🦋 BlueSky Likes: Flexible Components for Displaying Bluesky Likes

External content

Lea VerouLea Verou
injavascriptweekly

🦋 BlueSky Likes: Flexible Components for Displaying Bluesky Likes

Front End
Open Source
Web Components
3 min read
Svedit: A Tiny Library for Building Rich Content Editors with Svelte

External content

Michael AufreiterMichael Aufreiter
injavascriptweekly

Svedit: A Tiny Library for Building Rich Content Editors with Svelte

Svedit is a lightweight library designed for building editable websites using Svelte 5. It enables developers to model content in JSON, render it with custom Svelte components, and edit directly within the layout. Unlike traditional rich text editors that rely on linear character-based models, Svedit adopts a node-based approach, allowing for the combination of text-like content with structured, form-like elements. The library offers features such as: - Visual In-Place Editing: Edit content directly within the layout without switching contexts. - Transactional Editing with Time Travel: Every change is safe and undoable, providing a robust editing experience. - Unicode-Safe Input: Ensures correct handling of emojis, diacritics, and CJK characters. - Node-Based Structure: Content is structured in a graph-like model, allowing for nested nodes and complex content representations. Svedit is built by Michael Aufreiter and Johannes Mutter and is licensed under the MIT License. The library is currently in alpha, with ongoing development to enhance features and fix known issues.
Svelte
JSON
Web Development
Open Source
4 min read
⚖️ Deno Asks: 'Help Us Raise $200k to Free JavaScript from Oracle'

External content

Ryan Dahl
injavascriptweekly

⚖️ Deno Asks: 'Help Us Raise $200k to Free JavaScript from Oracle'

Deno is leading a legal initiative to cancel Oracle's trademark on the term "JavaScript," aiming to make it a public domain term freely usable by developers, conferences, and companies. After gathering over 27,000 signatures on an open letter, Deno filed a formal Cancellation Petition with the U.S. Patent and Trademark Office. The case has reached the critical discovery phase, which is resource-intensive and requires substantial funding. Deno is seeking to raise $200,000 through a GoFundMe campaign to support the litigation, including professional surveys, expert witnesses, and legal filings. Any surplus funds will be donated to OpenJS to continue defending civil liberties in the digital space. Deno emphasizes that if Oracle prevails, it could set a precedent allowing corporations to claim generic terms, undermining the integrity of trademark law.
JavaScript
Open Source
4 min read
Moving Off of TypeScript (We Love You, TypeScript)

External content

Chander RameshChander Ramesh
injavascriptweekly

Moving Off of TypeScript (We Love You, TypeScript)

Motion, a company that has operated with a large TypeScript monorepo for nearly five years, has decided to move away from TypeScript. While TypeScript enabled rapid development and full-stack operations, the company faced challenges as the codebase grew, including slow build times, frequent language server crashes, and issues with shared code across platforms. The final decision was influenced by the need for a more reliable and mature ecosystem, leading to a shift towards .NET and C# for backend development, while React remains in use for the frontend.
TypeScript
.NET
Full-Stack
7 min read
npm-check-updates 18.2: Update package.json Dependencies to Latest Versions

External content

Raine RevereRaine Revere
injavascriptweekly

npm-check-updates 18.2: Update package.json Dependencies to Latest Versions

npm-check-updates (ncu) is a command-line tool that upgrades your project's package.json dependencies to the latest versions, ignoring the specified version ranges. It maintains existing semantic versioning policies, ensuring that upgrades are consistent with the project's versioning strategy. The tool is compatible with various package managers, including npm, yarn, pnpm, deno, and bun. It offers both CLI and module usage, providing flexibility for different development workflows. Key features include: - Interactive Mode: Allows users to choose which packages to update one by one. - Cooldown Feature: Introduced in version 18.2, this feature helps protect against supply chain attacks by requiring package versions to be published at least a specified number of days before considering them for upgrade. The tool also supports filtering packages, rejecting specific versions, and upgrading only to the highest patch version without bumping the minor or major versions.
JavaScript
Open Source
Security
5 min read
'React Won by Default – And It's Killing Frontend Innovation'

External content

Loren StewartLoren Stewart
injavascriptweekly

'React Won by Default – And It's Killing Frontend Innovation'

