Modern Web Types: TypeScript Support for Newer Web APIs — TypeScript's DOM types only include APIs shipped in multiple browser engines, so things like element-scoped startViewTransition and fetchLater throw up errors. modern-web-types is a drop-in lib.dom replacement that adds missing interfaces/members shipped in any single browser engine.

Philip Walton (Google)

IN BRIEF:

• 🔒 Attackers are scanning for exposed Vite dev servers exploiting a server.fs.deny bypass (patched in Vite 7.3.2 and 8.0.5 earlier this year) to grab credentials from .env files. Vite listens on localhost by default, but double check your setup.

• Safari 27 shipped yesterday (alongside macOS/iOS 27), bringing the module loader rewrite we covered last week, so top-level await now works reliably in all major browsers.

• TC39 meets in Tokyo in two weeks. Here's the agenda with three iterator helper follow-ups (join, includes and chunking) all up for Stage 4, plus more.

• 🔒 Starting this Thursday, the OpenJS Foundation's CVE team is taking a break till October 6 due to burnout driven by a surge of AI-generated reports. Actively exploited issues will still get a response.

• 🔒 npm now places a temporary 72-hour 'security hold' on any account after a successful recovery-code sign-in.

RELEASES:

• pnpm 12.4 – The package manager can now manage Rust crates and Python packages alongside npm ones in a single workspace.

• Playwright 1.63 – Tests can now declare a named lock so those sharing a resource never run concurrently.

• Node.js v26.8.2 (Current) and v24.21.0 (LTS) – Both include a security release of Undici to fix numerous vulnerabilities.

• React Router 8.4, Vite 8.3, Moment.js 2.31.0 (security release).

A Design Space Exploration of async/await — A simple async/await example produces different results in JavaScript, Rust, Python and Swift. Test your mental model with a quiz, then learn about the design choices behind the differences.

Gavin Gray

Native is Now the Future of Mobile at Shopify — Shopify is rewriting its React Native mobile apps in Swift/Kotlin. The main argument is coding agents have cut the cost of writing everything twice, while the upsides of native remain.

Mustafa Ali (Shopify)

A Deep Dive into StyleX — A hands-on tour of Meta's StyleX, which turns JavaScript style objects into plain atomic CSS at build time, and why it can be a good fit for coding agents in particular.

Flavio Copes

📄 'Nobody Pays for Open Source: We Can Force Them To' – Laurie Voss ran npm for five years and thinks registries are an untapped lever for funding maintainers. Laurie Voss

📄 Anecdotally, Programmers Dislike reduce – map and filter sail through code review, but reduce draws complaints. Evan has a few theories why. Evan Hahn

• React DevTools 8.0 (Chrome Web Store) – The Suspense tab is now on by default, the Timeline profiler is gone (use your browser's Performance panel instead), and inspecting a DOM node now shows its matching React component.

• Zod 4.6 – Adds .validate(), a boolean check that skips building errors and is up to 35x faster than .safeParse().success on invalid input with compiled schemas.

• Javet 6.0 – Embed Node.js v26's runtime in the JVM for full interop with Java.

• parse-xml 5.0 – The fast, compliant XML parser goes ESM-only.

• 🕹️ n64js 1.0 – A Nintendo 64 emulator in pure JavaScript.

💻 Free live coding workshop, Sept 16. Build signup protection with Fingerprint that catches fake signups, no matter how they cover their tracks.

Flaky tests slowing down dev? Meticulous gives engineers confidence to ship faster by autonomously testing every edge case of your web app.

⚡ Zuplo puts every API, AI, and MCP request behind one gateway. Route traffic, guard your MCP servers, and cap your AI costs. Try it free.

📢  Elsewhere in the ecosystem

• 🕹️ This year's js13kGames entries are in with a record 317 games squeezed into 13KB each. Frank Force's SP13KTRA racer and the Hornbound roguelike are good places to start, and you can dig around the public repos of every project too.

• Chris Coyier rounds up new and emerging HTML features worth knowing about, like the <geolocation> and <install> elements, as well as HTML-in-Canvas and improvements to <select> customization.

• The first Three.js Conference took place in Paris last week, and Codrops has a live-blog writeup of both days, including Mr.doob's talk. No recordings yet.

• Tailwind Labs, the team behind Tailwind CSS, is joining Shopify. Tailwind CSS is to remain maintained and open source – phew! 😅