How to Keep package.json Under Control — Staring at a 863 megabyte node_modules folder for Val Town’s React app, Tom got to thinking about ‘dependency hygiene’ and some good ways to keep things under control. Good tips and tool recommendations here.

Tom MacWright

Behind the Scenes of bun install — Talk about an epic post. This is no mere explanation of how Bun quickly and efficiently installs packages — but a tour of package installation more generally, the underlying technicalities that make package installation tricky universally, and how Bun has tackled the problem.

Lydia Hallie (Bun)

Stop Reinventing Forms. Use SurveyJS Instead — SurveyJS UI components let you build JSON-driven forms, render them in React, Angular, Vue 3, or plain JS, and store results in your own DB. Open-source, extensible, no vendor lock-in — save months of development and stay in control of your data.

SurveyJS sponsor

A Major Supply Chain Attack Hit the npm Ecosystem — Socket warned us about a phishing campaign targeting npm package publishers which, sadly, bore fruit earlier this week when a variety of popular packages became compromised (like Chalk, DuckDB's distribution for Node.js, debug, and many others).

Gooding, Brown, et al. (Socket)

The Missing Link in JavaScript Tools? — Marvin ponders whether today’s fractured toolchain for templates, CSS imports, JSX, and numerous other non-standard enhancements to JavaScript could be unified into a single pipeline.

Marvin Hagemeister

Finally, Safe Array Methods in JavaScript — arr.sort() will sort your array in place, whereas ES2023’s arr.toSorted() will return a new, sorted copy of arr. There are several such methods you might prefer to use.

Matt Smith

Secure Your Agentic Apps with Auth for GenAI — Secure your agentic apps with features like User Authentication for AI agents, Token Vault, and more with Auth0’s Auth for GenAI (exclusively in Developer Preview).

Auth0 sponsor

An Interactive Guide to TanStack DB — TanStack DB offers an embedded client‑side database that uses differential dataflow to power live, relational queries, sub‑ms incremental updates, and optimistic writes. This tutorial leans on using it with React, but TanStack DB works alongside Vue, Solid, and Svelte as well.

Maxi Ferreira

Andromeda: The Newest JavaScript Runtime on the Block — A new JavaScript and TypeScript runtime built around the Rust-powered Nova engine. It’s still early days but they’re promising a lot: native single file compilation, a GPU-accelerated 2D Canvas API, low runtime overhead, interop with Rust, memory safety, WinterTC compatibility, and cross-platform support.

Andromeda Team

BlazeDiff: 'Blazing-Fast' Pixel-by-Pixel Image Comparisons — The creator was happy with the established pixelmatch library for doing image comparisons, until it got too slow for the scale he wanted. Here’s the story of how he came up with a faster alternative.

Teimur Gasanov

Unlock the Power of MCP Servers — Clerk shows how MCP servers let AI apps access data securely with OAuth — complete with a Next.js demo.

Clerk sponsor

Feedsmith 2.0: Feed Parser and Generation Library — As well as parsing feeds, you can also create RSS, Atom, JSON Feed, and OPML files with many common namespaces (iTunes, Podcast, Media RSS, Dublin Core, etc.) There’s a quick start tutorial for using it both in browsers or Node.js. GitHub repo.

Maciej Lamberski

React Bits: 100+ Creative, Animated React Components — If you want a bit of visual pizzazz in your project, this is for you. The components span from a variety of text effects to general animations, a ‘chroma grid’, bouncing cards, distortions, and more. GitHub repo.

David Has

SpessaSynth: SoundFont2-Based MIDI Player and Synthesizer — If you think typical browser-played MIDI files sound terrible, you’re right – but try this! It uses a SoundFont sample driven approach to play MIDI files in a predictable fashion, and also includes an editor/visualizer if you need it. The live demo is quite striking.

Spessasus