fidzu : javascript

#​809 - November 3, 2026

Read on the Web

JavaScript Weekly

The AI Cost of JavaScript Frameworks

Nolan Lawson had Claude build the same app five times in each of twelve JS stacks to test common "X is better for agents" claims. Costs varied significantly between runs, and Gautam Parab found that the observed cost ranges overlapped or touched for most pairs of frameworks.

But a clearer difference was in the median amount of JavaScript sent to browsers: 0KB for Astro, 18K for Hono+htmx, 36K for SvelteKit, and 115-142K for React Router, TanStack Start and Next.js. If you've gone "hands-free", Nolan asks, why stick to a particular stack you chose when you wrote all the code? His benchmark is on GitHub to try for yourself.

Nolan Lawson

Run AI Coding Models on Your Own Machine - Local models are now good enough for everyday coding. Learn to run them on your own Mac or GPU, wire them into your editor and terminal agents, and keep your code private with no per-token bill.

Master.dev sponsor

Why Is This Fingerprinting Script 'Creating Bioweapons'? - A crawl of sites to collect canvas fingerprinting examples (which you can see, visually, at fingerprint.garden) found an anti-analysis technique where JavaScript identifiers were named after… taboo topics, with a prompt hidden in invisible Unicode, all designed to make LLMs refuse to work on the code!

Veritas

💡 Canvas fingerprinting is a technique that uses quirks of how different clients render canvas elements, in order to distinguish browser environments.

IN BRIEF:

• 😄 Bartosz shares a creative way to generate strings and run code without parentheses or quotes. Good old JavaScript fun!

• 📊 GitHub's Octoverse 2026 report has TypeScript as the most used language on GitHub by contributors (with JS at third), and ~44% of merged TypeScript PRs showing AI involvement. Plus a lot more besides.

• GitHub Actions will block pull_request_target by default in public repos from December 2, unless an event policy explicitly allows it, with brownouts on November 9 & 16.

• Cloudflare Workers now supports the Temporal API natively behind a temporal compatibility flag. It'll be available by default from December 1.

RELEASES:

• Node.js v27.0 (Alpha) and v26.13.0 (LTS) - Node 26 is now the 'Lithium' LTS line, and 27 is the first ever Node 'alpha'. Under Node's new release process, every line spends six months in alpha before going Current.

• Vitest 5.1 - A new --since-last-run flag reruns only tests affected by your edits, plus there's an interactive snapshot review feature.

• Rspack 2.3 - The Rust-based webpack alternative adopts SWC Next and its rewritten parser. The team reports 5-20% faster builds and less peak memory use.

• Leaflet 2.0 Beta 1 - The mapping library's first major in a decade goes tree-shakeable, ships TypeScript types, and drops its default export.

• Effect 4.1, pnpm 12.17, ESLint 10.14.0, Nuxt DevTools v4

📖 Articles and Videos

"No, npm, 'estee' is not a typo of 'testem'" - Shane tried to publish a CLI called estee and hit npm's typosquatting filter, which (as best as we can tell) rejects names within a small Levenshtein distance of popular packages' names.

Shane Friedman

Shrinking clarity.js: When Cleaner Code Gzips Worse - Microsoft let an agent run 50+ size experiments on its analytics script. A big win came from dropping import * namespace objects, while good-practice refactors like extracting helpers actually made the gzipped output bigger.

Manu Nair (Microsoft)

Workshop: How to Implement Session Replay - Filters, custom tags, and sampling settings for finding the sessions that matter. Nov 5, 10am PT.

Sentry sponsor

'Nothing Installs at Our Company Until It's a Week Old' - Many recent package hijacks were caught within hours, so Bruno's company now makes new releases wait a week. He explains what this approach broke, what cooldowns don't stop, and settings for popular package managers.

Bruno Jurković

Timing Ten Design Systems, Then Fixing the Slow Ones - Den timed ten design systems (MUI, Ant Design, and Ionic among them) opening a 249-option select and ticking 100 checkboxes, then profiled the slow ones to find out why.

Den Odell

Using Bun? Dependabot Can't See Most of Your Dependencies - GitHub's dependency graph doesn't parse bun.lock, so Dependabot alerts cover only direct dependencies. Nicolas has some tips for improving matters.

