--- title: "How JavaScript source maps actually work" publication: "JavaScript Weekly" issue: 760 published_at: "2025-11-07" canonical_url: "https://javascriptweekly.com/issues/760" --- Plus htmx 4 alpha, embedding JS/TS anywhere with Hako, Vue 3 data components, and using the URL to store state. | #​760 — November 7, 2025 [Read on the Web](https://javascriptweekly.com/issues/760) Together with [![WorkOS\](https://res.cloudinary.com/cpress/image/upload/c_fill,g_auto,w_514,h_98/e_make_transparent/co_white,e_outline:9/tdfxwgk852ui9leli4wm.png)](https://workos.com/mcp?utm_source=cpjavascript&utm_medium=newsletter&utm_campaign=q42025) JavaScript Weekly [![\](https://res.cloudinary.com/cpress/image/upload/w_1280,e_sharpen:60,q_auto/mettuhpw65jeltbt2jio.jpg)](https://www.polarsignals.com/blog/posts/2025/11/04/javascript-source-maps-internals) [The Inner Workings of JavaScript Source Maps](https://www.polarsignals.com/blog/posts/2025/11/04/javascript-source-maps-internals) — Ever wondered how devtools can magically turn mangled, minified JavaScript back into readable source while debugging? Zero magic; that’s a [source map](https://developer.mozilla.org/en-US/docs/Glossary/Source_map) doing its job. But how do source maps actually work under the hood? Manoj Vivek [![\](https://res.cloudinary.com/cpress/image/upload/c_limit,w_480,h_480,q_auto/copm/0dccc2d2.png)](https://workos.com/mcp?utm_source=cpjavascript&utm_medium=newsletter&utm_campaign=q42025) [Ship Secure MCP Auth Without Relying on API Keys](https://workos.com/mcp?utm_source=cpjavascript&utm_medium=newsletter&utm_campaign=q42025) — API keys are hard to scope and break user flows. WorkOS Connect delivers a fully compliant OAuth 2.1 flow. It handles PKCE, scopes, user consent, and secure token issuance out of the box. WorkOS sponsor [Anders Hejlsberg's Take on the Rise of TypeScript](https://github.blog/developer-skills/programming-languages-and-frameworks/typescripts-rise-in-the-ai-era-insights-from-lead-architect-anders-hejlsberg/) — The co-creator of TypeScript says he’s ‘floored’ by the language’s success (now [the number one language](https://github.blog/news-insights/octoverse/octoverse-a-new-developer-joins-github-every-second-as-ai-leads-typescript-to-1/) on GitHub in 2025), shares a little info on the on-going compiler rewrite in Go, and the increasing role of AI. The GitHub Blog [Embedding TypeScript with Hako](https://andrews.substack.com/p/embedding-typescript) — A technical look at the [Hako](https://github.com/6over3/hako) JavaScript engine. It runs in WebAssembly so can be more easily embedded in more environments, including mobile apps. Andrew Sampson **IN BRIEF:** - GitHub has updated [its post about ongoing npm security changes](https://github.blog/changelog/2025-11-05-npm-security-update-classic-token-creation-disabled-and-granular-token-changes/). npm classic tokens can no longer be created, but existing ones will continue to work till February 3, 2026 at the latest. - I enjoyed Lea Verou's [cute proxy-based trick for creating symbols](https://front-end.social/@leaverou/115455940452841916) on demand. - The Svelte team has [a November 2025 update on what's new in Svelte.](https://svelte.dev/blog/whats-new-in-svelte-november-2025) - 🇷🇴 The popular [JSHeroes](https://jsheroes.io/) conference is taking place in Romania next May 14-15. If you'd like to speak, [its CFP is open](https://jsheroes.io/speak) until December 31. **RELEASES:** - [Storybook 10](https://storybook.js.org/blog/storybook-10/) – The popular frontend component workshop is now ESM-only, lighter, has a new module automocking system, Vitest 4 support, and more. - [htmx 4.0 Alpha 1](https://htmx.org/essays/the-fetchening/) – There was never going to be a v3 of htmx, so how about v4? Carson Gross tells the full story here. - [React Email 5.0](https://resend.com/blog/react-email-5) – Suite of components for creating emails in React. Now with a dark mode switcher and Tailwind 4 support. - [Turborepo 2.6](https://turborepo.com/blog/turbo-2-6), [Video.js