Lightnews — Scholar-powered news

Reposted by Ulises Gascón

OpenJS Foundation @openjsf.org · 1d

Lit is joining OpenJS as an Impact Project! 🔥

Donated by Google Open Source, Lit powers 10,000+ custom elements inside Google and is loved for its fast, standards-based web components.

Welcome to the OpenJS family, @lit.dev!

Learn more: hubs.la/Q03Np1Mm0

Lit Project Moves to OpenJS Foundation with Google Open Source Contribution | OpenJS Foundation

Lit joins a neutral home within the OpenJS Foundation community

hubs.la

2 8 54

Ulises Gascón @ulisesgascon.com · 5h

♥️ I’m very happy to announce that @weorbitant.bsky.social is now a Platinum Sponsor!

They’re fueling my #OpenSource work and helping make my journey as a #maintainer more #sustainable.

Huge thanks to the @weorbitant.bsky.social team for the support and trust 🙏

orbitant.com/en/

Home - Orbitant

We build robust engineering solutions with business insights.

orbitant.com

1 7

Reposted by Ulises Gascón

Jordan Harband @jordan.har.band · 1d

Don’t worry, this is going to involve dropping lots of no-longer-needed APIs :-D

OpenJS Foundation @openjsf.org · 1d

Lodash is entering a new chapter 📖 With investment from @sovereign.tech the project is getting key updates for security, modernization, and community-led governance.

Details: hubs.la/Q03NrdfR0

2 7

Ulises Gascón @ulisesgascon.com · 1d

✨ Gracias al increíble trabajo de @jddalton.bsky.social, #Lodash sigue siendo una de las librerías más confiables de #JavaScript.

Ahora ampliamos la #colaboración, la #gobernanza y la #seguridad para garantizar su futuro.

blog.ulisesgascon.com/el-futuro-de...

blog.ulisesgascon.com

2

Ulises Gascón @ulisesgascon.com · 1d

✨ Thanks to @jddalton.bsky.social’s incredible work, #Lodash remains one of the most trusted libraries in #JavaScript.

We’re now expanding #collaboration, #governance, and #security to ensure its future.

blog.ulisesgascon.com/the-future-o...

blog.ulisesgascon.com

1 4

Reposted by Ulises Gascón

OpenJS Foundation @openjsf.org · 8d

New Era for React = Stronger JavaScript Ecosystem 💙

React doesn’t live in isolation - It works alongside Node.js, Electron, webpack, and more. A dedicated foundation under the Linux Foundation means more collaboration, security, and sustainability across the ecosystem.

hubs.la/Q03MylxX0

Celebrating the Launch of the React Foundation | OpenJS Foundation

A New Era for React, and a Stronger JavaScript Ecosystem

hubs.la

19 44

Reposted by Ulises Gascón

Robin Bender Ginn @rginn206.bsky.social · 7d

So cool to be in the room at React Conf when the new React Foundation was announced 💙 with its new home at the Linux Foundation. At @openjsf.org we’re celebrating this big win for JavaScript communities.

OpenJS Foundation @openjsf.org · 8d

New Era for React = Stronger JavaScript Ecosystem 💙

React doesn’t live in isolation - It works alongside Node.js, Electron, webpack, and more. A dedicated foundation under the Linux Foundation means more collaboration, security, and sustainability across the ecosystem.

hubs.la/Q03MylxX0

Celebrating the Launch of the React Foundation | OpenJS Foundation

A New Era for React, and a Stronger JavaScript Ecosystem

hubs.la

6 21

Reposted by Ulises Gascón

Corbin Crutchley @crutchcorn.dev · 8d

React is being fostered going forward with a new foundation!

1 4 22

Reposted by Ulises Gascón

reaper @reaper.is · 15d

After using it for almost a year, I guess I can recommend it to people

usebruno.com

usebruno.com

1 3

Ulises Gascón @ulisesgascon.com · 15d

🔒 The latest issue of my #newsletter is out, number 008.

It covers the npm Shai Hulud attack and emergency response, GitHub’s Secure Open Source Fund, new Express releases, and the OpenJS AI Collaboration Space...

blog.ulisesgascon.com/newsletter-i...

Newsletter #008: Security wins, npm attacks, and community momentum 🔒

From the npm Shai-Hulud attack and emergency response, to GitHub’s Secure Open Source Fund, new Express releases, and the launch of the OpenJS AI Collaboration Space — this month has been packed with ...

blog.ulisesgascon.com

1 1

Reposted by Ulises Gascón

Richard Lau @rwklau.bsky.social · 21d

Just released @nodejs.org 22.20.0.
nodejs.org/en/blog/rele...

Node.js

Node.js® is a free, open-source, cross-platform JavaScript runtime environment that lets developers create servers, web apps, command line tools and scripts.

nodejs.org

1 7 29

Ulises Gascón @ulisesgascon.com · 23d

Welcome @rafaelgss.dev to the @openjsf.org #CNA team! 👏 👏 👏

github.com/openjs-found...

Nominate @rafaelgss as CNA Coordinator by UlisesGascon · Pull Request #297 · openjs-foundation/security-collab-space

@RafaelGSS has made outstanding contributions to the open source security ecosystem, particularly through his leadership in the Node.js project and related tooling. He brings deep expertise in vuln...

github.com

1 3 5

Reposted by Ulises Gascón

Darcy Clarke @darcyclarke.me · 29d

ℹ️ Don't know who needs to hear this but npm has had a --before= flag since v6.9.0 (02/2019): github.com/npm/cli/blob/v…

Setting a relative date is easy w/:
$ npm install --before="$(date -v -7d)"
# & only get registry deps that are over a week olddocs.npmjs.com/cli/v11/usin...re

https://github.com/npm/cli/blob/v…

3 10 43

Reposted by Ulises Gascón

Wes @notwes.bsky.social · 28d

Lots of GREAT progress and discussion on our @expressjs.bsky.social Performance Working Group. Thanks everyone who is participating as I think this is the second most (security comes first) impactful thing we could be working on.

