DEV Community: Adam

Stay ahead in web development: latest news, tools, and insights #145

Adam — Mon, 13 Jul 2026 04:51:43 +0000

Signup here for the newsletter to get the weekly digest right into your inbox.

weeklyfoo #145 is here: your weekly digest of all webdev news you need to know! This time you'll find 39 valuable links in 5 categories! Enjoy!

🚀 Read it!

Announcing TypeScript 7.0: TypeScript 7.0's native Go port delivers up to 10x faster compilation, tested across large-scale real-world codebases by Microsoft / typescript, performance / 26 min read

📰 Good to know

State of CLI Coding Agents, Mid-2026: A survey of 35 actively maintained terminal-based coding agents, with Claude Code, Codex CLI, and Omp leading on memory, editing precision, and orchestration by Oleg Luganskiy / ai, agents, tooling / 1 min read
Rebuilding Cognition's Agentic MapReduce: How Cognition scales agent tasks by sharding codebases, verifying vulnerabilities in parallel, and using Git itself for inter-agent communication and fault tolerance by Matt Rickard / ai, agents, engineering / 5 min read
PostgreSQL and the OOM Killer: Why We Use Strict Memory Overcommit: Why strict memory overcommit prevents catastrophic OOM kills in PostgreSQL, and what a kernel bug in production revealed about getting that configuration right by Burak Yucesoy / postgres, engineering / 18 min read
Hunting a 16-Year-Old SQLite Bug With TLA+: Modeling SQLite's Write-Ahead Log behavior in TLA+ to check whether dqlite was exposed to a long-standing corruption bug — it wasn't, thanks to stricter locking by Alberto Carretero / sqlite, engineering / 31 min read
How We Taught a Small LLM to Throw Away 68% of Our RAG Context: A small, cheap LLM learned to prune 68% of retrieved RAG context chunks while keeping 96% recall, cutting cost without sacrificing accuracy by Kapa AI / ai, engineering / 11 min read
Some New Agentic Patterns: Letting an agent work directly with the engineer building its runloop and tooling produces higher-quality results than routing every change through a human intermediary by Jesse Vincent / ai, agents, engineering / 10 min read
What's New in ECMAScript 2026: The newly approved 876-page ECMAScript 2026 spec adds Array.fromAsync, native Uint8Array Base64/Hex conversion, and more — most already usable today in browsers and runtimes by Pawel Grzybek / javascript, ecmascript / 7 min read
React Router v8: A deliberately boring major release with incremental changes, a new yearly release cadence, and updated baselines for Node, React, and Vite by Remix / react, javascript / 8 min read
Where Do Your LLM API Keys Actually Live?: Whether a provider API key sits inside your app process or behind a gateway determines the blast radius when a dependency gets compromised by Hadil / ai, security / 38 min read
Why We Built Yet Another Postgres Connection Pooler: PgDog is a new Postgres connection pooler with a built-in SQL parser to properly manage session state, SET commands, and LISTEN/NOTIFY, built on Rust's Tokio by Lev Kokotov / postgres, engineering / 6 min read
Get Ready for the CSS border-shape Property: On the heels of shape() and corner-shape, the new border-shape property unlocks fancy decorations, neat animations, and more — Chromium-only for now by Temani Afif / css, frontend / 13 min read
Google's Toolkit to Make Your Website Agent-Ready: A new Lighthouse toolkit that audits how agent-friendly your site is, checking accessibility tree quality, layout stability, and WebMCP integration by Google / ai, agents, web / 9 min read
Rewriting Bun in Rust: Facing recurring use-after-free and double-free bugs from Zig's manual memory management, Bun's team used Anthropic's models to rewrite the runtime in Rust, ending up faster, smaller, and safer by Bun / rust, engineering, bun / 53 min read
An Off Switch for Dual-Use Knowledge in AI Models: Anthropic's GRAM (Gradient-Routed Auxiliary Modules) isolates dual-use knowledge like cyber offense/defense into dedicated model compartments, resisting attempts to recover removed knowledge by Anthropic / ai, safety / 8 min read
GitLost: How We Tricked GitHub's AI Agent Into Leaking Private Repos: An indirect prompt injection through public GitHub issues let attackers exploit GitHub's Agentic Workflows to extract data from private repositories by Noma Security / security, ai, agents / 8 min read
npm v12 Ships With Install Scripts Off by Default: npm 12 is now GA with lifecycle scripts and implicit node-gyp builds no longer running by default, closing off a major supply-chain attack vector by GitHub Blog / npm, security, nodejs / 5 min read

🧰 Tools

Otari: An open-source, OpenAI-compatible LLM gateway for managing API keys, enforcing budgets, and tracking usage across 40+ providers from one endpoint by Mozilla AI / ai, llm, gateway
Vite+ Beta: The Vite team's unified toolchain brings Vite, Vitest, Oxlint, and more together under a single vp command — originally planned as commercial, now open sourced under MIT by VoidZero / vite, tooling, javascript
WordGard: A modular, collaborative-editing-ready rich text editor library from the creator of ProseMirror and Eloquent JavaScript by Marijn Haverbeke / javascript, editor, library
vinext: Cloudflare's Vite plugin reimplementing Next.js's API surface by Cloudflare / vite, nextjs, cloudflare
Herdr: A terminal-based multiplexer for running multiple coding agents in persistent sessions that survive disconnects and can be reached remotely over SSH by Herdr / ai, agents, cli
Apify MCP Server: Lets AI agents discover and run Apify Store Actors, access storages and results, and pull Apify docs directly into a coding assistant by Apify / ai, mcp, agents
OSV.dev: An open, distributed vulnerability database that aggregates open-source security advisories for scanning dependencies via API, CLI, or GitHub integration by OSV / security, opensource
OverflowGuard: A React component and custom element that adapts layouts around content instead of breakpoints, media queries, or magic numbers by Artur Marczyk / react, css, frontend
Postgres Is Enough: A directory of 89 extensions and tools that let Postgres stand in for Redis, Elasticsearch, Kafka, and other systems by Goodway / postgres, database
Tinbase: A Supabase-compatible backend in a single binary using PGlite and pg-mem, for a local Supabase-like dev experience without Docker by Sanket Sahu / postgres, supabase, database
Level Up Your Accessibility Game: 128 questions to practice WCAG 2.2, ARIA, semantic HTML, keyboard, and contrast, with plain-English answers by a11y.quest / accessibility, tools
GeoSQL: A geospatial analytics tool with a map-based validation loop to improve accuracy of spatial queries on PostGIS, BigQuery, and Snowflake by Dekart / postgres, geospatial, tools
Upyo 0.5: A Cross-Runtime Email Sending Library: A unified, type-safe API for sending emails over SMTP and HTTP-based providers like SendGrid or Amazon SES, working across Node, Deno, Bun, and edge runtimes by Hong Minhee / email, nodejs, library
node-calls-python: Calls Python directly from Node, in-process, without spawning a subprocess by hmenyus / nodejs, python, interop
Traycer: An open-source AI orchestration app that connects existing agent subscriptions for parallel operation with shared memory, model switching, and cross-device sync by Traycer / ai, agents, orchestration
react-easy-crop: A React component for interactive image and video cropping with dragging, zooming, and rotation, supporting any image format by Valentin Hervieu / react, image, library
native: A toolkit from Vercel Labs for building native desktop apps with web technologies by Vercel Labs / desktop, toolkit

