Bookmarks

Dev Toolkit — November 2, 2026

Languages & Runtimes

Node.js 26

Node 26 ("Lithium") came out on 2026-05-05 and has now moved onto the LTS line, so October is when teams on 24 start planning the jump. If your CI image pins a major, this is the month to bump it: grab it from the download page or through whatever version manager you already use. It's still the runtime the npm ecosystem is tested against first, which is the real reason it stays the default. **Pricing:** free, open source (MIT).

Deno

Run a `.ts` file with no build step, a permissions flag per capability (`--allow-net`, `--allow-read`), and a formatter, linter and test runner already in the binary. Deno 2 made `npm:` imports and `package.json` work, which removed the main reason people bounced off it; the 2.9 line was still shipping patches as of 2026-10-21. Install with `curl -fsSL https://deno.land/install.sh | sh`. **Pricing:** free, open source (MIT); Deno Deploy hosting is a separate paid product.

rv

André Arko, who spent years leading Bundler and RubyGems, is building what uv did for Python, this time for Ruby: `rv ruby pin`, `rv clean-install` from `Gemfile.lock`, and `rvx` to run a gem's CLI without installing it. It's pre-1.0 (v0.7.2 on 2026-10-21) and the roadmap still lists `rv add` and `rv sync`, so treat it as a fast way to install Rubies today and a Bundler replacement later. `brew install rv` gets you started. **Pricing:** free, open source (Apache-2.0).

Testing & Quality

pytest

Plain `assert` statements, fixtures injected by argument name, and a plugin ecosystem (`pytest-xdist`, `pytest-cov`, `pytest-asyncio`) big enough that nobody seriously starts a Python project on `unittest` anymore. `pip install pytest`, then `pytest`. Release 9.2.0 landed 2026-10-27. **Pricing:** free, open source (MIT).

Hypothesis

You describe the shape of valid input (`@given(st.lists(st.integers()))`) and Hypothesis generates hundreds of cases, then shrinks any failure down to the smallest example that still breaks. It plugs straight into pytest and keeps a local database of past failures so they get replayed on the next run. Of the property-based testing libraries in any language, this is the one other ecosystems copy. **Pricing:** free, open source (MPL-2.0, a file-level copyleft: fine to depend on, changes to its own files must stay open).

Biome

For a JS/TS repo tired of keeping ESLint, Prettier and their plugin versions in sync, Biome is the one-binary answer: formatter and linter for JavaScript, TypeScript, JSX, JSON and CSS, configured from one `biome.json`. `npm i -D -E @biomejs/biome` then `npx biome check --write`. The 2.x series adds type-aware rules without calling the TypeScript compiler; 2.6.4 shipped 2026-10-28. **Pricing:** free, open source (MIT or Apache-2.0).

cargo-mutants

Coverage tells you a line ran; mutation testing tells you whether any test would notice if it were wrong. `cargo install cargo-mutants` then `cargo mutants` rewrites your Rust functions one at a time (return `Default`, flip `<` to `<=`) and reports the mutants your suite let live. v27 (2026-03) made CLI filters stack with the config file, and v27.1 (2026-06-02) handles Cargo's TOML 1.1 syntax and mutates `NonZero<T>`. **Pricing:** free, open source (MIT).

Databases & Storage

sqlc

The inverse of an ORM: you write SQL in `.sql` files, sqlc parses it against your schema at build time and generates typed functions for Go (plus Kotlin, Python and TypeScript through plugins). A typo in a column name fails `sqlc generate`, not production. Most Go teams that dislike ORMs end up here. **Pricing:** free, open source (MIT).

Kysely

A TypeScript query builder whose types follow the query: select two columns and the result type has exactly those two. Built-in dialects cover PostgreSQL, MySQL, SQL Server, SQLite and PGlite, and `npm install kysely` is the whole setup. It's the pick when you want type safety without adopting a schema DSL; 0.29.8 shipped 2026-11-01. **Pricing:** free, open source (MIT).

Turso

A from-scratch Rust rewrite of SQLite that keeps the file format and C API but adds what SQLite won't: `BEGIN CONCURRENT` writes over MVCC, io_uring on Linux, change data capture and vector search. Bindings exist for Rust (`cargo add turso`), JS, Python, Go, .NET and Java. It runs in production at several companies but is pre-1.0 (v0.8.3, 2026-10-12), and the new Postgres frontend and encryption are flagged experimental. **Pricing:** free, open source (MIT); Turso Cloud hosting is separate.

