fidzu : javascript

#​803 - September 22, 2026

Read on the Web

JavaScript Weekly

tinyjs: Build JavaScript Desktop Apps in <10MB - I built an app with this and was impressed. You get a txiki.js-powered backend with full system access (including FFI!), native webview rendering, and tiny macOS, Linux, and Windows builds. It even makes it easy to sign/notarize the final app.

Tarwin Stroh-Spijer

There are lots of great options in this space though:

• Electrobun offers richer multi-window and GPU features, at the cost of a larger TypeScript runtime - though it can instead use Zig, Rust, Go, or Odin for a tiny native main process.

• Perry is a TypeScript to native AOT compiler whose primary UI model renders AppKit, Win32 and GTK4 widgets for a more conventionally native feel.

• Electron and the experimental Deno Desktop are powerful, but their executables typically run several times larger.

• Neutralinojs apps can be even smaller than tinyjs's, but you lose the general-purpose JavaScript privileged backend by design.

Full-Text Search in Drizzle Without a Second System - Try the official ParadeDB integration for Drizzle. Search your live Postgres tables. No ETL, no Elasticsearch. ParadeDB cloud coming soon.

ParadeDB sponsor

Persistent Databases in the Browser with DuckDB-Wasm and OPFS - A walkthrough of running DuckDB in the browser with a database file that survives reloads using the Origin Private File System now supported by all major browsers.

Piovesan and Wielenga (DuckDB)

How Linear Reworked Its CI for 4x the Tests - Eager agents grew Linear's test suite, and its CI costs with it! They share some remedies: rewriting type-aware ESLint rules as plain AST checks cut lint time 55% and eased a move to Oxlint, while selectively turning off Vitest's isolation saved a further 17% a month.

Mufeez Amjad (Linear)

IN BRIEF:

• Lovable rewrote Vite's dev server in Rust (calling it OJ) for performance reasons, but Evan You disputes the benchmark and predicts AI will have everyone maintaining "their own slop fork".

• 📊 npmchart.com plots download trends, releases and repo activity for any npm package (here's Svelte's, for example), and lets you compare packages.

• 🔒 npm now offers stage-only tokens to let automated workflows stage a release for a maintainer to approve with 2FA. This offers a migration path for those who can't move to trusted publishing yet.

RELEASES:

• Turborepo 2.11 - Experimental Rust, Python and Go support joins the task graph, plus up to 4x faster startup over 2.9.

• ESLint 10.11.0 - Performance update with faster startup and linting.

• Node.js 26.10.0 (Current) - Adds util.debounce/throttle.

• 📊 billboard.js 4.1, QuickJS-ng 0.17.0, VueUse 15.0

📖 Articles and Videos

An Undercover Analyst Infiltrated the Gang Behind 'Mini Shai-Hulud' - Bad news for the group behind this spring's cascading supply chain attacks… Google had a mole in their group chat! WIRED explains how the group was monitored and disrupted, leading to two recent arrests.

Andy Greenberg (WIRED)

The V8 Runtime Undermined My Constant-Time JavaScript Library - A look at how even branchless JavaScript can leak secrets through CPU cache behavior, due to quirks in how V8 handles booleans and -0.

Soatok Dreamseeker

Your UI Isn't Slow. It's Waiting on the Data - TimescaleDB extends Postgres so the data behind your UI loads fast as it grows. Get $1000 credit to start.

Tiger Data (creators of TimescaleDB) sponsor

Do Frameworks Matter Anymore? - If you're using AI, you're either using a framework or your agent is building an ad-hoc one on the fly. A Remix team member argues that's a good reason to want frameworks, and better ones, too.

