JavaScript Weekly

What Claude spends building with 12 JavaScript stacks

Tue, 3 Nov 2026 00:00:00 +0000

#809 — November 3, 2026

JavaScript Weekly

The AI Cost of JavaScript Frameworks

Nolan Lawson had Claude build the same app five times in each of twelve JS stacks to test common "X is better for agents" claims. Costs varied significantly between runs, and Gautam Parab found that the observed cost ranges overlapped or touched for most pairs of frameworks.

But a clearer difference was in the median amount of JavaScript sent to browsers: 0KB for Astro, 18K for Hono+htmx, 36K for SvelteKit, and 115–142K for React Router, TanStack Start and Next.js. If you've gone "hands-free", Nolan asks, why stick to a particular stack you chose when you wrote all the code? His benchmark is on GitHub to try for yourself.

Nolan Lawson

Run AI Coding Models on Your Own Machine — Local models are now good enough for everyday coding. Learn to run them on your own Mac or GPU, wire them into your editor and terminal agents, and keep your code private with no per-token bill.

Master.dev sponsor

Why Is This Fingerprinting Script 'Creating Bioweapons'? — A crawl of sites to collect canvas fingerprinting examples (which you can see, visually, at fingerprint.garden) found an anti-analysis technique where JavaScript identifiers were named after… taboo topics, with a prompt hidden in invisible Unicode, all designed to make LLMs refuse to work on the code!

Veritas

💡 Canvas fingerprinting is a technique that uses quirks of how different clients render canvas elements, in order to distinguish browser environments.

IN BRIEF:

😄 Bartosz shares a creative way to generate strings and run code without parentheses or quotes. Good old JavaScript fun!
📊 GitHub's Octoverse 2026 report has TypeScript as the most used language on GitHub by contributors (with JS at third), and ~44% of merged TypeScript PRs showing AI involvement. Plus a lot more besides.
GitHub Actions will block pull_request_target by default in public repos from December 2, unless an event policy explicitly allows it, with brownouts on November 9 & 16.
Cloudflare Workers now supports the Temporal API natively behind a temporal compatibility flag. It'll be available by default from December 1.

RELEASES:

Node.js v27.0 (Alpha) and v26.13.0 (LTS) – Node 26 is now the 'Lithium' LTS line, and 27 is the first ever Node 'alpha'. Under Node's new release process, every line spends six months in alpha before going Current.
Vitest 5.1 – A new --since-last-run flag reruns only tests affected by your edits, plus there's an interactive snapshot review feature.
Rspack 2.3 – The Rust-based webpack alternative adopts SWC Next and its rewritten parser. The team reports 5-20% faster builds and less peak memory use.
Leaflet 2.0 Beta 1 – The mapping library's first major in a decade goes tree-shakeable, ships TypeScript types, and drops its default export.
Effect 4.1, pnpm 12.17, ESLint 10.14.0, Nuxt DevTools v4

📖 Articles and Videos

"No, npm, 'estee' is not a typo of 'testem'" — Shane tried to publish a CLI called estee and hit npm's typosquatting filter, which (as best as we can tell) rejects names within a small Levenshtein distance of popular packages' names.

Shane Friedman

Shrinking clarity.js: When Cleaner Code Gzips Worse — Microsoft let an agent run 50+ size experiments on its analytics script. A big win came from dropping import * namespace objects, while good-practice refactors like extracting helpers actually made the gzipped output bigger.

Manu Nair (Microsoft)

Workshop: How to Implement Session Replay — Filters, custom tags, and sampling settings for finding the sessions that matter. Nov 5, 10am PT.

Sentry sponsor

'Nothing Installs at Our Company Until It's a Week Old' — Many recent package hijacks were caught within hours, so Bruno's company now makes new releases wait a week. He explains what this approach broke, what cooldowns don't stop, and settings for popular package managers.

Bruno Jurković

Timing Ten Design Systems, Then Fixing the Slow Ones — Den timed ten design systems (MUI, Ant Design, and Ionic among them) opening a 249-option select and ticking 100 checkboxes, then profiled the slow ones to find out why.

Den Odell

Using Bun? Dependabot Can't See Most of Your Dependencies — GitHub's dependency graph doesn't parse bun.lock, so Dependabot alerts cover only direct dependencies. Nicolas has some tips for improving matters.

