#tooling

An open bug filed against Claude Code on 2026-07-04 by an [Enterprise ZDR](https://docs.anthropic.com/en/docs/build-with-claude/zero-data-retention) user describes a working session on Sonnet 5 that suddenly starts referencing an unrelated Minecraft temple build, then doubles down on the wrong task in its recap. The reporter (GitHub: [@milesrichardson-edb](https://github.com/milesrichardson-edb), issue [anthropics/claude-code#74066](https://github.com/anthropics/claude-code/issues/74066)) is on Enterprise Zero Data Retention, the tier Anthropic specifically advertises as session-isolated. Triage on the reporter's local session JSONL at `~/.claude/projects/<encoded-cwd>/<session-id>.jsonl` finds the leaked text is not in the transcript, ruling out a local context bleed by file overlap. Four other users in the comments (with work histories going back to last year) describe near-identical behavior across Claude Code, Claude Mobile, and Claude deep research. The most plausible architectural fit is shared KV-cache state in inference ([per @yv3nne in the comments](https://github.com/anthropics/claude-code/issues/74066#issuecomment-4880448776)), but no Anthropic engineer has commented on the issue in the 22 hours since it was filed, and the issue reached the top of [Hacker News](https://news.ycombinator.com/item?id=42481789) on 2026-07-04. The tone in the thread is split: half suspecting a real platform cache reuse, half suspecting a [sonnet-5-specific hallucination triggered by a Pygments lexer](https://github.com/anthropics/claude-code/issues/74066#issuecomment-4880334711). Both readings are credible.

Turborepo [v2.10.3](https://github.com/vercel/turborepo/releases/tag/v2.10.3) shipped on 2026-07-03 with first-class support for [nub](https://github.com/nubjs/nub) and [aube](https://github.com/jdx/aube), two Rust-based Node.js package managers that emerged in spring and summer 2026. nub is authored by Colin McDonnell (creator of [Zod](https://github.com/colinhacks/zod), 43k stars) and aube by Jeff Dickey (creator of [mise](https://github.com/jdx/mise)); both integrate with Turborepo as `packageManager` values in `package.json` and `devEngines.packageManager`. The release also lands a new TUI/streamed-logs toggle, click-to-select tasks in the TUI task list, auto-copy of TUI selections to clipboard on mouse release, a `--production` flag on `turbo prune`, TypeScript 7.0.1-rc as the workspace toolchain, thin LTO + `codegen-units=1` for release builds, and a long list of cache-hashing perf fixes. The headline signal: two of the JS toolchain's most respected builders are now shipping package managers that ride on stock Node instead of replacing it, and Turborepo is the first mainstream monorepo tool to formalize both.

Anthropic released Claude Code [v2.1.199](https://github.com/anthropics/claude-code/releases/tag/v2.1.199) on 2026-07-02, one day after the v2.1.198 feature release (Chrome GA, background-agent auto-PR, /dataviz, Gateway on AWS) and two days after v2.1.197 made Sonnet 5 the default model. v2.1.199 is a bug-fix release with 24 entries: one new feature (stacked slash-skill invocations load up to 5 leading skills in one prompt), and a long list of reliability fixes for subagent error reporting, the background-agent daemon on Linux, streaming-response preservation on mid-stream API errors, SSL/TLS error handling behind corporate proxies, plan mode tool-call handling, and a per-env retry policy that no longer caps the user-tunable retry count at 15. Most of the items are in the background-agent / subagent area, which is consistent with the v2.1.197 + v2.1.198 direction of treating delegation as the product surface for Sonnet 5.

Rolldown [v1.1.4](https://github.com/rolldown/rolldown/releases/tag/v1.1.4), published 2026-07-01T14:02:02Z, ships one feature change and 19 bug fixes. The feature change is a partial reversal of the [v1.1.0 default-flip](https://github.com/rolldown/rolldown/releases/tag/v1.1.0) that landed on 2026-06-03: `experimental.lazyBarrel` is now disabled by default again, after four weeks of correctness reports against the default-on behaviour. The release also hardens the dev-mode path by forcing `lazyBarrel` off whenever `experimental.devMode` is set (PR [#10060](https://github.com/rolldown/rolldown/pull/10060)), on top of the existing force-off for `treeshake`. The default-flip revert (PR [#10071](https://github.com/rolldown/rolldown/pull/10071)) and the dev-mode fix both author as one line each: "disable `experimental.lazyBarrel` by default" and "fix(dev): disable lazy barrel in dev mode", and the root-cause tracking is the new [issue #10085](https://github.com/rolldown/rolldown/issues/10085) "Tracking strictExecutionOrder correctness and architecture issues", opened the day after the release. The release follows [Rolldown v1.1.3](https://github.com/rolldown/rolldown/releases/tag/v1.1.3) (2026-06-24) and is the first release since 1.1.0 to touch the lazyBarrel config surface.

