npm's broken UI bugged me enough I wrote a userscript to fix them, and added some features too. Repo: github.com/bluwy/npm-us... Here's a before-and-after comparison:

I feel the dilemma is, that I feel responsible for being friendly and welcoming to make the experience nicer for newcomers to OSS, who may not yet know the manner well. But with AI messing this up, it's really hard to tell if it's a human behind I should take care or just AI doing terrible work.

I think the package.json file should include a field `inlineDependencies` to record the dependencies of inline bundles and separately calculate their download size. e18e.dev/blog/bundlin...

Hello friends and welcome to a new “How is ESM vs CJS going!” 33.4% of the popular packages on npm now includes ESM. Up from 29.6% half a year ago. We have a third! ESM-only is up from 11.5% to 12.6%. This is also the impact of half a year of Node 18 being EOL, making `require(esm)` available

tsdown v0.17 is land now!

⚡️ The first Vite 8.0 beta is here! - Powered by Rolldown, bringing significantly faster production builds and more consistency - New features such as tsconfig paths or emitDecoratorMetadata support - Bumping browser targets aligned with Baseline Widely Available Read more in our announcement post!

Three years ago, frustrated with performance, I offhandedly said, “Wait until TS gets rewritten.” Today, it finally happened.

We've got some updates on TypeScript 7! The new native port - can type-check any project - supports --build and --incremental - has rich editor features implemented - is still 10x faster and is ready for you to try today! devblogs.microsoft.com/typescript/p...

tsdown v0.17 is coming soon with some exciting updates: - Completely rewritten watch mode for blazing fast performance - Get build output directly without writing to disk - Override configs for different formats - Detects CI environments, features can be toggled for CI or local use ...🧵

I'm signing the @opensourcepledge.com, it's time to give back to the maintainers of the projects @nuqs.dev depends on. I just gave 2700€ ($3,212) to 18 maintainers & projects I use, love, and want to support. Happy Thanksgiving! 💖 nuqs.dev/blog/open-so...

🚀 tsdown just hit 3k stars on GitHub! Thank you all for your amazing support!

💁 Start using it in bundlers today. import text from './text.txt' with { type: 'text' } import bytes from './image.png' with { type: 'bytes' } github.com/unplugin/unp...

When I said that, I had no idea what would happen next: "I think we can use fdir and picomatch to create a new library for lightweight glob, enhancing maintainability."

tsdown v0.16.0 is out now, featuring Vite DevTools integration! Just install `@vitejs/devtools` and run `tsdown --debug` for an early preview. Big thanks to @antfu.me, @arlo7.me, and @hyf0.bsky.social for their help!

😱 tsdown just crossed 1M monthly downloads! 🚀

Time to: fnm default v24

Node.js 25 is here! We have upgraded V8 to 14.1, bringing major JSON.stringify performance improvements and JIT pipeline optimizations. This release introduces the permission model --allow-net, Web Storage is enabled by default, and more! nodejs.org/en/blog/rele...

Watch @sxzz.dev demonstrate tsdown, the elegant library bundler. The key features, design philosophy, and how it simplifies/streamlines library development. Full video in comment ⏬

The Unified Toolchain for the Web We are thrilled to announce Vite+: A unified, Rust-powered toolchain and drop-in upgrade for @vite_js. Read the full vision and learn about our sustainable licensing model (free for individuals, OSS & small businesses). voidzero.dev/posts/announ...

Securing my npm publish workflow! 🔐 Migrating all my packages from local releases to a CI process using npm's Trusted Publishing (Provenance). It's incredibly easy with @sxzz.dev reusable GitHub workflow. Pure magic! ✨ github.com/sxzz/workflo... #npm #GitHubActions #CI #Security #OpenSource

What an excellent group 🙌 Best part of meetups and conferences @viteconf.org

Glad to see TypeScript's Isolated Declarations feature already mentioned in three talks this morning at @viteconf.org 👍 It's one of the reasons tsdown and Oxc can generate Type Declarations so quickly ⚡ The main ID developer @titiancernicova.bsky.social is here if you wish to meet him.

we now have some new @e18e.dev docs on best practice of publishing npm packages this documents the recommended basics for a secure publish workflow and gives some pointers for further security/tools/etc this is a _very_ opinionated subject, so do ping me if you have feedback!

