Bluesky

Strangers by String is #BuiltWithEleventy by @likethecolour.red and @strange.website 🏆🏆🏆

strangersbyspring.com

Quoted post

New core pre-release: v4.0.0-alpha.5

Full release notes: github.com/11ty/elevent...

tfw your web site is static

if you look in the footer of blog.fontawesome.com and tap on the Font Awesome flag you’ll see a variant of this component made to work with Font Awesome icons 🥰

(and reusing the colors from the header image of the blog post too: blog.fontawesome.com/blog-awesome...)

📮🔒 New post on the blog:

Securely publishing our packages to npm

www.11ty.dev/blog/npm-sec...

It’s decorative <snow-fall> season, friends: www.zachleat.com/web/snow-fall/

Maintenance update: to simplify our docs footprint, we will maintain historical versioned branches of our docs for *major* versions only:

v2.11ty.dev
v1.11ty.dev
v0.11ty.dev

Previously hosted minor version subdomains (e.g. v0-12-0.11ty.dev) will redirect to their respective major version.

Thanks!

DNS stands for “DO NOT meSs with this or you’re going to have a bad time”

📮🔒 New post on the blog

No more tokens! Locking down npm Publish Workflows

www.zachleat.com/web/npm-secu...

Includes a checklist of 8 important things you can do to improve your security footprint when using GitHub and npm.

I wanted to do this for an @11ty.dev conference but haven’t had the bandwidth yet 🫠

Free idea:

A developer conference (née job fair) where all of the speakers are folks that aren’t employed and are looking! Speakers would really benefit from the authority that conference speaking provides and employers looking to hire can send their own devs in to learn (and recruit)!

As a security precaution I had previously configured every single 11ty repository to have its own single-package-scoped npm token (there were probably ~30 or so), so this is a lovely improvement 😅

This took a lot of tedious work but I’m now npm token free, weee!

The entire @11ty.dev ecosystem is now using Trusted Publishers (docs.npmjs.com/trusted-publ...)

The @smashingmagazine.com Email Newsletter on Web Performance this week was great!

www.smashingmagazine.com/the-smashing...

This year we’re thankful for everyone that took a few minutes to fill out our 8 question survey (with 5 multiple choice questions 😅).

If you haven’t yet, we are still accepting submissions! It will help us prioritize the future of our project! Appreciate y’all!

www.11ty.dev/survey/2025/

for black friday I took 20% of the words off of my blog but I won’t tell you which ones

Is there a way to configure an npm package to *require* provenance and fail any publish attempts that don’t have it? I don’t think the Trusted Publisher stuff has that option, if I’m reading it correctly.

Was wondering how to use Subresource Integrity with dynamic import() — thought maybe there was a path forward using import attributes (no) but I did stumble across this excellent post about using it with Import Maps (from @guybedford.com):

jspm.org/js-integrity...

How to hallucinate using Web Components www.zachleat.com/web/hallucin...

participating in the JavaScript community feels like living in a house that’s on fire and all of your roommates are just buying their own fire extinguishers and pretending that it’s just a temporary bout of really hot weather

The 80px vertical page shift from “This issue has been moved to a discussion” clunking in on an already loaded page will be my villain origin story.

Bring back toasts, GitHub! 🥸

I have elevated to a new plane of open source existence.

(we were at 428 open issues in October)

this is using a <squirm-inal> Web Component from 2021: github.com/zachleat/squ...

2021-vintage Web Components are React 17-era. No big refactors or rewrites required.

went on a small side quest this morning and added an AI Mode toggle to my blog posts

e.g. www.zachleat.com/web/adventur...

Help guide the future of Eleventy by participating in the Eleventy Community Survey (and Suggestion Box)

11ty.dev/survey/2025/

@bobmonsour.com is looking for feedback on 11tybundle.dev — please participate in the redesign survey:

docs.google.com/forms/d/e/1F...

did Cloudflare do another React useEffect

why is no one talking about the <fieldset> of zelda

TIL about the HTML Size Analyzer from DebugBear. Great for finding sneaky Data URIs or large payloads of JSON in your pages:

www.debugbear.com/html-size-an...

Shipped a tiny little breaking change to <browser-window> this morning to show the full URL in the URL-bar by default (with an escape hatch if you hate it)

Repo: github.com/zachleat/bro...
Demo: zachleat.github.io/browser-wind...

Now available in v2.0.0

Is there a tool that helps compare npm downloads for a package to see what percentage of downloads are on various major versions?

In my mind there are three kinds of feedback: criticism, indifference, and praise.

Well-run developer communities accept all three. Poorly-run communities optimize for only the latter.

Closed 105 active issues (428 to 323) in the past month on @11ty.dev core; slowly organizing Enhancements as GitHub Discussions: www.11ty.dev/blog/github-...