Anthropic released Claude Code [v2.1.198](https://github.com/anthropics/claude-code/releases/tag/v2.1.198) on 2026-07-01T20:45:36Z, the second consecutive day of Claude Code shipping after v2.1.197 (the Sonnet 5 default release) the day before. The headline change is that Claude in Chrome is now generally available inside Claude Code: the browser-side assistant that was a research preview moves to a stable channel and is no longer gated behind a feature flag or a waitlist. The release also lands the first end-to-end automation for background agents in `claude agents`, which now commit, push, and open a draft pull request when they finish code work in a worktree, instead of stopping to ask for permission. Other notable additions: a `/dataviz` skill for chart and dashboard design with a runnable color-palette validator, a Gateway upstream for Claude Platform on AWS (`anthropicAws`) with model-not-found responses advancing the failover chain, a built-in Explore agent that now inherits the main session's model (capped at opus) instead of running on Haiku, and subagents that inherit the parent session's extended thinking configuration. The release also removes the `/agents` wizard and replaces it with the conversational flow, fixes a long list of reliability bugs around background agents, network drops, and platform auth, and improves syntax highlighting by upgrading to highlight.js 11.

Anthropic announced Claude Sonnet 5 on 2026-06-30 ([Introducing Claude Sonnet 5](https://www.anthropic.com/news/claude-sonnet-5)), and Claude Code [v2.1.197](https://github.com/anthropics/claude-code/releases/tag/v2.1.197) (released the same day) made it the default model. The launch is the first Sonnet-line model that closes the agentic gap with Opus 4.8, ships a native 1M-token context window, and lands on introductory pricing of $2 per million input tokens and $10 per million output tokens through August 31, 2026 (then $3/$15 per Mtok). Sonnet 5 is the new default for Free and Pro plans in Claude and is the default model in Claude Code, available immediately on update. The release ships with cyber safeguards enabled by default (the same safeguards as Opus 4.7 and 4.8, less strict than the Fable 5 set), a refreshed tokenizer that inflates token counts 1.0 to 1.35x, and rate-limit increases across Chat, Cowork, Claude Code, and the Claude Platform to absorb the higher token usage of the new effort-level controls. The Anthropic system card and the Claude Code release notes both ship the same day, so the Claude Code audience gets the new model the same day it is announced.

npm 11.18.0 (June 29, 2026) ships three features and a long backlog of bug fixes that together finish the work the npm CLI has been doing on the `install-strategy=linked` (isolated) install mode since RFC #0042 in 2022. The headline is [PR #9677](https://github.com/npm/cli/pull/9677) (backport of #9674), which graduates `--install-strategy=linked` from experimental to stable. The mode installs every package into `node_modules/.store/<name>@<version>/node_modules/<dep>` and links each into its parent's `node_modules` tree, so a package can only `require` dependencies that are actually declared in its own `package.json`. The new docs recommendation ([PR #9690](https://github.com/npm/cli/pull/9690)) is to run `--install-strategy=linked` in CI to catch phantom dependencies before publishing. Around the graduation the release ships a namespaced `npm install-scripts` command ([#9635](https://github.com/npm/cli/pull/9635), backport of #9629) that owns `approve`, `deny`, and `ls`, with `npm approve-scripts` / `npm deny-scripts` kept as aliases; an `install-scripts: prune unused allowScripts entries` housekeeping pass ([#9662](https://github.com/npm/cli/pull/9662)); and a new warning when `min-release-age` blocks an `npm audit fix` ([#9564](https://github.com/npm/cli/pull/9564)). The 43-commit release also fixes 19 `linked` strategy bugs (audit determinism #9638, dangling `.bin` shims #9643, stale `.store` cleanup #9649, invalid `filterNode` crash #9645, peerOptional validation #9641), three `npm sbom` fixes, and a percent-encoded `vcs_url` purl fix ([#9693](https://github.com/npm/cli/pull/9693)).

