ESLint v10 ships with a Node.js version requirement that necessitates `require(esm)`, yet the package remains CJS only. Why?

Finally finished building my personal website entirely with Vibe Coding! sxzz.dev If you’d like to exchange friend links, let me know!

I wanna say this out loud. A few months ago, I told Evan that @voidzero.dev should stop sponsoring me. I burned out, and I couldn't help Vite as before. But they decided to continue supporting me while I was down. And by doing so, they helped me get back on my feet sooner. Thank y'all ❤️

Just shipped stackblitz-mcp — my first vibe coding project! An MCP server that lets AI read StackBlitz projects. Useful when you ask AI to debug a GitHub issue and the repro is a StackBlitz link. stackblitz-mcp.sxzz.dev

tsdown now has an official AI skill! Install it: npx skills add rolldown/tsdown Your coding agent will know how to configure builds, generate declarations, set up CI validation, bundle WASM, and more. tsdown.dev/guide/skills

Working with TypeScript is far more complex than dealing with the JS runtime itself, and the effort involved is often underestimated. Examples: Volar.js, rolldown-plugin-dts

unplugin v3 has been released! - Drops CJS build, now ESM-only, and requires Node.js >= 20.19.0 - Adds Bun support (thanks to @alistair.bsky.social) github.com/unjs/unplugi...

After upgrading to @babel.dev v8, tsdown's startup time decreased by ~50ms.

🎉 tsdown v0.20 has now shipped, with Rolldown 1.0 RC!

🦀 Calling all Rustaceans! We’re migrating Rolldown `fake-js` plugin to Rust to supercharge build speeds! 🚀 We currently use Babel but want to move to Oxc for better performance. Check the issue ⬇️ github.com/sxzz/rolldow...

Finished two retrospective blog posts on the journey of require(esm) before 2025 ends: joyeecheung.github.io/blog/2025/12... joyeecheung.github.io/blog/2025/12...

🥳 Happy new year from UTC+8! github.com/sxzz/ts-star...

npm's broken UI bugged me enough I wrote a userscript to fix them, and added some features too. Repo: github.com/bluwy/npm-us... Here's a before-and-after comparison:

I feel the dilemma is, that I feel responsible for being friendly and welcoming to make the experience nicer for newcomers to OSS, who may not yet know the manner well. But with AI messing this up, it's really hard to tell if it's a human behind I should take care or just AI doing terrible work.

I think the package.json file should include a field `inlineDependencies` to record the dependencies of inline bundles and separately calculate their download size. e18e.dev/blog/bundlin...

Hello friends and welcome to a new “How is ESM vs CJS going!” 33.4% of the popular packages on npm now includes ESM. Up from 29.6% half a year ago. We have a third! ESM-only is up from 11.5% to 12.6%. This is also the impact of half a year of Node 18 being EOL, making `require(esm)` available

tsdown v0.17 is land now!

⚡️ The first Vite 8.0 beta is here! - Powered by Rolldown, bringing significantly faster production builds and more consistency - New features such as tsconfig paths or emitDecoratorMetadata support - Bumping browser targets aligned with Baseline Widely Available Read more in our announcement post!

Three years ago, frustrated with performance, I offhandedly said, “Wait until TS gets rewritten.” Today, it finally happened.

We've got some updates on TypeScript 7! The new native port - can type-check any project - supports --build and --incremental - has rich editor features implemented - is still 10x faster and is ready for you to try today! devblogs.microsoft.com/typescript/p...

tsdown v0.17 is coming soon with some exciting updates: - Completely rewritten watch mode for blazing fast performance - Get build output directly without writing to disk - Override configs for different formats - Detects CI environments, features can be toggled for CI or local use ...🧵

I'm signing the @opensourcepledge.com, it's time to give back to the maintainers of the projects @nuqs.dev depends on. I just gave 2700€ ($3,212) to 18 maintainers & projects I use, love, and want to support. Happy Thanksgiving! 💖 nuqs.dev/blog/open-so...

🚀 tsdown just hit 3k stars on GitHub! Thank you all for your amazing support!

💁 Start using it in bundlers today. import text from './text.txt' with { type: 'text' } import bytes from './image.png' with { type: 'bytes' } github.com/unplugin/unp...

