Colin McDonnell 💎 Zod

nubjs.comDe-phantoming the npm ecosystemA daily scan of 10,000 high-download npm packages, published as a package extensions database for other tools to use.

I used Nub to scan the top 10k npm packages for phantom (undeclared) dependencies It found 660 problematic packages. nubjs.com/blog/phanto...

github.comGitHub - nubjs/package-extensions: Undeclared dependencies across the most-downloaded npm packages, as a packageExtensions database for pnpm and YarnUndeclared dependencies across the most-downloaded npm packages, as a packageExtensions database for pnpm and Yarn - nubjs/package-extensions

We've published our dataset as @nubjs/extensions, a consumable package that other package managers (pnpm, Aube, etc) could use benefit use to patch their resolution It's a drop-in replacement for @yarnpkg/extensions and it's auto-updated daily via CI 👍 github.com/nubjs/packa...

nubjs.comThe virtual storeHow Nub's default linker works — one symlink per package into a machine-global store, with install-time phantom detection and per-package ejection — its warm-install performance, and the flat and project-local opt-outs.

Nub uses this list as a fast path during resolution, falling back to on-the-fly phantom detection at install time. Full docs👇 nubjs.com/docs/instal...

nubjs.comDe-phantoming the npm ecosystemA daily scan of 10,000 high-download npm packages, published as a package extensions database for other tools to use.

I used Nub to scan the top 10k npm packages for phantom (undeclared) dependencies It found 660 problematic packages. nubjs.com/blog/phanto...

These phantom dependency issues often go unnoticed in hoisted layouts, but cause problems (e.g. the dreaded ERR_MODULE_NOT_FOUND) when installed in isolated layouts or via a global virtual store (GVS) As more package managers add GVS this problem will exacerbate

Yarn worked around this with a hard-coded list of exceptions (@yarnpkg/extensions) which it used to patch known-bad packages. The same list is now use by pnpm v12 and Aube's global virtual stores. Unfortunately it's updated rarely and contains just 142 of the 792 bad packages

In the latest Nub `nubx` lets you disable dlx (downloading packages from the internet) globally, forever This lets you use nubx to invoke project-local CLIs (e.g. prisma, etc) without the risk of a typo running an untrusted package on your machine

In Zod 4.6 — z.string().url() gets 63x faster It now uses URL.canParse() before falling back to `new URL()` (the old approach)

zod.devZod 4.6Zod 4.6 is now available, with .validate() for boolean validation, .properties() on z.instanceof(), and six more JSON Schema keywords.

Zod 4.6 release notes

Nub v0.9.1 — Nub autosizes the libuv threadpool on beefier machines Node caps the threadpool at 4. Nub lets this float to the number of machine cores (with conservative nicing beyond 4), increasing max throughput for crypto, zlib, DNS, and native addons like bcrypt and sharp

github.comruntime: size libuv's threadpool to the cores on augmented runs by colinhacks · Pull Request #919 · nubjs/nubNode leaves libuv's threadpool at its default of 4 threads whatever the core count, and every fs call, dns.lookup (so every fetch to a new host), async zlib, and async crypto (pbkdf2, scrypt, r...

Full PR/writeup for the nerds 👇 github.com/nubjs/nub/pu...

In the latest Nub Set `nodeExecutable` in nub.jsonc to override Nub's Node version resolution logic — you can provide an absolute path, or use $() syntax to dynamically resolve one

By default Nub resolves a Node version in your project according to the following precedence

nubjs.comConfig referenceThe project file that configures Nub's runtime, dependency installs, and temporary package runs.

Full docs 👇 nubjs.com/docs/config...

New in Zod 4.6 z.iban() — validates international bank account numbers via regex + ISO 7064 checksum

zod.devZod 4.6Zod 4.6 is now available, with .validate() for boolean validation, .properties() on z.instanceof(), and six more JSON Schema keywords.