Oxlint apps_v1.72.0 and oxfmt apps_v0.57.0, both published on 2026-06-29, close out the v0.138 crates cycle predicted in the [v1.71 release notes](/articles/2026-06-23--oxlint-v1-71-oxfmt-v0-56). The crates release (crates_v0.138.0, also 2026-06-29) unifies the old and new AstBuilder APIs (#23876, #23834, #23831, with legacy methods marked `#[deprecated]`), renames `AllocatorAccessor` to `GetAllocator` and switches its `allocator` method to take `&self` (#23675, #23676), makes `Str` and `Ident` methods take `&GetAllocator` (#23781), adds `transformer_plugins: Support typeof define keys` for vue-i18n and similar macros (#23605, Alexander Lichter), and ships the headline perf entry of the cycle: `minifier: memoize value_type to remove its O(n^2) re-walk on long binary chains` (#23929, Dunqing), which turns a 20k-term arithmetic-addition chain from 6,118 ms to 4.7 ms (~1300x) and a real-world antd.js bundle from 78.1 ms to 65.4 ms. Oxlint v1.72.0 ships 3 features (React `no-unknown-property` suggestion #23936, AstBuilder unification #23875, `eslint/no-restricted-import` schema #23642), 18 bug fixes, and 23 performance entries. Oxfmt v0.57.0 carries two BREAKING changes that retire the Prettier fallback for CSS/LESS/SCSS and GraphQL files: `Format parser:css,less,scss files + css-in-js by oxc_formatter_css` (#23321, leaysgur) and `Support draft syntax with removing prettier fallback` (#23326, leaysgur), both landing on top of the new `oxc_formatter_css` (#23320) and `oxc_formatter_graphql` (#23317) crates.

Cline shipped v4.0.1 on June 28, 2026 and v4.0.2 on June 29, 2026 (github.com/cline/cline), a two-step recovery cycle for the v4.0.0 SDK migration that landed on June 26. v4.0.1 ships the pre-SDK 3.89.x VS Code extension under a 4.0.1 version number, built from a dedicated `legacy-extension` branch via a new `ext-vscode-publish-legacy.yml` workflow, to resolve regressions reported in 4.0.0 (broken diff previews in the editor, run_commands errors during file edits, broken file-editing flow with GLM 5.2 and MiniMax M3 through Ollama). v4.0.2 restores the SDK-backed code path on top of the same legacy branch, adding reasoning effort support (including `xhigh`) for DeepSeek thinking models (#11938), a centralized reasoning effort control layer for ClinePass (#11954), canonical Z.ai model ids (#11951), webview env replacement fix (#11955), ClinePass and Z.ai metadata polish (#11958), and a default focus chain settings fix (#11960). CLI v3.0.32 ships the same day with SDK v0.0.54 context-compaction improvements and ClinePass onboarding polish. The release sequence shows a project recovering a major migration in 72 hours by tagging the legacy branch forward rather than reverting the SDK work.

Prettier 3.9.0, released June 27, 2026 (prettier/prettier, blog post by Fisker Cheung), is a parser-heavy release that upgrades Markdown from remark-parse v8 to micromark v4 (better CommonMark and GFM compliance and a stack of long-standing bug fixes), YAML to yaml v2, GraphQL to GraphQL.js v17 (fragment arguments and directives on directive definitions), Flow to the Flow team's new Rust-based oxidized parser (roughly 37% faster on Prettier's valid Flow fixtures and 43% faster on flow_parser.js in local parser-only benchmarks), and Angular. The JavaScript and TypeScript printer is reworked too, particularly in --no-semi mode where comments around break and continue are now stable across repeated formats (an idempotency fix), plus redundant parenthesis removal in return statements, embedded-template interpolation alignment, and logical-not inlining. The release drops the legacy import ... assert {} syntax (Babel 8 removed the parser plugin; migrate to with), fixes a silently broken --cache-strategy content option, and stops EditorConfig files above Git worktrees from leaking in. The team reiterates pinning the exact version in package.json because the formatting changes will produce diffs.

Cline shipped v4.0.0 on June 26, 2026 (github.com/cline/cline), a major version that migrates the VS Code extension from its legacy standalone task implementation onto the shared Cline SDK, the same TypeScript engine that runs the Cline CLI, Kanban, and JetBrains plugin. The release adds ClinePass (built-in onboarding, provider selection, subscription handoff, and entitlement handling), a Customize marketplace for Skills, MCP servers, and the new Cline Plugins, queued prompts, edit-and-regenerate, a provider and model configuration rework around providers.json and a shared model catalog (Fireworks GLM 5.2, Kimi K2.6 Fast, Kimi K2.7 Code, Qwen 3.7 Plus, MiniMax M3, SAP AI Core, LiteLLM, Codex OAuth), command auto-approval disabled by default, and an extension build and package workflow moved to Bun. Subagents are temporarily disabled in the extension while the SDK-backed experience stabilizes.