Nicolas Charpentier (Shortcut)

📄 How Hard Is It to Check for Whitespace? – Why Java, Python and JavaScript disagree on what counts as whitespace. Sergey Tselovalnikov

📄 A Proposal: How to Hire Junior Engineers in the Age of AI – The npm co-founder thinks traditional coding interviews are dead. Laurie Voss

📄 How to Make postMessage Type-Safe in Under 350 Bytes Pavel Grinchenko (Evil Martians)

📄 The Web Can't Afford a JavaScript Runtime Monoculture Kate Holterhoff (RedMonk)

🛠 Code & Tools

Handwired: Compile Regular JavaScript into a Neural Net — A new mind-bender from Pretext's creator: a compiler that turns JavaScript into an exact network of ReLUs and matrix multiplies that run on the GPU. Demos include a 130-layer 'mini desktop' and a WebGPU search over 100K JSON documents.

Cheng Lou

Build Smarter JavaScript Applications With Live Search Data — Add search, shopping, maps, news, trends, flights and hotels results with a single developer-friendly JavaScript SDK.

SerpApi sponsor

🌐 x18n: Lint and Maintain i18n Files for Any Framework — Anthony Fu's successor to i18n-ally scans locale files and translation calls and reports missing, unused and broken keys (like how tsc --noEmit reports type errors).

Anthony Fu

djs: A New 'Suspend Anywhere' JavaScript Engine — Armin (of Flask fame) built an engine to run scripts in WebAssembly that can snapshot the VM's state and resume elsewhere, even mid-await.

Armin Ronacher

webframe: Run a Web Page Like a Command-Line Program — Point it at a URL or HTML file and it runs the page in a hidden system web view, piping console.log() to stdout and exceptions to stderr. No bundled browser or Playwright needed.

Jeff Lindsay

phoria2: A Small WebGL 2 Library for 3D Charts — A dependency-free 3D library aimed at dashboards and product viewers, with an API you can 'learn in an afternoon'. Plenty of live demos on the page.

Kevin Roast

Shiki 4.6 – Powerful code syntax highlighter, now with faster decoration handling and compressed Oniguruma WASM binary.
Preact 11.1 – A new preact/compat/compiler-runtime entry point lets code compiled by React Compiler run on Preact too.
Postgres.js 4.0 – The popular Postgres client for Node, Bun and Cloudflare Workers gets a rewrite and goes ESM-only.

📰 Classifieds

💸 Every OTP you send costs money. Fraudsters trigger them by the thousands. Fingerprint recognizes the device before you text. Learn how.

Your coding agent can write the app. Expo is the agentic mobile infrastructure that takes it from a repo to the App Store.

CodeAF fixed 2x OpenCode's issues and nearly 4x Claude Code's on the same open model, at up to 4.8x less per fix. Open source, Apache 2.0.

📢 Elsewhere in the ecosystem

Chrome 157 is due today with the headline feature being HTML-in-Canvas for drawing live, interactive DOM elements into 2D, WebGL and WebGPU canvases. This feature has numerous striking applications.
☕ CheerpJ 5.0 brings Java 21 and 25 to the browser via WebAssembly, ships the full JDK so you can compile Java in a tab, and previews a new WasmGC-based engine the team hopes will run Minecraft and IntelliJ one day.
🤖 LLM-whisperer Simon Willison looks at the world of browser games being built with coding agents, and argues October was the point where agents got good enough to ship playable games.
🕹️ Talking of games… GitHub's game jam Game Off is back for its 14th year with the theme 'SHIFT'. Entries are due on itch.io by December 1.

Rebuilding the original GTA engine in JavaScript

Tue, 27 Oct 2026 00:00:00 +0000

#808 — October 27, 2026

Read on the Web

JavaScript Weekly

TanStack AI 1.0: The Vendor-Neutral AI Toolkit Goes Stable — TanStack's framework-agnostic AI toolkit reaches 1.0, with stable APIs for chat, tools and media, plus 23 provider adapters. A new agent harness supports long-running sessions, but its APIs remain experimental.

Tuzlak, Herrington, et al. (TanStack)

Would You Let Your AI Agent Grade Its Own Homework? — Agents write code faster than ever. They even review their own work. But who’s reviewing them? Dropbox, Notion & ElevenLabs don’t take the risk. With Meticulous, every change is exhaustively verified, with zero developer effort.

Meticulous sponsor

Announcing TypeScript 7.1 Beta — TypeScript 7 gets a programmatic API, plus 'content mappers', a plugin point for checking code embedded in files such as Vue, Svelte, and Astro components. Also new are source phase imports and --target es2026.

