A runtime permission model that restricts filesystem and network access, read carefully and left off. A sandbox that has to be opened far enough for the workload is…
Escaping a user-supplied string for use in a pattern, implemented from a Stack Overflow answer in every project since 2011. Four copies of a security-relevant one-liner, three of…
A function that throws synchronously before returning a promise, and a caller whose .catch() never runs. A function that sometimes throws and sometimes returns a promise has two…
Union, intersection and difference on Set, in the language, replacing four utility functions and a dependency. The array round trip was the idiom and it allocated twice for…
Return type checking for conditional expressions, which resolved a pattern that had needed an assertion since 2021. Overloads with a boolean discriminant are a common shape and the…
A page that shipped 140 KB in 2024 and 18 KB in 2025, accounted for honestly. The largest saving is the widget nobody could convert, deferred rather than…
An accordion block converted to directives a year ago, revisited to see whether the conversion held. The runtime being loaded by somebody else’s plugin changes the calculation for…
Importing JSON with a syntax the runtime enforces, rather than with a bundler plugin that made it look like a module. The attribute is a security feature rather…