We'll do a talk about @npmx.dev together with @danielroe.dev at Web Engines Hackfest in A Coruña next week! Looking forward to meet our friends from @igalia.com and the browser engines dev world there!

🦀 I did a thing... what do you think? github.com/rust-lang/cr... #rustlang

The @npmx.dev team will be at Local-First Conf! We'll do a talk together with @willow.sh! See you this July in Berlin 🙌

Today, VoidZero joins Cloudflare. Vite remains MIT, vendor-neutral, and stewarded by the same wider team. The same goes for Vitest, Rolldown, and Oxc. Cloudflare is also committing $1M to an OSS fund to support independent development in the Vite ecosystem.

👀

Angular v22 released today and ships with day-one support on Netlify. Upgrade @netlify/angular-runtime to v4.0.0. The runtime handles the new allowedHosts and trustProxyHeaders config automatically, so deploy previews and forwarded headers just work. www.netlify.com/changelog/20...

We just published 7 CVEs identifying security vulnerabilities in React Router and Remix v2 We recommend updating to the latest appropriate versions: - React Router v7 -- 7.16.0 - React Router v6 -- 6.30.4 - Remix v2 -- 2.17.5 Details, links, and package ranges are listed below

New game: guess the package from its redacted @npmx.dev timeline graph. First correct answer gets a $20 donation to an OSS project or maintainer of their choice.

🛡️ we've just released v4.4.7 and v3.21.7, fixing seven coordinated-disclosure security advisories 👉 this includes all vulnerabilities we've been notified of through @anthropic.com's Project Glasswing, as well as a number by external researchers. github.com/nuxt/nuxt/s...

I've been using @npmx.dev a lot in the past days to handle a bunch of updates on a project with a lot of outdated dependencies. Can't stress enough how good it is, great work to everyone involved 👏

7 React Router security vulnerabilities were just disclosed. The two DoS issues have minimal impact on Netlify thanks to our autoscaling serverless architecture, but affected apps should upgrade to react-router 7.15.1. What you need to know: www.netlify.com/changelog/20...

@npmx.dev changelogs are incredible. Was looking to see what had changed while updating packages and the changelog tab was so natural it took me a few days to realize that it was a new feature. Huge thanks to @wilco.npmx.social this is an awesome feature.

One benefit of @npmx.dev that I didn't realize - outdated dependency indicators are potential avenues for new contributors, instead of just warnings. Thanks @yusukebe.bsky.social! (pr)

Update: SvelteKit has shot up from #10 to #6, with #4 just within reach; @vite.dev has stolen the #2 position from @nuxt.com; @svelte.dev's lead has grown and appears increasingly insurmountable 📈.

happy pride month 🎉

💯 Oh wow, great job @voidzero.dev on this new(?) page: oxc.rs/compatibilit.... Until now it was a pain to find the current status for any given combo at any given time. 💡 Here's a free idea: let me click a cell in this table to subscribe to updates and send me an email when that status changes.

🍿 To follow the dramatic battles in real time: pdsls.dev/jetstream?co...

New on @npmx.dev: 🥇🥈🥉 npmx.dev/leaderboard/... Why? Honestly, because we can just do fun things on the web. 🍿 Will the crown get to @rich-harris.dev's head? Will @danielroe.dev point out that ackshually SvelteKit is a fairer comparison and look how low the poor thing is? Will Astronauts organize?

I can't possibly drop $999.99 on it, but someone should definitely do something clever with iceberg.tips. Too good of a domain to pass up.

Stating what was never the bottleneck was never the bottleneck

Next big donation is pnpm, the package manager powering the majority of my projects. @zkochan's thankless work has been essential to the web dev ecosystem. $3,000 honestly feels cheap for how much his work has benefitted me.

Has anyone spotted this new badge in the wild yet on @npmx.dev? It can only be found on a select few packages and leads to something whimsical. But which packages? Obviously it's the ones wi◼️◼️ ◼️◼️◼️ ◼️o◼️◼️ ◼️◼️k◼️◼️.

console.log("happy birthday, @nodejs.org!")