The OpenAI Codex 0.142 line shipped between June 22 and June 26, 2026 (rust-v0.142.0 through rust-v0.142.3 on github.com/openai/codex). The cycle turns the agent into something a team can govern: configurable rollout token budgets that track usage across threads and abort turns when exhausted, multi-agent delegation configurable as disabled, explicit-request-only, or proactive, an indexed web-search mode that permits live search while restricting page access to server-approved URLs, MCP tools that use tool search by default, a /plugins marketplace reorganized into OpenAI Curated, Workspace, and Shared with me sections, system proxy (PAC, WPAD, bypass) support on Windows and macOS for authentication, and a long list of remote-executor reliability and security fixes. It builds directly on the 0.141 Noise-encrypted relay and cross-OS PathUri layer from June 18.

Node.js 26.4.0 (Current), published 2026-06-24 by @aduh95, lands eight SEMVER-MINOR changes: a minimal node:vfs subsystem that mounts user-supplied virtual filesystems (PR #63115, Matteo Collina) plus a follow-up that dispatches node:fs/promises to mounted VFS instances (PR #63537), package maps for ESM loaders that route bare specifiers through the loader hooks (PR #62239, Maël Nison), TLS certificateCompression that wires RFC 8879 zlib and zstd compression through the OpenSSL build config (PR #62217, Tim Perry), TCP_KEEPINTVL and TCP_KEEPCNT support in net.Socket.setKeepAlive (PR #63825, Guy Bedford), caller-supplied buffers in fs.readFile / fs.readFileSync (PR #63634, Matteo Collina), closeIdleConnections that now also drops pre-request sockets (PR #63470, semimikoh), net.BlockList advanced to Release Candidate stability (PR #63050), and crypto argon2 + KEM encap/decap marked stable (PR #63924, Filip Skokan). The release also adds WebCrypto cSHAKE (PR #63988), QUIC listEndpoints (PR #63536) and X509Certificate handles (PR #63191), dgram connectSync / bindSync (PRs #63838 + #63932, Guy Bedford), early-TCP net.BoundSocket (PR #63951), an experimental fast FFI call path for AArch64 and x86_64 (PRs #63068 + #63941, Paolo Insogna), npm 11.17.0 (PR #63857), sqlite 3.53.2, and libffi 3.6.0.

Vite 8.1.0 stable, published 2026-06-23 by the Vite Team (announcing-vite8-1), graduates Bundled Dev Mode from an experimental flag into a documented --experimental-bundle entry point (15x faster cold start on a 10k React-component app, 10x faster full reloads, 3x faster cold-start rendering and 40% faster full reloads reported by Linear), stabilises the WASM ESM Integration direct .wasm imports and build.chunkImportMap that shipped in 8.1-beta on 2026-06-15, brings Lightning CSS one step closer to default by adding external-CSS-in-CSS and plugin file dependencies, bumps Rolldown to 1.1.2 (1.1.3 follows the same day), pins rolldown with a tilde range so patch releases flow through without a Vite PR, extends server.fs.deny with .npmrc, .yarnrc.yml, and *.{key,p12,pfx,cer,der}, and emits a runtime warning when envFile: false is used (the deprecation is already documented in the types).

Oxlint apps_v1.71.0 and oxfmt apps_v0.56.0, both published on 2026-06-22, close out the v0.137 crates cycle. Oxlint v1.71 picks up the new treeshaking pure typed arrays minifier pass (#23469), the prefer-query-selector compound selector fix, 28 lint bug fixes (most of them Yunfei He's fixer-rewrite work), 13 performance entries anchored on a bucketed rule dispatch refactor (#23450, #23452, #23482-#23486, #23489, #23492), and the oxlint Tokio-on-LSP-only startup (#23447). Oxfmt v0.56.0 ships 9 bug fixes (CRLF normalization for `// @ts-ignore` suppressed text in #23701 and #23702, the member-chain panic fix #23698, the default-export-with-type-cast preservation #23697) and 3 formatter performance entries that remove arena copies on bigint, numeric-literal, and string-literal text. v1.71 is the first apps release since v1.70.0 on 2026-06-15, and the last one before the v0.138 crates release that will land on Monday 2026-06-29.

