Haoqun Jiang

Haoqun Jiang

@haoqun.dev

@vuejs.org core team member. @vite.dev core team emeritus. Worked on JS tooling. Learning new things. https://haoqun.dev/

457 followers1K following84 posts

Haoqun Jiang
@haoqun.dev

If I remember correctly, the repository was gone almost exactly 4 months ago today after the community became aware of the attack. I don't if it was suspended by GitHub for 4 months, or the attacker closed the account themselves and then reopened it. Anyway, it's a new pattern.

Haoqun Jiang
@haoqun.dev

One benefit of having good physical modeling of the motion system is that you can build delightful visualizations very easily. Much more compelling than function graphs.

Haoqun Jiang
@haoqun.dev

It's always great to see a years-old issue finally get fixed! This, plus content mappers, I'd say TypeScript 7.1 might even have a bigger impact on the tooling ecosystem than 7.0 github.com/microsoft/Ty...

github.comAmbient Module Declarations for Import Attributes (formerly known as Import Assertions) · Issue #46135 · microsoft/TypeScriptSuggestion 🔍 Search Terms import attributes, import assertions, ambient module ✅ Viability Checklist My suggestion meets these guidelines: This wouldn't be a breaking change in existing TypeScript/...
Haoqun Jiang
@haoqun.dev

Finally built a truly native-feeling bottom sheet for the web. Turns out it’s surprisingly hard to get right, even with good reference implementations.

Haoqun Jiang
@haoqun.dev

Negative parallelism, antithetical parallelism, rhetorical padding, aphoristic compression, metaphorical reification, conceptual sloganization, interpretive closure... AI really is a master of rhetorical packaging.

Haoqun Jiang
@haoqun.dev

I learned so much about English rhetoric in trying to get rid of the AI feel in my writing. The techniques I once wanted to learn to improve my English writing are now things I have to avoid to improve my English writing...

Haoqun Jiang
@haoqun.dev

#TIL Cloudflare Pages still runs Node.js 22.16, while many packages now require 22.18+. This can break native packages that ship platform binaries via `optionalDependencies`, because pnpm silently drops those binaries when the Node.js version doesn't meet the requirement.

Haoqun Jiang
@haoqun.dev

#TIL Cloudflare Pages still runs Node.js 22.16, while many packages now require 22.18+. This can break native packages that ship platform binaries via `optionalDependencies`, because pnpm silently drops those binaries when the Node.js version doesn't meet the requirement.

Haoqun Jiang
@haoqun.dev

#TIL iOS Safari limits the frame rate to around 60fps by default, and you can turn it off to enjoy a smoother web browsing experience (Settings -> Safari -> Advanced -> Feature Flags -> Prefer Page Rendering Updates near 60fps)

Haoqun Jiang
@haoqun.dev

Using coding agents to explore multiple ideas at once has been really fun. But the project has grown to the point where I can’t easily do a full line-by-line review anymore 🥲 I need to find a realistic way to make it production-ready.

Haoqun Jiang
@haoqun.dev

One more reason to use @pnpm.io and @npmx.dev: trust policy downgrade becomes visible and preventable

Socket@socket.dev

🚨 Active supply chain attack on axios@1.14.1. The latest version pulls in plain-crypto-js@4.2.1 -- a brand-new package that didn't exist before today. We're still investigating. If you use axios, pin your version and audit your lockfile. socket.dev/blog/axios-n...

socket.devSupply Chain Attack on Axios Pulls Malicious Dependency from...A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHu...
Haoqun Jiang
@haoqun.dev

TIL that IPv4 over IPv6 is a mainstream home internet setup in Japan to avoid old PPPoE limits. It took me back to my college years in China, when I was playing with IPv6 over IPv4 because native IPv6 wasn’t widely available. It’s really interesting to see how differently things evolved here.

Haoqun Jiang
@haoqun.dev

lmao 🤣

Gergely Orosz@gergely.pragmaticengineer.com

Status pages everywhere show green, because Statuspage.io is ALSO down: customers cannot log in to update their status page and indicate the outage their eng teams know about!! So a fail for Statuspage to depend on an AWS region... or DynamoDB (that seems to depend one AWS region?)