Brooks Lybrand

📄 We Are All Product Engineers Now - Laurie argues that understanding what customers need becomes a core developer skill. Laurie Voss

📺 Is AI Changing How JavaScript Itself Gets Designed? - A 2-minute take from TC39 delegate Michael Ficarra. JetBrains

📄 Solid 2.0: It's the Little Things - Six touches that change how SolidJS 2.0 feels. Brenley Dueck

📄 How Notion Handles Concurrent Editing with CRDTs Nehmzow and Guo (Notion)

🛠 Code & Tools

Plotly.js 4: A Big Update for the Popular Charting Library - Now ships its own TypeScript types, adds 'quiver' plots (above) for drawing vector fields (with many awesome examples in the post), accepts CSS Color 4 color strings, and removes Mapbox GL in favor of MapLibre (no token needed!)

Chris Parmer

🤖 Transformers.js v4.3: Run AI Models in the Browser - Adds support for structured output (e.g. JSON), using WebGPU on Safari 26+, and DeepSeek v4. The docs have had an overhaul and there's now an agent skill you can use.

Hugging Face

💡 Hugging Face also released a collection of 207 Apache-2.0 WebGPU kernels - matmul, attention and quantization ops for your own runtime.

Still Writing Tests Manually? Meticulous AI Is Here - Flaky tests slowing down dev? Meticulous gives engineers confidence to ship faster by autonomously testing every edge case of your web app.

Meticulous sponsor

@shadcn/lint: An Agent-First Linter for Tailwind - An ESLint/Oxlint plugin to enforce rules like "no raw colors" and "no restyling <Button> from outside" with errors to steer agents back to your variants and tokens.

shadcn

Devframe: A Framework for Building DevTools That Run Anywhere - From the developer behind Vitest and Nuxt DevTools, "a framework for building DevTools, in the same way Nuxt or Next.js provides a framework [for web apps]". Define a tool once and Devframe turns it into a Web Standard request handler you can mount almost anywhere.

Anthony Fu

✉️ Mailflare: A Self-Hosted Inbox Built Entirely on Cloudflare - A self-hosted inbox for custom domains built on Cloudflare's Email Routing, Workers, D1 and R2. AGPL 3.0 licensed.

Hieu Nguyen

• gridstack.js 14.0 - The popular drag-and-drop dashboard layout library adds a list mode that reflows widgets like a reorderable list. (Demos.)

• 🖼️ image-dimensions 2.6 - Quickly get an image's dimensions by reading the least amount of data.

• Feedsmith 3.0 - A fast way to parse and generate web feeds, including RSS, Atom, and JSON.

📢 Elsewhere in the ecosystem

• I love these pure CSS 'hand drawn' annotations (above) you can add to any page in a data-note attribute.

• Cloudflare's Sunil Pai writes about the senior engineer 'death spiral', where you go dark for weeks to prove yourself in a new role and end up burning out.

• 🤖 Simon Willison writes about Jev, a new, fast 'decision model' taking developer social media by storm. Feed it semi-structured state and one or more questions and you get only numbers back (probabilities, choices and scores).

• GitHub Actions has a new cache-mode setting to limit cache access per workflow or job, a defence against the kind of cache poisoning that compromised TanStack's npm packages in May.

#​802 - September 15, 2026

Read on the Web

JavaScript Weekly

Functional Programming Jargon, Mapped and Explained - Currying, purity, functors, monads…? If FP terms ever go over your head, TC39 delegate Hemanth HM's popular jargon reference is now an explorable map of concepts showing how they relate, each with a simple definition and JavaScript example.

Hemanth HM

Stay Sharp in the Age of AI - Master.dev instructors build at Anthropic, OpenAI, Netflix, Google, and Stripe. Learn from them with hundreds of courses, live workshops, and expanded AI learning paths. New members get $100 off a yearly membership.

Master.dev sponsor

Modern Web Types: TypeScript Support for Newer Web APIs - TypeScript's DOM types only include APIs shipped in multiple browser engines, so things like element-scoped startViewTransition and fetchLater throw up errors. modern-web-types is a drop-in lib.dom replacement that adds missing interfaces/members shipped in any single browser engine.

