JSIR: A High-Level IR for JavaScript from Google — Google has open sourced a new tool (JSIR) and proposed an industry-standard IR (Intermediate Representation – if an AST tells you what the code looks like, an IR tells you what it does) for JavaScript. Already used at Google for analysis and code transformation, the underlying idea could form a foundation for a new generation of tooling.

Zhixun Tan (Google)

💡 Most devs won't feel the impact for a while, but this is the kind of groundwork that can lead to better linters, smarter bundlers, better refactoring tools, and so forth.

What to Know in JavaScript (2026 Edition) — An up-to-date overview of the JS landscape, including the latest ECMAScript additions, frameworks to keep tabs on, runtimes, build tools, and more. A good way to catch up.

Chris Coyier

IN BRIEF:

• 🔓 The Axios team has published a postmortem of last week's npm supply chain compromise. There's also a look into how the social engineering part worked.

• 📊 WebKit, Google and Mozilla have unveiled JetStream 3, the latest version of a suite of popular browser-oriented JS and WASM performance benchmarks.

• Cloudflare has released EmDash, a JavaScript-flavored 'spiritual successor to WordPress'.

• The Svelte team has published its latest monthly roundup.

RELEASES:

• ESLint v10.2.0 – Adds support for language-aware rules through a new meta.languages property. Temporal is now also supported.

• Node.js 25.9.0 (Current) – Adds --max-heap-size to set a max heap size for a process, and includes stream/iter, a new experimental iterable streams API.

📖  Articles and Videos

Minimum Release Age is an Underrated Supply Chain Defense — An increasingly common package manager feature is being able to specify a minimum ‘package age’. The idea is that if you wait, then maintainers, security tools, etc. will tackle the most nefarious supply chain attacks. It’s no silver bullet, but may suit your use case, and here’s how to set it up.

Dani Akash

The Great CSS Expansion — A thorough review of Web-based tasks that were once JavaScript’s natural domain (e.g. tooltips, dialogs, scroll animations) but for which modern CSS now excels.

Pavel Laptev

🛠 Code & Tools

• npm-check-updates v20.0.0 – Upgrade package.json dependencies to latest versions while preserving semantic versioning policies. Now supporting cooldowns.

• Neutralinojs 6.7 – The cross-platform desktop app framework adds an API for input device simulation and handling.

• 🖼️ SVGInject 2.0 – Inlines SVG files into the DOM at runtime (no build step) so you can style them with CSS.

• vue-clamp 1.0 – Primitives for clamping multiline text, inline strings, and wrapped items in Vue 3. (Demo.)

• vue-virtual-scroller 2.0 – Fast virtual-scrolling for lists in Vue 3.

• Verdaccio 6.4 – Run your own local private npm registry.

• React Native Skia 2.6 – Fast 2D graphics library for RN.

• SunEditor 3.0 – Extensible, vanilla JS WYSIWYG editor.

• hucre 0.3 – Zero-dependency spreadsheet engine.

• bwip-js 4.9 – Pure JavaScript barcode writer.

📢  Elsewhere in the ecosystem

• In CSS is DOOMed, Niels Leenheer shows off how he implemented a version of 1993's Doom using purely CSS rendering (with the game logic in JavaScript). Play it for yourself or check out the code.

• QuickBEAM is a JavaScript runtime for Erlang's BEAM VM, as also used by Elixir. It offers compatibility with core Node.js APIs.

• In CSS or BS? find out how good you are at telling real-life CSS properties from made up ones.

• ✉️ Spencer Mortensen put twenty-five email address obfuscation techniques to the test to see which actually work in 2026.