fidzu : javascript

#​808 - October 27, 2026

Read on the Web

JavaScript Weekly

TanStack AI 1.0: The Vendor-Neutral AI Toolkit Goes Stable - TanStack's framework-agnostic AI toolkit reaches 1.0, with stable APIs for chat, tools and media, plus 23 provider adapters. A new agent harness supports long-running sessions, but its APIs remain experimental.

Tuzlak, Herrington, et al. (TanStack)

Would You Let Your AI Agent Grade Its Own Homework? - Agents write code faster than ever. They even review their own work. But who's reviewing them? Dropbox, Notion & ElevenLabs don't take the risk. With Meticulous, every change is exhaustively verified, with zero developer effort.

Meticulous sponsor

Announcing TypeScript 7.1 Beta - TypeScript 7 gets a programmatic API, plus 'content mappers', a plugin point for checking code embedded in files such as Vue, Svelte, and Astro components. Also new are source phase imports and --target es2026.

Daniel Rosenwasser (Microsoft)

GTA.js: 1997's Grand Theft Auto, But in JavaScript - Bramus has been reimplementing the original top-down GTA's engine in JavaScript and WebGL, loading Liberty City from the game's original demo files. Play it here.

Bramus Van Damme

💡 Fittingly, Pat Kerr, whose 1996 Atari ST prototype formed the basis of the original game's vehicle physics, recently rebuilt it in JavaScript.

IN BRIEF:

• Deno's Bartek Iwańczuk says the team is working on getting Deno into a foundation. Meanwhile, a new fork, Ende, plans to drop Node compatibility and refocus on sandboxing.

• Safari 27.1 previews the Device Posture and Viewport Segments APIs behind feature flags on the iPhone Duo, letting JavaScript detect folds and inspect screen segments.

• Chrome 156 has reached stable and no longer caches module fetch failures, so a dynamic import() that fails due to a network or HTTP error can be retried.

RELEASES:

• Node.js v26.12.1 (Current), v24.22.1 (LTS) and v22.23.4 - Security releases fixing ten CVEs, including the 'Node2Shell' Brotli decoder flaw, which can lead to remote code execution when an app decompresses malicious data. (Also, Node 26 is due to become LTS tomorrow.)

• Bun 1.4.4 - Adds bun fmt, a Prettier-compatible formatter that uses your existing Prettier or oxfmt config. It's very fast.

• Electron 45 - Upgrades to Chromium 156, Node 24.22 and V8 15.6, and adds hooks for the Prompt API so apps can plug in a local model.

• pnpm 12.16, Remix 3.1, axios 1.21, Deno 2.9.8

📖 Articles and Videos

Parser Combinators in TypeScript, Built From Scratch - Parser combinators sit between regexes and heavyweight tools like tree-sitter. This animated, step-by-step walkthrough shows the basic elements of building them, concluding in an example turning ping output into typed objects.

Florian Schindler

Dead Code Shouldn't Exist: How Sentry Cut 28,000 Lines - A talk Dominik has given at six conferences this year, now as swipeable slides with a full transcript. He covers how unused code can cost more than you might think, and how Sentry used Knip to remove 28,000 lines.

Dominik Dorfmeister (Sentry)

AI.js Day 2026: Frontend's Scariest AI Questions, Live on Channel 13, Nov 13 - No hype, just the AI questions frontend devs are afraid to ask. Save your spot.

JetBrains sponsor

Building an Isolated Preview for AI-Generated HTML - Rendering model-written HTML in a srcdoc iframe runs it on your own origin. A security engineer breaks the naive approach, then rebuilds it using sandbox and a strict CSP, with demos showing what each one blocks.

Keshav Malik

A First Look at TypeScript 7.1's Content Mappers - TypeScript 7 ignores tsserver plugins, but 7.1's content mappers can turn non-TS files into TypeScript. Here's how they work, applied to CSS modules and .graphql files.

Jovi De Croock

📄 How Engines Turn Dynamic Objects Into Fast Field Access - Shapes and inline caches, explained with runnable sketches. Max Bernstein

📄 Software is Slow Because of Bad Design, Not Slow Languages Sean Goedecke (GitHub)

🛠 Code & Tools

Structs: TC39's Shared Structs Proposal, But Usable Today - A former TC39 delegate's implementation of the Stage 2 structs proposal. The idea is you get shared memory between workers, so threads can work on the same objects instead of serializing copies back and forth. There's a playground too.

