fidzu : javascript

#​802 - September 15, 2026

Read on the Web

JavaScript Weekly

Functional Programming Jargon, Mapped and Explained - Currying, purity, functors, monads…? If FP terms ever go over your head, TC39 delegate Hemanth HM's popular jargon reference is now an explorable map of concepts showing how they relate, each with a simple definition and JavaScript example.

Hemanth HM

Stay Sharp in the Age of AI - Master.dev instructors build at Anthropic, OpenAI, Netflix, Google, and Stripe. Learn from them with hundreds of courses, live workshops, and expanded AI learning paths. New members get $100 off a yearly membership.

Master.dev sponsor

Modern Web Types: TypeScript Support for Newer Web APIs - TypeScript's DOM types only include APIs shipped in multiple browser engines, so things like element-scoped startViewTransition and fetchLater throw up errors. modern-web-types is a drop-in lib.dom replacement that adds missing interfaces/members shipped in any single browser engine.

Philip Walton (Google)

React 19.3 Released - A significant minor release making view transitions and Fragment Refs stable, adding Trusted Types support, and more. We covered it in more depth in last week's React Status.

The React Team

IN BRIEF:

• 🔒 Attackers are scanning for exposed Vite dev servers exploiting a server.fs.deny bypass (patched in Vite 7.3.2 and 8.0.5 earlier this year) to grab credentials from .env files. Vite listens on localhost by default, but double check your setup.

• Safari 27 shipped yesterday (alongside macOS/iOS 27), bringing the module loader rewrite we covered last week, so top-level await now works reliably in all major browsers.

• TC39 meets in Tokyo in two weeks. Here's the agenda with three iterator helper follow-ups (join, includes and chunking) all up for Stage 4, plus more.

• 🔒 Starting this Thursday, the OpenJS Foundation's CVE team is taking a break till October 6 due to burnout driven by a surge of AI-generated reports. Actively exploited issues will still get a response.

• 🔒 npm now places a temporary 72-hour 'security hold' on any account after a successful recovery-code sign-in.

RELEASES:

• pnpm 12.4 - The package manager can now manage Rust crates and Python packages alongside npm ones in a single workspace.

• Playwright 1.63 - Tests can now declare a named lock so those sharing a resource never run concurrently.

• Node.js v26.8.2 (Current) and v24.21.0 (LTS) - Both include a security release of Undici to fix numerous vulnerabilities.

• React Router 8.4, Vite 8.3, Moment.js 2.31.0 (security release).

📖 Articles and Videos

A Design Space Exploration of async/await - A simple async/await example produces different results in JavaScript, Rust, Python and Swift. Test your mental model with a quiz, then learn about the design choices behind the differences.

Gavin Gray

Native is Now the Future of Mobile at Shopify - Shopify is rewriting its React Native mobile apps in Swift/Kotlin. The main argument is coding agents have cut the cost of writing everything twice, while the upsides of native remain.

Mustafa Ali (Shopify)

Workshop: From an Error to the Logs That Explain It - Reading logs next to traces and errors, holding context across services, and cutting the noise.

Sentry sponsor

A Deep Dive into StyleX - A hands-on tour of Meta's StyleX, which turns JavaScript style objects into plain atomic CSS at build time, and why it can be a good fit for coding agents in particular.

Flavio Copes

📄 'Nobody Pays for Open Source: We Can Force Them To' - Laurie Voss ran npm for five years and thinks registries are an untapped lever for funding maintainers. Laurie Voss

📄 Anecdotally, Programmers Dislike reduce - map and filter sail through code review, but reduce draws complaints. Evan has a few theories why. Evan Hahn

🛠 Code & Tools

SnapDOM 3.0: Turn DOM Elements Into Images, Canvas and More - Zero-dependency html2canvas alternative with support for pseudo-elements and Shadow DOM. v3.0 adds 'incremental recapture' for faster repeat captures, automatic web font embedding, and fromString() for turning raw HTML markup into images.

Zumerlab

Your App Didn't Get Slower. Your Data Got Bigger - TimescaleDB extends Postgres so queries stay fast at scale, even as your data grows. Get $1000 credit to start.

Tiger Data (creators of TimescaleDB) sponsor

Fallow: Codebase Intelligence for TypeScript and JavaScript - A fast, zero-config Rust binary that finds dead code, duplication, circular dependencies and complexity hotspots in JS/TS projects. It's also pitched as a deterministic check for AI agent coding loops. GitHub repo.

Bart Waardenburg

🎨 category-colors: Generate 'Least Wrong' Color Palettes for Charts - Matt devised this algorithm for picking categorical chart colors in 2022 while design director at Stripe. It's now available as an npm package, and you can try it out on the Web here.

Matt Ström-Awn

• React DevTools 8.0 (Chrome Web Store) - The Suspense tab is now on by default, the Timeline profiler is gone (use your browser's Performance panel instead), and inspecting a DOM node now shows its matching React component.

• Zod 4.6 - Adds .validate(), a boolean check that skips building errors and is up to 35x faster than .safeParse().success on invalid input with compiled schemas.

• Javet 6.0 - Embed Node.js v26's runtime in the JVM for full interop with Java.

• parse-xml 5.0 - The fast, compliant XML parser goes ESM-only.

• 🕹️ n64js 1.0 - A Nintendo 64 emulator in pure JavaScript.

📢 Elsewhere in the ecosystem

• 🕹️ This year's js13kGames entries are in with a record 317 games squeezed into 13KB each. Frank Force's SP13KTRA racer and the Hornbound roguelike are good places to start, and you can dig around the public repos of every project too.

• Chris Coyier rounds up new and emerging HTML features worth knowing about, like the <geolocation> and <install> elements, as well as HTML-in-Canvas and improvements to <select> customization.

• The first Three.js Conference took place in Paris last week, and Codrops has a live-blog writeup of both days, including Mr.doob's talk. No recordings yet.

• Tailwind Labs, the team behind Tailwind CSS, is joining Shopify. Tailwind CSS is to remain maintained and open source - phew! 😅

#​801 - September 8, 2026

Read on the Web

JavaScript Weekly

How Turbopack Chunks Your JavaScript - Starting from the Network tab and working up, a look at chunking strategy and the tradeoffs bundlers make between fewer requests and less code (e.g. 8 chunks can weigh more than 355 do), backed by numbers from bundling the official Next.js site itself.

Sam Poder

Catch Runtime Bugs Before Your JS PR Merges - Greptile now runs your code to find bugs. T-Rex runs your PR branch in a sandbox, uses browser agents to click through your UI, and attaches screenshots and videos as evidence of the issue directly in the PR.

Greptile sponsor

Vitest 5.0 Focuses on Speed and Test Debugging - A major release for the Vite-native test runner, with a benchmark repo showing up to 53% faster runs on dependency-heavy apps. The new Trace View replays Browser Mode tests step by step, and vitest doctor recommends settings to make your suite run faster.

Vitest Team

How Safari Fixed Top-Level await - Safari's module loader was originally built on an abandoned spec proposal and adding top-level await caused years of "cannot access before initialization" errors. Safari 27 brings full spec compliance for it, but it took a ground-up rewrite and this post explains the complexity.

Kai Tamkun (WebKit)

IN BRIEF:

• 🎂 jQuery 1.0 is 20 years old. InfoQ looks back at how $() helped us dodge the browser wars and why many sites still use it. Ten years further back, Microsoft shipped JavaScript in Internet Explorer as JScript to dodge trademark issues.

• Two men have been arrested over the TeamPCP npm supply chain attacks. TeamPCP is suspected of cloning the Shai-Hulud worm, resulting in the 'Mini Shai-Hulud' waves.

• VoidZero's latest update celebrates Vitest passing 100m weekly downloads, React Compiler support reaching Vite, and the latest on Rolldown, Vite+ and ViteConf (taking place online this October 15th).

RELEASES:

• deck.gl 9.4 - The GPU-powered data visualization library extends its experimental WebGPU support in what's expected to be the final v9 release.

• Bun 1.4.1 and 1.4.2 - Big idle memory usage drops, smaller bun build bundles, Bun.serve speaks HTTP/2 on the same port as HTTP/1.1, and more.

• NVM for Windows 2.0 - A Node version manager for Windows. No longer needs admin privileges in v2.

• Astro 7.3, ESLint 10.10.0, Storybook 10.6, Vuetify 4.2

📖 Articles and Videos

▶ The Story of VS Code - An official movie-length documentary on Visual Studio Code's journey from a Swiss skunkworks to now. Its founding engineers cover the decisions made in areas like Electron, LSP, and the extension API, plus candid talk about the various forks now springing up.

Microsoft and Stefan Kingham

😅 We also learn that at the 2015 launch they drank a beer per 100 Hacker News upvotes… and had to stop at 1,400 (votes, not beers!)

Half Past Fetch: What await fetch() Waits For - Did you know await fetch(url) waits for the headers, not the full body? Gabor digs into some surprising consequences of that for connections, clone(), aborts, and timeouts.

Gábor Koós

Your AI Writes Tests That Pass but Prove Nothing. Fix It - Wallaby CLI makes test generation 10x smarter with live coverage and runtime data, using 3x fewer tokens. One skill to install.

Wallaby Team sponsor

10 Anti-'Slop' Moves for Frontend Projects - A walkthrough of automated checks that cut how much code you have to review, covering OpenAPI codegen, layer boundaries, mutation testing, and using CI to make it all stick.

Yuri Mikhin (Evil Martians)

The Browser's Main Thread is Expensive - A thorough look, complete with demos, at spending your main thread time well, including splitting, batching, prioritizing, and deferring tasks, then getting work off it entirely.

Lee Sun-Hyoup

📄 Why I Ported Moonshine to JavaScript - Pete's low-latency speech to text runtime now runs in the browser to avoid round trips to a server. Pete Warden

📺 How Can Someone Actually Change JavaScript? - A 2-minute explainer from a TC39 delegate. Mikhail Barash

🛠 Code & Tools

Dropzone.js 6.x: The Drag and Drop Uploader Returns - A major update for the library that handles the browser side of drag and drop uploading. After a 5 year(!) beta, v6.0, 6.1, and 6.2 landed over two days, bringing no dependencies, smaller bundles, and fixes for chunked uploads that could corrupt files.

Mat Simon

Rslib 1.0: A Build Tool for Shipping JavaScript Libraries - From the Rspack team, a unified build pipeline that handles the irritating parts of publishing packages, like getting ESM and CJS working side by side, Module Federation output, and component CSS across React, Vue, Svelte and Solid.

Chenwei Dai, Elecmonkey, et al.

Balance build time with your time - Our technologists do meaningful work, and we give them the support to have a meaningful life, too.

Fidelity Careers sponsor

vgpu: Render WebGPU Shaders in the Browser or Node.js - Provides a way to use the same shader in the browser or render headlessly with Node (to a high-resolution PNG or MP4 video). WGSL modules import and export like TypeScript does.

Vercel

SimpleWebAuthn 14.0: Now with Post-Quantum Passkeys - The passkeys library now verifies post-quantum ML-DSA passkeys and, on Node 24.7 and up, prefers ML-DSA-44 at registration by default.

Matthew Miller

• ESLint Config Inspector 3.4 - Adds timing analysis making it easier to identify the rules slowing down your lint runs.

• GPUIX 0.7 - Build native GPU-accelerated desktop apps with React and TypeScript atop the framework used by Zed.

• memlab 2.0.5 - Meta's framework for finding memory leaks in both browser and Node.js JavaScript apps.

• 🎵 Astro LilyPond - Build-time rendering of text to musical notation for Astro.

• 📊 vue-echarts 8.3 - Vue.js component for Apache ECharts.

📢 Elsewhere in the ecosystem

• ✨ GitHub has a new privacy-safe star history API, so charting a repo's growth over time no longer means scraping or approximating it. Star-History shares a little more background and you can use it to chart projects' star counts, as above (for example).

• Robin Wieruch argues that, due to the advent of agentic coding, building things from primitives rather than high-level libraries makes more sense, using D3 vs Recharts as an example.

• You don't need initial-scale=1.0 in your viewport meta tag, claims Declan Chidlow, as it worked around quirks in old versions of iOS.

• Got a browser-compatibility pain point? Submit it as an Interop 2027 idea (by September 23).

• 👕 TIL you can buy official Vue.js merch!

#​800 - September 1, 2026

Read on the Web

Issue 800! I'm not doing anything to celebrate, but I know many of you have been here for years, so thanks for your continued support. Maybe I'll do something for issue 1000, though at current velocity that'll be late 2030... ;-)
__
Your editor, Peter Cooper

JavaScript Weekly

The Depths of JavaScript: Minesweeper in 247 Bytes - An analysis of a playable 8x8 Minesweeper implementation in one line of JavaScript, complete with flags and cascading blank cells. The author's 658-byte version is impressive enough, but this post covers the tricks to make it 62% smaller than that!

yui and DNEK

Stop Reviewing PRs in the Order They Arrived. Review in the Order That Matters - CodeRabbit Triage is a reviewer-first prioritization layer for the PR queue: a self-updating, cross-repository inbox that tells you which pull request to review next, how deeply to review it and which ones may be safe to close.

CodeRabbit sponsor

Remix 3 RC: A Full-Stack Framework with No React Required - Remix's big rewrite from its previous life as a React framework into an independent full-stack framework is largely done. This post makes a good pitch, but even better is the all-new homepage explaining how Remix offers everything you need to build a modern webapp in 'a single package'.

