❌ If you unit-test a React 19 app, there’s a good chance a chunk of your CI time is being wasted on… 😴 setTimeout. Wait, what? Yes! React 19 introduced a minimum delay for showing a Suspense fallback, and hardcoded (!) it to 300ms. Just 3 tests can waste almost 1 second on absolutely nothing!

🤔 What if there were a conference without talks? Just hanging out with OSS maintainers & builders, seeing what they’re working on, and learning cool stuff by actually talking to people. 🤯 What if hallway track turned into the whole event! 💡 @tannerlinsley.com is exploring it. Interested? ⬇️

With npm supply chain attacks on the rise, secure publishing practices are becoming a pressing concern for anyone maintaining npm packages. ⚠️ We've released updated guidance to help maintainers reduce exposure, strengthen release processes, and protect the ecosystem: openjsf.org/blog/publish...

🥳 The newly added trust policy seems awesome. But for now, it seems rxjs 7.2.0 makes it unhappy. www.npmjs.com/package/rxjs...

🤶 No Advent of PBT for this year, but if you have not tried the one of last year probably a good one to do 💕

if you've been using `provenance-action`, I'm delighted to say you can now replace it with @pnpm.io v10.21's new `trustPolicy` feature! 🎉

Activating the Copilot Business from my company on my account, dropped my access to my own Copilot Pro 😵 Surprised that @github.com did not think of these cases, I feel I miss something

@nico.dev learning us how to build K.I.T.T. with Javascript.

ECMAScript excitement 😉 Congrats to proposal champion Dan Minor @mozilla.org on shipping the TC39 Stage 3 Upsert proposal in Firefox 144 🎉 let map = new Map(); map.getOrInsert(key, defaultVal); It lets you set a default value on a map key without overwriting an existing value 👍

ECMAScript excitement 😉 Congrats to Evan Wallace on shipping the TC39 Stage 2.7 Import Bytes proposal in ESBuild 0.25.11 🎉 It lets you import raw bytes as a readonly Uint8Array 👍 import buf from "./a.png" with { type: "bytes" } Also available in Deno, Bun, & webpack.

As for the launch of Vite+, I'm glad we now have the demo and the website. Probably it's best to wait for the blog post (promised for Monday) to really understand it and continue the conversation. viteplus.dev

Huge positive news for the React community. React and React Native are moving out of Meta and into Linux Foundation. engineering.fb.com/2025/10/07/o...

i wrote about atproto and why it matters

Awesome 😍 I'll definitely give it a try for the CI of @fast-check.dev

This is great news! GitHub will require use of passkeys for 2FA when publishing to NPM. What a huge step up in security compared to other phishable 2FA methods that were historically supported 🎉 github.blog/security/sup...

Rolldown v1.0.0-beta.39 has been released! ⚡ macOS Performance Boost: 10%-30% faster bundling, up to 45% in extreme cases. 🎯 Cross-Chunk Optimization: Support for __NO_SIDE_EFFECTS__ annotation, as well as better tree-shaking across module boundaries and more efficient DCE

eslint-plugin-depend released! this ESLint plugin helps you find dependencies the @e18e.dev community has recommended replacing thanks to @bluwy.me for adding eslint/json support too 🙏

ECMAScript excitement 😉 Next week's TC39 meeting has a packed agenda: 🔼 Amount 🔼 Array.prototype.pushAll 🔶 AsyncContext 🔶 Await Dictionary 🔼 Import Bytes 🔶 Intl Era Month Code 🔼 Iterator Chunking 🔶 new Global() 🔼 Non-extensible applies to private 🔼 Promise Adoption 🔼 Promise Predicate 🔶 Temporal

our two-step process for fast typescript types: 1️⃣ build a type-level benchmarking library 2️⃣ spend the prime of your life on cache optimizations

Hey #edusky: what have I said for years about not putting images of children on your websites or socials ? This is why www.theguardian.com/technology/2...

Writing tests is hard, and I'm lazy. I'd rather write a few invariants, and let fast-check fuzz test the rest. That's why I built @​traversable/valibot-test. Here it is in action:

TIL: the "sync" in @react.dev's useSyncExternalStore isn't for "synchronise", it's for "synchronous". As: it's not for synchronising against an external store, It's for synchronously (ie: disabling concurrent features) updating against a store's changes. h/t @tkdodo.eu 🤯

I wanna write a blogpost about Suspense, Transitions and React Query but it would mostly be "here's how I understand it, here's what I think doesn't work and here's what we might have to change internally to make it work"

Why do nuqs URL updates occur client-side only by default? Because you're guaranteed to run @react.dev on the client, but not all frameworks do SSR. With `shallow: false`, you opt-out of this client-only behaviour, and cross the network boundary for search params you need during SSR.

