danielroe

the most beneficial effect of many boycotts is on yourself

'but that won't hurt company x' is often irrelevant

I'm taking back some agency
I'm aligning my actions with my beliefs
I feel better for it

that's good enough

in fact, imo it's better than punishment as a motive

wrote some things I've been thinking about ai
... and it ended up feeling very personal

roe.dev/blog/the-go...

The golden thread

AI can serve us as a force multiplier, augmenting our own agency and making the most of our own effort, hard work and value. Not by replacing it.

check out ghostty.org

I've been using for a while - it's great! ✨

... and it's just been open-sourced on github.com/ghostty-org/...

Ghostty

Ghostty is a fast, feature-rich, and cross-platform terminal emulator that uses platform-native UI and GPU acceleration.

🙋‍♂️ want a zero-config backup of your github repos and think @tangled.org is pretty cool?

then synchub.to is for you!

👉 it's a github app that automatically syncs your public github repos to tangled ✨

let me know what you think! 🙏

synchub.to

Mirror your public GitHub repos to tangled.org, automatically.

🙋‍♂️ so ... for reasons:

I would love to know people's frustrations with:

- the current npmjs.com
- admin user flows on npm web ui (and cli, locally)

🙏

I am delighted to announce that @vercel.com are investing in Nuxt!

they are backing our vision of the open web, hiring me as well as other core team members (@atinux.com, @pi0.io + @antfu.me), to continue to work full time on Nuxt

we remain independent — and our vision and ethos are not changing 💚

a few words that I think are important to say on diversity, equity and inclusion in open source (and more generally)

much love ❤️

roe.dev/blog/diversity

Diversity, equity and inclusion

I'm in favour of diversity, equity and inclusion in open source communities, and here's why I think it matters.

in light of the current supply chain attacks, I've just published a @github.com action to detect packages that _lose_ their provenance.

📦 supports pnpm-lock.yaml, package-lock.json, yarn.lock (v1)
🎨 inline GitHub annotations
✅ JSON output + configurable
💪 published in TS with zero deps

GitHub - danielroe/provenance-action: GitHub Action that detects dependency provenance downgrades from lockfile changes (npm/pnpm/yarn).

GitHub Action that detects dependency provenance downgrades from lockfile changes (npm/pnpm/yarn). - danielroe/provenance-action

💥 just released a github action: `uppt`

it aims to be a very simple, secure release workflow for maintainers that adheres to best security practices

⚪ trusted, staged publishing on npmjs.com
⚪ github environment protection
⚪ generated release PR + changelog
⚪ automatic release + publish on merge ✨

AI now writes 127% of my code. Here's what I learned.

AI writes my code

Published 25/04/2025 — AI · Real Talk

incredible lightning over arthur’s seat in edinburgh tonight

constant
(every couple of seconds!)

▶

🚨 if you're a @nuxt.com user, make sure you're on v3.16.0+

we just made public a CVE that may affect you if your site is behind a CDN that ignores query parameters when caching the response.

CVE: github.com/nuxt/nuxt/se...

Full write-up: zhero-web-sec.github.io/research-and...

I'm delighted to announce my latest project

⚡️ blazing fast
📦 built from scratch for devs
🎛️ offering full control of your environment
💰 VC funding welcome

accept no imitations

Dev Mode - Toggle Your Developer Environment

Easily turn dev mode on and off from one single site.

we now have a starter pack of the nuxt 'ecosystem team' - a group of contributors active across the community ... ❤️

if there's someone else you think should be here, let me know!

go.bsky.app/KFf6zff

normalise this 👇

I'm delighted to announce the first alpha of `@nuxt/a11y` 🎉

⚪ new core nuxt module
⚪ integrated in nuxt devtools

thanks to @timdamen.io for his incredible work on this ❤️

you can test it today – we'd love feedback, ideas, issues + PRs 🙏

▶

wouldn't it be nice if sites could share a cache of common js?

... stuff like react, or vue or svelte?

👉 there's an early stage proposal for cross-origin storage which enables exactly this.

there are challenges but I think it's very interesting indeed

GitHub - WICG/cross-origin-storage: Explainer for the Cross-Origin Storage (COS) API

Explainer for the Cross-Origin Storage (COS) API. Contribute to WICG/cross-origin-storage development by creating an account on GitHub.

wrote a few words on why I think @npmx.dev might be going places

The virtuous circle

The virtuous circle is the most powerful pattern in developer tooling. And it's the myth of the 10x developer that makes it hard to see.

🙋 have you ever _wanted_ to deploy a @nuxt.com site to some provider bc of their features/dx/price but decided not to because of a limitation in nuxt?

(would love to know even minor nitpicks or frictions)

a tip for everyone making atproto integrated apps that ask for an app password:

👉 you can use the non authenticated, cached appview api for a many of the requests you might be making

a story in two acts

I'm asking because I'm building an alternative to npmjs.com, including the admin ui piece

I have a working mvp, although of course it's very 🚧

if this is something you'd like to contribute to, and you've experienced any of these pain points, let me know - always more fun to build together! 🙏

🚨 check your dependencies!

in these 500+ packages, three third-party nuxt modules were affected:

- @alexcolls/nuxt-ux
- @alexcolls/nuxt-socket.io
- @posthog/nuxt

no dependencies of nuxt itself, or any of our first party modules, were affected.

Socket @socket.dev

We have updated this list to include more than 500 packages and 700+ affected versions, as well as a technical analysis of the attack. socket.dev/blog/shai-hu.... cc: @campuscodi.risky.biz @typescript.fm @bleepingcomputer.com @theregister.com

Shai Hulud Strikes Again (v2) - Socket

Another wave of Shai-Hulud campaign has hit npm with more than 500 packages and 700+ versions affected.

butterfly flash mob

- schedule a post to X with a single 🦋
- november 16, 15:00 UTC
- you know the first rule of the flash mob

invite your friends with your own voice: find a post on why we should move here, quote post it, copy and paste this post text, send