https://github.com/sxzz • 🏳️‍🌈 Gen Z • indie OSS developer sponsored by @voidzero.dev @vuejs.org @vite.dev @vue-macros.dev @vueuse.org @unjs.io @rolldown.rs elk.zone More at https://sxzz.dev/https://bsky.app/profile/sxzz.devhttps://bsky.app/profile/sxzz.dev/post/3msy6qzhpmk2bChangesets is using tsdown [contains quote post or other embedded content]13 Aug 2026 17:39 +0000at://did:plc:llafowfaldxtb7w7p4oca337/app.bsky.feed.post/3msy6qzhpmk2bhttps://bsky.app/profile/sxzz.dev/post/3msfkwz56a22pJust like this is Johnson’s project, he can do whatever he wants. After using such disrespectful language toward someone (regardless of where), I thought you knew you could always directly fork an OSS project instead of impotently raging like an asshole. No community welcomes you. [contains quote post or other embedded content]06 Aug 2026 07:56 +0000at://did:plc:llafowfaldxtb7w7p4oca337/app.bsky.feed.post/3msfkwz56a22phttps://bsky.app/profile/sxzz.dev/post/3msd333luxs2wTIL: Domains like .dev, .app are required to use HTTPS.05 Aug 2026 08:07 +0000at://did:plc:llafowfaldxtb7w7p4oca337/app.bsky.feed.post/3msd333luxs2whttps://bsky.app/profile/sxzz.dev/post/3mrl2lm27ik2o❯ pnpm run release && claude --dangerously-skip-permissions /review-npm-stage https://github.com/sxzz/review-npm-stage26 Jul 2026 18:54 +0000at://did:plc:llafowfaldxtb7w7p4oca337/app.bsky.feed.post/3mrl2lm27ik2ohttps://bsky.app/profile/sxzz.dev/post/3mrcnzmcfsk2wGlad to help move the ecosystem toward: - ESM-only - TypeScript - OIDC + staged publishing - Runtime-agnostic design wherever possible - No bundled deps unless needed - Like-minded dependencies I’ve replaced `debug` and `semver` with `obug` and `verkit`. What’s next? 🤔 [contains quote post or other embedded content]23 Jul 2026 10:48 +0000at://did:plc:llafowfaldxtb7w7p4oca337/app.bsky.feed.post/3mrcnzmcfsk2whttps://bsky.app/profile/sxzz.dev/post/3mr6tnr2ipk24The tsdown ecosystem, visualized ✨ Each circle = a project owner using tsdown, sized by GitHub stars. 873 projects over 100 stars and counting. Grateful to everyone shipping with it.21 Jul 2026 22:18 +0000at://did:plc:llafowfaldxtb7w7p4oca337/app.bsky.feed.post/3mr6tnr2ipk24https://bsky.app/profile/sxzz.dev/post/3mqrpfj5sd22zVolar now has first-class support in tsdown and rolldown-plugin-dts. It can generate `.d.ts` files for all file types supported by Volar, including Vue and Astro. https://github.com/sxzz/rolldown-plugin-dts/commit/7cb4ee8fd19b71e88e712f596d0b40476bfe235916 Jul 2026 16:57 +0000at://did:plc:llafowfaldxtb7w7p4oca337/app.bsky.feed.post/3mqrpfj5sd22zhttps://bsky.app/profile/sxzz.dev/post/3mqqzl6ppgs2n🎉 magic-string is now fully migrated to pure ESM and TypeScript, and its long-awaited v1.0 release is finally here! https://github.com/Rich-Harris/magic-string/pull/31016 Jul 2026 10:27 +0000at://did:plc:llafowfaldxtb7w7p4oca337/app.bsky.feed.post/3mqqzl6ppgs2nhttps://bsky.app/profile/sxzz.dev/post/3mqhctdiqpk2m⚡ After `rolldown-plugin-dts` migrated Babel toolchain to yuku, tsdown has cut ~5 MB from its install size and is now smaller than tsup. ❤️ Huge thanks to arshad-yaseen for the help!12 Jul 2026 13:46 +0000at://did:plc:llafowfaldxtb7w7p4oca337/app.bsky.feed.post/3mqhctdiqpk2mhttps://bsky.app/profile/sxzz.dev/post/3mq4n6a7wbk2ni am cool [contains quote post or other embedded content]08 Jul 2026 07:52 +0000at://did:plc:llafowfaldxtb7w7p4oca337/app.bsky.feed.post/3mq4n6a7wbk2nhttps://bsky.app/profile/sxzz.dev/post/3mpyqpknloc2jtsdown #1000 issue https://github.com/rolldown/tsdown/issues/100006 Jul 2026 