---
title: "Create videos with HTML and JavaScript via HyperFrames"
publication: "JavaScript Weekly"
issue: 782
published_at: "2026-04-21"
canonical_url: "https://javascriptweekly.com/issues/782"
---
Plus two handy new Git features, Bun's testing story gets stronger, and the fake star economy.
#782 — April 21, 2026
[Read on the Web](https://javascriptweekly.com/issues/782)
Together with [](https://www.meticulous.ai/?utm_source=jsweekly&utm_medium=newsletter&utm_campaign=26q2&utm_content=primary)
JavaScript Weekly
[](https://hyperframes.heygen.com/)
[HyperFrames: Write HTML and JavaScript to Create Videos](https://hyperframes.heygen.com/) — An open-source framework for creating and rendering videos with HTML and JavaScript. Essentially a simpler non-React alternative to [Remotion](https://www.remotion.dev/). It includes a variety of [built-in blocks/components](https://hyperframes.heygen.com/catalog/blocks/instagram-follow) for common video effects and elements, and can also [composite existing video](https://hyperframes.heygen.com/concepts/compositions) and audio clips. [GitHub repo.](https://github.com/heygen-com/hyperframes#readme)
HeyGen [](https://www.meticulous.ai/?utm_source=jsweekly&utm_medium=newsletter&utm_campaign=26q2&utm_content=primary)
[Still Writing Tests Manually? Meticulous AI Is Here](https://www.meticulous.ai/?utm_source=jsweekly&utm_medium=newsletter&utm_campaign=26q2&utm_content=primary) — Notion, Dropbox, Wiz and LaunchDarkly now use a testing paradigm they can’t work without. Built by former Palantir engineers, Meticulous automatically creates an evolving suite of E2E UI tests, delivering exhaustive coverage with no developer effort.
Meticulous sponsor
[The Vercel Breach That Started with a Roblox Cheat](https://vercel.com/kb/bulletin/vercel-april-2026-security-incident) — An employee of an AI tool provider used by a Vercel employee was compromised by malware ([bundled with a Roblox cheat!](https://webmatrices.com/post/how-a-roblox-cheat-and-one-ai-tool-brought-down-vercel-s-entire-platform)) and the attacker used that foothold, by way of Google Workspace, to reach a subset of Vercel customers’ environment variables.
Vercel
💡 Vercel users should [follow these steps](https://vercel.com/kb/bulletin/vercel-april-2026-security-incident#recommendations), but even if you're not one, the weak link was an OAuth grant to a third-party tool, and that pattern is nearly universal.
**IN BRIEF:**
- [Node.js is moving to support the Temporal API by default](https://github.com/nodejs/node/pull/61806), most likely in Node v26 which is [expected next week.](https://github.com/nodejs/node/pull/62526#issuecomment-4282061307)
- _Salesforce_ ecosystem devs are used to using specific frameworks within its walled garden; now [you can build native React apps on Salesforce](https://developer.salesforce.com/blogs/2026/04/build-with-react-run-on-salesforce-introducing-salesforce-multi-framework).
- Rust's official package/crate registry, [crates.io](https://crates.io/), is [migrating from Ember.js to Svelte 5.](https://blog.rust-lang.org/inside-rust/2026/04/17/crates-io-svelte-public-testing/)
**RELEASES:**
- [Node.js 24.15.0 (LTS)](https://nodejs.org/en/blog/release/v24.15.0) – `require(esm)` and the module compile cache are marked as stable, and `--max-heap-size` has been added.
- [Fable 5.0](https://fable.io/) – A mature F# transpiler that targets JavaScript (plus other languages). [v5.0](https://github.com/fable-compiler/Fable/releases/tag/5.0.0) adds .NET 10 and F# 10 support.
- [uuid 14.0](https://github.com/uuidjs/uuid) – Create RFC9562-compliant UUIDs (v1 through v7).
