--- title: "Dr. Axel's blog is gone (for now)" publication: "JavaScript Weekly" issue: 786 published_at: "2026-05-19" canonical_url: "https://javascriptweekly.com/issues/786" --- Plus banishing JavaScript to the ShadowRealm, high quality image resizing in the browser, and Express gets a new logo and site. #​786 — May 19, 2026 [Read on the Web](https://javascriptweekly.com/issues/786) Together with [![Depot\](https://res.cloudinary.com/cpress/image/upload/c_fill,g_auto,w_1280,h_320/e_make_transparent/co_white,e_outline:20/lqhtj3olkxbq58buyzzc.png)](https://fandf.co/4tkTepn) JavaScript Weekly [![\](https://res.cloudinary.com/cpress/image/upload/w_1280,e_sharpen:60,q_auto/ql3ejie7zibdm4rd25zh.jpg)](https://github.com/npm/rfcs/pull/868) RFC: [It’s Time for `npm` to Make Install Scripts Opt-In](https://github.com/npm/rfcs/pull/868) — npm is the only major package manager that runs dependency install scripts (e.g. `postinstall`) by default, and they’ve become too much of a security weakness, says Jamie, who works for GitHub (maintainers of npm). This RFC features further discussion of the idea and the tradeoffs involved. Jamie Magee 💡 [npq](https://github.com/lirantal/npq) is a tool that makes `npm install`s safer. It stands in front of `npm` and audits packages before installing them, including the presence of pre/post install scripts. [![\](https://res.cloudinary.com/cpress/image/upload/c_limit,w_480,h_480,q_auto/copm/f5067c40.png)](https://fandf.co/4tkTepn) [How Depot Built a CI Orchestrator on AWS Lambda](https://fandf.co/4tkTepn) — Long-running CI orchestration without long-lived servers. Depot rebuilt their CI engine using AWS Lambda durable functions — stateful, callback-driven, and crash-recoverable. A deep dive into the run-workflow-job hierarchy powering Depot CI. Depot sponsor [_Mini Shai-Hulud_ Hits: 300+ Malicious npm Packages Published](https://safedep.io/mini-shai-hulud-strikes-again-314-npm-packages-compromised/) — The _"[Shai-Hulud](https://socket.dev/blog/ongoing-supply-chain-attack-targets-crowdstrike-npm-packages)"_ class of npm ecosystem attacks continues to rumble on. Today, [hundreds more packages](https://safedep.io/mini-shai-hulud-strikes-again-314-npm-packages-compromised/#full-list-of-compromised-packages) – including popular ones from the `antv` family and `timeago.js` – were hit. SafeDep Team **IN BRIEF:** - 😱 Dr. Axel Rauschmayer (JavaScript legend and former JS Weekly editor) has [taken his blog and JavaScript books off the Web](https://2ality.com/) due to being overwhelmed by AI crawlers. You can, however, still [purchase his fantastic books here.](https://payhip.com/rauschma) - The Bun saga continues. Despite once [playing down its significance](https://news.ycombinator.com/item?id=48019226), the [Rust-based rewrite of Bun has been merged](https://github.com/oven-sh/bun/pull/30412), though there are [questions over the quality](https://github.com/oven-sh/bun/issues/30719) of the AI-ported code. Much [discussion ensued on Hacker News.](https://news.ycombinator.com/item?id=48150900) - [The Deno team is teasing Deno 2.8](https://bsky.app/profile/deno.land/post/3mm6clkq5uc22), due to be released this week. Significant Node.js compatibility improvements, `import defer`, and TypeScript 6.0.3 support await. - The Chrome and Edge teams are working on [a new `` HTML element](https://developer.chrome.com/blog/install-element-ot) for browsers to render a 'trusted install button' for PWAs. - The _Express.js_ project has [an all new look](https://expressjs.com/en/blog/2026-05-18-a-new-look-for-express/), including a new site, logo, and [improved docs.](https://expressjs.com/en/5x/starter/installing/) **RELEASES:** - [Angular 22 Release Candidate](https://github.com/angular/angular/releases/tag/v22.0.0-rc.0) – Final is due in early June. Expect [signal-based forms](https://angular.dev/guide/forms/signals/overview) and the [OnPush](https://github.com/angular/angular/discussions/66779) change detection strategy becoming default. - [Bun 1.3.14](https://bun.com/blog/bun-v1.3.14) – The alternative JS runtime gets `Bun.Image`, more HTTP/2 and HTTP/3 support, and more Node compatibility improvements. - [ESLint Config Inspector 3.0](https://github.com/eslint/config-inspector) – A visual tool for inspecting and understanding your ESLint flat configs. - [TypeORM 