Update: reduced @rspack/dev-server deps from 193 → 8, install size from 14.9 MB → 4.1 MB.
npm supply chain attacks keep happening and keeping deps minimal makes me feel safer.
npm supply chain attacks keep happening and keeping deps minimal makes me feel safer.
April 2, 2026 at 1:36 AM
Update: reduced @rspack/dev-server deps from 193 → 8, install size from 14.9 MB → 4.1 MB.
npm supply chain attacks keep happening and keeping deps minimal makes me feel safer.
npm supply chain attacks keep happening and keeping deps minimal makes me feel safer.
have you seen the new supply chain vuln? don't update tubu. it's literally on heebee. they got poodee's deps. they infiltrated dippy. roll back weeno. disable scripts in ~/.gumpyrc. it's in poob. do not install poob. do not update poob. uninstall poob right now. poob has it in for you.
March 31, 2026 at 11:01 AM
have you seen the new supply chain vuln? don't update tubu. it's literally on heebee. they got poodee's deps. they infiltrated dippy. roll back weeno. disable scripts in ~/.gumpyrc. it's in poob. do not install poob. do not update poob. uninstall poob right now. poob has it in for you.
@bomb.sh/tty is the low-level layout engine and input parser that powers our forthcoming tui libraries. think we can get this even smaller, but our baseline is now
v0.9.0 at 113 kB (0 deps)
compared to
v0.6.0 at 830 kB (0 deps)
@opentui/core at 21 MB (9 deps)
ink at 7.8 MB (36 deps)
v0.9.0 at 113 kB (0 deps)
compared to
v0.6.0 at 830 kB (0 deps)
@opentui/core at 21 MB (9 deps)
ink at 7.8 MB (36 deps)
@bomb.sh/tty v0.9.0 is out! 🙌
💢 improved border defaults
🥕 hardware-driven caret rendering
💬 unicode 17 support
🧠 up to 50% memory reduction
🤏 size optimization (down to 113 kB install size)
and we have a changelog now
github.com/bombshell-de...
💢 improved border defaults
🥕 hardware-driven caret rendering
💬 unicode 17 support
🧠 up to 50% memory reduction
🤏 size optimization (down to 113 kB install size)
and we have a changelog now
github.com/bombshell-de...
September 5, 2026 at 2:29 AM
@bomb.sh/tty is the low-level layout engine and input parser that powers our forthcoming tui libraries. think we can get this even smaller, but our baseline is now
v0.9.0 at 113 kB (0 deps)
compared to
v0.6.0 at 830 kB (0 deps)
@opentui/core at 21 MB (9 deps)
ink at 7.8 MB (36 deps)
v0.9.0 at 113 kB (0 deps)
compared to
v0.6.0 at 830 kB (0 deps)
@opentui/core at 21 MB (9 deps)
ink at 7.8 MB (36 deps)
Copyparty is a portable file server with accelerated resumable uploads, dedup, WebDAV, FTP, TFTP, zeroconf, media indexer, thumbnails++ all in one file, no deps github.com/9001/copypar...
GitHub - 9001/copyparty: Portable file server with accelerated resumable uploads, dedup, WebDAV, FTP, TFTP, zeroconf, media indexer, thumbnails++ all in one file, no deps
Portable file server with accelerated resumable uploads, dedup, WebDAV, FTP, TFTP, zeroconf, media indexer, thumbnails++ all in one file, no deps - 9001/copyparty
github.com
August 17, 2025 at 4:42 AM
Copyparty is a portable file server with accelerated resumable uploads, dedup, WebDAV, FTP, TFTP, zeroconf, media indexer, thumbnails++ all in one file, no deps github.com/9001/copypar...
long overdue updating/move from local old godot addon deps to new asset store. no work on sprites will be done
#GodotEngine
#indiedev
#gamedev
#GodotEngine
#indiedev
#gamedev
September 24, 2026 at 4:47 PM
long overdue updating/move from local old godot addon deps to new asset store. no work on sprites will be done
#GodotEngine
#indiedev
#gamedev
#GodotEngine
#indiedev
#gamedev
your outie never ignores react-hooks/exhaustive-deps, and always cleans up their effects
February 18, 2025 at 11:37 PM
your outie never ignores react-hooks/exhaustive-deps, and always cleans up their effects
it seems like the new equilibrium with dependencies is:
* automated security scanners analyze new versions of deps within minutes
* everyone else uses cooldowns
the automated scanner folks get marketing when they find compromised deps, and everyone else benefits from their work
is this right?
