TypeScript.fm - The Friendly Show for TypeScript Developers

News for the week of May 18, 2026: Claw Patrol! Claw Patrol! We'll be there on the double! Also, npm finally responds to ongoing supply chain attacks. From the community: using Effect more effectively, and AI's impact on open source.
Sponsored by Excalibur.js
Excalibur.js is the free and open source friendly TypeScript 2D game engine for the web. Learn to make web games with TypeScript or JavaScript! Excalibur comes out-of-the-box with everything you need, like physics, sprites, animations, sound effects, and first-party plugins for popular 2D gamedev tools.
Homepage and Docs: https://excaliburjs.com
Make Your First Game in 10 Minutes
Join the Discord: https://discord.gg/9UemP985Uy

Chapters

(00:00) - Welcome to the Show

(05:07) - News: Claw Patrol is an Open Source Security Firewall by Deno

(06:54) - News: Deno 2.8 Release Notes

(08:08) - News: Google I/O Takeaways

(13:26) - News: Firefox 151 Features and Updates

(16:05) - Security: npm Wakes Up to Supply Chain Attacks

(21:26) - Security: Laravel Lang Compromised with Backdoor

(23:00) - Library Watch: mediabunny Works in Your Browser Without ffmpeg

(24:09) - Library Watch: TSBin is a JSBin Clone for TypeScript

(25:52) - Community: AI Has Taken Over Open Source by Socket

(28:53) - Community: Ergonomic Effect by Alex Leung

(31:47) - Community: Building Your Own Server in Node.js by James Smith

(33:09) - Bleet of the Week

(33:37) - Cool Link: Witch Hat Atelier Magic System Simulator

(34:45) - Cool Link: Stormlight Archives by Brandon Sanderson

(36:22) - Cool Link: No One's Happy

(37:22) - The Minnesota Long Goodbye

News
Deno: Claw Patrol: an open-source security firewall for agents
Deno: 2.8 blog post
Google: 15 Updates from Google I/OWebAuthN Immediate Mode: https://github.com/MasterKale/webauthn-polyfills 

Firefox: Firefox 151.0, See All New Features, Updates and Fixes 
npm: npm Invalidates Granular Access Tokens as Mini Shai-Hulud Sweeps the Registry 
Laravel: Laravel Lang Compromised with RCE Backdoor Across 700+ Versions
Library Watch
Mediabunny: Correction, it does not depend on ffmpeg
https://tsbin.com/p/new 
From the Community
Socket: AI Has Taken Over Open Source 
Alex Leung: Ergonomic Effect
James Smith: BYO Web Server in Node 
Bleet of the week
Cool Links
I Built a Witch Hat Atelier Spell Simulator
No One’s Happy
Music
Seahorse Dreams by Kubbi (Spotify)

News for the week of May 11, 2026: Deno 2.8 brings Node compatibility to 75%, Bun's Rust port is taking shape, and more supply chain sadness. From the community: SpacetimeDB's JS engine is faster than Rust, scrapping a custom DSL in favor of TypeScript, and why Effect is good for AI agents.
Sponsored by Excalibur.js
Excalibur.js is the free and open source friendly TypeScript 2D game engine for the web. Learn to make web games with TypeScript or JavaScript! Excalibur comes out-of-the-box with everything you need, like physics, sprites, animations, sound effects, and first-party plugins for popular 2D gamedev tools.
Homepage and Docs: https://excaliburjs.com
Make Your First Game in 10 Minutes
Join the Discord: https://discord.gg/9UemP985Uy

