Reporting the same security issue to pnpm vs bun: pnpm acknowledged it quickly, shipped a fix, backported it, and published an advisory. bun never acknowledged, silently fixed this and another issue I reported, has not published advisories. One takes security more seriously.

beautiful new docs site at dax.land for @dsherret.bsky.social's dax, one of my very favorite tools. I write nearly all my scripts in TypeScript because of it

The latest version of dax (dax.land) can show a scrolling view of the last N lines when executing a command. This is especially useful when running multiple commands in parallel.

Released gagen 0.5, which simplifies the output to match dependabot.

I've found maintaining GitHub Actions workflow files is much easier when it's generated from Typescript. The latest realization is that the output yaml file can act like a lockfile. So I maintain `actions/checkout@v6`, but the generated output gets locked to a hash.

Due to terrible GitHub availability, dprint formatting plugins on plugins.dprint.dev are now served directly instead of redirecting to GH assets. Additionally, the plugins are now cached indefinitely by the server, which eliminates the risk of a repo disappearing.

Released jsonc-parser 0.32, which allows deserializing via serde to a concrete type. It's also much faster.

Last Monday was my last day at Deno. It was a privilege to work with such talented colleagues. The standard library has been my passion for years. I've reviewed all PRs since 2023 and learned a lot from them. Proud to see it often mentioned as one of the best parts of Deno.

My last day at Deno was this week. I really enjoyed maintaining the language server and working with the CLI team, and I'm sure they will keep building great things. Looking for new work in the space of native-backed JS/TS tooling, or something new!

Yesterday was my last day at Deno. I'm sad to leave but I'm proud of everything the team and I were able to build. I'm glad I had the opportunity to work with some of the most talented people I've met. I wish them all the best! I'm actively looking for my next challenge, my DMs are open!

Today is my last day with the Deno team 🦕💖💔 I know they're gonna keep making awesome things. But now *I* need to make awesome things for someone else! If you're looking for a DevRel with a JS focus and extra sparkle, get in touch!

Marvin is another lovely talented person I had the pleasure to work with who you should try and snag for your company if you can!

Yesterday was my last day at Deno. I'm going to transition from two days a week to full time on a business I cofounded in the auto glass industry. My plan is to increase my contributions to my personal open source projects and keep contributing features/fixes to Deno that I need or want.

John is an absolutely incredible UX design expert. If you are looking for someone who can come up with, implement, and test your UX flows, you should hire him.

Yesterday I updated my bio as I'm no longer with the #1 🦕-themed javascript company. I'm sad to go but excited to see what's next. I've spent the last few years designing exclusively in code, building agent skills, working on command-line tools, and crafting dev docs experiences. Hit me up.

Snap him up

Also merged a perf improvement to the sharp pkg's install script. Once released, it will make all pkg managers faster installing Next.js with lifecycle scripts when brew is installed (except Bun because it overrides the maintainer's decision and always skips the install script)

I've wanted this for so long - and @kettmeir.dev has finally implemented it! View changes in the public API of packages between versions: - what methods were added, changed (type signature), or removed In the future we could even indicate if you are about to publish a breaking change

dprint's incremental formatter is incredibly fast and happens without needing an opt-in. You can use both oxc and biome via dprint for faster performance.

It's good npmx.dev shows git and https dependencies. I still think it's crazy npmjs.org doesn't.

I didn't want a terminal based solution, so I vibe coded a desktop app to give the status of all my AI sessions regardless of where they're running and I can click to quickly jump to them.

Additionally, pnpm 11 will block dependencies from exotic sources (like Git) in subdependencies.

How to bypass minimum dependency/release age: 1. Publish an npm package with an unpinned git dependency. 2. Get usage and wait many months. 3. Push a malicious commit to the git dependency's repo.

The deno and dprint vscode extensions now prompt when a custom executable path is set in the workspace configuration. I believe this should help reduce the chance of malicious config launching an executable in a trusted workspace.

Vibe coded a website to give a summary of our frequently failing and flaky tests on the CI.

dprint 0.51 (code formatter) is out. This release adds initial support for formatting with a global config file. github.com/dprint/dprin...

In the Deno repo, we have a custom Rust test runner for our tests in order to support file/directory-based tests and improve stability on the CI. I just refactored the code to have a pty reporter that surfaces some useful information. It seems better than having failures whizz by.

Did something fun; used @tinygo.org to shove @mvdan.cc's wonderful gofumpt into @dsherret.bsky.social's amazing dprint formatter via a Wasm plugin. We previously used an "exec" plugin to do this with go tool, but it was slow to run, and worse in parallel (and... Windows 😑). Now it's fast!

The next Deno release will include Node type declarations out of the box.

In his talk at #EuroRust25, @kettmeir.dev shared how the @deno.land project improved error handling by migrating from the anyhow crate to using thiserror and concrete error types – watch it on YouTube now! 🦀 👉 youtu.be/f6eofqicw_s #RustLang #RustConference #EuroRust

Wrote a library this weekend for modifying JSONC files david.deno.dev/posts/jsonc-...

Stuck in an elevator with @snek.dev, @littledivy.com, @bartlomieju.bsky.social, @magurotuna.bsky.social, @dsherret.bsky.social, @kettmeir.dev, and Nathan

🌟 Speaker Spotlight: David Sherret @dsherret.bsky.social will walk us through the JSR package registry: why it exists, how it improves on previous approaches such as HTTPS specifiers, and the design decisions behind its module resolution. Schedule, speakers & more info: squiggleconf.com

Importing bytes and texts: ✅ adds to your module graph ✅ type checking ✅ works with deno bundle and deno compile deno.com/blog/v2.4#im...

Type checking text and bytes imports is now working.

Should have importing files as text and bytes ready for Deno 2.4 -- will be unstable because it hasn't been standardized.

This is now published to JSR as a rolldown plugin: jsr.io/@deno/rolldo...

Got bundling JSR/Deno code with Rolldown working. This is using Rolldown's and Deno's crates respecting Deno's lockfile, config discovery, and resolution. Finally Deno's crates have been refactored enough for this to be feasible (~500 LOC). I'll update with more details later.

I've come across so many bugs caused by using wildcard matches in Rust. Even though it can be verbose, I think it's better to avoid them in most cases so that adding a new enum variant causes compiler errors, forcing you to re-evaluate each match.

It was getting difficult to debug Deno's npm resolution so I wrote a tool to help visualize each step it makes.

My closing keynote from Rust Nation UK last week is now online: "Microsoft is Getting Rusty: A Review of Successes and Challenges"

Neat to see software I used to work on and features I helped implement in Severance.

Lint plugins are now available 🎉

Beware: npm doesn't show non-npm dependencies in the dependencies tab. Check out this package—npm lists it as having zero dependencies, but if you look at the package.json, it definitely has dependencies.

Did some work on the url Rust crate the past two days and got it parsing a 400 character URL more than twice as fast (still have a few PRs not merged).

I feel like making node resolution "just work" leaves the JS ecosystem in a worse place.

@jsr.io is now openly governed — meet its board members and check out its governance charter 👇 deno.com/blog/jsr-ope...

TypeScript <5.7 on left, TypeScript 5.7 on right. Glad this seems to work lol. Anyone have a better solution for dealing with Uint8Array being generic now?

Worked on this slowly over 5 months, but Deno's config discovery and module resolution logic has been extracted out of the CLI and into a re-usable crate (not yet published). Also a few days ago this setup code was hundreds of lines, but now it's only a few.

Wasmbuild is getting simpler thanks to Wasm imports.