Daniel Rosenwasser (Microsoft)

GTA.js: 1997's Grand Theft Auto, But in JavaScript — Bramus has been reimplementing the original top-down GTA's engine in JavaScript and WebGL, loading Liberty City from the game's original demo files. Play it here.

Bramus Van Damme

💡 Fittingly, Pat Kerr, whose 1996 Atari ST prototype formed the basis of the original game's vehicle physics, recently rebuilt it in JavaScript.

IN BRIEF:

Deno's Bartek Iwańczuk says the team is working on getting Deno into a foundation. Meanwhile, a new fork, Ende, plans to drop Node compatibility and refocus on sandboxing.
Safari 27.1 previews the Device Posture and Viewport Segments APIs behind feature flags on the iPhone Duo, letting JavaScript detect folds and inspect screen segments.
Chrome 156 has reached stable and no longer caches module fetch failures, so a dynamic import() that fails due to a network or HTTP error can be retried.

RELEASES:

Node.js v26.12.1 (Current), v24.22.1 (LTS) and v22.23.4 – Security releases fixing ten CVEs, including the 'Node2Shell' Brotli decoder flaw, which can lead to remote code execution when an app decompresses malicious data. (Also, Node 26 is due to become LTS tomorrow.)
Bun 1.4.4 – Adds bun fmt, a Prettier-compatible formatter that uses your existing Prettier or oxfmt config. It's very fast.
Electron 45 – Upgrades to Chromium 156, Node 24.22 and V8 15.6, and adds hooks for the Prompt API so apps can plug in a local model.
pnpm 12.16, Remix 3.1, axios 1.21, Deno 2.9.8

📖 Articles and Videos

Parser Combinators in TypeScript, Built From Scratch — Parser combinators sit between regexes and heavyweight tools like tree-sitter. This animated, step-by-step walkthrough shows the basic elements of building them, concluding in an example turning ping output into typed objects.

Florian Schindler

Dead Code Shouldn't Exist: How Sentry Cut 28,000 Lines — A talk Dominik has given at six conferences this year, now as swipeable slides with a full transcript. He covers how unused code can cost more than you might think, and how Sentry used Knip to remove 28,000 lines.

Dominik Dorfmeister (Sentry)

AI.js Day 2026: Frontend's Scariest AI Questions, Live on Channel 13, Nov 13 — No hype, just the AI questions frontend devs are afraid to ask. Save your spot.

JetBrains sponsor

Building an Isolated Preview for AI-Generated HTML — Rendering model-written HTML in a srcdoc iframe runs it on your own origin. A security engineer breaks the naive approach, then rebuilds it using sandbox and a strict CSP, with demos showing what each one blocks.

Keshav Malik

A First Look at TypeScript 7.1's Content Mappers — TypeScript 7 ignores tsserver plugins, but 7.1's content mappers can turn non-TS files into TypeScript. Here's how they work, applied to CSS modules and .graphql files.

Jovi De Croock

📄 How Engines Turn Dynamic Objects Into Fast Field Access – Shapes and inline caches, explained with runnable sketches. Max Bernstein

📄 Software is Slow Because of Bad Design, Not Slow Languages Sean Goedecke (GitHub)

🛠 Code & Tools

Structs: TC39's Shared Structs Proposal, But Usable Today — A former TC39 delegate's implementation of the Stage 2 structs proposal. The idea is you get shared memory between workers, so threads can work on the same objects instead of serializing copies back and forth. There's a playground too.

Erik Arvidsson

Introducing TanStack Redact: A Slimmer React Runtime — A build plugin swaps React and React DOM for a smaller reimplementation in the browser with no code changes. It works with Vite, Start, Vinext and Next.js, and while TanStack reports 20-70% smaller client builds, rendering is synchronous only.

Tanner Linsley (TanStack)

AI Tests That Catch Real Bugs — AI can write low-value tests that pass without checking much. Wallaby helps your agent refine assertions and catch bugs.

Wallaby Team sponsor

Verdaccio 7.0: The Self-Hosted npm Registry Adds Staged Publishing and 2FA — A mature, lightweight way to self-host your own npm registry and proxy. v7 adds experimental staged publishing (where new versions need approval before going live) and 2FA, plus stricter ownership checks.

