The Inner Workings of JavaScript Source Maps — Ever wondered how devtools can magically turn mangled, minified JavaScript back into readable source while debugging? Zero magic; that’s a source map doing its job. But how do source maps actually work under the hood?
Manoj Vivek
Ship Secure MCP Auth Without Relying on API Keys — API keys are hard to scope and break user flows. WorkOS Connect delivers a fully compliant OAuth 2.1 flow. It handles PKCE, scopes, user consent, and secure token issuance out of the box.
Embedding TypeScript with Hako — A technical look at the Hako JavaScript engine. It runs in WebAssembly so can be more easily embedded in more environments, including mobile apps.
Andrew Sampson
IN BRIEF:
GitHub has updated its post about ongoing npm security changes. npm classic tokens can no longer be created, but existing ones will continue to work till February 3, 2026 at the latest.
How to Throttle Specific Requests in Chrome DevTools — Chrome DevTools has supported network throttling for a long time but you can now throttle requests to specific URLs or domains too, which could be ideal if you want to see how your site handles the failure of third party scripts.
🖼️image-dimensions: Get the Dimensions of Images — A zero-dependency way to get the pixel width and height of JPEG, PNG/APNG, GIF, WebP, AVIF and HEIF images in any modern JavaScript environment.
Directives and the Platform Boundary — First there was the "use strict" directive to opt in to strict mode in JavaScript, but now you’ll encounter use client, use server, React's new use no memo, and more, and they're not standard JS features at all. Tanner thinks this proliferation of directives comes at a cost, with an increased risk of framework and tooling lock-in.
🏆TypeScript Leaps to #1 Most Used Language on GitHub — As part of this week’s GitHub Universe event, GitHub released its annual report of activity on the platform. A year ago, Python jumped to #1, pushing JavaScript to #3, but this year TypeScript takes the crown and GitHub suggests LLM-oriented development played a role. Taking JavaScript and TypeScript together, however, places our ecosystem far out in front.
I Built the Same App 10 Times: Evaluating Frameworks for Mobile Performance — When targeting mobile devices, small bundle sizes and quick rendering times are key, so Loren wanted to see how different approaches compared. Marko, SolidStart, SvelteKit, Qwik, Nuxt, Next.js and more are all under the spotlight here.
Loren Stewart
▶ The Origin Story of JavaScript — Annie takes us all the way back to the start of the Web in the early 90s and walks us through the conditions and advancements that enabled JavaScript to take off, all the way through to our modern framework-oriented, tool-rich ecosystem. (25 minutes.)
Annie Sexton
Still Writing Tests Manually? — See why modern engineering teams like Dropbox, Notion and Wiz rely on Meticulous to run E2E UI tests.
🤫spoilerjs: Framework-Agnostic 'Spoiler Effects' — If you’ve got some text (or maybe sensitive data like a token) you want to hide on a page until someone clicks on it, this Telegram-inspired web component is for you.
shajid hasan
Gasket: CLI Tool to Discover 'Bridges' Between JavaScript and Native Code — Dynamic analysis tool that inspects the in-memory layout of JavaScript function objects to identify those that cross the language boundary. This is quite niche, but built by the authors of a paper about identifying such bridges for security purposes.
📊 Recharts 3.3 – A chart library built on top of D3. The homepage has examples and demos. v3.3 gives charts the direct ability to handle responsive sizing.
A roundup of some other interesting stories in the broader landscape:
vite-plugin-use-golang is a curious new Vite plugin that lets you add a "use golang" directive to the top of a 'JavaScript' file but then actually write Go code instead (which is then compiled to WebAssembly).
Node-RED is a popular 'low code' JavaScript-powered programming environment and Node-RED Con 2025 is a free, online event taking place next week (November 4) highlighting how it's used in engineering, smart homes, and even to play Factorio.
Next.js 16 Released — Launched alongside this week’s Next.js Conf (you can ▶️ watch the livestream here), the popular React framework gains explicit caching components, an MCP server for AI-assisted debugging, both Turbopack and React Compiler support go stable, and more.
It's been a decade since we mentioned Backbone.js regularly, but it was a big deal in the pre-React era. Panphora looks at React vs Backbone in 2025 and ponders how much progress we've made in 15 years.
Importing vs Fetching JSON — You’ve used import to load code, but what about loading JSON? Import attributes, now broadly supported across browsers, make it possible, but is there any point instead of using fetch? Jake investigates.
Jake Archibald
Rethinking Async Loops in JavaScript — Awaiting in loops runs your async operations one-by-one instead of all at once. And using map() with await? It doesn’t even wait. Matt breaks down some patterns that actually work, and why forEach with async is easy to get wrong.
Matt Smith
Build Your Apps Faster with a Ready-to-Use Backend — Forget about DevOps headaches. OneEntry gives frontend devs a ready-to-use cloud backend with built-in database, intuitive admin panel, and flexible data models that adapt to any project.
Solving NYT's Pips Puzzle with TypeScript — I love doing the New York Times’ various puzzles, though I’m not a huge fan of their newest one: Pips. Nonetheless, it’s an interesting puzzle to consider how to solve algorithmically.