SWC v1.15.43, published on 2026-06-22 with swc_core v71.0.3, ships the experimental Rust React Compiler as a configurable SWC transform via .swcrc jsc.transform.reactCompiler (PR #11917, 54 files, 12,986 additions); fixes a silent template literal minifier bug where `compress` dropped text after the left template's last interpolation when concatenating two template literals (#11939); gates Number(x) -> +x on both `unsafe: true` AND `unsafe_math: true` to match terser v4.3.11+ (#11944, #11949); corrects scope for ES2022 private property brand checks (#11953); and lands seven internal React Compiler fixes (#11940, #11943, #11946, #11950, #11951, #11952, #11957) plus a parser fix that allows no-default builds (#11956) and a docs entry on the untrusted input security scope (#11937).

Astro 7.0.0, published on 2026-06-22, lands the 7.0 stable branch after ten weeks of beta. The headline changes: a Vite 8 upgrade, the Rust-based Astro compiler as the default (the Go compiler is removed), the Sätteri Markdown pipeline as the default (remark/rehype moves out of the default install), advanced routing promoted from experimental (with src/fetch.ts as the new default entrypoint), route caching promoted from experimental (top-level cache and routeRules, with cacheNetlify() and cacheVercel() providers landing in the same release), a background dev server mode designed for AI coding agents (astro dev --background, .astro/dev.json lockfile, astro dev stop|status|logs), compressHTML: 'jsx' as the new default, the @astrojs/db package removed, and every official integration bumped a major version (vue 7, react 6, svelte 9, preact 6, solid-js 7, vercel 11, netlify 8, node 11). create-astro@5.1.0, shipped in the same release wave, now writes an AGENTS.md file into every new project with a CLAUDE.md symlink pointing at it.

Oxc release crates_v0.137.0, published on 2026-06-18, ships two new minifier passes (treeshake pure typed arrays and Set/Map array literals via #23469, and inline const values for read-only vars via #22593), a long-running incremental scoping refresh that retires the LiveUsageCollector collector entirely (#23197), a friendly parser error for adjacent JSX elements (#23378), a React Compiler bug fix for computed-key imports (#23586), and two breaking changes to the ESTree config API (#23573, #23574). The minifier pass list also gets a Proxy-aware object-introspection fix (#23483) and a new Map/WeakSet/WeakMap preservation rule for string arguments (#23470). v0.137 is the first crates release since v0.135 on 2026-06-08 and the second since Bun's native React Compiler integration landed on 2026-06-20.

PR #32504, merged into oven-sh/bun on June 20, 2026, turns the upstream React Compiler Rust port into a built-in `bun build` transform behind `--react-compiler` and `Bun.build({ reactCompiler: true })`. Bun ports the upstream `facebook/react` `compiler/crates/` workspace directly into a single `src/react_compiler/` crate (~62k LOC) instead of going through Babel, SWC, or Oxc, and on a large React codebase (around 860 components, 1400 memo slots) the compiler pass runs in 465 ms versus 9.15 s for the Babel plugin. The feature is experimental, off by default, and ships with `reactCompilerOutputMode` (client or ssr) and a `scripts/sync-react-compiler.sh` re-sync helper.

Astro 7.0.0-beta.6 (June 19, 2026) promotes the experimental route caching API to top-level stable, dropping the experimental.cache and experimental.routeRules flags in favor of a new top-level cache config and a cache helper. Beta.5 (June 18) made 'jsx' the default compressHTML mode, changing the rendered output of every site that relied on the legacy whitespace preservation. Beta.6 also pulls in @astrojs/markdown-satteri 0.3.1-beta.2.

TypeScript 7.0 RC (June 18, 2026) is the release candidate of the compiler Microsoft ported from its bootstrapped TypeScript codebase to Go. It is often about 10x faster than TypeScript 6.0, ships a tsc6 compatibility package so it can run side-by-side with 6.0, adds --checkers/--builders/--singleThreaded parallelism controls and a rebuilt watch mode on a Go port of @parcel/watcher, and turns every 6.0 deprecation into a hard error. The stable release is planned within the next month, with a stable programmatic API deferred to 7.1.

pnpm 11.8.0 (June 18, 2026) adds a long-requested `--dry-run` for `pnpm install`, experimental Node.js package maps at `node_modules/.package-map.json`, CycloneDX devDependencies scope and per-package SBOM generation, and a macOS Gatekeeper fix that strips quarantine from native binaries. It also closes a configDependencies path-traversal advisory (GHSA-qrv3-253h-g69c) three days after the 11.7 lockfile hardening.

React Router v8.0.0 (June 17, 2026) is the first major release under the project's Open Governance model and the first on a planned yearly cadence. Every `future.v8_*` flag from v7 is now the default (always-on middleware, pass-through requests, the Vite Environment API, route-module splitting), the baseline moves to Node 22.22+, React 19.2.7+, and Vite 7+, all packages ship ESM-only with an ES2022 target, `react-router-dom` is removed, and the node adapters switch to a Remix-maintained fetch server while `create-react-router` drops its fetch polyfill for native `fetch`.