Verdaccio Team

Biome 2.6 Adds Markdown, YAML and SCSS Support — The Rust-powered alternative to Prettier and ESLint adds formatting support for Markdown, YAML and SCSS, along with initial linting support. JavaScript plugins for custom lint rules are available as a developer preview.

Biome Core Team

☕ CoffeeScript 2.7.1 – The first release in four and a half years brings Node 22+ fixes and with { type: 'json' } import attributes.

💡 If you never used CoffeeScript, it is/was a Ruby- and Python-flavored language that compiled to JavaScript. Brendan Eich held up its arrow functions and lightweight classes as models for what went into ES6 (ES2015).

oxlint 1.89 – The Rust-based linter now counts the upstream recommended rules of its React, Vue, Next.js, Jest/Vitest, and other plugins as 'recommended' so expect more reports if you upgrade.
Mutative 2.0 – Immer-style efficient immutable updates library. The author reports a 3.6x speedup over Immer across a benchmark suite.
SonicJS 3.0 – Headless CMS for Cloudflare Workers, built on Hono. v3 rebuilds the data layer, auth and plugin system. Homepage.
query-string 10.0 – Parse and stringify URL query strings. Now throws for values it can't represent.
ShareDB 7.0 – Realtime database backend based on operational transformation.

📰 Classifieds

📱 Expo is mobile AI infrastructure. Your agent writes the code, and Expo gets your iOS and Android app built and into the stores. Try it.

🧩 CAPTCHAs can frustrate real users and cost you conversions. Try Fingerprint’s bot detection for free and stop abuse without the friction.

📢 Elsewhere in the ecosystem

🔒 Node2Shell: ELLIO now reports exploit traffic in the wild for the Brotli RCE fixed in the Node releases (as mentioned earlier). The flaw is in Google's Brotli library, so bundled copies elsewhere need patching too.
Sentry has given $1m to open source maintainers this year. JavaScript recipients include pnpm, TanStack, MSW, Knip and three Three.js maintainers, plus the OpenJS Foundation.
🎉 CSS-Tricks, the popular web dev resource, is independent again, now owned by longtime editor Geoff Graham.
Arc, the design-led Chromium browser popular with developers, is being sunset with The Browser Company steering everyone to Dia.
📄 Google Docs can now open, edit and collaborate on Markdown files natively and Drive renders previews of them too.

The up to 8x faster Rust port of TypeScript

Tue, 20 Oct 2026 00:00:00 +0000

#807 — October 20, 2026

Read on the Web

JavaScript Weekly

tsrs: Cloudflare and VoidZero's Rust Port of TypeScript — A Rust port of the Go-based TypeScript 7 compiler, built with some input from the TypeScript team and heading into Oxc. Benchmarks claim up to 8x the speed of TypeScript 7.0 and it runs in WebAssembly. Experimental, but npx tsrs works.

Chen, Mitropoulos and Nakazawa (Cloudflare / VoidZero)

💡 Max Schwenk started the port with agents writing the code, and tells the full tale here, including how it took his company's typecheck from 80 seconds to 7.

Send Webhooks from Your TypeScript API in Minutes — One typed npm package, one call per event. Svix handles retries, signing, delivery logs, and a portal for your customers, so you don't build any of it. Resend sends 200M+ webhooks a year through it.

Svix sponsor

Thank You, Deno: Competition Keeps JavaScript Moving — Last week we covered Deno joining Cloudflare and the future of the Deno runtime. Deno was valuable, says Darcy, as it (and Bun) made the entire ecosystem better by pushing Node and npm to adopt its best ideas.

Darcy Clarke (vlt)

IN BRIEF:

🔒 Next.js has patched two critical RCE flaws: one in use cache functions via an upstream React Server Components bug and one in the image optimizer's SVG handling. Upgrade to 16.4.1 or 15.5.28; a public PoC is already out.
🔒 Node.js security releases are due tomorrow for the 26.x, 24.x and 22.x lines, with the highest severity issue rated high.
Bun compiling JavaScript ahead-of-time, previewed a few weeks ago, now has a draft PR to produce binaries with no JIT or bytecode.

