TypeScript.fm - The Friendly Show for TypeScript Developers

News for the week of October 12, 2026: the internet is on fire with major security issues from a compromised CA to critical PHP vulnerabilities and remote code execution in Node.js! But at least TypeScript 7.1 beta is out, along with tsrs, a Rust port from oxc team. From the community: a game to help you create a mental model of memory mapping, which new image format is best for the web, and an interview with Daniel Rosenwasser on what comes after TS 7.
Sponsored by Excalibur.js
Excalibur.js is the free and open source friendly TypeScript 2D game engine for the web. Learn to make web games with TypeScript or JavaScript! Excalibur comes out-of-the-box with everything you need, like physics, sprites, animations, sound effects, and first-party plugins for popular 2D gamedev tools.
Homepage and Docs: https://excaliburjs.com
Make Your First Game in 10 Minutes
Join the Discord: https://discord.gg/9UemP985Uy

Chapters

(00:00) - Security: eMudhra CA Compromise Allows TLS Impersonation

(04:10) - Security: Node.js High CVE for Remote Code Execution

(05:53) - Security: PHP2Shell, Critical PHP Vulnerability

(07:45) - Security: Socket for Origin Version Control Released

(08:51) - Security: What Just Happened?

(11:37) - Tooling: TypeScript 7.1 Beta

(19:22) - Tooling: tsrs, Cloudflare's Port of TypeScript 7 to Rust

(23:28) - Tooling: tsc-ts, Porting TypeScript to TypeScript (with a C Runtime)

(24:20) - Tooling: tsc-dotnet, Experimental TypeScript Port to C#

(26:36) - Tooling: Bun Working on AOT Compilation?

(29:45) - Tooling: Elide the Polyglot Runtime is Now Stable

(32:00) - Frameworks: Astro 7.4 Features New Timings Flag for Build

(32:40) - Frameworks: TanStack Start 1.0 is Stable

(33:40) - Frameworks: Snapfire, TypeScript Web Apps Served in Rust

(37:32) - Web Platform: Firefox 158 Now Supports JPEG XL

(37:52) - Library Watch: Nuclo, Fast Lightweight DOM Updates

(39:01) - Library Watch: OpenWorkflow, an OSS Alternative to Temporal

(41:06) - Library Watch: ts-rs, Generate TypeScript Bindings from Rust Types

(42:14) - Library Watch: tmcp, a Batteries-included Alternative to Official TypeScript MCP SDK

(44:14) - Community Highlights: TypeScript Memory Mapper Game

(45:41) - Community: The Register Interviews Ryan Dahl on Deno Joining Cloudflare

(47:42) - Community: Josh Goldberg Interviews Daniel Rosenwasser on Software Engineering Daily

(48:10) - Community: Filip Sodic on Why Types Are Worth Typing

(49:26) - Community: Node Banter on Shipping TS Source in npm

(52:30) - Community: Isaac Levin Writes About Building an RSS Reader in TS

(53:13) - Community: Next.js on Improving Navigation Experience in v0

(54:02) - Community: Jake Archibald on JPEG XL vs. AVIF for Web Use Cases

(56:47) - Bleet of the Week

(57:12) - Cool Link: Breadboard Clock Series

(58:09) - Cool Link: Teal, Statically Typed Dialect of Lua

(58:33) - Cool Link: The Decoherence Trap by Maevyn.codes

(01:02:13) - The Minnesota Long Goodbye

SecurityNode.js October 2026 Security Updates
CERT-EU - Critical Vulnerabilities in PHP 
The Internet goes on high alert after discovery of 8 compromised TLS certs - Ars Technica Informal advisory and diagnostics: https://emudhra.we-have-a-problem.com/

Socket for Origin Now Available 
Tooling
Announcing TypeScript 7.1 Beta  
Introducing tsrs: a Port of TypeScript to Rust
tsc-ts: TypeScript in TypeScript, compiles using scriptc
typescript-dotnet: Experimental port of TS 7 to C# (via Reddit)
Bun AOT in the works
Elide: 1.6.0 Changelog
Frameworks
Astro 7.4 
TanStack Start 1.0 is Stable 
SnapFire: Write TypeScript, served in Rust
Library Watch
Nuclo: fast lightweight DOM framework for updates
OpenWorkflow: OSS workflow engine alternative to Temporal
ts-rs: TS Bindings from Rust Types (via Mike)
tmcp: build opinionated TypeScript MCP servers (via Paolo)

