🚀 pnpm v10.21 is out! This release introduces two powerful new security & compatibility features: 1️⃣ Automatic Node.js runtime installation for dependencies 2️⃣ Configurable trust policy for detecting supply-chain downgrades 🧵👇

"Let me use sed" is the new "Hold my beer"

Lodash is entering a new chapter 📖 With investment from @sovereign.tech the project is getting key updates for security, modernization, and community-led governance. Details: hubs.la/Q03NrdfR0

Introducing Socket Firewall: free, proactive protection for your software supply chain @dale.link @socket.dev socket.dev/blog/introdu... #ECMAScript #JavaScript

🚀 Socket now integrates with Bun 1.3’s new Security Scanner API! @bun.sh users can now protect their projects from malicious packages, typosquatting, & other supply chain attacks. Great to see Bun moving fast to protect devs with this new API! socket.dev/blog/socket-...

🚨 Update: The "Shai-Hulud" supply chain attack has expanded to nearly 500 trojanized npm packages, including several from CrowdStrike, all using the same malware first seen in Tinycolor. Full details and package list: socket.dev/blog/ongoing... #NodeJS #JavaScript

After recent npm supply chain attacks, @pnpm.io 10.16 adds a setting for delayed dependency updates. Tools like Taze and npm-check-updates are testing similar “maturity” options, hinting at a cautious new trend in #JavaScript package management. socket.dev/blog/pnpm-10... #NodeJS

In the past week "minimumReleaseAge" was added to pnpm 10.16.0 and also "maturity-period" added to taze 19.6.0 🙌

pnpm v10.16.0 adds "minimumReleaseAge", a setting for defining how long a version has to have been published before pnpm will install it. A nice countermeasure against accidental installs of short-lived compromised packages before they get taken down. Not a 100% fix, but a great additional step!

🚨 Using setImmediate() in your Node.js apps? You might be creating silent performance bombs that only explode in production. Our latest webinar breaks down why this "simple" async function is one of the most misunderstood tools in Node.js 🧵👇

URLPattern is about to land in all browsers! 🎉 The only problem is it's slow to match URLs against a large set of patterns by linearly scanning. So I just made url-pattern-list: a utility that parses patterns into a efficient prefix-tree for 2-30x faster matching! 😲 www.npmjs.com/package/url-...

🚨 Active supply chain attack on npm: Multiple Prettier tooling packages were compromised through the phishing campaign we published about just hours ago. Watch out for more compromised accounts and malicious packages. Follow-up: socket.dev/blog/npm-phi... #nodejs #npm

We're thrilled to announce the first stable release of Oxlint - version 1.0! Our Rust-powered JavaScript/TypeScript linter delivers 50~100x faster performance than ESLint with 500+ rules and zero configuration required. Time to give it a try! voidzero.dev/posts/announ...

A tip I learned from a client this week: Before closing out an AI agent coding session, ask the agent to update your copilot-instructions.md file with what it learned. That saves time by adding context for future prompts.

github.com/eslint/eslin... It is *wild* how simple that change is for that kind of startup perf boost 😍

ESLint enables the V8 compile cache by default in Node.js v22+. The result on my machine is a load time reduction of around 90%.

a game where you play a buddy duo called Chick and Nugget - sick 3D platformer! - everything is made out of crafting materials - levels open, unfold, rotate - theme song by Banjo-Kazooie composer - voice cast ft the voice of Sly Cooper PaperKlay, coming 27th May, please DM for codes

ECMAScript excitement 😉 Node.js 24 LTS ships these new JS features 🎉 🔶 Atomics.pause 🔶 Error.isError 🔶 Explicit Resource Management (`using`) 🔶 Float16Array 🔶 Intl.DurationFormat 🔶 Promise.try 🔶 RegExp.escape 🔶 RegExp Modifiers 🔶 RegExp Duplicate Named Capture Groups

✂️ Knip v5.54.0 is out → Use `--fix --format` to format modified files, using Formatly and your project's formatter + config ✨ → Support aliases from plugins, added for Vite, Vitest & webpack (`resolve.alias`) → Simplified plugin development (removed `resolveEntryPaths`, use only `resolveConfig`)

Node.js 24 is here and it's looking good 😎🚀 Featuring updates to V8 v13.6, npm v11, improved Permission Model and more new features in the blog. Check it out and let us know what you think: hubs.ly/Q03lfLDC0

Super excited to share what I've been working on lately. Socket can now automagically fix security alerts with an autopilot mode ⚡🪄📦

🔥 Launch Day 5: We’re so excited to launch socket fix — a CLI tool that automatically upgrades vulnerable dependencies, runs your tests, and even auto-merges safe updates in CI. From alert to merged fix. Zero friction.