📖 Articles and Videos
[](https://www.youtube.com/watch?v=a9_Ud5MFTjU)
▶[Evan You's _State of Vue 2026_ Talk](https://www.youtube.com/watch?v=a9_Ud5MFTjU) — A month ago, Evan You (of Vue.js and VoidZero fame) gave his annual address. Less Vue-focused than usual (though _[Vapor Mode](https://github.com/vuejs/core/releases/tag/v3.6.0-beta.1)_ is “almost ready”), the talk focuses on Vite-ecosystem updates covering [Vite 8](https://vite.dev/blog/announcing-vite8), [Vite+](https://viteplus.dev/), and [Void.](https://void.cloud/)
Evan You / Vue.js Amsterdam
[How I Resolved 15K Circular Dependencies](https://stefanhaas.xyz/article/15k-circular-dependencies/) — A senior Microsoft engineer’s retrospective of clearing ~15,000 project-level circular dependencies from a 7 million line(!) TypeScript monorepo, with reusable ideas for anyone wrangling a large TS workspace. **For some reason this article no longer exists as of April 24.**
Stefan Haas
[Your Agent Ships 10 Ideas a Day. You Get 2 Databases?](https://ghost.build/?utm_source=content-syndication&utm_medium=referral&utm_campaign=javascript-weekly-newsletter) — Your agent builds faster than a 2-project free tier allows. _ghost_ gives it unlimited Postgres. 1TB storage. [Try free](https://ghost.build/?utm_source=content-syndication&utm_medium=referral&utm_campaign=javascript-weekly-newsletter).
ghost sponsor
[The Vertical Codebase](https://tkdodo.eu/blog/the-vertical-codebase) — Structuring an app with folders like `components/`, `hooks/`, and `utils/` feels tidy at first, but gets harder to live with over time. Dominik makes the case for a vertical, domain-first approach.
Dominik Dorfmeister
🔒 [The OWASP NPM Security Best Practices Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/NPM_Security_Cheat_Sheet.html) — A useful, long-standing checklist that continues to be updated with recent updates tackling disabling lifecycle scripts, typosquatting, trusted publishing, and dependency confusion.
OWASP Cheat Sheet Series
[How We Made the Angular Compiler Faster Using AI](https://voidzero.dev/posts/oxc-angular-compiler) — Two of VoidZero’s developers wanted to see how fast an Angular compiler they could make. Very fast, it turns out.
Brooklyn and Michael Dong (VoidZero)
📄 [Why I Don't Chain Everything in JavaScript Anymore](https://allthingssmitty.com/2026/04/20/why-i-dont-chain-everything-in-javascript-anymore/) – Long chains of methods vs. an easier-to-read sequence. Matt Smith
📄 [The Scope of Type Guards and Assertion Functions](https://www.stefanjudis.com/today-i-learned/the-scope-of-type-guards-and-assertion-functions/) Stefan Judis
🛠 Code & Tools
[](https://bun.com/blog/bun-v1.3.13)
[Bun v1.3.13: Smarter Testing, Streaming Installs, and Less Memory](https://bun.com/blog/bun-v1.3.13) — The [Bun](https://bun.com/) runtime has had a great run of releases, including last week’s [v1.3.12](https://bun.com/blog/bun-v1.3.12) with built-in browser automation. Now, `bun test` gets numerous enhancements with `--isolate`, `--parallel`, `--shard` and `--changed` options for test env isolation, parallelization, and to run only test files affected by recent changes. The runtime [now uses 5% less memory](https://bun.com/blog/bun-v1.3.13#bun-s-runtime-uses-5-less-memory), `bun install` gets faster, and more.
Jarred Sumner
[Introducing B2B Authentication](https://go.clerk.com/X65DFZS) — Clerk combines Organizations, SCIM, SSO, RBAC, invites, and billing to build enterprise-ready apps.
Clerk sponsor
[Animata: Over 100 Animated React Components](https://animata.design/) — A suite of novel animation-focused React components you don't often see elsewhere, including [animated beams](https://animata.design/docs/background/animated-beam), [spreading cards](https://animata.design/docs/card/card-spread), and [a Slack-style intro screen](https://animata.design/docs/hero/slack-intro).