Chapters

(00:00) - Welcome to the Show

(05:34) - News: Deno 2.8 Brings Node Compat to Just Over 75%

(07:57) - News: VS Code Codebase Type Checked by TS 7

(08:15) - News: Bun's Rust Port Coming in Next 1.4 Release

(13:55) - News: Rolldown 1.0 Released

(17:32) - News: GitHub Takes Aim at Claude Code and Codex with New Copilot App

(18:58) - PSA: Upgrade Next.js Due to Recent CVEs

(19:52) - PSA: TanStack Supply Chain Incident Post-mortem

(23:48) - PSA: Ongoing Mini Shai-Hulud Supply Chain Attack

(27:22) - PSA: node-ipc Infected with Credential Stealer

(30:56) - Library Watch: Vitest 4.1.6 and 5.0.0-beta.3 Security Updates

(31:15) - Library Watch: styleframe is a TypeScript Design System Engine

(32:23) - Library Watch: mediabunny, a TypeScript Media Encoder and Decoder Library

(34:08) - Community: Migrating to TypeScript 6 by LogRocket

(34:48) - Community: SpacetimeDB JS Engine Outperforms Rust

(37:21) - Community: Inventing a New Language Was a Mistake by Wasp

(40:31) - Community: Express.js Revamp

(41:18) - Community: Anders on Why AI Will Never Replace Developers

(41:46) - Community: Interview With Anders on Turbo Pascal, C#, and TS

(41:59) - Community: npm install && pray by Jo Franchetti

(42:22) - Community: Next Era of TypeScript with Effect by Lucas Barake

(43:21) - Community: Node.js Alpine Linux Feedback

(44:32) - Community: dax.land, Shell Scripting Everywhere

(45:13) - Bleet of the Week

(45:47) - Cool Link: Why HTML in Canvas is Cool

(46:23) - Cool Link: Beginners Guide to Immich, a Self-hosted Google Photos Alternative

(46:55) - Cool Link: The Math Behind Exodia's Draw in Yu-Gi-Oh!

(47:18) - Cool Link: Best Local Agentic Coding Workflow by Web Dev Simplified

(49:59) - Cool Link: Declarative Partial Updates Web Standard

(53:31) - The Minnesota Long Goodbye

News
Deno: 2.8 release is hot off the press
VS Code: VS Code type checked with TS 7 Native Preview 
Bun: Rust Port is Looking More Official
VoidZero: Announcing Rolldown 1.0 
GitHub: GitHub takes aim at Claude Code and Codex with its new Copilot app and yes, you can bring your own model 
PSA: Reminder update your Next.js
TanStack: Hardening TanStack After the npm Compromise 
Socket: Active Supply Chain Attack Compromises @antv Packages on npm... 
Socket: Popular node-ipc npm Package Infected with Credential Stealer 
Library Watch
Vitest 4.1.6 and 5.0.0-beta.3: Security updates
Styleframe 3.7.0, TS design system engine, comes with a new playground 
Mediabunny is a TypeScript library for media encoding/decoding on the client and server
From the Community
LogRocket: TypeScript v6 is here: A full migration guide
SpacetimeDB: Let's talk benchmarks
Wasp: 5 Years and $5M Later: Inventing a New Programming Language for Web Development Was a Mistake
Express: A New Look for Express 
Anders: Microsoft Lead: "AI will NEVER Replace Coders, Here's Why" 
Anders: TypeScript, C# and Turbo Pascal with Anders Hejlsberg 
Jo Franchetti: npm install && pray — Defending Your Stack from Code You Didn't Write
Lucas Barake: Next Era of TypeScript | Effect.ts × AI
Node.js: Promote Alpine Linux out of experimental to be a tier 2 platform
dax.land lets you develop shell scripts that run the same everywhere  
Bleet of the week
Cool Links
Joy of Code: Why Everyone Is Excited About HTML In Canvas
Futo: A Beginner's Guide to Immich  
adef: The Math Behind the Exodia Draw in Episode 1 of YuGiOh
Web Dev Simplified: The Best Local Agentic Coding Workflow (Complete Guide)
Chrome Developer Blog: Declarative partial updates 
Music
Seahorse Dreams by Kubbi (Spotify)