🤪 Fun

Engineering a Brainrot Art Installation on an Orange Pi Zero: An infinite-scroll BrainRot TV art piece with procedural audio and a decay meter, squeezed onto a $15 Orange Pi Zero by Google AI / hardware, art / 11 min read
GTA2 Web: The top-down classic GTA 2 ported to run natively in the browser, with WebRTC peer-to-peer multiplayer added on top by Erik Markus Kannike / games, webrtc / 1 min read

📺 Videos

I Read Every Major CS Paper From the Last 100 Years: A tour through the major CS papers behind today's LLMs, tracing how decades of research led to modern AI by Fireship / ai, cs
Frontend Minimalism in Action: Do More With Less JavaScript: Peter Kröner explores building maintainable, resilient frontends by relying on web standards and minimalist engineering over hype-driven dependencies by Peter Kröner / frontend, talk
How Kubernetes Networking Really Works: A Packet's Journey: Tracing a real packet across a live cluster to show how traffic moves between Pods using network namespaces, veth pairs, bridges, and routing tables by Ashwin Sriram / kubernetes, networking, talk

Want to read more? Check out the full article here.

To sign up for the weekly newsletter, visit weeklyfoo.com.

Faster Compilers, Twelve-Factor Agents, and Kubernetes in Your Browser

Adam — Thu, 09 Jul 2026 15:07:48 +0000

The GPU finally got its own origin story: Fergus Finn's bottom-up walkthrough of what actually happens when you run a kernel is the kind of infrastructure literacy that pays dividends whether you're writing CUDA or just squinting at inference latency. Worth the read.

On the speed front, the VS Code team's adoption of the TypeScript 7 compiler is peak "benchmark theatre" — in the best way. Type-checking: 36s → 5s. Watch mode: 80s → 20s. If you needed permission to finally take compiler rewrites seriously, here's your permit.

The agent ecosystem keeps industrializing: 12 Factor Agents brings the famous twelve-factor vocabulary to LLM apps, Oak promises sub-second working tree mounts purpose-built for parallel agent workflows, Weave Router cuts inference costs 40–70% without leaking your API keys off-device, and Apple quietly shipped an official MCP server for Safari's dev tools. Browser-integrated agent tooling is moving from experiment to table stakes.

Security filed three interesting dispatches: Matteo Collina argues that CVE-2026-48931 should have been routine hardening — not a CVE — and the mis-classification broke node-fetch users across Google APIs, Firebase, and Backstage. Reddit's spam-detection internals got accidentally exposed by a debugging glitch (awkward). And npm now locks high-impact package accounts into 72 hours of read-only mode after any account-recovery action — a quiet but very sensible guardrail.

The SQL standard picked up QUALIFY and INSERT ... BY NAME at the latest working-group meeting. Postgres implications inbound; time to start planning your migrations.

And if you've ever shipped a React SSR page and wondered why LCP went red: Ivan Akulov's piece on hydration mismatches plus font swap is your forensic playbook. Also, someone ported Kubernetes to the browser. Completely unnecessary. Completely on-brand.

Enjoy!

Signup here for the newsletter to get the weekly digest right into your inbox.

Find the 12 highlighted links of weeklyfoo #144:

What Happens When You Run a GPU Kernel

by Fergus Finn

A step-by-step breakdown of what the CPU, driver, and GPU actually do during kernel execution — from pushbuffer writes to warp scheduling

🚀 Read it!, engineering, gpu, performance

Iterating Faster on VS Code with TypeScript 7

by VS Code Team

How the VS Code team adopted the Go-based TypeScript 7 compiler incrementally — type-checking dropped from 36s to 5s, watch mode from 80s to 20s

📰 Good to know, typescript, engineering, tooling

A Peek Into Reddit's Anti-Spam Internals

by Lyra

How a leaked debugging glitch revealed Reddit's moderation stack, including its spam-detection algorithms and use of the Perspective API

📰 Good to know, engineering, security

I Ported Kubernetes to the Browser

by Sam Rose

webernetes is a TypeScript port of Kubernetes that runs pod lifecycles, deployment tracking, and simulated networking entirely in the browser

📰 Good to know, engineering, kubernetes

New SQL Standard Features With Postgres Implications

by Peter Eisentraut

QUALIFY, INSERT ... BY NAME, and JOIN TO ONE were adopted into the draft SQL standard at the latest standards meeting, with an update on the still-debated 'key joins' proposal

📰 Good to know, database, postgres, sql

CVE-2026-48931 Shouldn't Have Been a CVE

by Matteo Collina

Matteo Collina on why his own http.Agent security fix should have shipped as ordinary hardening, not a CVE, and how it broke node-fetch@2 users across Google APIs, Firebase, and Backstage

📰 Good to know, node, security, engineering

npm Locks High-Impact Accounts After Recovery Actions

by GitHub

Maintainers of the most popular packages are now locked into 72 hours of read-only mode after changing their email or using a 2FA recovery code

📰 Good to know, npm, security, supply-chain

Introducing the Safari MCP Server for Web Developers

by WebKit Team

Apple's new Safari MCP server lets AI coding agents inspect the DOM, console, network, performance, and accessibility of a local Safari browser

📰 Good to know, ai, tools, web

The Hidden Cost of Hydration Mismatches

by Ivan Akulov

How a single hydration mismatch, combined with web font swapping, can push a React page's Largest Contentful Paint from green into the red

📰 Good to know, react, performance, frontend

12 Factor Agents

by HumanLayer

Principles for building reliable LLM-powered applications, inspired by the 12-factor app methodology

🧰 Tools, ai, agents, framework

Oak

by Oak

Version control built for agent workflows — content-addressed storage gives instant branch cloning, and working trees mount in about a second without a full git-style clone

🧰 Tools, git, tools, ai

Weave Router

by Weave

Local model router that picks the best LLM for each prompt in under 50ms and cuts inference costs 40-70% without ever sending API keys off-device

🧰 Tools, ai, llm, tools

Want to read more? Check out the full article here.

