2026.03.20 🛠 chore: up node24. #229

The popular GitHub Action actions-cool/issues-helper has been compromised. Every existing tag in the repository has been moved to point to a single imposter commit that does not appear in the action's...

Suggestion 🔍 Search Terms import attributes, import assertions, ambient module ✅ Viability Checklist My suggestion meets these guidelines: This wouldn't be a breaking change in existing TypeScript/...

Today we’re announcing Private Access Tokens, a completely invisible, private way to validate that real users are visiting your site.

Today we are releasing Babel 8. It's been 8 years since we released Babel 7. And that's not without reason.

Audit rules, examples, and remediations.

Vue SFC compiler module with a Lightning CSS-backed style compiler

Added support for Node.js runtime installation for dependencies and a setting for configuring trust policy.

Sometimes npm packages are compromised and published with malware. Luckily, there are companies like [Socket], [Snyk], and [Aikido] that detect these compromised packages early. The npm registry usually removes the affected versions within hours. However, there is always a window of time between when the malware is published and when it is detected, during which you could be exposed. Fortunately, there are some things you can do with pnpm to minimize the risks.

How building edge-case first led to bloated, overly-granular libraries and what we can do about it

Motivation npm Trusted Publishing is now generally available, allowing package owners to publish npm packages via CI without manually generating npm tokens. This method greatly reduces the risk of ...

Context: Import Attributes is now stage 4: https://github.com/tc39/proposal-import-attributes Related PR / issues: #17485 rollup/rollup#5694 There are few different aspects regarding properly impor...

npm Blog (Archive); updates from the npm team are now published on the GitHub Blog and the GitHub Changelog

Up until recently, supporting JavaScript in Rust based tools has been deemed not worth it. The main concern is the overhead of the de-/serialization cost when sending data back and forth. But there is...

An open-source library with unstyled, primitive components, accompanied by a variety of examples & use cases ready to be integrated into your projects.