🚀 Big news! Socket is acquiring Coana, bringing best-in-class reachability analysis to modern SCA! Coana's technology reduces false positives by up to 80%, letting teams focus on vulnerabilities that actually matter. #AppSec 1/4

We got it working 💪

Announcing Oxlint Beta: oxc.rs/blog/2025-03...

Neat little TypeScript trick: If you have a string or number type that you have some default/known values for: type Role = "alert" | "alertdialog" | string TypeScript will simplify the type to just: Role: string However if you wrap it like `string & {}` you'll preserve the autocompletions

🚀 Big news for npm users! Socket and Seal Security collaborated on resolving a critical 3-year-old npm overrides bug, and the fix just shipped in version 11.2.0. → socket.dev/blog/npm-ove... #NodeJS #JavaScript

🚀 Big news for TypeScript! Microsoft is porting the TypeScript compiler to Go, delivering 10x faster builds, lower memory usage, and snappier editor performance. A huge leap forward for developers! socket.dev/blog/typescr... #golang #TypeScript

When you're very proud of the feature your team have shipped, even though no one wants it. 😅

Very excited to see oxvg, a Rust-based alternative to SVGO powered by Lightning CSS and other browser-grade components from Servo! Has the potential to be not just faster, but also optimize better. ⚡️ github.com/noahbald/oxvg

🚀 We just launched `$ npx reproduce <pkg>`

The @vlt.sh team launched "reproduce" today, an #OSS tool that verifies if npm packages match their source code. With recent supply chain attacks exposing provenance limitations, this approach is already showing better adoption rates than traditional methods. ➳ socket.dev/blog/vlt-lau... #JavaScript

ECMAScript excitement 😉 Congrats to @goose.icu on advancing the Math.clamp proposal to Stage 1 today at TC39 🎉 github.com/CanadaHonk/p...

New adventure in Node SEA holds state internally/can be passed around. Fun because it means I can store data & then pass it around without worrying about things like files being missing. Basically an old style virtual image system you can copy and pass around. Function persistence needs work tho.

Automated security tools won this one. We can't continue closing issues and CVEs every day, telling users that the security issue esbuild dev server doesn't affect vite. We'll release a minor in a couple of days with esbuild 0.25 to avoid the false positive security reports.

🚀 Big news for Node.js developers! require(esm) has been backported to Node.js 20, removing a major roadblock for ESM adoption. With Node 18 nearing EOL, library maintainers can finally go ESM-only with confidence. 🎉 socket.dev/blog/require... #NodeJS #JavaScript

Yes you were able to put the contents of a package json in the top of a JS file. I don’t remember the specific requirements or such and I’m kind of assuming the feature is gone now. I remember always having trouble finding docs for it even back then

❌ el.classList.includes("foo") ✅ el.classList.contains("foo") ✅ [].includes("foo") ❌ [].contains("foo") JavaScript is so humbling some days. Curse you mootools.

🎉🎉🎉

I used to be tired. Now with smartwatches, I’m tired with data

Me (learning TypeSpec): This looks simple and clean, I'm so happy TypeSpec: I deprecated the deprecated decorator so you can use deprecated features while you deprecate. Me: ... typespec.io/docs/standar...

Node 20 is getting all the require(esm) goodies unflagged now 👀 github.com/nodejs/node/...

📦 Just released sbommage, a friendly terminal UI for exploring SBOMs! Built with Python/Textual, it handles SPDX, CycloneDX, and Syft formats. Works great for quickly poking around in your SBOMs without fighting with JSON viewers. Check it out:

I too have come to this conclusion but instead when camel case gets funky I move to snake case or a hybrid of camel snake

This is such a nice feature! Really pleased to ship this one.

Introducing Slow Roads 2.0 - procedurally-generated, scenic roads for endless driving zen. Built with @threejs.org to run in your browser - no installs, no ads, just roads. Play free at slowroads.io #threejs #webgame #javascript #procedural #webgl

We’ve landed urlpattern to node.js! 3 year old GitHub issue for requesting this is now closed. @lemire.bsky.social github.com/nodejs/node/...

Been wondering why a bunch of sites have been SUPER slow lately. Turns out it's the @1password.bsky.social chrome extension doing really bad things. :/ Gonna have to disable for awhile.

y’all @monteslu.com gave a talk about this at @halfstackconf.bsky.social and revealed at the end that all the slides were running as a “game” on the device 🤯