To sign up for the weekly newsletter, visit weeklyfoo.com.

Stay ahead in web development: latest news, tools, and insights #144

Adam — Mon, 06 Jul 2026 05:03:20 +0000

Signup here for the newsletter to get the weekly digest right into your inbox.

weeklyfoo #144 is here: your weekly digest of all webdev news you need to know! This time you'll find 32 valuable links in 5 categories! Enjoy!

🚀 Read it!

What Happens When You Run a GPU Kernel: A step-by-step breakdown of what the CPU, driver, and GPU actually do during kernel execution — from pushbuffer writes to warp scheduling by Fergus Finn / engineering, gpu, performance / 34 min read

📰 Good to know

Code Is the Easy Part: How a startup untangled a billing system by simplifying the data model and encoding unrecorded business rules, cutting invoicing time from a week to two days by Swizec Teller / engineering / 15 min read
What Happened After 2,000 People Tried to Hack My AI Assistant: Prompt injections are still a real security problem but defenses are getting better — field notes from opening an AI assistant to public attack by Fernando Iturriaga / ai, security / 5 min read
Iterating Faster on VS Code with TypeScript 7: How the VS Code team adopted the Go-based TypeScript 7 compiler incrementally — type-checking dropped from 36s to 5s, watch mode from 80s to 20s by VS Code Team / typescript, engineering, tooling / 15 min read
Deno 2.9: Native desktop app packaging, 2x faster cold starts, quick migration from npm lockfiles, and a target of Node.js 26 compatibility by Bartek Iwańczuk / javascript, deno, tooling / 30 min read
A Peek Into Reddit's Anti-Spam Internals: How a leaked debugging glitch revealed Reddit's moderation stack, including its spam-detection algorithms and use of the Perspective API by Lyra / engineering, security / 34 min read
I Ported Kubernetes to the Browser: webernetes is a TypeScript port of Kubernetes that runs pod lifecycles, deployment tracking, and simulated networking entirely in the browser by Sam Rose / engineering, kubernetes / 16 min read
New SQL Standard Features With Postgres Implications: QUALIFY, INSERT ... BY NAME, and JOIN TO ONE were adopted into the draft SQL standard at the latest standards meeting, with an update on the still-debated 'key joins' proposal by Peter Eisentraut / database, postgres, sql / 7 min read
Meta's AI Storage Blueprint at Scale: How Meta rebuilt its BLOB storage metadata subsystem with tiered caching and prefetching to keep GPUs fed and speed up AI research velocity by Meta Engineering / ai, engineering, infrastructure / 16 min read
CVE-2026-48931 Shouldn't Have Been a CVE: Matteo Collina on why his own http.Agent security fix should have shipped as ordinary hardening, not a CVE, and how it broke node-fetch@2 users across Google APIs, Firebase, and Backstage by Matteo Collina / node, security, engineering / 16 min read
npm Locks High-Impact Accounts After Recovery Actions: Maintainers of the most popular packages are now locked into 72 hours of read-only mode after changing their email or using a 2FA recovery code by GitHub / npm, security, supply-chain / 4 min read
Building an Intern: How the team built Junior, an AI intern in Slack that takes instructions, does research, and gets steered by reviewers, over four months of development by cra.mr / ai, agents / 23 min read
Skill Engineering and the Case Against One-Shot AI Design: Agents need domain knowledge, context, and carefully defined ways for humans to steer results: a case against expecting one-shot AI design by Latent Space / ai, agents / 7 min read
How OpenAI Delivers Low-Latency Voice AI for 900M Users: Splitting voice AI infra into a stateless edge relay and a stateful transceiver, encoding routing metadata into the ICE ufrag to avoid database lookups on the hot path by ByteByteGo / engineering, infrastructure, ai / 15 min read
Introducing the Safari MCP Server for Web Developers: Apple's new Safari MCP server lets AI coding agents inspect the DOM, console, network, performance, and accessibility of a local Safari browser by WebKit Team / ai, tools, web / 9 min read
The Hidden Cost of Hydration Mismatches: How a single hydration mismatch, combined with web font swapping, can push a React page's Largest Contentful Paint from green into the red by Ivan Akulov / react, performance, frontend / 5 min read

🧰 Tools

12 Factor Agents: Principles for building reliable LLM-powered applications, inspired by the 12-factor app methodology by HumanLayer / ai, agents, framework
Astryx: Meta's open-source design system powering 13,000+ apps — 150+ accessible components, no styling lock-in, and an API designed for humans and AI assistants alike by Meta / design, open-source
Copybara: A tool for transforming and moving code between repositories, keeping a confidential repo and a public repo in sync from one authoritative source by Google / git, tooling, open-source
tiks: Procedural UI sounds for the web — generates click, toggle, success, and error sounds at runtime via oscillators and gain envelopes, at ~2KB gzipped by rexa-developer / web, audio, tooling
pgrust: An AI-Assisted Rewrite of Postgres in Rust: Not production-ready, but it already passes Postgres' own regression tests — built by running eight Codex agents in parallel by Michael Malis / database, rust, ai
Skills by Builder.io: Small composable skills for coding agents that extend Claude Code and Codex with planning, code review, auditing, and documentation verification by Builder.io / ai, agents, tools
FixCSS: A library that converts CSS written in an improved, corrected syntax into browser-compatible CSS, fixing design mistakes catalogued by the CSS Working Group by Declan Chidlow / css, tooling
OpenWiki: CLI that generates and maintains agent-focused documentation for codebases, with commands to initialize, update, and customize model settings by LangChain / ai, agents, docs, tools
Oak: Version control built for agent workflows — content-addressed storage gives instant branch cloning, and working trees mount in about a second without a full git-style clone by Oak / git, tools, ai
cmux: Ghostty-based macOS terminal with vertical tabs, split panes, an embedded browser, and a socket API for running AI coding agents in parallel by manaflow-ai / terminal, tools, ai
Weave Router: Local model router that picks the best LLM for each prompt in under 50ms and cuts inference costs 40-70% without ever sending API keys off-device by Weave / ai, llm, tools
ZeroFS: Open-source filesystem that makes S3-compatible object storage behave like a high-performance, encrypted POSIX filesystem or block device by ZeroFS / storage, filesystem, open-source

🤪 Fun

Where to Find the Colors Your Screen Can't Show You: A journey through real-world colors screens still can't reproduce, despite P3, OKLCH, and other expanding color gamuts by Ryan Moulton / science, color, fun / 36 min read

📺 Videos

Modern UI Patterns: A CSS Day talk on the newest updates in CSS and web UI, plus a 5-principle UX framework for framing modern design decisions by Una Kravets / css, design, talk
We Built a P2P App With No Servers — 1M Users Didn't Miss Them: The original author of Node Cookbook shows how his team built a production peer-to-peer app from scratch with no cloud, no infrastructure, and no vendor lock-in, scaling past a million users by David Mark Clements / p2p, architecture, talk
Building Great Agent Skills: The Missing Manual: A practical talk on designing, structuring, and maintaining Skills that coding agents can reliably use by AI Engineer / ai, agents, talk

Want to read more? Check out the full article here.

