javascript

A self-propagating worm hijacked keyv and related npm packages on August 4 after a maintainer's GitHub account was breached, spreading to 1,300+ package versions.

The React team merged a work-in-progress Rust rewrite of the React Compiler, and Vercel says early Turbopack tests found 20-50% faster compilation.

npm v12 disables install scripts, Git dependencies, and remote-URL dependencies by default, closing the execution path several npm worms exploited over the past year.

Ecma International approved ECMAScript 2026 on June 30. The 17th edition of the JavaScript standard adds Math.sumPrecise, Iterator.concat, Array.fromAsync, Error.isError, Map upsert methods, Uint8Array base64 and hex conversion, and JSON.parse source access.

Deno 2.9, released June 25, adds an experimental deno desktop command that compiles web projects into single-binary native apps using the OS webview by default.

Angular's June 3 release graduates Signal Forms, Asynchronous Signals, and Angular Aria to stable, flips the default change-detection strategy to OnPush, and ships with Vitest as the default test runner.

SvelteKit shipped versions 2.57.0 through 2.61.0, advancing its experimental remote functions with a new query.live primitive and several breaking changes to queries and forms.

Deno 2.8, released May 22, adds deno audit fix, deno pack, deno ci, deno transpile, deno why, and deno bump-version, while slashing cold npm install times by 3.66x and enabling Chrome DevTools network traffic inspection.

GitHub's npm registry makes staged publishing generally available: packages must pass a human-approved, 2FA-gated queue before consumers can install them.

Biome v2, released June 2025, introduces type-aware lint rules and a plugin system without requiring tsc, reaching v2.4 by February 2026.

VoidZero's Vitest 4.1 adds pytest-style test tags, an experimental mode to bypass Vite's module runner, async leak detection, and a reporter optimized for AI coding agents.

Jarred Sumner merged PR