On June 18, 2026, the Node.js project shipped coordinated security releases for the v22 'Jod' LTS, the v24 'Krypton' LTS, and the v26 Current line. The drop fixes 12 CVEs, including two rated High: CVE-2026-48618 (TLS hostname normalization for server identity checks) and CVE-2026-48933 (WebCrypto cipher output length guard). The release also picks up OpenSSL 3.5.7, undici 8.5.0 on v26, llhttp 9.4.2, and nghttp2 1.69.0 (semver-major) on v22 and v24.

Codex 0.141.0 (June 18, 2026) makes Noise IK the default transport between orchestrator and exec-server, ships a PathUri / NativePathString layer that round-trips POSIX, Windows-drive, and UNC paths without leaking the URI encoding, opens a `created-by-me-remote` plugin marketplace, raises the MCP tool timeout to 300 seconds, and pins the bundled SQLite to 3.51.3 to keep the WAL-reset corruption fix in place after dependency refreshes.

On June 18, 2026, the Swoole team publicly renamed their ahead-of-time PHP compiler to TypePHP, a separate strongly-typed compiled language with full PHP syntax compatibility, a dual static-compile / ZendVM-runtime engine, native Decimal / BigInt / BigFloat types, four strongly-typed C++-backed containers, uniform function call syntax, and direct C++ ABI calls into C, C++, Rust and Go static libraries. A beta is promised by China's National Day (October 1, 2026), with full source-code release to follow. We unpack the dual-engine design, the C++ ABI integration, the self-hosted compiler, what changes against KPHP, HHVM, PeachPie and FrankenPHP, and the open question Roman Pronskiy raised about where the language stops being PHP.

On June 12, 2026, Google Cloud published the Open Knowledge Format (OKF), an open specification that formalizes the LLM-wiki pattern into a portable, interoperable format: a directory of markdown files with YAML frontmatter, one required field (type), five recommended ones, and zero required tooling. The tweet from Google Cloud Tech on June 16 drove 117,000 views in 24 hours and made the spec the most-discussed knowledge-format launch of the year. This long read walks through the v0.1 spec section by section, the design choices that make it deliberately minimal, what Google is shipping alongside it (an enrichment agent for BigQuery, a static HTML visualizer, three sample bundles, and a native BigQuery Knowledge Catalog integration), and the open question every AI agent builder and data platform team should be tracking over the next six months.

pnpm 11.7.0 (June 15, 2026) ships four headline changes: a `--frozen-store` install mode for Nix stores, OCI layers, and other read-only mounts; delegation of dependency resolution to the pacquet Rust port (not just materialization); an opt-in `--batch` flag for `pnpm publish --recursive`; and a security fix that rejects path-traversal and reserved aliases (`.bin`, `.pnpm`, `node_modules`, `../../escape`) in lockfile-sourced dependencies.

Astro 7.0.0-beta.4 (June 15, 2026) flips the Sätteri Rust-based Markdown pipeline on by default, removes the experimental flag from advanced routing, the custom logger, and the new rendering engine, deletes the deprecated astro db/login/logout/link/init CLI commands, and folds the dev-server background mode added in alpha.2 into the default CLI.

Deno merged `deno desktop` on June 16, 2026 (PR #33441), a new subcommand that turns a Deno project into a self-contained desktop application. The feature ships the WEF backend (CEF by default, plus WebView and raw winit), the Deno.BrowserWindow API for window lifecycle and native events, framework auto-detection for Next, Astro, Fresh, Remix, Nuxt, SvelteKit, SolidStart, TanStack Start, and Vite SSR, a CDP multiplexer that exposes both V8 isolates in a single DevTools session, an auto-updater with bsdiff patches, and cross-compiled .app/.dmg/.exe/.AppImage outputs. Three smaller Deno PRs landed the same morning: `deno link`/`unlink`, `deno test --shard`, and a fetch `request_builder_hook` for `x-deno-fetch-token`/`cdn-loop` headers.

On June 16, 2026, Z.ai released GLM-5.2 under MIT, with a solid 1M-token context, an IndexShare sparse-attention trick that cuts per-token FLOPs by 2.9×, an anti-hack module for coding RL, and benchmark numbers that put it within a few points of Claude Opus 4.8 on Terminal-Bench 2.1, ahead of GPT-5.5 on three long-horizon suites, and at the top of the open-weights leaderboard on every coding benchmark the company chose to publish. This long read walks through the architecture, the IndexShare + MTP story, the slime agentic RL infrastructure, the anti-hack module, the full benchmark table with all the footnotes, and what this means for the rest of the open-weights long-context race.