To sign up for the weekly newsletter, visit weeklyfoo.com.

Agent Guardrails, Faster Pipelines, and CSSQuake

Adam — Fri, 03 Jul 2026 05:02:49 +0000

AI agents are finally getting some grown-up infrastructure: Cloudflare's temporary accounts let agents deploy without borrowing a human login, Agent Hooks for Deterministic Guardrails pushes rules into the workflow before bad code wanders too far, and PostHog's 70x SQL parser story is a very good reminder that “parallel agents” only sounds impressive if you also keep the validation turned on.

The supporting cast is strong too: Recall brings local-first memory to Claude Code, ast-grep Outline gives agents symbol-level file navigation without inhaling entire files, and Hunk is built specifically for reviewing agent-authored diffs before they mutate into pure scroll fatigue. Add Migration Autopilot for risky database changes, and the tooling story starts looking a lot less like improvisational theater.

Meanwhile, the platform itself is getting sharper: Streaming HTML Might Become a Thing hints at framework-style partial updates going native, Astro 7.0 ships a Rust-powered speed boost plus Advanced Routing, PACT proposes bot throttling without surveillance, npm v12's install-script change gets the necessary “helpful, not magical” security reality check, and GitHub Actions step parallelism quietly deletes a pile of fake-job CI boilerplate.

And because the web still knows how to have fun, CSSQuake proves you can apparently render Quake with HTML/CSS 3D geometry. Completely unreasonable. Completely excellent.

Enjoy!

Signup here for the newsletter to get the weekly digest right into your inbox.

Find the 13 highlighted links of weeklyfoo #143:

I Wrote a 70x Faster SQL Parser While Barely Looking at the Code

by PostHog

Rebuilding PostHog's SQL parser using Claude Code in parallel sessions — 70x faster than the C++ ANTLR parser, validated with property-based testing

🚀 Read it!, ai, engineering

Temporary Cloudflare Accounts for AI Agents

by Cloudflare

Cloudflare's new --temporary flag in Wrangler lets AI agents deploy Workers without human sign-up or MFA

📰 Good to know, cloudflare, ai, agents

Streaming HTML Might Become a Thing

by Ollie Williams

Declarative partial updates — a browser proposal for streaming HTML placeholders — brings framework-style patterns straight to the web platform

📰 Good to know, web, html, browser

Astro 7.0

by Astro Team

Faster build times with a new Rust-powered compilation and Markdown/MDX processing pipeline — Advanced Routing adds full control over the request pipeline

📰 Good to know, astro, javascript, tooling

PACT: Anonymous Credentials for the Web

by Dennis Jackson

Mozilla's proposal for cryptographic bot-rate-limiting without user tracking or device fingerprinting — sites can throttle bots via math, not surveillance

📰 Good to know, security, privacy, browser

Blocking Install Scripts Is Not a Silver Bullet

by Ulises Gascon

npm v12 skips install scripts by default, but a compromised package's code still runs at import time — Node's permissions model and sandboxing are the actual defense

📰 Good to know, javascript, nodejs, security

GitHub Actions Steps Can Now Run in Parallel

by GitHub

Step-level parallelism lets multiple steps run concurrently within a job without needing separate jobs or a matrix workaround

📰 Good to know, github, tooling, ci

Agent Hooks for Deterministic Guardrails

by Zarar

How to use agent hooks to enforce rules AI agents cannot ignore — 100% deterministic checks that fire during work, not after

📰 Good to know, ai, agents

Recall

by raiyanyahya

Local memory plugin for Claude Code — captures session activities offline and generates concise project summaries without external servers or API keys

🧰 Tools, claude, ai, tools

ast-grep Outline

by ast-grep

New feature lets AI agents inspect a file's symbol structure without reading the whole file — fewer tokens, faster code navigation

🧰 Tools, ai, tools, ast

Hunk

by modem-dev

Terminal diff viewer built for agent-authored changesets — review-first with multi-file streams, inline AI annotations, and a skill file for automated feedback sessions

🧰 Tools, ai, tools, terminal, git

Migration Autopilot

by Migration Autopilot

GitHub Action that reviews database migration PRs for dangerous patterns — column drops, renames, truncations, and similar footguns

🧰 Tools, databases, postgres, tools

CSSQuake

by Agustin Capeletto

Quake ported to HTML/CSS 3D geometry via PolyCSS — no WebGL or canvas renderer required

🤪 Fun, css, gamedev, creative

Want to read more? Check out the full article here.

To sign up for the weekly newsletter, visit weeklyfoo.com.

Stay ahead in web development: latest news, tools, and insights #143

Adam — Mon, 29 Jun 2026 04:47:29 +0000

Signup here for the newsletter to get the weekly digest right into your inbox.

weeklyfoo #143 is here: your weekly digest of all webdev news you need to know! This time you'll find 39 valuable links in 5 categories! Enjoy!

🚀 Read it!

I Wrote a 70x Faster SQL Parser While Barely Looking at the Code: Rebuilding PostHog's SQL parser using Claude Code in parallel sessions — 70x faster than the C++ ANTLR parser, validated with property-based testing by PostHog / ai, engineering / 11 min read

