Skip to main content

Newsletter Roundup — Week of August 3 📬

· 8 min read
Gergely Sipos
Gergely Sipos
Frontend Architect

What caught our eye this week across JavaScript Weekly #796, React Status #485, and Node Weekly #635 — and what it means for the Aliz stack.

React Ecosystem​

Octane: React's Programming Model, Compiled Away​

Dominic Gannaway, creator of Inferno, released Octane — a compiled framework that uses React's programming model (TSX/JSX) but generates reactivity ahead of time with no Virtual DOM. Octane already integrates with TanStack Query and TanStack Router, plus other common React libraries.

Aliz stack connection: Octane isn't a replacement for React in our stack, but it signals where the broader ecosystem is heading: compiling away the runtime. Note that the React Compiler takes a different approach — it adds automatic memoization at build time while retaining React's runtime and Virtual DOM reconciliation. Worth watching as both patterns mature.

TanStack Drops RSC from tanstack.com​

In a data-driven write-up, Tanner Linsley explained why TanStack stopped using React Server Components on its own site. After shrinking their markdown and syntax highlighting stack to 27KB (via new TanStack Markdown and TanStack Highlight libraries), plain SSR delivered smaller pages with lower blocking time and simpler code than RSC.

Aliz stack connection: This doesn't invalidate RSC — TanStack's use case (static docs/marketing) is very different from data-heavy apps. But the new TanStack Markdown (4.9KB) and Highlight (8KB) libraries are compelling alternatives to the ~358KB Shiki-based approach for syntax highlighting in lightweight contexts.

TanStack Charts Alpha​

Alongside the rebrand and new site, TanStack released an alpha of TanStack Charts — a grammar-based charting library designed so AI agents can write chart specs. Microsoft is also experimenting in this space with Flint.

Aliz stack connection: We recommend ECharts for data visualization. TanStack Charts is early alpha, but the grammar-for-agents angle is interesting — worth adding to our triage list once it stabilizes.

MobX 7.0​

MobX 7.0 slims down its API, removes deprecations, updates React bindings, and now always uses Proxy-backed observable objects and arrays. A significant modernization release.

Other React Highlights​

  • Mantine 9.5 — date pickers gain native month/year select, plus a new SunburstChart component.
  • React Ace 15.0 — code editor component now ships native ESM alongside CJS, fixing import interop under Vite 8.
  • OverflowGuard — 2KB component that detects when toolbar/nav content overflows its container, so you can collapse without magic breakpoints.
  • Microcharts — sparkline-style word-sized charts for React, 106 chart types.
  • Virtua 0.50 — zero-config ~3KB virtual list/grid component, now with Angular support alongside React, Vue, Solid, and Svelte.

JavaScript Ecosystem​

Anders Hejlsberg Demos TypeScript 7's 10x Speedup​

The creator of TypeScript showed off the Go-based TypeScript 7 compiler running on VS Code's 1.3 million line codebase, demonstrating the 10x speed improvement. He also covered the new LSP language server and why compiler API users (Vue, Astro, Svelte) should stay on TypeScript 6 for now.

Aliz stack connection: We covered TypeScript 7.0 in detail when it launched. Anders' demo confirms the real-world performance gains are as advertised — this is directly relevant to our TypeScript stack.

Rust Is Still Eating JavaScript in 2026​

Lee Robinson's 2021 prediction that Rust would rewrite JavaScript tooling got a 2026 update. Rspack, Biome, Turbopack, Rolldown, Oxc, and Bun's recent Rust rewrite all prove him right. This was the most-read link on JavaScript Weekly this year.

Aliz stack connection: Our bet on Vite (powered by Rolldown) continues to benefit directly from this trend.

Octane: A Compiled React Alternative (Cross-listed)​

Covered above in the React section — Octane appeared in both newsletters as a standout release.

TC39: Await Dictionary Reaches Stage 3​

The Await Dictionary proposal (Promise.allKeyed) advanced to Stage 3 at last week's TC39 meeting. This lets you await multiple named promises and get back an object with matching keys instead of a positional array, making concurrent async code more readable.

