Skip to content

JavaScript Every Month

Web in May 2026

Originally sent via Buttondown

Hello June 🌧️

Several security incidents have been reported, and your device is now a target. Regularly rotate all the keys stored on your device, and monitor your bills and usage. I have added a security section in Spotlight for your convenience. If you need some help, OWASP has released a free local first JS vulerability scanner - CVE Lite CLI

Releases

Browsers

Chrome 148

  • name only container queries (baseline)
  • lazy loading for <video> and <audio> elements with lazy attribute
  • Open Font Format avar2 text shaping and glyph rendering

Firefox 151

  • support for style() queries on @container
  • document PiP functionality on desktop
  • support for web serial API

Safari 26.5

  • support for the :open pseudo-class for <details>, <dialog>, <select>, and <input> elements
  • Added support for element-scoped keyword in CSS random() function

IDE

  • Antigravity 2 - Google's IDE goes agent view as the main view, adds scehduled tasks, subagents as it catches up to others.
  • Repo Prompt author joins OpenAI. Community Edition of product expected soon.
  • Anthropic's partnership with SpaceX has doubled the 5-hour rate limits for Pro, Max, and Team plans. The reduction in peak hour limits has also been removed.
  • IDE Qoder reaches stable 1.0 release.
  • Visual Studio Code has had multiple releases through the month where they released their in built browser previews with responsiveness, remote agent support.

Astro 6.4

  • Introduces new markdown processor API, you can also use Satteri, a Rust Markdown pipeline engine
  • Advanced routing configuration with first class support for Hono, Cloudflare

React Aria

  • Checkbox, Radio and Switch become customizable compound components
  • test utils on RC

Foldkit

frontend framework for correctness

Built on Effect. Architected like Elm. Written in TypeScript.

TypeORM 1.0

First stable release, after sticking out for so long.

Diffs - Linear

Software review surface area by Linear.

Deno 2.8

  • deno add and deno install now treat unprefixed names as npm packages by default
  • 76.4% Node.js test suite compatibility
  • 3.66x faster cold npm installs
  • supports import defer
  • supports deno why, deno pack

and a lot more. Huuuge minor release from Deno.

Bun 1.3.14

  • Bun.Image built in image processing API
  • Global virtual store option for bun install
  • Experimental HTTP/2, HTTP/3 client for fetch
  • Rewritten fs.watch() backend on Linux, macOS
  • Bun.Terminal on Windows

While this is a large release similar to Deno's, there was something else that happened shaking up the entire Bun/JavaScript ecosystem. Talking about it in the spotlight.

Tanstack Start

Meanwhile, Tanner Linsely wrote about an experiment in which he is building a scoped React that contains just enough underlying code. No more, no less.

Node 26.0.0

  • Temporal API is stable
  • support for randomUUIDv7()

Rolldown 1.0

  • First stable release for the VoidZero bundler

Staged Publishing

To improve security, npm is introducing a staged step where packages can be approved before going live to the wide audience.

Modern Web Guidance - Chrome

A set of skills encourages agents to utilize the best and latest offerings of the web. While I feel a sense of satisfaction reading through it, I would prefer to wait for agents to incorporate these trends into their training data. I do not trust the agents to use caniuse or this skill when necessary.

fate 1.0

The modern data client inspired by Relay and GraphQL

  • View Composition
  • Normalized cache
  • Data masking and strict selection
  • Live views and lists

Rosie

Package manager for skills. Interestingly does not do the skills registry.

In the Spotlight 🔦

Bun in Rust

https://github.com/oven-sh/bun/pull/30412

Bun was rewritten from Zig to Rust, few things to note about this:

  • The entire PR was done in a one week, in one single PR with 2188 file changes. Almost entirely by AI, managing the test suite.

Lines changed: 1009257 additions & 4024 deletions

  • Claude team later revealed how this PR miracle was achieved in their post on Claude dynamic workflows
  • Bun was built on Zig and is one of the flagship projects developed using this language. Zig, if you are not familiar, is designed to be an improved version of C. It operates as a non-profit corporation. The Zig and Bun teams have faced challenges after Bun's acquisition by Anthropic. Zig has been vocally against contributions from large language models (LLMs) and does not permit LLM involvement. While Bun has made many improvements to its port of Zig, it cannot contribute back due to the LLM policy.

Security

There are still so many security attacks happening, LLMs or not, that the separate section for it seems appropriate.

Tutorials

How React Native Builds Actually Work (APK, AAB, IPA, APP) - YouTube

Beto Moedano explains what these confusing acronyms are and how to build a React Native project. Apple and Google compete to make their certificates so convoluted that it attracts some customers to Expo build.

9 Times the Web Platform Was Influenced by Libraries

A good perspective on how the web platform has evolved and adopted features from libraries. The most famous example is jQuery's $, which is still used as an alias for querySelector in the browser console. Let's get more awesome libraries and more done natively.

The React2Shell Story and What Happened Next.js

lol wouldn’t it be crazy if we found an RCE in React

The intriguing story of how the react2shell vulnerability was discovered begins with a Discord group chat. The group aimed to uncover specific CMS systems and ultimately found the bug in the React framework itself.

Build Your Own Database - NaN

An interactive blog post about building your own key-value database from the ground up. I did not even want to create a database, but just scrolling through the article made me want to.

In short

In Other News

Ollee Watch

I discovered this on the MKBHD podcast, and as someone who loves my Casios and enjoys tinkering, this looks awesome. A custom PCB replacement designed to transform Casio's classic retro digital watches into hidden smartwatches. It can currently do Bluetooth time syncing, timezones, alarms and some hacked in fitness tracking (also play Poker, if you are into that)

Uber's COO says it's getting harder to justify the money spent on AI tokenmaxxing

Many companies have transformed into token-use factories. They evaluate their employees based on the number of tokens they have burned. That's when they run into Goodhart's law.

A measure becomes a target, it ceases to be a good measure

To view alongside, Dara Khosrowshahi on replacing Uber drivers — and himself — with AI | Decoder To read alongside, Software is becoming marketing

What will happen to technical blogging?

Technical blogs are typically free and written for exposure. However, if only AI is reading and copying these blogs, they become largely ineffective. The AI won't remember you, so who are you promoting to?

The iPhone That Never Was - Wired

Wired tells the story of General Magic, the company that brought together talented technicians, invented everything necessary for smartphones, and then collapsed spectacularly.

Nobody understands the point of hybrid cars - Technology Connections - YouTube

A comprehensive tutorial on hybrid engines, explaining what they are, how they operate, and how they can save us from slow charging hell.

AI updates

Looking Ahead

Subscribe to JEM Newsletter

Stay ahead of the curve in Web Development with Javascript Every Month Newsletter.

I will deliver a curated selection of articles, tutorials, and resources straight to your inbox once a month.

No spam, unsubscribe anytime.

Keyboard shortcuts

h
Go to Home
b
Go to Blog
w
Go to Webmarks
p
Open Projects
j
Go to Newsletter
t
Switch light and dark
s
Turn key sounds on or off
/
Search webmarks
?
Show this sheet

This keyboard hides a couple of secrets. One is spelled out on the home page; the other is older than most of the web.