Mastodon

if you want stable and reliable software, give developers stable and reliable employment

a reliable source has relayed that perhaps the flight attendant in fact said “infant life vests” which, in fairness to my ego, seems equally implausible

look, as my own internal dialogue has surmised: no aircraft can contain an infinite number of life vests. that would be silly. anyone would be silly to think that. the flight attendants did not announce that as part of the safety briefing…

when VC funded projects quiet-quit

A look back at the year of 11ty, 2025 edition (№8):

+73% releases (×177)
+15% issues closed (×804)
+51% downloads (4.7M)
-28% dependencies (×134)
-22% size (21 MB)

https://www.11ty.dev/blog/review-2025/

it clearly needs to be repeated that layoffs are a leadership failure, full stop.

just to be clear the pluribus hive mind is the borg with a smile

happy holidays

with a *huge* assist from Svelte’s https://www.npmjs.com/package/@sveltejs/acorn-typescript here

first draft of zero configuration typescript (with dependency mapping) in @11ty is working — weeeeeeeeeeee

software complexity sells via developer ego

happy holidays!

Just deleted a bunch of testing boilerplate in this repo after @vitest added `import.meta.resolve` support 🏆

https://github.com/vitest-dev/vitest/issues/6953

I think https://github.com/zachleat/import-module-string is one of the best things I’ve built this year (even if no one else does 😅)

Writing database queries is too close to the metal. Best practices don’t work! It’s time to make SQL enterprise-scale with utility classes.

https://tailwindsql.xyz/

Curious how to use Node.js’s new Type Stripping feature for TypeScript compatibility with Eleventy? We have you covered: https://www.11ty.dev/docs/languages/typescript/#configuration

a one-way street can also be a two-way street with the right attitude

“a one-way mirror, also called two-way mirror…” — https://en.wikipedia.org/wiki/One-way_mirror

CommonJS? ESM? TypeScript? Wait, even CommonJS TypeScript?? Eleventy can run them all.

https://www.11ty.dev/docs/cjs-esm/

Which should you choose? It depends! The social-media sized answer is: ESM 😅

leadership wants an everything app
users want an everything bagel

Tiny bug fix release of `<table-saw>`: https://github.com/zachleat/table-saw/releases/tag/v1.0.7

👍✅ Runtimes supporting CommonJS and ESM
👎❌ Modules dual publishing both CommonJS and ESM

Deno both supports and absolutely does not support CommonJS 😅

1️⃣ https://docs.deno.com/examples/cjs_to_esm_tutorial/
2️⃣ https://deno.com/blog/commonjs-is-hurting-javascript
3️⃣ https://docs.deno.com/runtime/fundamentals/node/#commonjs-support

a dad hat that says “corny on main”

Currently wondering what it feels like to work so hard on an open-licensed typeface only to have it co-opted by very terrible and very famous people as part of their core brand identity.

Thankful to @jacklorusso for their 11ty docs contribution detailing how to use @deno_land’s new `dx` command with Eleventy: https://www.11ty.dev/docs/javascript-runtime/#deno

Coming to a canary near you: adding support for Node’s Module Compile Cache feature (existing Node 20+ minimum is unchanged but this is featured tested and available in Node 22.8+ only).

https://github.com/11ty/eleventy/issues/3499

one of the 5 stages of grief is denial of service

ok fine but can react server components show emotional vulnerability too

Eleventy Core Dependency Watch (2025 Edition)

https://www.11ty.dev/blog/dependency-watch/

v4.0.0.alpha.6 (compared with v3) reduces:

1️⃣ dependencies 21.6%
2️⃣ 3rd-party dependencies 27.6%
3️⃣ node_modules weight 33.3%

is software getting better?

New core pre-release: v4.0.0-alpha.6

https://github.com/11ty/eleventy/releases/tag/v4.0.0-alpha.6

Note: this includes a new `@​11ty/nunjucks` package.

my hot take is that I think every VC-funded software project should report how much runway they have left every month

TIL about Carlito, a typeface (derived from Lato) made by Łukasz Dziedzic — the same type designer that made Lato!

https://github.com/googlefonts/carlito

Take my npm tokens, take my land,
Take me where I cannot stand.
I don't care, I'm still free,
You can't take the sky from me.