Erik Arvidsson

Introducing TanStack Redact: A Slimmer React Runtime - A build plugin swaps React and React DOM for a smaller reimplementation in the browser with no code changes. It works with Vite, Start, Vinext and Next.js, and while TanStack reports 20-70% smaller client builds, rendering is synchronous only.

Tanner Linsley (TanStack)

AI Tests That Catch Real Bugs - AI can write low-value tests that pass without checking much. Wallaby helps your agent refine assertions and catch bugs.

Wallaby Team sponsor

Verdaccio 7.0: The Self-Hosted npm Registry Adds Staged Publishing and 2FA - A mature, lightweight way to self-host your own npm registry and proxy. v7 adds experimental staged publishing (where new versions need approval before going live) and 2FA, plus stricter ownership checks.

Verdaccio Team

Biome 2.6 Adds Markdown, YAML and SCSS Support - The Rust-powered alternative to Prettier and ESLint adds formatting support for Markdown, YAML and SCSS, along with initial linting support. JavaScript plugins for custom lint rules are available as a developer preview.

Biome Core Team

• ☕ CoffeeScript 2.7.1 - The first release in four and a half years brings Node 22+ fixes and with { type: 'json' } import attributes.

💡 If you never used CoffeeScript, it is/was a Ruby- and Python-flavored language that compiled to JavaScript. Brendan Eich held up its arrow functions and lightweight classes as models for what went into ES6 (ES2015).

• oxlint 1.89 - The Rust-based linter now counts the upstream recommended rules of its React, Vue, Next.js, Jest/Vitest, and other plugins as 'recommended' so expect more reports if you upgrade.

• Mutative 2.0 - Immer-style efficient immutable updates library. The author reports a 3.6x speedup over Immer across a benchmark suite.

• SonicJS 3.0 - Headless CMS for Cloudflare Workers, built on Hono. v3 rebuilds the data layer, auth and plugin system. Homepage.

• query-string 10.0 - Parse and stringify URL query strings. Now throws for values it can't represent.

• ShareDB 7.0 - Realtime database backend based on operational transformation.

📢 Elsewhere in the ecosystem

• 🔒 Node2Shell: ELLIO now reports exploit traffic in the wild for the Brotli RCE fixed in the Node releases (as mentioned earlier). The flaw is in Google's Brotli library, so bundled copies elsewhere need patching too.

• Sentry has given $1m to open source maintainers this year. JavaScript recipients include pnpm, TanStack, MSW, Knip and three Three.js maintainers, plus the OpenJS Foundation.

• 🎉 CSS-Tricks, the popular web dev resource, is independent again, now owned by longtime editor Geoff Graham.

• Arc, the design-led Chromium browser popular with developers, is being sunset with The Browser Company steering everyone to Dia.

• 📄 Google Docs can now open, edit and collaborate on Markdown files natively and Drive renders previews of them too.

#​807 - October 20, 2026

Read on the Web

JavaScript Weekly

tsrs: Cloudflare and VoidZero's Rust Port of TypeScript - A Rust port of the Go-based TypeScript 7 compiler, built with some input from the TypeScript team and heading into Oxc. Benchmarks claim up to 8x the speed of TypeScript 7.0 and it runs in WebAssembly. Experimental, but npx tsrs works.

Chen, Mitropoulos and Nakazawa (Cloudflare / VoidZero)

💡 Max Schwenk started the port with agents writing the code, and tells the full tale here, including how it took his company's typecheck from 80 seconds to 7.

Send Webhooks from Your TypeScript API in Minutes - One typed npm package, one call per event. Svix handles retries, signing, delivery logs, and a portal for your customers, so you don't build any of it. Resend sends 200M+ webhooks a year through it.

Svix sponsor

Thank You, Deno: Competition Keeps JavaScript Moving - Last week we covered Deno joining Cloudflare and the future of the Deno runtime. Deno was valuable, says Darcy, as it (and Bun) made the entire ecosystem better by pushing Node and npm to adopt its best ideas.

Darcy Clarke (vlt)

IN BRIEF:

• 🔒 Next.js has patched two critical RCE flaws: one in use cache functions via an upstream React Server Components bug and one in the image optimizer's SVG handling. Upgrade to 16.4.1 or 15.5.28; a public PoC is already out.

