The State of JavaScript 2025 Survey — Each year, Devographics runs an epic survey of as many JavaScript community members as it can and turns the results into an interesting report on the state of the ecosystem – here’s the results from 2024. If you have the time, fill it in, especially as they format it in a way where you can actually learn about stuff as you go.
Devographics
React 19.2 Released — The third release in a year for React, this time introducing new features like <Activity /> (a way to hide and restore the UI and internal state of its children), useEffectEvent, and improvements to Chrome DevTools' performance profiles so you can see more about React’s scheduling and the tree of components it’s working with. Oh, and how about partial pre-rendering?
The React Team
Don’t miss The AI Security Developers Challenge at DevSecCon on Oct 22, 2025 — Participate in the hands-on developer challenge workshop 💻at DevSecCon and get a chance to team up with industry experts from around the globe 🌎. Register for free and walk away with practical tips you can apply directly to your projects 🚀.
The newly relaunched JSConf event returns to Maryland on October 14-16. Tickets are still available and they gave us a JSCONF25NEWSLETTER code which gives a discount. (Note: We have no financial relationship with the event.)
Mastering npx: A Cheatsheet for npm and Node Power Users — You’ve almost certainly used the npx command to easily run a command from an npm package (either local or remote) – it’s easy to use, but npx has a couple of other features and options to keep in mind.
qjs: Run JavaScript in Go using QuickJS and Wazero — A new Cgo-free JavaScript runtime option for integrating JavaScript into apps written in Go. It uses a fork of QuickJS that’s compiled to WebAssembly and then run using Wazero.
Have you ever wanted to program by whistling? Now you can. Velato is a JavaScript-inspired esoteric language designed to be written entirely by whistling and you can give it a go in your browser right now. I struggled with it, but you might have more luck (it doesn't seem to like Safari, for starters).
Velato was built by Daniel Temkin, the author of Forty-Four Esolangs, a new book, published by MIT Press, about an artist's take on creating esoteric programming languages.
AI Code Reviews Meet CLI Coding Agents — CodeRabbit CLI brings instant code reviews directly to your terminal, integrating with Claude Code, Cursor CLI, and other AI agents. While they generate code, CodeRabbit ensures it's production-ready - catching bugs, security issues, and hallucinations before they hit your codebase.
CodeRabbit sponsor
GitHub's Plan for a More Secure npm Supply Chain — In direct response to the recent npm ecosystem supply chain attacks of recent weeks, GitHub’s senior director of security research has outlined steps GitHub is taking, including blocking the upload of packages featuring the patterns of the recent malware, hardening package publication, and promoting the use of trusted publishing.
NPM Security Best Practices — An extensive list of best practices, techniques, and ideas to consider for making your use of the npm packaging ecosystem and its tooling more secure.
JSON is Not JSON Across Languages — If you use JSON to communicate between systems built in different languages, beware. Different libraries with varying opinions can cause “some of the most soul-crushing debugging experiences in software development.”
🤖GitHub Copilot CLI Now in Public Preview — Not content to let Claude Code and OpenAI Codex dominate the CLI-based dev agent scene, GitHub has released a CLI-based version of Copilot, built using Node.
GitHub
TanStack Start v1 Release Candidate — TanStack’s attempt at a full-stack TanStack Router-powered framework has reached a v1.0 release candidate that’s expected to be largely the same as its eventual 1.0 release. “It’s the next chapter in building type-safe, high-performance React apps without the heavy abstractions.”
Cap'n Web: A New RPC System for Browsers and Web Servers — A ‘spiritual sibling’ to Cap’n Proto, an RPC protocol created by one of the same authors. However, Cap’n Web’s underlying serialization is human-readable, focused on integrating well with JS runtimes, and works over HTTP, WebSocket, and postMessage() out-of-the-box.
📊 Billboard.js 3.17.0(above) – The popular charting library adds image label support for charts, label border styling, and dynamic control of label colors.
PythonMonkey 1.3 – Embed the SpiderMonkey JS engine into Python's VM. Now with Python 3.14 support.
pretty-bytes 7.1 – Convert a size in bytes into a human readable equivalent (e.g. 1337 becomes '1.34 kB').
Docusaurus 3.9 – The popular React + MDX-powered content/docs site generator.
Neo.mjs 10.9 – Multi-threaded framework for fast, desktop-like webapps.
Over the past couple of months the esteemed Dr. Axel Rauschmayer has been working on a valuable series of beginner-friendly posts on a range of web development topics, with a heavy focus on JavaScript. He pitches the series as a way to teach people "who have never programmed how to create web apps with JavaScript".
These are all excellent primers/refreshers, and ideal for sharing with those early in their web development journey. Here are some of the highlights so far:
The 'Shai-Hulud' npm Supply Chain Attack Rumbles On — Now named after a term for the sandworms of the Dune universe, the ongoing malicious supply chain attack affecting the npm ecosystem has grown in scale with hundreds of packages affected in an attempt to exfiltrate tokens and secrets from developers’ machines.
Pandya, van der Zee, and Brown (Socket)
The story above has triggered a wave of responses and mitigations:
FlexGrid by Wijmo: The Industry-Leading JavaScript Datagrid — A fast and flexible DataGrid for building modern web apps. Key features and virtualized rendering are included in the core grid module. Pick & choose special features to keep your app small. Built for JavaScript, extended to Angular, React, and Vue.
The WebAssembly 3.0 standard is now 'live' (and already ships with most browsers) with various features that should improve JS interoperability, including garbage collection, tail calls, exception handling, and ways to manipulate JavaScript strings directly.
▶️ Vue's Evan You was recently interviewed by Nuno Maduro of the Laravel project about his background at Google, how Vue.js was first created, the relationship between Next.js and Nuxt, and his current work with void(0).