Full Zod 4.6 announcement 👇

New in Zod 4.6 — .validate() Unlike .parse(), this method returns a boolean, aborts early when it encounters the first error, and instantiates no issue objects. It is 13-39x faster than `.safeParse().success` on invalid data.

zod.devZod 4.6Zod 4.6 is now available, with .validate() for boolean validation, .properties() on z.instanceof(), and six more JSON Schema keywords.

Full Zod 4.6 announcement 👇

New in Zod 4.6 — z.instanceof().properties() Specify arbitrary property-level validators on z.instanceof() schemas

12 Sept

Zod 4.6 is now available! 💎 z.instanceof().properties() 💎 z.iban() 💎 .validate()

zod.devZod 4.6Zod 4.6 is now available, with .validate() for boolean validation, .properties() on z.instanceof(), and six more JSON Schema keywords.

12 Sept

Full post 👇 zod.dev/blog/zod-4-6

8 Aug

In the latest version of Nub Support for Promise.allKeyed() and Promise.allSettledKeyed() — the object form of Promise.all()

github.comGitHub - tc39/proposal-await-dictionary: A proposal to add Promise.allKeyed to ECMAScriptA proposal to add Promise.allKeyed to ECMAScript. Contribute to tc39/proposal-await-dictionary development by creating an account on GitHub.

8 Aug

It's a Stage 3 proposal championed by @jordan.har.band et. al. github.com/tc39/proposa...

nubjs.comRuntimeWhat Nub adds when it runs your code on stock Node — TypeScript and JSX with no build step, editor-style resolution, automatic .env loading, data-file imports, and modern globals — plus the…

8 Aug

This works with every supported Node version (auto-polyfilled down to v18.19+). Official V8/Node support is expected in v27. Learn more 👇 nubjs.com/docs/runtime...

boron.shBoron — beautiful images of your terminalCompose a terminal session, keep its ANSI colors, and export it as an image.

5 Aug

Introducing Boron — A WYSIWYG editor for designing beautiful CLI screenshots It's Carbon or ray[dot]so for terminals instead of code blocks 👾 ✅ ANSI colors & styles ✅ richtext copy/paste from terminals ✅ export to png/svg/jpg/webp/text boron.sh

5 Aug

The other tools accept code and handle the syntax highlighting, including "Bash". But for shell screenshots, this rarely looked good.

5 Aug

Boron gives you an editor that gives you the power to tweak the ANSI escape codes on a char-by-char basis Also great for hand-designing CLI output for handoff to an agent ✨

8 July

Nub's package manager is now 5.5x faster than Bun on our warm install benchmark!

nubjs.comNode’s phantom dependency problem and the path to a 5x faster package managerOne copy of every package per machine, symlinked into every project — and the mechanisms that make that layout work across the ecosystem.

8 July

this is the culmination of a huge engineering lift to unblock symlink-powered package linkers in JavaScript. writeup below — approachable for people who do not think about package managers in their spare time 😛 nubjs.com/blog/unblock...

Introducing Nub. The all-in-one JavaScript toolkit that augments Node.js (instead of trying to replace it)

github.comGitHub - nubjs/nub: The fast all-in-one Node.js toolkitThe fast all-in-one Node.js toolkit. Contribute to nubjs/nub development by creating an account on GitHub.

Nub is now in public beta. Lots more on the roadmap, stay tuned! Star/watch the repo! 👇 github.com/nubjs/nub

nubjs.comNub — an all-in-one toolkit for Node.jsNub is a TypeScript-first toolkit for Node.js: run TypeScript files on stock Node, a faster npm run, a pnpm-compatible package manager, and a built-in Node version manager. No lock-in.