📰 Good to know

Building a Design System Specced for Engineers and Agents: How Evil Martians built a design system readable by both engineers and AI agents in seven weeks, cutting the usual audit time with LLM assistance by Evil Martians / design, ai, engineering / 13 min read
Temporary Cloudflare Accounts for AI Agents: Cloudflare's new --temporary flag in Wrangler lets AI agents deploy Workers without human sign-up or MFA by Cloudflare / cloudflare, ai, agents / 8 min read
Everything a Senior Engineer Needs to Know About LLMs: A 30-minute deep dive into Transformers, self-attention mechanisms, and the architecture choices that shape modern language models by pathtostaff / ai, engineering / 30 min read
Streaming HTML Might Become a Thing: Declarative partial updates — a browser proposal for streaming HTML placeholders — brings framework-style patterns straight to the web platform by Ollie Williams / web, html, browser / 4 min read
In Praise of Memcached: The case for choosing Memcached over Redis when you need fast, stateless caching without the complexity of persistence and data structures by jchri.st / databases, performance / 5 min read
Astro 7.0: Faster build times with a new Rust-powered compilation and Markdown/MDX processing pipeline — Advanced Routing adds full control over the request pipeline by Astro Team / astro, javascript, tooling / 21 min read
Vite 8.1: Experimental bundled dev mode radically speeds up dev server startup and full reloads on large apps, plus WASM/ESM integration support by Vite Team / javascript, tooling / 7 min read
window.showDirectoryPicker Opens Up a Whole New World: Chrome's File System Access API lets web apps access local directories — enabling in-browser dev tools and full file editors by Steve Harrison / web, browser, javascript / 2 min read
Modern CSS Theming: How to use light-dark(), contrast-color(), and style-queries for themes that adapt automatically to system preferences by Una Kravets / css, web / 7 min read
The Low-Tech AI of Elden Ring: How Elden Ring's enemies use a stack-based goal management system — a surprisingly simple and effective alternative to behavior trees for dynamic hierarchical AI behavior by nega.tv / engineering, gamedev, ai / 15 min read
PACT: Anonymous Credentials for the Web: Mozilla's proposal for cryptographic bot-rate-limiting without user tracking or device fingerprinting — sites can throttle bots via math, not surveillance by Dennis Jackson / security, privacy, browser / 20 min read
What's Coming in Postgres 19: Quality-of-life improvements arriving in Postgres 19 — REPACK, partitioning enhancements, SQL/PGQ graph queries, and GROUP BY ALL by Craig Kerstiens / databases, postgres / 14 min read
The HTTP QUERY Method: New idempotent HTTP method for sending request bodies in read-only queries — filling the gap between GET and POST for large query payloads by IETF / web, http / 30 min read
Node.js 26.4 Adds Package Maps: Experimental package maps resolve modules from a static JSON file instead of walking node_modules — plus early support for the new vfs subsystem by Antoine du Hamel / javascript, nodejs / 16 min read
Blocking Install Scripts Is Not a Silver Bullet: npm v12 skips install scripts by default, but a compromised package's code still runs at import time — Node's permissions model and sandboxing are the actual defense by Ulises Gascon / javascript, nodejs, security / 21 min read
GitHub Actions Steps Can Now Run in Parallel: Step-level parallelism lets multiple steps run concurrently within a job without needing separate jobs or a matrix workaround by GitHub / github, tooling, ci / 4 min read
Rspack 2.1: Ships TypeScript 7 support and the Rust-based React Compiler — faster builds for projects using the new type stripping and Rust-compiled JSX transform by Rspack Team / javascript, tooling, rust / 17 min read
Agent Hooks for Deterministic Guardrails: How to use agent hooks to enforce rules AI agents cannot ignore — 100% deterministic checks that fire during work, not after by Zarar / ai, agents / 7 min read

🧰 Tools

Recall: Local memory plugin for Claude Code — captures session activities offline and generates concise project summaries without external servers or API keys by raiyanyahya / claude, ai, tools
Orca: AI orchestration tool for running multiple coding agents in parallel, with terminal splits, design mode, and a mobile companion for monitoring workflows by stablyai / ai, agents, tools
cnfast: Drop-in alternative to tailwind-merge, clsx, and classnames with up to 7x faster class merging by Aiden Bai / css, tailwind, tools
Polygraph: Nx's meta-harness that connects all your organization's repos into a synthetic monorepo, letting AI agents read, write, and grep across repo boundaries by Nx / ai, agents, tools
ast-grep Outline: New feature lets AI agents inspect a file's symbol structure without reading the whole file — fewer tokens, faster code navigation by ast-grep / ai, tools, ast
Hunk: Terminal diff viewer built for agent-authored changesets — review-first with multi-file streams, inline AI annotations, and a skill file for automated feedback sessions by modem-dev / ai, tools, terminal, git
Pagecast: Publish local HTML, Markdown, and static mini apps to shareable Cloudflare Pages URLs from the terminal or coding agents. by Amal David / cloudflare
Migration Autopilot: GitHub Action that reviews database migration PRs for dangerous patterns — column drops, renames, truncations, and similar footguns by Migration Autopilot / databases, postgres, tools
Go Micro: Agent harness and service framework for Go — model routing, memory, tools, guardrails, durable workflows, MCP and A2A gateways via pluggable Go interfaces by Go Micro / ai, agents, golang, tools
Hasp: Local-first secret broker with project bindings, time-bounded grants, and first-class agent support — inject secrets into processes or supply them on-demand by Hasp / security, agents, tools
pnpm pnpr: Experimental pnpm-compatible npm registry server written in Rust — early preview of self-hosted package registry support for pnpm workspaces by pnpm / javascript, nodejs, tools
AccessControl 3.0: RBAC/ABAC access control library with a real policy engine, conditional grants, ownership enforcement, mandatory restriction gates, and audit hooks by Onur Yildirim / security, tools
design.md: Format spec for describing a visual identity to coding agents — structured design context that complements CLAUDE.md for AI-assisted development workflows by Google Labs / ai, design, agents, tools
tw-fade: Tailwind CSS v4 plugin for CSS mask fades on scroll containers — scroll edge effects with zero custom CSS by Pete Boere / css, tailwind, tools
Takumi 2.0: Rust-powered engine that renders JSX to images without a headless browser — v2.0 adds SVG output and on-demand Google Fonts by Kane Wang / javascript, react, tools
ForesightJS 4: Predicts user intent from mouse and keyboard cues to prefetch content for a snappier UX — v4 adds a declarative React component by ForesightJS / javascript, performance, tools
grove: Git worktree manager that automates dependency cloning and dev server management per worktree — less boilerplate for parallel branch work by Iheanyi Ekechukwu / git, tools

🤪 Fun

I Stored a Website in a Favicon: Encoding HTML into the RGB channels of a favicon so the browser can extract and render it via JavaScript by Tim Wehrle / creative, web / 5 min read
CSSQuake: Quake ported to HTML/CSS 3D geometry via PolyCSS — no WebGL or canvas renderer required by Agustin Capeletto / css, gamedev, creative / 1 min read

📺 Videos

What's Missing in Postgres?: Bruce Momjian tours features Postgres still lacks — sharding, connection pooling, columnar storage, and transparent data encryption by Bruce Momjian / databases, postgres

Want to read more? Check out the full article here.

To sign up for the weekly newsletter, visit weeklyfoo.com.

Logs, Loops, and the AI Reality Check

Adam — Fri, 26 Jun 2026 04:30:55 +0000

Agent builders got a whole architecture playbook this week: The Log Is the Agent reframes agents as resumable event histories, Don’t Trust Large Context Windows reminds us that “1M tokens” is often marketing math, and AI Demands More Engineering Discipline, Not Less makes the case that faster code generation means stricter systems thinking, not looser standards.