v10](https://www.mux.com/blog/videojs), [ESLint Config Inspector v1.4](https://github.com/eslint/config-inspector) 📖 Articles and Videos [![\](https://res.cloudinary.com/cpress/image/upload/w_1280,e_sharpen:60,q_auto/nx2vvbisbpcuoxm7piby.jpg)](https://www.youtube.com/playlist?list=PLLiioAbFTbKP4JVMijrNRRrNccfauPko8#cascadiajs) ▶[The Talk Videos from CascadiaJS 2025](https://www.youtube.com/playlist?list=PLLiioAbFTbKP4JVMijrNRRrNccfauPko8#cascadiajs) — [CascadiaJS](https://cascadiajs.com/2025/) took place a month ago and the talk videos have been gradually rolling out onto YouTube. You can [learn more about TanStack](https://www.youtube.com/watch?v=uy2WSS1MjGM&list=PLLiioAbFTbKP4JVMijrNRRrNccfauPko8&index=20&t=3s) with Jack Herrington, [the origin story of JavaScript](https://www.youtube.com/watch?v=Sl3XUmg4LBk&list=PLLiioAbFTbKP4JVMijrNRRrNccfauPko8&index=5) with Annie Sexton, [the Web Monetization API](https://www.youtube.com/watch?v=v-dFoIWHTM4&list=PLLiioAbFTbKP4JVMijrNRRrNccfauPko8&index=17) with Ioana Chiorean, and more. CascadiaJS [High-Performance Syntax Highlighting with the CSS Custom Highlight API](https://pavi2410.com/blog/high-performance-syntax-highlighting-with-css-highlights-api/) — Now supported in all major browsers, the CSS Custom Highlight API provides a mechanism for styling arbitrary text ranges in a document by using JavaScript to create the ranges, and CSS to style them. Pavitra Golchha [How to Create a Virtual Green Screen Using the Vonage Video API](https://developer.vonage.com/en/blog/how-to-create-a-virtual-green-screen-using-the-vonage-video-api) — Transform video calls with virtual green screens using the Vonage Video API and HTML5 canvas. Vonage sponsor [How to Throttle Specific Requests in Chrome DevTools](https://www.debugbear.com/blog/chrome-devtools-throttle-individual-request) — Chrome DevTools has supported network throttling for a long time but you can now throttle requests to specific URLs or domains too, which could be ideal if you want to see how your site handles the failure of third party scripts. Matt Zeunert ?! [Importing Node Modules from BitTorrent](https://evanhahn.com/node-torrent-import/) — A fascinating demo of the power of Node.js’s [customization hooks](https://nodejs.org/docs/latest-v21.x/api/module.html#customization-hooks) for overriding import behavior. Evan Hahn [Advanced Beginner’s Guide to ClojureScript](https://romanliutikov.com/blog/advanced-beginners-guide-to-clojurescript) — An introduction to [a compiler](https://clojurescript.org/) for the functional Clojure Lisp dialect that produces JavaScript. Roman Liutikov 📄 [Handling Time and Mock Clocks in Tests](https://blog.angular.dev/handling-time-and-mock-clocks-in-tests-5a393b32dd30) Andrew Scott (Angular) 📄 [Zod + TypeScript: Schema Validation Made Easy](https://www.telerik.com/blogs/zod-typescript-schema-validation-made-easy) Hassan Djirdeh 📄 [Next.js 16: What’s New and What It Means for Frontend Devs](https://blog.logrocket.com/next-js-16-whats-new/) Abiola Farounbi (LogRocket) 🛠 Code & Tools [![\](https://res.cloudinary.com/cpress/image/upload/w_1280,e_sharpen:60,q_auto/pizfvud2u2vunfdrntbu.jpg)](https://perspective-dev.github.io/) [Perspective 4.0: High Performance Analytics and Data Visualization Component](https://perspective-dev.github.io/) — Originally built by JP Morgan, this data visualization component, built in C++ and compiled to WebAssembly, is well-suited for large and real-time streaming datasets. The demo on the homepage lets you try visualization types at up to 1000 changes per second. v4.0 [sees the project move to the OpenJS Foundation.](https://openjsf.org/blog/perspective-joins-openjs) OpenJS Foundation 💡 Perspective comes with a rich set of [examples](https://github.com/perspective-dev/perspective?tab=readme-ov-file#examples) with full code demonstrating how to use it, [like this streaming example.](https://perspective-dev.github.io/block/?example=streaming) [Agentic Postgres: Let Your Agents Cook](https://www.tigerdata.com/blog/postgres-for-agents) — Build