Meta
REACT FLIGHT FIXES MAIN-THREAD STALLS FROM DEBUG BLOAT
React's Flight server was freezing the main thread when serializing large debug strings, and the fix just shipped.
read --wire →
$ tail -f topics/javascript.log
JavaScript news, every morning.
Daily updates from the JavaScript and TypeScript world - Node.js, React, Vue, Next.js, Vercel, and the platform layers built on them.
41 updates across 6 projects this week.
Your week in JavaScript, every Monday.
One calm review of what shipped across JavaScript - the commits, releases, and security advisories that matter. Every Monday, with security advisories same-day. Free, unsubscribe in one click.
We'll start you on the top JavaScript projects - refine anytime. · Read a sample issue →
Recent wires
Supabase
SUPABASE HARDENS AI STORAGE GUIDANCE, CLI SHEDS LAST GO BINARIES
The Assistant now blocks dangerous RLS patterns on public buckets while the CLI completes its TypeScript migration, eliminating the final Go proxy layer.
read --wire →
Node.js
NPM 11.16.0 LANDS IN NODE, VFS MOUNTING SHIPS FOR ENTERPRISE
Node core absorbed npm's latest feature release while the Virtual File System abstraction entered mainline, giving operators their first production-ready path to mount custom storage backends.
read --wire →
Vue.js
ROUTER DROPS NIGHTWATCH FOR PLAYWRIGHT, AXIOS TIGHTENS HTTP ADAPTER
Vue Router just migrated its entire E2E test suite to Playwright, running cross-browser for the first time in CI, while axios 1.16.0 lands a wave of adapter fixes that should smooth out your HTTP edge cases.
read --wire →
Vercel
TURBOPACK WINDOWS FIX, REACT ROUTER REGRESSION PATCHED, WORKFLOW ENCRYPTION RECLASSIFIED
Turbopack now generates valid file URIs on Windows, React Router's prerender mode stops leaking HTML to JSON endpoints, and Workflow SDK encryption failures stop masquerading as user errors.
read --wire →
Shopify
CLI EXTRACTS ORGANIZATIONS PACKAGE AS STORE COMMANDS SHIP
Shopify CLI is breaking apart its monolith: a new @shopify/organizations package lands today, unblocking the store create dev command and setting the pattern for future modular tooling.
read --wire →
Meta
REACT HARDENS RELEASE PIPELINE, JEST PLUGS SUPPLY CHAIN RISK
React now signs artifacts across all release branches, closing a gap that could have left older versions unverified in production.
read --wire →
Supabase
SUPABASE CLI GOES ALL-IN ON TYPESCRIPT - GO BINARY PORTS ACCELERATE
Supabase shipped native TypeScript replacements for branches, orgs, and SSO commands overnight, killing the Go subprocess fork-exec tax and completing five major CLI modernization batches in parallel.
read --wire →
Node.js
NODE UPGRADES QUIC ERROR HANDLING AND LOCKS DOWN SECURITY RELEASE PROCESS
Node shipped proper error codes for QUIC failures while hardening how the team lands security patches, two changes that make production debugging faster and release integrity stronger.
read --wire →
Vue.js
LANGUAGE TOOLS PATCHES SHELL INJECTION HOLE IN CI WORKFLOW
A supply chain vulnerability in the auto-version GitHub Action could let malicious PR titles execute arbitrary commands during version bumps.
read --wire →
Vercel
NEXT.JS TURBOPACK ANALYZER GETS CRITICAL LOGIC FIX, CLAUDE OPUS 4.8 LANDS IN AI SDK
Next.js fixed a fundamental short-circuit evaluation bug in Turbopack's type analyzer that was inverting AND/OR logic for nullish and string checks, while the AI SDK absorbed Anthropic's latest flagship model with mid-conversation system message support.
read --wire →
Shopify
SHOPIFY CLI 4.1.0 SHIPS WITH EXTENSION-ONLY DEFAULT, REMOVES HOSTED_APPS
Shopify CLI 4.1.0 lands with a breaking change that makes the extension-only template the default, while a performance optimization that broke your workflow just got reverted.
read --wire →
Meta
REACT FIXES FLIGHT SERVER DATA LOSS UNDER BACKPRESSURE
React's Flight Server was silently dropping streamed content when network backpressure hit between header and payload chunks, leaving data stranded in the queue.
read --wire →
Supabase
STORAGE LOCKS IN POOL REBALANCE, REALTIME GAINS AND FILTERS, NESTJS JOINS THE ADAPTER LINEUP
Storage v1.60.0 ships a critical fix that stops cluster rebalancing from torching garbage collection, while Realtime adds AND filter support for Postgres Changes and the server SDK lands its first NestJS adapter.
read --wire →
Node.js
NODE FIXES STORAGE CRASH AND FFI VALIDATION BUG
Node core landed critical fixes for a Storage.prototype length crash and FFI void parameter validation, while undici realigned its lifecycle with bundled Node versions.
read --wire →
Vue.js
VUE PATCHES TELEPORT RACE CONDITION THAT BREAKS SUSPENSE
A critical fix for deferred teleports inside Suspense prevents stray DOM updates when content is discarded before mount, solving a class of silent failures that hit production apps.
read --wire →
Vercel
EDGE RUNTIME OIDC NOW WORKS, NODE.JS GETS WEB API FLEXIBILITY
Vercel shipped the fixes that unblock edge functions authenticating with OIDC tokens and let Node.js developers opt into the Web API handler pattern without middleware overhead.
read --wire →
Shopify
SHOPIFY CLI KILLS THE ENV VAR GATE, EXTENSION-ONLY BECOMES THE DEFAULT
The HOSTED_APPS environment variable is gone, and the extension-only template is now the standard path for `shopify app init`, shipping without friction.
read --wire →
Supabase
BIGQUERY VIEW LOGIC FIXED, NPM SECURITY GUIDE GOES LIVE, CLI GAINS TABLE EXPOSURE CONTROL
Supabase shipped fixes across three critical surfaces: ETL now properly recreates BigQuery views on schema changes, a comprehensive npm supply-chain hardening guide hits docs, and the CLI gains granular control over Data API table exposure.
read --wire →
Node.js
NODE STRIPS 14 ROOT CERTIFICATES, ADDS PERMISSION.DROP CONTROL
Node's certificate store just got pruned hard, removing 14 trusted roots including DigiCert and COMODO, while a new permission.drop API gives you runtime control over what your code can access.
read --wire →