TAG
#javascript
Stories connected through a shared idea, actor, technology or theme.
Oxlint 1.88 adds LSP configuration diagnostics and new JavaScript rulesThe release makes configuration errors visible to the language-server client and adds new rule behavior including a configurable prefer-query-selector check. It also contains breaking AST comment-attachment changes and fixes conflicting TypeScript import autofixes.→Next.js 16.4 canary advances bundle-analysis toolingVersion 16.4.0-canary.60 unifies the colours used for bundle-analyser deltas. The change is small but affects how teams interpret performance regressions during framework development.→Next.js ships a coordinated security release for supported branchesThe fixes affect both current and previous maintained release lines. The advisories cover image optimisation, App Router metadata image routes and self-hosted SSG or ISR deployments.→pnpm patches a dependency security advisory and store-corruption failuresThe release ships undici 7.29.1 and addresses failures that occurred when multiple pnpm processes wrote to the same store. It also fixes handling for package, catalog, project and command names that collide with JavaScript built-in object properties.→Mock Service Worker 3.0 becomes ESM-only and raises runtime baselinesMSW 3.0 is ESM-only, drops supported Node.js versions below 22 and requires TypeScript 5.9 or newer. The release adds a Vite plugin, GraphQL subscriptions, navigation and form interception, WebSocket events and fixes for browser-mode test flakiness.→Oxlint 1.86 adds React component and TypeScript diagnosticsThe release adds new lint coverage for generated empty object types and improves handling of parameter-property reassignment, `declare` preservation and `await using`. It also updates React compiler, HTML-comment and several ESLint rule behaviours.→Node.js 26.9 expands Web Workers, crypto and runtime diagnosticsNode.js 26.9 adds Web Workers support, a generic MAC API, OpenSSL provider cipher and hash discovery, default FFI support and a new `node:bench` implementation. It also extends `perf_hooks` with meanCI and CBOR operations and introduces an experimental DTLS API alongside broader crypto, HTTP, filesystem and permission changes.→Deno 2.9.7 tightens network, cache and lockfile safetyDeno 2.9.7 makes audit honour configured certificate stores, disambiguates HTTP authority paths and checks resolved IPs against the network deny list. It also validates lockfile tarball registry paths, fixes permission descriptors and removes argument, completion and sourcemap handling errors in deployment and sandbox commands.→OpenAI Node SDK 7.16 adds WebSocket event limits and malformed-event handlingVersion 7.16 adds per-iterator limits for incoming WebSocket events and improves buffering and handling of malformed WebSocket messages. The release also bounds fallback abort subscriptions and keeps callback credentials local to individual HTTP requests.→Next.js 16.4 canary.31 fixes proxy detection and Turbopack shutdown handlingVersion 16.4.0-canary.31 fixes detection of proxy.ts when compound pageExtensions are used and makes next dev wait for Turbopack shutdown. It also advances tree shaking through module wrappers and export tracing through client-component proxies.→pnpm 12.4.2 patches executable-shim and GitHub Actions security issuesThe release prevents dependency executables from taking over another package’s POSIX bin shim and requires HTTPS for GitHub server URLs except on loopback hosts. It also improves installs, peer-dependency resolution, Python lockfile reuse, workspace performance and several platform-specific behaviours.→GitHub Agentic Workflows adds shared JavaScript modules for workflow packagesThe release supports .mjs and .cjs modules inside aw.yml packages with path-traversal and extension restrictions. It also coordinates rate-limit handling for multi-target logs and makes failed-run and evaluation credit accounting fail closed.→pnpm 11.27 adds explicit build approval and trust-policy cleanupThe release asks for approval before running package build scripts and keeps unapproved packages in the ignored-build-scripts state. It also adds trust-policy cleanup, safer global package operations and improved workspace peer dependency handling.→OpenAI Node SDK 7.11 adds prompt-cache diagnostics and API-key expiry fieldsVersion 7.11.0 adds prompt-cache diagnostics and service-account API-key expiration fields, and corrects function-argument completion event fields. The release also improves WebSocket and streaming cleanup examples for Responses-based applications.→Ultralytics Inference 0.0.42 improves browser and WebAssembly inferenceUltralytics Inference 0.0.42 reduces unnecessary XNNPACK thread contention and fixes browser pose-label parsing. It also improves webcam, ONNX and LiteRT handling across the project’s Rust, WebAssembly and browser packages.→Pact JS 17.1.4 updates its pact-core contract-testing enginePact JS 17.1.4 updates the pact-core dependency to version 20.1.1. The release also updates the fast-xml-parser development dependency used by the XML examples.→pnpm 12.3 adds trust-policy checks and native global-command shimspnpm 12.3 adds trust-policy flags to pnpm remove and pnpm update, verifying the lockfile against active policies. It also makes context-aware global commands such as node, deno, bun and pnpm-added shims native executables on every platform and improves local and tarball installs.