---
title: "npm 12, TypeScript 7, and Bun in Rust"
publication: "JavaScript Weekly"
issue: 794
published_at: "2026-07-14"
canonical_url: "https://javascriptweekly.com/issues/794"
---

Plus a deep dive into Proxy and Reflect, a lighter Babylon.js, and TC39's next meeting.        

#​794 — July 14, 2026 

[Read on the Web](https://javascriptweekly.com/issues/794)  

Together with [![Code Rabbit\](https://res.cloudinary.com/cpress/image/upload/c_fill,g_auto,e_trim,w_1280,h_187/e_make_transparent/co_white,e_outline:20/hxaajcewmf94f29l9dka.png)](https://coderabbit.link/cooperpress-jsweekly)   

JavaScript Weekly 

[![\](https://res.cloudinary.com/cpress/image/upload/w_1280,e_sharpen:60,q_auto/vznfsck17p4he0yi3eae.jpg)](https://tanstack.com/stats/npm)  

📈 [TanStack's npm Package Download Charts](https://tanstack.com/stats/npm) — A quick way to chart package popularity over time, look for trends, and see what libraries and tools have soared or fallen. The default view compares TanStack's packages against several common packages, but you can enter any packages you wish, or see pre-defined sets like build tools, component libraries, or UI frameworks. 

TanStack   [![\](https://res.cloudinary.com/cpress/image/upload/c_limit,w_480,h_480,q_auto/copm/81f2de52.png)](https://coderabbit.link/cooperpress-jsweekly) 

[Your AI Writes the Code. CodeRabbit Reviews It](https://coderabbit.link/cooperpress-jsweekly) — AI can write the code, but you still own what ships. CodeRabbit is the AI-native review layer that catches the bugs and edge cases humans skim past, so what merges matches what you intended. [Free to try, 2-click install](https://coderabbit.link/cooperpress-jsweekly). 

CodeRabbit sponsor   

[Rewriting Bun in Rust](https://bun.com/blog/bun-in-rust) — Bun's creator shares the full story of porting the JavaScript runtime from Zig to Rust, with the assistance of many Claude Code instances churning through ~$165k in usage (at API prices). The Rust version forms the basis of Bun 1.4, expected any day now. 

Jarred Sumner   

[npm v12 Released: Install Scripts are Off by Default](https://github.blog/changelog/2026-07-08-npm-install-time-security-and-gat-bypass2fa-deprecation/) — npm 12 is now GA with [many breaking changes](https://github.com/npm/cli/releases/tag/v12.0.0). The big change is lifecycle scripts no longer run by default, but here are [more practical implications to consider](https://socket.dev/blog/npm-12). It may also be worth upgrading [via 11.18.0](https://github.com/npm/cli/releases/tag/v11.18.0) first. 

GitHub   

**IN BRIEF:** 

- TC39's 115th meeting takes place next week. [Here's the agenda](https://github.com/tc39/agendas/blob/main/2026/07.md), including [Await Dictionary](https://github.com/tc39/proposal-await-dictionary) aiming for Stage 3, plus [Decimal](https://github.com/tc39/proposal-decimal/), Import Defer and [Map.take](https://github.com/dcrousso/proposal-Map-take).
- [Next.js now has a formal security release program](https://nextjs.org/blog/next-security-release-program) with monthly announcements and scheduled releases. The first is expected on July 20.
- ⚠️ The `jscrambler` npm package [suffered a supply chain attack at the weekend](https://socket.dev/blog/jscrambler-supply-chain-attack) which Socket detected within six minutes.
- The [Porffor](https://porffor.dev/) ahead-of-time JavaScript compiler [is now self-hosting](https://bsky.app/profile/honk.foo/post/3mq5u64sl4k27) (can compile itself with itself).
- [Vercel has acquired](https://vercel.com/blog/vercel-acquires-better-auth) the team behind [Better Auth](https://better-auth.com/), the popular auth library.   

