JavaScript news and engineering summaries

The Mastodon web application requires JavaScript to function properly in a browser. Users are advised to enable JavaScript or utilize one of the available native Mastodon applications for their specific platform to ensure full functionality.

A major supply chain attack in the npm registry recently compromised millions of applications, highlighting systemic vulnerabilities in the JavaScript ecosystem. While developers describe these incidents as inevitable, contrast with ecosystems like Go and Rust shows that smaller dependency chains and stricter security practices can effectively mitigate such catastrophic security breaches.

htmx 4.0.0 modernizes internals by replacing XMLHttpRequest with fetch() while preserving near-htmx 2 behavior. Key changes include explicit attribute inheritance, standardized events, and history restoration without localStorage by default. New capabilities include morph swaps, <hx-partial>, streaming extensions, hx-live, and an upgrade checker. htmx 2 remains npm’s latest line until early 2027, with 4.x available now.

The Ladybird browser project has begun transitioning parts of its codebase from C++ to Rust, starting with the LibJS JavaScript engine. This decision prioritizes memory safety and leverages the mature Rust ecosystem. Using AI-assisted translation, developers achieved identical byte-for-byte performance and output without regressions, aiming for a phased, stable integration which will eventually replace the C++ pipeline.

Mastodon is a decentralized social networking platform. Its official web application requires JavaScript to function properly. Users who prefer not to use a web browser or encounter compatibility issues can access the service through various native apps available for different operating systems.

Deno desktop is a tool that turns Deno projects, including Next.js and other web frameworks, into self-contained, cross-platform binary desktop applications. It offers small bundle sizes, Node compatibility, in-process bindings for performance, and built-in features like auto-updates and cross-compilation, providing a streamlined alternative to existing web-based desktop frameworks.

An investigation found that AliExpress loads obfuscated Alibaba security scripts, collina.js and fireyejs.js, which create silent WebAudio graphs for audio fingerprinting. Despite zero gain, they connect to the audio destination and can keep Bluetooth audio active, disrupting multipoint headphones. Blocking both scripts with uBlock Origin prevents the behavior but may affect anti-fraud checks.

Mastodon requires JavaScript to function correctly in web browsers. If users encounter issues, they are encouraged to enable JavaScript in their settings or download a native Mastodon application for their specific platform to ensure a better experience.

A developer at Mumbai airport, frustrated by a traveler playing loud video reels without headphones, created a creative technical solution called STFU. Built using the Web Audio API and Claude, the application operates by capturing ambient audio and playing it back with a short delay of approximately two seconds. This creates an auditory feedback loop that induces cognitive dissonance in the speaker or the source of the noise, effectively forcing them to stop. The creator noted that this psychological phenomenon is more effective than direct confrontation. Inspired by a similar project by Tim Darcet, the tool was open-sourced to help others deal with antisocial noise levels in public spaces.

A privacy vulnerability in Firefox and Tor Browser allowed websites to track users by exploiting the non-deterministic order of IndexedDB database results. This process-scoped identifier leaked across origins, circumventing Private Browsing and Tor's isolation promises. Developers resolved this by canonicalizing result order to remove identifying entropy, ensuring API output remains stable and consistent rather than leaking internal process states.

jQuery 4.0.0 marks a significant milestone as the first major release in nearly a decade, celebrating the library's 20th anniversary. This version introduces critical modernizations, including the migration of the source code to ES modules and the removal of support for Internet Explorer versions older than 11. The update enhances security by supporting Trusted Types and Content Security Policy directives. To streamline the library, several deprecated APIs and internal-only prototype methods have been removed, resulting in a smaller file size. Notable changes also include an update to the slim build, which now excludes Deferreds and Callbacks in favor of native Promises. The release aligns jQuery's event ordering for focus and blur events with the W3C specification, ensuring better consistency across modern browsers. Developers are encouraged to use the provided upgrade guide and migration plugin to transition smoothly to this refined, performance-oriented version.

Vite 8 has been released, featuring the new Rust-based Rolldown bundler which replaces both esbuild and Rollup. This unified architecture delivers 10-30x faster builds while maintaining plugin compatibility. Key updates include integrated Devtools, built-in TypeScript path support, and performance improvements for large-scale projects, alongside the launch of a new plugin registry.

Bloomberg and Igalia spearheaded a nine-year effort to introduce Temporal, a modern, immutable date and time API for JavaScript. Replacing the flawed Date object, Temporal reached Stage 4 in TC39 and is featured in ES2026. It offers nanosecond precision, time zone awareness, and calendar support, utilizing a unique cross-engine Rust implementation named temporal_rs.

A significant security incident has been identified involving multiple compromised npm packages within the @redhat-cloud-services scope. Several versions of these packages have been found to contain malicious code. Developers and administrators are urged to audit their dependencies and address the identified versions to mitigate potential security risks.

Mastodon is a prominent decentralized social media platform that offers users an alternative to traditional centralized networks. To fully utilize its web-based application, users must ensure that JavaScript is enabled in their browser settings. JavaScript is essential for the interface to function correctly, facilitating real-time interactions and dynamic content loading. Users who prefer not to use a web browser or who have specific platform requirements can opt for various native apps available for mobile and desktop environments. These applications provide a tailored experience for accessing the Mastodon ecosystem across different devices.

Cloudflare has acquired VoidZero, with the original team joining to support foundational tools like Vite, Vitest, Rolldown, and Oxc. These projects remain open-source, vendor-agnostic, and community-driven. Cloudflare is also establishing a $1 million ecosystem fund to support contributors, aiming to integrate Vite as the native foundation for its developer platform and future tooling.

Mastodon is a prominent decentralized social networking platform that operates within the Fediverse, offering users an alternative to traditional centralized social media. To ensure a seamless user experience, the Mastodon web application requires JavaScript to be enabled in the browser, allowing for interactive features and real-time updates. For users who prefer a different interface or those who cannot use JavaScript, Mastodon supports various native apps across multiple platforms including iOS and Android. These applications leverage the platform's API to provide a robust and secure way to interact with the community without relying solely on a web browser.

An article derives music theory from physics, arithmetic, and code: sound becomes time-varying numbers, envelopes shape notes, harmonics explain timbre and consonance, and octave ratios lead to twelve-tone equal temperament. JavaScript arrays then model MIDI pitches, scales, modes, chords, progressions, and notation, showing how musical tension and resolution emerge from constraints rather than memorized conventions.

This message informs users that JavaScript must be enabled in their web browser to ensure the full functionality and interactive features of the website are accessible to them.

Mastodon is a decentralized social networking platform. Its web interface requires JavaScript to function properly. Users who prefer not to use a web browser can access the service through various native apps available across multiple operating systems, ensuring broad compatibility and accessibility for the federated network.