TypeScript.fm - The Friendly Show for TypeScript Developers

Liran Tal (lirantal.com) from Snyk joins us to dive deep into writing secure TypeScript applications. What's different compared to vanilla JavaScript security? Will schema validators fix all our woes? Can't we let LLMs find and fix security vulnerabilities? Liran educates us about the pitfalls and risks with misplacing trust in TypeScript and LLMs and what we can do to write more secure code.Chapters(00:00) - Introducing Liran Tal (02:56) - What's Special About TypeScript Security vs. JavaScript Security? (04:23) - Misplacing Trust in Types (05:49) - Practical Examples of TypeScript Security Issues (08:43) - Why Does TypeScript Security Matter? (10:23) - TypeScript is Not a Security Tool (11:14) - How Does HTTP Parameter Pollution Work? (12:45) - Ways to Mitigate Parameter Pollution (15:44) - Schema Validators Won't Always Save You (16:51) - How Prototype Pollution Works (18:23) - Exploiting Schema Validators Through Prototype Pollution (21:50) - Mitigating Prototype Pollution Risks (25:21) - Consequences of Prototype Pollution (27:23) - Ways to Safely Merge Objects (30:03) - How Can TypeScript Developers Improve Their Security Posture? (33:17) - How Do LLMs Impact Secure Coding? (39:11) - Misplacing Trust in AI-Generated Code (41:10) - Can LLMs Review and Fix Secure Code? (45:57) - So We're All Doomed, Right? (48:31) - Bonus: Game Development as a Teaching Tool (54:48) - Where to Find Liran LinksLiran's website and blogTalk: Friend or Foe? TypeScript Security FallaciesCourse: Node.js Security CourseBook: Essential Node.js SecurityBook: Serverless SecurityTool: npq (welcoming contributions!)https://github.com/lirantal/is-website-vulnerableGame: Dependency FrostPaper: Are AI-generated fixes secure? (July 2025)Sponsored by Excalibur.jsExcalibur.js is the friendly TypeScript game engine for making 2D web games. Use your TypeScript or JavaScript skills to make games! Excalibur comes out-of-the-box with everything you need to make web games, like physics, sprites, animations, sound effects, input, and particles. Design your assets with tools like Aseprite and Tiled, then load them natively using first-party plugins.MusicSeahorse Dreams by Kubbi (Spotify)

News of the week of July 21, 2025: Deno Fresh 2.0 is in alpha, TS 5.9 RC has some small changes, and beware the latest eslint-config-prettier supply chain attack. From the community: learn TypeScript for free in an hour, master generics through Soduku, run TS in the browser without a build step, and a library for modern TS dependency injection.Chapters(00:00) - Introduction and Personal News (07:14) - News: Try Out the Deno Fresh 2.0 Alpha (08:32) - News: TypeScript 5.9 RC Includes Some Small Fixes (09:22) - News: TSGo Adds @satisfies Support for JSDoc (09:44) - PSA: eslint-config-prettier Supply Chain Attack (10:35) - Correction: tsgolint and TSL Clarifications (12:25) - Community Highlight: Learn TS in One Hour by freeCodeCamp (12:53) - Community Highlight: Mastering TypeScript Mysteries by Sweta Tanwar (13:37) - Community Highlight: Using BigInt to Make Sure a String is a Well-formed Integer (14:38) - Community Highlight: tsbro Runs TypeScript in the Browser (16:28) - Community Highlight: pure-ts-mock is a Standalone Mocking Library (17:31) - Community Highlight: Custom SSR for Lit Web Components Using Deno Emit (19:33) - Community Highlight: Mastering TypeScript Types by Laxman Rathod (20:19) - Community Highlight: Building TypeScript Apps with Bun and Electron with electrobun (21:08) - Secret of the Handbook: const Generics (23:06) - Cool API: navigator.sendBeacon for Analytics (24:43) - Cool Lib: es-toolkit, A Modern JavaScript Utility Library (25:26) - Cool Lib: di-wise, a Zero Deps Dependency