News for the weeks of April 27 and May 4, 2026: Rust ports galore, Remix 3 is ready to rumble, and lots of security PSAs that are breaking the Internet. From the community: boring web dev, cross-framework templating with TSRX, and TypeScript features wishlist.
Sponsored by Excalibur.js
Excalibur.js is the free and open source friendly TypeScript 2D game engine for the web. Learn to make web games with TypeScript or JavaScript! Excalibur comes out-of-the-box with everything you need, like physics, sprites, animations, sound effects, and first-party plugins for popular 2D gamedev tools.
Homepage and Docs: https://excaliburjs.com
Make Your First Game in 10 Minutes
Join the Discord: https://discord.gg/9UemP985Uy

Chapters

(00:00) - Welcome to the Show

(02:45) - News: tsz is a Vibe-ported TypeScript Go Compiler to Rust

(07:45) - News: Bun Experiments with Rust Port from Zig

(10:23) - News: pnpm Core Officially Being Ported to Rust as Pacquet

(13:13) - News: Astro 6.3 with Experimental Advanced Routing

(14:06) - News: Remix 3 Beta is Ready to Kick the Tires

(17:06) - News: Nuxt.js Has a New Agent

(18:31) - News: SvelteKit Now Supports TS 6.0

(19:03) - News: Node 26 Brings Stable Temporal API, Experimental FFI

(23:02) - News: Chrome 148 Ships Prompt API No One Wants

(28:50) - News: Behind the Scenes Hardening Firefox

(35:20) - PSA: Multiple Critical Linux Exploits, Copy Fail and Dirty Frag

(38:55) - PSA: React 19 and Next.js Vulnerabilities

(40:34) - PSA: TanStack Packages Compromised

(42:07) - PSA: vm2 Critical Vulnerabilities

(43:05) - PSA: cPanel is Being pwned Across the Web

(44:42) - Library Watch: Laravel TypeScript Type Generator

(45:31) - Library Watch: motion.dev JavaScript Animation Library

(46:25) - Library Watch: Temper Lets You Build Cross-language Libraries

(48:36) - Library Watch: Wavedash is a Backend for Multiplayer Games

(49:37) - Library Watch: Flue, a TypeScript Agent Harness Framework

(49:59) - Highlight: Rebuilding Zork in TypeScript and React

(50:59) - Highlight: TSRX, a TS-driven Templating Library

(53:29) - Highlight: I Went Back to Boring Web Dev and I'm Not Sorry by Andre Klein

(55:41) - Highlight: TypeScript Features Wishlist by Cinnamon

(57:22) - Highlight: JSON.parse vs. stringify Date Handling Tip

(57:59) - Bleet of the Week

(58:37) - Cool Link: Shader Playground

(59:38) - Cool Link: Recreating the PSP from Cast Acrylic

(01:00:02) - Cool Link: Cascade Radiance for Realistic Lighting

(01:01:10) - Cool Link: Inside Out Money Podcast

(01:02:39) - The Minnesota Long Goodbye

News
tsz vibe-port of Go compiler to Rust
Bun experimental Rust port
pnpm port to Rust officially called pacquet
Astro 6.3 
Remix 3 Beta Preview 
Introducing the Nuxt Agent
SvelteKit: Now Supports TS 6.0 
Node.js 26.1.0 (Current) 
New in Chrome 148, the controversial Prompt API
Behind the Scenes Hardening Firefox
PSA: Malicious npm Package Brand-Squats TanStack to Exfiltrate Environment Variables
PSA: TanStack Packages Compromised
PSA: Linux exploits, Copy Fail and Dirty Frag, including WSL2 on Windows
PSA: React and Next.js Hit With 12 Security Flaws — Three Let Attackers Bypass Auth, Hijack Servers
PSA: vm2 Node.js Library Vulnerabilities Enable Sandbox Escape and Arbitrary Code Execution
PSA: cPanel & WHM Authentication Bypass CVE-2026-41940
Library Watch
Laravel TS Annotations 
Motion.dev – Effortless Animation For The Web
Temper: Cross-language *libraries* with Temper: Interview
Wavedash for multiplayer apps 
Flue: TypeScript agent harness, BYOM and build your own agents
From the Community
Chad Loder: Zork in TypeScript+React 
Ryan Carniato: Exploring TSRX w/ Dominic Gannaway
André Klein: I Went Back to Boring Web Dev, and I'm Not Sorry
Cinnamon: Feedback for TypeScript 
Jonathan Bones: JSON.parse vs JSON.stringify date handling
Bleet of the week
Cool Links
Excalibur.js contributor Justin has a Shader Editor 
I re-created the PSP 
Exploring a New Approach to Realistic Lighting: Radiance Cascades 
Inside Out Money podcast – if you like friends yapping about money
Music
Seahorse Dreams by Kubbi (Spotify)

