npm and pnpm introduce staged publishing

дата:
Plus Deno 2.8's Node.js leap, a Webpack-to-Rspack migration story, and a bloody hard crossword.

#​787 — May 26, 2026

Read on the Web
Together with  Expo

JavaScript Weekly

JS Crossword: All the Answers are JavaScript — This hand-crafted puzzle will seriously stretch your JavaScript knowledge. I’ve seen so many people on social media either cheering having finished it or cursing being stuck…

Lyra Rebane

💡 I've put some (educational!) tips at the end of this issue.

Expo UI Hits Stable: Native iOS & Android from One Import — From a single import, @expo/ui ships SwiftUI on iOS and Jetpack Compose on Android with the real platform components underneath. SDK 56 also lands native drop-in replacements for seven common React Native community packages.

Expo sponsor

Staged Publishing for npm Packages Goes Live — npm’s ‘staged publishing’ model provides a review period with approval required before packages go live on the npm registry. Both npm 11.15.0 and pnpm 11.3 have added support.

The npm Project

💡 In this broader writeup, GitHub also introduced npm's new --allow-* options to control over where npm is allowed to source packages from.

IN BRIEF:

RELEASES:

📖  Articles and Videos

Chrome Previews Declarative Partial Updates — Two new sets of APIs for working with HTML out-of-order, whether in the doc itself (via <template for>) or through dynamic insertion (via setHTML/streamHTML). Experimental in Chrome 148 but polyfills exist.

Pollard and Rosenthal (Chrome)

Optimizing Our Build Times by Migrating from Webpack to Rspack — How Yelp cut build times in half with Rspack (a Rust-powered drop-in replacement for webpack) and what they learned about barrel files and re-exports.

Benson Pan (Yelp)

Unlimited Postgres for Developers and Their Agents — ghost gives your agent unlimited postgres forks. No project limits, no cleanup, 1TB storage, 100 hrs/mo free. Try for free

Ghost sponsor

Microsoft's Analysis of the Recent Mini Shai-Hulud Compromise — A detailed post-mortem of last week’s ‘Mini Shai-Hulud’ npm security chain compromise.

Microsoft Defender Security Research Team

🤖 AI-Assisted Engineers are Burning Out: Is This Fine? – A look at the negative effects of AI-assisted coding and how to avoid burning yourself out. Ivan Chepurin

📄 A Simple Clustering Algorithm for Lists – Some algorithm fun. Cassidy Williams

🛠 Code & Tools

Deno 2.8: The 'Biggest Minor Release' to Date — The headline is that Node.js compatibility has jumped from 42% in Deno 2.7 to 76.4% now (higher than Bun). Deno also gets huge perf gains across the board and drops the npm: prefix requirement when adding/installing packages. Plus many other things, including:

Bartek Iwańczuk

10 Merged, 34 to Go: Fixing JS Observability Upstream — Every JS APM tool monkey-patches libraries. It breaks with ESM, bundlers, and non-Node runtimes. Here's how to fix it.

Sentry sponsor

📄 DOCX 9.7: Build Word .docx Files in JavaScript — A mature, comprehensive library for generating docx files both client and server side. There’s a CodePen-based example with the basics, plus over 100 example scripts.

Dolan Miu

tinykeys 4.0: A Tiny, Modern Library for Keybindings — Has a very simple, straightforward API and the page includes live demos.

Jamie Kyle

An Official Node.js Codemod to Migrate from Axios to fetch — A codemod to transform code using Axios to using the Fetch API instead.

The Node.js Team

📱 Hot Updater: Self-Hosted Over-the-Air Updates for React Native — A way to deploy updates to apps without app store submissions.

Sungyu Kang

📰 Classifieds

🦊 Foxit's open-source MCP server gives AI agents 30+ PDF tools — covering PDF conversion, OCR, merge, signing, and document workflows.

⚙️ Middleware, but for AI agents. Compose Claude Code, Codex & Gemini as one TypeScript harness — 100+ agent recipes. agentfield.ai/github.

Flaky tests slowing down dev? Meticulous gives engineers confidence to ship faster by autonomously testing every edge case of your web app.

👀  JS Crossword Tips

The JS Crossword (featured at the top of the issue) is tough, so I have some educational tips and JS quirks to help you on your way:

  • The crossword runs in the browser, so the window global object is in play. For example: find(0) and name return things in the browser, but not in Node.

  • Look at the 'playground' beneath the puzzle. While a clue may say object, the expected result may be more detailed.

  • A number like 67 can be represented multiple ways. For example: 0103 == 67 and 0x43 == 67

  • You can go further with prefixes and suffixes on numbers. For example: 123., +123, and +123. all equal 123

  • Assignments evaluate to the value that was assigned.

  • Tagged template literals offer a… quirky way to call functions. Consider that this works in JS: console.log`hi` (though this is not equivalent to console.log('hi')).

  • ' is not in the allowed character list.
n

Комментарии

Отправить комментарий