• 🔒 Node.js security releases are due tomorrow for the 26.x, 24.x and 22.x lines, with the highest severity issue rated high.

• Bun compiling JavaScript ahead-of-time, previewed a few weeks ago, now has a draft PR to produce binaries with no JIT or bytecode.

RELEASES:

• Node.js v26.12.0 (Current) and v24.22.0 (LTS) - 26.12 can now synchronously load most ES modules and marks the config file stable; 24.22 gains util.throttle and util.debounce.

• Astro 7.4 - Adds a --timings flag for astro build to see where build time is spent, plus experimental parallel prerendering across worker threads.

• React Router 8.5 - Deprecates its own view transition APIs in favor of React's <ViewTransition> component, and adds an experimental 'API-only' mode.

• Pretext 1.0 - Multiline text layout without touching the DOM. 1.0 ports browsers' own line breakers, so results more closely match what would render.

• React Native 0.88, Elysia 2.0 RC, ESLint 10.13, tsup 9.0, Vuetify 4.3

📖 Articles and Videos

The Tetris Script That Becomes Snake Once Prettified? - You'd think pretty-printers and deobfuscators at least leave a script's logic alone, but no. See how chaining semantic quirks in such tools can turn the 'cleaned up' output into a different program!

Robert Vähhi (TrustSig)

Do Web Components Have a Future If Nobody is Writing Them? - Nolan has spent years building and defending web components, so this thoughtful, if a little melancholy, piece carries some weight.

Nolan Lawson

Your CI Was Built for Humans. Your Agents Need Something Else - Expo is mobile AI infrastructure. Your agents build, test and ship iOS and Android apps in the background.

Expo sponsor

▶ ViteConf 2026: The Full Replay - Last week's ViteConf brought ~30 talks including Evan You's keynote on tooling in the agentic era, plus updates on Vitest 5, Vite DevTools, and a faster parser coming to Oxc. It's 10 hours, but there's a hero with timestamps in the comments.

ViteConf

💡 One of the bigger announcements: Void, the Vite team's full-stack SDK and deploy platform, is now open source.

How to Gaslight JavaScript Programmers (with Proxies) - Proxy, introduced as part of ES6 back in the day, has plenty of practical uses but can also make objects behave in curious, unexpected ways. Complete with live, editable examples.

Bryan Gillespie

How Miro Moved 70,000 Tests from Jest to Vitest - The story of moving ~70,000 tests across an 800-package monorepo to Vitest, with AI agents doing most of the laborious work.

Sergey Nikitin

📄 Upgrading to Zod 4 Cut Our Worker CPU by a Third - A Zod 3 to 4.5 migration at 100 million parses a day. Chris Arderne

📄 Using replace() as an Iterator - An old regex-callback-for-side-effects idiom, benchmarked against alternatives. Eugene Lazutkin

📄 Recursion is DEAD and HTML Killed It - Hands-on with Chromium's experimental Declarative Partial Updates proposal. Dave Rupert

📺 NightMonkey: Compiling JavaScript Ahead of Time to WebAssembly - An hour-long VMIL 2026 talk from a Wasmtime engineer. Chris Fallin

🛠 Code & Tools

Maplair: A Batteries-Included, Tree-Shakeable Fork of Leaflet - Still in alpha since last year, one of Leaflet's contributors has forked it, rolling in the 2.0 work plus rotation, fullscreen, search, heatmaps and more - all tree-shakeable.

Simon Legner

💡 The same day, Leaflet's creator posted a candid update about his experiences living in Ukraine and a plan to get Leaflet 2.0 released.

Embeddable DOCX, XLSX & PPTX Editor for Users and AI - Let your AI edit existing files via object-level APIs. Users review and keep editing the same file. Try Playground.

Thinkfree sponsor

📊 Chartist 2.0: The Lightweight SVG Charting Library Returns - A CSS-styled SVG charting library from 2014 that "went stale over the last years" makes a comeback with a composable API, server-side rendering to SVG, terminal charts, and still ~12KB gzipped for a line chart. There's a migration guide for 1.x users.

Gion Kunz et al.

Pele: Mermaid Diagrams as Lightweight, Themeable SVG - Zero-dependency renderer for the Mermaid diagram syntax with responsive layouts and SVG you can theme with CSS variables. Around a sixth the size of Mermaid.js. Try the playground.