On June 16, 2026, four trading days after SpaceX's record $85.7bn IPO made Elon Musk the world's first trillionaire, the company confirmed it will acquire Anysphere, the parent of the Cursor AI coding editor, in an all-stock deal valued at $60 billion. The price is roughly 16x Cursor's late-2025 private valuation, twice the round it was about to close, and the deal closes the loop on a curious April arrangement in which SpaceX had the right to buy Cursor for $60bn or pay $10bn for the partnership instead. This long read walks through the deal mechanics, the IPO-as-acquisition-currency story, the technology bet on Composer + Colossus, what xAI's collapse had to do with the timing, and the questions every developer who uses Cursor, Claude Code, Copilot, or any other AI coding tool should be asking this week.

On June 15, 2026, at VivaTech, the Staan search API opened self-service to any developer. It is the public face of European Search Perspective, the 50/50 Qwant and Ecosia joint venture that runs the European search index, and the launch lands in the gap left by Microsoft's August 2025 retirement of the Bing Search API and Google's constrained programmatic access. This long read walks through the pipeline, the three product tiers, the pricing, the sovereignty story and its limits, the 'American backup' fallback, and what it means for the AI agents and coding tools that depend on a fresh web index.

Playwright v1.61.0 (June 15, 2026) ships a virtual authenticator for WebAuthn/passkey ceremonies, a first-class page.localStorage / page.sessionStorage API, network security details on API responses, and brings test runner video recording to parity with trace recording. Browser channels: Chromium 149, Firefox 151, WebKit 26.5.

Vite 8.1.0-beta.0 (June 15, 2026) is the first beta of the 8.1 line. It ships the WASM ESM Integration standard as direct .wasm imports, a build.chunkImportMap option that uses import maps to improve chunk cache hit rates, integration with Vite Task for zero-config build caching, support for lightningcss plugin dependencies, and a breaking rename of every `server.hmr` option to `server.ws`.

esbuild v0.28.1 (June 11, 2026) is the first release since April. It fixes a CVSS 8.1 remote code execution in the Deno API via NPM_CONFIG_REGISTRY, a Windows-only dev-server path traversal, and a minifier bug that silently broke `using` and `await using` resource disposal.

OpenRouter's Fusion API runs multiple LLMs in parallel, has a judge model extract consensus and contradictions, then synthesizes a single answer. On the DRACO deep research benchmark, a panel of budget models matched the best frontier model at half the cost, and a frontier panel surpassed every individual model tested. This analysis breaks down the architecture, the benchmark methodology, and why the synthesis step, not model diversity, is where most of the performance gain lives.

Biome's CLI hits 2.5.0 and the JavaScript API moves to a major v6.0.0. The headline is a new spanInBytesToSpanInCodeUnits helper that fixes a real bug in non-ASCII text extraction, plus a long list of SCSS, JSON, linter, and CLI improvements.

Oxc 0.135 integrates the React Compiler Rust port, marks AST nodes as #[non_exhaustive] (a breaking change for downstream Rust crates), adds two new template-escape AstBuilder methods, and brings dozens of parser strictness and codegen whitespace fixes.

Rolldown 1.1.0 introduces two notable behavior changes: experimental.lazyBarrel is now enabled by default, and tsconfig project-reference resolution has been updated to match TypeScript's behavior.

Oxc's June release ships oxlint v1.68.0 with two new Vue rules, a TypeScript method-signature-style linter rule, and parser improvements that reject ambient context misuse. oxfmt v0.53.0 ships formatter updates alongside performance work on token parsing.

Turborepo's latest stable releases add heap allocation profiling via OpenTelemetry traces, fix pnpm injected peer package handling, harden OTEL endpoint validation, and address PTY shutdown hangs and npm tlog publish retries.

OpenCode, the open source AI coding agent with 145K GitHub stars, has rebuilt its Desktop app on Electron after concluding that WebKit performance and bundled CLI startup issues made Tauri a poor fit for its all-TypeScript architecture.

Next.js 16.3.0-canary brings fine-grained prefetch configuration, better deduping for the 'use cache' directive, and a redesigned blocking route dev overlay, with sccache now bootstrapped via cargo-binstall.

Oxc v0.126.0 ships support for Turbopack magic comments in the parser, a breaking rename of Box and Vec allocator methods, new NAPI transform options for enum optimization, and continued performance work on the lexer and allocator.

