The Secure Way to Release an npm Package in 2026 — A practical guide to publishing npm packages more safely, written by the author of numerous popular packages (e.g. postcss). As well as showing how to use staged publishing and trusted publishing, he explains why they help.

Andrey Sitnik

💡 GitHub is continuing to focus on npm security, and is starting to scan every npm package for malware at publish time. This will have some implications, including a delay between publishing and availability for installation.

IN BRIEF:

• 🚨 Developing incident: The popular keyv and cacheable packages were compromised today with a credential-stealing worm. The repercussions are ongoing with hundreds more packages compromised so far.

• Monthly updates from the Astro team and the Svelte team. The first preview releases of SvelteKit 3 are now available.

• ⚖️ The Deno vs Oracle JavaScript™ trademark case rattles on with Deno consenting to a fifth extension request as discovery continues.

• Popular JS library factory TanStack has rebranded and introduced new 'Markdown' and 'Highlight' libraries.

RELEASES:

• MobX 7.0 – The popular state manager slims down, removes deprecations, updates its React bindings, and now always uses Proxy-backed observable objects and arrays.

• Javy 9.1 – Toolchain for compiling JavaScript to WebAssembly for WASM runtimes.

• Node.js v26.6.0 (Current) and v24.19.0 (LTS)

• Vite 8.2, React Three Fiber 9.7, Lerna 10.0, Hono 4.13.0

Your SPA is Leaking Memory: 'Soak Test' It — How to run a Playwright 'soak test' that loops a user flow within the same browser context, watches DOM node and listener counts, and fails CI when a memory leak creeps in.

Den Odell

Your JSON is Lying to You — A reminder that a JSON.parse/JSON.stringify round-trip is far from lossless, with big integers, undefined, Date, and more, altered or lost along the way. Gabor covers the nastier gotchas and practical ways to make the conversion boundaries explicit.

Gabor Koos

Adding Go's defer to the TypeScript Compiler — In Go, defer delays the execution of a function call until the surrounding function finishes. Can you just fork TypeScript and add language features? Yes! Should you? Probably not, as using is already a good fit for the use case.

Andrew Healey

📄 Learning Remix 3 – By porting a Solid 2.0 demo to Remix 3's server-first model. Mark Malstrom

📄 Why npm Dependency Trees Are So Big Andrew Nesbitt

TanStack Charts: A New Chart Grammar Option — In the past few weeks, TanStack has been rapidly iterating on a new, framework-neutral way to declaratively specify a large number of chart-related visualizations in JavaScript. Output renders to SVG or canvas and can be styled as you wish. Here's a comparison against other established options.

TanStack

💡 Jacob has a post from 2022 covering how microdiff is so fast.

• Neutralinojs 6.9 – The lightweight Electron alternative has a new C++ network API for making HTTP requests free of the webview's CORS restrictions.

• DukPy 0.6 – Simple JavaScript interpreter for Python. Now uses the QuickJS-NG engine to support more modern JavaScript and Promises.

• isomorphic-git 1.40.0 – A pure JS implementation of Git for Node & browsers.

• better-result 3.0 – Lightweight Result type for TypeScript with generator-based composition.

• ip-address 10.4 – Parse, validate and manipulate IP (v4 and v6) addresses.

⚡ Stop being the integration layer. Build a CRM-to-signed-PDF pipeline in n8n with plain HTTP calls. No SDK, no manual file handling.

Flaky tests slowing down dev? Meticulous gives engineers confidence to ship faster by autonomously testing every edge case of your web app.

⚡ Zuplo puts every API, AI, and MCP request behind one gateway. Route traffic, guard your MCP servers, and cap your AI costs. Try it free.

📢  Elsewhere in the ecosystem

• Did you know JavaScript supports a third type of comment (beyond // and /* */)? ▶️ Mat Marquis shows off hashbang comments in a short YouTube video. And yes, they're in the language spec!

• 🤖 GitHub's Sean Goedecke says LLMs reward expertise, with the most important prompting skill being expertise in the domain you're prompting for.

• Microsoft is previewing a way to call native Windows APIs from Node (and therefore Electron) without native addons, via a new dynamic Windows Runtime API (WinRT) projection.

• Cloudflare Workers has added support for inbound TCP connections and gRPC (in private beta).

• Stacked pull requests are now in public preview on GitHub.