跪拜 Guibai
← Back to the summary

This Week's Frontend: Vitest 5.1, Remix v3.2, Node 27 Alpha, and a One-Week Package Quarantine

🌰Lizi Frontend Weekly #153 (2026.11.02 - 2026.11.08): Stay on top of the latest frontend news for the week, read excellent articles from home and abroad, and keep our curiosity about the frontend.

📰 Tech News

  1. Vitest 5.1: Vitest 5.1 released, adding --since-last-run parameter that only reruns tests affected by code changes; also brings interactive snapshot review.

  2. Remix v3.2: Remix v3.2 new version released: supports Content Security Policy (CSP), component runtime size reduced by ~10%, and other improvements.

  3. Node.js 27 Alpha: The first version under the new Node release cycle. According to Node's new release model, each major version goes through a six-month Alpha phase before stable release; so v27 stable is expected next April. The Alpha build is based on the main branch, includes breaking changes, and is intended for library authors and testing scenarios, not production.

📒 Articles

  1. 'Nothing Installs at Our Company Until It's a Week Old': "No package gets installed at our company until it's been out for a week." Recent package hijacking incidents broke out within hours of release. So the author's company set a rule: new package versions must sit for a week-long cooling period before going live. The article discusses the problems this approach brings, the risks a cooling mechanism can't block, and the relevant configuration for mainstream package managers.

  2. How does one develop technical judgment in frontend?: The article presents five typical judgment scenarios and suggests deliberately accumulating experience by reviewing your own production incidents and studying others' incident post-mortems, to accelerate judgment formation, ultimately reducing solution blind spots and making code more stable in extreme scenarios.

  3. What does CORS actually protect? 90% of frontend devs misunderstand the essence of cross-origin: The article distinguishes simple requests and preflight requests, points out the dangerous practices of * wildcard and echoing Origin as-is, provides a production-grade whitelist configuration scheme, and clarifies that CORS cannot defend against CSRF, form/static-resource tag cross-origin requests. It emphasizes replacing wildcards with whitelists for security.

🔧 Tools

  1. x18n: Anthony Fu's new work after i18n-ally, a tool for checking and maintaining internationalization files for any framework.
image-20261108115039051
  1. File Viewer: An internal web app previewer for Office / PDF / CAD / archives, based on native browser capabilities.
image-20261108115329349
  1. Skullet: Generates skeleton screen loading states from components. Feed it sample data, it renders your real component invisibly, measures layout dimensions, then generates a matching skeleton screen.
image-20261108115953759

🚀🚀🚀 The above news and articles are selected from common weekly newsletters such as JavaScript Weekly. The content will be continuously improved. Hope you like it.

💖 Follow WeChat public account: Lizi Frontend