Loren Stewart argues that React's dominance in frontend development is no longer due to its technical superiority but because it has become the default choice. This "React-by-default" mindset leads teams to opt for React without evaluating other frameworks that might better suit their project's needs. Stewart highlights that frameworks like Svelte, Solid, and Qwik offer innovative solutions—such as compile-time reactivity and fine-grained updates—that React's virtual DOM model cannot match. The article emphasizes the importance of making deliberate, constraint-based decisions when choosing frameworks to foster innovation and avoid the stagnation caused by defaulting to React.
Front End
React
Svelte
Web Development
6 min read
The 'Shai-Hulud' npm Supply Chain Attack Rumbles On

External content

Pandya, van der Zee, and Brown (Socket)Pandya, van der Zee, and Brown (Socket)
injavascriptweekly

The 'Shai-Hulud' npm Supply Chain Attack Rumbles On

The "Shai-Hulud" npm supply chain attack has escalated, now compromising nearly 500 packages, including several CrowdStrike npm packages. Malicious updates introduce a bundle.js script that: - Downloads and executes TruffleHog, a legitimate secret scanner. - Searches host systems for tokens and cloud credentials. - Validates discovered developer and CI credentials. - Creates unauthorized GitHub Actions workflows within repositories. - Exfiltrates sensitive data to a hardcoded webhook endpoint. The npm registry has removed the affected packages, and the attacker has branded the campaign with a GitHub Actions workflow file named shai-hulud.yaml, referencing the sandworms from Dune.
Security
npm
Open Source
5 min read
Fetch Streams are Great, But Not for Measuring Upload/Download Progress

External content

Jake ArchibaldJake Archibald
injavascriptweekly

Fetch Streams are Great, But Not for Measuring Upload/Download Progress

Jake Archibald discusses the limitations of using the Fetch API's streaming capabilities to track upload and download progress. While streaming allows for chunked data processing, relying on it for progress monitoring can lead to inaccurate results and potential misimplementations. For instance, measuring download progress using Content-Length can be misleading when compression is involved, as the decoded size may differ from the encoded size. Similarly, with upload streams, determining progress is unreliable because the Fetch API measures when data is taken from the stream, not when it's actually sent over the network. Jake emphasizes that while Fetch streams are valuable for efficient data handling, they are not suitable for precise progress tracking.
API
JavaScript
4 min read
BlazeDiff: 'Blazing-Fast' Pixel-by-Pixel Image Comparisons

External content

Teimur GasanovTeimur Gasanov
injavascriptweekly

BlazeDiff: 'Blazing-Fast' Pixel-by-Pixel Image Comparisons

BlazeDiff is a JavaScript/Rust-based library offering “blazing-fast pixel-by-pixel” image comparison. It aims to match the output and API of the popular pixelmatch library, but with significant performance gains. What sets it apart is its use of block-based optimization: rather than comparing every pixel every time, BlazeDiff divides images into blocks and only processes those blocks with differences. It also includes early-exit logic (if buffers are identical), uses 32-bit integer comparisons (helping with CPU vectorization), and supports various image formats (PNG, JPEG, WebP) when used with its Sharp transformer binary. Benchmark results show that BlazeDiff is approximately 1.5× faster than pixelmatch, especially in workloads where large images or many comparisons are required. In “identical buffer” scenarios the speedups are especially pronounced. The project is open source under the MIT license and fully API-compatible with pixelmatch (you can use the same options like YIQ color space), making it fairly easy to swap in for existing workflows. It’s useful in visual testing, CI/CD, or anywhere where image diffs are needed at scale.
JavaScript
Rust
Performance
Testing
3 min read
React Bits: 100+ Creative, Animated React Components

External content

David HasDavid Has
injavascriptweekly

React Bits: 100+ Creative, Animated React Components

React Bits is an open-source library of animated, interactive, and fully customizable React components aimed at helping developers add visual flourish to their projects. The components are grouped into categories like Text Animations, General Animations, Components, and Backgrounds. Each piece is designed so that you can tweak it via props, pick different styles (e.g., vanilla CSS vs. Tailwind), or pick TypeScript/JavaScript variants. There are “statement pieces” in the collection—components that are visually striking or unusual (e.g., ball pit, chroma-grid effects, interactive distortions) intended to be eye-catching parts of a user’s UI. The library is gaining popularity: lots of usage, GitHub stars, contributions, etc. And the documentation supports quick starts, demos, and various styling/integration options.
React
Animation
Front End
Tailwind
4 min read
---