Do you prefer `.mjs` or `.js` for Node libraries? I used to favor `.js`, but `.mjs` seems to improve toolchain performance. Since Node will support CJS for the foreseeable future, we need an easier way to tell ESM and CJS apart. github.com/rolldown/tsd...

The good news I've been waiting for has finally arrived. github.blog/security/sup...

POV on how you set up Trusted Publisher for npm as a maintainer of a giant monorepo... thanks npm for being... so manual... Thanks @sxzz.dev for the userscript to make things a lot easier! github.com/sxzz/userscr... I also made a small script to open the tabs: github.com/antfu/open-p...

Simply use this plugin to make your import statements more efficient, with no configuration required github.com/sxzz/rolldow...

TIL: For better performance, avoid importing TypeScript compiler and Babel packages as ESM 😱 use `require()` instead!

1. Never manually enter your GitHub or npm password; use a Passkey instead. 2. Enable npm 2FA for both authorization and publishing. 3. Use trusted publishing and remove all npm CI tokens. 4. Only invite maintainers who follow these security practices.

All the packages affected by this attack had not enabled trusted publishing and provenance. - The top four packages were all impacted. - More than half of the top ten packages were affected. github.com/sxzz/npm-top...

🚨 Breaking: npm author Qix compromised. Malicious package versions published in projects that typically see hundreds of millions of downloads each week. Details: socket.dev/blog/npm-aut...

looks like @sxzz.dev is doing great work pushing people to use trusted publishing! happy to see e18e folks helping out too

taze now includes npm provenance downgrade checks to help prevent attacks similar to those previously experienced by Rspack.

To enhance security of publishing npm packages locally, I’ve enabled 2FA for publishing `npm profile enable-2fa auth-and-writes` To make the process both secure and convenient, especially for 1Password users, I created a package that automatically enters the OTP code for you. github.com/sxzz/unotp

⚡ Speaker highlight: Kevin Deng, Creator of tsdown When it comes to publishing and packing libraries, there are tons of things to consider. Luckily, @sxzz.dev built an all-in-one solution! Meet tsdown and learn about automatic dts generation, dependency analysis, multi-format output and more!

set up 41 packages today to use OIDC trusted publishing on @npmjs.bsky.social today! it didn’t take long at all and worked on the first try. death to long lived tokens! thanks npm

Good news from ESLint! The 10 years old parallel linting issue is finally resolved. Issue: github.com/eslint/eslin... PR: github.com/eslint/eslin...

tsup is not actively maintained anymore 👀 With >9M NPM monthly downloads and >10k GitHub stars, tsup is undeniably a popular choice for bundling. Unfortunately, it is not under active maintenance anymore. Thanks to @egoist.dev & contributors for all the work on tsup 🙏🏻

We encourage everyone to migrate from using npm publish tokens to trusted publisher! github.com/e18e/ecosyst...

😈 I removed all CI npm tokens and switched to using trusted publishing. github.blog/changelog/20...

🚀 Rspack is now available on bundler.sxzz.dev! Feel free to give it a try. ✨ The diff feature will be added soon—stay tuned! 👀

Node excitement 😉 Congrats to @marcoippolito.dev on today's landmark Node 22.18 release. It is the first LTS release to ship unflagged TypeScript support 🎉 This means Node can run *.ts files. It pairs well with TypeScript's "erasableSyntaxOnly" flag 👍 Many folk contributed 🙏

🌟 Give it a try! Experience the `try expression` Stage 0 syntax (by @arthurfiorette) effortlessly integrated into all your favorite toolchains—VSCode, TypeScript, ESLint, Prettier, Vite, and more! 🔗 github.com/sxzz/tc39-tr...

I’m sponsoring @sxzz.dev ! Thanks to everyone I sponsor for the help and inspiration you’ve given me in OSS 💚 github.com/sponsors/sxz...

Introducing a new syntax in JavaScript or TypeScript is incredibly challenging. It has the potential to disrupt entire toolchains, including TypeScript, Babel, Prettier, and ESLint. 💡 Exciting news—I'm working on making something happen!

vue-router build powered by tsdown + rolldown ✨

🚨 npm phishing alert! Attackers are sending emails from spoofed [email protected] addresses linking to a typosquatted clone site (npnjs.com) to steal credentials. This attack is designed to hijack npm accounts. Careful with those email links: socket.dev/blog/npm-phi... #nodejs #JavaScript

It has been 603 days from the first line of Vapor's code to its release today! 🥹 github.com/vuejs/core/c...