Building JavaScript tools in a single HTML file
#765 — December 12, 2025
JavaScript Weekly
Useful Patterns for Building HTML Tools — In many situations, you don’t need a full-on framework to build useful tools; just HTML, JavaScript and CSS in a single file will do the job fine. Simon’s become a bit of an expert by rolling out many such tools using LLMs, and shares his process and practices here. More please!
Simon Willison
Why Are the Top AI Companies Choosing SpreadJS? — Because SpreadJS brings a familiar Excel-like UI to JavaScript web apps. Trusted by leading AI innovators and organizations, it empowers devs to build finance, analytics, and more apps with Excel I/O, 500+ calc functions, charts, & more. View demos!
SpreadJS From MESCIUS sponsor
Deno 2.6 Released — The popular alternative runtime introduces a new npx-like tool called dx to run binaries from npm and JSR packages, adds a deno audit tool for identifying vulnerabilities in dependencies, adds more granular control over runtime permissions, implements source phase imports, and more.
Iwańczuk and Jiang (Deno)
IN BRIEF:
⚠️ Two more vulnerabilities relating to React Server Components surfaced yesterday, separate to last week’s React2Shell incident.
🔒 GitHub shares an update on its npm token policies. All npm classic tokens have been revoked this week, and there’s now a new process for getting a two hour session token or a granular access token instead.
🕒 Chrome 144 Beta has been released with support for the Temporal API for working with dates and times.
Microsoft has unveiled a preview of its JavaScript/TypeScript Modernizer for VS Code – it’s a tool that analyzes a project and suggests an upgrade plan for both syntax and dependencies.
Oxlint introduces type-aware linting in alpha form.
RELEASES:
Node.js v24.12.0 (LTS) – The first LTS release of Node.js with type stripping marked as stable.
@platformatic/python-node v2.0 – Run Python ASGI apps in Node.js processes. Now supporting HTTP response streaming and bidirectional WebSockets.
Bun v1.3.4 – Now with support for URLPattern, fake/controllable timers in its test runner, and console.log now supports the %j specifier like Node.
React v19.2.3, v19.1.4, and v19.0.3
📖 Articles and Videos
How the Seattle Times is Protecting Itself from npm Supply Chain Attacks — Technical details on how the Seattle Times has been adopting pnpm as an alternative to npm for its enhanced client-side security controls.
Ryan Sobol
A Proposal for Making Complex Web Apps Faster — From Microsoft comes an early-stage look at a proposal for a new Delayed Message Timing API to help deal with the slowdowns that multiple parallel contexts (iframes, threads, multiple windows, etc) can introduce. Feedback is being sought.
Joone Hur & Patrick Brosset (Microsoft)
Behind CERN’s Data Engine: Faster Writes, Instant Insights — CERN’s massive time-series workloads run faster with TimescaleDB, improving ingestion, compression, and real-time analytics.
Tiger Data sponsor
Building a Tiny 2D Physics Engine in JavaScript — A lovely, and rather old-school style post about building a simple physics engine from scratch in JavaScript then golfing it down to just 2KB of source as seen on its homepage (where there’s a demo too).
Maxime Euzière
📄 Non-Blocking Cross-Browser Image Rendering on the Canvas – A good way to improve UX responsiveness with more complex use cases. Alexander Myshov
📄 Prelude of the Chambered Reborn: Rewriting a Classic in TypeScript – Porting a Java game that Minecraft’s creator worked on during a Ludum Dare contest. Angelo Lima
📄 Angular Tips – A documentation site covering numerous best practices for building large Angular apps. Martin Boué
🛠 Code & Tools
Open Sourcing the Remix Store — The Remix Store is a swag store for the Remix project and its codebase provides a powerful example of how Remix’s own core team builds apps with Remix and Hydrogen.
Brooks Lybrand and the Remix Team
💡 You don’t need to be a Remix user to benefit from this code, either. For example, here’s the code to the store’s neat ‘glitchy’ 404 page which you could adapt to use elsewhere.
🕒 <relative-time> 5.0: Format Timestamps as a Natural Language Relative Time — Supply this web component with a standard formatted date and time and it’ll render “2 days ago”, say. GitHub uses this itself on all repo and code views.
GitHub
Still Writing Tests Manually? — See why modern engineering teams like Dropbox, Notion and Lattice rely on Meticulous to run E2E UI tests.
Meticulous AI sponsor
ts-exec: Execute TypeScript on Node using SWC — From the creator of Adonis comes another way to run TypeScript on Node. While Node 22.18+ supports type stripping, ts-exec supports JSX and decorators and has some benefits over ts-node and tsx.
Harminder Virk
Toastflow: A Toast Notifications Library for Vue 3 — A really nifty web-based playground for playing around with toast notifications. I wish more projects had things like this. Toastflow is technically framework agnostic, but the only renderer so far is for Vue 3. GitHub repo.
Adrián Janočko
Devalue: Get the Job Done When JSON.stringify Can’t — A library from the Svelte project that’s like JSON.stringify but that can tackle more things like cyclical and repeated references, regexes, Map and Set, and even custom types. You can try it out here.
Svelte
iceberg-js: A JavaScript Client for Apache Iceberg — A minimal, vendor-agnostic JavaScript client for the Apache Iceberg REST Catalog API that works in most runtimes and environments.
Katerina Skroumpelou (Supabase)
Inertia 2.3 – Build single-page React, Vue and Svelte apps using classic server-side routing and controllers (ideally for integrating with server-side frameworks like Django, Rails, Laravel, etc.)
OpenPGP.js 6.3 – OpenPGP implementation for JavaScript.
🗓️ React Datepicker 9.0 – Long–standing React date picker component.
🎸 SVGuitar 2.5 – Render guitar chord charts in SVG form.
pnpm 10.25 – Fast, space efficient package manager.
js-tokens 10.0 – Tiny JavaScript source tokenizer.
📰 Classifieds
Trigger.dev handles queues, retries, and long-running tasks so you can build production-ready agents and TypeScript workflows reliably at scale.
$5 PostgreSQL now available. Stop overpaying for idle instances with the new developer tier from Aiven.
📢 Elsewhere in the ecosystem
Some other interesting tidbits in the broader landscape:
📺 Earlier this year, Dimitri Mitropoulos wowed us by running Doom inside TypeScript’s type system – now he’s back ▶️ showing off TypeSlayer, a tool for diagnosing and fixing TypeScript performance problems with some fantastic 3D visualizations. It looks great, but isn’t public yet.
Get up to speed with the latest developments in the world of CSS this year with the Chrome team’s CSS Wrapped 2025.
GitHub shares some updates on work it’s done on its GitHub Actions platform and some new features coming in 2026.
🗳️ Rick Viscomi of the Google Chrome team has put out a call for you to vote for the web features you want to see in the future. This is a separate effort from the recent Interop 2025 voting process and votes will accumulate over the long term.
🤖 OpenAI released its GPT 5.2 model yesterday.
