tsdown v0.16.0 is out now, featuring Vite DevTools integration! Just install `@vitejs/devtools` and run `tsdown --debug` for an early preview. Big thanks to @antfu.me, @arlo7.me, and @hyf0.bsky.social for their help!

😱 tsdown just crossed 1M monthly downloads! 🚀

Time to: fnm default v24

Node.js 25 is here! We have upgraded V8 to 14.1, bringing major JSON.stringify performance improvements and JIT pipeline optimizations. This release introduces the permission model --allow-net, Web Storage is enabled by default, and more! nodejs.org/en/blog/rele...

Watch @sxzz.dev demonstrate tsdown, the elegant library bundler. The key features, design philosophy, and how it simplifies/streamlines library development. Full video in comment ⏬

The Unified Toolchain for the Web We are thrilled to announce Vite+: A unified, Rust-powered toolchain and drop-in upgrade for @vite_js. Read the full vision and learn about our sustainable licensing model (free for individuals, OSS & small businesses). voidzero.dev/posts/announ...

Securing my npm publish workflow! 🔐 Migrating all my packages from local releases to a CI process using npm's Trusted Publishing (Provenance). It's incredibly easy with @sxzz.dev reusable GitHub workflow. Pure magic! ✨ github.com/sxzz/workflo... #npm #GitHubActions #CI #Security #OpenSource

What an excellent group 🙌 Best part of meetups and conferences @viteconf.org

Glad to see TypeScript's Isolated Declarations feature already mentioned in three talks this morning at @viteconf.org 👍 It's one of the reasons tsdown and Oxc can generate Type Declarations so quickly ⚡ The main ID developer @titiancernicova.bsky.social is here if you wish to meet him.

we now have some new @e18e.dev docs on best practice of publishing npm packages this documents the recommended basics for a secure publish workflow and gives some pointers for further security/tools/etc this is a _very_ opinionated subject, so do ping me if you have feedback!

Do you prefer `.mjs` or `.js` for Node libraries? I used to favor `.js`, but `.mjs` seems to improve toolchain performance. Since Node will support CJS for the foreseeable future, we need an easier way to tell ESM and CJS apart. github.com/rolldown/tsd...

The good news I've been waiting for has finally arrived. github.blog/security/sup...

POV on how you set up Trusted Publisher for npm as a maintainer of a giant monorepo... thanks npm for being... so manual... Thanks @sxzz.dev for the userscript to make things a lot easier! github.com/sxzz/userscr... I also made a small script to open the tabs: github.com/antfu/open-p...

Simply use this plugin to make your import statements more efficient, with no configuration required github.com/sxzz/rolldow...

TIL: For better performance, avoid importing TypeScript compiler and Babel packages as ESM 😱 use `require()` instead!

1. Never manually enter your GitHub or npm password; use a Passkey instead. 2. Enable npm 2FA for both authorization and publishing. 3. Use trusted publishing and remove all npm CI tokens. 4. Only invite maintainers who follow these security practices.

All the packages affected by this attack had not enabled trusted publishing and provenance. - The top four packages were all impacted. - More than half of the top ten packages were affected. github.com/sxzz/npm-top...

🚨 Breaking: npm author Qix compromised. Malicious package versions published in projects that typically see hundreds of millions of downloads each week. Details: socket.dev/blog/npm-aut...

looks like @sxzz.dev is doing great work pushing people to use trusted publishing! happy to see e18e folks helping out too

taze now includes npm provenance downgrade checks to help prevent attacks similar to those previously experienced by Rspack.

To enhance security of publishing npm packages locally, I’ve enabled 2FA for publishing `npm profile enable-2fa auth-and-writes` To make the process both secure and convenient, especially for 1Password users, I created a package that automatically enters the OTP code for you. github.com/sxzz/unotp

⚡ Speaker highlight: Kevin Deng, Creator of tsdown When it comes to publishing and packing libraries, there are tons of things to consider. Luckily, @sxzz.dev built an all-in-one solution! Meet tsdown and learn about automatic dts generation, dependency analysis, multi-format output and more!

set up 41 packages today to use OIDC trusted publishing on @npmjs.bsky.social today! it didn’t take long at all and worked on the first try. death to long lived tokens! thanks npm

Good news from ESLint! The 10 years old parallel linting issue is finally resolved. Issue: github.com/eslint/eslin... PR: github.com/eslint/eslin...

tsup is not actively maintained anymore 👀 With >9M NPM monthly downloads and >10k GitHub stars, tsup is undeniably a popular choice for bundling. Unfortunately, it is not under active maintenance anymore. Thanks to @egoist.dev & contributors for all the work on tsup 🙏🏻

We encourage everyone to migrate from using npm publish tokens to trusted publisher! github.com/e18e/ecosyst...