From the Community
Prescod: TypeScript Memory Mapper Game (Free) 
The Register: Interview with Ryan Dahl about Deno + Cloudflare
Software Engineering Daily: TypeScript 7 and What Comes Next (Josh Goldberg & Daniel Rosenwasser)
Filip Sodic: Types Are Worth Typing
Nodeland: Don’t Ship the Source (TypeScript), listen to the podcast episode
Isaac Levin: Building an RSS Reader in TypeScript
Next.js: Improving navigation experience in v0 with Next.js 16.4 
Jake Archibald: JPEG XL vs AVIF for web use-cases 
Bleet of the Week
Cool Links
Setting the time on my breadboard clock: Breadboard clock part 5 
Statically Typed Lua 
Ma...

News for the week of October 5, 2026: Theo spends $420,000+ porting the TypeScript compiler to Rust, the new Bun (type)check command claims 3-7x speedups, and Deno joins Cloudflare. From the community: ViteConf is October 15, GitHub moves off CSS-in-JS, and Syntax is donating.
Sponsored by Excalibur.js
Excalibur.js is the free and open source friendly TypeScript 2D game engine for the web. Learn to make web games with TypeScript or JavaScript! Excalibur comes out-of-the-box with everything you need, like physics, sprites, animations, sound effects, and first-party plugins for popular 2D gamedev tools.
Homepage and Docs: https://excaliburjs.com
Make Your First Game in 10 Minutes
Join the Discord: https://discord.gg/9UemP985Uy

Chapters

(00:00) - Tooling: ts-rust, a Vibe Port of TypeScript 7 to Rust

(06:03) - Tooling: bun check, 2-7X Faster Type Checking in Bun 1.4.3

(10:07) - Tooling: bun Adds lint and format Commands, Forking oxlint and oxfmt

(11:27) - Tooling: terser Adds Erasable Types Support

(13:17) - Tooling: Node.js 26.11.0, New Docs and Benchmarking Perf Hooks

(15:22) - Frameworks: Next.js 16.4 Adds Cache Components Programming Model

(19:21) - Web Platform: Deno Joins Cloudflare, But Will No Longer Maintain the Runtime

(24:24) - Web Platform: Chrome 155+ Will Support JPEG XL

(26:12) - Security: Vite Dev Server CVE for Arbitrary Command Execution

(27:41) - Security: TanStack Start CVE for Reflected Cross-site Scripting

(28:37) - Security: zod and Other Packages Were Nearly Compromised

(30:38) - Security: New GhostAction Wave Steals Cloud and AI Credentials

(32:50) - Other News: Remembering Margaret Hamilton, Apollo Space Programmer

(33:14) - Library Watch: maligator, an AOT Compiler for JavaScript to C

(34:24) - Library Watch: fjson, a Friendly JSON-alike Language and Parser

(35:10) - Library Watch: logtape 2.4

(36:23) - Library Watch: plumeria, Type-safe Zero-runtime Atomic CSS

(37:02) - Community: ViteConf is October 15

(37:26) - Community: Syntax.fm Calling for Nominations to Fund OSS Maintainers

(37:48) - Community: GitHub is Switching from CSS-in-JS to CSS Modules

(40:13) - Community: Mark Built a JavaScript Runtime Over the Weekend Called Bento

(41:48) - Community: Grafana's Cuetsy and Thema TypeScript Code Generation

(42:26) - Bleet of the Week

(43:11) - Cool Event: Ludum Dare, Make a Game in 48 Hours

(44:02) - Cool Study: Where is the Bottleneck in Software Development and AI?

(45:46) - Cool Tool: TypeScript to Zod Schema Tool (and More!)

