225 Photos and videos
quoting this to pin it 😎
20 Aug 2020
6
4,772
eskimojo retweeted
May 15
It's Redux release day! Shipped RTK 2.12.0, React-Redux 9.3.0, and Reselect 5.2.0
Highlights:
- RTK skills files
- `connect` is officially deprecated! Don't use it! :)
- Fixed trusted publishing
github.com/reduxjs/redux-too…
github.com/reduxjs/react-red…
github.com/reduxjs/reselect/…
1
4
47
4,606
eskimojo retweeted
May 11
SECURITY ADVISORY — TanStack npm packages
A supply-chain compromise affecting 42 @tanstack/* packages (84 versions total) was published to npm earlier today at approximately 19:20 and 19:26 UTC. Two malicious versions per package.
Status: ACTIVE — packages are deprecated, npm security engaged, publish path being shut down.
Severity: HIGH — payload exfiltrates AWS, GCP, Kubernetes, and Vault credentials, GitHub tokens, .npmrc contents, and SSH keys.
If you installed any @tanstack/* package between 19:20 and 19:30 UTC today, treat the host as potentially compromised:
• Rotate cloud, GitHub, and SSH credentials immediately
• Audit cloud audit logs for the last several hours
• Pin to a prior known-good version and reinstall from a clean lockfile
Detection — the malicious manifest contains:
"optionalDependencies": {
"@tanstack/setup": "github:tanstack/router#79ac49ee..."
}
Any version with this entry is compromised. The payload is delivered via a git-resolved optionalDependency whose prepare script runs router_init.js (~2.3 MB, smuggled into each tarball at the package root).
Unpublish is blocked by npm policy for most affected packages due to existing third-party dependents. All 84 versions are being deprecated with a SECURITY warning, and npm security has been engaged to pull tarballs at the registry level.
Full technical breakdown, complete package and version list, and rolling status updates:
github.com/TanStack/router/i…
Credit to the security researcher for responsible disclosure.
138
979
3,853
3,905,243
eskimojo retweeted
Mar 17
🚀 Valibot v1.3 is here!
✅ Smarter pipelines with `guard()` for type refinement & `parseBoolean()` for boolish inputs (env vars, forms, query strings).
✅ Result caching via `cache()` / `cacheAsync()` for repeated & async validations.
✅ New validators: `domain()`, `jwsCompact()`, `isrc()` important compatibility fixes.
Huge thanks to @eskimojo, @yslpn and many others for contributing to this release! 🙌
Full details examples 👉 valibot.dev/blog/valibot-v1.…
npm i valibot@latest
#Valibot #TypeScript
2
18
104
5,379
eskimojo retweeted
Feb 23
Shoutout for @eskimojo for the implementation and TypeBox for being currently the fastest ⚡️
1
2
502
eskimojo retweeted
Feb 23
🚨 Exciting update! Our Schema Benchmarks OSS project now has a dedicated section for Standard Schema.
Check it out and discover how fast your favorite Standard Schema libraries like @valibot, @zodtypes, @arktypeio, @EffectTS_ and more really are! 📈
Which one surprises you the most? 👀
schemabenchmarks.dev/standar…
#TypeScript #WebDev #OpenSource #StandardSchema
2
2
27
1,664
Incredibly hyped to announce Schema Benchmarks, a project I've been steadily working on in collaboration with @FabianHiller!
It aims to provide a central and transparent resource for many of the metrics that matter for schemas, including bundle size and runtime performance 😄
5
3
21
2,725
@colinhacks excuse the ping, but I'm wondering if this is a bug - I'm just not sure if it's a bug our side or Zod's. based on the docs i wouldn't expect to see locales included in the compiled output 🤔
before compilation: schemabenchmarks.dev/repo/ra…
after schemabenchmarks.dev/repo/ra…
1
69
update: my bad!
(though i do think this is a mistake that could be made by an end user - i'm curious what about the default export breaks tree shaking)
x.com/eskimojo/status/202538…
an update to this:
i noticed a discrepancy between our zod benchmark and zod's docs, namely that we were using a default import and the docs show a namespace import.
updating our benchmark to match the docs brought zod down to a much more reasonable 16KB.
48
Our current results, starting with bundle size (compiled with @rolldown_rs):
Typia and Valibot lead here, with very similar results (~1.9KB minified gzipped). Zod brings up the rear, maybe due to its extensive language support. Its mini variant however is far smaller, at 5KB.
3
3
206
Now for parsing; where the schema returns a new value. We mark try/catch tests with *, and "abort early" tests with †.
Libraries that can abort early (Valibot, Effect, joi) have an advantage with invalid data, and Typebox clocks in slowest, constrasting its validation results.
2
2
193
eskimojo retweeted
Feb 20
🚨 Missed our big announcement yesterday? We launched schemabenchmarks.dev! 🎉
An open-source project comparing top JS schema libraries like @zodtypes, @valibot, @arktypeio, Typia, TypeBox, @EffectTS_ and more. 🧩
Dive into metrics on download time, schema creation, and parsing speed. 🔥
Check it out now and see who's leading the pack: schemabenchmarks.dev/blog/we…
1
12
72
8,530
We'll also aim to expand to other types of benchmarking and comparison - I'm already investigating capturing error messages and traces, inspired by x.com/techsavvytravvy/status…
Feb 11
i ranked some validation libraries
this is very official and the results are final
ALT A dark screenshot of terminal output comparing several JavaScript validation libraries in two ways. First, it ranks which library produces the most helpful error stack trace: valibot is best; sury, decoders, and effect-schema are next; then yup; then arktype; then zod; and joi is last because it doesn’t show up in the stack trace. Second, it ranks bundle size from smallest to largest: valibot and decoders are the smallest, yup and sury are mid-sized, arktype and joi are larger, and zod and effect-schema are the largest.
1
3
157
eskimojo retweeted
Feb 19
Proud to have teamed up with @eskimojo on Schema Benchmarks! 🙌
Valibot and Typia neck-and-neck on bundle size (~1.9KB gzipped)—the fight for the smallest bundles is heating up! 🔥
Transparent metrics like these help us all improve—dive in and let us know what you think!
schemabenchmarks.dev/
Incredibly hyped to announce Schema Benchmarks, a project I've been steadily working on in collaboration with @FabianHiller!
It aims to provide a central and transparent resource for many of the metrics that matter for schemas, including bundle size and runtime performance 😄
4
2
26
1,906
this was also a great opportunity to try out a bunch of new tech - we're currently running on Vite 8 (beta), @tan_stack Start ( Query Pacer), and using Oxfmt/Oxlint/TSGo 👀
5
123
To see our results in depth, check out schemabenchmarks.dev/!
Reckon we've missed a library, or thought of an improvement to our methodology? We'd love to hear from you! github.com/open-circle/schem…
Want to do one better and DIY? Thanks! Give this a read: schemabenchmarks.dev/contrib…
2
116