Atlas

Schema migrations the Terraform way: declare the schema you want in HCL, SQL or your ORM's models, and Atlas diffs it against the live database, plans the migration and lints it for destructive changes. Install with `curl -sSf https://atlasgo.sh | sh` and point it at PostgreSQL, MySQL, SQLite, ClickHouse and a dozen others. v1.3.0 shipped 2026-08-02. Read the licence before you install. **Pricing:** split — the Community Edition build is Apache-2.0, the default binary runs under Ariga's commercial terms, and `migrate lint` left the free Starter plan in v0.38.

CLIs & Terminal

fzf

Pipe any list into it and type to filter. That one idea has become the interactive layer of most dotfiles: `Ctrl-R` history search, `Ctrl-T` file picking and `**<Tab>` completion come with the shell integration, and editors and git aliases wire it in everywhere else. It's a single Go binary (`brew install fzf`), still releasing monthly; 0.74.5 landed 2026-10-11. **Pricing:** free, open source (MIT).

jq

The standard for slicing JSON on the command line, and the one people pick up from a coworker's one-liner and then slowly learn properly. After years of stalled maintenance it moved to the `jqlang` org, and 1.8 is the current manual. If you only ever use `.foo[] | select(.bar)`, the manual's section on `reduce` and `paths` is worth an afternoon. **Pricing:** free, open source (MIT).

Ghostty

A GPU-rendered terminal emulator that uses native UI on macOS (Swift) and Linux (GTK) instead of drawing its own widgets, so tabs, splits and settings behave like the platform. Version 1.4, out 2026-10-27, compresses idle scrollback (70–90% less memory), raises the default scrollback to 50 MB, plays animated Kitty-protocol images, and fixes layout on macOS 27. **Pricing:** free, open source (MIT).

Zellij

A terminal multiplexer for people who never memorised tmux's prefix keys: the bindings are shown on screen, layouts live in KDL files, and plugins compile to WebAssembly. 0.45 (2026-08) added Kitty graphics, OSC 133 shell integration so you can jump between prompts, first-class nested sessions, and a web client that installs as a phone app. `cargo install --locked zellij` or grab a release binary. **Pricing:** free, open source (MIT).

Editors & IDE Tooling

rust-analyzer

The Rust language server: completion, go-to-definition, inlay type hints, and assists like "fill match arms" in any LSP editor. It's what the official VS Code Rust extension runs, it ships through `rustup component add rust-analyzer`, and it cuts a release every week (latest 2026-11-02). There isn't a serious alternative. **Pricing:** free, open source (MIT or Apache-2.0).

basedpyright

Microsoft's Pyright is open source but Pylance, the VS Code extension built on it, is closed and licensed only for Microsoft's editors. basedpyright is the fork that fills the gap: Pylance-style features (semantic highlighting, inlay hints, auto-imports) in Neovim, Helix, Zed or VSCodium, plus stricter rules and a baseline file for adopting them gradually. `pip install basedpyright`; v1.40.2 came out 2026-10-04. **Pricing:** free, open source (MIT).

Pyrefly

Meta's Rust-written Python type checker and language server, which hit 1.0 on 2026-05-12 after a beta that started November 2025. It's the default checker for Instagram's codebase, and the 1.0 notes put typing-spec conformance above 90%. 1.4 (2026-10-14) made the VS Code extension use the Pyrefly in your `.venv`, checks uv workspace members, and reads `basedpyright` config so you can try it on an existing project. `pip install pyrefly`. **Pricing:** free, open source (MIT).

Build, CI & Packaging

Bazel

Hermetic, cached, remote-executable builds across languages: what you reach for when a monorepo has Java, Go, C++ and TypeScript and `make` is no longer an honest answer. Bazel 9 is the current LTS (9.3.1 on 2026-10-20), with Bzlmod as the only dependency system now that `WORKSPACE` is gone. It has a real learning curve; install through Bazelisk so every machine runs the version pinned in `.bazelversion`. **Pricing:** free, open source (Apache-2.0).

pnpm

pnpm 12 is a Rust rewrite (stable since late August 2026) that keeps pnpm 11's commands, settings and lockfile format, so the upgrade is `pnpm self-update latest-12` plus a read of the short breaking-changes list: git deps resolve over HTTPS, unknown `pnpm-workspace.yaml` keys are errors, and cyclic peer resolution is now deterministic. The content-addressed store and strict `node_modules` layout are why it beat npm and Yarn in monorepos, and 11 already made a one-day release cooldown the default. **Pricing:** free, open source (MIT).