When I said that, I had no idea what would happen next: "I think we can use fdir and picomatch to create a new library for lightweight glob, enhancing maintainability."

tsdown v0.16.0 is out now, featuring Vite DevTools integration! Just install `@vitejs/devtools` and run `tsdown --debug` for an early preview. Big thanks to @antfu.me, @arlo7.me, and @hyf0.bsky.social for their help!

😱 tsdown just crossed 1M monthly downloads! 🚀

Time to: fnm default v24

Node.js 25 is here! We have upgraded V8 to 14.1, bringing major JSON.stringify performance improvements and JIT pipeline optimizations. This release introduces the permission model --allow-net, Web Storage is enabled by default, and more! nodejs.org/en/blog/rele...

Watch @sxzz.dev demonstrate tsdown, the elegant library bundler. The key features, design philosophy, and how it simplifies/streamlines library development. Full video in comment ⏬

The Unified Toolchain for the Web We are thrilled to announce Vite+: A unified, Rust-powered toolchain and drop-in upgrade for @vite_js. Read the full vision and learn about our sustainable licensing model (free for individuals, OSS & small businesses). voidzero.dev/posts/announ...

Securing my npm publish workflow! 🔐 Migrating all my packages from local releases to a CI process using npm's Trusted Publishing (Provenance). It's incredibly easy with @sxzz.dev reusable GitHub workflow. Pure magic! ✨ github.com/sxzz/workflo... #npm #GitHubActions #CI #Security #OpenSource

What an excellent group 🙌 Best part of meetups and conferences @viteconf.org

Glad to see TypeScript's Isolated Declarations feature already mentioned in three talks this morning at @viteconf.org 👍 It's one of the reasons tsdown and Oxc can generate Type Declarations so quickly ⚡ The main ID developer @titiancernicova.bsky.social is here if you wish to meet him.

we now have some new @e18e.dev docs on best practice of publishing npm packages this documents the recommended basics for a secure publish workflow and gives some pointers for further security/tools/etc this is a _very_ opinionated subject, so do ping me if you have feedback!

Do you prefer `.mjs` or `.js` for Node libraries? I used to favor `.js`, but `.mjs` seems to improve toolchain performance. Since Node will support CJS for the foreseeable future, we need an easier way to tell ESM and CJS apart. github.com/rolldown/tsd...

The good news I've been waiting for has finally arrived. github.blog/security/sup...

POV on how you set up Trusted Publisher for npm as a maintainer of a giant monorepo... thanks npm for being... so manual... Thanks @sxzz.dev for the userscript to make things a lot easier! github.com/sxzz/userscr... I also made a small script to open the tabs: github.com/antfu/open-p...

Simply use this plugin to make your import statements more efficient, with no configuration required github.com/sxzz/rolldow...

TIL: For better performance, avoid importing TypeScript compiler and Babel packages as ESM 😱 use `require()` instead!

1. Never manually enter your GitHub or npm password; use a Passkey instead. 2. Enable npm 2FA for both authorization and publishing. 3. Use trusted publishing and remove all npm CI tokens. 4. Only invite maintainers who follow these security practices.

All the packages affected by this attack had not enabled trusted publishing and provenance. - The top four packages were all impacted. - More than half of the top ten packages were affected. github.com/sxzz/npm-top...

🚨 Breaking: npm author Qix compromised. Malicious package versions published in projects that typically see hundreds of millions of downloads each week. Details: socket.dev/blog/npm-aut...

looks like @sxzz.dev is doing great work pushing people to use trusted publishing! happy to see e18e folks helping out too

taze now includes npm provenance downgrade checks to help prevent attacks similar to those previously experienced by Rspack.

To enhance security of publishing npm packages locally, I’ve enabled 2FA for publishing `npm profile enable-2fa auth-and-writes` To make the process both secure and convenient, especially for 1Password users, I created a package that automatically enters the OTP code for you. github.com/sxzz/unotp

⚡ Speaker highlight: Kevin Deng, Creator of tsdown When it comes to publishing and packing libraries, there are tons of things to consider. Luckily, @sxzz.dev built an all-in-one solution! Meet tsdown and learn about automatic dts generation, dependency analysis, multi-format output and more!

set up 41 packages today to use OIDC trusted publishing on @npmjs.bsky.social today! it didn’t take long at all and worked on the first try. death to long lived tokens! thanks npm