Security and reliability stayed loud: A Backdoor in a LinkedIn Job Offer shows how a fake recruiting flow can weaponize dependency installs, Stop Using JWTs challenges default auth habits, and The Only Scalable Delete in Postgres Is DROP TABLE is the kind of data lifecycle advice you wish you had before your first massive cleanup job.

Also in this issue: A New Era For Software Testing, How TanStack Cut TypeScript Type-Checking Work by Up to 86%, TypeScript 7.0 RC, MDN MCP Server, Lore, Eve, and NUB all point in the same direction: better tooling, sharper feedback loops, and fewer excuses for chaotic engineering.

Enjoy!

Signup here for the newsletter to get the weekly digest right into your inbox.

Find the 14 highlighted links of weeklyfoo #142:

Stop Using JWTs

by samsch

JWTs were never designed for session management — traditional cookie sessions are more secure, more flexible, and avoid the false promise of stateless auth

🚀 Read it!, security, engineering

The Log Is the Agent

by TLDR

The agent is the history of events that make up its data — this log concept lets agents be reconstructed and resumed, unlocking capabilities that make advanced agent use cases easier to reason about

📰 Good to know, ai, agents, engineering

The Only Scalable Delete in Postgres Is DROP TABLE

by PlanetScale

Large DELETEs leave dead tuples, add replication overhead, and don't return disk space — structure your schema so bulk deletion becomes a DROP or TRUNCATE

📰 Good to know, postgres, database, performance

Don't Trust Large Context Windows

by Garrit Franke

LLMs have a reliable smart zone that degrades past roughly 100k tokens — effective attention is a small fraction of the advertised window size

📰 Good to know, ai, llm, performance

AI Demands More Engineering Discipline, Not Less

by Charity Majors

AI makes generating code fast and disposable, shifting us from obsessing over individual lines to managing entire systems — this demands more rigor, not less

📰 Good to know, ai, engineering

A Backdoor in a LinkedIn Job Offer

by roman.pt

A developer was targeted by a fake recruiter requesting a code review for a malicious GitHub repo — installing dependencies would silently execute a remote payload

📰 Good to know, security

A New Era For Software Testing

by Salvatore Sanfilippo

antirez on using AI agents as QA engineers — writing markdown specs that direct agents to exercise the full build on each release, replacing brittle scripted tests

📰 Good to know, ai, testing

How TanStack Cut TypeScript Type-Checking Work by Up to 86%

by TanStack

Using tsc diagnostics to find and eliminate expensive generic chains in TanStack Table v9 — concrete techniques reusable in any type-heavy library

📰 Good to know, typescript, performance, react

You Got Faster, Your Company Didn't

by Terrible Software

AI makes individual developers dramatically more productive but organizational structures built for slower output haven't adapted — the bottleneck has moved from writing code to reviewing, merging, and coordinating

📰 Good to know, ai, engineering, productivity

TypeScript 7.0 RC

by Microsoft

The release candidate ships the Go-based rewrite — 10x faster type-checking with no code changes required

📰 Good to know, typescript, javascript

MDN MCP Server

by MDN Team

Bring MDN's web platform documentation and browser compatibility data into any AI agent or IDE — accurate up-to-date answers instead of relying on stale model training data

🧰 Tools, mcp, ai, tools, web

Lore

by Epic Games

Epic Games' open-source version control system optimized for projects combining code with large binary assets — verifiable tamper-evident history with an interface built for both developers and artists

🧰 Tools, tools, git, gamedev

Eve

by Vercel

Vercel's open-source agent framework with built-in durable execution, sandboxed computing, and human-in-the-loop approvals — agents are defined as a directory of files specifying components, actions, and connections

🧰 Tools, tools, ai, agents

NUB

by Colin McDonnell

All-in-one toolkit from Zod's creator that augments Node.js — adds full TypeScript support beyond type stripping, faster and more secure package installation, and richer .env handling without replacing your package manager

🧰 Tools, nodejs, typescript, tools

Want to read more? Check out the full article here.

To sign up for the weekly newsletter, visit weeklyfoo.com.

Stay ahead in web development: latest news, tools, and insights #142

Adam — Mon, 22 Jun 2026 05:22:55 +0000

Signup here for the newsletter to get the weekly digest right into your inbox.

weeklyfoo #142 is here: your weekly digest of all webdev news you need to know! This time you'll find 37 valuable links in 4 categories! Enjoy!

🚀 Read it!

Stop Using JWTs: JWTs were never designed for session management — traditional cookie sessions are more secure, more flexible, and avoid the false promise of stateless auth by samsch / security, engineering / 23 min read

📰 Good to know

The Log Is the Agent: The agent is the history of events that make up its data — this log concept lets agents be reconstructed and resumed, unlocking capabilities that make advanced agent use cases easier to reason about by TLDR / ai, agents, engineering / 1 min read
The Only Scalable Delete in Postgres Is DROP TABLE: Large DELETEs leave dead tuples, add replication overhead, and don't return disk space — structure your schema so bulk deletion becomes a DROP or TRUNCATE by PlanetScale / postgres, database, performance / 8 min read
Don't Trust Large Context Windows: LLMs have a reliable smart zone that degrades past roughly 100k tokens — effective attention is a small fraction of the advertised window size by Garrit Franke / ai, llm, performance / 4 min read
AI Demands More Engineering Discipline, Not Less: AI makes generating code fast and disposable, shifting us from obsessing over individual lines to managing entire systems — this demands more rigor, not less by Charity Majors / ai, engineering / 21 min read
A Backdoor in a LinkedIn Job Offer: A developer was targeted by a fake recruiter requesting a code review for a malicious GitHub repo — installing dependencies would silently execute a remote payload by roman.pt / security / 5 min read
News from WWDC26: WebKit in Safari 27 Beta: Safari 27 ships 58 new features including customizable select, sizes=auto for lazy images, and CSS gap decorations by WebKit Team / css, frontend, browser / 67 min read
CSS is Filling the Gaps: Gap decorations in grid and flex are now stable in Chrome 149 — style the space between rows and columns with column-rule, rule-inset, and more by Brecht De Ruyte / css, frontend / 13 min read
A New Era For Software Testing: antirez on using AI agents as QA engineers — writing markdown specs that direct agents to exercise the full build on each release, replacing brittle scripted tests by Salvatore Sanfilippo / ai, testing / 4 min read
WASI 0.3: WebAssembly System Interface 0.3 ships native async support for WebAssembly Components — a major milestone for WASM-based server and edge runtimes by Bytecode Alliance / webassembly, wasm / 9 min read
How TanStack Cut TypeScript Type-Checking Work by Up to 86%: Using tsc diagnostics to find and eliminate expensive generic chains in TanStack Table v9 — concrete techniques reusable in any type-heavy library by TanStack / typescript, performance, react / 23 min read
Don't Run SQL Migrations in Tests: Content-addressing database state by hashing all migration scripts lets a test suite clone a cached database instead of running every migration per test — halved one Go project's test time by Guillaume Gaultier / go, testing, database / 12 min read
Babel 8.0: The JavaScript compiler's first major release in eight years ships as ESM-only with dropped support for older Node.js versions and legacy polyfills by Babel Team / javascript, tooling / 11 min read
The Scope of CSS @function: CSS custom functions resolve variables from where they are called rather than where they are defined — unlike custom properties they don't inherit through the DOM, letting library authors encapsulate complex logic behind clean APIs by Jane Ori / css, frontend / 14 min read
You Got Faster, Your Company Didn't: AI makes individual developers dramatically more productive but organizational structures built for slower output haven't adapted — the bottleneck has moved from writing code to reviewing, merging, and coordinating by Terrible Software / ai, engineering, productivity / 5 min read
Node.js Security Releases: Eleven vulnerabilities fixed across Node.js 26.3.1, 24.17.0, and 22.23.0 — two rated high severity: a TLS hostname normalization bug and a WebCrypto flaw by Node.js Team / nodejs, javascript, security / 4 min read
Large-Scale Malware Distribution Found on GitHub: A campaign using 10,000 repositories distributes Trojan malware disguised under various project names — repos constantly delete and re-add commits to complicate detection by Orchid Files / security, github / 10 min read
TypeScript 7.0 RC: The release candidate ships the Go-based rewrite — 10x faster type-checking with no code changes required by Microsoft / typescript, javascript / 20 min read

