
Security News
Astral Launches pyx: A Python-Native Package Registry
Astral unveils pyx, a Python-native package registry in beta, designed to speed installs, enhance security, and integrate deeply with uv.
Sarah Gooding
November 5, 2024
At the end of October, JSR, the open source package registry for modern JavaScript and TypeScript, convened its first working group meeting. Although Deno currently pays to keep JSR running, the registry is not a Deno project. Its creators intend for JSR to be an open source community-run project, and they are working towards adopting an open governance model.
During the first JSR Working Group meeting, participants discussed the current state of JSR in the JavaScript ecosystem, the roadmap, and recruiting for governance.
They opened by giving a brief introduction to JSR with a slide deck that clearly articulates what JSR is and what it isn’t, and where its modules currently operate:
JSR and Deno engineer Luca Casonato highlighted the mission for the project - to “level up the JavaScript ecosystem” and ensure that package management is ready for the next 10 years of JavaScript development.
In their inaugural working group meeting, the JSR team outlined a clear and strategic roadmap centered around two primary focus areas: enhancing the publishing process for developers entrenched in the Node ecosystem and elevating the overall consumer experience for package users.
JSR currently enables the publishing of new TypeScript packages but lacks guidance for type checking, does not consistently handle existing .js and .d.ts file pairs. Local testing of npm-emitted code is still challenging, and JSR does not support publishing JSX.
Recognizing the vast number of developers who rely on Node.js, the JSR roadmap aims to simplify the transition and integration of existing Node packages into the JSR registry through these key initiatives:
On the consumer side, JSR is committed to making package usage more seamless and intuitive, through a few key improvements:
JSR’s collection of community packages has grown to more than 7,400 packages in the nine months since it went into public beta. Developers rave about how much time is saved by using JSR to publish Typescript packages, and the registry is solidifying its position as a vital resource in the JavaScript ecosystem.
JSR is currently hosted on Google Cloud with a Rust backend, Postgres database, and Deno/Fresh on the frontend. Current costs are $400 a month for database and compute and JSR’s engineers don’t expect this to grow much. The Deno company is willing to pay for hosting infrastructure, even after moving to a foundation.
The main concerns for long-term sustainability are the variable cost of bandwidth, which is increasing as registry usage grows. The group is hoping to find some CDN partners that can help lessen the bandwidth costs.
As the registry grows, the group has discussed moving JSR into an open foundation by establishing a JSR governance board to oversee the transition. The group noted that JSR is already operationally detached from Deno, along with the JSR brand, so it should not be complicated to move it into an open foundation where it won’t be controlled by a single entity.
The working group is currently seeking trusted individuals with track records to oversee this process and decide the overall direction of the registry. They are also looking for engineering help on JSR, which is written in Rust and TypeScript. It’s open source and there are some issues already labeled as good-first-issue in the JSR repository.
A JSR moderation group is another missing piece of the puzzle that will be put in place following the formation of the JSR governance board. This group will handle the day-to-day administration of the public registry. This includes operations like enforcing naming and content policies, responding to user requests and issues, and increasing limits. The group will meet on a regular basis to discuss and evolve the policies and make critical decisions.
Check out the meeting recording and the slides for more details on applying to contribute to JSR’s governance, moderation, and engineering efforts. The working group plans to hold a bi-weekly recurring open meeting where they will answer questions, respond to feedback, and collectively plan and discuss the future roadmap of JSR. The next meeting is happening this week on Friday, November 8, at 7PM EST.
Subscribe to our newsletter
Get notified when we publish new security blog posts!
Try it now
Security News
Astral unveils pyx, a Python-native package registry in beta, designed to speed installs, enhance security, and integrate deeply with uv.
Security News
The Latio podcast explores how static and runtime reachability help teams prioritize exploitable vulnerabilities and streamline AppSec workflows.
Security News
The latest Opengrep releases add Apex scanning, precision rule tuning, and performance gains for open source static code analysis.