ReactConf 2025 Highlights, Bun 1.3's Security Scanner API, and Malware-as-a-Service | News | Ep 39

TypeScript.fm - The Friendly Show for TypeScript Developers

News of the week of October 6, 2025: Highlights from ReactConf 2025, Bun 1.3's (delicious) security lede got buried, and how to buy lifetime access to someone's webcam for $500. From the community: CSS is cool again, Immer.js perf improvements, and why typed linting is blocked by ESLint core.

Chapters

• (00:00) - Welcome to the Show
• (05:52) - News: ReactConf 2025 Highlights
• (15:53) - News: Bun 1.3 Highlights
• (20:59) - News: VS 2026 Now Includes TypeScript 7 Native Preview
• (21:33) - News: TC39 Async Context
• (22:51) - News: TC39 Module Declarations
• (24:40) - News: TC39 Defer Import Evaluation Moves to Stage 3
• (25:11) - News: Vite+ Announcement
• (27:43) - PSA: StealIt Malware Uses Node SEAs to Bypass Scanners
• (30:26) - Community Highlight: Dr. Axel's Schools Us in CSS
• (32:07) - Community Highlight: Why Typed Linting is Blocked by ESLint Core
• (32:30) - Community Highlight: Immer.js Perf Improvements Landing Soon
• (33:25) - Community Highlight: Unofficial 1Password TS Library
• (35:02) - Community Highlight: Joke of the Week
• (35:21) - Cool Link: Kagi, the Premium Search Engine
• (39:19) - Cool Videos: Mojo, Simulating Smoke, and How UTF-8 Works
• (40:54) - Cool Link: Twoslash Provides Rich Type Metadata for Docs
• (41:51) - The Minnesota Long Goodbye

News

• ReactConf: React 19.2 dropped
• ReactConf: React Compiler 1.0 dropped (reminded Erik of this old ditty)
• ReactConf: React Foundation
• Bun 1.3
• VS 2026 has TS 7 preview
• TC39: Module Declarations
• TC39: Defer Import Eval advances to stage 3
• Vite+ unifies enterprise JS tooling
• PSA: Stealit Malware Abuses Node.js Single Executable Feature via Game and VPN Installers

From the Community

• Dr. Axel: CSS: Learn the essentials quickly
• Josh Goldberg: Why typed linting optimization blocked by ESLint core
• Library Watch: Immer.js perf improvements on the horizon
• Blog Post: Stopping Bad Actors: Inside 1Password’s Security Model

Cool Stuff

• Cool Product: Kagi Search, the premium search engine you pay for
• Cool Video: GPU Programming and Language Design with Chris Lattner
• Cool Video: Coding Adventure: Simulating Smoke
• Cool Video: UTF-8, Explained Simply
• Cool Library: Twoslash, generate TS metadata for interactive docs snippets
• Cool Read: Chris Coyier’s CSS starter
• Cool Read: Innovate, Leverage, Commoditize (ILC model) strategic gameplay

Sponsored by Excalibur.js
Excalibur.js is the friendly TypeScript game engine for making 2D web games. Use your TypeScript or JavaScript skills to make games! Excalibur comes out-of-the-box with everything you need to make web games, like physics, sprites, animations, sound effects, input, and particles. Design your assets with tools like Aseprite and Tiled, then load them natively using first-party plugins.

Music
Seahorse Dreams by Kubbi (Spotify)