Nicolas Charpentier (Shortcut)

📄 How Hard Is It to Check for Whitespace? - Why Java, Python and JavaScript disagree on what counts as whitespace. Sergey Tselovalnikov

📄 A Proposal: How to Hire Junior Engineers in the Age of AI - The npm co-founder thinks traditional coding interviews are dead. Laurie Voss

📄 How to Make postMessage Type-Safe in Under 350 Bytes Pavel Grinchenko (Evil Martians)

📄 The Web Can't Afford a JavaScript Runtime Monoculture Kate Holterhoff (RedMonk)

🛠 Code & Tools

Handwired: Compile Regular JavaScript into a Neural Net - A new mind-bender from Pretext's creator: a compiler that turns JavaScript into an exact network of ReLUs and matrix multiplies that run on the GPU. Demos include a 130-layer 'mini desktop' and a WebGPU search over 100K JSON documents.

Cheng Lou

Build Smarter JavaScript Applications With Live Search Data - Add search, shopping, maps, news, trends, flights and hotels results with a single developer-friendly JavaScript SDK.

SerpApi sponsor

🌐 x18n: Lint and Maintain i18n Files for Any Framework - Anthony Fu's successor to i18n-ally scans locale files and translation calls and reports missing, unused and broken keys (like how tsc --noEmit reports type errors).

Anthony Fu

djs: A New 'Suspend Anywhere' JavaScript Engine - Armin (of Flask fame) built an engine to run scripts in WebAssembly that can snapshot the VM's state and resume elsewhere, even mid-await.

Armin Ronacher

webframe: Run a Web Page Like a Command-Line Program - Point it at a URL or HTML file and it runs the page in a hidden system web view, piping console.log() to stdout and exceptions to stderr. No bundled browser or Playwright needed.

Jeff Lindsay

phoria2: A Small WebGL 2 Library for 3D Charts - A dependency-free 3D library aimed at dashboards and product viewers, with an API you can 'learn in an afternoon'. Plenty of live demos on the page.

Kevin Roast

• Shiki 4.6 - Powerful code syntax highlighter, now with faster decoration handling and compressed Oniguruma WASM binary.

• Preact 11.1 - A new preact/compat/compiler-runtime entry point lets code compiled by React Compiler run on Preact too.

• Postgres.js 4.0 - The popular Postgres client for Node, Bun and Cloudflare Workers gets a rewrite and goes ESM-only.

📢 Elsewhere in the ecosystem

• Chrome 157 is due today with the headline feature being HTML-in-Canvas for drawing live, interactive DOM elements into 2D, WebGL and WebGPU canvases. This feature has numerous striking applications.

• ☕ CheerpJ 5.0 brings Java 21 and 25 to the browser via WebAssembly, ships the full JDK so you can compile Java in a tab, and previews a new WasmGC-based engine the team hopes will run Minecraft and IntelliJ one day.

• 🤖 LLM-whisperer Simon Willison looks at the world of browser games being built with coding agents, and argues October was the point where agents got good enough to ship playable games.

• 🕹️ Talking of games… GitHub's game jam Game Off is back for its 14th year with the theme 'SHIFT'. Entries are due on itch.io by December 1.

#​808 - October 27, 2026

Read on the Web

JavaScript Weekly

TanStack AI 1.0: The Vendor-Neutral AI Toolkit Goes Stable - TanStack's framework-agnostic AI toolkit reaches 1.0, with stable APIs for chat, tools and media, plus 23 provider adapters. A new agent harness supports long-running sessions, but its APIs remain experimental.

Tuzlak, Herrington, et al. (TanStack)

Would You Let Your AI Agent Grade Its Own Homework? - Agents write code faster than ever. They even review their own work. But who's reviewing them? Dropbox, Notion & ElevenLabs don't take the risk. With Meticulous, every change is exhaustively verified, with zero developer effort.

Meticulous sponsor

Announcing TypeScript 7.1 Beta - TypeScript 7 gets a programmatic API, plus 'content mappers', a plugin point for checking code embedded in files such as Vue, Svelte, and Astro components. Also new are source phase imports and --target es2026.

Daniel Rosenwasser (Microsoft)

GTA.js: 1997's Grand Theft Auto, But in JavaScript - Bramus has been reimplementing the original top-down GTA's engine in JavaScript and WebGL, loading Liberty City from the game's original demo files. Play it here.

Bramus Van Damme

💡 Fittingly, Pat Kerr, whose 1996 Atari ST prototype formed the basis of the original game's vehicle physics, recently rebuilt it in JavaScript.