News for the week of April 20, 2026: highlights from the recent TypeScript 7 beta and Deno Fresh quality of life improvements. From the community: Bloomberg's type-safe CLI library, a new TSGO toolchain, and TypeScript database migrations.
Sponsored by Excalibur.js
Excalibur.js is the free and open source friendly TypeScript 2D game engine for the web. Learn to make web games with TypeScript or JavaScript! Excalibur comes out-of-the-box with everything you need, like physics, sprites, animations, sound effects, and first-party plugins for popular 2D gamedev tools.
Homepage and Docs: https://excaliburjs.com
Make Your First Game in 10 Minutes
Join the Discord: https://discord.gg/9UemP985Uy

Chapters

(00:00) - Welcome to the Show

(05:42) - News: TypeScript 7 Beta!

(15:01) - News: Deno Fresh 2.3 is Zero JS by Default

(18:37) - News: Firefox 150 Has Better Split Views, PDF Editor

(20:23) - Library Watch: TypeScriptToLua Supports TS 6.0

(21:34) - Library Watch: ttsc, a TypeScript Go Toolchain to Replace tsx

(23:27) - Library Watch: tesseron, Turn Any App Into an MCP Server

(26:03) - Library Watch: stricli, Bloomberg's Lightweight CLI Library

(27:38) - Highlight: Writing Node.js Add-ons with .NET Native AOT

(30:28) - Highlight: Prisma Next Supports TypeScript Migrations

(33:24) - Highlight: Create a Complete Zod Clone from WebDevSimplified

(34:03) - Highlight: TuiSky, a Terminal UI Client for BlueSky

(34:49) - Highlight: unbash v3 is the Fastest and Bestest Parser of Bash

(35:12) - Highlight: Graphics Programming with WebGPU and TypeScript

(36:09) - Bleet of the Week

(36:25) - Secret of the Handbook: Const Generics

(37:32) - Cool Link: Sorting 10,000 Lego Parts per Day

(39:07) - Cool Link: Building a Better Chess Bot in C#

(39:39) - Cool Link: Whimsical Animations Course

(41:23) - Cool Link: Web Serial API

(44:07) - The Minnesota Long Goodbye

News
Microsoft: Announcing TypeScript 7.0 Beta
Deno: Fresh 2.3: Zero JS by default, View Transitions, and Temporal support
Firefox: Firefox 150.0, See All New Features, Updates and Fixes 
Library Watch
TypeScriptToLua v1.36.0: TS 6.0 support
samchon/ttsc: A `typescript-go` toolchain for compiler-powered transforms and type-safe execution. 
Tesseron: In-app MCP layer that interfaces with agent tools (like WebMCP) 
Stricli: Bloomberg’s type-safe CLI framework 
From the Community
Microsoft: Writing Node.js addons with .NET Native AOT 
Prisma: TypeScript Migrations in Prisma Next 
WebDevSimplified: Create a Complete Zod Clone In TypeScript
Michael Black: TUI for Bluesky in TypeScript 
Lars: Unbash v3 
Ryosuke: WebGPU w/ TypeScript 
Bleet of the week
Secret of the Handbook: I Can’t Believe This TS Feature Has No Documentation
Cool Links
Cool Watch: Coding Adventure: Making a Better Chess Bot 
Cool Watch: Why we had to reinvent the conveyor belt 
Cool Course: Whimsical Animations 
Web Serial API: Read from and write to a serial port
Music
Seahorse Dreams by Kubbi (Spotify)