Haoqun Jiang reposted

pnpm
@pnpm.io

Published an article about mitigating supply chain attacks with pnpm pnpm.io/supply-chain...

pnpm.ioMitigating supply chain attacks | pnpmSometimes npm packages are compromised and published with malware. Luckily, there are companies like [Socket], [Snyk], and [Aikido] that detect these compromised packages early. The npm registry usually removes the affected versions within hours. However, there is always a window of time between when the malware is published and when it is detected, during which you could be exposed. Fortunately, there are some things you can do with pnpm to minimize the risks.

Haoqun Jiang reposted

Kevin Deng
@sxzz.dev

We encourage everyone to migrate from using npm publish tokens to trusted publisher! github.com/e18e/ecosyst...

github.comPromote npm trusted publisher · Issue #201 · e18e/ecosystem-issuesMotivation npm Trusted Publishing is now generally available, allowing package owners to publish npm packages via CI without manually generating npm tokens. This method greatly reduces the risk of ...
Kevin Deng@sxzz.dev

😈 I removed all CI npm tokens and switched to using trusted publishing. github.blog/changelog/20...

github.blognpm trusted publishing with OIDC is generally available - GitHub ChangelogAs of today, npm trusted publishing with OpenID Connect (OIDC) is now generally available. This feature enables you to securely publish npm packages directly from CI/CD workflows using OpenID Connect…
Haoqun Jiang
@haoqun.dev

Finally, finally! SALVATION HAS ARRIVED! Time to refactor every GitHub Actions workflow! 🎉

Seb ⚛️ ThisWeekInReact.com@sebastienlorber.com

OMG - GitHub Actions now supports Yaml Anchors This somehow means you can create Yaml variables and reuse common values in CI jobs I thought I'd never see this day happen

Haoqun Jiang
@haoqun.dev

Wow, this was unexpected. I've got mixed feelings, but huge congrats to the team!

daniel r(ooooooh) in nyc 🇺🇸@danielroe.dev

I am delighted to announce that @vercel.com are investing in Nuxt! they are backing our vision of the open web, hiring me as well as other core team members (@atinux.com, @pi0.io + @antfu.me), to continue to work full time on Nuxt we remain independent — and our vision and ethos are not changing 💚

Haoqun Jiang
@haoqun.dev

Finally. I wish the community could migrate from the `packageManager` field to `devEngines` following this - always pinning versions is good in theory but way too cumbersome in practice.

Socket@socket.dev

📌 Just hours ago, the Node.js TSC officially voted to stop distributing Corepack. Future Node.js releases (i.e. 25+) won’t include it, but it will remain available separately. socket.dev/blog/node-js... #nodejs #javascript

socket.devNode.js TSC Votes to Stop Distributing Corepack - SocketCorepack will be phased out from future Node.js releases following a TSC vote.

Haoqun Jiang reposted

James
@43081j.com

This thing is so useful. Especially for security - ensuring the published package is actually what exists in the source

Passle ☭@passle.dev

TIL npm diff docs.npmjs.com/cli/v11/comm... (via @43081j.com on the @e18e.dev discord)

Haoqun Jiang reposted

Marvin Hagemeister
@marvinh.dev

Speeding up the JavaScript ecosystem part 11 is here! This time we're looking at: Extending Rust tools with JavaScript plugins marvinh.dev/blog/speedin...

marvinh.devSpeeding up the JavaScript ecosystem - Rust and JavaScript PluginsUp until recently, supporting JavaScript in Rust based tools has been deemed not worth it. The main concern is the overhead of the de-/serialization cost when sending data back and forth. But there is...
Haoqun Jiang
@haoqun.dev

Resurfacing this post now that pnpm 10 is tagged as latest.

Haoqun Jiang@haoqun.dev

I forked Bun's internal allowlist for those who need the protection from this new default but don't want to bother reviewing every dependency one-by-one: github.com/haoqunjiang/...

github.comGitHub - haoqunjiang/build-scripts-allowlist: An up-to-date list of common NPM packages that need to run lifecycle scripts during installation.An up-to-date list of common NPM packages that need to run lifecycle scripts during installation. - haoqunjiang/build-scripts-allowlist
Haoqun Jiang
@haoqun.dev

In my experience this new default doesn't break many projects. But it might slow down some native packages a bit. For example, packages like esbuild, lightningcss-cli try to optimize their binaries in the postinstall scripts; these will no longer be executed by default: github.com/evanw/esbuil...