IN BRIEF:

• Deno's Bartek Iwańczuk says the team is working on getting Deno into a foundation. Meanwhile, a new fork, Ende, plans to drop Node compatibility and refocus on sandboxing.

• Safari 27.1 previews the Device Posture and Viewport Segments APIs behind feature flags on the iPhone Duo, letting JavaScript detect folds and inspect screen segments.

• Chrome 156 has reached stable and no longer caches module fetch failures, so a dynamic import() that fails due to a network or HTTP error can be retried.

RELEASES:

• Node.js v26.12.1 (Current), v24.22.1 (LTS) and v22.23.4 - Security releases fixing ten CVEs, including the 'Node2Shell' Brotli decoder flaw, which can lead to remote code execution when an app decompresses malicious data. (Also, Node 26 is due to become LTS tomorrow.)

• Bun 1.4.4 - Adds bun fmt, a Prettier-compatible formatter that uses your existing Prettier or oxfmt config. It's very fast.

• Electron 45 - Upgrades to Chromium 156, Node 24.22 and V8 15.6, and adds hooks for the Prompt API so apps can plug in a local model.

• pnpm 12.16, Remix 3.1, axios 1.21, Deno 2.9.8

📖 Articles and Videos

Parser Combinators in TypeScript, Built From Scratch - Parser combinators sit between regexes and heavyweight tools like tree-sitter. This animated, step-by-step walkthrough shows the basic elements of building them, concluding in an example turning ping output into typed objects.

Florian Schindler

Dead Code Shouldn't Exist: How Sentry Cut 28,000 Lines - A talk Dominik has given at six conferences this year, now as swipeable slides with a full transcript. He covers how unused code can cost more than you might think, and how Sentry used Knip to remove 28,000 lines.

Dominik Dorfmeister (Sentry)

AI.js Day 2026: Frontend's Scariest AI Questions, Live on Channel 13, Nov 13 - No hype, just the AI questions frontend devs are afraid to ask. Save your spot.

JetBrains sponsor

Building an Isolated Preview for AI-Generated HTML - Rendering model-written HTML in a srcdoc iframe runs it on your own origin. A security engineer breaks the naive approach, then rebuilds it using sandbox and a strict CSP, with demos showing what each one blocks.

Keshav Malik

A First Look at TypeScript 7.1's Content Mappers - TypeScript 7 ignores tsserver plugins, but 7.1's content mappers can turn non-TS files into TypeScript. Here's how they work, applied to CSS modules and .graphql files.

Jovi De Croock

📄 How Engines Turn Dynamic Objects Into Fast Field Access - Shapes and inline caches, explained with runnable sketches. Max Bernstein

📄 Software is Slow Because of Bad Design, Not Slow Languages Sean Goedecke (GitHub)

🛠 Code & Tools

Structs: TC39's Shared Structs Proposal, But Usable Today - A former TC39 delegate's implementation of the Stage 2 structs proposal. The idea is you get shared memory between workers, so threads can work on the same objects instead of serializing copies back and forth. There's a playground too.

Erik Arvidsson

Introducing TanStack Redact: A Slimmer React Runtime - A build plugin swaps React and React DOM for a smaller reimplementation in the browser with no code changes. It works with Vite, Start, Vinext and Next.js, and while TanStack reports 20-70% smaller client builds, rendering is synchronous only.

Tanner Linsley (TanStack)

AI Tests That Catch Real Bugs - AI can write low-value tests that pass without checking much. Wallaby helps your agent refine assertions and catch bugs.

Wallaby Team sponsor

Verdaccio 7.0: The Self-Hosted npm Registry Adds Staged Publishing and 2FA - A mature, lightweight way to self-host your own npm registry and proxy. v7 adds experimental staged publishing (where new versions need approval before going live) and 2FA, plus stricter ownership checks.

Verdaccio Team

Biome 2.6 Adds Markdown, YAML and SCSS Support - The Rust-powered alternative to Prettier and ESLint adds formatting support for Markdown, YAML and SCSS, along with initial linting support. JavaScript plugins for custom lint rules are available as a developer preview.

Biome Core Team

• ☕ CoffeeScript 2.7.1 - The first release in four and a half years brings Node 22+ fixes and with { type: 'json' } import attributes.

💡 If you never used CoffeeScript, it is/was a Ruby- and Python-flavored language that compiled to JavaScript. Brendan Eich held up its arrow functions and lightweight classes as models for what went into ES6 (ES2015).

