Uh oh, I'm writing about time again. 🕒 Client / server defaults alignment, hydration issues, distributed systems, this is going to be a fun one. Thanks for the nerd snipe @mxkaske.dev 😅

Urgh, someone just posted the raw output of their LLM agent trying to resolve their problem as a comment in an issue. Including all the steps the thing took, the 12 branches of digressive hallucinations, and how it miserably failed at the end. Why? Just, why?

I love this: to know the TC39 meeting time in your location: use the Temporal API 🙌

Proud to have contributed this feature to @nuqs.dev ❤️

Why do nuqs URL updates occur client-side only by default? Because you're guaranteed to run @react.dev on the client, but not all frameworks do SSR. With `shallow: false`, you opt-out of this client-only behaviour, and cross the network boundary for search params you need during SSR.

Protection against Supply Chain Attacks Before heading off to @squiggleconf.com I recorded a video about the recent NPM-related supply chain attacks with the goal to tell you how to protect yourself and your team from them as good as possible. Including a high-level overview & actionables 👏🏻

TIL: the "sync" in @react.dev's useSyncExternalStore isn't for "synchronise", it's for "synchronous". As: it's not for synchronising against an external store, It's for synchronously (ie: disabling concurrent features) updating against a store's changes. h/t @tkdodo.eu 🤯

Hey, #ruby folks! I've been one of the #RubyGems maintainers for the last decade. Ruby Central has forcefully taken control of the RubyGems organization on GitHub, the `rubygems-update` and `bundler` gems on rubygems[.]org, and more. You can read the details here: pup-e.com/goodbye-ruby...

Don't want LinkedIN to automatically train its AI on your data, switch it off here: www.linkedin.com/mypreference... Not sure about the rest of the world, but if you don't switch it off it will start collecting in November for the Netherlands/ Dutch members.

Wishlist: browserstack, but for email clients. - Send a test email - It fans out to lots of different email clients + config (dark mode) - You get screenshots of how broken your email looks in each client

Moving a client's old email system from Meteor + MJML to @fastify.dev + react.email 💌 - Actual @react.dev for templating (w/ Context for nested components) - TailwindCSS for styling - Type-safe props on render (no more failed/missing expansions) Neat.

This was peak Apple UI design.

Imagine a local-first, distributed, peer-to-peer, immutable data exchange system. This is not BitTorrent. It’s what you get from putting your app state in the URL.

ℹ️ Don't know who needs to hear this but npm has had a --before=<date> flag since v6.9.0 (02/2019): github.com/npm/cli/blob/v… Setting a relative date is easy w/: $ npm install --before="$(date -v -7d)" # & only get registry deps that are over a week olddocs.npmjs.com/cli/v11/usin...re

Update: did not find the bug, nor a good reproduction. Actually, a lot of different reproductions, but seemingly orthogonal to each other. My brain hurts. /quit

🟣 I'm live on Twitch! Working on @nuqs.dev (debugging 🐞), come say hi! 👋 twitch.tv/fortysevenfx

Dropped my active NPM tokens count from 25 to 8. Given the increase of supply chain attacks recently, I'm soft-deprecating a lot of the old packages I'm no longer maintaining, that were using long-lived, publish-all-packages scoped tokens. I'll enable provenance on those if need be.

🚨 Major active supply chain attack just hit npm. Popular package @​ctrl/tinycolor was trojanized — and it didn’t stop there. Over 40 packages were silently modified to steal secrets from dev machines & CI pipelines. Our team at Socket caught it. Full report coming soon. Stay safe out there.

Honestly serious: JUST DON'T UPDATE PACKAGES RIGHT NOW. It is unclear to me yet, but this is looking pretty wide spread. Better be safe than sorry, just go touch some grass.

🗣️ Big news: I'll be speaking at @nextjs.org Conf '25, on Oct 22 in SF ! We'll cover a few tricks @nuqs.dev has up its sleeve to scale URL state in Next.js (some I yet need to finish building 😅). So thankful for the opportunity 🙌

I forgot about the 3 modes of React Router, looks like the e2e test matrix for @nuqs.dev is about to become a bit larger..

