1/ For newcomers, it would be easiest if they could simply deploy (as in “upload”) Node.js apps that write to the file system and everything works.

CSS wish: inner breakpoints 2ality.com/2025/09/css-...

Write good commit messages. Yes, even when you’re working on a solo project or one where you work with just one or two other people. Your memory isn’t as good as you think it is (almost no one’s is!) and you’ll be glad you wrote it down. Tonight’s example for me was this: github.com/true-myth/tr...

Neat CSS game by @sandroroth.com: “CSS Selectors Playground” selectors.sandroroth.com

Good talk about recent new CSS features by @matuzo.at: “That’s not how I wrote CSS 3 years ago” [It *is* how he wrote CSS 2 years ago 😀] Link that skips CSS history: www.youtube.com/live/L668dK6...

ECMAScript excitement 😉 @jason-williams.co.uk from TechAtBloomberg announces the release of Boa's Rust-based implementation of TC39 Stage 3 Temporal 🎉 Chrome estimates this will ship in Chromium 143 🎉🎉 Temporal is the shiny replacement for the broken JS Date API ✨

Experiment: I’d like to let beginners play with CSS selectors and wrote a small web app. rauschma.github.io/learning-web...

Proposal to add optional type annotations to JS: github.com/tc39/proposa... But I’m wondering: Wouldn’t it be better if browsers supported type stripping (like Node.js etc. already do): That feels cleaner to me. JSPM supports client-side type stripping (if extension is .ts): jspm.org/docs/cli/

ECMAScript excitement 😉 Congrats to @styfle.dev on advancing the Import Bytes proposal to Stage 2.7 today at TC39 🎉 It lets you import raw bytes as a readonly Uint8Array 👍 import bytes from "./photo.png" with { type: "bytes" } Similar APIs are already available in Deno, Bun, & bundlers.

I don’t think there is a simple way to insert a tab character in Visual Studio Code. I’m using this bookmarklet for now: javascript:{ navigator.clipboard.writeText('\t') .catch((error) => { alert(String(error)); }); }

1/ My “Learning Web Development” series is almost complete: • I’m amazed by how much people need to know to do web dev (even with as few tools as possible). • I *think* I managed to teach everything you need to know to be productive. And relatively quickly, too. 2ality.com/2025/08/lear...

🚀 BIG NEWS: We just open-sourced the Intelligent Command Center (ICC) for Node.js! After years of watching teams struggle with Node.js on Kubernetes, we're changing the game. The problem? K8s was built for Java/.NET, not Node.js's async model. The cost? 40% overprovisioning. 🧵

The good news I've been waiting for has finally arrived. github.blog/security/sup...

Learning web development: Creating web pages via HTML 2ality.com/2025/09/html... #2ality #WebDev #HTML

How would you take screenshots of HTML content for (e.g.) a book? I’m considering: • One “save to file” button per section. • <a download> plus github.com/niklasvh/htm...

How would you take screenshots of HTML content for (e.g.) a book? I’m considering: • One “save to file” button per section. • <a download> plus github.com/niklasvh/htm...

Interestingly, there is no simple way to replicate the following HTML with Markdown (without using HTML tags): <blockquote> <p> For myself, I am an optimist — it does not seem to be much use being anything else. </p> </blockquote> <div> — Winston Churchill </div>

I was wondering: Wouldn’t it be better to edit HTML and Markdown in a proportional font. That would help with questions such as “Is this an en dash or an em dash?”. Here are some answers: news.ycombinator.com/item?id=3691...

“[Wasm 3.0] has much better support for compiling high-level programming languages. Enabled by this, we have seen various new languages popping up to target Wasm, such as Java, OCaml, Scala, Kotlin, Scheme, or Dart, all of which use the new GC feature.” webassembly.org/news/2025-09...

ECMAScript excitement 😉 Next week's TC39 meeting has a packed agenda: 🔼 Amount 🔼 Array.prototype.pushAll 🔶 AsyncContext 🔶 Await Dictionary 🔼 Import Bytes 🔶 Intl Era Month Code 🔼 Iterator Chunking 🔶 new Global() 🔼 Non-extensible applies to private 🔼 Promise Adoption 🔼 Promise Predicate 🔶 Temporal

Visual Studio Code: The refactoring “Rename Symbol” (F2) works with JavaScript functions and HTML elements.

In practice, what users notice more is which engines support which features, tracked here: webassembly.org/features/ But the spec reaching a final/complete state is an important milestone for standardization. And most of those new features are already very widely supported.

In Apple’s Notes·app, you can now export to and import from Markdown. www.macrumors.com/how-to/ios-i...