* automated security scanners analyze new versions of deps within minutes
* everyone else uses cooldowns
the automated scanner folks get marketing when they find compromised deps, and everyone else benefits from their work
is this right?
May 11, 2026 at 9:55 PM
it seems like the new equilibrium with dependencies is:
* automated security scanners analyze new versions of deps within minutes
* everyone else uses cooldowns
the automated scanner folks get marketing when they find compromised deps, and everyone else benefits from their work
is this right?
* automated security scanners analyze new versions of deps within minutes
* everyone else uses cooldowns
the automated scanner folks get marketing when they find compromised deps, and everyone else benefits from their work
is this right?
deps acho que ele deve ir de Dirceu e Suplicy
quem sera q o lula vai votar pra dep estadual
October 2, 2026 at 1:45 PM
deps acho que ele deve ir de Dirceu e Suplicy
After some @11ty.dev housekeeping yesterday I’ve crossed paths with folks on the @e18e.dev team and just wanted to say they are doing very good work!
e18e.dev
If you’ve ever been frustrated by outdated deps or had trouble upgrading deps, these folks are solving problems before they get to you 🏆
e18e.dev
If you’ve ever been frustrated by outdated deps or had trouble upgrading deps, these folks are solving problems before they get to you 🏆
e18e
Ecosystem Performance
e18e.dev
March 5, 2025 at 4:39 PM
pds.js oauth coming in hot
bringing back the single .js
zero deps besides cloudflare worker stuff
still ironing out stuff (and very basic scopes support) but it works on @pdsls.dev
bringing back the single .js
zero deps besides cloudflare worker stuff
still ironing out stuff (and very basic scopes support) but it works on @pdsls.dev
January 8, 2026 at 2:48 AM
pds.js oauth coming in hot
bringing back the single .js
zero deps besides cloudflare worker stuff
still ironing out stuff (and very basic scopes support) but it works on @pdsls.dev
bringing back the single .js
zero deps besides cloudflare worker stuff
still ironing out stuff (and very basic scopes support) but it works on @pdsls.dev
🥗 unjs/c12 v4 (beta)
-📦 Install size: 3.44 MB → 380 kB (deps: 20 → 7)
- ⚡ TypeScript configs load ~2.5× faster on cold cache
- 🔒 Supports expanding env vars via _FILE references
With 37M monthly downloads, once everyone migrates, this saves over 100 TiB of bandwidth 🫣
github.com/unjs/c12/rel...
-📦 Install size: 3.44 MB → 380 kB (deps: 20 → 7)
- ⚡ TypeScript configs load ~2.5× faster on cold cache
- 🔒 Supports expanding env vars via _FILE references
With 37M monthly downloads, once everyone migrates, this saves over 100 TiB of bandwidth 🫣
github.com/unjs/c12/rel...
Release v4.0.0-beta.2 · unjs/c12
compare changes
📦 Package Improvements
c12 install size is now down to 380kB from 3.44MB (20 deps to 7 deps).
Loading TypeScript files is significantly faster (on cold cache) — simple TS config loa...
github.com
February 6, 2026 at 7:15 PM
🥗 unjs/c12 v4 (beta)
-📦 Install size: 3.44 MB → 380 kB (deps: 20 → 7)
- ⚡ TypeScript configs load ~2.5× faster on cold cache
- 🔒 Supports expanding env vars via _FILE references
With 37M monthly downloads, once everyone migrates, this saves over 100 TiB of bandwidth 🫣
github.com/unjs/c12/rel...
