Skip to main content

Newsletter Roundup — Week of July 21 📬

· 6 min read
Gergely Sipos
Gergely Sipos
Frontend Architect

What caught our eye this week across JavaScript Weekly #795, React Status #483, and Node Weekly #634 — and what it means for the Aliz stack.

JavaScript Ecosystem​

Framework Benchmarks: A Side-by-Side Comparison​

Alicia Sykes published a thorough framework benchmark comparing the same app built across Angular, Solid, React, Alpine.js, and others. The results cover bundle size, build time, and UX metrics. She also shipped Stack Match, a tool that recommends frameworks based on your criteria.

Aliz stack connection: We're firmly on React, but it's healthy to see where it stands objectively. React's trade-off is a larger bundle size compared to lighter alternatives like Preact or Solid, but its massive ecosystem, mature tooling, and hiring pool make it worthwhile for our use cases.

Nuxt 4.5: Vite 8 and Rspack 2 Integration​

Nuxt 4.5 shipped with Vite 8, Rspack 2, experimental SSR streaming, and a new useLayout composable. Nuxt 3 goes end-of-life July 31. Meanwhile, Vue 3.6 hit RC with Vapor Mode finally feature-complete.

Rolldown 1.2 Released​

Rolldown 1.2 is out — the Rust-based bundler that powers Vite. Continued Rust toolchain progress keeps our build times fast.

ESLint Codemods for Version Migrations​

ESLint now ships official codemods for automating v8→v9 and v9→v10 migrations. A useful tool to bookmark for our ESLint upgrades.

Other Highlights​

  • Astro 7.1 — our recommended content framework gets another incremental improvement.
  • Color.js 0.7 — comprehensive color library with new color spaces and gamut mapping.
  • Flint — Microsoft Research's chart spec that compiles to Vega-Lite, ECharts, or Chart.js. Interesting for agentic data visualization.
  • Preact 11.0 Beta 2 — nearing final release with a migration guide available.
  • Pinia 4.0 — Vue's state management goes ESM-only and leaner.

React Ecosystem​

Pete Hunt Returns to Lead Next.js​

Big news: Guillermo Rauch announced that Vercel hired Pete Hunt (early React team member) and Nick Schrock (co-creator of GraphQL) — Pete will lead Next.js. A significant leadership signal for the React meta-framework space.

ReactBench: Evaluating AI Coding Agents on React​

From the team behind React Scan and Million.js, ReactBench evaluates coding agents on realistic React work. At the time of the newsletter's publication, GPT 5.6 Sol led the leaderboard. Worth tracking as AI-assisted development grows in our workflows.

shadcn/typeset: Typography for Rendered HTML​

The shadcn team released shadcn/typeset — a drop-in typography system driven by a few CSS variables, packaged as a single CSS file. Useful for Markdown-rendered content in apps using shadcn/ui.

Kent C. Dodds: "The Framework Wars Are Over"​

Kent C. Dodds shared a video explaining why no one dethroned React. Meanwhile, Jack Herrington went the other direction, explaining why he's all-in on the TanStack approach over Next.js.

Aliz stack connection: Our TanStack Query recommendation aligns well with the growing "React + TanStack" pattern that doesn't require a meta-framework.

Vercel Formalizing Monthly Next.js Security Releases​

Vercel is introducing a predictable monthly security release cadence for Next.js — good news for teams that need compliance predictability.

Other Highlights​

  • react-dropzone 17.0 — mature hook-based file drag-and-drop library.
  • React Mosaic 7.0 — tiling window manager component, now targeting React 16–19.
  • brainless — Claude Code, Codex, and Grok UIs as shadcn components.

Node.js Ecosystem​

Prototype Pollution: Why Node Won't Fix It in Core​

Matteo Collina explains why the Node team rejects prototype pollution reports against core: if an attacker can already write to Object.prototype, the game is over. The real fix lives at the boundary where untrusted JSON becomes objects — relevant for any team handling user input.

Node.js Security Releases Coming July 27​

A round of security releases is planned for Node 26.x, 24.x, and 22.x resolving a HIGH severity issue. Action item: Update your pinned Node versions after the release.

Domenic Denicola's Agentic Coding Setup​

Domenic Denicola (creator of jsdom, key figure in Promises adoption) shared his developer workflow: disposable VMs, Tailscale, and git worktrees. Interesting patterns for AI-assisted development setups.

better-sqlite3 13.0: N-API Migration​

better-sqlite3 13.0 moves to N-API, meaning prebuilt binaries now work across different Node and Electron versions. New db.explain() and preparedStatement.toString() methods added.

npm Supply Chain & Slopsquatting​

Two security stories worth noting:

  • Microsoft Security Research documented how attackers adapted the AsyncAPI npm supply chain compromise to bypass disabled post-install scripts.
  • A new study identified 53 slopsquatting targets across 5 popular LLMs — packages that AI models hallucinate into existence that attackers can then register.

Aliz stack connection: Our npm supply chain security practices (lockfiles, min-release-age, exact version pinning) help mitigate these attacks.

Other Highlights​

  • Execa 10.0 — process execution library trims API, adds stream conversion and killDescendants option.
  • eslint-package-json — ESLint plugin catching package.json mistakes (invalid names, bad version ranges, broken exports).
  • Bun 1.4 teased — "biggest jump in Node.js compatibility since Bun v1.0."
  • pnpm — native workspace release management and new doctor command.
  • Prisma 7.9, Verdaccio 6.8, Piscina 5.3.

What This Means for the Aliz Stack​

Key threads connecting back to our Recommended Tech Stack:

  • Rust toolchains keep delivering. Rolldown 1.2 and the broader Rust-in-JS ecosystem continue to validate our Vite bet.
  • React leadership solidifies. Pete Hunt leading Next.js, Kent declaring the framework wars over, and ReactBench proving React's AI-generation quality all reinforce React as the safe default.
  • Supply chain vigilance matters. Slopsquatting and adapted supply chain attacks mean our npm security practices (exact pins, lockfiles, min-release-age) aren't optional luxuries.
  • shadcn ecosystem growing. Between typeset and last week's Base UI default, the shadcn/ui ecosystem keeps expanding.
  • ESLint codemods simplify future ESLint version upgrades — file this away for when we migrate.

Further Reading​