11 posts tagged with "ecosystem"

OJ — nicknamed "Orange Juice" — is a single Rust binary from Lovable that runs a React app the way Vite's dev server does. To be clear up front, because this is where most of the coverage goes wrong: it is not a fork of Vite's source code, and it is not a full rewrite of Vite. It reimplements one layer — the dev-server layer — in Rust, while leaning on the same Rust foundations Vite itself already uses. That correction matters, but it isn't the real story. The real story is the debate OJ set off: a Socket.dev article and a widely-shared Evan You post arguing that AI is collapsing the cost of reimplementing open-source dependencies, and what that does to the ecosystem. If you want the background on why Rust keeps showing up under node_modules, that's a separate post — see The Rust Wave Under Your node_modules. This one is about OJ specifically, and the argument it started.

What caught our eye this week across JavaScript Weekly #802, React Status #491, and Node Weekly #641 — and what it means for the Aliz stack.

What caught our eye this week across JavaScript Weekly #799, React Status #488, and Node Weekly #638 — and what it means for the Aliz stack.

What caught our eye this week across JavaScript Weekly #796, React Status #485, and Node Weekly #635 — and what it means for the Aliz stack.

The State of CSS 2026 results are out, fielded May 15 – June 29, 2026 with ~4,900 respondents. The question set shrank from 63 features to 46, and the headline is a contradiction: the most-wanted new feature of the year is also the most-avoided one. Underneath that sits something stranger — CSS is the one part of the frontend stack AI still can't write. This post is about what to do differently, not about what the charts say.

What caught our eye this week across JavaScript Weekly #795, React Status #484, and Node Weekly #634 — and what it means for the Aliz stack.

What caught our eye this week across JavaScript Weekly #795, React Status #483, and Node Weekly #634 — and what it means for the Aliz stack.

The State of Web Dev AI 2026 survey results have been published. This is the newest addition to the "State of" survey family by Devographics — the team behind State of JS, State of CSS, and State of HTML — now focused specifically on how developers use AI in their web development workflows.

TanStack packages — @tanstack/query, @tanstack/router, @tanstack/table — collectively pull tens of millions of weekly downloads. They sit deep in dependency trees across a huge number of production apps. In early 2026, an attacker obtained an npm publish token from TanStack's CI pipeline and used it to push malicious versions of several packages. Obfuscated postinstall hooks phoned home to attacker infrastructure. The window was short — hours — but hours is a lot of npm install runs.

This isn't a new pattern. The same playbook worked against lottie-player in 2025 and ua-parser-js in 2021. What changes each time is the name on the package and the number of people scrambling. This post walks through what happened, why the pattern keeps repeating, and what you can do about it today.

In January 2020, esbuild 0.1 dropped and gave the JavaScript ecosystem its first taste of what esbuild's own FAQ described as 10–100× faster tooling. The shock was real, but the lasting shift wasn't actually Go. By 2021 the new tools coming out — SWC, Turbopack, Rspack, Biome, oxc, Rolldown, Lightning CSS, plus runtimes like Deno and desktop shells like Tauri — were almost uniformly Rust. Six years later, on a modern frontend project, a non-trivial fraction of what lands in node_modules after npm install is a Rust binary in a thin JavaScript wrapper. This post is a curiosity tour of that landscape: who built what, in what order, and how the Rust pieces actually get into the install. It is not a recommendation post; there is no switch-to-X conclusion at the end.