JS frameworks, React/Vue/Svelte, and runtime updates Compiled for immediate developer deployment.
calendar_todaysummarizeWeek 21-2026
article
Deno 2.8
TAG: RUNTIME
Deno 2.8 is the biggest minor release to date, introducing six new subcommands: deno audit fix, deno bump-version, deno ci, deno pack, deno transpile, and deno why. The npm: prefix is now optional on the CLI, and cold npm installs run 3.66x faster than 2.7 thanks to parallel resolution, abbreviated packuments, and improved tarball extraction. Node.js API compatibility leapt from roughly 42% in 2.7 to 76.4% (3,405 of 4,457 tests), putting Deno well ahead of Bun 1.3.14 at 36.4%. The release also bundles TypeScript 6.0.3, adds import defer support, native CPU profiling with flamegraph and Markdown output, Chrome DevTools network inspection, the catalog: protocol for monorepos, and OffscreenCanvas as a stable global.
Node.js 24.16.0, codenamed Krypton, is the latest LTS release on the v24 line. The most notable addition is crypto.randomUUIDv7(), a semver-minor addition that generates time-ordered UUIDs per the RFC 9562 specification. The test runner gains test order randomization, aligned mock timeout APIs, and mock-timers support for AbortSignal.timeout. The fs module adds a cancellable signal option to fs.stat() and exposes the frsize field in statfs. The debugger receives edit-free runtime expression probes via node inspect, and the http module hardens ClientRequest options merging and adds req.signal to IncomingMessage. The util module gains hex-color text colorization support.
On May 6, 2026, React and Next.js patched twelve vulnerabilities in a single advisory. CVE-2026-23870, rated high severity, is a denial-of-service in the Flight protocol deserializer: a single unauthenticated HTTP request with a malformed chunk graph can pin a Node worker on CPU until it stops answering other requests. The bug affects react-server-dom-webpack, react-server-dom-parcel, and react-server-dom-turbopack on every 19.x line up to 19.0.5/19.1.6/19.2.5, and every Next.js App Router project is in scope even without explicit Server Actions. The fix in patched versions adds structural validation, depth and size caps, and type-tag enforcement to the deserializer. The author argues that the Server Actions mental model as function calls obscures that each use server directive creates an unauthenticated HTTP endpoint parsing Flight-shaped bytes.
TanStack Virtual Just Got a Lot Faster, and Finally Handles iOS
TAG: FRAMEWORK
Tanner Linsley audited TanStack Virtual end-to-end and shipped the largest single performance release in years. The core fix eliminated a hidden Map clone in resizeItem that caused 50 million wasted operations on a 10k-item list, dropping that scenario from 1.9 seconds to 1.3 milliseconds (1,382x faster). Cold mount at 100k items improved from 6.1 ms to 4.5 ms in real React, and 500k-item mounts dropped from 14 ms to 2.7 ms via a Float64Array-backed lazy VirtualItem proxy. iOS Safari momentum scroll, broken for years on dynamic-height lists, now works via a deferred scrollTop write that flushes once the touch gesture settles. Backward-scroll jank with dynamic items is also fixed by default by gating scroll-position adjustments on scroll direction.
Webpack 5.107 takes the first step toward native HTML module support: enabling experiments.html lets you import .html files from JavaScript, with inline style and script tags, img src, link href, and script src references all processed through the normal webpack pipeline, replacing html-loader for these cases. A separate experiments.typescript flag adds zero-loader TypeScript compilation using Node.js's built-in module.stripTypeScriptTypes, with the same constraints as TypeScript's erasableSyntaxOnly mode. CSS Modules gain scope hoisting, a pure mode parser option to catch accidentally global selectors, and the ability to use @value identifiers inside @import and url() references. The resolver now includes module-sync in conditionNames to align with Node.js.
ReDoS in the Wild: What 329 JavaScript Repositories Taught Us About Regex Denial of Service
TAG: SECURITY
Ko-Hsin Liang scanned 329 public JavaScript and TypeScript repositories using a Babel-based AST detector and found 9,528 potential ReDoS patterns across 176 repositories, with 9,516 classified as overlapping alternatives. Benchmarks on Node.js v24 confirmed that patterns like (a*)*, (a|a)*, and ((a+)+)+ cause exponential backtracking: a 20-character input can take 150-244 ms, and inputs of 40 characters or more reliably hit a 5-second timeout while equivalent safe patterns remain sub-millisecond. A follow-up dynamic probe generating the simplest attack input for each finding produced zero timeouts, showing that a static scan is a broad filter, not a final verdict. The study recommends using safe-regex, eslint-plugin-regexp, or the re2 npm module, and prefers parsers such as new URL() over complex nested regex for semantic validation.