• oxlint 1.89 - The Rust-based linter now counts the upstream recommended rules of its React, Vue, Next.js, Jest/Vitest, and other plugins as 'recommended' so expect more reports if you upgrade.

• Mutative 2.0 - Immer-style efficient immutable updates library. The author reports a 3.6x speedup over Immer across a benchmark suite.

• SonicJS 3.0 - Headless CMS for Cloudflare Workers, built on Hono. v3 rebuilds the data layer, auth and plugin system. Homepage.

• query-string 10.0 - Parse and stringify URL query strings. Now throws for values it can't represent.

• ShareDB 7.0 - Realtime database backend based on operational transformation.

📢 Elsewhere in the ecosystem

• 🔒 Node2Shell: ELLIO now reports exploit traffic in the wild for the Brotli RCE fixed in the Node releases (as mentioned earlier). The flaw is in Google's Brotli library, so bundled copies elsewhere need patching too.

• Sentry has given $1m to open source maintainers this year. JavaScript recipients include pnpm, TanStack, MSW, Knip and three Three.js maintainers, plus the OpenJS Foundation.

• 🎉 CSS-Tricks, the popular web dev resource, is independent again, now owned by longtime editor Geoff Graham.

• Arc, the design-led Chromium browser popular with developers, is being sunset with The Browser Company steering everyone to Dia.

• 📄 Google Docs can now open, edit and collaborate on Markdown files natively and Drive renders previews of them too.

#​807 - October 20, 2026

Read on the Web

JavaScript Weekly

tsrs: Cloudflare and VoidZero's Rust Port of TypeScript - A Rust port of the Go-based TypeScript 7 compiler, built with some input from the TypeScript team and heading into Oxc. Benchmarks claim up to 8x the speed of TypeScript 7.0 and it runs in WebAssembly. Experimental, but npx tsrs works.

Chen, Mitropoulos and Nakazawa (Cloudflare / VoidZero)

💡 Max Schwenk started the port with agents writing the code, and tells the full tale here, including how it took his company's typecheck from 80 seconds to 7.

Send Webhooks from Your TypeScript API in Minutes - One typed npm package, one call per event. Svix handles retries, signing, delivery logs, and a portal for your customers, so you don't build any of it. Resend sends 200M+ webhooks a year through it.

Svix sponsor

Thank You, Deno: Competition Keeps JavaScript Moving - Last week we covered Deno joining Cloudflare and the future of the Deno runtime. Deno was valuable, says Darcy, as it (and Bun) made the entire ecosystem better by pushing Node and npm to adopt its best ideas.

Darcy Clarke (vlt)

IN BRIEF:

• 🔒 Next.js has patched two critical RCE flaws: one in use cache functions via an upstream React Server Components bug and one in the image optimizer's SVG handling. Upgrade to 16.4.1 or 15.5.28; a public PoC is already out.

• 🔒 Node.js security releases are due tomorrow for the 26.x, 24.x and 22.x lines, with the highest severity issue rated high.

• Bun compiling JavaScript ahead-of-time, previewed a few weeks ago, now has a draft PR to produce binaries with no JIT or bytecode.

RELEASES:

• Node.js v26.12.0 (Current) and v24.22.0 (LTS) - 26.12 can now synchronously load most ES modules and marks the config file stable; 24.22 gains util.throttle and util.debounce.

• Astro 7.4 - Adds a --timings flag for astro build to see where build time is spent, plus experimental parallel prerendering across worker threads.

• React Router 8.5 - Deprecates its own view transition APIs in favor of React's <ViewTransition> component, and adds an experimental 'API-only' mode.

• Pretext 1.0 - Multiline text layout without touching the DOM. 1.0 ports browsers' own line breakers, so results more closely match what would render.

• React Native 0.88, Elysia 2.0 RC, ESLint 10.13, tsup 9.0, Vuetify 4.3

📖 Articles and Videos

The Tetris Script That Becomes Snake Once Prettified? - You'd think pretty-printers and deobfuscators at least leave a script's logic alone, but no. See how chaining semantic quirks in such tools can turn the 'cleaned up' output into a different program!

Robert Vähhi (TrustSig)

Do Web Components Have a Future If Nobody is Writing Them? - Nolan has spent years building and defending web components, so this thoughtful, if a little melancholy, piece carries some weight.