Injection Library for TS (26:29) - Cool Read: NIH is Far Cheaper Than the Wrong Dependency NewsDeno Fresh 2.0 is an alphaAnnouncing TypeScript 5.9 RC Popular npm linter packages hijacked via phishing to drop malware From the CommunityfreeCodeCamp: Learn TypeScript – Crash Course for Beginners (1 hour free course)City.js Conf: Sweta Tanwar - Mastering TypeScript MysteriesInteresting Type Inference Post using BigInts (Playground Link)stagas/tsbro: TypeScript for the Browserpure-ts-mock (bweet) is a minimalist, type-safe mocking libraryMatt Jennings pointed out a neat way to do SSR with Web Components (Lit) using Deno Emit and Deno Bundle Laxman Rathod: Mastering TypeScript Types: A Practical Guide from Basics to Advanced (h/t Shawn Wildermuth)Electrobun aims to be a complete solution-in-a-box for building, updating, and shipping ultra fast, tiny, and cross-platform desktop applications written in Typescript. Under the hood it uses bun to execute the main process and to bundle webview typescript, and has native bindings written in zig.Secret of the Handbook: Const Generics (playground link) (h/t sirpepe) Cool StuffNavigator: sendBeacon() methodtoss/es-toolkit: A modern JavaScript utility library that's 2-3 times faster and up to 97% smaller—a major upgrade to lodashexuanbo/di-wise: Lightweight and flexible dependency injection library for JavaScript and TypeScript, w/wo ECMAScript decoratorsClean Architecture in TypeScript | 弦而時習之 Lewis Campbell: NIH Is Far Cheaper Than The Wrong Dependency Learn Wardley MappingSponsored by Excalibur.jsExcalibur.js is the friendly TypeScript game engine for making 2D web games. Use your TypeScript or JavaScript skills to make games! Excalibur comes out-of-the-box with everything you need to make web games, like physics, sprites, animations, sound effects, input, and particles. Design your assets with tools like Aseprite and Tiled, then load them natively using first-party plugins.MusicSeahorse Dreams by Kubbi (Spotify)

News of the week of July 14, 2025: Nuxt 4.0 is released along with an acquisition by Vercel, TSGO ships go-to-type definition support, and Bun ships smarter types. From the community: test type completions and benchmark instantiations with a testing package from Arktype, treating types as values with type-level maps, and dive a bit deeper into how type inference works. Chapters(00:00) - Introduction and Personal News (06:02) - News: Nuxt 4.0 Release and NuxtLabs Joins Vercel (09:57) - News: TSGO Adds Go-to-type Definition Support (10:33) - News: Node 24.4.1 Security Patches (12:12) - News: Bun 1.2.19 Ships Smarter Types (13:21) - News: SvelteKit Now Supports Vite 7 and Rolldown (13:52) - Community Highlight: oxlint + tsgolint = no slowdown! (16:01) - Community Highlight: Type-safe Event Emitters by Artem (17:13) - Community Highlight: Understanding TypeScript's Type Inference by SharpCoderBlog (17:46) - Community Highlight: Testing Type Completions in TypeScript by Arktype (19:17) - Community Highlight: Type-safe Persistence and Auto-theming in Svelte 5 by Puru Vijay (19:59) - Community Highlight: Your GPU is a JavaScript Runtime by Iwo Plaza (20:54) - Community Highlight: DHH Hates TypeScript (22:15) - Community Highlight: Node and Deno Permissions Discussion by Dr. Axel (25:29) - Community Highlight: Treating Types as Values with Type-level Maps by Gregros (27:08) - Community Highlight: Return Types on Functions, Yay or Nay? by Kyle Shevlin (28:15) - Community Highlight: Jake and Josh Interview on Software Engineering Daily Podcast (28:34) - Cool Link: Dokploy is an OSS Alternative to Vercel, Netlify, and Heroku (30:07) - Cool Link: Turning a Toy Into a Cyberdeck by Attoparsec (30:52) - Cool Link: What's New in Vite by Evan You (31:38) - Cool Link: Add Windows