18:44 +0000at://did:plc:llafowfaldxtb7w7p4oca337/app.bsky.feed.post/3mpyqpknloc2jhttps://bsky.app/profile/sxzz.dev/post/3mnx7qlcg6c2rI deployed an instance at registry.regesta.dev If anyone is interested, I can invite you to the GitHub repo! [contains quote post or other embedded content]10 Jun 2026 17:18 +0000at://did:plc:llafowfaldxtb7w7p4oca337/app.bsky.feed.post/3mnx7qlcg6c2rhttps://bsky.app/profile/sxzz.dev/post/3mnuqszaxhk2mI’m designing a transparent, ecosystem-neutral package registry. Content-addressed releases, append-only events, mirrorable state, and projections for npm/PyPI/Cargo/Go/OCI. Feedback welcome: regesta.dev https://regesta.dev/09 Jun 2026 17:45 +0000at://did:plc:llafowfaldxtb7w7p4oca337/app.bsky.feed.post/3mnuqszaxhk2mhttps://bsky.app/profile/sxzz.dev/post/3mnhqvlaw2c2kI now own VoidZero.04 Jun 2026 13:42 +0000at://did:plc:llafowfaldxtb7w7p4oca337/app.bsky.feed.post/3mnhqvlaw2c2khttps://bsky.app/profile/sxzz.dev/post/3mnhpz7ukxk2jI'm designing and creating a new registry04 Jun 2026 13:26 +0000at://did:plc:llafowfaldxtb7w7p4oca337/app.bsky.feed.post/3mnhpz7ukxk2jhttps://bsky.app/profile/sxzz.dev/post/3mmxsfgwsbk2mIt’s been really encouraging to see tsdown adopted by companies like @vercel.com and @cloudflare.social, as well as open-source projects like OpenClaw and LobeHub. If tsdown has been useful to you or your project, please consider sponsoring my work ❤️ https://github.com/rolldown/tsdown/discussions/14329 May 2026 05:26 +0000at://did:plc:llafowfaldxtb7w7p4oca337/app.bsky.feed.post/3mmxsfgwsbk2mhttps://bsky.app/profile/sxzz.dev/post/3mmrfw3lsms2qnpm increasingly feels like a zombie org under GitHub. As someone who's been around the JS ecosystem and part of multiple OSS orgs for years, what I'm seeing isn't just "big co moves slow." It's quiet neglect of critical infrastructure the entire JS world runs on. A short thread 🧵26 May 2026 16:27 +0000at://did:plc:llafowfaldxtb7w7p4oca337/app.bsky.feed.post/3mmrfw3lsms2qhttps://bsky.app/profile/sxzz.dev/post/3mmmhfq54e22rPSA: the safest way to publish an npm package today is staged publish + OIDC + provenance. "But it can't stop every attack." Sure, and seatbelts don't prevent every injury either. We still wear them. Security is layers, not silver bullets.24 May 2026 17:10 +0000at://did:plc:llafowfaldxtb7w7p4oca337/app.bsky.feed.post/3mmmhfq54e22rhttps://bsky.app/profile/sxzz.dev/post/3mmlbr2m3nk24Heads up: npm's stage publish still has an unresolved issue. Toolchains can't tell if a package was published via trusted publishing once it's staged, so tools like pnpm end up showing false security downgrade warnings. https://github.com/pnpm/pnpm/issues/11887 [contains quote post or other embedded content]24 May 2026 05:56 +0000at://did:plc:llafowfaldxtb7w7p4oca337/app.bsky.feed.post/3mmlbr2m3nk24https://bsky.app/profile/sxzz.dev/post/3mmk3kikzqc2vThe first high-impact package for staged publishing has arrived: tinyexec! @43081j.com [contains quote post or other embedded content]23 May 2026 18:33 +0000at://did:plc:llafowfaldxtb7w7p4oca337/app.bsky.feed.post/3mmk3kikzqc2vhttps://bsky.app/profile/sxzz.dev/post/3mmip6if5os2zTracking npm provenance adoption across the top ~15k high-impact packages. Now with daily trend data 📈 Since Aug 2025: • Trusted Publisher: 0.55% → 16.69% • Provenance: 6.96% → 3.14% • Untrusted: 92.49% → 80.17% Trusted Publisher adoption is climbing fast! https://github.com/sxzz/npm-top-provenance23 May 2026 05:19 +0000at://did:plc:llafowfaldxtb7w7p4oca337/app.bsky.feed.post/3mmip6if5os2z