TypeScript 6.0 lands as a bridge release with new features like #/ subpath imports, stable type ordering, and a path toward TypeScript 7.0's native Go codebase.

The swc-project Rust compiler released v1.15.26 with bug fixes, performance improvements, and continued integration across the Node.js and bundler ecosystem.

Vite+ Alpha drops today under MIT license, unifying Vite, Vitest, Oxlint, Oxfmt, and Rolldown into a single vp binary. Node.js runtime and package manager management included.

Vercel engineers used AI coding agents to optimize Turborepo's Rust codebase, achieving 81–96% faster task graph computation. Here's the process, the wins, and the sharp limits they ran into.

Node.js 25.9 adds an experimental stream/iter module for async iteration over streams, a --max-heap-size CLI flag, AsyncLocalStorage with using scopes, TurboSHAKE crypto, and an upgraded npm 11.12.1. Here's what each change means for your code.

Google has open sourced JSIR, a next-generation JavaScript analysis tool built on MLIR. It supports both high-level dataflow analysis and lossless source-to-source transformation, used internally for Hermes bytecode decompilation and AI-powered JavaScript deobfuscation.

JetBrains' March release turns on a service-based TypeScript engine by default, puts Junie, Claude Agent, Codex, and Cursor in the AI chat sidebar, sunsets Code With Me, and adds native Wayland support on Linux.

Astro 6.1 lets you tune Sharp's encoder settings at the pipeline level, adds advanced SmartyPants configuration, and exposes i18n fallback routes to the integration hook system. Cloudflare acquisition continues to shape the roadmap.

Vite 8.0.0 shipped stable on March 12, and the patch releases haven't stopped, v8.0.7 landed April 7 with fixes across CSS, SSR, WASM, and dev server behavior. A contrast to the long beta cycle.

TypeScript 6.0 is out, and the Microsoft team is clear: it's a bridge release. The real story is what comes next: TypeScript 7, written in Go and already available as a preview, promises a 10x speedup.

ESLint's biggest breaking-change release in years finalises flat config, removes eslintrc support entirely, and adds JSX reference tracking. But the bigger story might be what's nipping at its heels.

While ESLint v10 was wrestling with legacy cleanup, the Oxc project shipped a linter 100x faster, a formatter 30x faster than Prettier, and a parser that leaves SWC in the dust. Here's what the JavaScript oxidation compiler actually is.

As of March 2026, IntelliJ IDEA v2026.1 ships JavaScript, TypeScript, HTML, CSS, and basic React features at no extra cost, features that previously required a paid Ultimate subscription. The catch: Angular, Vue, and advanced debugging still need Ultimate.

The popular dependency and unused-code scanner for JavaScript and TypeScript gets a major overhaul, replacing its TypeScript backend with the Rust-based oxc-parser, and the results are dramatic.

Astro 6.0 and 6.1 land within weeks of each other, bringing an experimental Rust compiler, request-time content collections, a built-in Fonts API, CSP tooling, and deeper Cloudflare integration, all while the framework doubles its adoption for the third year running.

The State of JavaScript 2025 survey shows TypeScript exclusive usage at 40%, Vite satisfaction at 98% versus Webpack's 26%, and Claude doubling its developer share. The ecosystem is maturing rather than churning.

Microsoft ships TypeScript 6.0 as the final release built on the original JavaScript codebase. DOM type updates, improved inference, subpath imports, and a migration flag set the stage for the native Go-based TypeScript 7.0.

The Vite 8 beta drops ESBuild and Rollup in favor of Rolldown, signaling a full Rust-based future for the JavaScript build toolchain. What changes, what breaks, and why it matters.

LogRocket's March 2026 AI development tool rankings show major shifts as Antigravity climbs to second place and OpenAI's Codex re-enters the top five.

The State of JavaScript 2025 survey reveals TypeScript usage at an all-time high, Vite crushing Webpack in satisfaction, and growing concerns about Next.js complexity.

By early 2026, Claude Code held a 46% 'most loved' rating among developers, leaving Cursor at 19% and GitHub Copilot at 9%. But love ratings and usage rankings don't tell the whole story. Here's what each tool actually does well, and when to use which.

Microsoft's port of the TypeScript compiler and language service to Go is now measurable: the VS Code codebase compiles in 7.5 seconds instead of 77.8. Here's what the native era means for your build pipeline and editor performance.

VoidZero's Vite+ promises to unify runtime, package manager, bundler, linter, formatter, and test runner under a single command. We read the announcements, benchmarked the claims, and talked to people using it in production. Here is what we found.