Philip Walton (Google)

React 19.3 Released - A significant minor release making view transitions and Fragment Refs stable, adding Trusted Types support, and more. We covered it in more depth in last week's React Status.

The React Team

IN BRIEF:

• 🔒 Attackers are scanning for exposed Vite dev servers exploiting a server.fs.deny bypass (patched in Vite 7.3.2 and 8.0.5 earlier this year) to grab credentials from .env files. Vite listens on localhost by default, but double check your setup.

• Safari 27 shipped yesterday (alongside macOS/iOS 27), bringing the module loader rewrite we covered last week, so top-level await now works reliably in all major browsers.

• TC39 meets in Tokyo in two weeks. Here's the agenda with three iterator helper follow-ups (join, includes and chunking) all up for Stage 4, plus more.

• 🔒 Starting this Thursday, the OpenJS Foundation's CVE team is taking a break till October 6 due to burnout driven by a surge of AI-generated reports. Actively exploited issues will still get a response.

• 🔒 npm now places a temporary 72-hour 'security hold' on any account after a successful recovery-code sign-in.

RELEASES:

• pnpm 12.4 - The package manager can now manage Rust crates and Python packages alongside npm ones in a single workspace.

• Playwright 1.63 - Tests can now declare a named lock so those sharing a resource never run concurrently.

• Node.js v26.8.2 (Current) and v24.21.0 (LTS) - Both include a security release of Undici to fix numerous vulnerabilities.

• React Router 8.4, Vite 8.3, Moment.js 2.31.0 (security release).

📖 Articles and Videos

A Design Space Exploration of async/await - A simple async/await example produces different results in JavaScript, Rust, Python and Swift. Test your mental model with a quiz, then learn about the design choices behind the differences.

Gavin Gray

Native is Now the Future of Mobile at Shopify - Shopify is rewriting its React Native mobile apps in Swift/Kotlin. The main argument is coding agents have cut the cost of writing everything twice, while the upsides of native remain.

Mustafa Ali (Shopify)

Workshop: From an Error to the Logs That Explain It - Reading logs next to traces and errors, holding context across services, and cutting the noise.

Sentry sponsor

A Deep Dive into StyleX - A hands-on tour of Meta's StyleX, which turns JavaScript style objects into plain atomic CSS at build time, and why it can be a good fit for coding agents in particular.

Flavio Copes

📄 'Nobody Pays for Open Source: We Can Force Them To' - Laurie Voss ran npm for five years and thinks registries are an untapped lever for funding maintainers. Laurie Voss

📄 Anecdotally, Programmers Dislike reduce - map and filter sail through code review, but reduce draws complaints. Evan has a few theories why. Evan Hahn

🛠 Code & Tools

SnapDOM 3.0: Turn DOM Elements Into Images, Canvas and More - Zero-dependency html2canvas alternative with support for pseudo-elements and Shadow DOM. v3.0 adds 'incremental recapture' for faster repeat captures, automatic web font embedding, and fromString() for turning raw HTML markup into images.

Zumerlab

Your App Didn't Get Slower. Your Data Got Bigger - TimescaleDB extends Postgres so queries stay fast at scale, even as your data grows. Get $1000 credit to start.

Tiger Data (creators of TimescaleDB) sponsor

Fallow: Codebase Intelligence for TypeScript and JavaScript - A fast, zero-config Rust binary that finds dead code, duplication, circular dependencies and complexity hotspots in JS/TS projects. It's also pitched as a deterministic check for AI agent coding loops. GitHub repo.

Bart Waardenburg

🎨 category-colors: Generate 'Least Wrong' Color Palettes for Charts - Matt devised this algorithm for picking categorical chart colors in 2022 while design director at Stripe. It's now available as an npm package, and you can try it out on the Web here.