-📦 Install size: 3.44 MB → 380 kB (deps: 20 → 7)
- ⚡ TypeScript configs load ~2.5× faster on cold cache
- 🔒 Supports expanding env vars via _FILE references
With 37M monthly downloads, once everyone migrates, this saves over 100 TiB of bandwidth 🫣
github.com/unjs/c12/rel...
Peer deps are a curse upon the npm ecosystem ☠️
December 16, 2024 at 11:21 PM
Peer deps are a curse upon the npm ecosystem ☠️
today:
released a major of nuxt/test-utils (v4) ✅
released a minor of nuxt/telemetry (removed 10/15 deps!) 🔥
released two new patches of nuxt ✅
and now a glass of 🍷
released a major of nuxt/test-utils (v4) ✅
released a minor of nuxt/telemetry (removed 10/15 deps!) 🔥
released two new patches of nuxt ✅
and now a glass of 🍷
February 7, 2026 at 6:54 PM
today:
released a major of nuxt/test-utils (v4) ✅
released a minor of nuxt/telemetry (removed 10/15 deps!) 🔥
released two new patches of nuxt ✅
and now a glass of 🍷
released a major of nuxt/test-utils (v4) ✅
released a minor of nuxt/telemetry (removed 10/15 deps!) 🔥
released two new patches of nuxt ✅
and now a glass of 🍷
deps and services are cached, any nix derivations built inside the workflow are automagically cached
and there is so much more coming to the CI story :)
and there is so much more coming to the CI story :)
🪡 Spindle gains a new engine: microvm 🪡
You can now:
- build docker containers in CI
- run sidecar services like postgres, redis for integration tests
- use non-nixos base images, such as alpine
Read the blog post by @ptr.pet for more: blog.tangled.org/spindle-micr...
You can now:
- build docker containers in CI
- run sidecar services like postgres, redis for integration tests
- use non-nixos base images, such as alpine
Read the blog post by @ptr.pet for more: blog.tangled.org/spindle-micr...
Spindle's new microVM engine
How we built the new QEMU-based microVM engine
blog.tangled.org
June 29, 2026 at 8:51 PM
deps and services are cached, any nix derivations built inside the workflow are automagically cached
and there is so much more coming to the CI story :)
and there is so much more coming to the CI story :)
Queria fazer o cortez de deps
October 3, 2026 at 5:51 PM
Queria fazer o cortez de deps
Wrote a little tool to detect unused dependencies in your deps.edn or project.clj on the way back from #reclojure (which was an awesome #clojure conference!)
github.com/borkdude/unu...
github.com/borkdude/unu...
GitHub - borkdude/unused-deps: Find unused deps in a clojure project
Find unused deps in a clojure project. Contribute to borkdude/unused-deps development by creating an account on GitHub.
github.com
May 27, 2025 at 10:26 PM
Wrote a little tool to detect unused dependencies in your deps.edn or project.clj on the way back from #reclojure (which was an awesome #clojure conference!)
github.com/borkdude/unu...
github.com/borkdude/unu...
Some new stuff for my npm userscript. github.com/bluwy/npm-us...
Better versions tab, show vulnerability info, new package labels (esm, cjs, module replacements, has postinstall, etc), better settings menu, and more.
Screenshots:
Better versions tab, show vulnerability info, new package labels (esm, cjs, module replacements, has postinstall, etc), better settings menu, and more.
Screenshots:
January 21, 2026 at 7:24 AM
Some new stuff for my npm userscript. github.com/bluwy/npm-us...
Better versions tab, show vulnerability info, new package labels (esm, cjs, module replacements, has postinstall, etc), better settings menu, and more.
Screenshots:
Better versions tab, show vulnerability info, new package labels (esm, cjs, module replacements, has postinstall, etc), better settings menu, and more.
Screenshots:
they went from 84 deps to 67 🎉 great size reduction too
hopefully can drop a few more!
hopefully can drop a few more!
