Kevin Deng

Kevin Deng

@sxzz.dev

https://github.com/sxzz β€’ πŸ³οΈβ€πŸŒˆ Gen Z β€’ indie OSS developer sponsored by @voidzero.dev @vuejs.org @vite.dev @vue-macros.dev @vueuse.org @unjs.io @rolldown.rs elk.zone More at https://sxzz.dev/

1.6K followers310 following312 posts

Kevin Deng
@sxzz.dev

I made a little playground for tsrs πŸ¦€ Runs in your browser with WASM, and it’s much much faster than the tsgo WASM version! tsrs.sxzz.dev

Kevin Deng@sxzz.dev

rolldown-plugin-dts now lets you choose your TypeScript compiler for .d.ts generation: tsc, tsgo or tsrs Benchmark: β€’ Real repo: tsrs 229ms, 3.6Γ— faster than tsc β€’ 1000 modules: tsrs ~10% faster, ~13% less memory than tsgo β€’ tsrs is lowest on time and memory in every workload

Kevin Deng
@sxzz.dev

rolldown-plugin-dts now lets you choose your TypeScript compiler for .d.ts generation: tsc, tsgo or tsrs Benchmark: β€’ Real repo: tsrs 229ms, 3.6Γ— faster than tsc β€’ 1000 modules: tsrs ~10% faster, ~13% less memory than tsgo β€’ tsrs is lowest on time and memory in every workload

VoidZero@voidzero.dev

Introducing tsrs: a Rust port of the TypeScript compiler πŸ¦€ We are not forking TypeScript! β—† In close collab with the TypeScript team β—† Up to 8x faster than TS 7.0 & ~70% less memory β—† Runs in WASM (works in your browser & workers) β—† Soon part of Oxc npx tsrs blog.cloudflare.com/typescript-r...

blog.cloudflare.comIntroducing tsrs: a Port of TypeScript to RustCloudflare is collaborating on tsrs, a Rust port of TypeScript that is up to 8x faster and uses 70% less memory.
Kevin Deng
@sxzz.dev

Note: both rolldown-plugin-dts (TS 7.1 support) and the Vue content mapper are experimental & not stable yet. Try it out, but use with caution in prod ⚠️

Kevin Deng reposted

Rick Viscomi
@rviscomi.dev

I wrote this one! πŸ™‹β€β™‚οΈ In CJK languages, hitting Enter to confirm an IME candidate can accidentally submit the form in chat textareas The guide shows how to safely implement "Enter to submit" including how to work around a Safari event-ordering bug with isComposing github.com/GoogleChrome...

github.commodern-web-guidance/skills/modern-web-guidance/guides/forms/ime-safe-enter-submit.md at v0.0.186 Β· GoogleChrome/modern-web-guidanceKeep your coding agent up to date with the latest web best practices - GoogleChrome/modern-web-guidance
Chrome for Developers@developer.chrome.com

Here's what's new in Modern Web Guidance v0.0.186 β†’ goo.gle/4xcsdWW ⌨️ New guide on IME-safe textarea submission, along with recs for handling KeyboardEvent.isComposing for IME πŸ”Ž Mandatory code verification step for agents in the global MWG skill

goo.gleRelease v0.0.186 Β· GoogleChrome/modern-web-guidanceRelease Notes: v0.0.186 πŸ†• New Guides Added the ime-safe-enter-submit guide, which provides implementation strategies for handling "Enter to submit" patterns in textareas without interrupting Input...

Kevin Deng reposted

Andrew Branch
@andrewbran.ch

If you’re not stalking TypeScript PRs, you might be surprised how much you can do with the API in nightlies (and even in 7.0 stable), so here’s a tiny demo that I think hits some of the highlights. 🧡

Kevin Deng
@sxzz.dev

Just like this is Johnson’s project, he can do whatever he wants. After using such disrespectful language toward someone (regardless of where), I thought you knew you could always directly fork an OSS project instead of impotently raging like an asshole. No community welcomes you.

This post is unavailable.
Kevin Deng
@sxzz.dev

Glad to help move the ecosystem toward: - ESM-only - TypeScript - OIDC + staged publishing - Runtime-agnostic design wherever possible - No bundled deps unless needed - Like-minded dependencies I’ve replaced `debug` and `semver` with `obug` and `verkit`. What’s next? πŸ€”

James@43081j.com

good timeline. this is magic-string, 140M dls/week. a week ago i asked if it could go ESM only - @sxzz.dev dropped a PR <1 day later πŸŽ‰ later, I removed sourcemaps and did 2 big CPU perf speed ups πŸš€ love seeing a high impact package like this shrink and speed up

Kevin Deng
@sxzz.dev

The tsdown ecosystem, visualized ✨ Each circle = a project owner using tsdown, sized by GitHub stars. 873 projects over 100 stars and counting. Grateful to everyone shipping with it.

Kevin Deng
@sxzz.dev

⚑ After `rolldown-plugin-dts` migrated Babel toolchain to yuku, tsdown has cut ~5 MB from its install size and is now smaller than tsup. ❀️ Huge thanks to arshad-yaseen for the help!

Kevin Deng reposted

npmx
@npmx.dev

We've started by verifying npmx maintainers. Log in to mu.social to see the verified badges! We'd like to discuss the best strategy for our communities with OSS maintainers. Should all large enough OSS projects be verifiers? Or would it be better for a few orgs/foundations to take on the task?

