Another busy week means another edition of Friday Links.
Here's a curated collection of new libraries, framework releases, AI announcements, tutorials, and developer tools that caught our attention over the last few days.
🧠 Language & Runtime Updates
Bun 1.3.14 released with additional Node.js compatibility improvements, package manager updates, and runtime optimizations. The Bun team continues its Rust migration, sharing more implementation details and progress toward the next major release.
Check out the New Node.js API Documentation Preview
📜 Articles & Tutorials
ECMAScript - Introducing Deferred Module Evaluation with import defer
Medium Explains Its New Table of Contents System
The engineering team breaks down the design and implementation of Medium's built-in table of contents, inspired by an existing Chrome extension.
How I Stopped Running out of Tokens
The secure way to release an npm package in 2026
npm publish-time malware scanning and dual-use metadata
Is JavaScript Obfuscation Still Worth It in the AI Era?
Disrupting supply chain attacks on npm and GitHub Actions
Running npm in a Separate Container when using Claude
Swapping a lightweight image for an animated SVG
How to Design URLs: Routing, Query Parameters, and Fragments
⚒️ Tools
scriptc - Vercel has unveiled a new TypeScript-to-native compiler designed to produce executables that behave exactly like Node.js. It compiles to native binaries by default, with an optional --dynamic mode that embeds a JavaScript engine when runtime flexibility is needed.
MapLibre GL JS 6.0 — The open source WebGL library for interactive vector maps has released version 6. The update drops CommonJS in favor of ESM-only builds, requires WebGL 2, delivers significant performance improvements, and includes both release notes and a migration guide from v5.
Shadscan - Deterministic UI Audits for shadcn Apps
Optio - Manage AI coding agents from a single platform. Automate development tasks, run reusable workflows on schedules or webhooks, and give agents secure access to the tools they need.
A11Y.md - A context system for building accessible software by default - for developers and AI, with enforceable rules aligned to WCAG.
AI Interaction Atlas - A design framework for AI applications that helps teams describe and model interactions between users, AI agents, system processes, data, and product constraints using a common vocabulary.
Multica - An open source platform for managing AI coding agents as collaborative teammates. It can assign tasks, track progress, capture knowledge, and help agents improve over time through reusable skills and workflows.
Draw.io MCP Server - Connect AI agents to Draw.io through the Model Context Protocol, allowing them to generate and modify diagrams directly from prompts and development tasks.
AionUI - An open source collaboration app for AI coding assistants including OpenClaw, Hermes, Claude Code, and Codex. It offers zero setup, support for any API key, multi-agent workflows, remote access, and more.
Pi Agent Harness - A developer toolkit that simplifies AI agent development with a common LLM interface, agent runtime, terminal UI, and command-line tools for coding workflows
shiki - a TUI note-taking app for people who live in the terminal
📚 Libs
Slick 2.0 - Ken Wheeler's classic jQuery carousel library is back with its first major release in years, adding compatibility with jQuery 4.0 while preserving the API developers already know.
Satori - The library for rendering JSX, HTML, and CSS as SVG has been updated with new features, bug fixes, and performance improvements, making it even easier to generate dynamic graphics in JavaScript.
crypto-random-string 6.0 - The lightweight library for generating cryptographically secure random strings is now faster and simpler. Version 6 improves performance and removes the deprecated asynchronous API.
jsdom 30.0.1 - The widely used browser environment emulator for Node.js has released version 30. It adds support for CSS.escape(), CSS.supports(), background-position-x and background-position-y, along with numerous bug fixes and compatibility improvements.
Example:
import cryptoRandomString from 'crypto-random-string';
const token = cryptoRandomString({ length: 10 });
// => "2cf05d94db"
Claude Code Tips - Whether you're just getting started or already using Claude Code daily, this collection of 40+ tips offers workflow optimizations, configuration ideas, and advanced usage patterns.
⌚ Releases
pnpm continues to evolve with a wave of new releases, introducing built-in workspace release management, a doctor command for diagnosing installation problems, and additional developer-focused features.
React 19.2.8, 19.1.9, and 19.0.8 have been released to address a potential denial-of-service (DoS) vulnerability affecting Server Function endpoints.
Ember 7.1 introduces a broad set of new template helpers and operators, along with a modernized documentation experience.
Bruno 4.0 - The JavaScript-powered, open source HTTP API client continues to evolve with new capabilities, making it an even stronger lightweight alternative to Postman.
tslog 5.1.0 - A ground-up rewrite modernizes the zero-dependency logger with ESM-only builds, support for Node, Deno, Bun, browsers, workers, and React Native, plus improved stack traces, middleware, and transport APIs.
The Nuxt team has shipped security patch releases for both the 4.x and 3.x branches, with Nuxt 4.5.1 and 3.21.10 addressing issues discovered after the 4.5 launch.
dompdf.js 2.0 — A major update to the client-side PDF generation library adds improvements for converting HTML into multi-page PDFs entirely in the browser.
Verdaccio 6.9 - The lightweight, self-hosted npm proxy registry continues to improve with stability updates and enhancements for teams managing private JavaScript packages.
Announcing Ada v4: Validating 35.6M URLs per second
Deno 2.9.4, Node.js 26.5.1 (Current), Prisma 7.9, React Router 8.3, Vue 3.6 RC2, Wasp v0.25
npm-check-updates 23.0 - The popular dependency update tool is now faster, smaller, and ESM-only. It finds newer package versions beyond your package.json constraints, offers an interactive upgrade mode, and supports configurable cooldown periods to avoid upgrading to freshly published releases.
Run it without installing:
npx npm-check-updates
To interactively review and apply updates one package at a time:
npx npm-check-updates -i
📺 Videos
TypeScript 7 Is Here (And It's 10× Faster)
MCP vs API: Why traditional APIs are failing AI agents
How AI agents & Claude skills work (Clearly Explained)
Context engineering explained: What every AI developer should know
Agentic AI Frameworks Explained: Workflows, Multi-Agent, & Production
Full Stack SaaS: Build Your Own Browser-Controlling AI
Modern CSS Masking: Build Advanced UI Shapes Without Extra Elements
Alpine.js + HTMX: A Whole Frontend in 20KB, No Build
Better than Next.js? Is Rust Finally Ready for Full-Stack Web Development? Introducing Topcoat
🗞️ News & Updates
Claude Opus 5 Max Accidentally Deleted a Project Database
A developer reported that Anthropic's latest Claude Opus 5 Max deleted an entire project database just ten minutes into a coding session after suggesting the destructive command itself. The model later acknowledged the mistake. Fortunately, the project was only a test environment with no users, and most of the generated content was recovered using Gemini 3.6. The incident serves as another reminder to review AI-generated commands carefully before executing them, especially when working with databases or production systems.
Amazon identifies North Korean hacker group behind open-source supply chain attacks
Thanks for stopping by.
Have a great weekend, enjoy the links, and we'll see you next Friday with another roundup from the JavaScript world.
Top comments (0)