---
title: "Reimplementing htmx from scratch"
publication: "JavaScript Weekly"
issue: 797
published_at: "2026-08-04"
canonical_url: "https://javascriptweekly.com/issues/797"
---

Plus an ongoing package security incident, JavaScript's third comment syntax, and extending TypeScript with a new feature.        

#​797 — August 4, 2026 

[Read on the Web](https://javascriptweekly.com/issues/797)  

Together with [![Master.dev\](https://res.cloudinary.com/cpress/image/upload/c_fill,g_auto,w_1280,h_245/co_white,e_outline:17/cgiteem1q7kgf8yoheqo.png)](https://master.dev/courses/frontend-architecture/?utm_source=email&utm_medium=javascriptweekly&utm_content=frontendcooper)   

JavaScript Weekly 

[![\](https://res.cloudinary.com/cpress/image/upload/w_1280,e_sharpen:60,q_auto/sk9fe6nujcbnpxh2pkor.jpg)](https://nextjs.org/blog/next-16-3)  

[Next.js 16.3 Released](https://nextjs.org/blog/next-16-3) — The newly expanded Next.js team (now including [Dan Abramov](https://bsky.app/profile/danabra.mov/post/3mp5b3nd3ws2k) and [𝕏 Pete Hunt](https://x.com/rauchg/status/2077870043833229692)!) has dropped the latest version of the popular React framework, complete with faster builds, optional TypeScript 7 type checking, faster SSR, [Instant Navigations](https://nextjs.org/blog/next-16-3-instant-navigations), [AI improvements](https://nextjs.org/blog/next-16-3-ai-improvements), and more. 

The Next.js Team   [![\](https://res.cloudinary.com/cpress/image/upload/c_limit,w_480,h_480,q_auto/copm/0f9a422d.png)](https://master.dev/courses/frontend-architecture/?utm_source=email&utm_medium=javascriptweekly&utm_content=frontendcooper) 

[Frontend Architecture: Monoliths to Microfrontends](https://master.dev/courses/frontend-architecture/?utm_source=email&utm_medium=javascriptweekly&utm_content=frontendcooper) — Maxi Ferreira walks through modular monoliths, monorepos, and microfrontends so you can pick the right structure for your codebase and know the real cost before you commit. 

Master.dev sponsor   

[Let's Make the Worst `htmx` Ever](https://zserge.com/posts/worst-htmx-ever/) — After making [the 'worst' React](https://zserge.com/posts/worst-react-ever/) and [Vue.js](https://zserge.com/posts/worst-vuejs-ever/) implementations, Serge tackles rebuilding the essence of [htmx](https://htmx.org/) from scratch. A fun way to understand what htmx actually does under the hood. 

Serge Zaitsev   

[The Secure Way to Release an `npm` Package in 2026](https://evilmartians.com/chronicles/the-secure-way-to-release-an-npm-package) — A practical guide to publishing `npm` packages more safely, written by the author of numerous popular packages (e.g. [postcss](https://www.npmjs.com/package/postcss)). As well as showing _how_ to use staged publishing and trusted publishing, he explains _why_ they help. 

Andrey Sitnik  

💡 GitHub is continuing to [focus on npm security](https://github.blog/security/supply-chain-security/disrupting-supply-chain-attacks-on-npm-and-github-actions/), and is starting to [scan every npm package for malware](https://github.blog/changelog/2026-07-28-npm-publish-time-malware-scanning-and-dual-use-metadata/) at publish time. This will have some implications, including a delay between publishing and availability for installation.  

**IN BRIEF:** 

- 🚨 **Developing incident:** The popular `keyv` and `cacheable` packages were [compromised today with a credential-stealing worm](https://socket.dev/blog/popular-npm-packages-in-the-keyv-and-cacheable-namespaces-compromised-in-active-supply-chain). The repercussions are ongoing with [hundreds more packages](https://github.com/wiz-sec-public/wiz-research-iocs/blob/main/reports/keyv-packages.csv) compromised so far.
- Monthly updates from [the Astro team](https://astro.build/blog/whats-new-july-2026/) and [the Svelte team](https://svelte.dev/blog/whats-new-in-svelte-august-2026). The first preview releases of SvelteKit 3 are now available.
- ⚖️ The _Deno vs Oracle_ JavaScript™ trademark case rattles on with [Deno consenting to a _fifth_ extension request](https://ttabvue.uspto.gov/ttabvue/v?pno=92086835&pty=CAN&eno=26) as discovery continues.
- Popular JS library factory [_TanStack_ has rebranded](https://tanstack.com/blog/tanstack-has-a-new-look) and introduced [new 'Markdown' and 'Highlight' libraries](https://tanstack.com/blog/introducing-tanstack-markdown-and-highlight).   