Haoqun Jiang
@haoqun.dev

Note it's not about their Node APIs (so Vite isn't affected), just when executing the binaries (i.e. `pnpm exec esbuild`) there will be a performance hit.

Haoqun Jiang
@haoqun.dev

@acemarke.dev Hi Mark, I just noticed that the Bluesky link on your GitHub profile is invalid since you changed your handle. Just wanted to give you a heads-up in case you'd like to update it

Bluesky@bsky.app

📢 App Version 1.96 is rolling out now (1/6) In this release: a notifications Mentions tab, reserving your default username when you verify your account with a domain, and other improvements!

Haoqun Jiang
@haoqun.dev

@acemarke.dev Hi Mark, I just noticed that the Bluesky link on your GitHub profile is invalid since you changed your handle. Just wanted to give you a heads-up in case you'd like to update it

Bluesky@bsky.app

📢 App Version 1.96 is rolling out now (1/6) In this release: a notifications Mentions tab, reserving your default username when you verify your account with a domain, and other improvements!

Haoqun Jiang
@haoqun.dev

And in case you still want that username, you can temporarily change your handle back and forth to reserve it. This feature was introduced about a month ago: bsky.app/profile/bsky...

Bluesky@bsky.app

📢 App Version 1.96 is rolling out now (1/6) In this release: a notifications Mentions tab, reserving your default username when you verify your account with a domain, and other improvements!

Haoqun Jiang
@haoqun.dev

The discoveries are really cool, though

Chandler Carruth @chandlerc.blog

The gift that keeps on giving: predictors.fail This is IMO a great example of why **process isolation is the only path to confidentiality on modern CPUs**. Site- (or origin-) process isolation continues to be the path. Also note: the CPU is **not** the problem here IMO, it's doing exactly its job.

Haoqun Jiang reposted

sapphi_red
@sapphi.red

Vite 6.0.9 / 5.4.12 / 4.5.6 has been released with *breaking changes* due to security issues. I recommend upgrading it. Some users may need to update the config options. Please check github.com/vitejs/vite/... if you encountered any errors.

github.comAny websites were able to send any requests to the development server and read the response### Summary Vite allowed any websites to send any requests to the development server and read the response due to default CORS settings and lack of validation on the Origin header for WebSocket co...
Haoqun Jiang
@haoqun.dev

I forked Bun's internal allowlist for those who need the protection from this new default but don't want to bother reviewing every dependency one-by-one: github.com/haoqunjiang/...

github.comGitHub - haoqunjiang/build-scripts-allowlist: An up-to-date list of common NPM packages that need to run lifecycle scripts during installation.An up-to-date list of common NPM packages that need to run lifecycle scripts during installation. - haoqunjiang/build-scripts-allowlist
Socket@socket.dev

Big changes in @pnpm.io 10.0.0: Lifecycle scripts are now blocked by default to combat supply chain attacks. This change is widely supported but comes with some friction. socket.dev/blog/pnpm-10... #NodeJS #pnpm #JavaScript

socket.devpnpm 10.0.0 Blocks Lifecycle Scripts by Default - Socketpnpm 10 blocks lifecycle scripts by default to improve security, addressing supply chain attack risks but sparking debate over compatibility and workf...
Haoqun Jiang
@haoqun.dev

The intrusive design is mostly due to the intrinsic complexity that makes overriding rules in plain array configs almost impossible without knowing the underlying implementation. Type-aware linting in Vue + TypeScript needs a complete overhaul… which I'd like to work on after this stop-gap measure.

Haoqun Jiang reposted

pnpm
@pnpm.io

pnpm can block lifecycle scripts of dependencies during installation. This is an opt-in feature though. Should we block them by default? github.com/orgs/pnpm/di...

github.comShould we block lifecycle script of dependencies during installation? · pnpm · Discussion #8918There was recently an incident with rspack, where it was published with a postinstall script that contained malware. Such incidents happen from time to time, so it could be a good idea to stop runn...
Haoqun Jiang
@haoqun.dev

SCOTUSblog IS HERE!!! I’ve been missing them since they left X. As I don’t use TikTok, I’ve had no easy way to follow them (well, I don’t feel like checking websites regularly for updates). So glad to see this account again on a social network!

SCOTUSblog@scotusblog.com

Good morning! We're expecting more opinions from the Supreme Court today at 10 EST. Follow along for live updates, a thread: