David Bottiau

Oh, everything goes in circles...

[Pierre @pierrecomputer]

diffshub[dot]com

view any public diff, blazingly fast

[David Bottiau @dbottiau]

@lucasmeijer This. I still don't understand why this is not possible.

[TANSTACK @tan_stack]

SECURITY ADVISORY — TanStack npm packages
A supply-chain compromise affecting 42 @tanstack/* packages (84 versions total) was published to npm earlier today at approximately 19:20 and 19:26 UTC. Two malicious versions per package.
Status: ACTIVE — packages are deprecated, npm security engaged, publish path being shut down.
Severity: HIGH — payload exfiltrates AWS, GCP, Kubernetes, and Vault credentials, GitHub tokens, .npmrc contents, and SSH keys.
If you installed any @tanstack/* package between 19:20 and 19:30 UTC today, treat the host as potentially compromised:
• Rotate cloud, GitHub, and SSH credentials immediately
• Audit cloud audit logs for the last several hours
• Pin to a prior known-good version and reinstall from a clean lockfile
Detection — the malicious manifest contains:
"optionalDependencies": {
"@tanstack/setup": "github:tanstack/router#79ac49ee..."
}
Any version with this entry is compromised. The payload is delivered via a git-resolved optionalDependency whose prepare script runs router_init.js (~2.3 MB, smuggled into each tarball at the package root).
Unpublish is blocked by npm policy for most affected packages due to existing third-party dependents. All 84 versions are being deprecated with a SECURITY warning, and npm security has been engaged to pull tarballs at the registry level.
Full technical breakdown, complete package and version list, and rolling status updates:
https://t.co/Zy8qG7PA9f
Credit to the security researcher for responsible disclosure.

[TANSTACK @tan_stack]

We replaced our entire smoke-test suite with 147 deterministic E2E tests powered by aimock. 🧪

Every PR now verifies every feature across 7 LLM providers in about 2 minutes. No tokens burned. No flakiness. ✅

Here's how → https://t.co/TNLxHvS3Md

[azu @azu_re]

diffレンダリングとコード表示のライブラリ。
CSS GridとShadow DOMを活用してDOMノード数を削減しレンダリングの高速化やVirtualizationに対応している。
Stack型(統合表示)とSplit型(左右並列表示)の2つのレイアウトに対応し、S… "" https://t.co/fZsIVh7VlI

[TANSTACK @tan_stack]

You asked for TanStack skills, we built the whole pipeline.

Introducing @tan_stack Intent (alpha)

📦 Ship agent-readable "skills" inside npm packages
🔍 Auto-discovered from node_modules
🔄 Knowledge sync with npm update
📂 Distributed - skills live in library repo
🧩 Composable - mix core + framework-specific skills
🌐 npm, pnpm, bun, yarn, deno

No stale training data. Just npm install!

🔗 ⬇️🧵

[Evan You @evanyou]

It is my default way to check npm packages now

[Vanshika @vanyaSile]

Wait… Vite using 5173 because it spells VITE???

how did I never notice this until @Hiteshdotcom sir pointed it out

[TANSTACK @tan_stack]

We released a new TanStack library this week.

Introducing TanStack Hotkeys!

Setting up keyboard shortcuts is supposed to be easy and only take a few lines of code, right? Well, there are enough small "gotchas" that can eventually add up to an annoying amount of complexity.

[Scott Hanselman 🌮 @shanselman]

we open sourced it https://t.co/XRNHPt8EtK

[David Fowler @davidfowl]

👀👀👀

#aspire

[David Bottiau @dbottiau]

@lovelacecoding jj new

[Zed @zeddotdev]

🚀 We just shipped v0.215.0!

After 3 years and more than 1100 requests, it's finally here.
Rainbow brackets! 🌈
Enable it with the `colorize_brackets` language setting.

[VoidZero @voidzerodev]

Did you know that you can match against Standard Schemas in @vitest_dev?

With the major release of Vitest 4, this is possible now!

No matter if you want to match your whole data or only partials against a schema, and no matter which validation library is used - as long as they support Standard Schema.

[athas.dev @athasdev]

You can use any code editor inside Athas now!

You wanna use Athas, but don't want the editor? Just select your favorite editor.

You can use Athas' features like git, AI, image editing, databases; and still continue using Neovim, Helix, etc. inside of Athas.

[David Fowler @davidfowl]

Really excited to share the hard work the team is working on. The next version of aspire has some big changes coming, not just for .NET but python and JavaScript. It's early but follow us as we take the YAML out of devops.

https://t.co/3BTxhJ1WoF

#aspire @aspiredotdev

[Alem Tuzlak 🇧🇦 @AlemTuzlak]

The @tan_stack form devtools are here!!! 🔥🎊

New addition to the TanStack devtools family is finally out! 🚀

Debug your forms like never before! 🤖

Check out the docs how to add them to your project here:
https://t.co/qIcoEAIRp0

[Ben {chmark} Adams ⟠ @ben_a_adams]

The .NET 10 performance blog post has landed

A monster of a read again from @stephentoub !

https://t.co/cT0aZqhDSG

[David Bottiau @dbottiau]

@jarredsumner Also, not mentioned but when the flag it is not present and it fails, a small message explaining why it exists and how to properly publish package.

[David Bottiau @dbottiau]

@jarredsumner Could be great if other package managers could do this but if bun does this, that's a good start.