for our communities with OSS maintainers. Should all large enough OSS projects be verifiers? Or would it be better for a few orgs/foundations to take on the task?

Eurosky Social@eurosky.social · 2mo ago

We're delighted to launch with multiple trusted verifiers: @france-atmosphe.re @npmx.dev and @medsky.network. Trusted organizations, businesses and professional networks can become verifiers and verify their people and accounts - reach out at verification@mu.social

Open-sourced now! github.com/regesta-dev/...

I deployed an instance at registry.regesta.dev If anyone is interested, I can invite you to the GitHub repo!

Kevin Deng@sxzz.dev · 2mo ago

I’m designing a transparent, ecosystem-neutral package registry. Content-addressed releases, append-only events, mirrorable state, and projections for npm/PyPI/Cargo/Go/OCI. Feedback welcome: regesta.dev

Hello friends and welcome to another “how’s ESM vs CJS doing?!” A big win this time, at a year of `require(esm)` available! 38.0% of the popular npm packages now have ESM, up from 33.4% half a year ago. ESM-only is up from 12.6% to 16.0%. Particularly this non-dual, “vanilla” growth is very big!

I’m designing a transparent, ecosystem-neutral package registry. Content-addressed releases, append-only events, mirrorable state, and projections for npm/PyPI/Cargo/Go/OCI. Feedback welcome: regesta.dev

📦 @pnpm.io 11.5 adds support for recognizing npm staged publishes after staged approval metadata triggered a false downgrade signal. As npm adds more release paths, registry metadata needs to make it clear how each package version was published. socket.dev/blog/pnpm-11...

pnpm 11.5 Adds Support for Recognizing npm Staged Publishes ...

pnpm 11.5 now recognizes npm staged publish approvals in release metadata, preventing those releases from being mistaken for lower-trust package publi...

socket.dev

I now own VoidZero.

I'm designing and creating a new registry

happy pride month 🎉

i made a new game called js crossword where you have to solve it by literally writing javascript code that eval()'s into the correct values! check it out if you're into ctfs or wanna challenge your javascript skills lyra.horse/fun/jscrossw... <3

It’s been really encouraging to see tsdown adopted by companies like @vercel.com and @cloudflare.social, as well as open-source projects like OpenClaw and LobeHub. If tsdown has been useful to you or your project, please consider sponsoring my work ❤️ github.com/rolldown/tsd...

Who's using tsdown? · rolldown tsdown · Discussion #143

Which Projects Are Using tsdown? Share Your Insights! Hey everyone! 🚀 We're curious to know which projects or teams are currently using tsdown. Whether it's a personal side project, a startup, or a...

github.com

npm increasingly feels like a zombie org under GitHub. As someone who's been around the JS ecosystem and part of multiple OSS orgs for years, what I'm seeing isn't just "big co moves slow." It's quiet neglect of critical infrastructure the entire JS world runs on. A short thread 🧵

PSA: the safest way to publish an npm package today is staged publish + OIDC + provenance. "But it can't stop every attack." Sure, and seatbelts don't prevent every injury either. We still wear them. Security is layers, not silver bullets.

Heads up: npm's stage publish still has an unresolved issue. Toolchains can't tell if a package was published via trusted publishing once it's staged, so tools like pnpm end up showing false security downgrade warnings. github.com/pnpm/pnpm/is...

no-downgrade false positive with staged publishing · Issue #11887 · pnpm/pnpm

Verify latest release I verified that the issue exists in the latest pnpm release pnpm version 11.x Which area(s) of pnpm are affected? (leave empty if unsure) No response Link to the code that rep...

github.com

Kevin Deng@sxzz.dev · 2mo ago

The first high-impact package for staged publishing has arrived: tinyexec! @43081j.com

The first high-impact package for staged publishing has arrived: tinyexec! @43081j.com

Kevin Deng@sxzz.dev · 2mo ago

Tracking npm provenance adoption across the top ~15k high-impact packages. Now with daily trend data 📈 Since Aug 2025: • Trusted Publisher: 0.55% → 16.69% • Provenance: 6.96% → 3.14% • Untrusted: 92.49% → 80.17% Trusted Publisher adoption is climbing fast! github.com/sxzz/npm-top...

Tracking npm provenance adoption across the top ~15k high-impact packages. Now with daily trend data 📈 Since Aug 2025: • Trusted Publisher: 0.55% → 16.69% • Provenance: 6.96% → 3.14% • Untrusted: 92.49% → 80.17% Trusted Publisher adoption is climbing fast! github.com/sxzz/npm-top...

The actions-cool/issues-helper compromise showed a nasty edge case: Even pinned SHAs can still break if the action repo gets disabled. I built actionspack to inline actions/workflows where possible, pin what remains, and make dependency updates visible in git diff.

Kevin Deng@sxzz.dev · 3mo ago

Recent supply-chain poisoning incidents made one thing obvious: CI should not blindly trust floating @main refs. actionspack brings a pnpm-like lockfile to GitHub Actions: author in .github/workflows/src, inline safe workflows/actions, pin the rest to SHAs, and review updates with git diff.

Recent supply-chain poisoning incidents made one thing obvious: CI should not blindly trust floating @main refs. actionspack brings a pnpm-like lockfile to GitHub Actions: author in .github/workflows/src, inline safe workflows/actions, pin the rest to SHAs, and review updates with git diff.

🚀 tsdown v0.22 is out, now powered by Rolldown 1.0.0! What’s new: ✦ Upgraded to Rolldown v1.0.0 ✦ Reduced install size by 1.33 MB ✦ Auto-detects the `bin` field ✦ Dropped support for Node.js 20, 21, and 23 ✦ `dts` is now inferred from `compilerOptions.declaration` github.com/rolldown/tsd...

VoidZero@voidzero.dev · 3mo ago

🚀Rolldown 1.0 is here!🚀 Rust-based high-performance JavaScript bundler. 🏎️ Runs at native speed that’s up 30x faster than Rollup 🤝 Compatible with existing Rollup & Vite plugins ⚡The underlying bunder for Vite After 2 years, Rolldown is officially stable and has 20+M weekly downloads.