**RELEASES:** 

- [MobX 7.0](https://github.com/mobxjs/mobx/releases/tag/mobx%407.0.0) – The popular state manager slims down, removes deprecations, [updates its React bindings](https://github.com/mobxjs/mobx/releases/tag/mobx-react%4010.0.0), and now always uses Proxy-backed observable objects and arrays.
- [Javy 9.1](https://github.com/bytecodealliance/javy) – Toolchain for compiling JavaScript to WebAssembly for WASM runtimes.
- [Node.js v26.6.0 (Current)](https://nodejs.org/en/blog/release/v26.6.0) and [v24.19.0 (LTS)](https://nodejs.org/en/blog/release/v24.19.0)
- [Vite 8.2](https://github.com/vitejs/vite/blob/v8.2.0/packages/vite/CHANGELOG.md), [React Three Fiber 9.7](https://github.com/pmndrs/react-three-fiber/releases/tag/v9.7.0), [Lerna 10.0](https://github.com/lerna/lerna/releases/tag/v10.0.0), [Hono 4.13.0](https://github.com/honojs/hono/releases/tag/v4.13.0)  

📖 Articles and Videos  

[Your SPA is Leaking Memory: 'Soak Test' It](https://denodell.com/blog/your-spa-is-leaking-memory-soak-test-it) — How to run a Playwright 'soak test' that loops a user flow within the same browser context, watches DOM node and listener counts, and fails CI when a memory leak creeps in. 

Den Odell   

[Your JSON is Lying to You](https://blog.gaborkoos.com/posts/2026-08-03-Your-JSON-Is-Lying-to-You/) — A reminder that a `JSON.parse`/`JSON.stringify` round-trip is far from lossless, with big integers, `undefined`, `Date`, and more, altered or lost along the way. Gabor covers the nastier gotchas and practical ways to make the conversion boundaries explicit. 

Gabor Koos   

[Don’t Just Code—Grow as a Technologist](https://jobs.fidelity.com/en/technology-careers/?utm_source=javascript&utm_medium=paidsocial&utm_campaign=jobssocial&utm_content=awn-tech-nl1-s) — Explore new technology, sharpen your existing skills and build new ones when you work in tech at Fidelity. 

Fidelity Careers sponsor   

[cdnjs at 9 Billion Requests a Day: A Migration Story](https://blog.cloudflare.com/cdnjs-dev-platform-migration/) — [cdnjs](https://cdnjs.com/) is a popular, free CDN for loading JavaScript libraries without bundling or self-hosting (which LLMs _really_ seem to like). Cloudflare explains how it now runs entirely on Workers and R2. 

Simona Badoiu (Cloudflare)   

[Adding Go's `defer` to the TypeScript Compiler](https://healeycodes.com/adding-defer-to-the-typescript-compiler) — In Go, `defer` delays the execution of a function call until the surrounding function finishes. Can you just fork TypeScript and add language features? Yes! Should you? Probably not, as [`using`](https://www.totaltypescript.com/typescript-5-2-new-keyword-using) is already a good fit for the use case. 

Andrew Healey   

📄 [Learning Remix 3](https://malstrom.me/blog/learning-remix-3) – By porting a Solid 2.0 demo to Remix 3's server-first model. Mark Malstrom 

📄 [Why npm Dependency Trees Are So Big](https://nesbitt.io/2026/07/28/why-npm-dependency-trees-are-so-big.html) Andrew Nesbitt  

🛠 Code & Tools 

[![\](https://res.cloudinary.com/cpress/image/upload/w_1280,e_sharpen:60,q_auto/zzctbd5nks5jg4ur4cir.jpg)](https://tanstack.com/charts/latest)  

[TanStack Charts: A New Chart Grammar Option](https://tanstack.com/charts/latest) — In the past few weeks, TanStack has been rapidly iterating on a new, framework-neutral way to declaratively specify a large number of chart-related visualizations in JavaScript. Output renders to SVG or canvas and can be styled as you wish. [Here's a comparison](https://tanstack.com/charts/latest/docs/comparison) against other established options. 

TanStack   

[An Open Source PR Reviewer Just Ranked #2 of 42 on Code-Review-Bench](https://agentfield.ai/github/pr-af/?utm_source=javascript&utm_medium=newsletter&utm_campaign=javascript-260804&utm_id=javascript-260804-pr-af&utm_content=pr-af) — PR-AF outranks the commercial tools. Verified findings only, ~10x cheaper, self-hosted. Drops into GitHub Actions. 

Agentfield.ai sponsor   

[MicroDiff 1.6: Fast Object and Array Comparison Library](https://github.com/AsyncBanana/microdiff) — Given two objects or arrays, it returns the differences (think `diff` but for JS objects). This week's release adds support for Temporal types. 