Matt Ström-Awn

• React DevTools 8.0 (Chrome Web Store) - The Suspense tab is now on by default, the Timeline profiler is gone (use your browser's Performance panel instead), and inspecting a DOM node now shows its matching React component.

• Zod 4.6 - Adds .validate(), a boolean check that skips building errors and is up to 35x faster than .safeParse().success on invalid input with compiled schemas.

• Javet 6.0 - Embed Node.js v26's runtime in the JVM for full interop with Java.

• parse-xml 5.0 - The fast, compliant XML parser goes ESM-only.

• 🕹️ n64js 1.0 - A Nintendo 64 emulator in pure JavaScript.

📢 Elsewhere in the ecosystem

• 🕹️ This year's js13kGames entries are in with a record 317 games squeezed into 13KB each. Frank Force's SP13KTRA racer and the Hornbound roguelike are good places to start, and you can dig around the public repos of every project too.

• Chris Coyier rounds up new and emerging HTML features worth knowing about, like the <geolocation> and <install> elements, as well as HTML-in-Canvas and improvements to <select> customization.

• The first Three.js Conference took place in Paris last week, and Codrops has a live-blog writeup of both days, including Mr.doob's talk. No recordings yet.

• Tailwind Labs, the team behind Tailwind CSS, is joining Shopify. Tailwind CSS is to remain maintained and open source - phew! 😅

#​801 - September 8, 2026

Read on the Web

JavaScript Weekly

How Turbopack Chunks Your JavaScript - Starting from the Network tab and working up, a look at chunking strategy and the tradeoffs bundlers make between fewer requests and less code (e.g. 8 chunks can weigh more than 355 do), backed by numbers from bundling the official Next.js site itself.

Sam Poder

Catch Runtime Bugs Before Your JS PR Merges - Greptile now runs your code to find bugs. T-Rex runs your PR branch in a sandbox, uses browser agents to click through your UI, and attaches screenshots and videos as evidence of the issue directly in the PR.

Greptile sponsor

Vitest 5.0 Focuses on Speed and Test Debugging - A major release for the Vite-native test runner, with a benchmark repo showing up to 53% faster runs on dependency-heavy apps. The new Trace View replays Browser Mode tests step by step, and vitest doctor recommends settings to make your suite run faster.

Vitest Team

How Safari Fixed Top-Level await - Safari's module loader was originally built on an abandoned spec proposal and adding top-level await caused years of "cannot access before initialization" errors. Safari 27 brings full spec compliance for it, but it took a ground-up rewrite and this post explains the complexity.

Kai Tamkun (WebKit)

IN BRIEF:

• 🎂 jQuery 1.0 is 20 years old. InfoQ looks back at how $() helped us dodge the browser wars and why many sites still use it. Ten years further back, Microsoft shipped JavaScript in Internet Explorer as JScript to dodge trademark issues.

• Two men have been arrested over the TeamPCP npm supply chain attacks. TeamPCP is suspected of cloning the Shai-Hulud worm, resulting in the 'Mini Shai-Hulud' waves.

• VoidZero's latest update celebrates Vitest passing 100m weekly downloads, React Compiler support reaching Vite, and the latest on Rolldown, Vite+ and ViteConf (taking place online this October 15th).

RELEASES:

• deck.gl 9.4 - The GPU-powered data visualization library extends its experimental WebGPU support in what's expected to be the final v9 release.

• Bun 1.4.1 and 1.4.2 - Big idle memory usage drops, smaller bun build bundles, Bun.serve speaks HTTP/2 on the same port as HTTP/1.1, and more.

• NVM for Windows 2.0 - A Node version manager for Windows. No longer needs admin privileges in v2.

• Astro 7.3, ESLint 10.10.0, Storybook 10.6, Vuetify 4.2

📖 Articles and Videos

▶ The Story of VS Code - An official movie-length documentary on Visual Studio Code's journey from a Swiss skunkworks to now. Its founding engineers cover the decisions made in areas like Electron, LSP, and the extension API, plus candid talk about the various forks now springing up.

