netlify now runs the @e18e.dev GitHub action on every PR in their build repo! 🎉 if you don't use it already, here's just a few things it detects changes in per PR: - 🔒 trust levels - 📈 dependency count - 📦 install size - 📦 bundle size - ⚠️ redundant dependencies

made the caniuse-lite data a bit smaller 👀

something i'm thinking of adding to @npmx.dev 👀

these packages are now ESM only: - sisteransi (downloads: 54M/week) - babel (downloads: 150M/week) - cookie (downloads: 160M/week) ...and many more to come 🎉 big win for standardisation and install size

here's an @e18e.dev tool to summarise and visualise v8 deoptimisations. with `npx @e18e/deopt your_script.js`, you basically get a UI served up locally which shows where v8 deoptimised your code. you can also use `npx @e18e/deopt --md your_script.js` to get a markdown summary

The @e18e.dev meta-framework tracker is getting closer to our first release. Thanks to the team behind HTTP Archive and contributions from @rdforte.bsky.social, we now have metrics for each meta-framework in the wild in our report. Sneak peek of what we are working on (designs not final)

Every Babel package is ESM-only now! 🎉 Inflection point. If you were waiting for a signal to leave CJS behind for your packages, this is it!

`cookie` is now ESM-only, which means the `cookie-es` fork is no longer really necessary. It's also faster now. These are some of the changes coming in Express 6. github.com/jshttp/cooki...

We need more package auditing tools like replacements.fyi to make our dependency trees more secure and performant. @e18e.dev is doing great work.

You probably know this, but @e18e.dev's replacements.fyi is pretty slick.

Small one but sisteransi is now esm only! 56M downloads/week so it's a good win 🎉

✂️ Playing a bit with a new "cycles" reporter in Knip to show circular dependencies. The data is available in the module graph already anyway 😎 Feel free to take a look and give it a 🌀 if you're interested: github.com/webpro-nl/kn...

It counts as day-one support if it's within 24 hours, right? 👁️👁️ ... @netlify.com supports React Router 8 on "day one"! www.netlify.com/changelog/20... and while I'm in @netlify/vite-plugin-react-router... - 🧹 ESM only - 🔏 Trusted Publishing - Node.js 22+ - Vite 6+ RR v7 still fully supported.

working on the @e18e.dev skills 👀

Well, @npmx.dev seems to be happy with our v4 canaries so far! npmx.dev/package/@11t...

CodeRabbit started sponsoring @e18e.dev today 🎉 hopefully some good collaboration coming up too 🙏 AI code review is a prime place to apply e18e advice, slop reduction, etc Thanks to @santoshyadav.dev for figuring this out!

Today is the day! My JSNation talk 'De-bloating the Web: The "Ecosystem Performance" Initiative (e18e)' will be live at 17:30 UTC. If you want to know what e18e is all about, what we are up to, and how you can help or benefit from it, make sure to join the talk later! @jsnation.gitnation.org

new release of the @e18e.dev ESLint plugin! 🚀 includes a new rule you can opt into which auto fixes some map get/sets to use `getOrInsert` instead 🔥

Checkout the new `noRestrictedDependencies` rule! Powered by @e18e.dev module replacements 🎉

The great @tkdodo.eu talking about knip ✂️

Hello friends and welcome to another “how’s ESM vs CJS doing?!” A big win this time, at a year of `require(esm)` available! 38.0% of the popular npm packages now have ESM, up from 33.4% half a year ago. ESM-only is up from 12.6% to 16.0%. Particularly this non-dual, “vanilla” growth is very big!

Great to see our work at @e18e.dev featured in Node Weekly. Do you need that npm package? Find out today: replacements.fyi Node Weekly: nodeweekly.com/issues/627

after about two years of the package existing, tinyglobby has surpassed both globby and fast-glob. it's been an insane journey that wouldn't have been possible without @e18e.dev and help from people like @benmccann.com or @43081j.com. i'm infinitely grateful for what e18e has done to the ecosystem 💙

It's been a while since I last touched my old project with 60M downloads, today got a little nostalgic and revived it. Most dependencies are gone. lint-staged -> ❌ tape -> node --test eslint -> oxlint prettier -> oxfmt github.com/postcss/post...

📦 @pnpm.io 11.5 adds support for recognizing npm staged publishes after staged approval metadata triggered a false downgrade signal. As npm adds more release paths, registry metadata needs to make it clear how each package version was published. socket.dev/blog/pnpm-11...