Steph Ango (Obsidian)

<rich-input>: A Rich Input Field with GitHub-Style Search Filters - A web component for GitHub-style search boxes: free text mixed with autocompleted key:value filters, highlighted in place.

Bramus Van Damme

• Chokidar 6.0 - The file watcher behind much of JS tooling. Rewritten to check changes against the disk before reporting to avoid stray events after a burst of edits, say.

• Happy DOM 21.0 - Headless browser environment in pure JavaScript, popular for testing. Now blocks stylesheet and iframe loading by default.

• p-queue 10.0 - Promise queue with concurrency control. Now dependency-free and an EventTarget.

• Paper.js 0.13 and 0.14 - Vector graphics scripting framework for canvas. First notable releases in years. (Homepage with demos.)

• 🕹️ LittleJS 1.27 - Dependency-free HTML5 game engine that now does 3D too.

• 🖼️ Skia Canvas 4.0 - Canvas API for Node, built on Skia.

📢 Elsewhere in the ecosystem

• 🖼️ JPEG XL: The modern image format is now supported by all major browsers, with Firefox 158 the latest to enable it by default. Jake Archibald pits it against AVIF in this extensive review. What I find amazing is what it's able to render in under 100 bytes.

• NodeConf EU 2026: The ▶️ latest NodeConf EU talks are up, including James Snell's case for a common minimum API every runtime should support, plus sessions on V8 heap management and Emscripten and WebAssembly.

• A new social network: /dev/null is a GitHub-oriented social network for developers, built from scratch in 48 hours. It already has over 8000 members, including me. It's been a lot of fun so far!

#​806 - October 13, 2026

Read on the Web

JavaScript Weekly

Deno is Joining Cloudflare (But…) - Maybe David Bushell saw the writing on the wall, as the Deno team isn't joining Cloudflare to keep working on Deno, but to fold celld into workerd so Durable Objects can be self-hosted (more on that here). The Deno runtime will get a final year of official fixes, Deno Deploy closes in six months, and JSR moves to Cloudflare's infrastructure.

Ryan Dahl

💡 On Hacker News, Ryan Dahl noted that Deno "has been sucked into the gravity well of Node compatibility" before asking: "Why reimplement Node? It works." But what happens to the JavaScript™ trademark case, I wonder…?

CodeAF: #1 of Ten Coding Harnesses on DeepSWE - Ten coding harnesses ran the same open model on 113 real GitHub issues. CodeAF solved the most and paid the least per solved issue: 3.4x less than Claude Code, 4.8x less than OpenCode. A new open-source coding harness built for open models.

AgentField AI sponsor

Bun 1.4.3 Adds bun check, a Built-In TypeScript Type Checker - bun check is a port of TypeScript 7's checker that reads your tsconfig.json, reports the same errors as tsc and, Jarred claims, runs 3-6x faster. It plugs into bun run/test/build too. Idle server processes now use far less CPU, and a JavaScriptCore upgrade picks up numerous perf gains.

Jarred Sumner

IN BRIEF:

• AWS has launched Lambda Web Functions, which run an ordinary port-listening Node server (Express, Hono, Fastify, etc.) on Lambda with no handler rewrite, billing for active CPU time and separately for memory.

• 📊 The 2026 Stack Overflow Developer Survey results are out (30,903 people took part) with JavaScript the #1 language for the 12th year in a row (and TypeScript at #6).

• 🔒 Despite this week's fresh stir, no malicious Zod release reached npm. Malicious commits pushed to its repo in September were reverted the same day, as Colin McDonnell explains.

• 🔒 An out-of-band Next.js security release is due tomorrow.

RELEASES:

• Last second addition: TanStack Start 1.0 has just dropped. Big news for full-stack React and Solid fans! :-)

• 🎉 Partytown 1.0 - A popular way to relocate third-party scripts to run in a Web Worker rather than on the main thread has left beta after five years in development.

• Marionette 5.0 - Six years on, the Backbone-era framework returns with a core free of Backbone, jQuery and Underscore… and they explain why!

• Bootstrap 6 Alpha - An early look at Bootstrap's first major release since 2021, leaning on modern CSS and making its JavaScript plugins ESM-only.

• Express 5.3.0 - A maintenance release worth upgrading to, as patched qs, proxy-addr and body-parser dependencies close five CVEs.

