---
title: "Package efficiency and dependency hygiene"
publication: "JavaScript Weekly"
issue: 752
published_at: "2025-09-12"
canonical_url: "https://javascriptweekly.com/issues/752"
---

Plus we take a tour of some JavaScript-based musical projects. |        

#​752 — September 12, 2025 

[Read on the Web](https://javascriptweekly.com/issues/752)   

If you have any interest in music and being able to render music or generate music with JavaScript, be sure to check out the very end of this issue where we've dedicated an entire section to the topic :-)
__
_Your editor, Peter Cooper_ 

Together with [![SurveyJS\](https://res.cloudinary.com/cpress/image/upload/c_fill,g_auto,w_1000,h_410/e_make_transparent/co_white,e_outline:20/yrja59qflovcjwojxypq.png)](https://surveyjs.io/?utm_source=jsweekly&utm_medium=email)   

JavaScript Weekly 

[![\](https://res.cloudinary.com/cpress/image/upload/w_1280,e_sharpen:60,q_auto/qhjrvyfvoxxp652shjou.jpg)](https://blog.val.town/gardening-dependencies)  

[How to Keep `package.json` Under Control](https://blog.val.town/gardening-dependencies) — Staring at a 863 megabyte `node_modules` folder for [Val Town](https://www.val.town/)’s React app, Tom got to thinking about ‘dependency hygiene’ and some good ways to keep things under control. Good tips and tool recommendations here. 

Tom MacWright   

[Behind the Scenes of `bun install`](https://bun.com/blog/behind-the-scenes-of-bun-install) — Talk about an epic post. This is no mere explanation of how [Bun](https://bun.sh/) quickly and efficiently installs packages — but a tour of package installation more generally, the underlying technicalities that make package installation tricky universally, and how Bun has tackled the problem. 

Lydia Hallie (Bun)   [![\](https://res.cloudinary.com/cpress/image/upload/c_limit,w_480,h_480,q_auto/copm/92f08903.png)](https://surveyjs.io/?utm_source=jsweekly&utm_medium=email) 

[Stop Reinventing Forms. Use SurveyJS Instead](https://surveyjs.io/?utm_source=jsweekly&utm_medium=email) — SurveyJS UI components let you build JSON-driven forms, render them in React, Angular, Vue 3, or plain JS, and store results in your own DB. Open-source, extensible, no vendor lock-in — save months of development and stay in control of your data. 

SurveyJS sponsor   

[A Major Supply Chain Attack Hit the npm Ecosystem](https://socket.dev/blog/npm-author-qix-compromised-in-major-supply-chain-attack) — Socket warned us about [a phishing campaign](https://socket.dev/blog/npm-phishing-email-targets-developers-with-typosquatted-domain) targeting npm package publishers which, sadly, bore fruit earlier this week when a variety of popular packages became compromised ([like Chalk](https://github.com/chalk/chalk/issues/656), [DuckDB's distribution for Node.js](https://github.com/duckdb/duckdb-node/security/advisories/GHSA-w62p-hx95-gf2c), [debug](https://social.hackerspace.pl/@informatic/115168929981581855), and [many others](https://www.aikido.dev/blog/npm-debug-and-chalk-packages-compromised)). 

Gooding, Brown, et al. (Socket)   

**RELEASES:** 

- [Deno 2.5](https://deno.com/blog/v2.5) – You can now create sets of permissions in `deno.json`, `Deno.test` gets some DX improvements, and `deno bundle` gets a programmatic API so you can script the bundling of your app, along with much more.
- [ESLint v9.35.0](https://eslint.org/blog/2025/09/eslint-v9.35.0-released/) – Has [a new rule](https://eslint.org/docs/latest/rules/preserve-caught-error) (`preserve-caught-error`) for disallowing the loss of an originally caught error when re-throwing custom errors.
- [Node.js v24.8.0 (Current)](https://nodejs.org/en/blog/release/v24.8.0) – Now supporting inspection of HTTP/2 network calls in Chrome DevTools.
- [Electron 38](https://www.electronjs.org/blog/electron-38-0) – Mentioned last week, but now has an official blog post.
- [Storybook 10 is now in beta](https://storybook.js.org/docs/10/releases/migration-guide). The big change is it's going ESM only.
- [Ember 6.7](https://blog.emberjs.com/ember-released-6-7/), [Rspack 1.5.3](https://github.com/web-infra-dev/rspack/releases/tag/v1.5.3), [Expo Router v6](https://expo.dev/blog/expo-router-v6), [Fastify 5.6](https://github.com/fastify/fastify/releases/tag/v5.6.0)  

📖 Articles and Videos  

[The Missing Link in JavaScript Tools?](https://marvinh.dev/blog/unifying-js-tools/) — Marvin ponders whether today’s fractured toolchain for templates, CSS imports, JSX, and numerous other non-standard enhancements to JavaScript could be unified into a single pipeline. 