Oxlint Type-Aware Linting Now Stable​

Oxlint's type-aware linting is now stable. The Rust-based linter can now use TypeScript type information for its checks, bringing it closer to feature parity with ESLint + typescript-eslint.

Other JavaScript Highlights​

  • htmx 4.0 — released with a tongue-in-cheek claim of being "the first JavaScript library to release exclusively on the Game Boy."
  • MapLibre GL JS 6.0 — WebGL-powered vector map library goes ESM-only, requires WebGL 2, ships broad performance gains.
  • Bruno 4.0 — open source HTTP API client, a JavaScript-powered Postman alternative.
  • Shadscan — deterministic UI audit tool for shadcn/ui apps with ~60 static checks, no AI needed.
  • eslint-package-json — ESLint plugin catching package.json mistakes (invalid names, bad version ranges, broken exports).

Node.js Ecosystem​

npm to Scan Every Package for Malware at Publish Time​

GitHub announced that the npm registry will begin scanning packages at publish time for malware. New versions may take several minutes to become installable and could be held or blocked if flagged. This is a major step forward for supply chain security.

Aliz stack connection: Combined with our existing npm supply chain security practices (lockfiles, min-release-age, exact version pinning), publish-time scanning adds another layer of defense. The min-release-age cooldown we enforce also gives these scans time to complete before packages reach our CI.

Vercel's scriptc: TypeScript-to-Native Compiler​

Vercel Labs released scriptc, a TypeScript-to-native ahead-of-time compiler that promises "what compiles behaves byte-for-byte like Node." It's static by default with an opt-in --dynamic mode that embeds a JavaScript engine for runtime dynamism.

Node.js Security Releases: 11 CVEs Fixed​

Node v26.5.1, v24.18.1 and v22.23.2 are available, fixing 11 CVEs including two HTTP/2 flaws and a Permission Model allowlist bypass. Action item: Update your pinned Node versions in CI and local environments.

New Node.js API Docs Site (Preview)​

Node's official API docs are getting a complete redesign, now sharing a design system with nodejs.org and featuring built-in search. The preview is available for testing.

Secure npm Publishing Guide​

Andrey Sitnik (creator of PostCSS and nanoid) published a practical guide to publishing npm packages securely in 2026, covering staged publishing, trusted publishing, and security best practices.

North Korean Group Linked to npm Supply Chain Attacks​

Amazon's security team traced several npm supply chain attacks (including those targeting debug and chalk) to a single North Korean-linked group — a sobering reminder of the sophistication of supply chain threats.

Other Node Highlights​

  • jsdom 30.0 — adds CSS.escape(), CSS.supports(), background-position-x/y, and various fixes.
  • tslog 5 — zero-dependency logger, ground-up ESM-only rewrite with pretty output, source map support, and secret masking.
  • npm-check-updates 23.0 — finds newer dependency versions, now faster, smaller, and pure ESM. Supports custom cooldown periods.
  • Verdaccio 6.9 — self-hostable private npm registry.

What This Means for the Aliz Stack​

Key threads connecting back to our Recommended Tech Stack:

  • Compiled UI frameworks emerge. Octane compiles away React's runtime and Virtual DOM entirely, while the React Compiler adds automatic memoization at build time but retains React's reconciliation model. Our React bet remains solid, but the compilation trend will reshape how React apps are built.
  • TanStack ecosystem expands. New Markdown, Highlight, and Charts libraries, plus a full rebrand. The TanStack Query ecosystem keeps growing beyond data fetching.
  • Supply chain security gets real teeth. npm publish-time malware scanning plus our existing min-release-age and lockfile practices create multiple layers of defense. The North Korean attribution shows why this matters.
  • TypeScript 7 performance confirmed. Anders' live demo on a 1.3M-line codebase validates the TypeScript 7 speed claims. Teams should start testing the migration path.
  • Node security patches. 11 CVEs fixed across three Node release lines — stay on top of version pins.

Further Reading​