RELEASES:

Node.js v26.12.0 (Current) and v24.22.0 (LTS) – 26.12 can now synchronously load most ES modules and marks the config file stable; 24.22 gains util.throttle and util.debounce.
Astro 7.4 – Adds a --timings flag for astro build to see where build time is spent, plus experimental parallel prerendering across worker threads.
React Router 8.5 – Deprecates its own view transition APIs in favor of React's <ViewTransition> component, and adds an experimental 'API-only' mode.
Pretext 1.0 – Multiline text layout without touching the DOM. 1.0 ports browsers' own line breakers, so results more closely match what would render.
React Native 0.88, Elysia 2.0 RC, ESLint 10.13, tsup 9.0, Vuetify 4.3

📖 Articles and Videos

The Tetris Script That Becomes Snake Once Prettified? — You'd think pretty-printers and deobfuscators at least leave a script's logic alone, but no. See how chaining semantic quirks in such tools can turn the 'cleaned up' output into a different program!

Robert Vähhi (TrustSig)

Do Web Components Have a Future If Nobody is Writing Them? — Nolan has spent years building and defending web components, so this thoughtful, if a little melancholy, piece carries some weight.

Nolan Lawson

Your CI Was Built for Humans. Your Agents Need Something Else — Expo is mobile AI infrastructure. Your agents build, test and ship iOS and Android apps in the background.

Expo sponsor

▶ ViteConf 2026: The Full Replay — Last week's ViteConf brought ~30 talks including Evan You's keynote on tooling in the agentic era, plus updates on Vitest 5, Vite DevTools, and a faster parser coming to Oxc. It's 10 hours, but there's a hero with timestamps in the comments.

ViteConf

💡 One of the bigger announcements: Void, the Vite team's full-stack SDK and deploy platform, is now open source.

How to Gaslight JavaScript Programmers (with Proxies) — Proxy, introduced as part of ES6 back in the day, has plenty of practical uses but can also make objects behave in curious, unexpected ways. Complete with live, editable examples.

Bryan Gillespie

How Miro Moved 70,000 Tests from Jest to Vitest — The story of moving ~70,000 tests across an 800-package monorepo to Vitest, with AI agents doing most of the laborious work.

Sergey Nikitin

📄 Upgrading to Zod 4 Cut Our Worker CPU by a Third – A Zod 3 to 4.5 migration at 100 million parses a day. Chris Arderne

📄 Using replace() as an Iterator – An old regex-callback-for-side-effects idiom, benchmarked against alternatives. Eugene Lazutkin

📄 Recursion is DEAD and HTML Killed It – Hands-on with Chromium's experimental Declarative Partial Updates proposal. Dave Rupert

📺 NightMonkey: Compiling JavaScript Ahead of Time to WebAssembly – An hour-long VMIL 2026 talk from a Wasmtime engineer. Chris Fallin

🛠 Code & Tools

Maplair: A Batteries-Included, Tree-Shakeable Fork of Leaflet — Still in alpha since last year, one of Leaflet's contributors has forked it, rolling in the 2.0 work plus rotation, fullscreen, search, heatmaps and more – all tree-shakeable.

Simon Legner

💡 The same day, Leaflet's creator posted a candid update about his experiences living in Ukraine and a plan to get Leaflet 2.0 released.

Embeddable DOCX, XLSX & PPTX Editor for Users and AI — Let your AI edit existing files via object-level APIs. Users review and keep editing the same file. Try Playground.

Thinkfree sponsor

📊 Chartist 2.0: The Lightweight SVG Charting Library Returns — A CSS-styled SVG charting library from 2014 that "went stale over the last years" makes a comeback with a composable API, server-side rendering to SVG, terminal charts, and still ~12KB gzipped for a line chart. There's a migration guide for 1.x users.

Gion Kunz et al.

Pele: Mermaid Diagrams as Lightweight, Themeable SVG — Zero-dependency renderer for the Mermaid diagram syntax with responsive layouts and SVG you can theme with CSS variables. Around a sixth the size of Mermaid.js. Try the playground.

Steph Ango (Obsidian)

<rich-input>: A Rich Input Field with GitHub-Style Search Filters — A web component for GitHub-style search boxes: free text mixed with autocompleted key:value filters, highlighted in place.

Bramus Van Damme

Chokidar 6.0 – The file watcher behind much of JS tooling. Rewritten to check changes against the disk before reporting to avoid stray events after a burst of edits, say.
Happy DOM 21.0 – Headless browser environment in pure JavaScript, popular for testing. Now blocks stylesheet and iframe loading by default.
p-queue 10.0 – Promise queue with concurrency control. Now dependency-free and an EventTarget.
Paper.js 0.13 and 0.14 – Vector graphics scripting framework for canvas. First notable releases in years. (Homepage with demos.)
🕹️ LittleJS 1.27 – Dependency-free HTML5 game engine that now does 3D too.
🖼️ Skia Canvas 4.0 – Canvas API for Node, built on Skia.