Marvin Hagemeister   

[Finally, Safe Array Methods in JavaScript](https://allthingssmitty.com/2025/09/08/finally-safe-array-methods-in-javascript/) — `arr.sort()` will sort your array _in place_, whereas ES2023’s `arr.toSorted()` will return a new, sorted _copy_ of `arr`. There are several such methods you might prefer to use. 

Matt Smith   

[Secure Your Agentic Apps with Auth for GenAI](https://auth0.com/signup?onboard_app=genai&ocid=7014z000001NyoxAAC-aPA4z0000008OZeGAM?utm_source=jsweekly&utm_campaign=amer_mult_mult_all_ciam-dev_dg-plg_auth0_native_jsweekly_newsletter_aud_JSWeeklyNewsletter-Q3_utm2&utm_medium=cpc&utm_id=aNKKZ000000047Q4AQ) — Secure your agentic apps with features like User Authentication for AI agents, Token Vault, and more with Auth0’s Auth for GenAI (exclusively in Developer Preview). 

Auth0 sponsor   

[An Interactive Guide to TanStack DB](https://frontendatscale.com/blog/tanstack-db/) — [TanStack DB](https://tanstack.com/db/latest) offers an embedded client‑side database that uses differential dataflow to power live, relational queries, sub‑ms incremental updates, and optimistic writes. This tutorial leans on using it with React, but TanStack DB works alongside Vue, Solid, and Svelte [as well.](https://tanstack.com/db/latest/docs/framework) 

Maxi Ferreira   

📺 [Handling 500 Million Clicks with a $4 VPS](https://www.youtube.com/watch?v=nk3Ti0tCGvA) – Behind the scenes of a Node-backed site that went viral. Andrew Schmelyun 

📄 [How To Set Up Express.js 5 For Production in 2025](https://www.reactsquad.io/blog/how-to-set-up-express-5-in-2025) Jan Hesters 

📄 [Building Microfrontends with Module Federation and Vue](https://alexop.dev/posts/how-to-build-microfrontends-with-module-federation-and-vue/) Alex Opalic 

📄 [How Shopify Migrated to React Native's _New Architecture_](https://shopify.engineering/react-native-new-architecture) Thiago Magalhaes (Shopify)  

🛠 Code & Tools 

[![\](https://res.cloudinary.com/cpress/image/upload/w_1280,e_sharpen:60,q_auto/mwthqetzakzeazjrarol.jpg)](https://tryandromeda.dev/)  

[Andromeda: The Newest JavaScript Runtime on the Block](https://tryandromeda.dev/) — A new JavaScript and TypeScript runtime built around the Rust-powered [Nova engine](https://trynova.dev/). It’s still early days but they’re promising a lot: native single file compilation, a GPU-accelerated 2D Canvas API, low runtime overhead, interop with Rust, memory safety, WinterTC compatibility, and cross-platform support. 

Andromeda Team   

[BlazeDiff: 'Blazing-Fast' Pixel-by-Pixel Image Comparisons](https://github.com/teimurjan/blazediff) — The creator was happy with the established [pixelmatch library](https://github.com/mapbox/pixelmatch) for doing image comparisons, until it got too slow for the scale he wanted. [Here’s the story](https://dev.to/teimurjan/building-blazediff-how-i-made-the-fastest-image-diff-up-to-60-faster-with-block-level-optimization-ok7) of how he came up with a faster alternative. 

Teimur Gasanov   

[Unlock the Power of MCP Servers](https://go.clerk.com/vs1FgIh) — Clerk shows how MCP servers let AI apps access data securely with OAuth — complete with a Next.js demo. 

Clerk sponsor   

[Feedsmith 2.0: Feed Parser and Generation Library](https://feedsmith.dev/) — As well as parsing feeds, you can also create RSS, Atom, JSON Feed, and OPML files with many common namespaces (iTunes, Podcast, Media RSS, Dublin Core, etc.) There’s [a quick start tutorial](https://feedsmith.dev/quick-start) for using it both in browsers or Node.js. [GitHub repo.](https://github.com/macieklamberski/feedsmith) 

Maciej Lamberski   

[React Bits: 100+ Creative, Animated React Components](https://www.reactbits.dev/) — If you want a bit of visual _pizzazz_ in your project, this is for you. [The components](https://reactbits.dev/text-animations/split-text) span from a variety of text effects to general animations, [a ‘chroma grid’](https://reactbits.dev/components/chroma-grid), bouncing cards, distortions, and more. [GitHub repo.](https://github.com/DavidHDev/react-bits) 

David Has   

- [Ink 6.3](https://github.com/vadimdemedes/ink) – Use React to build CLI apps, as used by Claude Code, Gemini CLI, and [many other apps.](https://github.com/vadimdemedes/ink?tab=readme-ov-file#whos-using-ink)
- [Tricolore 0.1](https://riatelab.github.io/tricolore.js/) – Visualize ternary compositions with choropleth maps. [Live demo.](https://observablehq.com/@mthh/choropleth-maps-based-on-ternary-composition)
- [ts-to-zod 4.0](https://github.com/fabien0102/ts-to-zod) – Generate Zod schemas (v4) from TypeScript types/interfaces.
- [Confirmal 1.3](https://github.com/marcomuser/conformal) – Turn `FormData` into real objects with TypeScript inference.
- 📊 [Chartbrew 4.3](https://github.com/chartbrew/chartbrew) – Create live reporting dashboards.
- [ow 3.0](https://github.com/sindresorhus/ow) – Function argument validation for humans.
- [uuid 13.0](https://github.com/uuidjs/uuid) – Generate RFC9562 compliant UUIDs.
- [Fresh 2.0](https://github.com/denoland/fresh) – Deno-powered Web framework.      

