Oh! Btw... As of yesterday (2026-08-04) ... nodejs_compat is enabled *by default* for a new Cloudflare Worker deployments using compat date 2026-08-04 or later.
TIL when running Vitest browser mode (or plain Playwright) on Github Actions on Ubuntu, you can skip the slow "playwright install chromium" step completely by providing channel option. This makes Playwright use the pre-installed Chrome. So many projects out there that could speed their CIs with this
npm is rotating write-scoped npm Granular Access Tokens that bypass 2FA as a precaution following a now-contained security incident. This doesn't affect GitHub personal access tokens. Maintainers should upgrade the npm CLI to v12+ and consider Trusted Publishing. docs.npmjs.com/trusted-publ...
Trusted publishing for npm packages | npm Docs
Documentation for the npm registry, website, and command-line interface
docs.npmjs.com
Hot take: JS *itself* needs a way of taking a Promise and waiting for it synchronously. No, you shouldn't do it all the time. Yes it would be a sharp tool you could cut yourself on. But there are use-cases.
Firefox for Web Developers@webdevs.firefox.com · yesterdayJS promise integration for WebAssembly landed in Firefox 153, making it easier to work with asynchronous calls from Wasm. Here's how it works:
soo @npmjs.com new scanners were unable to detect a preinstall script. socket.dev/blog/popular... you had one job.
npm@npmjs.com · 7d agoStrengthening npm supply-chain security: packages are now scanned for malware at publish time, before they can be installed. We're also introducing disclosure for legitimate dual-use tools so they aren't blocked by default. gh.io/npm-publish-...
🚨 An npm worm is spreading live, while half of the security industry is at #BlackHat in Vegas. talk about timing! @socket.dev is now tracking 2,234 malicious package artifacts across 444 unique packages in the keyv/cacheable compromise. Average detection time: 5 min 18 sec after publication
Popular npm Packages in the keyv and Cacheable Namespaces Co...
Popular npm packages keyv and cacheable compromised.
socket.dev
🦀 Rstest now uses Yuku instead of Acorn for V8 coverage parsing. On a real Rsbuild test suite: 8.74s → 3.35s median 378/378 tests passing Unchanged coverage totals A parser swap, with a 61.7% faster coverage run. ⚡️
In today's Oxlint 1.77.0 release, import/no-cycle (our slowest Rust rule) gets more than 3x as fast!
come join us tomorrow on the live stream where we'll be chatting to Oliver about porffor! 🎉
Alexander Lichter@thealexlichter.com · last wk.Summer break is over: The @e18e.dev & friends show is coming back next week 🎉 And we got nobody else than the one and only @honk.foo talking about Porforr and how a future for natively compiled JavaScript could look like! Swing by at 7pm CEST / 1pm EDT on August 4th 👌 youtube.com/live/L8Edgas...
Maintaining documentation is also important, and it can even take more time than maintaining the code.
Did you know that GitHub Actions now supports the `parallel` keyword? I was waiting for something like this for sooo long! And I only found out about it thanks to PRs opened by @luc122c.bsky.social for Nuxt, Nitro, and other big projects in the ecosystem.
New feature in AgentScan GitHub app: the honeypot comment. This comment is intended to welcome regular users, but it also contains a hidden comment that only AI agents will read. This will prompt them to write a specific custom string that will immediately close the PR and add a label as automations
my big pile of `yaml` perf improvements just got merged 🎉 looking forward to v3 being published!
We were looking at some dependency decisions at work today, and let me tell you, the @npmx.dev open compare feature proved to be super useful!!!
new @e18e.dev blog post about when to publish source maps to npm 📦 source maps are often the reason behind bloated install sizes, but sometimes necessary. here we try to explain some of the balance, do/don't
Source maps or not?
Source maps are great for debugging, but should we be shipping them in production?
e18e.dev
nothing’s going to last forever thx 4 everything july! astro.build/blog/whats-n...
What's new in Astro - July 2026 | Astro
July 2026 - CodeTV GSAP Webflow contest, Astro Germany, and more!
astro.build
looking at swapping out chalk - grateful to @e18e.dev for the assist! e18e.dev/docs/replace...
e18e
Modern alternatives to the chalk package for terminal string styling and colors, with notes on browser console support
e18e.dev
`oxc-walker` v1.1.1 is out. nice work, everyone! 🔥 thanks @harlanzw.com for opening the PR to remove the last dependency - I won't hold it against you that it was a package I wrote. 😭 ... plus some very nice runtime performance improvements from @matejcerny.dev 🔥
i just recently found out you can sign into @npmx.dev. the features is what made me switch
dame@dame.is · 6d agohard pill to swallow for atproto developers/creators: 99% of potential users either do not care about, value, understand, or want to “own their own data” i see so many apps/projects lead with this “value prop”, but it’s not an important or meaningful consideration for most people
Vite 8.2 is out 🚀 • Top-level `input` option: No need to use `build.rolldownOptions` • Warnings for config features the native loader can't handle yet • PostCSS config type export for type-safe configs • Dev URLs now labeled by their interfaces More info in the changelog github.com/vitejs/vite/...
github.com
While some people laughed about the number of dependencies in the JS world, others worked to improve the ecosystem (like @e18e.dev). Now many of my open source projects have around 20 packages in node_modules, including transitive dependencies.
We’ve saved hundreds of gigabytes of bandwidth per month so far! Reach out if you’re interested in helping! We help with outreach, repo modernization, analysis infra, and data analysis
~paul@paulvall.dev · 7d agonew @e18e.dev effort just kicked off: dieting rust crates 🦀 huge thanks to @jacobasper.com for starting this. we're using the lean crate cargo diet to trim packaged crate sizes across the ecosystem tracking issue: github.com/e18e/ecosystem-issues/issues/280
new @e18e.dev effort just kicked off: dieting rust crates 🦀 huge thanks to @jacobasper.com for starting this. we're using the lean crate cargo diet to trim packaged crate sizes across the ecosystem tracking issue: github.com/e18e/ecosystem-issues/issues/280
`cargo diet` · Issue #280 · e18e/ecosystem-issues
background 60% of rust crates often do not have an explicit includes key, leading to including e2e tests, images, examples. To fix this we can run cargo diet. I have been running cargo diet against...
github.com
Strengthening npm supply-chain security: packages are now scanned for malware at publish time, before they can be installed. We're also introducing disclosure for legitimate dual-use tools so they aren't blocked by default. gh.io/npm-publish-...
npm publish-time malware scanning and dual-use metadata - GitHub Changelog
As part of our ongoing supply-chain security work, npm is introducing automatic scanning of packages at publish time. This changelog covers what publishers can expect and a new metadata requirement…
gh.io
Related to this @danabra.mov blog post, still relevant today I hope in the future the flow of irrelevant ReDoS CVEs will decrease, simplifying work for maintainers overreacted.io/npm-audit-br...
npm audit: Broken by Design — overreacted
Found 99 vulnerabilities (84 moderately irrelevant, 15 highly irrelevant)
overreacted.io