fidzu : javascript

#​810 - November 10, 2026

Read on the Web

JavaScript Weekly

How X (Twitter) is Rebuilding Its Web App - X is replacing 3 servers with one app built on React, Vite and Fastify. Yagiz, famed for his performance work on Node, explains the streaming architecture behind it, along with some bottlenecks they had to fix, like how hundreds of tiny JavaScript files slowed startup.

Yagiz Nizipli (X Engineering Blog)

Why Standard Webhooks Hit 118m npm Downloads a Month - OpenAI, Anthropic, and Gemini all sign webhooks with Standard Webhooks, the open spec Svix started. That's one finding in the State of Webhooks 2027, where we scored 489 API companies on retries and signatures. Immediate download, no email required.

Svix sponsor

Parcel 3 Alpha: The Bundler Rewritten in Rust - A ground-up Rust rewrite of the popular bundler that the team reports is up to 100x faster than Parcel 2 at cold builds of React Spectrum. It runs as a standalone binary without Node, with support for native plugins written in Rust, Go or Swift, while JavaScript plugins run on an embedded QuickJS runtime.

The Parcel Team

IN BRIEF:

• 📊 The State of JavaScript 2026 survey is now open. Share the features, libraries and tools you use and like, and discover a few new ones along the way. We'll share the results once they're out.

• TypeScript 7's Go-powered compiler now has an experimental WebAssembly build which already powers an early TypeScript Playground v2.

• ESLint now officially lints shell scripts with the @eslint/shell plugin adding ShellCheck-like rules for Bash, sh and mksh.

RELEASES:

• Playwright 1.65 - The browser testing tool's test runner can now run under Bun, plus there's a new failures reporter.

• Storybook 11 Beta - The UI component workshop gets more agent-ready, with official skills, Claude/Codex plugins, headless CLI tools, and more.

• 🔒 Vite has disclosed a critical remote code execution flaw affecting dev servers exposed to the network via --host or server.host. Upgrade to 8.3.7, 8.2.5, 8.1.7, 7.3.8 or 6.4.6.

• 🔒 Next.js 16.4.5 and 15.5.29 fix seven security issues, including a high-severity cross-tenant cache disclosure.

• 🔒 Node.js security releases are due tomorrow (or shortly after) for the 26.x, 24.x and 22.x lines.

📖 Articles and Videos

Experiments with Multithreaded JavaScript - What would JavaScript look like if threads could share objects directly? Former TC39 delegate Erik Arvidsson explores three approaches: in a Porffor fork, as a TypeScript library with an ownership checker, and as an implementation of the TC39 structs proposal. Each has a playground to try.

Erik Arvidsson

The New JavaScript Features Between V8 14.6 and 15.6 - Node 27, released in alpha recently, is built on V8 15.6, and Joyee tours what that brings to developers, including Math.sumPrecise, new iterator methods, and some behavior changes in sorting, dates and promises, all with sample code.

Joyee Cheung

How to Build Your Own Automated Debugging Workflow - Connect your coding agent to Sentry and turn errors into fix PRs. See the guides and recipes in the resource hub.

Sentry sponsor

Spreading Liquid with three.js - A technical explanation of a 'liquid-spreading' effect originally built for a cosmetics site. The in-page demo is fun to play with and this could be handy if you want to create paint-like effects.

Misaki Nakano

Reviving Facebook's Abandoned JavaScript Optimizer - Prettier creator James Long put agents to work resurrecting Prepack, Facebook's attempt to make JavaScript faster by running it ahead of time. There's an experimental demo that shows off the gains on a sample React app.

James Long

Yavashark: Building a JavaScript Engine for 950 Days Straight - A solo developer's progress report on a Rust-based engine they're building that passes around 82% of test262 and can server-render a React app. There's a playground to try it for yourself.

Sharktheone

📄 A Fifth Object Shape Made the Same Loop Twice as Slow - V8's hidden classes and inline caches in action. Mohsen Fallahnejad

📺 ReactiveScript: Early Findings - A lengthy stream by Solid's creator on ReactiveScript, his experimental reactive UI language he first shared in 2021. Ryan Carniato

🛠 Code & Tools

EmbedPDF 3.0: A PDF Viewer for Any JavaScript App - An open-source PDF viewer for vanilla JavaScript, React, Vue, Svelte and Angular. The v3 rebuild offers a ready-made viewer, headless components for custom UIs, and a standalone PDF engine. Try the demo.