🧰 Tools

Ponytail: AI senior developer tool that produces efficient, minimal code at low cost and fast speeds — prioritizes native solutions over over-engineered abstractions and works with every model by DietrichGebert / ai, tools, cli
SQL to ER Diagram: Paste a SQL schema and instantly generate a clean, interactive ER diagram by sqltoerdiagram / tools, database, sql
mac-ocr: CLI tool built on Apple's Vision framework for local, offline OCR on macOS — no cloud API required by Hiroki Osame / cli, tools, macos
LikeC4: Architecture-as-code platform — describe your software systems in a DSL and get live, always-up-to-date architecture diagrams generated automatically by LikeC4 / tools, architecture
MDN MCP Server: Bring MDN's web platform documentation and browser compatibility data into any AI agent or IDE — accurate up-to-date answers instead of relying on stale model training data by MDN Team / mcp, ai, tools, web
Epiq: Git-backed issue tracker with a TUI and kanban board — issues live with the code, work offline, and use append-only events to avoid conflicts by ljtn / tools, git, cli
databow: CLI to run SQL against any ADBC database — supports DuckDB, BigQuery, Postgres, and SQLite with syntax highlighting and multiple output formats by Columnar Tech / tools, database, cli
Prop for That: Bridges JavaScript values to CSS custom properties declaratively — mouse position, slider values, and the current time available as live CSS properties via a single HTML attribute by Adam Argyle / css, javascript, tools
Lore: Epic Games' open-source version control system optimized for projects combining code with large binary assets — verifiable tamper-evident history with an interface built for both developers and artists by Epic Games / tools, git, gamedev
Eve: Vercel's open-source agent framework with built-in durable execution, sandboxed computing, and human-in-the-loop approvals — agents are defined as a directory of files specifying components, actions, and connections by Vercel / tools, ai, agents
NUB: All-in-one toolkit from Zod's creator that augments Node.js — adds full TypeScript support beyond type stripping, faster and more secure package installation, and richer .env handling without replacing your package manager by Colin McDonnell / nodejs, typescript, tools
Iroh 1.0: Peer-to-peer encrypted networking stack that punches through NAT and firewalls — built in Rust with official Node.js bindings for adding direct, private connections to any app by Iroh / nodejs, networking, tools, p2p
Playwright 1.61: Now supports registering and testing passkeys, plus a new WebStorage API for reading and writing localStorage and sessionStorage directly in tests by Playwright Team / testing, javascript, tools
Clear: Programming language where the spec and implementation are the same file — no translation step, no drift between docs and behavior, compiles to any target without modifying the spec by Şahin Özdemir / tools, ai, agents, programming
Deno Desktop: Electron alternative built on Deno instead of Node.js — native window APIs with smaller binary size and faster startup by Deno / deno, javascript, tools
ASCILINE: A high-performance, real-time ASCII video rendering engine. Streams binary-encoded frames via WebSockets for ultra-low latency, 30 FPS playback using HTML5 Canvas and requestAnimationFrame. by SteadyW / ascii, animation
Flue 1.0 Beta: Cloudflare's open-source agent framework beta — built on Workers and Durable Objects as a rival to Vercel's Eve by Cloudflare / ai, agents, tools

🤪 Fun

The Virtual OS Museum: A Linux VM that runs over 1700 historical operating systems from 1948 to present under emulation — mainframes, Unix variants, home computers, and mobile by virtualosmuseum.org / history, fun, os / 10 min read
Sketching the Impossible: A 3D portfolio built without a single 3D model — pure CSS and creative technique by Codrops / css, frontend, portfolio, fun / 19 min read

Want to read more? Check out the full article here.

To sign up for the weekly newsletter, visit weeklyfoo.com.

Code Is Cheap, Burnout Is Not

Adam — Fri, 19 Jun 2026 04:43:27 +0000

The theme of the week is unmistakable: AI writes the code, and now everything else is the bottleneck. Christoph Nakazawa argues that with agents generating more code than humans, what matters has shifted — ownership, taste, and strict-but-fast feedback loops beat raw throughput. Carson Gross puts it bluntly: if code costs nothing to write, the bottleneck is judgment. Addy Osmani makes it explicit: undocumented goals and rationale are now high-interest technical debt in AI-assisted engineering. And Builder.io calls it: agent experience (AX) is the new developer experience.

The bad news? Evil Martians brings data showing AI-assisted engineers are burning out — hidden cognitive overload, decreased fulfillment, and lost ownership are real costs the productivity headlines skip.

On the practical front: react.doctor breaks down why useEffect keeps surprising everyone (dependency model bugs in disguise), and performance.dev documents how a Tauri+SQLite app rebuilt with TanStack Router came out twice as fast. TanStack AI just dropped in beta — framework-agnostic, composable, and potentially the React Query moment for application-level AI.

Supply chain this week: npm v12 ships default-deny for install scripts after a year of attack headlines, and DepsGuard brings policy-as-code for your package manager config across npm, pnpm, yarn, and bun. sem adds semantic version control on top of Git — diff at the function level, not the line level. pg_durable brings exactly-once task execution inside Postgres, potentially retiring your entire message queue tier. free-email-domains gives you every known free email provider in one maintained list, and asm unifies Claude Code, Cursor, and Windsurf agent skills from a single CLI.