**RELEASES:** 

- ⭐ [TypeScript 7.0](https://devblogs.microsoft.com/typescript/announcing-typescript-7-0/) – The final release of the "10x faster" Go-powered version of the TypeScript compiler is here. A (temporary) lack of a full API means many users are recommended to [stay on 6.0](https://devblogs.microsoft.com/typescript/announcing-typescript-7-0/#typescript-and-embedded-languages) for now, though.
- [Node.js 26.5.0 (Current)](https://nodejs.org/en/blog/release/v26.5.0) – Adds support for [importing text files in ES modules](https://github.com/tc39/proposal-import-text) via import attributes, plus `blob.textStream()`.
- [ESLint 10.7](https://eslint.org/blog/2026/07/eslint-v10.7.0-released/), [Storybook 10.5](https://github.com/storybookjs/storybook/releases/tag/v10.5.0), [Vite DevTools 0.4](https://github.com/vitejs/devtools/releases/tag/v0.4.0)  

📖 Articles and Videos  

[`Proxy` and `Reflect`: Redefining How Objects Fundamentally Work](https://piccalil.li/blog/proxy-and-reflect/) — A deep dive into intercepting the internal operations of JavaScript objects, covering why `Reflect` exists at all, and ending with a small reactive state system (essentially [how Vue 3's reactivity works](https://vuejs.org/guide/extras/reactivity-in-depth)). 

Mat Marquis   

[In Defense of Polyfills](https://lea.verou.me/blog/2026/polyfills/) — Prolific standards editor Anne van Kesteren said polyfilling is harmful. Lea disagrees, arguing _"ponyfills are just userland libraries with better marketing"_ and a web without polyfills would be a stagnant one. 

Lea Verou   

[Sentry + GitHub: Bugs Diagnosed and Fixed, Live](https://sentry.io/resources/github-copilot-workshop/?utm_source=javascriptweekly&utm_medium=paid-community&utm_campaign=ai-fy27q2-githubcopilotworkshop&utm_content=newsletter-sponsored-link-register) — Sentry catches it, Seer diagnoses it, Copilot writes the fix. Watch Sentry and GitHub break a script live July 15th. 

Sentry sponsor   

[Collaborative Editing in Wordgard](https://marijnhaverbeke.nl/blog/collaborative-editing-wordgard.html) — Marijn recently released his new [Wordgard](https://wordgard.net/) rich text editor (and ProseMirror successor). Here's his third take on collaborative editing in eleven years, still based on operational transformation (OT) rather than CRDTs. 

Marijn Haverbeke  

💡 We missed [Marijn's Wordgard release post](https://marijnhaverbeke.nl/blog/wordgard-0.1.html) in last week's Wordgard feature. He explains why and how he built it (no LLMs!) and why he's _not_ taking pull requests.  

[Reverse Engineering ChatGPT's Web Stack](https://performance.dev/chatgpt) — The author spent days breaking down ChatGPT's page source, bundles, and requests. React Router 7, TanStack Query, Radix, and ProseMirror all make an appearance. 

Dennis Brotzky   

📄 [Playwright on GitHub Actions: A Setup That Actually Runs Fast](https://endform.dev/blog/playwright-github-actions) Jakob Norlin 

📄 [Building Persistent Page Transitions with WebGPU and Vanilla JS](https://tympanus.net/codrops/2026/06/30/building-persistent-page-transitions-with-webgpu-and-vanilla-javascript/) Ben Paine 

📄 [SolidJS 2.0: A React Developer's First Look at Signals and Async](https://morello.dev/blog/solidjs-2-react-developers-first-look) Dennis Morello  

🛠 Code & Tools 

[![\](https://res.cloudinary.com/cpress/image/upload/w_1280,e_sharpen:60,q_auto/solv9pgf1thozoexx7xt.jpg)](https://developers.googleblog.com/litertjs-googles-high-performance-web-ai-inference/)  

[LiteRT.js: High Performance Web AI Inference from Google](https://developers.googleblog.com/litertjs-googles-high-performance-web-ai-inference/) — A JavaScript binding of [LiteRT](https://developers.google.com/edge/litert) for running AI directly inside the web browser, boasting more performance than the TensorFlow.js approach. Here's [a CodePen-hosted demo](https://codepen.io/LiteRT/pen/XJNNxZv) of using it to do image upscaling (surprisingly quickly!) 

Yu, Ristić, Soulanille, Parikh (Google)   

[Full-Text Search in Drizzle Without a Second System](https://github.com/paradedb/drizzle-paradedb) — Try the official ParadeDB integration for Drizzle. Search your live Postgres tables. No ETL, no Elasticsearch cluster. 