Got exactly the same issues: one package at a time and rate limited 😅 Not the best UX/DX

✨ We’re thrilled to welcome our new Gold Sponsor: LambdaTest! 🎉 Your support helps us keep improving fast-check for the whole community 💛 More about them at www.lambdatest.com

The thesis of this post is that React isn't innovating and other UI libraries are. But the real issue is that React's innovations are overshadowed by it's own success. www.lorenstew.art/blog/react-w...

🚨 Major active supply chain attack just hit npm. Popular package @​ctrl/tinycolor was trojanized — and it didn’t stop there. Over 40 packages were silently modified to steal secrets from dev machines & CI pipelines. Our team at Socket caught it. Full report coming soon. Stay safe out there.

🚊 On my way to Prague for @react-prague.bsky.social. I will be talking about how we use knip @sentry.io to remove unused code 🙌

styled-components maintenance mode doesn't have to mean panic mode. Our engineer @codey.bsky.social made performant community forks. Linear's already seeing 40% faster renders with zero code changes. Not a permanent fix, but it buys you time to migrate properly. www.sanity.io/blog/cut-sty...

pnpm v10.16.0 adds "minimumReleaseAge", a setting for defining how long a version has to have been published before pnpm will install it. A nice countermeasure against accidental installs of short-lived compromised packages before they get taken down. Not a 100% fix, but a great additional step!

Re the incidents lately: I think npm needs to provide a flow where we can block a workflow (gh action) until a user goes to a URL to 2fa and approve it Most of us maintainers would be happy to do that extra step imo

Hoping next one will be Property Based Testing being natively supported 😅 Anyway I believe schema integration might please @ssalbdivad.dev 🤗

And here is the associated release note: fast-check.dev/blog/2025/09...

We also recently moved @fast-check.dev and all associated packages to Trusted Publishing to ensure a safer publication flow 🤗

I keep giving LLMs a chance to impress me, whenever I encounter a boring task that they should be good at, and they keep shitting the bed. Not like 'this was too hard a problem for fancy autocomplete' shitting the bed, like 'randomly deleting swathes of code' shitting the bed

Awesome 😎 We just toggled it ON at work to reach a close to x2 in CI.

New version of fast-check released 🚀

Setting custom `process.title` in Node takes around 10-20ms. Vitest used to do this for every isolated test file so that debugging test runner processes was a bit nicer experience. But it's not worth the performance hit.

🤔 Probably time to dig through the changelog of @nodejs.org. One of my test suite backed by #Jest started to fail with 24.6.0 while it passed well with 24.5.0. As I'm playing with `--experimental-vm-modules` to run these tests in Jest I would not be surprised that something broke around VM...

TypeScript excitement 😉 TS 6.0 is planning a bunch of breaking changes to tsconfig options to deprecate some and change the defaults for others. This will simplify configuration and ease the transition to the Go-based TS 7.0 👍 The latest pitch is to enable strict type-checking modes by default 🎉

The uncomfortable reality is that it is 100x harder to become a solid software engineer than to become hands-on with these tools A solid dev starts to use these tools and 2 weeks later they know what needs to be known Someone using these tools is not necessarily a solid dev tho…

Updated the new Grid docs today to hopefully step through the different parts a bit more clearly. react-window-git-issues-821-brian-vaughns-projects.vercel.app/grid/grid

1Password, Bitwarden, LastPass, Enpass, iCloud Passwords, and LogMeOnce remain vulnerable to zero-day clickjacking vulnerabilities disclosed at DEF CON. Vendors downplayed or ignored the issue. Socket has filed a CVE to ensure these risks are formally tracked. socket.dev/blog/passwor...

We did exactly the same at Pigment. No global state manager only props drilling and React's contexts. It works and it scales well if used properly 🤗

On ne voit vraiment pas la même chose en Europe et aux USA quand on parle de régulation / encadrement des IA generative. Et comme quoi ils ne sont pas si anti regulation que ca (pas sur ce qu'il faut malheureusement) www.whitehouse.gov/p... #ia #dei

tsup is not actively maintained anymore 👀 With >9M NPM monthly downloads and >10k GitHub stars, tsup is undeniably a popular choice for bundling. Unfortunately, it is not under active maintenance anymore. Thanks to @egoist.dev & contributors for all the work on tsup 🙏🏻

I've been building react-pdf for almost a decade. Thought nothing could surprise me. Then someone asked me on That Other Platform: "Can I get the page count without state?" Mind. Blown. 🤯 1/3 🧵👇

Switched to ESLint Vitest Rule Tester by @antfu.me in my Perfectionist and De Morgan plugins. Tests are now cleaner, easier to debug, and support it.skip/it.only. Plus, it works great with Wallaby, unlike the standard ESLint Rule Tester! 🧪 github.com/antfu/eslint...

The semver library used in npm, yarn and pnpm could be made 33x faster. Ran into that while wondering why running `npm install` takes so long on the Preact repo. marvinh.dev/blog/speedin...