@rspack/core is now 2.6 MB smaller than the previous release, and 17.8 MB smaller than v1.0. Love the new npmx graph for visualizing this trend. 📉

happy ending! Netlify’s support team helped me identify the underlying issue, which I fixed, and they’re refunding the bandwidth overage costs 💜 grateful for excellent customer support from @taylorbar.net

yo dawg I heard you like changelogs

🚀 Wow, this is finally happening! npm plans to block postinstall scripts by default in a future release In the near future (phased rollout), we will likely get a warning github.com/npm/cli/pull...

in the next version of pkg.pr.new, published npm packages will show an @npmx.dev button directly in the commit details panel!

🥹

For the last *9 hours*, @github.com git operations have been failing with cryptic auth errors ~5% of the time on @netlify.com, @vercel.com, and presumably everywhere. Not a peep on githubstatus.com. 🥺 Make it stop. --- www.netlifystatus.com/incidents/4l... www.vercel-status.com/incidents/jm...

the replacements.fyi site now lets you drop a package.json into it to see which dependencies can be replaced with native functionality, or more performant choices 🎉

Heads up for Nuxt users: The Nuxt team disclosed four CVEs yesterday, including a route middleware bypass. Upgrade to nuxt 3.21.6 or 4.4.6 as soon as possible. Full breakdown of impact on Netlify deployments in the changelog. www.netlify.com/changelog/20...

In [email protected], we added a new report page "Maintainer Actions", which lists actionable changes for package maintainers to move the ecosystem forward. With pre-constructed prompts to copy if you want agents to do that for you. github.com/antfu/node-m...

The first episodes of the new @atproto.com Off Protocol podcast are out! Listen to episode 1, where @jimray.locket.computer talks with @zeu.dev, @danielroe.dev, and @patak.cat about how the community banded together and pushed 1K PRs in 2 weeks to build npmx.dev 🤍

100 days of ./ npmx

The @netlify.com security team has been monitoring today's npm supply chain breach. Thank you @socket.dev for the great intel! We've reached out to a small set of affected customers. Sites created by Agent Runners unaffected (all deps pinned). We have no evidence that Netlify itself is affected.

We at TanStack just had a major attack against our Router packages. We have a postmortem out now explaining what happened and how we mitigated the response: tanstack.com/blog/npm-sup... No other TanStack packages outside of the Router monorepo were impacted

That was fast!

⚠️ You may want to check once more. The list keeps growing. It's up to 385 packages now. @socket.dev have added a CSV export for your scripting convenience 🥲.

⚠️ If you use any TanStack package in any of your projects and there's any chance any of them was updated today, stop what you're doing and read this. ... Actually there are 121 non-tanstack packages affected as well, so check the list anyway.

It's so beautiful. p.s. @npmx.dev is still just in alpha 🫢

I absolutely *love* the timeline feature of @npmx.dev I realized in a new project that I didn't have the @types installed for eslint-config-prettier, despite having it in another project So I could verify in 2 clicks that this change actually happened and confidently remove a dependency!

If you have any Next.js sites, upgrade them now! Yes, yet again. Check out platform-specific guidance: @netlify.com → www.netlify.com/changelog/20... @cloudflare.social → developers.cloudflare.com/changelog/po... @vercel.com → vercel.com/changelog/ne...

If you were still unsure whether the Mythos announcement was just a marketing stunt: hacks.mozilla.org/2026/05/behi... Prepare.

okay wait a sec has anyone ever thought of creating atproto records as presence pings and then WebRTC for p2p realtime comms? you'd get a full decentralized thingy without needing a centralized thingy for the presence thingy. is that anything

Switched @badrap/valita to ESM-only, pretty cool how @npmx.dev celebrates the package size reduction 🎉 npmx.dev/package/@bad...

Huge thanks to @natemoo.re, @philippeserhal.com, and @nickgraynews.bsky.social, who recently started sponsoring my open-source work! I’ve spent most of the last 5 years working on OSS, and this support means a lot. It's not an easy path, but this trust helps me keep going long-term.

It seems silly but features like this are important because tangled is *dogfed on tangled*, so the quality of tangled impacts how maintainers and OSS contributors can improve tangled itself. 🔁 I gave up on opening some issues on the tangled repo because I couldn't attach a screenshot of the issue.

Node.js v26.0.0 is out 💚 Temporal API enabled by default, V8 14.6, Undici 8, and key deprecations as we keep modernizing the platform. Check it out nodejs.org/en/blog/rele...

@vitest.dev is going framework agnostic, and we need your feedback!