#TIL iOS users generally see fewer CAPTCHAS when browsing the web.

#TIL Cloudflare Pages still runs Node.js 22.16, while many packages now require 22.18+. This can break native packages that ship platform binaries via `optionalDependencies`, because pnpm silently drops those binaries when the Node.js version doesn't meet the requirement.

Babel 8! After all these years! What a surprise! babeljs.io/blog/2026/06...

#TIL iOS Safari limits the frame rate to around 60fps by default, and you can turn it off to enjoy a smoother web browsing experience (Settings -> Safari -> Advanced -> Feature Flags -> Prefer Page Rendering Updates near 60fps)

docs.zizmor.sh/audits/ It's always interesting to read the rules in an auditing/linting tool's documentation. Surprised by how many footguns exist in common GitHub Actions usage patterns.

I spent the last two weeks vibe-coding a port of Vue’s style compiler to LightningCSS, and I’m seeing ~2.4–5× speedups in most cases: npmx.dev/package/@lig... Pretty happy with where the architecture and performance have landed.

@lightning-vue/compiler - npmx

Vue SFC compiler module with a Lightning CSS-backed style compiler

npmx.dev

One more reason to use @pnpm.io and @npmx.dev: trust policy downgrade becomes visible and preventable

Socket@socket.dev · 4mo ago

🚨 Active supply chain attack on axios@1.14.1. The latest version pulls in plain-crypto-js@4.2.1 -- a brand-new package that didn't exist before today. We're still investigating. If you use axios, pin your version and audit your lockfile. socket.dev/blog/axios-n...

Moltbook is fascinating.

TIL that IPv4 over IPv6 is a mainstream home internet setup in Japan to avoid old PPPoE limits. It took me back to my college years in China, when I was playing with IPv6 over IPv4 because native IPv6 wasn’t widely available. It’s really interesting to see how differently things evolved here.

@pnpm.io getting better by the day pnpm.io/blog/release... I still can't believe that a one-person package manager is doing better than npm CLI, owned by a corporate, where the resources of the two projects are incomparable. Draw your own conclusions.

pnpm 10.21 | pnpm

Added support for Node.js runtime installation for dependencies and a setting for configuring trust policy.

pnpm.io

Apple forgot to turn off sourcemaps when shipping their new App Store website lol github.com/rxliuli/apps...

lmao 🤣

Gergely Orosz@gergely.pragmaticengineer.com · 10mo ago

Status pages everywhere show green, because Statuspage.io is ALSO down: customers cannot log in to update their status page and indicate the outage their eng teams know about!! So a fail for Statuspage to depend on an AWS region... or DynamoDB (that seems to depend one AWS region?)

Published an article about mitigating supply chain attacks with pnpm pnpm.io/supply-chain...

Mitigating supply chain attacks | pnpm

Sometimes npm packages are compromised and published with malware. Luckily, there are companies like [Socket], [Snyk], and [Aikido] that detect these compromised packages early. The npm registry usually removes the affected versions within hours. However, there is always a window of time between when the malware is published and when it is detected, during which you could be exposed. Fortunately, there are some things you can do with pnpm to minimize the risks.

pnpm.io

some thoughts about the bloat introduced by edge-case first libraries

We encourage everyone to migrate from using npm publish tokens to trusted publisher! github.com/e18e/ecosyst...

Promote npm trusted publisher · Issue #201 · e18e/ecosystem-issues

Motivation npm Trusted Publishing is now generally available, allowing package owners to publish npm packages via CI without manually generating npm tokens. This method greatly reduces the risk of ...

github.com

Kevin Deng@sxzz.dev · last yr.

😈 I removed all CI npm tokens and switched to using trusted publishing. github.blog/changelog/20...

Finally, finally! SALVATION HAS ARRIVED! Time to refactor every GitHub Actions workflow! 🎉

Seb ⚛️ ThisWeekInReact.com@sebastienlorber.com · last yr.

OMG - GitHub Actions now supports Yaml Anchors This somehow means you can create Yaml variables and reuse common values in CI jobs I thought I'd never see this day happen

Wow, this was unexpected. I've got mixed feelings, but huge congrats to the team!

danielroe@danielroe.dev · last yr.

I am delighted to announce that @vercel.com are investing in Nuxt! they are backing our vision of the open web, hiring me as well as other core team members (@atinux.com, @pi0.io + @antfu.me), to continue to work full time on Nuxt we remain independent — and our vision and ethos are not changing 💚

Finally. I wish the community could migrate from the `packageManager` field to `devEngines` following this - always pinning versions is good in theory but way too cumbersome in practice.

Socket@socket.dev · last yr.

📌 Just hours ago, the Node.js TSC officially voted to stop distributing Corepack. Future Node.js releases (i.e. 25+) won’t include it, but it will remain available separately. socket.dev/blog/node-js... #nodejs #javascript

This thing is so useful. Especially for security - ensuring the published package is actually what exists in the source

Passle ☭@passle.dev · last yr.

TIL npm diff docs.npmjs.com/cli/v11/comm... (via @43081j.com on the @e18e.dev discord)

😮‍💨 Still paying down the tech debt that accumulated during the transition from non-scoped packages to scoped ones… I’m lucky to have subscribed to @lirantal.com’s Node.js security newsletter. It’s always informative! - www.alxndrsn.com/2024-08-01-n... - www.nodejs-security.com/newsletter/n...

Speeding up the JavaScript ecosystem part 11 is here! This time we're looking at: Extending Rust tools with JavaScript plugins marvinh.dev/blog/speedin...

Speeding up the JavaScript ecosystem - Rust and JavaScript Plugins

Up until recently, supporting JavaScript in Rust based tools has been deemed not worth it. The main concern is the overhead of the de-/serialization cost when sending data back and forth. But there is...

marvinh.dev

Looks like Reka UI, the rebranded Radix Vue component library, has just got officially released 👀 It's such a cool name. Can't wait to try it out!

Reka

An open-source library with unstyled, primitive components, accompanied by a variety of examples & use cases ready to be integrated into your projects.

reka-ui.com

#TIL So this is the fastest way to import an ES module in the Node.js REPL… How did I never know about the `_` (underscore) auto-assignment in the REPL?! nodejs.org/api/repl.htm... So many wasted keystrokes over the years!

Resurfacing this post now that pnpm 10 is tagged as latest.

Haoqun Jiang@haoqun.dev · 2y ago

I forked Bun's internal allowlist for those who need the protection from this new default but don't want to bother reviewing every dependency one-by-one: github.com/haoqunjiang/...

@acemarke.dev Hi Mark, I just noticed that the Bluesky link on your GitHub profile is invalid since you changed your handle. Just wanted to give you a heads-up in case you'd like to update it

Bluesky@bsky.app · 2y ago

📢 App Version 1.96 is rolling out now (1/6) In this release: a notifications Mentions tab, reserving your default username when you verify your account with a domain, and other improvements!

The discoveries are really cool, though

Chandler Carruth @chandlerc.blog · 2y ago

The gift that keeps on giving: predictors.fail This is IMO a great example of why **process isolation is the only path to confidentiality on modern CPUs**. Site- (or origin-) process isolation continues to be the path. Also note: the CPU is **not** the problem here IMO, it's doing exactly its job.

Vite 6.0.9 / 5.4.12 / 4.5.6 has been released with *breaking changes* due to security issues. I recommend upgrading it. Some users may need to update the config options. Please check github.com/vitejs/vite/... if you encountered any errors.

Any websites were able to send any requests to the development server and read the response

### Summary Vite allowed any websites to send any requests to the development server and read the response due to default CORS settings and lack of validation on the Origin header for WebSocket co...

github.com

I forked Bun's internal allowlist for those who need the protection from this new default but don't want to bother reviewing every dependency one-by-one: github.com/haoqunjiang/...

Socket@socket.dev · 2y ago

Big changes in @pnpm.io 10.0.0: Lifecycle scripts are now blocked by default to combat supply chain attacks. This change is widely supported but comes with some friction. socket.dev/blog/pnpm-10... #NodeJS #pnpm #JavaScript

Trying to make configuring ESLint + Vue + TypeScript a bit easier with a few helper functions, but I'm afraid it might be too intrusive: github.com/vuejs/eslint... What's your opinion about this API?

pnpm can block lifecycle scripts of dependencies during installation. This is an opt-in feature though. Should we block them by default? github.com/orgs/pnpm/di...

Should we block lifecycle script of dependencies during installation? · pnpm · Discussion #8918

There was recently an incident with rspack, where it was published with a postinstall script that contained malware. Such incidents happen from time to time, so it could be a good idea to stop runn...

github.com