--- title: "JavaScript desktop apps in under 10MB" publication: "JavaScript Weekly" issue: 803 published_at: "2026-09-22" canonical_url: "https://javascriptweekly.com/issues/803" --- Plus Plotly.js 4, Google's mole inside a supply chain hacking gang, and Evan You predicting 'slop forks'. #​803 — September 22, 2026 [Read on the Web](https://javascriptweekly.com/issues/803) Together with [![ParadeDB\](https://res.cloudinary.com/cpress/image/upload/c_fill,g_auto,e_trim,w_1280,h_164/e_make_transparent/co_white,e_outline:17/cdd8ciarsq6m8xam8oc3.png)](https://github.com/paradedb/drizzle-paradedb) JavaScript Weekly [![\](https://res.cloudinary.com/cpress/image/upload/w_1280,e_sharpen:60,q_auto/l5ejacd7rpbkelmaxdto.jpg)](https://tinyjs.app/) [tinyjs: Build JavaScript Desktop Apps in <10MB](https://tinyjs.app/) — I built an app with this and was impressed. You get a [txiki.js](https://github.com/saghul/txiki.js/)-powered backend with full system access (including FFI!), native webview rendering, and tiny macOS, Linux, and Windows builds. It even makes it easy to sign/notarize the final app. Tarwin Stroh-Spijer There are lots of great options in this space though: - [Electrobun](https://blackboard.sh/electrobun/) offers richer multi-window and GPU features, at the cost of a larger TypeScript runtime – though it can instead use Zig, Rust, Go, or Odin for a tiny native main process. - [Perry](https://www.perryts.com/) is a TypeScript to native AOT compiler whose primary UI model renders AppKit, Win32 and GTK4 widgets for a more conventionally native feel. - [Electron](https://www.electronjs.org/) and the experimental [Deno Desktop](https://deno.com/blog/v2.9#deno-desktop) are powerful, but their executables typically run several times larger. - [Neutralinojs](https://neutralino.js.org/) apps can be even smaller than tinyjs's, but you lose the general-purpose JavaScript privileged backend by design. [![\](https://res.cloudinary.com/cpress/image/upload/c_limit,w_480,h_480,q_auto/copm/5c853e9e.png)](https://github.com/paradedb/drizzle-paradedb) [Full-Text Search in Drizzle Without a Second System](https://github.com/paradedb/drizzle-paradedb) — Try the official ParadeDB integration for Drizzle. Search your live Postgres tables. No ETL, no Elasticsearch. ParadeDB cloud coming soon. ParadeDB sponsor [Persistent Databases in the Browser with DuckDB-Wasm and OPFS](https://duckdb.org/2026/09/18/opfs-wasm) — A walkthrough of running [DuckDB](https://duckdb.org/) in the browser with a database file that survives reloads using the [Origin Private File System](https://developer.mozilla.org/en-US/docs/Web/API/File_System_API/Origin_private_file_system) now supported by all major browsers. Piovesan and Wielenga (DuckDB) [How Linear Reworked Its CI for 4x the Tests](https://linear.app/now/ci-bottleneck-reworked) — Eager agents grew Linear's test suite, and its CI costs with it! They share some remedies: rewriting type-aware ESLint rules as plain AST checks cut lint time 55% and eased a move to [Oxlint](https://oxc.rs/docs/guide/usage/linter), while selectively turning off Vitest's isolation saved a further 17% a month. Mufeez Amjad (Linear) **IN BRIEF:** - Lovable [rewrote Vite's dev server in Rust](https://lovable.dev/blog/faster-previews-oj) (calling it [OJ](https://rapha.land/introducing-oj/)) for performance reasons, but Evan You [disputes the benchmark](https://socket.dev/blog/oj-vite-rust) and predicts AI will have everyone maintaining _"their own slop fork"_. - 📊 [npmchart.com](https://www.npmchart.com/) plots download trends, releases and repo activity for any npm package (here's [Svelte's](https://www.npmchart.com/p/svelte), for example), and lets you compare packages. - 🔒 npm now offers [stage-only tokens](https://github.blog/changelog/2026-09-18-stage-only-npm-tokens-for-safer-automation/) to let automated workflows stage a release for a maintainer to approve with 2FA. This offers a migration path for those who can't move to [trusted publishing](https://docs.npmjs.com/trusted-publishers) yet. **RELEASES:** - [Turborepo 2.11](https://turborepo.dev/blog/2-11) – Experimental Rust, Python and Go support joins the task graph, plus up to 4x faster startup over 2.9. - [ESLint 10.11.0](https://eslint.org/blog/2026/09/eslint-v10.11.0-released/) – Performance update with faster startup and linting. - [Node.js 26.10.0 (Current)](https://nodejs.org/en/blog/release/v26.10.0) – Adds [`util.debounce`/`throttle`](https://github.com/nodejs/node/pull/65899). - 📊 [billboard.js 4.1](https://netil.medium.com/billboard-js-4-1-0-live-resizing-configurable-subchart-react-subpath-csp-safe-worker-e1a6fd0ece88), [QuickJS-ng 0.17.0](https://github.com/quickjs-ng/quickjs/releases/tag/v0.17.0), [VueUse 15.0](https://github.com/vueuse/vueuse/releases/tag/v15.0.0) 📖 Articles and Videos [An Undercover Analyst Infiltrated the Gang Behind 'Mini Shai-Hulud'](https://www.wired.com/story/an-undercover-google-analyst-infiltrated-a-notorious-supply-chain-hacking-gang/) — Bad news for the group behind this spring's cascading supply chain attacks… Google had a mole in their group chat! WIRED explains how the group was monitored and disrupted, leading to [two recent arrests](https://www.afp.gov.au/news-centre/media-release/two-wa-men-charged-following-afp-fbi-wapf-disruption-alleged-global). Andy Greenberg (WIRED) [The V8 Runtime Undermined My Constant-Time JavaScript Library](https://soatok.blog/2026/09/12/the-v8-javascript-runtime-undermined-my-constant-time-javascript-library/) — A look at how even branchless JavaScript can leak secrets through CPU cache behavior, due to quirks in how V8 handles booleans and `-0`. Soatok Dreamseeker [Your UI Isn't Slow. It's Waiting on the Data](https://www.tigerdata.com/go/trial?utm_source=content-syndication&utm_medium=referral&utm_campaign=javascript-weekly-newsletter) — TimescaleDB extends Postgres so the data behind your UI loads fast as it grows. [Get $1000 credit to start](https://www.tigerdata.com/go/trial?utm_source=content-syndication&utm_medium=referral&utm_campaign=javascript-weekly-newsletter). Tiger Data (creators of TimescaleDB) sponsor [Do Frameworks Matter Anymore?](https://brookslybrand.com/posts/do-frameworks-matter-anymore/) — If you're using AI, you're either using a framework or your agent is building an ad-hoc one on the fly. A Remix team member argues that's a good reason to _want_ frameworks, and _better_ ones, too. Brooks Lybrand 📄 [We Are All Product Engineers Now](https://seldo.com/posts/we-are-all-product-engineers-now) – Laurie argues that understanding what customers need becomes a core developer skill. Laurie Voss 📺 [Is AI Changing How JavaScript Itself Gets Designed?](https://www.youtube.com/watch?v=_iVDudRDS-4) – A 2-minute take from TC39 delegate Michael Ficarra. JetBrains 📄 [Solid 2.0: It's the Little Things](https://www.brenelz.com/posts/solidjs-its-the-little-things/) – Six touches that change how [SolidJS 2.0](https://www.solidjs.com/blog/solid-2-0-rc-the-big-reveal) feels. Brenley Dueck 📄 [How Notion Handles Concurrent Editing with CRDTs](https://www.notion.com/blog/how-notion-handles-concurrent-editing-with-crdts) Nehmzow and Guo (Notion) 🛠 Code & Tools [![\](https://res.cloudinary.com/cpress/image/upload/w_1280,e_sharpen:60,q_auto/xuy1lcdg0vlkmjacpeux.jpg)](https://plotly.com/blog/announcing-plotly-js-4-plotly-py-7/) [Plotly.js 4: A Big Update for the Popular Charting Library](https://plotly.com/blog/announcing-plotly-js-4-plotly-py-7/) — Now ships its own TypeScript types, adds ‘quiver’ plots _(above)_ for drawing vector fields (with many awesome examples in the post), accepts CSS Color 4 color strings, and removes Mapbox GL in favor of MapLibre (no token needed!) Chris Parmer 🤖 [Transformers.js v4.3: Run AI Models in the Browser](https://github.com/huggingface/transformers.js/releases/tag/4.3.0) — Adds support for structured output (e.g. JSON), using WebGPU on Safari 26+, and DeepSeek v4. [The docs](https://huggingface.co/docs/transformers.js/index) have had an overhaul and there’s now an [agent skill](https://github.com/huggingface/transformers.js/blob/main/.ai/skills/transformers-js/SKILL.md) you can use. Hugging Face 💡 Hugging Face also released [a collection of 207 Apache-2.0 WebGPU kernels](https://huggingface.co/blog/webgpu-kernels) — matmul, attention and quantization ops for your own runtime. [Still Writing Tests Manually? Meticulous AI Is Here](https://www.meticulous.ai/?utm_source=jsweekly&utm_medium=newsletter&utm_campaign=26q3&utm_content=sponsored) — Flaky tests slowing down dev? Meticulous gives engineers confidence to ship faster by autonomously testing every edge case of your web app. Meticulous sponsor [`@shadcn/lint`: An Agent-First Linter for Tailwind](https://github.com/shadcn-ui/lint) — An ESLint/Oxlint plugin to enforce rules like _"no raw colors"_ and _"no restyling `