Nicolas Dubien
@nicolas.dubien.me
Author of @fast-check.dev (🌐 https://fast-check.dev) ∙ Lead Principal Software Engineer @GoPigment ∙ Opinions are my own #Testing #JavaScript #TypeScript #React
Rust announced their LLM policy. I suggest everyone to give it a read. Objectively, it's well written, and it explains plainly their decision. It fits the project. blog.rust-lang.org/inside-rust/...
rust-lang/rust is adopting an LLM policy | Inside Rust Blog
Want to follow along with Rust development? Curious how you might get involved? Take a look!
blog.rust-lang.org
🚀 Release note for fast-check 4.9.0 is out. It's all about performance and rewriting of `entityGraph`. More at: fast-check.dev/blog/2026/07...
🥵 On this period of hot weather, I had the bad idea to compute the CO2 emission per $1 of Claude... $1 ≈ 1kg of CO2 on decarbonized electricity like France and 30kg for bad ones. It easily leads to tons in a year window. Guess what allowance per human is 2 tons a year for +2°C 🫠
🫠 Does anyone know if the OSS program of @anthropic.com will be renewed? Not using my credits as much as I could but Claude is still an interesting ally for OSS projects to pinpoint or suggest things that the maintainer can then include (or not). If only they renew it 🙏
pnpm 11.10 adds a new _auth setting that ties each registry credential to its host, so a malicious or compromised repo file can't redirect your token to a different server. The release also hardens pnpm deploy, pack-app, and more. socket.dev/blog/pnpm-11...
pnpm 11.10 Hardens Registry Authentication to Block Token Re...
pnpm 11.10 hardens registry auth to block token redirection, tightens pack-app and deploy, and makes the Rust port (v12) installable.
socket.dev
@nicolas.dubien.me has been verified by @npmx.dev on the mu.social app
Talk submitted to discuss about @fast-check.dev 🤞 I was not sure of the proposed title, I was in between two titles. Maybe I'll re-submit with the other title just in case one is more catch-y than the other 🤔
Matteo Collina@nodeland.dev · last mo.📢 CFP EXTENDED: NodeConf EU 2026 — Bologna, Italy We pushed the Call for Papers deadline to **June 30th**. One more week to send your talk. Node.js maintainers, production engineers, runtime nerds, tooling builders => we want your session.
Time to spend some time on my property based skills for @fast-check.dev 😅
Andrew Lisowski 💻@hipstersmoothie.com · last mo.Tanstack intent is preeeeetty cool - npm packages ship skills along with them - you tell your AGENTS.md to use intent to lookup those skills - they get loaded on demand as you develop
got frustrated recently at work about people writing using AI instead of using their brains! here's my take on it: sophiebits.com/2026/06/25/t...
There are no lossless transformations of natural-language text
sophiebits.com
🤞 Hope to see many of you at "Beyond testing and type checking JavaScript: Can we be bothered?" github.com/Igalia/weben...
Beyond testing and type checking JavaScript: Can we be bothered? · Issue #77 · Igalia/webengineshackfest
Logistics Date & Time: Wednesday 17th June at 12:00 CEST (local time) URL: https://meet.jit.si/WEH2026-js-testing Notes: https://hackmd.io/@rego/WEH2026-js-testing/edit Room: JS Room (rooms 4 + 5) ...
github.com
Nicolas Dubien@nicolas.dubien.me · 2mo agoI'll discuss a little bit about Property Based Testing and @fast-check.dev during the breakout sessions of @webengineshackfest.org (remotely for me)
I'll discuss a little bit about Property Based Testing and @fast-check.dev during the breakout sessions of @webengineshackfest.org (remotely for me)
Staged publishing TL;DR 1. You replace `npm publish` with `npm stage publish` 2. It puts the tarball in a staging area for review 3. You approve it via the CLI or web It will land in npm@^11.15.0. I've already turned off non-staged publishing in @nuqs.dev (in the Trusted Publishing settings).
James@43081j.com · 3mo agoWoooo yeaaah! The missing piece 🎉 everything is about to get a lot more secure
Woooo yeaaah! The missing piece 🎉 everything is about to get a lot more secure
Staged publishing for npm packages | npm Docs
Documentation for the npm registry, website, and command-line interface
docs.npmjs.com
In the next version of pnpm you'll be able to run the Rust engine for fetching, importing, and linking packages.
I made a graph visualizer for specifically analyzing (and eventually visual refactoring (hopefully)) Shows cycles, filtering, handles 60k nodes / 100k edges reasonable rendered with WebGL2 hope someone finds it useful <3
Heartbreaking. And a wake-up call. It is no longer about being difficult to find a way to sustain yourself through your work online. It is no longer sustainable to keep a website up now. Axel has done so much for the web and all of us. Buy one of his books if you can. We've learned so much from him.