1.0](https://typeorm.io/docs/releases/1.0/release-notes/), [ESLint 10.4.0](https://eslint.org/blog/2026/05/eslint-v10.4.0-released/), [Relay 21.0](https://github.com/facebook/relay/releases/tag/v21.0.0), [Rolldown 1.0.1](https://github.com/rolldown/rolldown/releases/tag/v1.0.1) 📖 Articles and Videos [![\](https://res.cloudinary.com/cpress/image/upload/w_1280,e_sharpen:60,q_auto/echd5tqlridpzz6jd2bx.jpg)](https://blog.isquaredsoftware.com/2026/05/ai-thoughts-part-2-agent-workflow-tools/) 🤖 [Mark Erikson's Agent Setup, Workflow, and Tools](https://blog.isquaredsoftware.com/2026/05/ai-thoughts-part-2-agent-workflow-tools/) — Mark, well known for maintaining Redux and creating Redux Toolkit, goes deep into his daily development workflow, including his use of [OpenCode](https://opencode.ai/) (an open source JavaScript-powered coding agent), how he manages his knowledge base, tasks, and more. Mark Erikson [Clerk API Keys Are Now Generally Available](https://go.clerk.com/bEqH8Si) — Let your users create credentials that delegate access to your API. Verify server-side, revoke instantly — all via the Backend SDK. Clerk sponsor 📗 [NodeBook: An Advanced Guide to Node.js Internals](https://www.thenodebook.com/) — Eight in-depth chapters for understanding Node.js internals, covering topics like [event loop internals](https://www.thenodebook.com/node-arch/event-loop-intro#what-the-nodejs-event-loop-does), [what V8 does](https://www.thenodebook.com/node-arch/v8-engine-intro), [streams](https://www.thenodebook.com/streams/foundation-of-streams), [module resolution](https://www.thenodebook.com/modules/resolution-algorithm), and [async/await](https://www.thenodebook.com/async-patterns/async-await). Ishtmeet Singh [Soon We Can Finally Banish JavaScript to the _ShadowRealm_](https://css-tricks.com/soon-we-can-finally-banish-javascript-to-the-shadowrealm/) — A tour of the _in-progress_ [TC39 proposal](https://github.com/tc39/proposal-shadowrealm) for running JavaScript in an isolated ‘pseudo-realm’ with its own globals and intrinsics. Handy for third-party code or anything you want to keep away from global scope. Mat Marquis 📄 [Hardening TanStack After the npm Compromise](https://tanstack.com/blog/incident-followup) – What TanStack is doing to improve supply chain security after [an attacker published](https://tanstack.com/blog/npm-supply-chain-compromise-postmortem) malicious versions of TanStack packages last week. The TanStack Team 📺 [The _TanStack Start_ Story: Tanner Linsley on Competing with Next.js](https://www.youtube.com/watch?v=6moPS3AAbe4) – A candid 40-minute interview with TanStack’s founder. Nuno Maduro 📄 [Cross-Document View Transitions: The Gotchas Nobody Mentions](https://css-tricks.com/cross-document-view-transitions-part-1/) Durgesh Rajubhai Pawar (CSS Tricks) 🛠 Code & Tools [![\](https://res.cloudinary.com/cpress/image/upload/w_1280,e_sharpen:60,q_auto/wbo5vpin96clokiyeke5.jpg)](https://orval.dev/) [Orval: Generate Type-Safe Clients from OpenAPI/Swagger Specs](https://orval.dev/) — Given a valid OpenAPI v3 or Swagger v2 spec, generate models, requests, hooks, and mocks for React, Vue, Svelte, Solid, and Hono apps, or even plain `fetch`. Victor Bury [Brownies: Browser Storage as a Plain Object, With Change Events](https://github.com/franciscop/brownies) — One tiny API over cookies, localStorage, sessionStorage and IndexedDB. Typed values survive automatically, and you get `subscribe()` for change events. Francisco Presencia [Querying a Billion Rows Shouldn't Freeze Your API](https://www.tigerdata.com/go/trial?utm_source=content-syndication&utm_medium=referral&utm_campaign=javascript-weekly-newsletter) — TimescaleDB extends Postgres so analytics queries stay fast at scale. No pipeline, no drift. [$1000 credit to start](https://www.tigerdata.com/go/trial?utm_source=content-syndication&utm_medium=referral&utm_campaign=javascript-weekly-newsletter). Tiger Data (creators of TimescaleDB) sponsor 🖼️ [Pica 10.0: High Quality Image Resizing in the Browser](https://nodeca.github.io/pica/demo/) — High quality in-browser image resizing that leans on WASM and Web Workers or falls back to pure JS as necessary. [v10](https://github.com/nodeca/pica/blob/master/CHANGELOG.md#1000---2026-05-16) is a modernization build (the first since 2021) that adds ESM and split builds and migrates to TypeScript. [GitHub repo.](https://github.com/nodeca/pica) Vitaly Puzrin 🗓️ [SVAR Calendar: A Calendar Component for React, Svelte and Vue](https://svar.dev/blog/svar-calendar-for-react-svelte-vue/) — A flexible calendar component with a MIT-licensed core and extended commercial version. [Here’s a live demo](https://svar.dev/demos/calendar/) of the open source version. XB Software Sp. 