François Best

npm needs to change their logo

📦 nuqs@2.10.2 is out! 🚀 It fixes a bug of state flickering when a sync render interrupted a startTransition in React Router, and a bug in Next.js 16.4.0 with shallow updates interfering with each other. Changelog: nuqs.dev/changelog Try it out: pnpm add nuqs@latest

Haven't been active much here, sorry, AI-in-OSS burnout is real. How do you care when nobody else does? When nobody engages? When all the human connection is gone? When all you read is AI slop? I want to go back to coding for fun. Because whatever this is, it's very much _not_ fun.

"Maintaining Open-Source at the Age of AI." That's the talk @francoisbest.com is bringing to React Advanced, on what it takes to keep open-source projects healthy as AI reshapes how code gets written. Can't wait to see you 🎟️ https://reactadvanced.com

📦 nuqs@2.10.0 is out! 🚀 The React SPA adapter is now SSR-compatible for @astro.build, Inertia.js, @fastify.dev etc. Feed it the `serverSearch` prop to avoid a flash of defaults on island hydration. Changelog: nuqs.dev/changelog#v2... Try it out: pnpm add nuqs@latest

📦 nuqs@2.9.6 is out! 🚀 It fixes an issue with pending URL updates not resetting on Back navigation in Next.js pages router & TanStack Router, when no useQueryState(s) hooks were mounted. Also minor correctness fixes for parsers. nuqs.dev/docs/changel...

📦 nuqs@2.9.5 is out! 🚀 It adds SSR support to the community Inertia adapter, and fixes 6 minor edge-case bugs. Full changelog: nuqs.dev/changelog#v2... Try it out: pnpm add nuqs@latest

📦 nuqs@2.9.3 is out! 🚀 It fixes a bug where state updates would blink/replay when pending state updates done in startTransition were rebased on top of other priority updates. Concurrent React is fun. Try it out: pnpm add nuqs@latest

🗣️ I'll be speaking at @reactadvanced.gitnation.org London again this year! 🇬🇧 My "Maintaining open-source at the age of AI" talk is a fun one, with deep & important discussions about our OSS ecosystem. See you all on October 23rd/26th! Grab your ticket or register for the livestream via my badge:

📦 nuqs@2.9.2 is out! 🚀 It fixes a React concurrency issue where a discarded render could leave query state stuck out of sync with the URL. Try it out: pnpm add nuqs@latest

If Doom was made in the EU 🍪 The HTM-in-canvas API is really fun to play with. Play it here: doom-c15t.vercel.app

📦 nuqs@2.9.1 is out! 🚀 It includes many bug fixes, a few found by @shadcn.com's /improve skill 🫶, and also: - Better monorepo & MFE compatibility - Fixed startTransition support in @reactrouter.com v7+ (while loaders run) Also, we have a changelog page now: nuqs.dev/changelog

The replay of my @forkit.community talk is out: youtu.be/slbSwQo8Xqc?...

/goal go through all my repos and upgrade them to typescript@^7 Congrats to the team! 🎉

"The state of your application, instead of living in memory, lives in the URL." New Señors at Scale episode with @francoisbest.com, creator of nuqs: URL state internals, npm supply chain attacks, and AI agents in open source. 🎥 https://youtu.be/b3AYuuRdyf4 #React #nuqs

✍️ New blog post: how I refactored the @nuqs.dev release pipeline for npm staged publishing. nuqs.dev/blog/staged-... Also some relevant supply-chain security advice for GitHub Actions & npm package consumers. (words written by hand, with some LLM assistance for supporting diagrams)

I'm live on Twitch for a couple of hours to talk about npm supply-chain security and GitHub Actions. But first, we gotta record some 8bit heavy metal 🤘😈 www.twitch.tv/francoisbest

When people say that "@nuqs.dev just works": this is why. app.principal-ade.com/47ng/nuqs

This is the first GA release that went through our new npm staged publishing pipeline 🙌 Blog post explaining how it works in progress ✍️

Weekend project: drafting a spec RFC for StandardCodec, a StandardSchema inspired-and-compatible way to bidirectionally convert between two arbitrary data types in TypeScript. Zod codecs, Effect Schema, nuqs parsers, and now Waku codecs are all implementations of this. We need a standard.

Your company should sponsor Artem if it mocks its HTTP/API layer with mswjs.io. (and if it does not yet, it should) $ npx cashcn npm://msw 100/m

New silly weekend project: `cashcn`, the fastest way to sponsor OSS maintainers. $ npx cashcn franky47 100 Supports: - GitHub repos: 47ng/nuqs - OpenCollective: oc://antfu - NPM packages: npm://msw - recurring: 100/m Redirects to GitHub sponsors pre-filled (URL state FTW) Go sponsor maintainers!

Talk prep is going well 🙈💀

How it started / How it's going

🟣 I'm live on Twitch, chill birthday stream 🥳 Playing with local AI models & working on OSS, come say hi! www.twitch.tv/francoisbest

After messing around way too much with tmux + mosh + Ghostty settings to make them play nice, it's good to see projects that wrap this nicely. herdr.dev

Lots of cool folks there 👋 ticker.bskyshelf.space/report/franc... @thibaultleouay.dev @tkdodo.eu @kettanaito.com @tyler.fun @patak.cat @sebastienlorber.com @antfu.me

Thank you so much upstash.com for sponsoring me! 💖 A lovely early birthday present 🥳

what

console.log("happy birthday, @nodejs.org!")

I did not have the Pope quoting Gandalf about AI on my bingo card today 😳

The new reality of open-source at the age of AI: - 📈 Downloads going up (3M weekly for @nuqs.dev) - 📉 Human engagement (visit to the docs, stars, issues & discussions) going down. I’ll be talking about this in my talk next week at @forkit.community

Staged publishing TL;DR 1. You replace `npm publish` with `npm stage publish` 2. It puts the tarball in a staging area for review 3. You approve it via the CLI or web It will land in npm@^11.15.0. I've already turned off non-staged publishing in @nuqs.dev (in the Trusted Publishing settings).

Microsoft game of the year 2026

🟣 I'll be live today on Twitch to talk about the security of GitHub Actions (or lack thereof): - What you can change in your workflows today to avoid being pwned - What you can setup to make sure it stays "secure" over time Gonna be fun, come hang out at 10am CEST: www.twitch.tv/francoisbest

Heartbreaking. And a wake-up call. It is no longer about being difficult to find a way to sustain yourself through your work online. It is no longer sustainable to keep a website up now. Axel has done so much for the web and all of us. Buy one of his books if you can. We've learned so much from him.

Takeaway from the TanStack vuln: people don't read reports. The number of replies "they should have checked before merging"... 😓 The PR that kicked it off **wasn't** merged. It didn't need to be, and the vuln vector (cache poisoning) was invisible to maintainers.

Hackers behind Shai-Hulud are now offering crypto bounties to their mates for the trophy of highest vuln on OSS packages. I’m tired boss 😓

Maintainers with @github.com sponsors: have you received your April payout? Asking as a few of us haven't 🤔

Writing this made me feel sad, angry, borderline sick, but better be safe than sorry. nuqs currently stands at 2.5M weekly downloads, it only takes one angle I haven't seen and defended against to pwn projects that I care about. I have ideas I want to try, stay tuned. We'll be back. 🫶