JSIR: A High-Level IR for JavaScript from Google — Google has open sourced a new tool (JSIR) and proposed an industry-standard IR (Intermediate Representation – if an AST tells you what the code looks like, an IR tells you what it does) for JavaScript. Already used at Google for analysis and code transformation, the underlying idea could form a foundation for a new generation of tooling.
Zhixun Tan (Google)
💡 Most devs won't feel the impact for a while, but this is the kind of groundwork that can lead to better linters, smarter bundlers, better refactoring tools, and so forth.
Free Workshop: Claude Code Deep Dive — April 21 — Lydia Hallie from Anthropic teaches a full-day Claude Code workshop at Frontend Masters on April 21. Free to attend. No subscription required.
Frontend Masters sponsor
What to Know in JavaScript (2026 Edition) — An up-to-date overview of the JS landscape, including the latest ECMAScript additions, frameworks to keep tabs on, runtimes, build tools, and more. A good way to catch up.
ESLint v10.2.0 – Adds support for language-aware rules through a new meta.languages property. Temporal is now also supported.
Node.js 25.9.0 (Current) – Adds --max-heap-size to set a max heap size for a process, and includes stream/iter, a new experimental iterable streams API.
📖 Articles and Videos
Minimum Release Age is an Underrated Supply Chain Defense — An increasingly common package manager feature is being able to specify a minimum ‘package age’. The idea is that if you wait, then maintainers, security tools, etc. will tackle the most nefarious supply chain attacks. It’s no silver bullet, but may suit your use case, and here’s how to set it up.
The Great CSS Expansion — A thorough review of Web-based tasks that were once JavaScript’s natural domain (e.g. tooltips, dialogs, scroll animations) but for which modern CSS now excels.
Your CI doesn't have to be this slow — Depot CI: 2-3s job starts, parallel steps, SSH debugging. Run depot ci migrate to move your GitHub Actions in minutes.
axios Package Compromised; Malicious Versions Added a Trojan Dependency — Axios is an HTTP library that gets 100M+ downloads a week, largely due to its legacy popularity. An attacker took advantage of that to roll out a version with a malicious dependency including a remote access trojan (though Axios' codebase itself was fine). This is big, as even if you don’t use Axios, your dependencies might. Here's how to see if you're affected.
Still Writing Tests Manually? Meticulous AI Is Here — Notion, Dropbox, Wiz and LaunchDarkly now use a testing paradigm they can’t work without. Built by former Palantir engineers, Meticulous automatically creates an evolving suite of E2E UI tests, delivering exhaustive coverage with no developer effort.
Signals: The Push-Pull Based Algorithm — A well-diagrammed ground-up explanation of how signals work internally, focusing on the push-pull algorithm at the core of reactivity in frameworks like Solid, Vue, and Angular.
A Gentle Intro to npm Workspaces (With Visuals) — Workspaces let you manage multiple packages in one repo and link local packages so they can import each other by name. npm may then hoist and deduplicate compatible dependencies during install.
Carlos Precioso
📄 'I Decompiled the White House's New App' – Among the surprises in the React Native app are a cookie/paywall bypass injector and dynamic loading of JavaScript from a random user’s GitHub Pages... Thereallo
Pretext: A Multiline Text Measurement and Layout Library — Cheng Lou, formerly a React core team member, caused a stir with this X post three days ago, racking up 22M impressions and getting 25k stars on this repo since. Why? People are very excited about the potential for real time web layouts! There are demos here if you want to see what the excitement is about, although the library itself is reasonably straightforward.
Cheng Lou
GitHub Actions 🤝Expo CI/CD Workflows — Keep GitHub Actions. Add Expo Workflows for mobile: M4 Pro builds, E2E tests, OTA. Let each tool handle what it’s best at.
Expo sponsor
Knip v6: The Tool to Declutter Your JS/TS Projects — Knip is a go-to tool for finding and removing unused files, exports, and dependencies in projects. v6 integrates oxc for 2-4x performance gains (it tears through Astro in two seconds) and is largely a drop-in upgrade.
🔠 Looking for a new IDE font option? CodingFont lets you find your ideal choice visually using a bracket-style faceoff. Noto Sans Mono won for me – not one I'd considered before!
Announcing TypeScript 6.0 — Over six months in the making, TypeScript 6.0 is designed to bridge the gap between its self-hosted compiler and the (almost ready) Go-powered native compiler of TypeScript 7.0 . There are new features (Temporal improvements, RegExp.escape, and more), but most important are the changes to help you prepare for 7.0:
Numerous default changes: strict is now true, module is esnext, rootDir defaults to ., and more.
A change that will affect many apps is types defaulting to [] rather than pulling in everything from node_modules/@types.
A large number of Deno employees announced (e.g.) they were departing the company last week. Deno employee Josh Collinsworth, not speaking for the company, noted"Deno is not going away. These are just hard times."
📗 Chibivue is a code project and associated online book that provides, and explains how to build for yourself, a minimal Vue.js implementation.
RELEASES:
Next.js 16.2 – The React framework gets much faster next dev startup and ~50% faster rendering.
Storybook 10.3.0 – The component workshop adds Vite 8, Next.js 16.2, and ESLint 10 support, plus a preview of an MCP server for React dev.
⚠️ All maintained Node.js versions are due security releases later today to address nine vulnerabilities.
Deno 2.7.6 – deno eval auto-detects CJS vs ESM, and --cpu-prof-flamegraph generates interactive SVG flamegraphs.
The Three Pillars of JavaScript Bloat — Three reasons your node_modules is huge: needless ES3-era compat packages, micro-libraries with a single consumer, and ponyfills for APIs that shipped years ago! James, known for the e18e ecosystem performance project, offers some ways to calm the chaos.