to Your App with winbox.js (33:21) - Cool Link: Marginal Utility of Money by The Happy Philosopher (37:42) - Post-credits Banter Personal NewsSorry for the delay, Kamran just got back from vacation!Follow Kamran's trip on InstaNewsNuxt 4.0 is released and NuxtLabs joins Verceltypescript-go: Implement go-to-type-definition (PR #1405)Node.js 24.4.0 and 24.4.1 include high-severity CVE fixes (as well as 20.x, and 22.x release lines)Bun 1.2.19 is smarter when you are not using `dom` lib typesWhat’s new in Svelte: July 2025From the CommunityBoshen: oxlint + tsgolint = no slowdown! no-floating-promises completes 4.4k files in 3.2 seconds, in the vscode repo.Artem: rettime, a type-safe event emitterSharpCoderBlog: Deep Dive into TS Type InferenceArktype: Testing Type Completions with @ark/attest (bsky thread)Puru Vijay: Type-Safe Persistence and Auto-Theming in Svelte 5Iwo Plaza: Your GPU is a JavaScript runtime* (TypeGPU deep-dive) DHH: I hate TypeScriptDiscussion: Per-module or Per-dependency Permissions?Greg Rosenbaum: Treating types as values with type-level mapsKyle Shevlin: Return types on functions, yay or nay?Software Engineering Daily Podcast: TypeScript with Jake BaileyCool StuffTool: dokploy is an OSS alternative to Netlify Video: Turning a toy into a cyberdeckVideo: What's New in Vite Explained by Its Creator Library: Put Windows in Your Web App with WinBox.jsBlog: How Understanding the Marginal Utility of Money Will Make you Happier Sponsored by Excalibur.jsExcalibur.js is the friendly TypeScript game engine for making 2D web games. Use your TypeScript or JavaScript skills to make games! Excalibur comes out-of-the-box with everything you need to make web games, like physics, sprites, animations, sound effects, input, and particles. Design your assets with tools like Aseprite and Tiled, then load them natively using first-party plugins.MusicSeahorse Dreams by Kubbi (Spotify)

News of the week of July 7, 2025: We dive into the TypeScript 5.9 beta, an experimental Go linter for TS/JS, plus make sure you upgrade your Node.js versions! From the community: a new enum syntax proposal in case JS doesn't get native enums, TSL brings faster type-aware linting, and trashh_dev asks TypeScript: WTF?Chapters(00:00) - Introduction and Personal News (07:10) - News: TypeScript 5.9 Beta (19:42) - News: tsgolint, an Experimental JS/TS Native Linter (21:56) - PSA: Upgrade Your Node.js 20.x, 22.x, and 24.x Installations (22:46) - Community Highlight: TSL, a New Type-aware Linter (25:00) - Community Highlight: New typescript-eslint Homepage Preview (26:04) - Community Highlight: New Enum Syntax Proposal by Naman (29:53) - Community Highlight: WTF TypeScript by trashh_dev (31:27) - Community Highlight: Migrating MorphKit to NativeScript with LLMs (33:47) - Community Highlight: ariadne-ts Brings Rust-style Diagnostic Messages to TS (35:20) - Cool Link: Get Current Weather in Your Terminal (36:12) - Cool Link: JSON Repair (37:09) - Cool Link: aws/jsii Lets You Consume TS Libs from Python, Java, and C# (39:38) - Cool Link: Check Road Conditions in Colorado with cotrip.org Personal NewsSorry for the delay, Kamran's on vacation!Follow Kamran's trip on InstaNewsAnnouncing TypeScript 5.9 Beta tsgolint, an experimental proof-of-concept typescript-go powered JS/TS linter written in GoPSA: High-severity security patches coming to Node.js on Patch Tuesday for 24.x, 22.x, and 20.x release lines!From the CommunityArnaud Barré: Introducing tsl, an extension of tsc for type-aware linting!Joshua Goldberg: New TypeScript Eslint homepageNaman: New enum syntax for TypeScript Chris Batiste (trashh_dev): WTF Typescript nStudio: Morphing Swift to 100% TypeScript with NativeScript + AIAriadne-ts v0.3.0: Beautiful Diagnostics in TypeScript (h/t