Eurosky Social@eurosky.social

We're delighted to launch with multiple trusted verifiers: @france-atmosphe.re @npmx.dev and @medsky.network. Trusted organizations, businesses and professional networks can become verifiers and verify their people and accounts - reach out at verification@mu.social

Kevin Deng reposted

Titus πŸ‡΅πŸ‡Έ
@wooorm.com

Hello friends and welcome to another β€œhow’s ESM vs CJS doing?!” A big win this time, at a year of `require(esm)` available! 38.0% of the popular npm packages now have ESM, up from 33.4% half a year ago. ESM-only is up from 12.6% to 16.0%. Particularly this non-dual, β€œvanilla” growth is very big!

Kevin Deng reposted

Socket
@socket.dev

πŸ“¦ @pnpm.io 11.5 adds support for recognizing npm staged publishes after staged approval metadata triggered a false downgrade signal. As npm adds more release paths, registry metadata needs to make it clear how each package version was published. socket.dev/blog/pnpm-11...

socket.devpnpm 11.5 Adds Support for Recognizing npm Staged Publishes ...pnpm 11.5 now recognizes npm staged publish approvals in release metadata, preventing those releases from being mistaken for lower-trust package publi...
Kevin Deng
@sxzz.dev

It’s been really encouraging to see tsdown adopted by companies like @vercel.com and @cloudflare.social, as well as open-source projects like OpenClaw and LobeHub. If tsdown has been useful to you or your project, please consider sponsoring my work ❀️ github.com/rolldown/tsd...

github.comWho's using tsdown? Β· rolldown tsdown Β· Discussion #143Which Projects Are Using tsdown? Share Your Insights! Hey everyone! πŸš€ We're curious to know which projects or teams are currently using tsdown. Whether it's a personal side project, a startup, or a...
Kevin Deng
@sxzz.dev

npm increasingly feels like a zombie org under GitHub. As someone who's been around the JS ecosystem and part of multiple OSS orgs for years, what I'm seeing isn't just "big co moves slow." It's quiet neglect of critical infrastructure the entire JS world runs on. A short thread 🧡

View full thread
Kevin Deng
@sxzz.dev

Credit where it's due. Huge thanks to the @pnpm.io, @npmx.dev, and broader tooling communities (@e18e.dev) You're the reason working with JS packages still feels okay day to day. You filled the vacuum npm left behind. The registry is still a single point of failure, but the tools around it aren't.

Kevin Deng
@sxzz.dev

npm increasingly feels like a zombie org under GitHub. As someone who's been around the JS ecosystem and part of multiple OSS orgs for years, what I'm seeing isn't just "big co moves slow." It's quiet neglect of critical infrastructure the entire JS world runs on. A short thread 🧡

View full thread
Kevin Deng
@sxzz.dev

So here's the ask: **open source the npm registry** Microsoft acquired npm in 2020. The bar isn't even "make it better." It's "stop making it worse." A closed registry controlled by one company is a structural risk the JS ecosystem shouldn't have to carry.

Kevin Deng
@sxzz.dev

The archived npm-registry-couchapp repo still says: "FOSS is an important part of npm, and over time we plan on exposing more APIs," In 2026, that line reads like a punchline. The repo is archived. The promise is archived. "Over time" never came. github.com/npm/npm-regi...

github.comGitHub - npm/npm-registry-couchapp: couchapp bits of registry.npmjs.orgcouchapp bits of registry.npmjs.org. Contribute to npm/npm-registry-couchapp development by creating an account on GitHub.
Kevin Deng
@sxzz.dev

npm increasingly feels like a zombie org under GitHub. As someone who's been around the JS ecosystem and part of multiple OSS orgs for years, what I'm seeing isn't just "big co moves slow." It's quiet neglect of critical infrastructure the entire JS world runs on. A short thread 🧡

View full thread
Kevin Deng
@sxzz.dev

The npm registry has no proper issue tracker. Feedback gets dumped into a GitHub Discussions space, mixed with everything else, rarely getting an official reply. npm is critical infra for millions of developers. It deserves its own dedicated, staffed, public tracker. This isn't optional.

Kevin Deng
@sxzz.dev

Then there are the recent security incidents. Supply chain attacks keep landing on npm, and the responses tend to be slow and opaque. When you operate the registry the world depends on, "we're looking into it" days later isn't accountability. It's risk externalized onto the ecosystem.

Kevin Deng
@sxzz.dev

npm increasingly feels like a zombie org under GitHub. As someone who's been around the JS ecosystem and part of multiple OSS orgs for years, what I'm seeing isn't just "big co moves slow." It's quiet neglect of critical infrastructure the entire JS world runs on. A short thread 🧡

Kevin Deng
@sxzz.dev

One concrete example. This issue on npm/cli: github.com/npm/cli/issues/8768 Open for six months. Zero official replies. It's not an outlier, it's the pattern. Real users posting real bug reports, just sitting there with no response from anyone at npm.

github.com[BUG] `publishConfig.tag` Not Respected Β· Issue #8768 Β· npm/cliIs there an existing issue for this? I have searched the existing issues This issue exists in the latest npm version I am using the latest npm Current Behavior npm publish doesn't respect publishCo...
Kevin Deng
@sxzz.dev

PSA: the safest way to publish an npm package today is staged publish + OIDC + provenance. "But it can't stop every attack." Sure, and seatbelts don't prevent every injury either. We still wear them. Security is layers, not silver bullets.

Kevin Deng
@sxzz.dev

Some say "local + 2FA is safer than CI." I don't buy it. Your daily laptop is browsing, chatting, installing random deps, running who knows what. Every bit of that activity adds exposure. A fresh CI run with OIDC + actions pinned to full-length commit SHAs starts from zero.

Kevin Deng
@sxzz.dev

Concrete example: a malicious VS Code extension might not steal your token (YubiKey or 1Password keeps it safe). But during local npm publish, it can intercept the request and inject code into your package before it reaches the registry. 2FA proves it's you, not what you shipped.