---
title: "npm and pnpm introduce staged publishing"
publication: "JavaScript Weekly"
issue: 787
published_at: "2026-05-26"
canonical_url: "https://javascriptweekly.com/issues/787"
---

Plus Deno 2.8's Node.js leap, a Webpack-to-Rspack migration story, and a bloody hard crossword.        

#​787 — May 26, 2026 

[Read on the Web](https://javascriptweekly.com/issues/787)  

Together with [![Expo\](https://res.cloudinary.com/cpress/image/upload/c_fill,g_auto,e_trim,w_1024,h_289/e_make_transparent/co_white,e_outline:15/damvoyij8zrqr3lp2edx.png)](https://try.expo.dev/js-weekly-ui)   

JavaScript Weekly 

[![\](https://res.cloudinary.com/cpress/image/upload/w_1280,e_sharpen:60,q_auto/kpiq6sqaxoik0wuhn14u.jpg)](https://lyra.horse/fun/jscrossword/)  

[JS Crossword: All the Answers are JavaScript](https://lyra.horse/fun/jscrossword/) — This hand-crafted puzzle will seriously stretch your JavaScript knowledge. I’ve seen so many people on social media either cheering having finished it or cursing being stuck… 

Lyra Rebane  

💡 I've put some (educational!) tips at the end of this issue.  [![\](https://res.cloudinary.com/cpress/image/upload/c_limit,w_480,h_480,q_auto/copm/20f71006.png)](https://try.expo.dev/js-weekly-ui) 

[Expo UI Hits Stable: Native iOS & Android from One Import](https://try.expo.dev/js-weekly-ui) — From a single import, @expo/ui ships SwiftUI on iOS and Jetpack Compose on Android with the real platform components underneath. SDK 56 also lands native drop-in replacements for seven common React Native community packages. 

Expo sponsor   

[Staged Publishing for npm Packages Goes Live](https://docs.npmjs.com/staged-publishing) — npm’s ‘staged publishing’ model provides a review period with approval required before packages go live on the npm registry. Both [npm 11.15.0](https://github.com/npm/cli/releases/tag/v11.15.0) and [pnpm 11.3](https://pnpm.io/blog/releases/11.3) have added support. 

The npm Project  

💡 [In this broader writeup](https://github.blog/changelog/2026-05-22-staged-publishing-and-new-install-time-controls-for-npm/), GitHub also introduced npm's new `--allow-*` options to control over where npm is allowed to source packages from.  

**IN BRIEF:** 

- [Firefox has added Web Serial support in Firefox 151](https://hacks.mozilla.org/2026/05/web-serial-support-in-firefox/) so you can connect to microcontrollers, 3D printers, and other serial-connected hardware from JS.
- Mozilla's Ryan Hunt [says goodbye to asm.js](https://spidermonkey.dev/blog/2026/05/20/saying-goodbye-to-asmjs.html) as Firefox's JS engine now disables optimizations for it by default.
- 🤖 [Modern Web Guidance](https://developer.chrome.com/docs/modern-web-guidance) is a suite of expert-vetted skills to guide agents in building modern web experiences, e.g. `"begin preloading pages when users hover over important links."`
- [TC39 held its latest meeting last week](https://github.com/tc39/agendas/blob/main/2026/05.md) – a roundup is due soon.   

**RELEASES:** 

- [Storybook 10.4](https://storybook.js.org/blog/storybook-10-4/) – the frontend component workshop – has added first-class TanStack React support and the ability for agents to set up Storybook in complex apps.
- [Node.js v26.2.0 (Current)](https://nodejs.org/en/blog/release/v26.2.0) and [v24.16.0 (LTS)](https://nodejs.org/en/blog/release/v24.16.0)
- [pnpm 11.3](https://pnpm.io/blog/releases/11.3) – Adds `pnpm stage` for [staged publishing](https://docs.npmjs.com/staged-publishing), `trustLockfile` for setting controls around application of trust policies, native `pkg`, `repo` and `set-script` commands & more.
- [npm 12.0 Prerelease](https://github.com/npm/cli/releases/tag/v12.0.0-pre.0.0), [Apache ECharts 6.1](https://github.com/apache/echarts/releases/tag/6.1.0) ([Demos.](https://echarts.apache.org/examples/en/index.html))  

📖 Articles and Videos  

[Chrome Previews _Declarative Partial Updates_](https://developer.chrome.com/blog/declarative-partial-updates) — Two new sets of APIs for working with HTML out-of-order, whether in the doc itself (via `<template for>`) or through dynamic insertion (via `setHTML`/`streamHTML`). Experimental in Chrome 148 but [polyfills](https://github.com/GoogleChromeLabs/html-setters-polyfill) [exist](https://github.com/GoogleChromeLabs/template-for-polyfill). 