(46:40) - Cool Link: ascii.rest, Animated ASCII Art for Web Pages

(48:22) - The Minnesota Long Goodbye

News
ToolingTheo: ts-rust
Bun: Bun 1.4.3
Terser: Experimental type erasure (via Rob Palmer)

MetaframeworksNext.js: Next.js 16.4

Web PlatformCloudflare: Deno joins Cloudflare
Node: Node.js 26.11.0 (Current)
Chrome: Shipping JPEG XL in Chrome (155+)

Security CornerVoidZero: Vite Dev Server security update
TanStack: TanStack Start security update: CVE-2026-102989
Zod: Security advisory: malicious npm package changes affecting zod, nub, and standard-schema
Socket: New GhostAction Wave Hits Hundreds of Repos, Expanding Beyond CI/CD Secrets to Cloud Credentials

Other newsMIT News: Margaret Hamilton, computing pioneer, dies

Library Watch
Maligator: JS AOT to C compiler (GitHub)
fjson from Cinnamon: friendly JSON parser for TypeScript
LogTape: LogTape 2.4.0
Plumeria: type-safe CSS with a Rust compiler
From the Community
VoidZero: ViteConf is October 15th
Syntax.fm: Syntax is donating
GitHub: Switches from CSS-in-JS
Mark Malstrom: Bento, a JS runtime in a weekend
Sam Boyer: Grafana's schema-driven data language: Cuetsy and Thema (via Evangaline Rome)
Bleet of the Week: “Cloudflare” Meteor
Cool Links
Artificial Intelligence in the Firm: Bottlenecks in Software Production
TypeScript to Zod Schema
ASCII Rest
Music
Seahorse Dreams by Kubbi (Spotify)

News for the weeks of September 21 and 28, 2026: Vite+ 1.0 is now stable, SvelteKit 3 is finally here, TanStack has charts now, and why everyone is launching decision models. From the community: awesome TypeScript books, why you shouldn't be afraid of generics, and how Booking.com cut Node scaling costs by 38%.
Sponsored by Excalibur.js
Excalibur.js is the free and open source friendly TypeScript 2D game engine for the web. Learn to make web games with TypeScript or JavaScript! Excalibur comes out-of-the-box with everything you need, like physics, sprites, animations, sound effects, and first-party plugins for popular 2D gamedev tools.
Homepage and Docs: https://excaliburjs.com
Make Your First Game in 10 Minutes
Join the Discord: https://discord.gg/9UemP985Uy

Chapters

(00:00) - Tooling: Vite+ 1.0 Stable Announced

(05:58) - Tooling: Introducing upm, a New Package Manager

(09:42) - Tooling: TanStack Charts 1.0 Announced

(12:08) - Metaframeworks: SvelteKit 3 is Here

(13:38) - Framework: Nuxt 4.6 Brings Nuxt CLI v4 and is Closer to Being Server Agnostic

(18:26) - Web Platform: ECMAScript Composites TC39 Proposal

(21:56) - Web Platform: Cloudflare Open Sources cf CLI and Forge

(25:40) - Web Platform: Cloudflare Introduces Clef, an Open Weights Decision Model

(30:41) - Web Platform: Chrome 154, Responsive iframes

(31:49) - Web Platform: Firefox 157's Fresh Design

(33:03) - Security: Next.js September 2026 Patches Available

(33:46) - Library Watch: Preact 11 - ESM-only, Hydration v2, Modern Diffing

(35:43) - Library Watch: Effect Module of the Week, RcMap

(36:35) - Library Watch: mimlet 0.1 for Testing with Mock Data

(37:33) - Library Watch: oxbox, a Tiny Portable Library for Parsing, Transforming JSX/TSX

(37:53) - Library Watch: safemods, Type-directed Code Mods for TS 7

(39:49) - Library Watch: GTKX, Linux desktop apps with React and JSX

(41:20) - Secret of the Handbook: Const Generics (Again)

(42:52) - Community: Angular's TypeScript 7-powered Compiler

(45:54) - Community: Josh Ghoulberg is Excited About no-unsafe-enum-assignments TS ESLint Rule

(47:02) - Community: Awesome TypeScript Books by tscollege

(48:19) - Community: Max Hurst Reassures Us Not to Be Afraid of Generics

(49:47) - Community: Dan Holloran on How to Clean Up Your TSConfig for TS7

(50:32) - Community: Rahul's Readable Regular Expressions Inspired by Emacs

(53:13) - Community: Razvan's Glossary of Programming Terms

(54:05) - Community: How Booking.com Scales Node.js and Cut Costs by 38%

(58:06) - Community: NOMIAD, an Open World Sci-Fi Game Written in WebGL and TypeScript