📰 Classifieds

🕵️ Muse doesn’t announce itself. Meta’s AI agent browses like a real user. See how Fingerprint detects it by name and try free for yourself.

🎬 Your app needs video, not a video team. Upload any format to Hyperserve's API, get back MP4 on a global CDN. Ship video in an afternoon.

📢 Elsewhere in the ecosystem

🖼️ JPEG XL: The modern image format is now supported by all major browsers, with Firefox 158 the latest to enable it by default. Jake Archibald pits it against AVIF in this extensive review. What I find amazing is what it's able to render in under 100 bytes.
NodeConf EU 2026: The ▶️ latest NodeConf EU talks are up, including James Snell's case for a common minimum API every runtime should support, plus sessions on V8 heap management and Emscripten and WebAssembly.
A new social network: /dev/null is a GitHub-oriented social network for developers, built from scratch in 48 hours. It already has over 8000 members, including me. It's been a lot of fun so far!

Ryan Dahl: 'Why reimplement Node? It works.'

Tue, 13 Oct 2026 00:00:00 +0000

#806 — October 13, 2026

Read on the Web

JavaScript Weekly

Deno is Joining Cloudflare (But…) — Maybe David Bushell saw the writing on the wall, as the Deno team isn't joining Cloudflare to keep working on Deno, but to fold celld into workerd so Durable Objects can be self-hosted (more on that here). The Deno runtime will get a final year of official fixes, Deno Deploy closes in six months, and JSR moves to Cloudflare's infrastructure.

Ryan Dahl

💡 On Hacker News, Ryan Dahl noted that Deno "has been sucked into the gravity well of Node compatibility" before asking: "Why reimplement Node? It works." But what happens to the JavaScript™ trademark case, I wonder…?

CodeAF: #1 of Ten Coding Harnesses on DeepSWE — Ten coding harnesses ran the same open model on 113 real GitHub issues. CodeAF solved the most and paid the least per solved issue: 3.4x less than Claude Code, 4.8x less than OpenCode. A new open-source coding harness built for open models.

AgentField AI sponsor

Bun 1.4.3 Adds bun check, a Built-In TypeScript Type Checker — bun check is a port of TypeScript 7's checker that reads your tsconfig.json, reports the same errors as tsc and, Jarred claims, runs 3-6x faster. It plugs into bun run/test/build too. Idle server processes now use far less CPU, and a JavaScriptCore upgrade picks up numerous perf gains.

Jarred Sumner

IN BRIEF:

AWS has launched Lambda Web Functions, which run an ordinary port-listening Node server (Express, Hono, Fastify, etc.) on Lambda with no handler rewrite, billing for active CPU time and separately for memory.
📊 The 2026 Stack Overflow Developer Survey results are out (30,903 people took part) with JavaScript the #1 language for the 12th year in a row (and TypeScript at #6).
🔒 Despite this week's fresh stir, no malicious Zod release reached npm. Malicious commits pushed to its repo in September were reverted the same day, as Colin McDonnell explains.
🔒 An out-of-band Next.js security release is due tomorrow.

RELEASES:

Last second addition: TanStack Start 1.0 has just dropped. Big news for full-stack React and Solid fans! :-)
🎉 Partytown 1.0 – A popular way to relocate third-party scripts to run in a Web Worker rather than on the main thread has left beta after five years in development.
Marionette 5.0 – Six years on, the Backbone-era framework returns with a core free of Backbone, jQuery and Underscore… and they explain why!
Bootstrap 6 Alpha – An early look at Bootstrap's first major release since 2021, leaning on modern CSS and making its JavaScript plugins ESM-only.
Express 5.3.0 – A maintenance release worth upgrading to, as patched qs, proxy-addr and body-parser dependencies close five CVEs.

📖 Articles and Videos

📊 WebSocket Servers in JavaScript: Node.js, Bun, and Deno — In 2023, Daniel found Bun much faster than Node at relaying WebSocket messages, but there was a bug in his Bun server. This new attempt uses a C client/relay as a baseline, and Node 26 now gets close to C latency, ahead of Bun and Deno.

Daniel Lemire

How Sindre Sorhus' Personal Site is Now Made in Swift — One of JavaScript's most prolific developers explains how he's dropped Astro and now builds his personal site with Swift, including the styling and markup, with broken links and style typos failing at compile time (source).

