8 posts tagged with "tooling"

Morphicons is not an icon set. It ships zero icons. It is a ~6.6 KB gzip engine that interpolates SVG d paths, so any stroke icon can smoothly morph into any other one — hamburger into close, play into pause, sun into moon. Instead of asking you to adopt yet another pack, it sits on top of the sets we already recommend: Lucide and Heroicons outline. The idea is genuinely clever. The maturity is genuinely worrying. Both are worth a closer look.

The State of CSS 2026 results are out, fielded May 15 – June 29, 2026 with ~4,900 respondents. The question set shrank from 63 features to 46, and the headline is a contradiction: the most-wanted new feature of the year is also the most-avoided one. Underneath that sits something stranger — CSS is the one part of the frontend stack AI still can't write. This post is about what to do differently, not about what the charts say.

TypeScript 7.0 shipped on July 8, 2026. The compiler is now written in Go — a line-by-line port of the existing TypeScript codebase (codename "Corsa"), not a from-scratch rewrite. The result is 8–12x faster builds, dramatically faster editor responsiveness, and a language server that crashes far less often. This is the single biggest performance improvement in TypeScript's 12-year history. But it comes with real breaking changes, a missing programmatic API, and a migration path that rewards patience over haste.

shadcn/ui launched on Radix in January 2023, and for three years Radix was the primitive layer under every component you copied into your repo. As of July 2026, that default has changed: new shadcn projects now scaffold on Base UI. This isn't a forced migration or a deprecation — Radix stays fully supported, and both libraries keep getting new components. The signal worth paying attention to is why the default moved: people running shadcn create were already picking Base UI over Radix roughly 2-to-1, so the default simply caught up to what teams were already choosing.

npm v12 (estimated July 2026) flips three security defaults that have been the most exploited code-execution paths in supply chain attacks. Install scripts, Git dependencies, and remote URL dependencies will all be blocked unless explicitly allowed. These aren't new features — they've been available as opt-in since npm 11.10.0+ — but v12 makes the secure path the default.

If you're running npm 11.16.0+, you're already seeing warnings for these. In v12, warnings become hard blocks. Now is the time to prepare.

npm CLI 11, released in February 2026, ships a new config option called min-release-age. It refuses to resolve any package version published less than a configured number of days ago. The idea is simple: give the community time to detect compromised releases before they land in your node_modules. Previously this was only available via pnpm's minimumReleaseAge — now npm has it natively.

In January 2020, esbuild 0.1 dropped and gave the JavaScript ecosystem its first taste of what esbuild's own FAQ described as 10–100× faster tooling. The shock was real, but the lasting shift wasn't actually Go. By 2021 the new tools coming out — SWC, Turbopack, Rspack, Biome, oxc, Rolldown, Lightning CSS, plus runtimes like Deno and desktop shells like Tauri — were almost uniformly Rust. Six years later, on a modern frontend project, a non-trivial fraction of what lands in node_modules after npm install is a Rust binary in a thin JavaScript wrapper. This post is a curiosity tour of that landscape: who built what, in what order, and how the Rust pieces actually get into the install. It is not a recommendation post; there is no switch-to-X conclusion at the end.

Remember when we said this was an experiment? Well, the experiment grew up. We just shipped a curated, 13-tool Recommended Tech Stack for Aliz frontend projects — a single reference for what we reach for when starting something new.