(59:05) - Community: Claude Mods Customize Your Clanker

(01:00:24) - Community: dsherret's TypeScript Factory Code Generator Generator

(01:01:18) - Community: Kris Jenkins Used SpaceTimeDB to Visualize Wikipedia Edits

(01:02:14) - Bleet of the Week

(01:02:49) - Cool Link: How to Render Text from Font Files by Jimmy Lefevre

(01:03:59) - Cool Prompt: Create a Trip Highlight Video

(01:10:02) - The Minnesota Long Goodbye

News
VoidZero: Announcing Vite+ 1.0Plus: ViteConf 2026 (October 15)

Socket: Introducing upm 
TanStack: TanStack Charts 1.0 announced 
SvelteKit: SvelteKit 3 is here 
Nuxt: Nuxt 4.6 
ECMAScript: TC39 Composites via Rob
Cloudflare: Open-sourcing cf and Forge
Cloudflare: Introducing Clef: our open-source decision models, and new RL fine-tuning platformRelated: AWS launches a local answer to TypeSafe's Jev decision model

Chrome: New in Chrome 154 
Mozilla: Firefox 157.0, See All New Features, Updates and Fixes 
Next.js: September 2026 Security Release 
Library Watch
Preact 11: Post by @jovidecroock.com
Effect.ts Module of the Week: RcMap
Mimlet 0.1.0-beta.0: create mock test data
Safemods: type-directed code mods for TypeScript 7
GTKX: native Linux desktop apps with React
From the Community
Angular Team: An update on Angular’s TypeScript 7-powered Compiler 
Josh Goldberg: typescript-eslint finally gets "no-unsafe-enum-assignments"
TScollege: Awesome TypeScript Books 
Max Hurst: Do Not Be Afraid of Generics 
Dan Halloran: Your tsconfig Is Still Written for TypeScript 5. Here's the Cleanup TS 7 Forces
Rahul M. Juliato: Readable Regular Expressions for JavaScript/TypeScript, Inspired by Emacs' rx
Razvan Muntian: a programming glossary
Booking.com: Node.js at scale, rebalanced: how we cut cost by 38%
NOMIAD: an open-world sci-fi game in WebGL written in TypeScript
Anthropic: Customize Claude Code with mods in TypeScript
David Sherret: TypeScript Compiler API Factory Code Generator Generator (via Evangaline Rome)
Kris Jenkins: SpaceTimeDB w/ TypeScript
Bleet of the Week

In this special episode, the two fools are joined by Cameron Clark and Jim Dummett from VoidZero (and now, Cloudflare) to talk about the latest developments in type-aware linting, Vite+ and the Vite ecosystem, and what the future of dev tooling looks like for TypeScript and JavaScript developers.
Sponsored by Excalibur.js
Excalibur.js is the free and open source friendly TypeScript 2D game engine for the web. Learn to make web games with TypeScript or JavaScript! Excalibur comes out-of-the-box with everything you need, like physics, sprites, animations, sound effects, and first-party plugins for popular 2D gamedev tools.
Homepage and Docs: https://excaliburjs.com
Make Your First Game in 10 Minutes
Join the Discord: https://discord.gg/9UemP985Uy

Chapters

(00:00) - Introducing Cameron Clark and Jim Dummett

(04:55) - The VoidZero Acqui-hire

(11:47) - The Vite Toolchain

(16:04) - What Dark Magic Makes TypeScript Plugins Work with oxlint?

(23:42) - Type-aware Linting via Oxlint and TypeScript 7

(27:02) - Type-aware Linting is Now Stable, What Does That Mean?

(29:39) - Does TypeScript 7's Performance Unlock New Kinds of Lint Rules?

(33:13) - What is Coming Next to Dev Tooling?

(37:29) - How Can Dev Tools Help Optimize Agent Interactions?