ParadeDB sponsor   

[Babylon Lite: A Faster, Smaller, WebGPU-Only 3D Engine](https://doc.babylonjs.com/lite/) — [Babylon.js](https://www.babylonjs.com/) is a powerful, long-standing 3D engine, but what would they do if rebuilding from scratch? This! _Lite_ is much faster and smaller, but with some tradeoffs. 

Babylon.js Team   

[Ant: A JavaScript Runtime in a 9MB Binary](https://antjs.org/) — No V8, JavaScriptCore or SpiderMonkey involved, this is a JS runtime built in C that ships as a 9MB binary, can run npm packages, and boasts incredibly short cold start times. 

theMackabu   

- 🔎 [Fuse.js 7.5](https://github.com/krisk/Fuse/releases/tag/v7.5.0) – The popular fuzzy search library fixes a variety of scoring and ranking bugs (so ordering may shift for some queries). ([Homepage](https://www.fusejs.io/) and [demo](https://www.fusejs.io/demo.html))
- [Nano ID 6.0](https://github.com/ai/nanoid) – Tiny, secure, URL-friendly unique string ID generator. `nanoid()` and `customAlphabet()` get 4x faster in 6.0.
- [Mantine Vue](https://mantine-vue.dev/getting-started) – A port of the popular [Mantine](https://mantine.dev/) React component library for use with Vue.      

📰 Classifieds   

Flaky tests slowing down dev? [Meticulous](https://www.meticulous.ai/?utm_source=jsweekly&utm_medium=newsletter&utm_campaign=26q3&utm_content=classified) gives engineers confidence to ship faster by autonomously testing every edge case of your web app. 

--- 

Your dashboard is slow because the query is slow. [TimescaleDB extends Postgres](https://www.tigerdata.com/go/trial?utm_source=content-syndication&utm_medium=referral&utm_campaign=javascript-weekly-newsletter) for analytics at scale, no second DB. 

--- 

⚡Sync live context across your entire agent stack. Merget’s now live, build & [win a year of Claude Max](https://merget.ai/hackathon).    

📢 Elsewhere in the ecosystem 

[![\](https://res.cloudinary.com/cpress/image/upload/w_1280,e_sharpen:60,q_auto/g1r2xzmiqtaoiqzrs2ds.jpg)](https://j-brooke.github.io/FracturedJson/)  

- [FracturedJson](https://j-brooke.github.io/FracturedJson/) is a JSON formatter that produces 'human-readable but fairly compact' output. If you have a big lump of JSON, this makes it more pleasant to look through. It also supports non-standard JSON comments.
- [Cloudflare has unveiled Precursor](https://blog.cloudflare.com/introducing-precursor/), a client-side verification system that uses injected JS to collect behavioral signals (e.g. pointer movement) in an attempt to improve bot detection.   

[![\](https://res.cloudinary.com/cpress/image/upload/w_1280,e_sharpen:60,q_auto/s6l7inruzpaoyfcqhhvn.jpg)](https://fonts.google.com/specimen/Geist+Pixel?preview.script=Latn)  

- 🔠 [Geist Pixel](https://vercel.com/font?type=pixel) _(above)_, the latest member of Vercel's _Geist_ family of fonts, is [now available to use on Google Fonts](https://fonts.google.com/specimen/Geist+Pixel?preview.script=Latn).
- Devographics, best known for its [State of JavaScript](https://stateofjs.com/en-US) surveys, is back with a more general [_State of Devs_ survey](https://survey.devographics.com/en-US/survey/state-of-devs/2026) to take.
- [A scrolling visualization of the ~200ms life of an HTTP request.](https://200ms.thenodebook.com/#act-0-prologue)         

Published by [Cooperpress](https://cooperpress.com/) and edited by [Peter Cooper](https://twitter.com/cooperx86) 

'JavaScript' is a trademark of Oracle Corporation in the US
We are not endorsed by or affiliated with Oracle. 

[Change your email address](https://javascriptweekly.com/edit_subscription/*|UID|*) or [stop getting this newsletter](https://javascriptweekly.com/leave/*|UID|*). 

© Cooper Press Ltd · Fairfield Enterprise Centre, Louth, LN11 0LS, United Kingdom