Reddit)Cool Stuffaws/jsii allows code in any language to naturally interact with JavaScript classesCOtrip.org – get road conditions in Colorado`curl wttr.in` -- Weather from the terminaljosdejong/jsonrepair: Repair invalid JSON documents Sponsored by Excalibur.jsExcalibur.js is the friendly TypeScript game engine for making 2D web games. Use your TypeScript or JavaScript skills to make games! Excalibur comes out-of-the-box with everything you need to make web games, like physics, sprites, animations, sound effects, input, and particles. Design your assets with tools like Aseprite and Tiled, then load them natively using first-party plugins.MusicSeahorse Dreams by Kubbi (Spotify)

News of the week of June 30, 2025, Deno Bundle is Back in Black in 2.4! We coin the term "Bweet", Deno also gets some non-standard import attributes for text and bytes, OTEL is now stable in Deno, and Next.js has a DoS vulnerability. From the community: we chat about modern Node.js patterns for 2025, NDC Oslo talks are rolling in on YouTube, and strongly type your MongoDB collections!ChaptersPersonal NewsShure MV7+ MicrophoneExcalibur Playground Prototype is Live (Thanks for the Pong Game Chris K!)Playing with Monaco code EditorArch Linux and "Ricing"NewsDeno 2.4 is released and it's JAM PACKED!PSA: For Next.js users: CVE-2025-49826 - VercelFrom the CommunityNode.js LGBTQIA+ Stories: Emelia Smith“The largest change I made to Node.js was splitting up the documentation into multiple files and pages, prior to this change, all the documentation had been on a single large page only.”Modern Node.js Patterns for 2025 (kashw1n)Undici DocsUndici Blog PostNDC Oslo 2025 Talks are Rolling outA Deep Dive into Advanced TypeScript: A Live Coding Expedition Christian WoerzKeynote CTRL+SHIFT+(BUILD) PAUSE - Laila BougriaNPM Specifiers in Node (Deno YouTube)Trace Resolution is very handy about type check errors in libraries (@literat.dev)“TIL: Using `tsc --traceResolution` is very handy to get information about why the heck TypeScript is raising an error about the file that should not be part of the library, but it is included during the type check 😅”Typing MongoDB Collections in TypeScript (Daniel Perez) From the vault, Feb 2025: Migrating 160,000 Lines of Production Banking JavaScript to TypeScript with Zero Downtime (Ben Howdle)Cool StuffAll things NeoVim, Arch, Hyprland, and tech goodness YouTube Channel TypecraftCGI TodayLocal-first software: You own your data, in spite of the cloudLocalFirstConfSponsored by Excalibur.jsExcalibur.js is the friendly TypeScript game engine for making 2D web games. Use your TypeScript or JavaScript skills to make games! Excalibur comes out-of-the-box with everything you need to make web games, like physics, sprites, animations, sound effects, input, and particles. Design your assets with tools like Aseprite and Tiled, then load them natively using first-party plugins.MusicSeahorse Dreams by Kubbi (Spotify)

News for the week of June 23, 2025: Ecma ratifies ES2025 standard, Vite 7 is mostly deprecations, Oracle gets a free pass, and the experimental type stripping warning is... stripped... from latest Node LTS releases. From the community: 6 advanced TS tricks, a new type-safe WebSockets API, and RegEx tips. Chapters(00:00) - Introduction and Personal News (04:59) - News: ECMAScript 2025 is Here (07:06) - News: Vite 7.0 is Out (10:15) - News: Node 24.3.0 and 22.17.0 LTS Releases (10:39) - News: Oracle v Deno Trademark Fraud Claim is Dismissed (12:04) - News: Astro 5.10 Introduces Experimental Live Content Collections (12:34) - Community Highlight: 6 Advanced TS Tricks by OlegWock (15:54) - Community Highlight: TypeScript Stuff I Wish I Knew Earlier (19:52) - Community Highlight: zap-socket Offers a TypeScript-first