(50:42) - Takeaways and Where to Follow Jim and Cameron

(57:09) - The Minnesota Long Goodbye

LinksCameron on GitHub
Jim's talk on oxc and type-aware linting
Vite+ (and 1.0 announcement)
Void Cloud
VoidZero Blog
oxlint plugin: anti-slop
Music
Seahorse Dreams by Kubbi (Spotify)

News for the week of Sep 14, 2026: latest Node 26 includes experimental benchmark tests, a modern drop-in replacement for DOM typings, and we try to understand Jev, bruv. From the community: how GitHub rewrote Copilot's runtime in Rust, learn about ESM, and why Shopify ditched React Native (spoiler: agents).
Sponsored by Excalibur.js
Excalibur.js is the free and open source friendly TypeScript 2D game engine for the web. Learn to make web games with TypeScript or JavaScript! Excalibur comes out-of-the-box with everything you need, like physics, sprites, animations, sound effects, and first-party plugins for popular 2D gamedev tools.
Homepage and Docs: https://excaliburjs.com
Make Your First Game in 10 Minutes
Join the Discord: https://discord.gg/9UemP985Uy

Chapters

(00:00) - Welcome to the Show

(06:02) - Tooling: Node 26.9.0 Lets You Write Benchmarks with node:bench

(08:49) - Tooling: Jev, the Type-safe AI

(15:25) - Tooling: TypeScript 7 Works Around New Golang FMA Changes

(17:58) - Frameworks: GeaStack Compiles Typescript to Native Apps with C++

(20:00) - Frameworks: Ember 7.2, New Built-in Strict Resolver and ESM-only

(20:46) - Web Platform: Firefox 156, Can Now Open Automatically on macos

(21:21) - Security: Happy Birthday Shai-Hulud!

(22:17) - Security: GitHub Actions Tries to Limit Cache Poisoning Risk

(23:47) - Security: Gitea Affected by Severe RCE Vulnerability

(24:47) - Library Watch: modern-web-types Drop-in Replacement for DOM Typings

(26:52) - Library Watch: sqlbraid Lets You Write SQL and Keep TypeScript

(29:28) - Library Watch: temporal-parser, a Lexer and Parser for Temporal Expressions

(31:06) - Library Watch: Zod 4.6 Comes With Some Perf Improvements

(32:26) - Community: Puffball Explains How TypeScript 7 Creates Typed ASTs in Go

(33:44) - Community: ESModule.com, Learn About ES Modules

(34:47) - Community: cm.xyz Explains Why You'd Use Effect

(36:27) - Community: Porffor Can Compile TSC

(37:34) - Community: Stephen Toub on How GitHub Rewrote Copilot Runtime in Rust, with Copilot

(42:29) - Community: ecyrbe Creates Typeskell to Experiment with Typeclasses

(42:52) - Community: Barak's Complete Guide to HOCs with Next.js, React, and TS

(43:53) - Community: Orhun Interviews Sebastian from OpenTUI

(44:34) - Community: Shopify Switched Back to Swift and Kotlin from React Native

(48:07) - Bleet of the Week

(49:31) - Cool Link: Design Your Own Silicon Chip

(50:41) - Cool Link: The Essential Craftsman

(53:10) - The Minnesota Long Goodbye

News
Node: 26.9.0
Syntax:  Jev Explained: Demos and Use Cases 
Jake Bailey: Go FMA’s introduce non-determinism
Geastack compiles TypeScript to native apps via C++
Ember: 7.2 released
Firefox: Firefox 156.0 release 
Socket: Happy Birthday, Shai-Hulud 
GitHub: Control GitHub Actions cache access with cache-mode 
Gitea RCE Vulnerability: Ed from Low Level's update on git situation 
Library Watch
modern-web-types is a drop-in replacement for dom typings with modern APIs
Clickin/SQLBraid: Write SQL. Keep TypeScript. Skip the query-builder translation layer 
taskade/temporal-parser: A lexer and parser for temporal expressions
Zod 4.6 perf fixes and Zod Mini standalone
From the Community
iamstan.dev: ES Modules via James
Puffball: Inside TypeScript 7's Go Port: Designing Typed AST Nodes Without a Giant Struct
cm.xyz: Understanding Why You'd Use Effect.ts 
Porffor: TSC compiled with Porffor
Stephen Toub: Migrating the GitHub Copilot runtime to Rust, using Copilot
Typeskell is a cursed project
Burak.dev: The Complete Guide to HOCs in Next.js with React and TypeScript 
Interview with OpenTUI https://bsky.app/profile/orhun.dev/post/3mvlg6qrwls2u 
Shopify: Native is now the future of mobile at Shopify 
Bleet of the WeekXKCD comic: guaranteed to be random

Cool Links
Designing Silicon From Scratch 
Dr.Semiconductor - YouTube 
Essential Craftsman – absolute gold carpentry tips
Music
Seahorse Dreams by Kubbi (Spotify)