Strangers by Spring is #BuiltWithEleventy by @henry and @redintheshell 🏆🏆🏆

https://strangersbyspring.com

New core pre-release: v4.0.0-alpha.5

Full release notes: https://github.com/11ty/eleventy/releases/tag/v4.0.0-alpha.5

tfw your web site is static

if you look in the footer of https://blog.fontawesome.com/ and tap on the Font Awesome flag you’ll see a variant of this component made to work with Font Awesome icons (and reusing the colors from the header image of the blog post too: https://blog.fontawesome.com/blog-awesome-to-11ty/#colors) 🥰

📮🔒 New post on the blog:

Securely publishing our packages to npm

https://www.11ty.dev/blog/npm-security/

It’s decorative <snow-fall> season, friends: https://www.zachleat.com/web/snow-fall/

Maintenance update: to simplify our docs footprint (and in reaction to deployment retention policies), we will maintain historical versioned branches of our docs for *major* versions only:

https://v2.11ty.dev/
https://v1.11ty.dev/
https://v0.11ty.dev/

Previously hosted minor version subdomains (e.g. https://v0-12-0.11ty.dev) will redirect to their respective major version.

Appreciate y’all!

DNS stands for “DO NOT meSs with this or you’re going to have a bad time”

📮🔒 New post on the blog

No more tokens! Locking down npm Publish Workflows

https://www.zachleat.com/web/npm-security/

Includes a checklist of 8 important things you can do to improve your security footprint when using GitHub and npm.

I wanted to do this for an @11ty conference but haven’t had the bandwidth yet 🫠

Free idea:

A developer conference (née job fair) where all of the speakers are folks that aren’t employed and are looking! Speakers would really benefit from the authority that conference speaking provides and employers looking to hire can send their own devs in to learn (and recruit)!

As a security precaution I had previously configured every single 11ty repository to have its own single-package-scoped npm token (there were probably ~30 or so), so this is a lovely improvement 😅

This took a lot of tedious work but I’m now npm token free, weee!

The @11ty ecosystem is now using Trusted Publishers (https://docs.npmjs.com/trusted-publishers)

The @smashingmag Email Newsletter on Web Performance this week was great!

https://www.smashingmagazine.com/the-smashing-newsletter/

This year we’re thankful for everyone that took a few minutes to fill out our 8 question survey (with 5 multiple choice questions 😅).

If you haven’t yet, we are still accepting submissions! It will help us prioritize the future of our project! Appreciate y’all!

https://www.11ty.dev/survey/2025/

for black friday I took 20% of the words off of my blog but I won’t tell you which ones

Is there a way to configure an npm package to *require* provenance and fail any publish attempts that don’t have it? I don’t think the Trusted Publisher stuff has that option, if I’m reading it correctly.

Was wondering how to use Subresource Integrity with dynamic import() — thought maybe there was a path forward using import attributes (no) but I did stumble across this excellent post about using it with Import Maps (from @guybedford):

https://jspm.org/js-integrity-with-import-maps

How to hallucinate using Web Components https://www.zachleat.com/web/hallucinate/

participating in the JavaScript ecosystem continues to feel like living in a house that’s on fire and all of your roommates are just buying their own fire extinguishers and pretending that it’s just a temporary bout of really hot weather

The 80px vertical page shift from “This issue has been moved to a discussion” clunking in on an already loaded page may be my villain origin story.

Bring back toasts, GitHub! 🥸

I have elevated to a new plane of open source existence

this is using a <squirm-inal> Web Component from 2021: https://github.com/zachleat/squirminal/

2021-vintage Web Components are React 17-era. No big refactors or rewrites required.

went on a small side quest this morning and added an AI Mode toggle to my blog posts

e.g. https://www.zachleat.com/web/adventures-in-date-parsing/

Help guide the future of Eleventy by participating in the Eleventy Community Survey (and Suggestion Box):

https://11ty.dev/survey/2025/

@bobmonsour is looking for feedback on https://11tybundle.dev/ — please participate in the redesign survey!

https://docs.google.com/forms/d/e/1FAIpQLSfef-ekQaPHSRnIQY8iUn-fmR79P1BXep-j2jPM3RKCDEcDnw/viewform

did Cloudflare do another React useEffect

why is no one talking about the <fieldset> of zelda

TIL about the HTML Size Analyzer from DebugBear. Great for finding sneaky Data URIs or large payloads of JSON in your pages:

https://www.debugbear.com/html-size-analyzer

Shipped a tiny little breaking change to <browser-window> this morning to show the full URL in the URL-bar by default (with an escape hatch if you hate it)

Repo: https://github.com/zachleat/browser-window
Demo: https://zachleat.github.io/browser-window/demo.html

Now available in v2.0.0