ForrestKnight covers the AI-driven rewrite of Bun from Zig to Rust, completed after Bun's acquisition by Anthropic. Jarred Sumner used Claude to port approximately 1,200 Zig files to Rust following a porting.md blueprint with around 300 rules covering type mappings, idiom translations, and naming conventions. The merged code passes Bun's full test suite on all platforms, fixes several memory leaks, shrinks the binary by 3-8 MB, and benchmarks neutral to faster. Critics noted over 13,000unsafe blocks compared to UV's 73, but the video explains that Bun's C/C++ FFI bridges account for roughly 2,400 unavoidable unsafe blocks, while the rest stem from faithfully porting Zig's 2,500-plus raw pointer manipulations. The rewrite is a phase-A draft (logic faithful, not yet idiomatic), with Zig code to be removed incrementally in follow-up PRs.
Deno 2.8 is the biggest minor release to date, introducing six new subcommands: deno audit fix, deno bump-version, deno ci, deno pack, deno transpile, and deno why. The npm: prefix is now optional on the CLI, and cold npm installs run 3.66x faster than 2.7 thanks to parallel resolution, abbreviated packuments, and improved tarball extraction. Node.js API compatibility leapt from roughly 42% in 2.7 to 76.4% (3,405 of 4,457 tests), putting Deno well ahead of Bun 1.3.14 at 36.4%. The release also bundles TypeScript 6.0.3, adds import defer support, native CPU profiling with flamegraph and Markdown output, Chrome DevTools network inspection, the catalog: protocol for monorepos, and OffscreenCanvas as a stable global.
ForrestKnight covers the AI-driven rewrite of Bun from Zig to Rust, completed after Bun's acquisition by Anthropic. Jarred Sumner used Claude to port approximately 1,200 Zig files to Rust following a porting.md blueprint with around 300 rules covering type mappings, idiom translations, and naming conventions. The merged code passes Bun's full test suite on all platforms, fixes several memory leaks, shrinks the binary by 3-8 MB, and benchmarks neutral to faster. Critics noted over 13,000unsafe blocks compared to UV's 73, but the video explains that Bun's C/C++ FFI bridges account for roughly 2,400 unavoidable unsafe blocks, while the rest stem from faithfully porting Zig's 2,500-plus raw pointer manipulations. The rewrite is a phase-A draft (logic faithful, not yet idiomatic), with Zig code to be removed incrementally in follow-up PRs.
Node.js 24.16.0, codenamed Krypton, is the latest LTS release on the v24 line. The most notable addition is crypto.randomUUIDv7(), a semver-minor addition that generates time-ordered UUIDs per the RFC 9562 specification. The test runner gains test order randomization, aligned mock timeout APIs, and mock-timers support for AbortSignal.timeout. The fs module adds a cancellable signal option to fs.stat() and exposes the frsize field in statfs. The debugger receives edit-free runtime expression probes via node inspect, and the http module hardens ClientRequest options merging and adds req.signal to IncomingMessage. The util module gains hex-color text colorization support.
On May 6, 2026, React and Next.js patched twelve vulnerabilities in a single advisory. CVE-2026-23870, rated high severity, is a denial-of-service in the Flight protocol deserializer: a single unauthenticated HTTP request with a malformed chunk graph can pin a Node worker on CPU until it stops answering other requests. The bug affects react-server-dom-webpack, react-server-dom-parcel, and react-server-dom-turbopack on every 19.x line up to 19.0.5/19.1.6/19.2.5, and every Next.js App Router project is in scope even without explicit Server Actions. The fix in patched versions adds structural validation, depth and size caps, and type-tag enforcement to the deserializer. The author argues that the Server Actions mental model as function calls obscures that each use server directive creates an unauthenticated HTTP endpoint parsing Flight-shaped bytes.