Read the docs! 👇 nubjs.com/docs

Introducing Nub. The all-in-one JavaScript toolkit that augments Node.js (instead of trying to replace it)

Nub detects your existing package manager (via package.json or lockfile) and runs in COMPAT MODE 🔐 reads *and writes* your existing lockfile (roundtrip!) ⚙️ respects your config files (see chart) ⚡️ zero config changes required in 99% of cases (Nub aborts when unsupported config is detected)

nub pm shim — A built-in package manager shimmer Like `corepack enable`, this registers global shims for npm, yarn, and pnpm. These shims intercept your commands and: - Detect the version used in your project - Install that version if needed - Run the command using the proper version

Introducing Nub. The all-in-one JavaScript toolkit that augments Node.js (instead of trying to replace it)

nub install — a fast, secure, incrementally adoptable package manager 🐇 2.7x faster than pnpm (warm install) 🧩 pnpm-compatible CLI (muscle memory) 🌅 powered by the Aube engine (by @jdx.dev)

It takes the safest default security posture of any package manager in the ecosystem 🔐 24hr minReleaseAge 🔐 checks OSV for known vulns during resolution (never installs known-bad pkgs) 🔐 blocks postinstall by default 🔐 blocks trust downgrades (e.g. recent versions that lost npm provenance)

Introducing Nub. The all-in-one JavaScript toolkit that augments Node.js (instead of trying to replace it)

nub run — a 24x faster than pnpm run 🐇 14ms overhead vs >300ms (commands feel instantaneous) 🧱 monorepo friendly (-r/--filter) 🧩 flag-for-flag compatible with pnpm run

nubx — a 19x faster npx 🐇 11ms overhead (vs 200ms+ for npx) 🧩 flag-for-flag compatible with npx ☁️ local-first, falls back to dlx

Introducing Nub. The all-in-one JavaScript toolkit that augments Node.js (instead of trying to replace it)

The `nub` command is flag-for-flag and var-for-var compatible with `node` (via passthrough, primarily)

And because it uses Node itself under the hood, there are no unexpected behavioral divergences. Here's how it does on Deno's Node.js compatibility test suite:

Introducing Nub. The all-in-one JavaScript toolkit that augments Node.js (instead of trying to replace it)

Nub uses these to add Bun's best features on top of stock Node.js ✅ non-erasable TS syntax (e.g. enums) ✅ TS-friendly module resolution (tsconfig-paths, extensionless imports) ✅ JSX ✅ decorators ✅ .env autoloading ✅ yaml/toml imports ✅ `Worker` ✅ `using` ✅ a lot more

When you run a file, Nub detects your project's Node version, auto-installs it if needed, and runs your code with it (no nvm/fnm needed) — including all the augmentations above It respects (in order) 👉 package.json#devEngines 👉 .node-version 👉 .nvmrc 👉 package.json#engines

Introducing Nub. The all-in-one JavaScript toolkit that augments Node.js (instead of trying to replace it)

Node.js now provides a powerful set of extension mechanisms that (mostly) didn't exist when Deno/Bun started: 👉 preload scripts (--import) 👉 module resolution plugins (module.registerHooks) 👉 Node-API native addons

Introducing ✨ Standard JSON Schema ✨ It's a sister spec to Standard Schema that provides a common interface for any entity that can be converted to JSON Schema

The following schema libraries have implemented day-one support for the spec 👇 Note the minimum versions (these we're all released in the last few weeks)

standardschema.devStandard JSON SchemaA standardized JSON Schema representation that preserves inferred type information

Visit the website to see the fulltext spec, FAQs, integration examples, and more standardschema.dev/json-schema If you implement or integrate with the spec, don't forget to submit a PR adding yourself to the website ✌️

Introducing ✨ Standard JSON Schema ✨ It's a sister spec to Standard Schema that provides a common interface for any entity that can be converted to JSON Schema

It puts control in the hands of the *consuming library*. Given a spec-compliant entity, they can: • extract a JSON representation of either its input or output type • control the *draft version* of the produced JSON Schema • pass library-specific config

This takes the onus off the end user to properly convert their schemas correctly to the format expected by some consuming library, eliminating a swath of potential footguns & unnecessary DX complexity

Introducing ✨ Standard JSON Schema ✨ It's a sister spec to Standard Schema that provides a common interface for any entity that can be converted to JSON Schema

This is the first ecosystem-wide standard representation that unifies runtime and static type information Essentially "JSON Schema with inferred types" — which unlocks totally new APIs for frameworks & AI tools