→Next.js 16.4 canary improves codemods and SST key orderingNext.js 16.4.0-canary.12 stores SST keys in key order when hashes are omitted and honours non-interactive mode in upgrade codemod prompts. The release also extends codemod transformation to .mjs files and removes an unnecessary CI workflow.→Alpine.js 3.17 adds deferred tree initialisation and a CSP fixAlpine.js 3.17 adds Alpine.deferInit(), allowing a component tree to remain suspended until an asynchronous prerequisite settles. The release also fixes Unicode escapes in Content Security Policy string literals.→Plasmo 0.89 adds browser-specific manifest overridesPlasmo 0.89 adds an overrides key for browser-specific manifest configuration and logs the selected target during plasmo build and plasmo dev. The release also documents zip output and CLI argument values more clearly.→Javy 6.0 changes its plugin API for JavaScript-to-WebAssembly buildsJavy 6.0 removes eval_bytecode from the default plugin and update namespace, moves plugin validation into code generation and changes the configuration schema API. It also adds a code-generation option for including source and documents a WASI Preview 2 plugin direction.→Node.js 26.8 adds crypto, diagnostics and SQLite APIsNode.js 26.8 enables SIV and GCM-SIV modes in Cipher and Decipher, marks TracingChannel stable, improves histogram and net.BlockList behaviour, and adds non-throwing MIMEType.parse. It also adds SQLite StatementSync close and dispose methods, basic REPL syntax highlighting and ZipFile, ZipEntry and ZipBuffer support, alongside certificate and Web Crypto fixes.→pnpm 12 makes dependency resolution and runtime selection more deterministicpnpm 12 canonicalises known-host Git dependencies to HTTPS identities, makes peer-dependency cycle breaking deterministic and fails or warns on unrecognised workspace settings instead of silently ignoring them. It adds project-aware shims for pinned runtimes, can provision other package managers and introduces an opt-in signed remote side-effects cache.→Hono 4.13.5 patches three web-framework security issuesHono 4.13.5 fixes query parsing that could read parameters after a URL fragment, creating cache-key and proxy interpretation differentials. It also closes a toSSG path-normalisation gap that could write outside the output directory and bounds dot-notation expansion in parseBody() to prevent memory exhaustion.→Hono 4.13.4 fixes request, routing and client edge casesHono 4.13.4 fixes request-parameter handling on unmatched requests and wildcard middleware association in the regexp router. It also corrects JSX ref cleanup, ETag parsing, undefined header and cookie values, form-data cloning, client query serialisation and media-type matching.→Vite+ 0.3.0 moves installs to standard platform directoriesFresh installs now use split XDG directories on Unix and standard local application-data folders on Windows, while existing single-root installations remain in place. The release adds tsup-to-vp pack migration, forwards supported commands to Bun 1.4, cuts the published package size by 51 percent and removes upgrade-check delays.→create-vite 9.2.0 adds nub package-manager supportcreate-vite 9.2.0 adds nub package-manager support and documents experimental React Compiler use in generated projects. It also updates eslint-react links and related development dependencies.→Next.js 16.4.0-canary.2 introduces backend-storage construction optionsThe canary release adds an options struct to the backend-storage construction path. The published release notes describe this as the release change and do not announce a broader stable feature set.→ESLint v10.9 tightens autofix safety for JavaScript codebasesESLint 10.9.0 adds checks for conditional loop expressions and numeric precision underflow, while fixing unsafe no-var and prefer-template autofixes. The release also updates shareable-config documentation and its CodeQL and CI dependencies.→Bun 1.4 ships the Rust rewrite and broader full-stack toolingBun says v1.4 adds 1,517 Node tests, fixes 2,900 issues, cuts idle CPU use by five times, reduces memory use by up to 35 percent and starts up to 50 percent faster on Linux. The release also adds Bun.Image, Bun.WebView, Bun.markdown, Bun.cron, Bun.Terminal, parallel test execution and package-manager audit and repair commands.→TypeScript 7.0.2 publishes the native compiler releaseTypeScript 7's native toolchain uses a Go-based compiler and parallelised checking, with Microsoft reporting substantial build and language-server speedups on tested codebases. The 7.0 line also changes several defaults and does not yet provide a stable programmatic API for some framework integrations.→celld brings Durable Objects-style state to self-hosted infrastructurecelld uses JavaScript-compatible Workers and Durable Objects interfaces while moving storage and coordination onto infrastructure controlled by the operator. The design combines object-level SQLite state with object storage such as S3-compatible systems.→Yadda 3.0 modernises JavaScript BDD for agent-assisted maintenanceYadda 3 removes browser bundling and obsolete integrations, adopts node:test, Biome and lefthook, adds Playwright and Puppeteer examples, and now ships TypeScript definitions. Its maintainer says Claude Code with Opus 4.8 performed most of the modernisation while a comprehensive test suite and separated implementation/test changes supplied the main constraints.→