Pollard and Rosenthal (Chrome)   

[Optimizing Our Build Times by Migrating from Webpack to Rspack](https://engineeringblog.yelp.com/2026/05/optimizing-our-build-times-by-migrating-from-webpack-to-rspack.html) — How Yelp cut build times in half with [Rspack](https://rspack.rs/) (a Rust-powered drop-in replacement for webpack) and what they learned about barrel files and re-exports. 

Benson Pan (Yelp)   

[Unlimited Postgres for Developers and Their Agents](https://ghost.build/?utm_source=content-syndication&utm_medium=referral&utm_campaign=javascript-weekly-newsletter) — _ghost_ gives your agent unlimited postgres forks. No project limits, no cleanup, 1TB storage, 100 hrs/mo free. [Try for free](https://ghost.build/?utm_source=content-syndication&utm_medium=referral&utm_campaign=javascript-weekly-newsletter) 

Ghost sponsor   

[Microsoft's Analysis of the Recent _Mini Shai-Hulud_ Compromise](https://www.microsoft.com/en-us/security/blog/2026/05/20/mini-shai-hulud-compromised-antv-npm-packages-enable-ci-cd-credential-theft/) — A detailed post-mortem of last week’s [‘Mini Shai-Hulud’](https://safedep.io/mini-shai-hulud-strikes-again-314-npm-packages-compromised/) npm security chain compromise. 

Microsoft Defender Security Research Team   

🤖 [AI-Assisted Engineers are Burning Out: Is This Fine?](https://evilmartians.com/chronicles/ai-assisted-engineers-are-burning-out-is-this-fine) – A look at the negative effects of AI-assisted coding and how to avoid burning yourself out. Ivan Chepurin 

📄 [A Simple Clustering Algorithm for Lists](https://cassidoo.co/post/clustering-tiles/) – Some algorithm fun. Cassidy Williams  

🛠 Code & Tools  

[Deno 2.8: The 'Biggest Minor Release' to Date](https://deno.com/blog/v2.8#new-subcommands) — The headline is that Node.js compatibility has jumped from 42% in Deno 2.7 to 76.4% now (higher than Bun). Deno also gets [huge perf gains](https://deno.com/blog/v2.8#performance) across the board and drops the `npm:` prefix requirement when adding/installing packages. Plus many other things, including: 

- New commands including: `audit fix` to upgrade vulnerable dependencies, `pack` to build a project into a npm-publishable tarball, and `why` to see why a package has been installed.
- [Web API support](https://deno.com/blog/v2.8#web-apis) improvements, including `OffscreenCanvas` going stable.
- Node [`module.registerHooks()` support](https://deno.com/blog/v2.8#module-loader-hooks).
- Chrome DevTools can now [inspect Deno's network traffic](https://deno.com/blog/v2.8#debugging).
- A [built-in CPU profiler](https://deno.com/blog/v2.8#cpu-profiling).
- [import defer](https://deno.com/blog/v2.8#import-defer) support.
- V8 14.9 and TypeScript 6.0.3. 

Bartek Iwańczuk   

[10 Merged, 34 to Go: Fixing JS Observability Upstream](https://blog.sentry.io/fixing-javascript-observability/?utm_source=javascriptweekly&utm_medium=paid-community&utm_campaign=observability-fy27q2-evergreen&utm_content=newsletter-sponsored-link-javascript-blog-learnmore) — Every JS APM tool monkey-patches libraries. It breaks with ESM, bundlers, and non-Node runtimes. [Here's how to fix it](https://blog.sentry.io/fixing-javascript-observability/?utm_source=javascriptweekly&utm_medium=paid-community&utm_campaign=observability-fy27q2-evergreen&utm_content=newsletter-sponsored-link-javascript-blog-learnmore). 