EmbedPDF

Embed an Office Editor Your App's AI Agent Can Use - DOCX/XLSX/PPTX editing in your app with your model and workflow. Agents make targeted edits, and users refine the file.

Thinkfree sponsor

chrome-capture: Record a Chrome Tab at 60-120fps to an MP4 File - It's been three years since we've linked to Paul Irish (once a frequent fixture in JavaScript Weekly!) but he's back with a neat, compact tool you can run with npx to record a Chrome tab at high quality including audio to an MP4 video.

Paul Irish

Text.js: React Apps That Render in the Browser Console - Really! A React 19 framework whose 'screen' is the DevTools console, with routing, keyboard input, layout primitives and ASCII fonts. Open the console on the homepage to try it, then bunx create-text-app if you're tempted. GitHub repo.

Anomaly

Jeasx 3.0: Server-Rendered JSX, Now Streaming - A minimal framework that uses JSX purely as a server-side templating language (with no React and no hydration) on top of Fastify and esbuild. v3 streams pages while async components are still loading and renders ~2x faster. Live examples.

Jeasx

• Rolldown 1.3 - The Rust-powered bundler adds experimental support for import attributes, but there are breaking changes to be aware of.

• jsdom 31.0 - The pure JS implementation of DOM/HTML standards adds a new CSS engine and switches to a Skia-backed canvas backend.

• Remix 3.2 - The full-stack framework adds nonce-based Content Security Policy middleware.

• Wiki.js 3.3 - Open source JavaScript and Node.js-powered wiki app.

📢 Elsewhere in the ecosystem

• 📺 I've been enjoying Arjay McCandless's YouTube channel lately as he's been focusing on maxing out VPSes with different stacks (and often being surprised by the results). This time, he compares 22 combinations of JavaScript runtimes and frameworks to see how many users they can handle!

• 🌙 Safari 27.3 beta introduces Adaptive Dark Mode, an opt-in feature that automatically darkens light websites that don't provide their own dark theme.

• 🎨 Three.js creator mrdoob is posting daily visual experiments for Codevember, complete with live demos and source.

• 💰 Cloudflare has handed out the first $301,300 of the $1M Vite Ecosystem Fund it pledged when VoidZero joined, spread across 44 projects and maintainers, including e18e.

#​809 - November 3, 2026

Read on the Web

JavaScript Weekly

The AI Cost of JavaScript Frameworks

Nolan Lawson had Claude build the same app five times in each of twelve JS stacks to test common "X is better for agents" claims. Costs varied significantly between runs, and Gautam Parab found that the observed cost ranges overlapped or touched for most pairs of frameworks.

But a clearer difference was in the median amount of JavaScript sent to browsers: 0KB for Astro, 18K for Hono+htmx, 36K for SvelteKit, and 115-142K for React Router, TanStack Start and Next.js. If you've gone "hands-free", Nolan asks, why stick to a particular stack you chose when you wrote all the code? His benchmark is on GitHub to try for yourself.

Nolan Lawson

Run AI Coding Models on Your Own Machine - Local models are now good enough for everyday coding. Learn to run them on your own Mac or GPU, wire them into your editor and terminal agents, and keep your code private with no per-token bill.

Master.dev sponsor

Why Is This Fingerprinting Script 'Creating Bioweapons'? - A crawl of sites to collect canvas fingerprinting examples (which you can see, visually, at fingerprint.garden) found an anti-analysis technique where JavaScript identifiers were named after… taboo topics, with a prompt hidden in invisible Unicode, all designed to make LLMs refuse to work on the code!

Veritas

💡 Canvas fingerprinting is a technique that uses quirks of how different clients render canvas elements, in order to distinguish browser environments.

IN BRIEF:

• 😄 Bartosz shares a creative way to generate strings and run code without parentheses or quotes. Good old JavaScript fun!

• 📊 GitHub's Octoverse 2026 report has TypeScript as the most used language on GitHub by contributors (with JS at third), and ~44% of merged TypeScript PRs showing AI involvement. Plus a lot more besides.

• GitHub Actions will block pull_request_target by default in public repos from December 2, unless an event policy explicitly allows it, with brownouts on November 9 & 16.

