A while ago I reported a security advisory for a project I maintain. Does that mean the advisory is going to be there forever? Can I close it at some point? The vulnerability is fixed. That counter on the GitHub Security tab is annoying.

Haha awesome. I got some free swag for making contributions to @vscode.dev.

🌐 next-intl 4.5.8 is out! Improvements for useExtracted: → Handle multiple calls to useTranslations and useExtracted → Avoid conflict with existing useTranslations import → Append newline with .json formatter

I don’t like LLM code reviews. Sometimes they’re wrong. Now you need to convince your teammates of this. Sometimes they’re right. Typically these things are also caught by other tooling, or they are just annoying nitpicks. Sometimes it’s actually useful. I don’t like to be outsmarted by the LLM.

Today is Black Friday, and there’s only one thing left that can still bring America together: DEALS. To celebrate, we're once again offering the biggest deal there is...99% OFF! www.99PercentOffSale.com

I reported an npm issue to limit lifecycle scripts from dependencies. Yesterday’s attacks were scary.

Reporting spam on @github.com should take less effort than posting spam

🌐 next-intl 4.5: useExtracted → For humans & AI → Next.js-first by design → Full Turbopack support → SWC-based parsing

Thank you @webpro.nl for sponsoring my work on unified and mdxlint! 💖

I really look forward to seeing navigator.preferences land in browsers. That means websites can finally make proper dark mode toggles.

as a condition of funding, we were asked to affirm that we wouldn’t undertake any diversity, equity, and inclusion work, whether or not we used the government funds to do so. The PSF simply couldn’t agree to that statement,

PDFs are not good digital forms. Don’t use them like that.

This issue to add builtin dotenv support to @vscode.dev needs 20 👍 reactions to be accepted. Existing dotenv extensions just don’t cut it. Give it a 👍 reaction and reshare if you would like to see this happen.

Wil je niet dat LinkedIn je profiel gebruikt om AI te trainen? Ga dan naar deze pagina: www.linkedin.com/mypreference...

🚀 Node SDK v4 is here! We've completely rebuilt it with TypeScript-first design: ✨ Full Robot definitions with autocomplete 🔧 Structured error handling with context 📦 Pure ESM, Node.js 20+ support 🛡️ Runtime validation for safer deployments with Zod

This issue to add builtin dotenv support to @vscode.dev needs 20 👍 reactions to be accepted. Existing dotenv extensions just don’t cut it. Give it a 👍 reaction and reshare if you would like to see this happen.

Neat! @zed.dev is getting MDX support.

In a monorepo, people can run @eslint.org either from the project root, or per workspace. I see both in practice. I have my own recommendation, but I don’t want to influence other people in this thread. @humanwhocodes.com I’m curious to hear what your take is on this.

Introducing mdxlint, a new tool to lint and format MDX files based on unified-engine. It’s compatible with remark plugins. CLI: github.com/remcohaszing... Language server: github.com/remcohaszing... @vscode.dev extension: github.com/remcohaszing...

Introducing mdxlint, a new tool to lint and format MDX files based on unified-engine. It’s compatible with remark plugins. CLI: github.com/remcohaszing... Language server: github.com/remcohaszing... @vscode.dev extension: github.com/remcohaszing...

I’m expecting a package tomorrow. I already know I won’t be home then. Neither the sender nor the delivery company will let me change the date or delivery address. Their email says it’s fine. My package will be delivered to a pick-up point if I’m not home. I just feel bad for the delivery guy.

The FUCK AI talk I gave at @amazefest.bsky.social is now available for everyone to see. In this talk I explain in layman's terms how the so-called AI actually works so that you can draw your own conclusions. Spoiler: it's dumber than you think. www.youtube.com/watch?v=gqP-...

I came up with a nice pattern to render multiple optional sections of MDX content as child components. remcohaszing.nl/blog/optiona...

I’m not sure how I feel about `tsc --init` basically ts-ignoring all declaration files as of TypeScript 5.9. I understand users just want to get on with building their own thing, but this also hides the opportunity for people to contribute type fixes upstream.

It’s really cool to be working on variable font sizes, improved line wrapping, and RTL support in Monaco editor / @vscode.dev. Also fun to learn about RTL and learn how it fits in this mostly LTR world.

I really want PreferenceManager to land in major browsers. It’s the missing piece in support for dark mode and other preferences on the web.

Yay! My @nextjs.org PR was merged. Now the docs no longer falsely claim that useMDXComponents() accepts any arguments.

I just had Copilot pop up in VSCode. It’s not really obvious how to disable it. There doesn’t seem to be a setting. I hope this helps someone: View → Appearance → Secondary Side Bar

👊 Now you're playing with power. Brick Power! #LEGO #LEGOGameBoy Pre-order today: ninten.do/6014s13js

cc @eslint.org @prettier-eslint.bsky.social Attention!! I was tricked by a phishing email and a npm token was added and leaked then some popular packages I'm maintaining were released with malicious software, I've deleted the leaked token and deprecated all bad versions and released new versions.

TIL using real (#) private properties in TypeScripts results in the (literal) #private property appearing in the compiled declaration file. This adds all sort of weirdness, such as type errors in the IDE, but not in tsc. @stripInternal doesn’t work on private properties.

A while ago I reported my first security advisory on GitHub for a library I maintain. Now it has a persistent counter on the security tab of the repo. Is it supposed to work like that? That’s kind of annoying TBH.

I’m pretty sure the answes is no, but is it possible to implement TypeScript constructor type overloads using class syntax? In other words: Can the following Connection variable be implemented as a regular class?

Thank you for sponsoring me @eslint.org @humanwhocodes.com! My recent contribution to ESLint only feels small compared to all the things ESLint has done for me 💖

Slack markdown support is so bad 😔

@nextjs.org finally merged my PR that makes the mdx-components file optional 🎉 Earlier it just crashed with a cryptic error message if that file was missing.

We just got a new box

Lately I’ve been using MDX more again as a web developer. This is great, as now I’m dogfooding the plugins and dev tooling.

How it’s going with ESM vs CJS today: 29.6% of the popular packages on npm now includes ESM. Up from 28.8% a quarter ago. ESM-only is up from 10.8% to 11.5%. It’s perhaps all a bit soon after Node 18 became EOL on April 30, making `require(esm)` available everywhere. Maybe next quarter shows more

What do engineers and librarians have in common? SSH 🤫

2FA on Twitter is broken. I don’t mean it in a bad UX kind of way. They logged me out from a device and I had to either disable it or get premium in order to log in.

I’m a bit confused about this RSC detail. This component renders fine, but the server responds with an internal server error. Does this means the components marked with 'use client' are allowed to use the DOM, but not the module?

Semantic HTML looks pretty decent by default, assuming you add: <meta content="light dark" name="color-scheme"> The only thing that I really don’t like is the default standard font. This is really the only must-have CSS: html { font-family: system-ui; }

AI is trained on outdated information. It gives you outdated results. This makes users confidently echo the outdated information on the internet. This outdated information will be used to further train the AI.

package-lock.json locks node_modules. bun.lock locks node_modules. pnpm-lock.yaml locks node_modules (in their own unique way). yarn.lock locks dependency ranges.

I’m happy to see people are moving to ESM-only now, but this has been possible since Node.js 10 went EOL. Support for require(esm) in all maintained Node.js versions, doesn’t mean legacy build tooling suddenly supports it now. The biggest difference, is that ESM can now be imported synchronously.

Thank you for sponsoring me via GitHub sponsors @connortumbleson.com! 💖

> It's generally best to publish only 1 format, either CJS or ESM. Not both.

May the fourth be with you