💡 [Schedule-X](https://schedule-x.dev/) is another great option in this space and [v4.6](https://github.com/schedule-x/schedule-x/blob/main/CHANGELOG.md#460-2026-05-12) just landed. [Fate 1.0: A Modern Data Framework for React](https://fate.technology/posts/fate-1.0) — A new data framework from former Jest lead and ex-Meta engineer Christoph Nakazawa. Christoph Nakazawa [Alien Signals: 'The Lightest Signal Library'](https://github.com/stackblitz/alien-signals) — Boils the best of Vue, Preact and Svelte’s approaches down into the lightest signal library going. A push-pull reactivity core so well-tuned it got merged back into Vue. Johnson Chu - [Critical 8.0](https://github.com/addyosmani/critical) – Addy Osmani's library for extracting and inlining above-the-fold CSS into HTML. - [SQL Formatter 15.8](https://github.com/sql-formatter-org/sql-formatter) – Pretty-printer for SQL queries. ([Demo](https://sql-formatter-org.github.io/sql-formatter/)) - [Shiki 4.1](https://shiki.style/) – Popular, powerful syntax highlighter. - [Redux Toolkit 2.12.0](https://github.com/reduxjs/redux-toolkit/releases/tag/v2.12.0) and [React Redux 9.3](https://github.com/reduxjs/react-redux/releases/tag/v9.3.0) - [Vue.js Language Tools 3.3](https://github.com/vuejs/language-tools/releases/tag/v3.3.0) 📰 Classifieds [HyperFormula](https://hyperformula.handsontable.com): The headless spreadsheet engine with 400+ Excel-compatible formulas. Run complex calculations at high speed. --- Flaky tests slowing down dev? [Meticulous](https://www.meticulous.ai/?utm_source=jsweekly&utm_medium=newsletter&utm_campaign=26q2&utm_content=classified) gives engineers confidence to ship faster by autonomously testing every edge case of your web app. --- ⚙️ [Middleware, but for AI agents](https://agentfield.ai/github/?utm_source=javascript&utm_medium=newsletter&utm_campaign=javascript-060519&utm_id=javascript-060519-github-cta&utm_content=github-cta). Compose Claude Code, Codex & Gemini as one TypeScript harness — 100+ agent recipes.[agentfield.ai/github](https://agentfield.ai/github/?utm_source=javascript&utm_medium=newsletter&utm_campaign=javascript-060519&utm_id=javascript-060519-github-cta&utm_content=github-cta). 📢 Elsewhere in the ecosystem [![\](https://res.cloudinary.com/cpress/image/upload/w_1280,e_sharpen:60,q_auto/azx9afpomjipp3vdrpxi.jpg)](https://es.discourse.group/t/jsonregistry-allows-branded-instances-in-regular-json/2569) - Andrea Giammarchi [proposes `JSONRegistry`](https://es.discourse.group/t/jsonregistry-allows-branded-instances-in-regular-json/2569) _(above)_, an alternative to `JSON` that lets you define a registry for serializing and reviving custom/branded types. - 🐝 [Wasp](https://wasp.sh/) is a Rails-like framework for Node, React and Prisma. It started life as a new programming language of its own before moving to JavaScript. Founder Matija Sosic tells the story in [5 Years and $5M Later: Inventing a New Programming Language for Web Development Was a Mistake](https://wasp.sh/blog/2026/05/13/new-language-for-web-dev-was-a-mistake). - Did you know that [some browsers render certain sites 'differently'](https://denodell.com/blog/browsers-treat-big-sites-differently) on an ad hoc basis? Firefox and Safari ship with [built-in 'tweaks' for popular sites](https://searchfox.org/firefox-main/source/browser/extensions/webcompat/data/interventions) to fix elements that don't render correctly by default. - 🤖 Simon Willison shares [a quick look at the last six months in LLMs.](https://simonwillison.net/2026/May/19/5-minute-llms/) Published by [Cooperpress](https://cooperpress.com/) and edited by [Peter Cooper](https://twitter.com/cooperx86) 'JavaScript' is a trademark of Oracle Corporation in the US We are not endorsed by or affiliated with Oracle. [Change your email address](https://javascriptweekly.com/edit_subscription/*|UID|*) or [stop getting this newsletter](https://javascriptweekly.com/leave/*|UID|*). © Cooper Press Ltd · Fairfield Enterprise Centre, Louth, LN11 0LS, United Kingdom