Jacob Jackson  

💡 Jacob has a post from 2022 covering [how microdiff is so fast](https://byteofdev.com/posts/microdiff/).  

[Virtua: Virtual List and Grid Component for Multiple Frameworks](https://github.com/inokawa/virtua) — A fast and small virtual list/grid component for React, Vue, Solid, Svelte, and Angular. [Here's a demo](https://inokawa.github.io/virtua/?path=/story/basics-vlist--default) and [a comparison table](https://github.com/inokawa/virtua#comparison) against other solutions. 

inokawa   

📊 [Perspective 5: Interactive Analytics and Data Vis Component](https://perspective-dev.github.io/) — Originally built by JP Morgan, a WASM-powered data visualization component suited to large and/or real-time streaming datasets. 5.0/5.1 just dropped with numerous fixes, `wasm64` builds, and [window columns](https://github.com/perspective-dev/perspective/pull/3207). 

OpenJS Foundation   

- [Neutralinojs 6.9](https://github.com/neutralinojs/neutralinojs/releases/tag/v6.9.0) – The lightweight Electron alternative has a new C++ network API for making HTTP requests free of the webview's CORS restrictions.
- [DukPy 0.6](https://github.com/amol-/dukpy/releases/tag/0.6.0) – Simple JavaScript interpreter for Python. Now uses the QuickJS-NG engine to support more modern JavaScript and Promises.
- [isomorphic-git 1.40.0](https://github.com/isomorphic-git/isomorphic-git) – A pure JS implementation of Git for Node & browsers.
- [better-result 3.0](https://github.com/dmmulroy/better-result) – Lightweight `Result` type for TypeScript with generator-based composition.
- [ip-address 10.4](https://github.com/beaugunderson/ip-address) – Parse, validate and manipulate IP (v4 and v6) addresses.      

📰 Classifieds   

⚡ Stop being the integration layer. [Build a CRM-to-signed-PDF pipeline in n8n](https://developer-api.foxit.com/developer-blogs/use-cases-workflow-examples/automated-document-pipelines/foxit-api-n8n-document-pipeline/?utm_source=draftdev&utm_medium=newsletter&utm_campaign=jsweekly_20260804) with plain HTTP calls. No SDK, no manual file handling. 

--- 

Flaky tests slowing down dev? [Meticulous](https://www.meticulous.ai/?utm_source=jsweekly&utm_medium=newsletter&utm_campaign=26q3&utm_content=classified) gives engineers confidence to ship faster by autonomously testing every edge case of your web app. 

--- 

⚡ [Zuplo](https://zuplo.link/vuib4cV) puts every API, AI, and MCP request behind one gateway. Route traffic, guard your MCP servers, and cap your AI costs. [Try it free](https://zuplo.link/vuib4cV).    

📢 Elsewhere in the ecosystem  

- Did you know JavaScript supports a third type of comment (beyond `//` and `/* */`)? [▶️ Mat Marquis shows off hashbang comments](https://www.youtube.com/watch?v=o98XmRVjxWs) in a short YouTube video. And yes, [they're in the language spec!](https://tc39.es/ecma262/multipage/ecmascript-language-lexical-grammar.html#sec-hashbang)
- 🤖 GitHub's Sean Goedecke says [LLMs reward expertise](https://www.seangoedecke.com/llms-reward-expertise/), with the most important prompting skill being expertise in the domain you're prompting for.
- Microsoft is previewing [a way to call native Windows APIs from Node](https://devblogs.microsoft.com/ifdef-windows/a-new-way-to-bring-native-windows-apis-to-javascript-introducing-dynamic-api-projections-for-node-js/) (and therefore Electron) _without_ native addons, via a new dynamic Windows Runtime API (WinRT) projection.
- Cloudflare _Workers_ has added [support for inbound TCP connections and gRPC](https://blog.cloudflare.com/grpc-workers/) _(in private beta)_.
- [Stacked pull requests are now in public preview](https://github.blog/changelog/2026-07-30-stacked-pull-requests-are-now-in-public-preview/) on GitHub.         

Published by [Cooperpress](https://cooperpress.com/) and edited by [Peter Cooper](https://twitter.com/cooperx86) 

'JavaScript' is a trademark of Oracle Corporation in the US
We are not endorsed by or affiliated with Oracle. 

[Change your email address](https://javascriptweekly.com/edit_subscription/*|UID|*) or [stop getting this newsletter](https://javascriptweekly.com/leave/*|UID|*). 

© Cooper Press Ltd · Fairfield Enterprise Centre, Louth, LN11 0LS, United Kingdom