TanStack Virtual Just Got a Lot Faster, and Finally Handles iOS
Tanner Linsley audited TanStack Virtual end-to-end and shipped the largest single performance release in years. The core fix eliminated a hidden Map clone in resizeItem that caused 50 million wasted operations on a 10k-item list, dropping that scenario from 1.9 seconds to 1.3 milliseconds (1,382x faster). Cold mount at 100k items improved from 6.1 ms to 4.5 ms in real React, and 500k-item mounts dropped from 14 ms to 2.7 ms via a Float64Array-backed lazy VirtualItem proxy. iOS Safari momentum scroll, broken for years on dynamic-height lists, now works via a deferred scrollTop write that flushes once the touch gesture settles. Backward-scroll jank with dynamic items is also fixed by default by gating scroll-position adjustments on scroll direction.
Webpack 5.107 takes the first step toward native HTML module support: enabling experiments.html lets you import .html files from JavaScript, with inline style and script tags, img src, link href, and script src references all processed through the normal webpack pipeline, replacing html-loader for these cases. A separate experiments.typescript flag adds zero-loader TypeScript compilation using Node.js's built-in module.stripTypeScriptTypes, with the same constraints as TypeScript's erasableSyntaxOnly mode. CSS Modules gain scope hoisting, a pure mode parser option to catch accidentally global selectors, and the ability to use @value identifiers inside @import and url() references. The resolver now includes module-sync in conditionNames to align with Node.js.
ReDoS in the Wild: What 329 JavaScript Repositories Taught Us About Regex Denial of Service
Ko-Hsin Liang scanned 329 public JavaScript and TypeScript repositories using a Babel-based AST detector and found 9,528 potential ReDoS patterns across 176 repositories, with 9,516 classified as overlapping alternatives. Benchmarks on Node.js v24 confirmed that patterns like (a*)*, (a|a)*, and ((a+)+)+ cause exponential backtracking: a 20-character input can take 150-244 ms, and inputs of 40 characters or more reliably hit a 5-second timeout while equivalent safe patterns remain sub-millisecond. A follow-up dynamic probe generating the simplest attack input for each finding produced zero timeouts, showing that a static scan is a broad filter, not a final verdict. The study recommends using safe-regex, eslint-plugin-regexp, or the re2 npm module, and prefers parsers such as new URL() over complex nested regex for semantic validation.
This week's JavaScript category was dominated by major runtime releases. Deno 2.8 — the biggest minor release to date — landed six new subcommands (deno audit fix, deno bump-version, deno ci, deno pack, deno transpile, deno why), cut cold npm install times by 3.66x, and pushed Node.js API compatibility from 42% to 76.4%, well ahead of Bun 1.3.14's 36.4%. Node.js 24.16.0 (LTS, codenamed Krypton) shipped crypto.randomUUIDv7() for RFC 9562 time-ordered UUIDs, test-order randomization, and a cancellable signal option on fs.stat(). Webpack 5.107 previewed native HTML module support via experiments.html and zero-loader TypeScript compilation viaexperiments.typescript.
Security was a sharp concern: CVE-2026-23870, a high-severity denial-of-service in React's Flight protocol deserializer, was patched across react-server-dom-webpack, react-server-dom-parcel, and react-server-dom-turbopack on every 19.x line up to 19.0.5/19.1.6/19.2.5 — affecting all Next.js App Router projects. A separate empirical study scanning 329 repositories found 9,528 potential ReDoS patterns; tools like safe-regex, eslint-plugin-regexp, and the re2 npm module were recommended as mitigations.
On the performance front, TanStack Virtual shipped a 1,382x speedup on 10k-item lists by eliminating a hidden Map clone in resizeItem, and fixed long-broken iOS Safari momentum scroll via a deferred scrollTop write. Meanwhile, Bun completed an AI-assisted Zig-to-Rust rewrite of approximately 1,200 files using Claude and a porting.md rulebook, shrinking the binary by 3-8 MB while passing the full test suite.
Key Takeaways
Deno 2.8 brings Node.js API compatibility to 76.4% (vs. Bun's 36.4%) and makes cold npm installs 3.66x faster — narrowing the gap with Node.js significantly.
CVE-2026-23870 is a high-severity DoS in React's Flight deserializer affecting all Next.js App Router projects; patch to react-server-dom 19.0.5/19.1.6/19.2.5 immediately.
TanStack Virtual's 1,382x list-rendering speedup and iOS Safari momentum-scroll fix ship in a single release — a must-update for any virtualized list at scale.