Nolan Lawson

Your CI Was Built for Humans. Your Agents Need Something Else - Expo is mobile AI infrastructure. Your agents build, test and ship iOS and Android apps in the background.

Expo sponsor

▶ ViteConf 2026: The Full Replay - Last week's ViteConf brought ~30 talks including Evan You's keynote on tooling in the agentic era, plus updates on Vitest 5, Vite DevTools, and a faster parser coming to Oxc. It's 10 hours, but there's a hero with timestamps in the comments.

ViteConf

💡 One of the bigger announcements: Void, the Vite team's full-stack SDK and deploy platform, is now open source.

How to Gaslight JavaScript Programmers (with Proxies) - Proxy, introduced as part of ES6 back in the day, has plenty of practical uses but can also make objects behave in curious, unexpected ways. Complete with live, editable examples.

Bryan Gillespie

How Miro Moved 70,000 Tests from Jest to Vitest - The story of moving ~70,000 tests across an 800-package monorepo to Vitest, with AI agents doing most of the laborious work.

Sergey Nikitin

📄 Upgrading to Zod 4 Cut Our Worker CPU by a Third - A Zod 3 to 4.5 migration at 100 million parses a day. Chris Arderne

📄 Using replace() as an Iterator - An old regex-callback-for-side-effects idiom, benchmarked against alternatives. Eugene Lazutkin

📄 Recursion is DEAD and HTML Killed It - Hands-on with Chromium's experimental Declarative Partial Updates proposal. Dave Rupert

📺 NightMonkey: Compiling JavaScript Ahead of Time to WebAssembly - An hour-long VMIL 2026 talk from a Wasmtime engineer. Chris Fallin

🛠 Code & Tools

Maplair: A Batteries-Included, Tree-Shakeable Fork of Leaflet - Still in alpha since last year, one of Leaflet's contributors has forked it, rolling in the 2.0 work plus rotation, fullscreen, search, heatmaps and more - all tree-shakeable.

Simon Legner

💡 The same day, Leaflet's creator posted a candid update about his experiences living in Ukraine and a plan to get Leaflet 2.0 released.

Embeddable DOCX, XLSX & PPTX Editor for Users and AI - Let your AI edit existing files via object-level APIs. Users review and keep editing the same file. Try Playground.

Thinkfree sponsor

📊 Chartist 2.0: The Lightweight SVG Charting Library Returns - A CSS-styled SVG charting library from 2014 that "went stale over the last years" makes a comeback with a composable API, server-side rendering to SVG, terminal charts, and still ~12KB gzipped for a line chart. There's a migration guide for 1.x users.

Gion Kunz et al.

Pele: Mermaid Diagrams as Lightweight, Themeable SVG - Zero-dependency renderer for the Mermaid diagram syntax with responsive layouts and SVG you can theme with CSS variables. Around a sixth the size of Mermaid.js. Try the playground.

Steph Ango (Obsidian)

<rich-input>: A Rich Input Field with GitHub-Style Search Filters - A web component for GitHub-style search boxes: free text mixed with autocompleted key:value filters, highlighted in place.

Bramus Van Damme

• Chokidar 6.0 - The file watcher behind much of JS tooling. Rewritten to check changes against the disk before reporting to avoid stray events after a burst of edits, say.

• Happy DOM 21.0 - Headless browser environment in pure JavaScript, popular for testing. Now blocks stylesheet and iframe loading by default.

• p-queue 10.0 - Promise queue with concurrency control. Now dependency-free and an EventTarget.

• Paper.js 0.13 and 0.14 - Vector graphics scripting framework for canvas. First notable releases in years. (Homepage with demos.)

• 🕹️ LittleJS 1.27 - Dependency-free HTML5 game engine that now does 3D too.

• 🖼️ Skia Canvas 4.0 - Canvas API for Node, built on Skia.

📢 Elsewhere in the ecosystem

• 🖼️ JPEG XL: The modern image format is now supported by all major browsers, with Firefox 158 the latest to enable it by default. Jake Archibald pits it against AVIF in this extensive review. What I find amazing is what it's able to render in under 100 bytes.

• NodeConf EU 2026: The ▶️ latest NodeConf EU talks are up, including James Snell's case for a common minimum API every runtime should support, plus sessions on V8 heap management and Emscripten and WebAssembly.

• A new social network: /dev/null is a GitHub-oriented social network for developers, built from scratch in 48 hours. It already has over 8000 members, including me. It's been a lot of fun so far!