• Cloudflare Workers now supports the Temporal API natively behind a temporal compatibility flag. It'll be available by default from December 1.

RELEASES:

• Node.js v27.0 (Alpha) and v26.13.0 (LTS) - Node 26 is now the 'Lithium' LTS line, and 27 is the first ever Node 'alpha'. Under Node's new release process, every line spends six months in alpha before going Current.

• Vitest 5.1 - A new --since-last-run flag reruns only tests affected by your edits, plus there's an interactive snapshot review feature.

• Rspack 2.3 - The Rust-based webpack alternative adopts SWC Next and its rewritten parser. The team reports 5-20% faster builds and less peak memory use.

• Leaflet 2.0 Beta 1 - The mapping library's first major in a decade goes tree-shakeable, ships TypeScript types, and drops its default export.

• Effect 4.1, pnpm 12.17, ESLint 10.14.0, Nuxt DevTools v4

📖 Articles and Videos

"No, npm, 'estee' is not a typo of 'testem'" - Shane tried to publish a CLI called estee and hit npm's typosquatting filter, which (as best as we can tell) rejects names within a small Levenshtein distance of popular packages' names.

Shane Friedman

Shrinking clarity.js: When Cleaner Code Gzips Worse - Microsoft let an agent run 50+ size experiments on its analytics script. A big win came from dropping import * namespace objects, while good-practice refactors like extracting helpers actually made the gzipped output bigger.

Manu Nair (Microsoft)

Workshop: How to Implement Session Replay - Filters, custom tags, and sampling settings for finding the sessions that matter. Nov 5, 10am PT.

Sentry sponsor

'Nothing Installs at Our Company Until It's a Week Old' - Many recent package hijacks were caught within hours, so Bruno's company now makes new releases wait a week. He explains what this approach broke, what cooldowns don't stop, and settings for popular package managers.

Bruno Jurković

Timing Ten Design Systems, Then Fixing the Slow Ones - Den timed ten design systems (MUI, Ant Design, and Ionic among them) opening a 249-option select and ticking 100 checkboxes, then profiled the slow ones to find out why.

Den Odell

Using Bun? Dependabot Can't See Most of Your Dependencies - GitHub's dependency graph doesn't parse bun.lock, so Dependabot alerts cover only direct dependencies. Nicolas has some tips for improving matters.

Nicolas Charpentier (Shortcut)

📄 How Hard Is It to Check for Whitespace? - Why Java, Python and JavaScript disagree on what counts as whitespace. Sergey Tselovalnikov

📄 A Proposal: How to Hire Junior Engineers in the Age of AI - The npm co-founder thinks traditional coding interviews are dead. Laurie Voss

📄 How to Make postMessage Type-Safe in Under 350 Bytes Pavel Grinchenko (Evil Martians)

📄 The Web Can't Afford a JavaScript Runtime Monoculture Kate Holterhoff (RedMonk)

🛠 Code & Tools

Handwired: Compile Regular JavaScript into a Neural Net - A new mind-bender from Pretext's creator: a compiler that turns JavaScript into an exact network of ReLUs and matrix multiplies that run on the GPU. Demos include a 130-layer 'mini desktop' and a WebGPU search over 100K JSON documents.

Cheng Lou

Build Smarter JavaScript Applications With Live Search Data - Add search, shopping, maps, news, trends, flights and hotels results with a single developer-friendly JavaScript SDK.

SerpApi sponsor

🌐 x18n: Lint and Maintain i18n Files for Any Framework - Anthony Fu's successor to i18n-ally scans locale files and translation calls and reports missing, unused and broken keys (like how tsc --noEmit reports type errors).

Anthony Fu

djs: A New 'Suspend Anywhere' JavaScript Engine - Armin (of Flask fame) built an engine to run scripts in WebAssembly that can snapshot the VM's state and resume elsewhere, even mid-await.

Armin Ronacher

webframe: Run a Web Page Like a Command-Line Program - Point it at a URL or HTML file and it runs the page in a hidden system web view, piping console.log() to stdout and exceptions to stderr. No bundled browser or Playwright needed.

Jeff Lindsay

phoria2: A Small WebGL 2 Library for 3D Charts - A dependency-free 3D library aimed at dashboards and product viewers, with an API you can 'learn in an afternoon'. Plenty of live demos on the page.