Microsoft and Stefan Kingham

😅 We also learn that at the 2015 launch they drank a beer per 100 Hacker News upvotes… and had to stop at 1,400 (votes, not beers!)

Half Past Fetch: What await fetch() Waits For - Did you know await fetch(url) waits for the headers, not the full body? Gabor digs into some surprising consequences of that for connections, clone(), aborts, and timeouts.

Gábor Koós

Your AI Writes Tests That Pass but Prove Nothing. Fix It - Wallaby CLI makes test generation 10x smarter with live coverage and runtime data, using 3x fewer tokens. One skill to install.

Wallaby Team sponsor

10 Anti-'Slop' Moves for Frontend Projects - A walkthrough of automated checks that cut how much code you have to review, covering OpenAPI codegen, layer boundaries, mutation testing, and using CI to make it all stick.

Yuri Mikhin (Evil Martians)

The Browser's Main Thread is Expensive - A thorough look, complete with demos, at spending your main thread time well, including splitting, batching, prioritizing, and deferring tasks, then getting work off it entirely.

Lee Sun-Hyoup

📄 Why I Ported Moonshine to JavaScript - Pete's low-latency speech to text runtime now runs in the browser to avoid round trips to a server. Pete Warden

📺 How Can Someone Actually Change JavaScript? - A 2-minute explainer from a TC39 delegate. Mikhail Barash

🛠 Code & Tools

Dropzone.js 6.x: The Drag and Drop Uploader Returns - A major update for the library that handles the browser side of drag and drop uploading. After a 5 year(!) beta, v6.0, 6.1, and 6.2 landed over two days, bringing no dependencies, smaller bundles, and fixes for chunked uploads that could corrupt files.

Mat Simon

Rslib 1.0: A Build Tool for Shipping JavaScript Libraries - From the Rspack team, a unified build pipeline that handles the irritating parts of publishing packages, like getting ESM and CJS working side by side, Module Federation output, and component CSS across React, Vue, Svelte and Solid.

Chenwei Dai, Elecmonkey, et al.

Balance build time with your time - Our technologists do meaningful work, and we give them the support to have a meaningful life, too.

Fidelity Careers sponsor

vgpu: Render WebGPU Shaders in the Browser or Node.js - Provides a way to use the same shader in the browser or render headlessly with Node (to a high-resolution PNG or MP4 video). WGSL modules import and export like TypeScript does.

Vercel

SimpleWebAuthn 14.0: Now with Post-Quantum Passkeys - The passkeys library now verifies post-quantum ML-DSA passkeys and, on Node 24.7 and up, prefers ML-DSA-44 at registration by default.

Matthew Miller

• ESLint Config Inspector 3.4 - Adds timing analysis making it easier to identify the rules slowing down your lint runs.

• GPUIX 0.7 - Build native GPU-accelerated desktop apps with React and TypeScript atop the framework used by Zed.

• memlab 2.0.5 - Meta's framework for finding memory leaks in both browser and Node.js JavaScript apps.

• 🎵 Astro LilyPond - Build-time rendering of text to musical notation for Astro.

• 📊 vue-echarts 8.3 - Vue.js component for Apache ECharts.

📢 Elsewhere in the ecosystem

• ✨ GitHub has a new privacy-safe star history API, so charting a repo's growth over time no longer means scraping or approximating it. Star-History shares a little more background and you can use it to chart projects' star counts, as above (for example).

• Robin Wieruch argues that, due to the advent of agentic coding, building things from primitives rather than high-level libraries makes more sense, using D3 vs Recharts as an example.

• You don't need initial-scale=1.0 in your viewport meta tag, claims Declan Chidlow, as it worked around quirks in old versions of iOS.

• Got a browser-compatibility pain point? Submit it as an Interop 2027 idea (by September 23).

• 👕 TIL you can buy official Vue.js merch!