News for the week of April 13, 2026: require(esm) marked stable in Node 24.15.0 LTS, HTML-in-Canvas demos, and Cal.com goes closed source thanks to AI security. From the community: dependency cooldowns are not a solution, TanStack's take on RSC, and accidentally DDOS'ing npm with TypeScript.
Sponsored by Excalibur.js
Excalibur.js is the free and open source friendly TypeScript 2D game engine for the web. Learn to make web games with TypeScript or JavaScript! Excalibur comes out-of-the-box with everything you need, like physics, sprites, animations, sound effects, and first-party plugins for popular 2D gamedev tools.
Homepage and Docs: https://excaliburjs.com
Make Your First Game in 10 Minutes
Join the Discord: https://discord.gg/9UemP985Uy

Chapters

(00:00) - Welcome to the Show

(06:03) - News: TSGo Cut 400 Hours a Month From CI Builds

(06:47) - News: Node 24.15.0 Marks require(esm) and Module Compile Cache Stable

(08:40) - News: See HTML-in-Canvas in Action

(11:19) - News: Everything Cloudflare Announced During Agents Week

(14:20) - News: Mozilla Takes Pot Shots at Microsoft on Copilot Rollback

(15:20) - News: Cal.com Goes Closed Source

(18:03) - Library Watch: Elide Runtime 1.0 Nightlies

(19:24) - Library Watch: Phaser 4 Game Engine Release

(20:07) - Library Watch: numpy-ts Now As Fast as Native NumPy

(20:50) - Library Watch: MavonEngine, a Three.js-based Multiplayer Game Engine

(22:34) - Library Watch: gql.tada, Types for GraphQL Queries

(26:02) - Highlight: State of Vue 2026 by Evan You

(26:31) - Highlight: Lessons from Building for the Bottom of the Browser by Mike Hall

(27:23) - Highlight: TanStack's Take on React Server Components

(29:21) - Highlight: aimock Helps TanStack Test Model Providers

(30:45) - Highlight: Dependency Cooldowns Make Us Free Riders by Cal Peterson

(32:49) - Highlight: How Ryan Cavanaugh Accidentally DDos'd npm

(33:31) - Bleet of the Week

(33:54) - Secret of the Handbook: accessor

(35:57) - Cool Watch: Garbage Time on Car YouTube

(37:07) - Cool Watch: How Ridiculous on YouTube

(38:00) - Cool Game: Indika, a Game Where You Play as a Russian Nun

(39:55) - The Minnesota Long Goodbye

News
TypeScript: TS 7 Native Preview saves team 400 hours a month
Node Release: Node.js 24.15.0 (LTS) 
HTML in Canvas HTML-in-Canvas .dev HTML In Canvas Is Wild And I Love It 
Cloudflare: Building the agentic cloud: everything we launched during Agents Week 2026 
Mozilla: Old habits die hard: Microsoft tries to limit our options, this time with AI 
Cal: Cal.com Goes Closed Source: Why AI Security Is Forcing Our Decision
Library Watch
Elide runtime stealthily releases 1.0.0 nightly and updates website
Phaser 4: New Renderer, GPU Sprites, Filters & More
numpy-ts is now as fast as native NumPy : r/typescript 
MavonEngine: Three.js game engine with an integrated server-authoritative physics engine
gql.tada: TS plugin for making type-safe GraphQL queries
From the Community
Evan You: State of Vue 2026
Mike Hall: Lessons from Building for the Bottom of the Browser
TanStack: React Server Components Your Way
TanStack: How We Test TanStack AI Across 7 Providers on Every PR 
Cal Peterson: Dependency cooldowns turn you into a free-rider
Ryan Cavanaugh: How I accidentally DDoS’d npm with TypeScript 
Bleet of the week
Secret of the Handbook: accessor keyword
Cool Links
Watch: Garbage Time on YT
Watch: How Ridiculous on YT
Play: INDIKA
Music
Seahorse Dreams by Kubbi (Spotify)