Luca Casonato 🏳️‍🌈

Software person. Working at @railway. Prev built @jsr_io and @deno_land. Creator of Fresh. @tc39 delegate. he/him 🏳️‍🌈🌍🌻💚

[Luca Casonato 🏳️‍🌈 @lcasdev]

More relevant than ever: you can find my other social profiles on my website: https://t.co/lkKfiz5Eqy. I hope to see many of your there soon!

(no direct links because the almighty overlord blocks them now)

[Luca Casonato 🏳️‍🌈 @lcasdev]

@lagent213 @plbiojout i literally wrote that message hahaa

[Luca Casonato 🏳️‍🌈 @lcasdev]

@dcolascione @victormustar You can not. It can only be sent in headers to specific domains that are in the allow list for the given env.

[Luca Casonato 🏳️‍🌈 @lcasdev]

@DavidSherret @elvecent_not @liran_tal @deno_land And for every fetched source file, the hash is in the meta file (so you can verify those using that hash)

[Luca Casonato 🏳️‍🌈 @lcasdev]

@liran_tal @deno_land I honestly find it rude that you think we are this stupid. The secret is not inside the VM. It is injected using a MitM proxy that sits outside the VM based on the SNI of the outgoing request

Also it takes literally 30 seconds for you to verify whether this works before tweeting

[Luca Casonato 🏳️‍🌈 @lcasdev]

@aloo @rough__sea Yes, that's the plan

[Luca Casonato 🏳️‍🌈 @lcasdev]

I am very proud of the team for the runtime level mitigation we rolled out to @deno_land Deploy for this. It's very precise, very fast, and way less prone to false positives than a WAF based block.

All React reversions are safe when running on Deno Deploy. Vertical integration!

[React @reactjs]

There is critical vulnerability in React Server Components disclosed as CVE-2025-55182 that impacts React 19 and frameworks that use it.

A fix has been published in React versions 19.0.1, 19.1.2, and 19.2.1. We recommend upgrading immediately.

https://t.co/kue7kd0XEX

[Luca Casonato 🏳️‍🌈 @lcasdev]

@MFrancis107 @deno_land That's odd - `deno run --tunnel` uses QUIC. Can you figure out whether your network is blocking that somehow? One thing you can try is going to https://t.co/ig9IqdAKJU and then reloading after first load.

[Luca Casonato 🏳️‍🌈 @lcasdev]

@MFrancis107 @deno_land Are you behind some corporate proxy? If you visit https://t.co/ydM44dwoJU, what TLS certificate do you get served?

[Luca Casonato 🏳️‍🌈 @lcasdev]

@MFrancis107 @deno_land That works!

[Luca Casonato 🏳️‍🌈 @lcasdev]

@katsuba_igor @deno_land @mastra @langfuse That already works. Instructions are on this page (see otel endpoint section) https://t.co/H07q5nouc0

[Luca Casonato 🏳️‍🌈 @lcasdev]

@zkochan @pnpmjs @deno_land I already commented on it in a couple of places 👍

(I work on JSR at Deno)

[Luca Casonato 🏳️‍🌈 @lcasdev]

@slicknet What specifically isn’t working for you? We are standardizing the behavior in WinterTC right now - would you like to join the calls?

[OpenAI Developers @OpenAIDevs]

We've published our official JavaScript SDK on @jsr_io. In Deno, we can use web standard interfaces like WebSocket on the server, as in this example with the Realtime API. Let us know what you think! 🦕

[Luca Casonato 🏳️‍🌈 @lcasdev]

Full transparency: someone from both @ncsc_nl and the incident response team from @Logius_minbzk reached out to me and are working on resolution. The system does work after all - report issues folks!

And thanks folks :)

[Luca Casonato 🏳️‍🌈 @lcasdev]

I sent a CVD report to @ncsc_nl's CERT, and they are being wholly unhelpful. Do I know anyone that works on DigiD or other cyber security stuff at @Rijksoverheid? Is there a report channel for DigiD directly that bypasses NCSC?

[Luca Casonato 🏳️‍🌈 @lcasdev]

@initjean @ncsc_nl @Rijksoverheid @0xDUDE @DIVDnl Oh journalists would be great - can you dm me their names?

[Luca Casonato 🏳️‍🌈 @lcasdev]

I sent a CVD report to @ncsc_nl's CERT, and they are being wholly unhelpful. Do I know anyone that works on DigiD or other cyber security stuff at @Rijksoverheid? Is there a report channel for DigiD directly that bypasses NCSC?

[Luca Casonato 🏳️‍🌈 @lcasdev]

@ncsc_nl @Rijksoverheid @DigiDwebcare

[Luca Casonato 🏳️‍🌈 @lcasdev]

@kettanaito @okikio_dev Undici does not support the “pass a generator function” thing. It honestly doesn’t even make sense - just invoke it and you have a async iterable?

[Deno @deno_land]

It's done. Now it’s your turn, @Oracle.

We’ve submitted a formal petition to cancel the JavaScript trademark: it is generic, Oracle has abandoned it, and Oracle committed fraud on the USPTO during the last trademark renewal.

Oracle has until January 4th to respond, or the case will go into default, which will result in the trademark being canceled.

It's time to #FreeJavaScript.

https://t.co/fBYOIBMOIf