Sindre Sorhus

Too Many Agent Traces to Read? Find the Ones That Matter, Live Oct 14 — Bad answers, wrong tool calls, too many traces. See how Sentry engineers find the failures worth fixing. Register now.

Sentry sponsor

Tiny Apps with TinyJS — A quick look at a new way to make tiny JS-powered desktop apps we featured a few weeks ago.

Raymond Camden

📄 Yet Another Way to Invoke Functions Without Parentheses – There are many ways to invoke arbitrary functions in JavaScript without using parens, but this is a particularly obscure one! bartosz

📄 Six Months of Building with Remix 3 – What the post-React Remix (v3 was released earlier this month) is like to work with day to day. Sergio Xalambrí

📄 A Visual Notation for React's Parent and Owner Trees – With a playground that draws them from your code. Jules Blom

📄 How to Test an iframe's postMessage Handler Keshav Malik

🛠 Code & Tools

🤖 OpenCode 2.0: A Big Update for the Open Coding Agent — A full-featured agentic coding app, built on Bun, that's more akin to Claude Code than Pi, say. v2.0 overhauls it with background subagents, a 'code mode' to let models script MCP tool calls, and clients for vanilla JS and Effect code to drive it.

Anomaly / The OpenCode Team

💡 If you've not given OpenCode a try yet, you can get started here.

Tamagui 3: One React UI Codebase for Web and Native — A styling system and component kit for sharing UI between React web apps and React Native, with a compiler that keeps things fast on both. v3 adds Tailwind-style props and React Strict DOM support.

Nate Wienert

Mobile AI Infrastructure for Web Devs Who Code with Agents — Point the agent you use for the web at iOS and Android. Expo takes care of the native builds and the trip to the stores.

Expo sponsor

H3 v2: The UnJS HTTP Framework Rebuilt on Web Standards — The minimal HTTP framework behind Nitro and Nuxt's server layer is now stable in v2, a rewrite around standard Request and Response so the same app runs on Node, Bun, Deno, Workers, and even in the browser. Migration guide.

Pooya Parsa

Shaders: 190+ WebGPU Effect Components, Now Open Source — Ripples, glows, and dissolves into ASCII, composed as components rather than written as shader code, for React, Vue, Svelte, Solid, or plain JS. The engine, framework bindings, and the components themselves are now all MIT licensed.

Simon Le Marchant

💡 If you like this vibe, ascii.rest, which offers "236 animated ASCII pieces for web pages", is also worth a look.

Node.js v26.11.0 (Current) – Adds a --process-timeout flag to end a process after a set time, plus virtual table support in node:sqlite.
Hono 5.0 RC – The web-standards server framework goes ESM-only and moves its runtime adapters into separate packages.
🔒 Handlebars 4.7.10 – The templating library fixes two critical JavaScript injection flaws affecting releases back to 3.0.
he 2.0 – Robust HTML entity encoder/decoder. First release in eight years, now ESM with named exports.
React Aria 1.22 – Adds a new Sheet component.
pnpm 12.12

📰 Classifieds

⚡️Add lightning-fast 1D/2D barcode scanning to your web app with STRICH. On-device processing, free trial and demo!

Durable AI agents built with the AI SDK you already use. Long-lived LLM sessions that survive deploys, crashes & refreshes. Test out chat.agent on Trigger.dev.

🎬 Your app needs video, not a video team. Upload any format to Hyperserve's API, get back MP4 on a global CDN. Ship video in an afternoon.

📢 Elsewhere in the ecosystem

In Fingerprints are the New Cookies, Roy Fish demonstrates the various ways web pages can assign a unique(ish) identity to you using JavaScript.
🤖 Theo Browne set AI agents loose on porting the TypeScript 7 compiler to Rust, and ts-rust is the (very experimental) result.
📱 Following Shopify, Coinbase is moving its app off React Native, saying agents have made building each feature twice cheap enough to go fully native.
Fancy a retro robot voice in your web experience? Klattsch is a voice synthesizer you can use on the web or from Node.js as an npm package. Daiiisy, daiiisy…
Three years ago we mentioned Linus Groh's Zig-based Kiesel JavaScript engine. It passed 25% of test262 back then, but v0.4.0 has landed and it's now at 94.7% (not far behind V8) and supports modern language proposals like await dictionary and numerous iterator proposals.