Using an outdated npm package? You can now search for @npmjs.com package replacements using @raycast.com! Day 236 of #100DaysOfRaycast 1 of 2

New game: guess the package from its redacted @npmx.dev timeline graph. First correct answer gets a $20 donation to an OSS project or maintainer of their choice.

npm now has the ability to approve/deny scripts per-package just like pnpm 🎉

we still haven't officially launched the @e18e.dev CLI. some of that is because i wasn't happy with the install size... big step forward today thanks to @rman.dev, we've dropped 47MB and 100 deps! (you can use the cli today but a proper launch and blog post are coming soon!)

Finally took the time to donate to two OSS projects I genuinely rely on: @npmx.dev and @e18e.dev. If you've been meaning to do the same for a project you love, there's never a bad time to give back.

✂️ Knip v6.15.0 is out 🎉 Celebrating the ▲ @vercel.com sponsorship and 152 plugins! → New treatTagHintsAsErrors option → Improved --trace features → New plugins: orval, nano-spawn → Many feats 'n fixes ✨ Changelog: github.com/webpro-nl/kn... Knip: knip.dev

If you're feeling burned out because your motivation is fading due to today's tech news or your job, join communities like @npmx.dev, @e18e.dev, and other OSS projects to get your drive back. Stay away from AI agents and interact with real people. It's one of the best things that happened to me.

Replacements​.fyi. A tool from the e18e collective that helps you find more performant and safer replacements for outdated or unnecessary npm packages. Type a package name and get drop-in alternatives or short code snippets to use instead. #npm #tools replacements.fyi/

1.0.0 of @e18e/setup-publish 🎉 you can use this to setup a GitHub workflow for publishing npm packages ✅ staged publishing ✅ follows best practices for secure publishes ✅ supports npm, pnpm, bun ✅ supports changesets, changelogithub

@rspack/core is now 2.6 MB smaller than the previous release, and 17.8 MB smaller than v1.0. Love the new npmx graph for visualizing this trend. 📉

we finally finished adding browserlist support for @e18e.dev cli 🤘🏻

In @npmx.dev you can now view a package's changelogs currently only package's that use Github to host their releases or changelog.md are supported but support for others are planned

🚀 @e18e.dev dependency-diff action v1.6.0 this action will reply in PRs when: - trust levels change - dependency size increases significantly - dependency count increases significantly - install size increases signficantly and more!

the @e18e.dev npm publishing guide has been updated to recommend the new `npm stage` feature! this guide and the templates it offers are a good way to get setup quickly in a secure way

Released mmntjs 1.0.0 A small, fast, moment-compatible date library for a safer path away from moment.js. Separate packages with timezone & locale support. Also ships with a migration tool to make moving large codebases less painful. github.com/yoshi-taka/m... mmntjs.veritycost.com @e18e.dev

We’ve been working on a new site for Changesets with a lot of new docs! If changesets has been confusing before, hopefully some of these will help, or let us know what else could be improved. Check it out 👉 changesets.dev

PSA: the safest way to publish an npm package today is staged publish + OIDC + provenance. "But it can't stop every attack." Sure, and seatbelts don't prevent every injury either. We still wear them. Security is layers, not silver bullets.

Personally, I like the success message more 🤪. The best part about @e18e.dev is we are always building, shipping and improving on the tools and data we offer.

Okay, HUGE news I can finally unveil: I've been working with the @posthog.com team to fix an upstream template for bundling Rust code into npm deps We got rid of 42 dependencies in the template (down to a single one) A total of ~200 packages (over 1,2M dl/w total) are now able to get rid of that!!

optimizing code is always such a pleasant feedback loop. bringing package from >800kB to <100kB will never not thrill me! 1) crank those optimization flags 2) use wasm-opt 3) compress wasm before inlining, pass through DecompressionStream before instantiating

FYI staged publishes in npm will show up in npmx & pnpm as a trust downgrade but they're not afaict. Problem is that the publisher is now the person who approved it, rather than npm's trusted publisher account. It needs fixing on npm's end I think. Probably means we need to publish new versions

My first blog post. I finally finished it. blog.rman.dev/year-in-open...

the replacements.fyi site now lets you drop a package.json into it to see which dependencies can be replaced with native functionality, or more performant choices 🎉

💥 just released a github action: `uppt` it aims to be a very simple, secure release workflow for maintainers that adheres to best security practices ⚪ trusted, staged publishing on npmjs.com ⚪ github environment protection ⚪ generated release PR + changelog ⚪ automatic release + publish on merge ✨