It's only called @vercel.com if it comes from the original village in the Jura region of France

Stay safe out there, Rustaceans! 🦀

Weekend project: running the @nuqs.dev e2e test suite in **development mode** to fish out some bugs. Everything is green in production, but the dev DX needs to match. 🚦 (inb4: no, it's not ⚛️ Strict Mode)

fix!: i'm slowly getting used to the lowercase one BREAKING CHANGE: now I have to change my commitlint rules to reflect that 😅

Nodemailer is wild. The runtime has zero dependencies, lightweight, neat. But its **type definitions** pull the entire AWS SDK with them, along with a ton of polyfills. cc @e18e.dev

Urgh, is there a good resource online that lists all of those forbidden HTML nesting rules?

Looking for my next role! I thrive where I can help others grow, and where my Vue.js open-source work is supported with time Frontend, AI, remote-friendly, and open to (some) relocations!

New section in the @nuqs.dev landing page. A huge thank you to all these wonderful people 🫶

TIL conventional commits can use a `!` to denote a breaking change: chore(deps)!: Drop Node.js 18 I had only been using the `BREAKING CHANGE: description` in the commit body, but having both is much neater, to quickly parse it visually on one-line logs. www.conventionalcommits.org/en/v1.0.0/#s...

🚨 Breaking: npm author Qix compromised. Malicious package versions published in projects that typically see hundreds of millions of downloads each week. Details: socket.dev/blog/npm-aut...

All the packages affected by this attack had not enabled trusted publishing and provenance. - The top four packages were all impacted. - More than half of the top ten packages were affected. github.com/sxzz/npm-top...

1. Never manually enter your GitHub or npm password; use a Passkey instead. 2. Enable npm 2FA for both authorization and publishing. 3. Use trusted publishing and remove all npm CI tokens. 4. Only invite maintainers who follow these security practices.

Uh, what? The @developers.google.com search console (SEO tools) is saying that @nuqs.dev is phishing? I just 301'd from the old domain to the new, the content is exactly the same, and there isn't any more details on the warning. Anybody got this when transferring domains?

Did you know your MacBook has a sensor that knows the exact angle of the screen hinge? It’s not exposed as a public API, but I figured out a way to read it and make it sound like an old wooden door.

🔗 Introducing our new domain name: nuqs.dev 2 years ago, I restarted work on the useQueryState hook to support the @nextjs.org app router. Since then, the project exploded: ⭐ +8k stars 📦 +30M downloads 👥 +50 contributors 🩷 +23 sponsors Thank you, everyone! 🫶

Weekend project: troLLMing bots.

This is handy, a quick way to navigate to the repository (GitHub, GitLab, etc) of an @npmjs.bsky.social package: ghub.io Eg: ghub.io/vite

Any guesses? 👀

📦 [email protected] is out! 🚀 - ✨ `processUrlSearchParams` middleware: sort the querystring alphabetically (for SEO & cache) or process it before updating the URL. - 💎 Zod codecs community parser - ⚠️ Log a warning when using debounce with shallow: true with a link to docs Try it out: pnpm add nuqs@latest

Wishlist: an MDN (@developer.mozilla.org) RSS feed of Baseline updates. Eg (in the future): "Safari just added support for the `using` keyword in JavaScript. It is now in Baseline." Or (in 2026-09): "After 2.5 years in Baseline, the Promise.withResolvers feature is now Widely Available."

Shower thought: MIDI is to music what SVG is to bitmap images.

New rule: if I see a cookie consent popup on your website that doesn’t have a « reject all » option, I’m closing the site immediately and going elsewhere. I have neither the time nor the energy to sift through all of your 394 « legitimate interest » data partners. </rant>

Artem is writing about testing again! 🍿

Can URL state compose? Find out out what @francoisbest.com thinks on our latest episode www.youtube.com/watch?v=2x5B... creators.spotify.com/pod/profile/...

Any streamers having this issue too? @ponceto91.bsky.social @danielroe.dev @t3.gg @whitep4nth3r.com @jason.energy

potentially new npm malware campaign unfolding targeting Windows? that comment looks like it is targeting LLM / AI 👀

How far can you get with URL state management? Find our with out latest guest @francoisbest.com creator of NUQS www.youtube.com/watch?v=2x5B... creators.spotify.com/pod/profile/...

🟣 I'm live on Twitch! Shipping a new project 👀, come say hi! 👋 twitch.tv/fortysevenfx

🟣 Tomorrow on stream: - Shipping a new side project 👀 - Playing with new toys (ink ⚛️) - And good o'l ones (mswjs.io 📡) 3-4pm CEST, come say hi! 👋 www.twitch.tv/fortysevenfx