Protection against Supply Chain Attacks Before heading off to @squiggleconf.com I recorded a video about the recent NPM-related supply chain attacks with the goal to tell you how to protect yourself and your team from them as good as possible. Including a high-level overview & actionables 👏🏻

Learning web development: Version control via Git and GitHub 2ality.com/2025/09/git-... #2ality #WebDev

Early npm and Node.js design decisions resulted in the biggest software ecosystem in existence, for the most used programming language in the world. We shouldn't pretend this is a net bad thing. But yes, it came with tradeoffs. A more competent current steward could have mitigated these tradeoffs.

Would love to see more packages deprecated on npm So many have deprecation notices in their readme but haven't actually been deprecated. I wonder what the reason for that is 🤔

The WebAssembly 3.0 spec is complete! webassembly.org/news/2025-09... This includes major features like GC, 64-bit memories, exceptions, and tail calls.

For Europeans: This website tells you how to protest against the planned Chat Control law which would have significant negative consequences for Europe. You can switch languages: fightchatcontrol.eu

Learning web development: Markdown 2ality.com/2025/09/mark... #2ality #WebDev #Markdown

Published an article about mitigating supply chain attacks with pnpm pnpm.io/supply-chain...

Learning web development: Native package managers 2ality.com/2025/09/nati... #2ality #WebDev

Robert Redford has died. 😢 One recent movie of his that I can recommend: “Our Souls at Night”—a cute romantic movie where the protagonists are older (something you don’t see often). www.imdb.com/title/tt5034...

Spent more time working on Immer perf this last week+. Did the initial PRs to migrate to Vitest, add the perf benchmarks, and tweak hotspots. Now, I've been diving deeper and trying to rewrite the "finalization" logic based on approaches used by other libs. Still very WIP, but seems promising!

reminder that node-modules.dev shows whether a package is trusted or published w/ provenance node-modules.dev

Another npm supply chain attack. Hopefully npm will add measures to make installing packages safe(r) again. pnpm has already added one (*). socket.dev/blog/tinycol... (*) github.com/pnpm/pnpm/re...

Honestly serious: JUST DON'T UPDATE PACKAGES RIGHT NOW. It is unclear to me yet, but this is looking pretty wide spread. Better be safe than sorry, just go touch some grass.

Latest Safari—it’s good to see it support the following web features: • SVG icons: webkit.org/blog/17333/w... • Support for WebGPU: webkit.org/blog/17333/w...

After recent npm supply chain attacks, @pnpm.io 10.16 adds a setting for delayed dependency updates. Tools like Taze and npm-check-updates are testing similar “maturity” options, hinting at a cautious new trend in #JavaScript package management. socket.dev/blog/pnpm-10... #NodeJS

On my Mac, `gh auth` (GitHub CLI) works really well: It logs me in globally (as if I had used ssh-add). Same on Windows? Background: I’m exploring how to explain GitHub to beginners. For myself, I use ssh-add, but for beginners gh auth seems simpler.

Learning web development: Authenticating users with plain Node.js 2ality.com/2025/09/auth... #2ality #WebDev #JavaScript #NodeJS

On my Mac, `gh auth` (GitHub CLI) works really well: It logs me in globally (as if I had used ssh-add). Same on Windows? Background: I’m exploring how to explain GitHub to beginners. For myself, I use ssh-add, but for beginners gh auth seems simpler.

I’m surprised this isn’t included in web crypto API: const password = "…"; const salt = generateSalt(); const hashedPassword = await hash(password, salt); const isVerified = await verify(password, hashedPassword, salt); console.log(isVerified); github.com/brielov/crypto

pnpm v10.16.0 adds "minimumReleaseAge", a setting for defining how long a version has to have been published before pnpm will install it. A nice countermeasure against accidental installs of short-lived compromised packages before they get taken down. Not a 100% fix, but a great additional step!

Is there a very simple authentication library that works with plain Node.js (=not a middleware for Express etc.)? http-auth (*) fits the bill; alas authentication will be unsafe should someone decide to deploy via HTTP. (*) github.com/gevorg/http-... Audience: beginners doing first experiments.

I’m curious if Node’s ESM customization hooks (*) will (or even can) eventually make it to browsers. (*) nodejs.org/api/module.h...

Learning web development: Implementing web servers 2ality.com/2025/09/impl... #2ality #WebDev #JavaScript

New audio drama: “Star Trek: Khan” www.youtube.com/playlist?lis...

#TypeScript: This will simplify my tsconfigs a lot: “Enable --strict by default” github.com/microsoft/Ty... /via @frontenddogma.com

Preact without a build step: rauschma.github.io/learning-web... I have to say I really like `html` tagged templates: No new JavaScript syntax (vs. JSX) but still fairly intuitive to use.