Sentry sponsor   

📄 [DOCX 9.7: Build Word `.docx` Files in JavaScript](https://docx.js.org/) — A mature, comprehensive library for generating `docx` files both client and server side. There’s a [CodePen-based example](https://codepen.io/dolanmiu/pen/RwNeObg) with the basics, plus [over 100 example scripts](https://github.com/dolanmiu/docx/tree/master/demo). 

Dolan Miu   

[tinykeys 4.0: A Tiny, Modern Library for Keybindings](https://jamiebuilds.github.io/tinykeys/) — Has a very simple, straightforward API and the page includes live demos. 

Jamie Kyle   

[An Official Node.js Codemod to Migrate from Axios to `fetch`](https://app.codemod.com/registry/@nodejs/axios-to-whatwg-fetch) — A [codemod](https://nodejs.org/learn/getting-started/userland-migrations) to transform code using Axios to using the Fetch API instead. 

The Node.js Team   

📱 [Hot Updater: Self-Hosted Over-the-Air Updates for React Native](https://hot-updater.dev/) — A way to deploy updates to apps without app store submissions. 

Sungyu Kang   

- 📊 [Perspective 4.5](https://github.com/perspective-dev/perspective) – Analytics and data viz component for large and streaming datasets.
- [Partytown 0.14.0](https://partytown.qwik.dev/) – Relocate resource-intensive scripts into Web Workers.
- [atproto TypeScript SDK Upgrades](https://atproto.com/blog/ts-sdk-upgrades) – Every package in the `@atproto` namespace has been rebuilt, and all are now shipped as ESM.
- [Kysely 0.29.0](https://github.com/kysely-org/kysely/releases/tag/v0.29.0) – Popular type-safe SQL query builder.
- [Svader 1.0](https://github.com/sockmaster27/svader) – Create GPU-rendered Svelte components.      

📰 Classifieds   

🦊 [Foxit's open-source MCP server](https://developer-api.foxit.com/developer-blogs/use-cases-workflow-examples/automated-document-pipelines/foxit-mcp-server-ai-pdf-tools/?utm_source=draftdev&utm_campaign=jsweekly) gives AI agents 30+ PDF tools — covering PDF conversion, OCR, merge, signing, and document workflows. 

--- 

⚙️ [Middleware, but for AI agents](https://agentfield.ai/github/?utm_source=javascript&utm_medium=newsletter&utm_campaign=javascript-260526&utm_id=javascript-260526-github-cta&utm_content=github-cta). Compose Claude Code, Codex & Gemini as one TypeScript harness — 100+ agent recipes.[agentfield.ai/github](https://agentfield.ai/github/?utm_source=javascript&utm_medium=newsletter&utm_campaign=javascript-260526&utm_id=javascript-260526-github-cta&utm_content=github-cta). 

--- 

Flaky tests slowing down dev? [Meticulous](https://www.meticulous.ai/?utm_source=jsweekly&utm_medium=newsletter&utm_campaign=26q2&utm_content=classified) gives engineers confidence to ship faster by autonomously testing every edge case of your web app.    

👀 JS Crossword Tips  

The [JS Crossword](https://lyra.horse/fun/jscrossword/) _(featured at the top of the issue)_ is tough, so I have some educational tips and JS quirks to help you on your way: 

- The crossword runs in the browser, so the `window` global object is in play. For example: `find(0)` and `name` return things in the browser, but not in Node.
- Look at the 'playground' beneath the puzzle. While a clue may say `object`, the expected result may be more detailed.
- A number like 67 can be represented multiple ways. For example: `0103 == 67` and `0x43 == 67`
- You can go further with prefixes and suffixes on numbers. For example: `123.`, `+123`, and `+123.` all equal `123`
- Assignments evaluate to the value that was assigned.
- [Tagged template literals](https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Template_literals#tagged_templates) offer a… _quirky_ way to call functions. Consider that this works in JS: `console.log\`hi\`` (though this is _not_ equivalent to `console.log('hi')`).
- `'` is not in the allowed character list.         

Published by [Cooperpress](https://cooperpress.com/) and edited by [Peter Cooper](https://twitter.com/cooperx86) 

'JavaScript' is a trademark of Oracle Corporation in the US
We are not endorsed by or affiliated with Oracle. 

[Change your email address](https://javascriptweekly.com/edit_subscription/*|UID|*) or [stop getting this newsletter](https://javascriptweekly.com/leave/*|UID|*). 

© Cooper Press Ltd · Fairfield Enterprise Centre, Louth, LN11 0LS, United Kingdom