📊A React SSR Framework Performance Showdown — A large benchmark of TanStack Start, React Router, and Next.js under heavy load. The results led to patches benefitting both TanStack and React generally.
pnpm 11 Beta 0: A Sneak Peek — The efficiency-focused npm alternative continues its outsized impact on JS package management. It's moving to a SQLite-powered store, gets a configuration overhaul, and has stricter build security by default. Four new commands, too, including pnpm sbom for generating Software Bill of Materials JSON documents.
pnpm contributors
Edge.js: Running Node Apps Inside a WebAssembly Sandbox — A new, in-alpha runtime that maintains full Node compatibility while offering isolation via WebAssembly. Existing apps/modules run unmodified with system calls sandboxed, and the JS engine used is pluggable (between V8, JavaScriptCore and QuickJS). More info on the homepage.
ArrowJS 1.0: Fast, Reactive UI Runtime Built on Platform Primitives — Built around ES modules, template literals and the DOM, it can also isolate component logic inside WASM sandboxes while rendering full inline DOM directly. First unveiled in 2022 by the creator of FormKit, it's now clearly finding its feet.
Flaky tests slowing down dev? Meticulous gives engineers confidence to ship faster by autonomously testing every edge case of your web app.
📢 Elsewhere in the ecosystem
The Microsoft Visual Studio Code team shares how they use AI to work on VS Code, from organizing their work and handling issues, to pushing out new releases. If you've noticed VS Code is getting a release every week now, this is why!
🔒 Perhaps more than ever, it's essential to ensure no secrets have sneaked into your repos. Secretlint is a linter dedicated to that task.
Back in 1989, Rob Pike, famous for his work on both the Go programming language and co-creating UTF-8, wrote Rob Pike's 5 Rules of Programming which has gone viral this week and still apply in 2026!
🤖 Addy Osmani introduces us to comprehension debt. In a world of agent-produced code, the question is now not “how do we generate more code?” but “how do we actually understand more of what we’re shipping?”
Dislike all the menu icons that macOS 26 (Tahoe) has introduced? There's a solution: defaults write -g NSMenuEnableActionImages -bool NO
Still Writing Tests Manually? Meticulous AI Is Here — Notion, Dropbox, Wiz and LaunchDarkly now use a testing paradigm they can’t work without. Built by former Palantir engineers, Meticulous automatically creates an evolving suite of E2E UI tests, delivering exhaustive coverage with no developer effort.
Meticulous sponsor
Vite 8.0 Released — A mega release for the popular build tool. Designed to be a smooth upgrade, there’s a lot behind the scenes: @vitejs/plugin-react v6 no longer needs Babel, Rolldown replaces Rollup and esbuild, Wasm SSR support, browser console forwarding to the terminal, and big performance gains.
Vite
💡 VoidZero has also open sourced its Vite+ toolkit. Originally intended to be a commercial project, Vite+ combines Vite, Vitest, Oxlint, Oxfmt, Rolldown, and tsdown into a single, unified toolchain, and it's now in alpha.
Electron 41.0 – The cross-platform desktop app framework adds ASAR Integrity digest and MSIX auto-updating support, improves Wayland support, and updates to Chromium 146, Node v24.14.0, and V8 14.6.
Nitro v3 Beta – Extend your Vite app with a production-ready server, compatible with any runtime. Handy if you want to try building your own framework!
Vitest 4.1 – Next-gen testing framework, now supporting Vite 8.
Source Maps: Shipping Features Through Standards — Source maps are JSON files that provide debuggers and similar tools with a mapping between minified/transformed code and the original codebase. Jon gives us a tour and takes us behind the scenes of how the feature has progressed towards becoming a standard (ECMA-426).
Jon Kuperman (Bloomberg)
How we Rewrote 130K Lines from React to Svelte in Two Weeks — A common adage in recent months has been that the use of LLMs and coding agents could lock us into using only the most popular frameworks, but in reality they also make switching between frameworks easier than ever before.
Best Practices for Svelte Developers — A brand new page in the Svelte docs that outlines some best practices for writing more robust Svelte apps.
Svelte Docs
An Empirical Study of Frontend Memory Leaks — Analysis of five hundred React, Vue and Angular apps for patterns that lead to memory leaks. Missing timer cleanups and event listener removals cause the majority of problems.
Nuxt 4.4: The Full-Stack Vue Framework — The full-stack Vue framework that includes routing (now powered by Vue Router v5), server-side rendering, and data fetching out of the box now adds custom useFetch/useAsyncData factories, typed layout props, build profiling, and more.
Daniel Roe and the Nuxt Team
Reveal.js 6.0: The HTML Presentation Framework — A long-standing way to bring elegant presentations to anyone with a browser. v6.0 has some breaking changes, switches to Vite, and introduces an official React wrapper.
RedwoodSDK 1.0 Released: The Cloudflare-Native React Framework — A server-first React framework, built as a Vite plugin, that integrates deeply with the Cloudflare platform (why?) and its provision of workers, databases (D1), durable objects, storage (R2), AI APIs, etc.
Peter Pistorius
Defuddle 0.14.0 – Get the main content of a page as Markdown. A modern implementation of the ideas behind Mozilla’s Readability.
Extension.js 3.9 – Framework for developing fast, unified cross-browser extensions with zero configuration.
🌷 JSNation - Amsterdam & Online - This June, catch the latest trends in modern Web development from the people shaping its present & future.
📢 Elsewhere in the ecosystem
📈 In The 49MB Web Page, Shubham Bose expresses surprise at finding that loading a single NY Times page results in 422 network requests and 49 megabytes of data transferred. He reflects on the problems that have led to this being a common experience on news sites.