Jacob

A peak behind the curtain on how a very large and long-lived OSS project runs and adapts to internal and external concerns.

The PHP Foundation says Chainguard unilaterally broke the embargo and published built images containing the critical RCE fixes more than six hours early: “This disregarded weeks of work by many parties toward a coordinated disclosure.” socket.dev/blog/php-emb...

@jakearchibald.com any chance you can get someone to respond to this? Looks like @firefox.com have just ignored it for 7 years 😬 won't-fix would be better than silence.

@samuel.fm i think this new feature is more confusing (and effectively wrong) than helpful. I'd guess the author's default is merely French (that's his native lang) and he did not explicitly mark the post as being in French. Also, the wording of the popup is very cumbersome.

Gaaah. I installed an iOS patch and it instead installed iOS 27. Liquid Glass is awful. How do I make it go away 😭

I built a thing! * bundle node apps * distribute them without registry * bundles are fully auditable * bundles are signed And now we can have assertions on the content distributed via ATProto. github.com/pipobscure/b...

Thank you everyone for joining us at #NodeConfEU 2026! 💚 We hope you enjoyed it as much as we did, and we can’t wait to see you again next year! 📅👩‍💻 #TechCommunity #NodeCommunity

Fancy tooltips that use popover and anchor positioning are great. But sometimes all you need is a trustworthy title HTML attribute for a text-only tooltip. 😭 Only problem is: it can't be styled! Do you want these tooltips to be stylable? Maybe with a ::tooltip pseudo. Let me know your use cases!

🥁 𝐒𝐩𝐞𝐚𝐤𝐞𝐫 𝐀𝐧𝐧𝐨𝐮𝐧𝐜𝐞𝐦𝐞𝐧𝐭🎙️ Thrilled to have @jakob.jingleheimer.dev on the #NodeConfEU 2026 stage! He'll tell us the story behind "𝐖𝐡𝐚𝐭'𝐬 𝐭𝐡𝐞 𝐓𝐞𝐚?". 🎟️Don't miss it out; secure your tickets www.nodeconf.eu

Last chance to share your feedback in the 2026 Node.js User Survey! If you use Node.js, take a few minutes to tell us about your experience, priorities, and what matters most to you. Take the survey: linuxfoundation.surveymonkey.com/r/nodejs-use... #NodeJS #OpenSource

one does not simply reveal a password 👁️

Are you a Node.js user? We want your feedback. Tell us all about how you're using Node.js in our annual user survey. Your response helps shape our future priorities! https://linuxfoundation.surveymonkey.com/r/nodejs-users-2026

Dependabot now waits three days before non-security version update pull requests, giving scanners time to catch a poisoned release first. The case for this cooldown delay ⬇️

<input type="checkbox" switch> is coming to Chromium-based browsers! My team is currently adding the implementation at chromium-review.googlesource.com/c/chromium/s...

@marinaaisa.com at WEH i think it was you who asked about Safari bugs that need fixing? Could Safari un-break its Shape Detection API? It used to work, and then it broke a few years ago 😢

@danabra.mov next currently strips out nodejs conditions, breaking any cleverness in pjson subpath imports eg `node --conditions=local --run dev`. It's otherwise great for local offline dev, substituting a module with remote service calls. Any chance you can get next to stop bungling it?

Node.js 26.4.0 is out with a new `node:vfs` built-in module (behind `--experimental-vfs` flag). It also adds support for package maps, and many bug fixes, including a fix for a regression shipped with last week security release. Full changelog and download links at nodejs.org/en/blog/rele...

Very early sneak peek to pnpr - the pnpm registry: pnpm.io/pnpr/

@tangled.org you okay?

Our statement on the UK gov't's demand that all content on all devices sold or used in the UK be scanned, on the presumption of nudity, using a dystopian combination of age verification & content scanning. This proposal will not safeguard children. It endangers us all. signal.org/blog/pdfs/20...

Kinda thinking this is the unfortunate future 😕

The first step in a big journey for deep-equal and object comparison 🥳

4.5 years after acquiring the form5 GH org/namespace and dozens maybe hundreds of unanswered support requests, someone at npm finally clicked the button to let me actually use it 🫠 (thank you YL, whoever you are) Now, what the heck was I gonna do with it 🤔

🚀 Still using Axios in Node.js? You might not need it anymore. Why switch? ✅ Native support ✅ Fewer dependencies ✅ Better standards alignment ✅ Reduced security surface ✅ Potential performance improvements nodejs.org/en/blog/migr...

The good old days. Now we just get gaslit.

Node.js v26.0.0 is out 💚 Temporal API enabled by default, V8 14.6, Undici 8, and key deprecations as we keep modernizing the platform. Check it out nodejs.org/en/blog/rele...

I don't think tech at large understands how hard it is to be an open source maintainer right now. So many great folks are on the brink of burnout. Funding is drying out. We live in a security minefield. Companies think humans are disposable. If you're a maintainer, we care. You deserve the world.

Here’s your morning mood, courtesy of Magda Patyk.

Node.js's learn articles now have a new home! Check out github.com/nodejs/learn to see the learn articles, now statically built with our very-own github.com/nodejs/doc-kit!

The Node.js Userland Migrations (and node:test) team have been busy bees 🐝 In node 25.9.0, MockModuleOptions’ defaultExport & namedExports are consolidated into a single “exports” object. A migration is available alongside it to automatically update your code. app.codemod.com/registry/@no...

I recently released sequins.dev, to have all the Observability signals you expect like logs, metrics, traces, and profiles, but as a macOS app which you can use for local dev. It's also completely free and open source. Give it a try, and let me know if there's any features you want!

Open Source Brunch success 😁 the weather really came through too for the terrace

We are looking for an open source product marketing manager to help us with WPE, Servo, Moonforge, Wolvic and other similar projects at @igalia.com More information: www.igalia.com/jobs/product...

A modern browser for the npm registry that nudges the ecosystem towards best practices and standards perfectly aligns with our mission: to make the next generation of JS developers more productive than ever before. We're happy to support our friends at @npmx.dev!

My company @igalia.com is hiring an Open Source Product Marketing Manager. www.igalia.com/jobs/product... Igalia is a worker-owned cooperative based in A Coruña, Spain. All positions are 100% remote. Igalia can potentially sponsor visas to emigrate to Spain.

From Chrome 145 (on general release next week!), DevTools we will start to show so called "soft" navigations and "Soft LCP" in the Performance Panel traces. These are for SPAs which don't do a full page load, but instead "fake it" by updating the current page and pushing a new history entry. 1/5 🧵

We're hosting our 1st workshop of 2026 at Framer! New and existing students and coaches are welcome, but space is limited to ~20 people. Food & drink generously provided by Framer. RSVP codebar.io/workshops/3612 Thu, 19 Feb @ 18:30 – 21:00 Rozengracht 207, 1016 LZ #DEI

it.expectFail is out for a test-case that should pass but can't 🙂

Today's spark of joy

We appreciate your patience and understanding as we work to deliver a secure and reliable release. Updates are now available for the 25.x, 24.x, 22.x, 20.x Node.js release lines to address: - 3 high severity issues - 4 medium severity issues - 1 low severity issue nodejs.org/en/blog/vuln...

The heavy snowfall at AMS right now. Visibility is barely 100 km 😮

😮

The OXC folks are 🔥 I reported a bug and it was patched before my tea brewed (not a joke).

I’ve been playing with module loaders and node sea recently. Anthropic supposedly bought bun because of the ease of application bundling. Now the same is easily achievable with node.js using www.npmjs.com/package/@pip... Applications bundled and runnable directly from zip-archives or SEAs.