For anyone interested in helping out: github.com/expressjs/pe...

GitHub - expressjs/perf-wg: Performance Working Group

Performance Working Group. Contribute to expressjs/perf-wg development by creating an account on GitHub.

github.com

2 11

Ulises Gascón @ulisesgascon.com · 28d

Welcome @bjohansebas.bsky.social to the @expressjs.bsky.social Security Triage team! 👏 👏 👏

github.com/expressjs/se...

Nominate @bjohansebas to the Security Triage team by UlisesGascon · Pull Request #105 · expressjs/security-wg

I’d like to nominate @bjohansebas as a Security Triage Team member, based on his contributions across multiple project areas and his recent involvement in CVE-2025-48997. cc: @expressjs/express-tc ...

github.com

2 5

Ulises Gascón @ulisesgascon.com · Sep 13

🗞️ Exciting update: #webpack now has an official Threat Model!

It sets clear boundaries, improves #security awareness, and strengthens our #ecosystem for everyone. 💪

github.com/webpack/security-wg/pull/9

doc: add a Threat Model by UlisesGascon · Pull Request #9 · webpack/security-wg

Heavily inspired in Express Threat model: https://github.com/expressjs/security-wg/blob/main/docs/ThreatModel.md Closes #8

github.com

2

Ulises Gascón @ulisesgascon.com · Sep 11

🚩 Keep up to date with @nodejs.org by watching the #Nodejs Security Working Group's last meeting on YouTube!

www.youtube.com/watch?v=2_ex...

2025-09-11 - Security Team meeting

YouTube video by node.js

www.youtube.com

1

Reposted by Ulises Gascón

Express @expressjs.bsky.social · Sep 8

The maintainer of one of our dependencies, debug, was the target of a phishing attack resulting in the release of [email protected] with malware.

Supply chain security is all of our responsibilities. Be careful out there, and for today don't update your deps.

socket.dev/blog/npm-aut...

npm Author Qix Compromised via Phishing Email in Major Suppl...

npm author Qix’s account was compromised, with malicious versions of popular packages like chalk-template, color-convert, and strip-ansi published.

socket.dev

1 5 12

Ulises Gascón @ulisesgascon.com · Sep 5

🍿 Exciting news! The @openjsf.org Foundation #AI Collaboration Space holds its first meeting next week.

A community hub where developers, maintainers and policy thinkers explore how #JavaScript connects billions of people to #AI.

github.com/openjs-found...

GitHub - openjs-foundation/ai-collab-space: A community hub exploring how JavaScript powers the future of AI.

A community hub exploring how JavaScript powers the future of AI. - openjs-foundation/ai-collab-space

github.com

1

Ulises Gascón @ulisesgascon.com · Sep 4

🔒 Securing #OpenSource projects is not an easy task.

✨ Here’s a great #initiative helping the #maintainers and community move forward:

👉 openjsf.org/blog/securit...

How OpenJS Hosted Projects Benefit from Security Support | OpenJS Foundation

Providing Hosted Projects with the Tools and Guidance to Manage Security Confidently

openjsf.org

2 3

Ulises Gascón @ulisesgascon.com · Sep 2

🗞️ Exciting news: #webpack now has a Security Working Group!

We’ll:
👉 Define triage & policies
👉 Guide secure plugin development
👉 Improve report processes
👉 Promote best practices
👉 Support #OpenJS & #OpenSSF initiatives

github.com/webpack/secu...

GitHub - webpack/security-wg: Webpack Security Working Group

Webpack Security Working Group. Contribute to webpack/security-wg development by creating an account on GitHub.

github.com

1

Reposted by Ulises Gascón

Wes @notwes.bsky.social · Aug 19

The @expressjs.bsky.social project has helped transfer over iconv-lite (with the awesome effort of @bjohansebas.bsky.social). Hopefully we can be a good home for this package which adds another 446M monthly downloads to the projects scope.

github.com/pillarjs/ico...

GitHub - pillarjs/iconv-lite: Convert character encodings in pure javascript.

Convert character encodings in pure javascript. Contribute to pillarjs/iconv-lite development by creating an account on GitHub.

github.com

1 2 7

Ulises Gascón @ulisesgascon.com · Aug 19

Say hello to the newest member of the @expressjs.bsky.social family 👋

iconv-lite: Convert character encodings in pure #javascript.

And yes… a new release is baking in the oven 🔥

github.com/pillarjs/ico...

release: 0.7.0 by bjohansebas · Pull Request #334 · pillarjs/iconv-lite

I plan to release this version on Wednesday, 8/20/2025 cc: @wesleytodd @ashtuchkin @UlisesGascon I’ll check if we already agree on moving this package to expressjs/pillarjs :) so I can update the m...

github.com

1 2

Ulises Gascón @ulisesgascon.com · Aug 14

✨ The #OSPO Book is here!✨

github.com/todogroup/os...

Releases · todogroup/ospology

📖 OSPOlogy - The Study of OSPOs. Contribute to todogroup/ospology development by creating an account on GitHub.

github.com

Ulises Gascón @ulisesgascon.com · Aug 13

🚀 One step closer to #jQuery 4!
blog.jquery.com/2025/08/11/j...

jQuery 4.0.0 Release Candidate 1 | Official jQuery Blog

jQuery: The Write Less, Do More, JavaScript Library

blog.jquery.com