Kevin Roast

• Shiki 4.6 - Powerful code syntax highlighter, now with faster decoration handling and compressed Oniguruma WASM binary.

• Preact 11.1 - A new preact/compat/compiler-runtime entry point lets code compiled by React Compiler run on Preact too.

• Postgres.js 4.0 - The popular Postgres client for Node, Bun and Cloudflare Workers gets a rewrite and goes ESM-only.

📢 Elsewhere in the ecosystem

• Chrome 157 is due today with the headline feature being HTML-in-Canvas for drawing live, interactive DOM elements into 2D, WebGL and WebGPU canvases. This feature has numerous striking applications.

• ☕ CheerpJ 5.0 brings Java 21 and 25 to the browser via WebAssembly, ships the full JDK so you can compile Java in a tab, and previews a new WasmGC-based engine the team hopes will run Minecraft and IntelliJ one day.

• 🤖 LLM-whisperer Simon Willison looks at the world of browser games being built with coding agents, and argues October was the point where agents got good enough to ship playable games.

• 🕹️ Talking of games… GitHub's game jam Game Off is back for its 14th year with the theme 'SHIFT'. Entries are due on itch.io by December 1.

#​808 - October 27, 2026

Read on the Web

JavaScript Weekly

TanStack AI 1.0: The Vendor-Neutral AI Toolkit Goes Stable - TanStack's framework-agnostic AI toolkit reaches 1.0, with stable APIs for chat, tools and media, plus 23 provider adapters. A new agent harness supports long-running sessions, but its APIs remain experimental.

Tuzlak, Herrington, et al. (TanStack)

Would You Let Your AI Agent Grade Its Own Homework? - Agents write code faster than ever. They even review their own work. But who's reviewing them? Dropbox, Notion & ElevenLabs don't take the risk. With Meticulous, every change is exhaustively verified, with zero developer effort.

Meticulous sponsor

Announcing TypeScript 7.1 Beta - TypeScript 7 gets a programmatic API, plus 'content mappers', a plugin point for checking code embedded in files such as Vue, Svelte, and Astro components. Also new are source phase imports and --target es2026.

Daniel Rosenwasser (Microsoft)

GTA.js: 1997's Grand Theft Auto, But in JavaScript - Bramus has been reimplementing the original top-down GTA's engine in JavaScript and WebGL, loading Liberty City from the game's original demo files. Play it here.

Bramus Van Damme

💡 Fittingly, Pat Kerr, whose 1996 Atari ST prototype formed the basis of the original game's vehicle physics, recently rebuilt it in JavaScript.

IN BRIEF:

• Deno's Bartek Iwańczuk says the team is working on getting Deno into a foundation. Meanwhile, a new fork, Ende, plans to drop Node compatibility and refocus on sandboxing.

• Safari 27.1 previews the Device Posture and Viewport Segments APIs behind feature flags on the iPhone Duo, letting JavaScript detect folds and inspect screen segments.

• Chrome 156 has reached stable and no longer caches module fetch failures, so a dynamic import() that fails due to a network or HTTP error can be retried.

RELEASES:

• Node.js v26.12.1 (Current), v24.22.1 (LTS) and v22.23.4 - Security releases fixing ten CVEs, including the 'Node2Shell' Brotli decoder flaw, which can lead to remote code execution when an app decompresses malicious data. (Also, Node 26 is due to become LTS tomorrow.)

• Bun 1.4.4 - Adds bun fmt, a Prettier-compatible formatter that uses your existing Prettier or oxfmt config. It's very fast.

• Electron 45 - Upgrades to Chromium 156, Node 24.22 and V8 15.6, and adds hooks for the Prompt API so apps can plug in a local model.

• pnpm 12.16, Remix 3.1, axios 1.21, Deno 2.9.8

📖 Articles and Videos

Parser Combinators in TypeScript, Built From Scratch - Parser combinators sit between regexes and heavyweight tools like tree-sitter. This animated, step-by-step walkthrough shows the basic elements of building them, concluding in an example turning ping output into typed objects.

Florian Schindler

Dead Code Shouldn't Exist: How Sentry Cut 28,000 Lines - A talk Dominik has given at six conferences this year, now as swipeable slides with a full transcript. He covers how unused code can cost more than you might think, and how Sentry used Knip to remove 28,000 lines.