ESLint v10.0.0 is officially here!
📉 Smaller download (11MB ➡️ 9.4MB)
🚫 Removal of the eslintrc configuration system
⚛️ Improved JSX reference tracking for better scope analysis
🛠️ Enhanced RuleTester for better rules
Check out the full release notes:
eslint.org/blog/2026/02...
📉 Smaller download (11MB ➡️ 9.4MB)
🚫 Removal of the eslintrc configuration system
⚛️ Improved JSX reference tracking for better scope analysis
🛠️ Enhanced RuleTester for better rules
Check out the full release notes:
eslint.org/blog/2026/02...
ESLint v10.0.0 released - ESLint - Pluggable JavaScript Linter
A pluggable and configurable linter tool for identifying and reporting on patterns in JavaScript. Maintain your code quality with ease.
eslint.org
February 9, 2026 at 4:26 PM
they went from 84 deps to 67 🎉 great size reduction too
hopefully can drop a few more!
hopefully can drop a few more!
tsdown v0.21 is going to be a big one 🚀
What's new:
✦ Full CSS pipeline (Sass/Less/Stylus + Lightning CSS)
✦ Cross-platform executable builds via @tsdown/exe
✦ Dep options moved to deps namespace
✦ Node.js < 22.18.0 deprecated
Try the beta: npm add tsdown@beta -D
github.com/rolldown/tsd...
What's new:
✦ Full CSS pipeline (Sass/Less/Stylus + Lightning CSS)
✦ Cross-platform executable builds via @tsdown/exe
✦ Dep options moved to deps namespace
✦ Node.js < 22.18.0 deprecated
Try the beta: npm add tsdown@beta -D
github.com/rolldown/tsd...
Release v0.21.0-beta.3 · rolldown/tsdown
v0.21.0 - Notable Changes
Breaking Changes
Dependency options renamed to deps namespace
The dependency-related options have been moved under a new deps namespace with clearer names:
external -> de...
github.com
March 3, 2026 at 5:06 PM
tsdown v0.21 is going to be a big one 🚀
What's new:
✦ Full CSS pipeline (Sass/Less/Stylus + Lightning CSS)
✦ Cross-platform executable builds via @tsdown/exe
✦ Dep options moved to deps namespace
✦ Node.js < 22.18.0 deprecated
Try the beta: npm add tsdown@beta -D
github.com/rolldown/tsd...
What's new:
✦ Full CSS pipeline (Sass/Less/Stylus + Lightning CSS)
✦ Cross-platform executable builds via @tsdown/exe
✦ Dep options moved to deps namespace
✦ Node.js < 22.18.0 deprecated
Try the beta: npm add tsdown@beta -D
github.com/rolldown/tsd...
since uv was released i haven’t had a single issue with python deps.
i love dealing with dependencies in python.
November 24, 2024 at 9:35 PM
since uv was released i haven’t had a single issue with python deps.
Deno 2.6 is here:
🛠️ `dx` is the new `npx`
⚡ faster typechecking with tsgo
🔒 improved security with `deno audit --socket`
🦺 safer deps with `deno approve-scripts`
🚘 source phase import support
and more!
deno.com/blog/v2.6
🛠️ `dx` is the new `npx`
⚡ faster typechecking with tsgo
🔒 improved security with `deno audit --socket`
🦺 safer deps with `deno approve-scripts`
🚘 source phase import support
and more!
deno.com/blog/v2.6
December 11, 2025 at 5:14 PM
Deno 2.6 is here:
🛠️ `dx` is the new `npx`
⚡ faster typechecking with tsgo
🔒 improved security with `deno audit --socket`
🦺 safer deps with `deno approve-scripts`
🚘 source phase import support
and more!
deno.com/blog/v2.6
🛠️ `dx` is the new `npx`
⚡ faster typechecking with tsgo
🔒 improved security with `deno audit --socket`
🦺 safer deps with `deno approve-scripts`
🚘 source phase import support
and more!
deno.com/blog/v2.6