Brooks Lybrand

💡 The final release is due on October 2 but it's more than ready to start working with.

pnpm 12: Rewritten in Rust, Same Commands and Lockfile - The Rust rewrite is stable, and nearly all of v11's commands, flags and lockfile format carry over with only a handful of changes. npm's latest tag still points to pnpm 11, though, so you'd need pnpm self-update next-12 to upgrade.

Zoltan Kochan

IN BRIEF:

• TypeScript has landed support for import-attribute-aware ambient modules. Declarations such as declare module "*" with { type: "css" } can now match imports carrying that attribute.

• Dani Sandoval rounds up what's new in the Svelte world this month including Svelte 5.57's new SvelteMap methods, SvelteKit 3 reaching RC, and an ai-tools add-on for the sv CLI.

• Sarah Rainsberger rounds up what's new in Astro this month too, including Matthew Phillips taking over as 'Project Steward', and a new Astro Playground.

RELEASES:

• ⭐ Rspack 2.2, Rsbuild 2.2, and Rslint 0.9 - Faster builds and HMR, shorter module IDs, and Node.js chunk splitting on by default in Rsbuild. Notably, Rslint now implements all rules and presets from @typescript-eslint.

• Cypress 16, NestJS 12, Vue 3.6 RC6, Deno 2.9.6, Mocha 12.0, Electron 44 (mentioned last week but there's now an official post).

• Node.js v26.8.0 (Current) and Node.js v24.20.0 (LTS)

📖 Articles and Videos

The Browser's New Email Verification API - A look at a WICG proposal to get rid of the 'go and check your inbox' headache with the browser and email provider using a token the server verifies on submit. Chrome origin trial and Gmail only for now.

Phil Nash

Lovable's Migration from Next.js to TanStack Start - How Lovable migrated a ~850K LOC app from Next.js to TanStack Start while running both in parallel behind a proxy, with a shared folder of code between them.

Alexander Lebedev (Lovable)

What We Learned Building a Data Grid in React, Vue, and Svelte - SVAR ships the same data grid for React, Vue and Svelte, and says the most crucial, performance-impacting elements remain the same whatever the framework.

Maksim Kozhukh (SVAR)

📄 The Problem with Concurrent Linter Fixes - Applying several autofixes at once can produce broken code that a "fix-then-reanalyze" loop wouldn't. Jeroen Engels

📄 Bumping the Major Version of Your JavaScript Library is User Hostile James Healy

🛠 Code & Tools

Uppy 6.0: A Modular JavaScript File Uploader - Resumable uploads from disk, Dropbox or GDrive, with wrappers for React, Vue, Svelte & Angular. This version focuses on clean-up, with a rewritten S3 plugin and fewer packages to manage.

Transloadit

Zod 4.5: Faster Parsing, 9x Less Memory Per Schema - A big performance release for the popular TypeScript-first schema validation library. In a deep dive, Colin explains how method memoization helped cut a bare z.string() from using 7.5KB of heap to just 784 bytes.

Colin McDonnell

Know JavaScript? You're Ready to Ship a Mobile App - Your React skills already ship mobile apps. Expo does the builds, store submission, and updates. No Xcode.

Expo sponsor

htmx 4.0: The Anti-SPA Library's First Major Release in Two Years - The library that swaps HTML fragments into pages using nothing but attributes moves from XMLHttpRequest to the Fetch API. Attribute inheritance is now opt-in, events have been standardized/renamed, and morphing swaps and <hx-partial> are new features. There's a full what's new in htmx 4 guide too.

Carson Gross

💡 If you're new to htmx, this page of patterns for common use cases provides a great hands-on introduction.

Svelte Bits: Animated UI Components for Svelte - A Svelte port of React Bits (by the same creator), the popular suite of animation components for React.

David Haz

• 🗓️ Schedule-X 4.7 - Large, schedule-style calendar control for React, Vue, Angular, Svelte and Preact apps.

• Mantine 9.6 - Popular, extensive React component suite. Adds a new media 'lightbox' component and more.

• 🖼️ Cropper.js 2.2 - A mature image cropping control with a playground where you can give it a spin.

• noble-curves 2.4 - Audited, minimal JS implementation of elliptic curve cryptography.

📢 Elsewhere in the ecosystem

• 🤖 Addy Osmani says mastery still comes from 'doing the reps', and that agents finishing tasks for you means building expertise has to be a more deliberate act.

• ∑ Lean, a language for writing machine-checked mathematical proofs, has a verifier that's "just" a type checker, so here's the concept demonstrated in TypeScript instead!

• 🚫 Google has removed all remaining Manifest V2 extensions from the Chrome Web Store… uBlock Origin included.

• AWS Lambda has introduced a new Node.js 26 runtime in preview.

• A detailed look at many of the things that should go in a modern HTML boilerplate.