JavaScript news and engineering summaries

Deno’s entire team is joining Cloudflare to develop a shared platform based on Cloudflare Workers and Durable Objects, aiming to make distributed server development simpler. The team will stop developing a separate Deno runtime after one year of monthly bug-fix and security releases, while Deno remains open source. Deno Deploy will shut down after six months, with migration support for paying customers. JSR continues on Cloudflare, and rusty_v8 will be supported and integrated into workerd.

e2e is an open-source end-to-end testing framework for web and mobile apps that lets agents execute natural-language goals, then validates outcomes with locators and assertions in the same test. It supports Playwright browsers, iOS simulators, and Android emulators, with configurable model providers or local models. Agent actions are recorded and replayed without model calls until the app changes, reducing repeat-run cost while preserving semantic testing in TypeScript.

The Mastodon web application requires JavaScript to function properly in a browser. Users are advised to enable JavaScript or utilize one of the available native Mastodon applications for their specific platform to ensure full functionality.

A major supply chain attack in the npm registry recently compromised millions of applications, highlighting systemic vulnerabilities in the JavaScript ecosystem. While developers describe these incidents as inevitable, contrast with ecosystems like Go and Rust shows that smaller dependency chains and stricter security practices can effectively mitigate such catastrophic security breaches.

openGym is a self-hosted gym and body-weight tracker that keeps data on the user's server instead of a subscription service. It supports weekly routines, guided workouts with supersets and cardio, 1,324 exercises, progression rules, muscle recovery and detraining views, body-weight charts, imports from FitNotes, Strong and Hevy, and passkey login. A React/Vite frontend and Node API run in Docker, storing JSON and merging concurrent edits by revision. Offline use, mobile apps, and an optional server-configured AI coach distinguish it.

htmx 4.0.0 modernizes internals by replacing XMLHttpRequest with fetch() while preserving near-htmx 2 behavior. Key changes include explicit attribute inheritance, standardized events, and history restoration without localStorage by default. New capabilities include morph swaps, <hx-partial>, streaming extensions, hx-live, and an upgrade checker. htmx 2 remains npm’s latest line until early 2027, with 4.x available now.

The Ladybird browser project has begun transitioning parts of its codebase from C++ to Rust, starting with the LibJS JavaScript engine. This decision prioritizes memory safety and leverages the mature Rust ecosystem. Using AI-assisted translation, developers achieved identical byte-for-byte performance and output without regressions, aiming for a phased, stable integration which will eventually replace the C++ pipeline.

Mastodon is a decentralized social networking platform. Its official web application requires JavaScript to function properly. Users who prefer not to use a web browser or encounter compatibility issues can access the service through various native apps available for different operating systems.

Deno desktop is a tool that turns Deno projects, including Next.js and other web frameworks, into self-contained, cross-platform binary desktop applications. It offers small bundle sizes, Node compatibility, in-process bindings for performance, and built-in features like auto-updates and cross-compilation, providing a streamlined alternative to existing web-based desktop frameworks.

An investigation found that AliExpress loads obfuscated Alibaba security scripts, collina.js and fireyejs.js, which create silent WebAudio graphs for audio fingerprinting. Despite zero gain, they connect to the audio destination and can keep Bluetooth audio active, disrupting multipoint headphones. Blocking both scripts with uBlock Origin prevents the behavior but may affect anti-fraud checks.

Mastodon requires JavaScript to function correctly in web browsers. If users encounter issues, they are encouraged to enable JavaScript in their settings or download a native Mastodon application for their specific platform to ensure a better experience.

A developer at Mumbai airport, frustrated by a traveler playing loud video reels without headphones, created a creative technical solution called STFU. Built using the Web Audio API and Claude, the application operates by capturing ambient audio and playing it back with a short delay of approximately two seconds. This creates an auditory feedback loop that induces cognitive dissonance in the speaker or the source of the noise, effectively forcing them to stop. The creator noted that this psychological phenomenon is more effective than direct confrontation. Inspired by a similar project by Tim Darcet, the tool was open-sourced to help others deal with antisocial noise levels in public spaces.

An article derives music theory from physics, arithmetic, and code: sound becomes time-varying numbers, envelopes shape notes, harmonics explain timbre and consonance, and octave ratios lead to twelve-tone equal temperament. JavaScript arrays then model MIDI pitches, scales, modes, chords, progressions, and notation, showing how musical tension and resolution emerge from constraints rather than memorized conventions.

A privacy vulnerability in Firefox and Tor Browser allowed websites to track users by exploiting the non-deterministic order of IndexedDB database results. This process-scoped identifier leaked across origins, circumventing Private Browsing and Tor's isolation promises. Developers resolved this by canonicalizing result order to remove identifying entropy, ensuring API output remains stable and consistent rather than leaking internal process states.

jQuery 4.0.0 marks a significant milestone as the first major release in nearly a decade, celebrating the library's 20th anniversary. This version introduces critical modernizations, including the migration of the source code to ES modules and the removal of support for Internet Explorer versions older than 11. The update enhances security by supporting Trusted Types and Content Security Policy directives. To streamline the library, several deprecated APIs and internal-only prototype methods have been removed, resulting in a smaller file size. Notable changes also include an update to the slim build, which now excludes Deferreds and Callbacks in favor of native Promises. The release aligns jQuery's event ordering for focus and blur events with the W3C specification, ensuring better consistency across modern browsers. Developers are encouraged to use the provided upgrade guide and migration plugin to transition smoothly to this refined, performance-oriented version.

Vite 8 has been released, featuring the new Rust-based Rolldown bundler which replaces both esbuild and Rollup. This unified architecture delivers 10-30x faster builds while maintaining plugin compatibility. Key updates include integrated Devtools, built-in TypeScript path support, and performance improvements for large-scale projects, alongside the launch of a new plugin registry.

The Mastodon web application requires JavaScript to function. Users who cannot or do not wish to enable JavaScript can instead use a native Mastodon app compatible with their platform.

Bloomberg and Igalia spearheaded a nine-year effort to introduce Temporal, a modern, immutable date and time API for JavaScript. Replacing the flawed Date object, Temporal reached Stage 4 in TC39 and is featured in ES2026. It offers nanosecond precision, time zone awareness, and calendar support, utilizing a unique cross-engine Rust implementation named temporal_rs.

A significant security incident has been identified involving multiple compromised npm packages within the @redhat-cloud-services scope. Several versions of these packages have been found to contain malicious code. Developers and administrators are urged to audit their dependencies and address the identified versions to mitigate potential security risks.

God's Eye View is an open-source, local-first browser simulator that fuses public spatial-intelligence feeds into an explorable photorealistic 3D globe. Built with vanilla JavaScript, CesiumJS, and Vite, it visualizes live aircraft, ships, satellites, earthquakes, fires, weather, traffic, transit, cameras, and infrastructure, with cockpit tracking, sensor-style rendering, annotations, shareable scenes, and optional OpenAI Realtime API voice control. It stands out through keyless operation, modular layers, server-side credential protection, and inspectable code.