📖 Articles and Videos

📊 WebSocket Servers in JavaScript: Node.js, Bun, and Deno - In 2023, Daniel found Bun much faster than Node at relaying WebSocket messages, but there was a bug in his Bun server. This new attempt uses a C client/relay as a baseline, and Node 26 now gets close to C latency, ahead of Bun and Deno.

Daniel Lemire

How Sindre Sorhus' Personal Site is Now Made in Swift - One of JavaScript's most prolific developers explains how he's dropped Astro and now builds his personal site with Swift, including the styling and markup, with broken links and style typos failing at compile time (source).

Sindre Sorhus

Too Many Agent Traces to Read? Find the Ones That Matter, Live Oct 14 - Bad answers, wrong tool calls, too many traces. See how Sentry engineers find the failures worth fixing. Register now.

Sentry sponsor

Tiny Apps with TinyJS - A quick look at a new way to make tiny JS-powered desktop apps we featured a few weeks ago.

Raymond Camden

📄 Yet Another Way to Invoke Functions Without Parentheses - There are many ways to invoke arbitrary functions in JavaScript without using parens, but this is a particularly obscure one! bartosz

📄 Six Months of Building with Remix 3 - What the post-React Remix (v3 was released earlier this month) is like to work with day to day. Sergio Xalambrí

📄 A Visual Notation for React's Parent and Owner Trees - With a playground that draws them from your code. Jules Blom

📄 How to Test an iframe's postMessage Handler Keshav Malik

🛠 Code & Tools

🤖 OpenCode 2.0: A Big Update for the Open Coding Agent - A full-featured agentic coding app, built on Bun, that's more akin to Claude Code than Pi, say. v2.0 overhauls it with background subagents, a 'code mode' to let models script MCP tool calls, and clients for vanilla JS and Effect code to drive it.

Anomaly / The OpenCode Team

💡 If you've not given OpenCode a try yet, you can get started here.

Tamagui 3: One React UI Codebase for Web and Native - A styling system and component kit for sharing UI between React web apps and React Native, with a compiler that keeps things fast on both. v3 adds Tailwind-style props and React Strict DOM support.

Nate Wienert

Mobile AI Infrastructure for Web Devs Who Code with Agents - Point the agent you use for the web at iOS and Android. Expo takes care of the native builds and the trip to the stores.

Expo sponsor

H3 v2: The UnJS HTTP Framework Rebuilt on Web Standards - The minimal HTTP framework behind Nitro and Nuxt's server layer is now stable in v2, a rewrite around standard Request and Response so the same app runs on Node, Bun, Deno, Workers, and even in the browser. Migration guide.

Pooya Parsa

Shaders: 190+ WebGPU Effect Components, Now Open Source - Ripples, glows, and dissolves into ASCII, composed as components rather than written as shader code, for React, Vue, Svelte, Solid, or plain JS. The engine, framework bindings, and the components themselves are now all MIT licensed.

Simon Le Marchant

💡 If you like this vibe, ascii.rest, which offers "236 animated ASCII pieces for web pages", is also worth a look.

• Node.js v26.11.0 (Current) - Adds a --process-timeout flag to end a process after a set time, plus virtual table support in node:sqlite.

• Hono 5.0 RC - The web-standards server framework goes ESM-only and moves its runtime adapters into separate packages.

• 🔒 Handlebars 4.7.10 - The templating library fixes two critical JavaScript injection flaws affecting releases back to 3.0.

• he 2.0 - Robust HTML entity encoder/decoder. First release in eight years, now ESM with named exports.

• React Aria 1.22 - Adds a new Sheet component.

• pnpm 12.12

📢 Elsewhere in the ecosystem

• In Fingerprints are the New Cookies, Roy Fish demonstrates the various ways web pages can assign a unique(ish) identity to you using JavaScript.

• 🤖 Theo Browne set AI agents loose on porting the TypeScript 7 compiler to Rust, and ts-rust is the (very experimental) result.

• 📱 Following Shopify, Coinbase is moving its app off React Native, saying agents have made building each feature twice cheap enough to go fully native.

• Fancy a retro robot voice in your web experience? Klattsch is a voice synthesizer you can use on the web or from Node.js as an npm package. Daiiisy, daiiisy…

• Three years ago we mentioned Linus Groh's Zig-based Kiesel JavaScript engine. It passed 25% of test262 back then, but v0.4.0 has landed and it's now at 94.7% (not far behind V8) and supports modern language proposals like await dictionary and numerous iterator proposals.