📰 Classifieds   

[Meticulous automatically creates and maintains an E2E UI test suite with zero developer effort](https://www.meticulous.ai/?utm_source=javascript_weekly&utm_campaign=september12th2025). Relied on by Dropbox, Wiz, Lattice, Bilt Rewards, etc. 

--- 

🔈 [JetBrains JavaScript Day 2025 registration is now open!](https://lp.jetbrains.com/javascript-day-2025/?utm_source=cooperpress&utm_medium=cpc&utm_campaign=js_weekly_javascript_day_2025&utm_content=2%20%20) Get up to speed with modern JavaScript development in just one day – for free. 

--- 

[$100 off yearly Frontend Masters membership!](https://frontendmasters.com/sale/?utm_source=classified&utm_medium=email&utm_campaign=javascriptweekly) 250+ courses, personalized learning path, workshops with devs from GitHub & Netflix. [Sale ends soon →](https://frontendmasters.com/sale/?utm_source=classified&utm_medium=email&utm_campaign=javascriptweekly) 

--- 

🗓️ [Free virtual DevSecCon on Oct 22, 2025](https://snyk.io/events/devseccon/?utm_campaign=dm_pp-cooperpress_250910_evt_251022_devseccon_flagship_2025&utm_medium=em-pa&utm_source=cooperpress-javascript-weekly&utm_content=dm_pp-cooperpress_250910_evt_251022_devseccon_flagship_2025%20). Learn to secure AI-native apps with keynotes, demos, and a developer challenge. [Register now!](https://snyk.io/events/devseccon/?utm_campaign=dm_pp-cooperpress_250910_evt_251022_devseccon_flagship_2025&utm_medium=em-pa&utm_source=cooperpress-javascript-weekly&utm_content=dm_pp-cooperpress_250910_evt_251022_devseccon_flagship_2025%20)     

🎵 Let's Get Musical 

[![\](https://res.cloudinary.com/cpress/image/upload/w_1280,e_sharpen:60,q_auto/ugbwvfrjtbd4yzmc8mbj.jpg)](https://github.com/spessasus/SpessaSynth)   

[SpessaSynth: SoundFont2-Based MIDI Player and Synthesizer](https://github.com/spessasus/SpessaSynth) — If you think typical browser-played MIDI files sound terrible, you’re right – but try this! It uses a SoundFont sample driven approach to play MIDI files in a predictable fashion, and also includes an editor/visualizer if you need it. [The live demo](https://spessasus.github.io/SpessaSynth/) is quite striking. 

Spessasus   

While we're on the topic, here are some other neat music related JavaScript projects we've enjoyed over the years:  

[![\](https://res.cloudinary.com/cpress/image/upload/w_1280,e_sharpen:60,q_auto/e074yzw1bgpvb4fvef1z.jpg)](https://www.alphatab.net/)  

- [alphaTab](https://www.alphatab.net/) – A full on music notation and guitar tab rendering library for building complete musical apps _(above)_.
- [chiptune3.js](https://github.com/DrSnuggles/chiptune) – A bit like SpressaSynth _(also above)_ but for playing _module file_ music. [Live demo.](https://drsnuggles.github.io/chiptune/)
- [Tone.js](https://tonejs.github.io/) – An easy way to use the Web Audio API to create music in the browser. Someone used it to [recreate the famous THX 'deep note' sound.](https://keliris.dev/articles/deep-note)
- 🎸 [SVGuitar](https://github.com/omnibrain/svguitar) – A library to render SVG guitar chord charts.
- [JZZ.js](https://jazz-soft.net/doc/JZZ/) – A JavaScript MIDI library that hides a lot of complexity behind its chained syntax when you need to work directly with MIDI. (The keyboard logo at the top left of its homepage is a neat easter egg.)
- [Strudel](https://strudel.cc/) – A live-coding environment in the browser for generating pieces of music with simple, chained JavaScript expressions.         

Published by [Cooperpress](https://cooperpress.com/) and edited by [Peter Cooper](https://twitter.com/cooperx86) 

'JavaScript' is a trademark of Oracle Corporation in the US
We are not endorsed by or affiliated with Oracle. 

[Change your email address](https://javascriptweekly.com/edit_subscription/*|UID|*) or [stop getting this newsletter](https://javascriptweekly.com/leave/*|UID|*). 

© Cooper Press Ltd · Fairfield Enterprise Centre, Louth, LN11 0LS, United Kingdom