Axel Rauschmayer (also on 🦣)@dr-axel.de · 3mo ago1/ I’m still processing what’s going on in tech at the moment. I used to feel at home in that world. It used to feel incredibly creative and positive. Now it’s increasingly full of bugs, dark addicting patterns and AI slop. 2ality.com
Your Gmail isn't free. You’re worth between $30 and $180,000, it just depends how valuable advertisers think you are. Read more, based on our analysis featured in Forbes: https://www.forbes.com/sites/zakdoffman/2026/04/28/price-of-free-gmail-how-much-your-google-account-is-worth/
🏁 TeamPCP and BreachForums are running a supply chain attack contest: $1,000 in Monero for the biggest haul of compromised open source packages, measured by download counts. The group open sourced Shai-Hulud as attack tooling and requires it for entry. socket.dev/blog/teampcp...
TeamPCP and BreachForums Launch $1,000 Contest for Supply Ch...
TeamPCP and BreachForums are promoting a Shai-Hulud supply chain attack contest with a $1,000 prize for the biggest package compromise.
socket.dev
This is awesome!! Check out @vlt.sh for this in the JS ecosystem. www.vlt.io/products/rep...
Reproduce | vlt /vōlt/
Verify whether a published npm package can be faithfully rebuilt from its declared source. Reproducibility over provenance.
vlt.io
daniel:// stenberg://@bagder.mastodon.social.ap.brid.gy · 3mo ago"Packages that can't be rebuilt byte-for-byte are now blocked from entering Debian's testing branch." https://itsfoss.com/news/debian-makes-reproducible-builds-mandatory/
If only we could combo otp/2fa with trusted publishing on @npmjs.bsky.social 😞 It would be great to be capable of having both enforced to strengthen publishing pipelines 💪
Just dropped all pull_request_target from all my key CIs. Also moved all pnpm commands to skip scripts 🤞
Dominik 🔮@tkdodo.eu · 3mo agoI _almost_ added pull_request_target to the bundle size check of @tanstack.com Query because I wanted to get the PR comment on PRs from forks. I didn't understand enough how it works / what it does so I didn't... Dodged a bullet here I guess
Today, TanStack packages have been compromised. Again, this all started with a "pull_request_target" GitHub action trigger. TL;DR for open-source maintainers: 🚫 NEVER use "pull_request_target" workflows 🚫 NEVER use shared caches in your publish pipeline
84 TanStack npm package artifacts were compromised in the ongoing Mini Shai-Hulud supply chain attack, adding suspected CI credential-stealing malware. Socket flagged every malicious version within six minutes of publication. Details: socket.dev/blog/tanstac...
Tanstack npm Packages Compromised in Ongoing Mini Shai-Hulud...
Socket detected 84 compromised TanStack npm packages modified with suspected CI credential-stealing malware.
socket.dev
Deepfakes are everywhere, but digital forensics investigators are fighting back. Learn more: https://scim.ag/42dMPBg
I wrote about everything I've felt, feared, and experienced about using AI for code over the last few years, and my opinions on where we stand. It's the most personal thing I've ever written. And I'm putting it out there to share with all of you. blog.isquaredsoftware.com/2026/05/ai-t...
My Thoughts on AI, Part 1: Fears, Opinions, and Mental Journey
My own personal thoughts and opinions on AI effects and usage, and how those have evolved over time
blog.isquaredsoftware.com
🚀Rolldown 1.0 is here!🚀 Rust-based high-performance JavaScript bundler. 🏎️ Runs at native speed that’s up 30x faster than Rollup 🤝 Compatible with existing Rollup & Vite plugins ⚡The underlying bunder for Vite After 2 years, Rolldown is officially stable and has 20+M weekly downloads.
Node saw a golden opportunity and they seized it correctly! Thrilled that explaining LTS releases will be so simple moving forward. Beautiful work! 🎊🎉
Wes@notwes.bsky.social · 3mo agoThe hidden gem is that @nodejs.org majors and LTS cycles got WAY easier to understand: 2026 -> v26 2027 -> v27 2028 -> v28 ... Aall of them go LTS for 18 months meaning each major is supported for 2 years. The new graphic tells the best story here: nodejs.org/en/blog/anno...
🧊 Big release for #JavaScript supply chain security: @pnpm.io 11 now defaults to a 1-day Minimum Release Age, blocks exotic subdependencies, and adds a new Allow Builds model. A strong step toward reducing exposure to fast-moving npm attacks → socket.dev/blog/pnpm-11... #nodejs
pnpm 11 Adds Supply Chain Protection Defaults for Minimum Re...
pnpm 11 turns on a 1-day Minimum Release Age and blocks exotic subdeps by default, adding safeguards against fast-moving supply chain attacks.
socket.dev