WebSocket API (20:42) - Community Highlight: Dr. Axel Shares Tips for Making Regular Expressions Better in JS (22:01) - Community Highlight: Functional Programming Examples in TS (22:50) - Community Highlight: Exhaustiveness Checking with never (24:12) - Community Highlight: Deno Adding Support for Import Type Text and Bytes (24:39) - Community Highlight: Importing JSON as const (26:37) - Community Highlight: Branded Types Example with ArkType (27:21) - Cool API: Promise.try Nuances Erik Realized After the Fact (29:48) - Cool Watch: Mitchell Hashimoto's Talk on Testing (30:44) - Cool Listen: Jake Archibald on Why We Don't Have HTML Imports (31:25) - Cool Link: PNG 3.0 Spec (32:41) - Cool Link: Invite an Eagle to Your Zoom Meeting (33:41) - Cool Read: Node.js Celebrates Pride Month NewsEcma International approves ECMAScript 2025: What’s new? Vite 7.0 is out and deprecates a bunch of stuffOracle fraud claim is dismissed in the latest JavaScript™ Trademark Update from DenoAstro 5.10 brings experimental Live Content CollectionsFrom the Community6 advanced TypeScript tricks · OlegWock (h/t Reddit)TypeScript stuff I Wish I Knew Earlier (h/t Reddit)Use https://github.com/type-challenges/type-challenges to become a generic Godzap-socket – A Typescript-first abstraction over WebSockets (h/t Reddit)Blog post: My attempt at fixing websockets Dr. Axel's tips for making regular expressions easier to use in JavaScript Functional Programming tips in TypeScript by Kanishka NaikAlgebraic Data TypesMonoids and Semigroups Pattern Matching Lazy Evaluation Exhaustive Checks with never by NicoImport types text and bytes coming to Deno 2.4 via David SherretImporting JSON config as const via cinny.bun.how (+ tracking TS issue)Example of using branded (nominal) types in ArkTypeCool StuffErik's neovim config is open source (one of us! one of us!)API: Promise.tryTalk: Can we test it? Yes, was can! - Mitchell Hashimoto (co-founder of Hashicorp)Listen: Jake Archibald on Native HTML Includes (ShopTalk)Read: PNG is back! by Chris Blume who chairs the PNG working groupRead: New version of PNG to challenge AVIF and WebP for image dominance on the webInvite: Pay to have an eagle, owl or falcon join your Zoom meetingRead: Node.js series to celebrate Pride MonthSponsored by Excalibur.jsExcalibur.js is the friendly TypeScript game engine for making 2D web games. Use your TypeScript or JavaScript skills to make games! Excalibur comes out-of-the-box with everything you need to make web games, like physics, sprites, animations, sound effects, input, and particles. Design your assets with tools like Aseprite and Tiled, then load them natively using first-party plugins.MusicSeahorse Dreams by Kubbi (Spotify)

Discover the latest advancements in TypeScript with features like Biome v2's type-aware linting. Mocha and Jest have both upgraded to support native ESM and TypeScript. Explore Grafana's k6 now offering TypeScript testing. Learn about exciting community contributions focused on type safety and better import maps. Dive into the challenges and joys of outdoor adventures paired with discussions about balancing work and personal projects. Plus, uncover the utility of `promise.try` for efficient function management!

The latest news features the launch of Amaro 1.0, a Node.js type stripping wrapper. Discover the super-fast Oxlint, set to revolutionize linting speeds, 50-100 times faster than ESLint! Pnpm introduces an experimental virtual store to expedite package installations. The community shines with highlights like TypeFire, a new meta programming framework, and Justin, a nifty JIT schema validation library. Plus, learn about the new edition of the 'Exploring JavaScript' book and the exciting transition of React Final Form from Flow to TypeScript!