Feels like a weight lifting organizing the Issue Tracker. This is also work I’d *never* do if I felt like I had to grind for growth.

to err is human, to forgive git history, divine

When folks attempt to use the `eleventy` package instead of the canonical `@11ty/eleventy`, we’ll throw a helpful error now.

Thanks to the donation of the `eleventy` name on npm!

github.com/11ty/elevent...

a bot that posts “is anyone maintaining this” issues on vibe coded repos

The absolute UX *drama* of the new tinted (vs. clear) Liquid Glass preference in the macOS 26.1 System Settings. Why separate from the Reduce Transparency accessibility toggle? Why so prominent in the Appearance section? Why do users need to know about Liquid Glass at all? Mistakes were made here 😅

the local spirit halloween has been around longer than the last time they did a full rewrite of the ▓▓▓▓▓▓▓▓▓▓ JavaScript framework

this web component is now five years old and it has outlived many epochs of JavaScript frameworks incredible journey-ing their “best practices” into even bester practices

just between us, it’s a web component

Shipped some dirt-simple demo styles with <seven-minute-tabs> while making some improvements to the 11ty docs (it’s the tabs component we use there)

zachleat.github.io/seven-minute...

8 y/o thought it was the “new york times best spelling author” and you know what, that’s what I’ll be calling it from here on out

How we use GitHub Issues and how that’s changing: www.11ty.dev/blog/github-...

(Happy Halloween, y’all 🎃)

“AirTag Found Moving With You”

The ominous alert. Fight or flight — adrenaline. After surveilling my surroundings I was frightened to discover that AirTags weren’t the only things moving with me. There were multiple *people* shadowing my movements as well. I was on a bus.

Copy *and* paste? …in this economy? www.zachleat.com/web/copy-pas...

Astute observers may notice that @11ty.dev’s docs *finally* added Copy to Clipboard buttons to all of the code samples!

This is all thanks to the `<wa-copy-button>` Web Component from Web Awesome which just shipped v3 today!

Check out the latest release from the awesome-verse: webawesome.com

Related: www.zachleat.com/web/external...

heading to my local spirit halloween to find supplies for my “react footguns” costume

to be clear, the risk of someone phishing my npm credentials is *much* lower than the risk of “can you take a look at this Eleventy project that isn’t working quite right (and also contains malware, intentionally or not)”

as a security precaution I am now running all Eleventy projects submitted through support channels via a Virtual Machine (Ubuntu on VirtualBox)

trying to download a 6GB virtual machine image and annoyed that’s it’s taking more than a few minutes

if 56k-me could see me now

I made a few small changes to the Eleventy Supporters facepile www.zachleat.com/web/permanen...

I’ve automated it so now I don’t have to actively perform the task — I only have to fix it when the automation breaks, which only happens extremely regularly

Today’s esoteric HTML element is <kbd>

As in: please press <kbd>⌘</kbd> + <kbd>R</kbd> repeatedly when AWS causes your JavaScript to fail to load.

developer.mozilla.org/en-US/docs/W...

Look, very few people will care about this but I wrote it up anyway www.zachleat.com/web/markdown...

I hope the aws gateway currently in time-out is thinking about what it did

oscar meyer deserves credit for skipping the vendor lock-in of mobile apps and instead prioritizing their weinermobile web site

sure wilhelm screamed but did he laugh — did he cry — did he love

If you’re using CSS Nesting, make sure your minifier supports it!

As I learned today, clean-css doesn’t support it yet: github.com/clean-css/cl...

I want to intercept Boolean coercion for objects in JavaScript: www.zachleat.com/web/boolean-...

when the paywall CSS is accessible but also inaccessible

I wonder if yogurt ever asks itself if it’s a good culture fit

we just accept link rot as an unavoidable byproduct of the web without a second thought as to why zelda rot isn’t a problem at all

what’s the name for the ballmer peak but when you’re tired

why weren’t any of my npm packages taken in the rapture

has anyone stopped to consider that the rapture is just another supply chain attack

some good insight here into how (I try) to navigate conflicts on social media (which can be very confusing to folks that are very accustomed to shouting and being shouted at): www.youtube.com/watch?v=Omc3...

Please add this tiny bit-o-CSS for stable scrollbar gutters to your Reset Stylesheets

www.zachleat.com/web/stable-s...

the big logo on the 11ty home page is now a @fontawesome.com icon 🥰 www.11ty.dev

it’s fixed! thanks to the folks that escalated my terrible social media bug report

hmm — the favicon for microsoft.com has been broken for at least a week now

sometimes it’s for better and sometimes it’s for worse, but npm has always been a Big Group Project™