javascript

pnpm 11's release candidate ships minimumReleaseAge=1 day, blockExoticSubdeps, and strictDepBuilds as defaults, baking lessons from the March 2026 Trivy and axios attacks into the package manager itself.

Node.js 26 ships April 22 as the final release under the project's long-running odd/even cadence, with the Temporal API on track and a new annual LTS-for-all model beginning with Node.js 27.

Vercel's Next.js 16.2 delivers an 87 percent reduction in dev server startup time, up to 60 percent faster rendering via a React contribution, and introduces experimental tooling that gives AI coding agents direct access to browser DevTools and component trees from the terminal.

Vite 8.0 replaces its dual esbuild-and-Rollup architecture with Rolldown, a Rust-based bundler delivering 10-30x faster builds. Linear reports build times dropping from 46 to 6 seconds.

Microsoft released TypeScript 6.0 on March 23, the last version of the compiler written in JavaScript. The release introduces strict-by-default settings and deprecates legacy features ahead of TypeScript 7.0, a full Go rewrite that has shown up to 10x faster compilation in benchmarks.

Attackers hijacked the primary Axios maintainer's npm account and published two malicious versions that installed a cross-platform remote access trojan, exposing one of the JavaScript ecosystem's most downloaded packages.

Microsoft has released TypeScript 6.0, the final major version built on the original JavaScript compiler codebase. The release introduces sweeping default changes, deprecates legacy module formats, and adds a migration flag to prepare codebases for TypeScript 7.0, which will be built entirely in Go.

Vercel releases Next.js 16.2 with experimental AI agent tooling, a React contribution that speeds up Server Component rendering by up to 350 percent, Turbopack Server Fast Refresh, and over 200 bug fixes.

A dormant malicious script planted on Russian Wikipedia in 2024 was inadvertently activated during a Wikimedia security review, modifying thousands of pages and 85 user scripts before engineers locked down editing across all projects.

Deno 2.7 ships stable Temporal date/time API, official Windows ARM builds, npm overrides, and over 40 Node.js compatibility fixes in its February 25 release.

Node.js published versions 25.6.0, 25.6.1, and 25.7.0 across February 2026, advancing built-in SQLite to release-candidate status, extending Single Executable Applications to ESM entry points, and adding SIMD-accelerated text encoding.

Researchers say Git-sourced dependencies can re-enable code execution paths even when npm is run with --ignore-scripts, undermining a widely recommended mitigation after 2025’s Shai-Hulud worm.