AI apps faster: Postgres with built-in memory, search, and free forkable DBs. Try it free on Tiger. Tiger Data sponsor [Vue Data UI 3.6: Vue Components Library for Data Storytelling](https://vue-data-ui.graphieros.com/) — There’s a lot packed into this suite of components, including basic chart types through to donuts, sparklines, world views, stacks, heatmaps, word clouds, and more. Definitely worth a look if you’re using Vue. [Live examples.](https://vue-data-ui.graphieros.com/examples/categories#vue-ui-xy) Alec Lloyd Probert 🖼️ [image-dimensions: Get the Dimensions of Images](https://github.com/sindresorhus/image-dimensions) — A zero-dependency way to get the pixel width and height of JPEG, PNG/APNG, GIF, WebP, AVIF and HEIF images in _any_ modern JavaScript environment. Sindre Sorhus [React Syntax Highlighter: A Code Syntax Highlighting Component](https://react-syntax-highlighter.github.io/react-syntax-highlighter/demo/) — If you need to show off source code in your React app somewhere, this is a component that does the job. [GitHub repo.](https://github.com/react-syntax-highlighter/react-syntax-highlighter) Conor Hastings [CSSOM: A CSS Parser Written in Pure JavaScript](https://github.com/acemir/CSSOM) — Also a partial implementation of CSS Object Model. Nikita Vasilyev - [debounce 3.0](https://github.com/sindresorhus/debounce) – Delay function calls until a set time elapses after the last invocation. Now a pure ES module. - [bcrypt.js 3.0.3](https://github.com/dcodeIO/bcrypt.js) – Optimized bcrypt in pure JavaScript, even in the browser. - [Marked 17.0](https://github.com/markedjs/marked) – Markdown parser and compiler. ([Docs.](https://marked.js.org/)) - [AlaSQL.js 4.8](https://github.com/AlaSQL/alasql) – Isomorphic JavaScript SQL database. - [fast-copy 4.0](https://github.com/planttheidea/fast-copy) – A fast deep object copier. 📰 Classifieds [Still writing tests manually?](https://www.meticulous.ai?utm_source=jsweekly&utm_medium=newsletter&utm_campaign=q4) See why modern engineering teams like Dropbox, Notion and Wiz rely on [Meticulous](https://www.meticulous.ai?utm_source=jsweekly&utm_medium=newsletter&utm_campaign=q4) to run E2E UI tests. --- 🔎 Search your GitHub Actions logs instantly. No more endless scrolling through CI failures. [Try Depot's new log search and find errors in seconds](https://fandf.co/4og6KIY). 📢 Elsewhere in the ecosystem A roundup of some other interesting stories in the broader landscape: [![\](https://res.cloudinary.com/cpress/image/upload/w_1280,e_sharpen:60,q_auto/va7cbt2uouajwonnie5m.jpg)](https://alfy.blog/2025/10/31/your-url-is-your-state.html) - In [Your URL is Your State](https://alfy.blog/2025/10/31/your-url-is-your-state.html), Ahmad Alfy looks at the 'overlooked power' and elegance of using the URL's various components for representing state. - Matt Perry shares everything he knows about animation performance on the Web in [The Web Animation Performance Tier List.](https://motion.dev/blog/web-animation-performance-tier-list) - Ben Visness writes about [how Mozilla has overhauled its internal tools for visualizing JavaScript and WebAssembly compilation](https://spidermonkey.dev/blog/2025/10/28/iongraph-web.html), complete with some interactive graphs. - If you were saddened by the [recent closure of Glitch](https://blog.glitch.com/post/changes-are-coming-to-glitch), Thomas Steiner demonstrates [how to use _Hugging Face Spaces_](https://blog.tomayac.com/2025/11/03/running-nodejs-in-a-hugging-face-space/) as an alternative for hosting small server-based Node apps. Published by [Cooperpress](https://cooperpress.com/) and edited by [Peter Cooper](https://twitter.com/cooperx86) 'JavaScript' is a trademark of Oracle Corporation in the US We are not endorsed by or affiliated with Oracle. [Change your email address](https://javascriptweekly.com/edit_subscription/*|UID|*) or [stop getting this newsletter](https://javascriptweekly.com/leave/*|UID|*). © Cooper Press Ltd · Fairfield Enterprise Centre, Louth, LN11 0LS, United Kingdom