Codse
📄 [officeParser: A Library to Parse Common Office-Related Formats](https://officeparser.harshankur.com/) — Work with formats like `docx`, `pptx`, `xlsx`, `odt` and others used by office suites, both in the browser and server-side. [GitHub repo.](https://github.com/harshankur/officeParser)
Harsh Ankur
🎵 [tiks: Procedural UI Sounds for the Web](https://rexa-developer.github.io/tiks/) — Clicks, pops and pings synthesized with the Web Audio API (so it’s tiny).
Rexa
- [TypeGPU 0.11](https://github.com/software-mansion/TypeGPU) – TypeScript WebGPU toolkit with advanced type inference and the ability to write shaders in TypeScript.
- 📺 [Shaka Player 5.1](https://github.com/shaka-project/shaka-player) – JavaScript library for adaptive media playback supporting DASH and HLS. ([Demos.](https://shaka-project.github.io/shaka-player/demo/))
- [TiddlyWiki 5.4](https://tiddlywiki.com/) – Self-contained JavaScript wiki for personal use. ([Repo.](https://github.com/TiddlyWiki/TiddlyWiki5))
- ✂️ [Knip 6.6](https://github.com/webpro-nl/knip/releases/tag/knip%406.6.0) – Popular tool for finding and removing unused files, dependencies and exports.
- [wasm-xlsxwriter 0.13](https://github.com/estie-inc/wasm-xlsxwriter) – Generate Excel files in the browser or Node.
- [React Three Fiber 9.6](https://github.com/pmndrs/react-three-fiber/releases/tag/v9.6.0) – The React renderer for Three.js.
- [np 11.2](https://github.com/sindresorhus/np) – A better `npm publish`.
📰 Classifieds
[HyperFormula AI SDK](https://eu1.hubs.ly/H0tzk_60): Give LLMs a deterministic engine to safely read, write, and calculate spreadsheet formulas. No hallucinated math.
---
[Gauntlet AI Night School](https://us06web.zoom.us/webinar/register/1617760893475/WN_P79TrYY5R8Cru6xEDkwKcw) | RAG that holds up in production requires evaluation built in from the start. Learn how. (Virtual — 4/22)
---
Builders Learn from Builders. From one builder to another: Join Mark Rober at Twilio SIGNAL, May 6–7 in San Francisco. [Register for a discounted developer ticket here!](https://signal.twilio.com/2026/register?code=DEVNET26&utm_campaign=signal&utm_medium=email&utm_source=javascriptweekly)
📢 Elsewhere in the ecosystem
[](https://github.blog/open-source/git/highlights-from-git-2-54/)
- [Git 2.54 has been released](https://github.blog/open-source/git/highlights-from-git-2-54/) with a couple of headline features: `git history` offers a new, easy way to edit commit messages or interactively split a commit into two. You can now define hooks in config files (whether in a repo, at user level, or even system level) rather than just in `.git/hooks`. You can also run multiple hooks for the same event in this way.
- If you ever work with _Ruby on Rails_, [you might find `rails_vite` interesting.](https://evilmartians.com/chronicles/now-you-see-it-vite-on-rails-without-the-proxy) It's a new tool that seamlessly brings the power of [Vite](https://vite.dev/) into Rails' pipeline.
- 💥 Anyone who's analyzed GitHub projects for a while knows this already, but [there's a huge 'fake star' economy](https://awesomeagents.ai/news/github-fake-stars-investigation/) where people pay to make their projects look more popular than they are.
- Isa Yeter explains [how he migrated from DigitalOcean to Hetzner](https://isayeter.com/posts/digitalocean-to-hetzner-migration/) slashing his hosting bill by 84% in the process.
- Cloudflare has released [a preview of its new `cf` CLI tool](https://blog.cloudflare.com/cf-cli-local-explorer/) for working with its various services.
Published by [Cooperpress](https://cooperpress.com/) and edited by [Peter Cooper](https://twitter.com/cooperx86)
'JavaScript' is a trademark of Oracle Corporation in the US
We are not endorsed by or affiliated with Oracle.
[Change your email address](https://javascriptweekly.com/edit_subscription/*|UID|*) or [stop getting this newsletter](https://javascriptweekly.com/leave/*|UID|*).
© Cooper Press Ltd · Fairfield Enterprise Centre, Louth, LN11 0LS, United Kingdom