JustGage 2.0: Draw and Animate Dashboard-Style SVG Gauges — A big release for a project started over a decade ago, now brought into the modern age and using native SVG APIs. There's a playground that lets you play with the options and gauge styles.
Solito 5.0: A Way to Use React Native with Next.js — Solito is a wrapper around React Navigation and Next.js that lets you share navigation code when building cross-platform apps. v5.0 supports Next.js 16 and Expo 54, and also drops React Native Web as a dependency.
🕳️ 🥊 Hiring Now: Join Holepunch to build the peer-to-peer internet. No servers. Open source, privacy-first. Shape the future of apps. Remote worldwide.
A roundup of other interesting stories from the broader landscape:
Dr. Axel Rauschmayer continues to work on his "web dev for beginners" series with a rather epic look at CSS layout in general(above), covering Flexbox, CSS Grid, media queries and container queries. This is a fantastic, modern primer for the topic, even if you're not a beginner.
No video yet, but Node.js TSC member Ruy Adorno gave a talk at JSConf last week about What's New and What's Next in Node.js and has shared his slidedeck which stands well on its own.
SpacetimeDB is a Rust-powered database/server combo for powering real-time multiplayer games and its latest release adds support for TypeScript modules.
Bun 1.3: The Full-Stack JavaScript Runtime — Arriving a few hours after last week’s issue (natch!) Bun 1.3 remains the big news of the past week. Bun is a performance and DX-focused JavaScriptCore-powered runtime which, with v1.3, balances being a drop-in Node.js replacement with becoming a ‘full-stack runtime’ among other exciting developments:
Full‑stack dev server with hot reloading built into Bun.serve
Improved GC with lower idle CPU and memory usage.
Built-in MySQL and Redis clients (alongside Postgres and SQLite).
AI Agents? Meet External Tools — Launching an AI-powered app? Make sure your agent is securely connecting with all of your external tools and APIs. Learn more about how Auth0’s Token Vault can secure your logins and agents so your users aren’t left vulnerable and exposed.
Auth0 sponsor
Announcing Vite+ / VitePlus — Originally announced at last week's ViteConf, Evan shares more details about what this extended, unified Vite-based toolchain (now in ‘early access’) is, and the motivation behind it. Unlike regular Vite, it has a commercial angle but “will be free for individuals, open source projects, and small businesses” as well as “source available.”
Evan You
Node.js v25.0.0 (Current) Released — The latest cutting edge version of Node has arrived with Web Storage enabled by default, JSON.stringify perf improvements, a new --allow-net option in the permission model, built-in Uint8Array base64/hex conversion, and WebAssembly and JIT optimizations.
Rafael Gonzaga
IN BRIEF:
Cloudflare Sandboxes is a new service for running untrusted JavaScript (and Python) code in a safe container-based 'sandbox' environment.
The Remix project's Remix Jam event took place last week, and you can now ▶️ watch the full livestream. If you want to see the reveal and demo of Remix 3, jump to 03:24:30 in the video.
Improving the Trustworthiness of JavaScript on the Web — A look at WAICT (Web Application Integrity, Consistency, and Transparency), an early-stage W3C-backed effort to bring stronger ‘app store-like’ security guarantees to the Web by ensuring the code a browser runs hasn’t been modified by attackers.
Michael Rosenberg (Cloudflare)
▶ Beyond Signals — A half-hour talk from the creator of SolidJS, exploring how signals (once pioneering, now mainstream) are shaping web development, their architectural implications, but why we’re only “at the beginning of the journey” and what comes next.
jsonriver: A Simple, Fast Streaming JSON Parser — A library to parse JSON incrementally as it streams in, such as from a network request or an LLM, returning a sequence of ‘increasingly complete’ values.
Peter Burns (Google)
Kaluma 1.3: A Tiny JS Runtime for the Raspberry Pi Pico 2 — Can a JavaScript runtime squeeze onto an RP2350-based Raspberry Pi Pico 2? Kaluma can, all while offering some Node.js-like niceties. v1.3 is powered by the latest version of JerryScript, a lightweight JS engine for constrained environments.
🚀 Unlock 2× Team Efficiency in Just 30 Days. JS Weekly readers: Claim your free Audit by Fractional CTO and resolve your toughest SaaS issues—fast.
🕳️ 🥊 Hiring Now: Build P2P apps for mobile & desktop. Ditch servers, empower users, protect privacy. Open source. Remote EU.
📢 Elsewhere in the ecosystem
A roundup of some other interesting stories in the broader landscape:
The React team has shipped v1.0 of React Compiler, a tool for automating the optimization of React apps by way of auto-memoization applied based upon analysis of their code.
Sebastian Lague's ▶️ Simulating Smoke video presents a fascinating look at how you might model and code a fluid simulation to emulate the behavior of smoke. It's not in JavaScript but is mostly math anyway.
With this week's release of Firefox 144, all major browsers now support view transitions, a neat front-end feature.
🐈 Cat cams! Nothing to do with programming, but meow.camera charmed me. You might need to switch cameras to actually find a cat. Not a fan of cats? Check out the Namib Desert for some bigger critters..