Rolldown

A Rust bundler with Rollup's plugin API and config shape. Vite 8 already uses it as its only bundler, so most people are running it without knowing. Use it directly for libraries or custom pipelines: `npm install -D rolldown`, then `rolldown -c`. It has been on the stable 1.x line since spring 2026 (1.2.16 on 2026-10-29). **Pricing:** free, open source (MIT).

GoReleaser

One `.goreleaser.yaml` and a tag push gets you cross-compiled binaries, archives, checksums, SBOMs, signed artifacts, Docker images, a Homebrew tap and a GitHub release. It started with Go and now also builds Rust, Zig and Bun projects. `goreleaser init` writes the starter config. **Pricing:** open source (MIT); GoReleaser Pro adds features like monorepo splits and nightlies for a paid licence.

APIs & Protocols

grpcurl

curl for gRPC. If the server has reflection turned on, `grpcurl -plaintext localhost:50051 list` shows its services and you can call methods with JSON bodies and no `.proto` files; otherwise pass `-proto`. It's a single Go binary (`brew install grpcurl`) and the first thing anyone runs when a gRPC call misbehaves. **Pricing:** free, open source (MIT).

Prism

Point `npx @stoplight/prism-cli mock openapi.yaml` at a spec and you have a mock server that returns the documented examples, or dynamic fake data with `-d`. Swap `mock` for `proxy` and it sits in front of the real API, flagging every request and response that drifts from the contract. v5.16.0 shipped 2026-07-17. **Pricing:** free, open source (Apache-2.0).

Scalar

Two things from one OpenAPI file: an interactive API reference that people actually read (with code samples in dozens of languages) and an offline-first desktop API client that stays in sync with your server in watch mode. There are drop-in integrations for FastAPI, Express, Hono, NestJS, Laravel, ASP.NET and more, or a one-line CDN script. **Pricing:** open source (MIT); a hosted docs platform is paid.

Redocly CLI `generate-client`

`npx @redocly/cli@latest generate-client openapi.yaml --output src/client.ts` writes a typed TypeScript client with zero runtime dependencies, and extra `--generator` flags add Zod schemas, TanStack Query hooks or MSW mocks. Python, Go, PHP and Java SDKs and a generated CLI are also on the list. Redocly announced it on 2026-09-01; it's marked experimental, so pin your CLI version. **Pricing:** free, open source (MIT).

Code Search & Review

Renovate

The dependency-update bot that handles the cases Dependabot doesn't: grouped updates, automerge rules per package, scheduled windows, and dozens of package managers and file types, Dockerfiles, Helm charts, Terraform and GitHub Actions pins. Run it as the hosted Mend GitHub App or self-host it with `npx renovate` in CI. **Pricing:** free; open source under AGPL-3.0, which matters only if you modify and redistribute it.

Zoekt

The trigram-indexed code search engine behind Sourcegraph, and the thing to reach for when `ripgrep` across a hundred checked-out repos starts taking minutes. `go install` the `zoekt-index` and `zoekt-webserver` commands, index a directory, and you get regex search with ctags-based ranking at `localhost:6070`. Sourcegraph has maintained it since forking Google's original in 2017. **Pricing:** free, open source (Apache-2.0).

Difftastic

Difftastic parses both versions of a file with tree-sitter and diffs the syntax trees, so a reformatted line or a wrapped argument list doesn't show up as a change. Set it as `GIT_EXTERNAL_DIFF` or jj's diff tool and reviews of refactors get much shorter. 0.72.0 (2026-10-29) sped up preprocessing and dropped Verilog and F# to keep the binary small. **Pricing:** free, open source (MIT).

PR-Agent

Qodo handed its open-source PR reviewer to a community org on 2026-04-23, and it has since kept up a release every couple of weeks (v0.49.0 on 2026-10-25). Add it as a GitHub Action or run `pr-agent --pr_url <URL> review` from `pip install "pr-agent[github]"`; it posts review comments, PR descriptions and improvement suggestions using the LLM key you supply, on GitHub, GitLab, Bitbucket or Azure DevOps. It isn't Qodo's hosted product, and the repo says so. **Pricing:** free, open source (MIT per the current LICENSE file; it was AGPL under Qodo); you pay your own model provider. --- *30 tools this month. Found a dead link or have something to add? Reply to the email.*