News for the week of June 2, 2025: TSC init command gets new, modern defaults, plus new betas drop for Vite 7 and Babel 8. From the community: Learn advanced TS features in 25 mins, and improve the performance of your TS monorepos with secret arcane knowledge.Chapters(00:00) - Introduction and Personal Updates (02:26) - News: tsc --init Finally Has New Defaults (04:39) - News: Deferred Imports Syntax Will Land in TS 5.9 (06:38) - News: Vitest 3.2 Brings Annotations, Better TS Support (08:21) - News: Vite 7 Beta (09:17) - News: Babel 8 Beta (10:49) - News: Storybook 9 Adds Interaction Tests, A11y Improvements (11:54) - News: TC39 Proposal Advancements (14:54) - News: IRS Uses TypeScript and React (16:50) - Community Highlight: The M.I.N.T. Principle by Sean Maxwell (22:07) - Community Highlight: Advanced TS by Web Dev Simplified (22:32) - Community Highlight: TS Monorepo Tips by Mike Hartington and Colin Hacks (24:30) - Community Highlight: Learn How Signals Work in TypeScript by Jon Kuperman (25:32) - Community Highlight: Your Feedback! (27:07) - Cool Stuff: Reverse-Engineering Linear's Sync Engine (28:09) - Cool Stuff: Chrome Performance Profiler Gets a Facelift Newstsc --init gets new defaults (h/t Rob Palmer)TypeScript 5.9 gets import deferred (h/t Rob Palmer)Vitest 3.2 is out!Vite 7 beta changelog entryAnnouncing Babel 8 Beta Storybook 9 Bluesky breakdown threadTC39 proposals advanceThe IRS Tax Filing Software TurboTax Is Trying to Kill Just Got Open SourcedFrom the CommunityThe MINT Principle – When to use object-oriented programming in TypeScript (h/t Reddit)Learn Advanced TypeScript In 25 Minutes (infer, extends, ternaries) Mike Hartington gave a talk on TypeScript performanceLive types in a TypeScript monorepo (Colin Hacks)Learn Signals by reading TypeScript (Jon Kuperman)Cool StuffReverse-engineering Linear's sync engineChrome personal profiler changes (Paul Irish)Sponsored by Excalibur.jsExcalibur.js is the friendly TypeScript game engine for making 2D web games. Use your TypeScript or JavaScript skills to make games! Excalibur comes out-of-the-box with everything you need to make web games, like physics, sprites, animations, sound effects, input, and particles. Design your assets with tools like Aseprite and Tiled, then load them natively using first-party plugins.MusicSeahorse Dreams by Kubbi (Spotify)

Jason Yu (ycmjason.codes) joins us to share an open source tool he created to help teams migrate their legacy TSConfig compiler options to modern-day options painlessly and progressively. Learn about his experience implementing strict options on big teams, how it inspired his new tool, and how you can take advantage of it right now!Chapters(00:00) - Meet Jason Yu (03:27) - Challenges of Migrating Legacy TypeScript (05:44) - What is ts-migrating? (07:01) - How Does ts-migrating Help Migrate TSConfig? (09:05) - What Does the ts-migrating CLI Do? (10:02) - How Do You Migrate Incrementally? (11:16) - How Do You Get Started with ts-migrating? (12:06) - Tackling the Migration in Small Chunks (13:12) - How Does This Compare to Using Folder-based TSConfig? (14:12) - What About ts-expect-error and ts-ignore Directives? (16:25) - What About Multiple TSConfigs? (17:34) - Are There Any Unsupported Compiler Options? (19:28) - How Do You Build a TypeScript LSP Plugin? (22:18) - How Will This Work with TS 7 (Go Native Port)? (23:57) - Advice for Teams Migrating TSConfig (25:52) - Jason's Favorite Coding Principles (32:42) - Where to Follow Jason Online LinksJason’s Links: https://ycmjason.codes Migrate your TSConfig incrementally: https://github.com/ycmjason/ts-migrating Blog / Video: 7 Modern Use Cases of IIFE ts-migrating Inspiration: https://github.com/allegro/typescript-strict-pluginMS Docs: Writing a Language Service PluginSponsored by Excalibur.jsExcalibur.js is the friendly TypeScript game engine for making 2D web games. Use your TypeScript or JavaScript skills to make games! Excalibur comes out-of-the-box with everything you need to make web games, like physics, sprites, animations, sound effects, input, and particles. Design your assets with tools like Aseprite and Tiled, then load them natively using first-party plugins.MusicSeahorse Dreams by Kubbi (Spotify)