Dominik Dorfmeister (Sentry)

AI.js Day 2026: Frontend's Scariest AI Questions, Live on Channel 13, Nov 13 - No hype, just the AI questions frontend devs are afraid to ask. Save your spot.

JetBrains sponsor

Building an Isolated Preview for AI-Generated HTML - Rendering model-written HTML in a srcdoc iframe runs it on your own origin. A security engineer breaks the naive approach, then rebuilds it using sandbox and a strict CSP, with demos showing what each one blocks.

Keshav Malik

A First Look at TypeScript 7.1's Content Mappers - TypeScript 7 ignores tsserver plugins, but 7.1's content mappers can turn non-TS files into TypeScript. Here's how they work, applied to CSS modules and .graphql files.

Jovi De Croock

📄 How Engines Turn Dynamic Objects Into Fast Field Access - Shapes and inline caches, explained with runnable sketches. Max Bernstein

📄 Software is Slow Because of Bad Design, Not Slow Languages Sean Goedecke (GitHub)

🛠 Code & Tools

Structs: TC39's Shared Structs Proposal, But Usable Today - A former TC39 delegate's implementation of the Stage 2 structs proposal. The idea is you get shared memory between workers, so threads can work on the same objects instead of serializing copies back and forth. There's a playground too.

Erik Arvidsson

Introducing TanStack Redact: A Slimmer React Runtime - A build plugin swaps React and React DOM for a smaller reimplementation in the browser with no code changes. It works with Vite, Start, Vinext and Next.js, and while TanStack reports 20-70% smaller client builds, rendering is synchronous only.

Tanner Linsley (TanStack)

AI Tests That Catch Real Bugs - AI can write low-value tests that pass without checking much. Wallaby helps your agent refine assertions and catch bugs.

Wallaby Team sponsor

Verdaccio 7.0: The Self-Hosted npm Registry Adds Staged Publishing and 2FA - A mature, lightweight way to self-host your own npm registry and proxy. v7 adds experimental staged publishing (where new versions need approval before going live) and 2FA, plus stricter ownership checks.

Verdaccio Team

Biome 2.6 Adds Markdown, YAML and SCSS Support - The Rust-powered alternative to Prettier and ESLint adds formatting support for Markdown, YAML and SCSS, along with initial linting support. JavaScript plugins for custom lint rules are available as a developer preview.

Biome Core Team

• ☕ CoffeeScript 2.7.1 - The first release in four and a half years brings Node 22+ fixes and with { type: 'json' } import attributes.

💡 If you never used CoffeeScript, it is/was a Ruby- and Python-flavored language that compiled to JavaScript. Brendan Eich held up its arrow functions and lightweight classes as models for what went into ES6 (ES2015).

• oxlint 1.89 - The Rust-based linter now counts the upstream recommended rules of its React, Vue, Next.js, Jest/Vitest, and other plugins as 'recommended' so expect more reports if you upgrade.

• Mutative 2.0 - Immer-style efficient immutable updates library. The author reports a 3.6x speedup over Immer across a benchmark suite.

• SonicJS 3.0 - Headless CMS for Cloudflare Workers, built on Hono. v3 rebuilds the data layer, auth and plugin system. Homepage.

• query-string 10.0 - Parse and stringify URL query strings. Now throws for values it can't represent.

• ShareDB 7.0 - Realtime database backend based on operational transformation.

📢 Elsewhere in the ecosystem

• 🔒 Node2Shell: ELLIO now reports exploit traffic in the wild for the Brotli RCE fixed in the Node releases (as mentioned earlier). The flaw is in Google's Brotli library, so bundled copies elsewhere need patching too.

• Sentry has given $1m to open source maintainers this year. JavaScript recipients include pnpm, TanStack, MSW, Knip and three Three.js maintainers, plus the OpenJS Foundation.

• 🎉 CSS-Tricks, the popular web dev resource, is independent again, now owned by longtime editor Geoff Graham.

• Arc, the design-led Chromium browser popular with developers, is being sunset with The Browser Company steering everyone to Dia.

• 📄 Google Docs can now open, edit and collaborate on Markdown files natively and Drive renders previews of them too.