We recently mentioned Andromeda as being the newest JavaScript runtime to appear, but now there's Ion, a runtime aimed at bringing a JavaScript engine into Rust programs.
Safari 26.0 has been released alongside macOS 26.0, iOS 26.0, etc. Along with numerous CSS enhancements and a new <model> element for embedding 3D models onto web pages, every site can now "be a web app" on iOS and iPadOS if a user adds it to their home screen.
Bun v1.2.22 – Stack traces now include asynchronous call frames, there's Bun.YAML.stringify to turn objects into YAML, bundler & minifier improvements, and more.
Fetch Streams are Great, But Not for Measuring Upload/Download Progress — Fetch upload streams seem well-suited for tracking the progress of uploads, but as Jake notes “just because stuff is taken from the stream doesn’t mean it’s yet been sent over the network”. He also touches on an issue relating to measuring download progress using response streams.
Jake Archibald
Moving Off of TypeScript (We Love You, TypeScript) — An interesting tale from an engineering team that has decided to throw in the towel on its 2.5 million lines of TypeScript, instead migrating to .NET and C#. React will remain on their frontend, however.
Chander Ramesh
Secure Your Agentic Apps with Auth for GenAI — Secure your agentic apps with features like User Authentication for AI agents, Token Vault, and more with Auth0’s Auth for GenAI (exclusively in Developer Preview).
npm-check-updates 18.2: Update package.json Dependencies to Latest Versions — That is, as opposed to the specified versions. Includes a handy -i interactive mode so you can look at potential upgrades and then opt in to them one by one. v18.2 adds a ‘cooldown’ feature to help protect against supply chain attacks by requiring package versions to be published at least the given number of days before considering them for upgrade.
Which npm Package Has the Largest Version Number? Armed with Bun and access to the npm registry's data, a developer set out to satisfy his curiosity, discovering a variety of winners (depending on how you define ‘version’ and ‘largest’).
📂 Want to download MDN for offline reference? The creator of the Dash macOS documentation browser shares some archive files of MDN's documentation covering areas like JavaScript, CSS, HTML and SVG.
If you have any interest in music and being able to render music or generate music with JavaScript, be sure to check out the very end of this issue where we've dedicated an entire section to the topic :-) __ Your editor, Peter Cooper
JavaScript Weekly
How to Keep package.json Under Control — Staring at a 863 megabyte node_modules folder for Val Town’s React app, Tom got to thinking about ‘dependency hygiene’ and some good ways to keep things under control. Good tips and tool recommendations here.
Tom MacWright
Behind the Scenes of bun install — Talk about an epic post. This is no mere explanation of how Bun quickly and efficiently installs packages — but a tour of package installation more generally, the underlying technicalities that make package installation tricky universally, and how Bun has tackled the problem.
Lydia Hallie (Bun)
Stop Reinventing Forms. Use SurveyJS Instead — SurveyJS UI components let you build JSON-driven forms, render them in React, Angular, Vue 3, or plain JS, and store results in your own DB. Open-source, extensible, no vendor lock-in — save months of development and stay in control of your data.
Deno 2.5 – You can now create sets of permissions in deno.json, Deno.test gets some DX improvements, and deno bundle gets a programmatic API so you can script the bundling of your app, along with much more.
ESLint v9.35.0 – Has a new rule (preserve-caught-error) for disallowing the loss of an originally caught error when re-throwing custom errors.
The Missing Link in JavaScript Tools? — Marvin ponders whether today’s fractured toolchain for templates, CSS imports, JSX, and numerous other non-standard enhancements to JavaScript could be unified into a single pipeline.
Marvin Hagemeister
Finally, Safe Array Methods in JavaScript — arr.sort() will sort your array in place, whereas ES2023’s arr.toSorted() will return a new, sorted copy of arr. There are several such methods you might prefer to use.
Matt Smith
Secure Your Agentic Apps with Auth for GenAI — Secure your agentic apps with features like User Authentication for AI agents, Token Vault, and more with Auth0’s Auth for GenAI (exclusively in Developer Preview).
Auth0 sponsor
An Interactive Guide to TanStack DB — TanStack DB offers an embedded client‑side database that uses differential dataflow to power live, relational queries, sub‑ms incremental updates, and optimistic writes. This tutorial leans on using it with React, but TanStack DB works alongside Vue, Solid, and Svelte as well.
Andromeda: The Newest JavaScript Runtime on the Block — A new JavaScript and TypeScript runtime built around the Rust-powered Nova engine. It’s still early days but they’re promising a lot: native single file compilation, a GPU-accelerated 2D Canvas API, low runtime overhead, interop with Rust, memory safety, WinterTC compatibility, and cross-platform support.
SpessaSynth: SoundFont2-Based MIDI Player and Synthesizer — If you think typical browser-played MIDI files sound terrible, you’re right – but try this! It uses a SoundFont sample driven approach to play MIDI files in a predictable fashion, and also includes an editor/visualizer if you need it. The live demo is quite striking.
Spessasus
While we're on the topic, here are some other neat music related JavaScript projects we've enjoyed over the years:
alphaTab – A full on music notation and guitar tab rendering library for building complete musical apps (above).
chiptune3.js – A bit like SpressaSynth (also above) but for playing module file music. Live demo.
🎸 SVGuitar – A library to render SVG guitar chord charts.
JZZ.js – A JavaScript MIDI library that hides a lot of complexity behind its chained syntax when you need to work directly with MIDI. (The keyboard logo at the top left of its homepage is a neat easter egg.)
Strudel – A live-coding environment in the browser for generating pieces of music with simple, chained JavaScript expressions.