😈 I removed all CI npm tokens and switched to using trusted publishing. github.blog/changelog/20...

🚀 Rspack is now available on bundler.sxzz.dev! Feel free to give it a try. ✨ The diff feature will be added soon—stay tuned! 👀

Node excitement 😉 Congrats to @marcoippolito.dev on today's landmark Node 22.18 release. It is the first LTS release to ship unflagged TypeScript support 🎉 This means Node can run *.ts files. It pairs well with TypeScript's "erasableSyntaxOnly" flag 👍 Many folk contributed 🙏

🌟 Give it a try! Experience the `try expression` Stage 0 syntax (by @arthurfiorette) effortlessly integrated into all your favorite toolchains—VSCode, TypeScript, ESLint, Prettier, Vite, and more! 🔗 github.com/sxzz/tc39-tr...

I’m sponsoring @sxzz.dev ! Thanks to everyone I sponsor for the help and inspiration you’ve given me in OSS 💚 github.com/sponsors/sxz...

Introducing a new syntax in JavaScript or TypeScript is incredibly challenging. It has the potential to disrupt entire toolchains, including TypeScript, Babel, Prettier, and ESLint. 💡 Exciting news—I'm working on making something happen!

vue-router build powered by tsdown + rolldown ✨

🚨 npm phishing alert! Attackers are sending emails from spoofed [email protected] addresses linking to a typosquatted clone site (npnjs.com) to steal credentials. This attack is designed to hijack npm accounts. Careful with those email links: socket.dev/blog/npm-phi... #nodejs #JavaScript

It has been 603 days from the first line of Vapor's code to its release today! 🥹 github.com/vuejs/core/c...

New Pride spotlight from @thisismissem.social 🌈💚 She shares how coming out and contributing to open source shaped her journey in tech. Read it here: nodejs.org/en/blog/comm...

Sponsored some individuals. Many thanks to the open-source community for all the support!

rolldown-plugin-dts is the very first to integrate tsgo, and it’s the most powerful tool for dts integration out there! 🦾

🚀 Try it out! Experimental TypeScript Go support is now available in rolldown-plugin-dts. github.com/sxzz/rolldow...

Today we are excited to announce Rolldown-Vite: a technical preview of the version of @vite.dev entirely powered by the Rust stack we built over the past year (Oxc + @rolldown.rs) voidzero.dev/posts/announ...

Hey @thealexlichter.com, What's tsdown? 👀 www.youtube.com/watch?v=FF1o...

Community highlights ✨ - @deno.land's Brief History of JS - @stefanjudis.com on JSON imports - @aduh95.bsky.social on node.config.json - @sxzz.dev on tsdown unbundling - @jakebailey.dev at Gophercon - @roman.nurik.net's Google Slides code highlighter - @amilajack.bsky.social Electron perf tips

🚀 Unbundle mode has landed on tsdown! Try it out now! tsdown.dev/options/unbu...

🤩 Wow! Vite is now powered by tsdown! github.com/vitejs/vite/...

Instead of inferring bundler entry points from `package.json` exports, why not let your bundler generate them for you? With tsdown, you write less boilerplate and always have correct exports—even no publint needed! 🔗 tsdown.dev/options/pack...

Just migrated Vue Macros to the #tsdown workspace mode — it's now 4x faster compared to tsup! (Used to take 20s, now only 5s 🚀) 🤯 On my machine, it finished in just 1 second! (10 CPU cores) My exploration journey: - tsup + dts: 76s - tsup + Oxc isolatedDeclarations: 20s - tsdown: 5s!

Even @egoist.dev, the author of tsup, has started using tsdown 🫡 github.com/egoist/walk-...