Enjoy!

Signup here for the newsletter to get the weekly digest right into your inbox.

Find the 12 highlighted links of weeklyfoo #141:

The Intent Debt

by Addy Osmani

Undocumented goals and rationale are technical debt that agentic AI makes far more expensive

🚀 Read it!, ai, engineering, documentation

The Problem with useEffect

by react.doctor

Why useEffect runs more than expected and how to fix it with useMemo and useCallback

📰 Good to know, react, hooks

The Conductor Rewrite

by performance.dev

How a Tauri React app backed by SQLite was rebuilt to run twice as fast with TanStack Router and react-virtuoso

📰 Good to know, react, performance, tauri

Modern Engineering Values

by Christoph Nakazawa

With agents writing more code, the values that matter shift — ownership, taste, and strict-but-fast feedback loops matter more than raw throughput

📰 Good to know, engineering, ai, culture

npm v12 to Stop Running Install Scripts by Default

by GitHub

After a year of supply chain attacks, npm v12 will no longer execute pre/install/postinstall scripts unless explicitly approved via a new npm approve-scripts workflow

📰 Good to know, npm, security, javascript

AI-Assisted Engineers Are Burning Out. Is This Fine?

by Evil Martians

AI tools introduce hidden cognitive costs — overload, decreased fulfillment, and lost ownership — making AI a productivity trap for many developers

📰 Good to know, ai, engineering, culture

TanStack AI in Beta

by TanStack

Framework and provider-agnostic AI toolkit for React, Vue, Solid, and Angular — brings TanStack's composable headless philosophy to AI integrations

📰 Good to know, react, ai, javascript

sem

by Ataraxy Labs

Semantic version control on top of Git that shows what entities changed (functions, methods, classes) not just lines

🧰 Tools, cli, git, developer-tools

pg_durable

by Microsoft

PostgreSQL extension for durable, exactly-once execution of long-running tasks

🧰 Tools, postgresql, database, tools

free-email-domains

by Kikobeats

Maintained list of every known free email provider — useful for filtering sign-ups or validating email inputs

🧰 Tools, tools, security, email

asm

by luongnv89

Unified CLI for managing AI agent skills across Claude Code, Cursor, and Windsurf — install, search, and audit capabilities from one place

🧰 Tools, tools, cli, ai

DepsGuard

by Arnica

Rust-based tool that audits and rewrites your package manager config to disable install scripts, enforce cooldowns, and block provenance downgrades across npm, pnpm, yarn, and bun

🧰 Tools, tools, security, npm

Want to read more? Check out the full article here.

To sign up for the weekly newsletter, visit weeklyfoo.com.

Stay ahead in web development: latest news, tools, and insights #141

Adam — Mon, 15 Jun 2026 04:56:47 +0000

Signup here for the newsletter to get the weekly digest right into your inbox.

weeklyfoo #141 is here: your weekly digest of all webdev news you need to know! This time you'll find 42 valuable links in 4 categories! Enjoy!

🚀 Read it!

The Intent Debt: Undocumented goals and rationale are technical debt that agentic AI makes far more expensive by Addy Osmani / ai, engineering, documentation / 10 min read

📰 Good to know

The Problem with useEffect: Why useEffect runs more than expected and how to fix it with useMemo and useCallback by react.doctor / react, hooks / 4 min read
The Conductor Rewrite: How a Tauri React app backed by SQLite was rebuilt to run twice as fast with TanStack Router and react-virtuoso by performance.dev / react, performance, tauri / 16 min read
How LLMs Actually Work: Tokens, embeddings, attention, transformers, and residual connections explained from the ground up by @0xkato / ai, llm, ml / 25 min read
The Hidden Why: Behavioral Economics for UX: How psychological and social factors drive user behavior, and the 3B Framework for designing around friction by Nielsen Norman Group / ux, design, product / 11 min read
How to Make Your Design System AI-Ready: Hard-coded values and undocumented decisions break AI prototyping — structured tokens and documented constraints fix it by Smashing Magazine / design-systems, ai, frontend / 7 min read
Announcing Angular v22: Signal Forms, Angular Aria, and async reactivity graduate to stable; new experimental features include async DI, template improvements, and error boundaries by The Angular Team / angular, javascript, frontend / 1 min read
Modern Engineering Values: With agents writing more code, the values that matter shift — ownership, taste, and strict-but-fast feedback loops matter more than raw throughput by Christoph Nakazawa / engineering, ai, culture / 14 min read
Code Is Cheap: If code costs nothing to write, the bottleneck shifts to judgment — knowing what to build, what to delete, and what the system actually needs by Carson Gross / engineering, ai, simplicity / 5 min read
State of the Software Engineering Job Market in 2026, Part 2: AI engineering comp now exceeds software engineering comp; frontend-only roles are shrinking fastest; intern intake keeps falling even as hiring recovers by The Pragmatic Engineer / engineering, career, ai / 11 min read
Initial Impressions of Claude Fable 5: Hands-on notes on the new model — 1M token context, stricter guardrails, and API fallback support when safety filters trigger by Simon Willison / ai, claude, llm / 14 min read
Agent Experience Is the New Developer Experience: As AI agents become active contributors, engineering must shift from DX to AX — deterministic context layers, scoped permissions, and reliable workspaces for stateless models by Builder.io / ai, engineering, agents / 16 min read
Doing Nothing at Work: Why an 80% utilization rate protects engineers from burnout and keeps them available for high-impact opportunities by Sean Goedecke / engineering / 11 min read
Loop Engineering: Replace yourself as the agent prompter with an automated loop that drives AI agents to completion without supervision by @addyosmani / ai, engineering / 1 min read
8 Myths On Software Engineering And AI: Why AI's measured engineering impact lags its promise — from how devs spend time to measurement gaps and real adoption patterns by Brian Houck / ai, engineering, dx / 6 min read
Design Systems Are Over. Product Context Is the Work: Components stay essential but AI needs broader product context — decisions, constraints, and reasoning — to maintain coherence as it generates at scale by Robin Cannon / design-systems, ai, design / 5 min read
npm v12 to Stop Running Install Scripts by Default: After a year of supply chain attacks, npm v12 will no longer execute pre/install/postinstall scripts unless explicitly approved via a new npm approve-scripts workflow by GitHub / npm, security, javascript / 4 min read
The Fundamentals and Dev Experience of CSS @function: @function lets you define stylesheet-scoped functions that return values anywhere CSS can use one — Chromium-only for now but the potential is significant by Jane Ori / css, frontend / 20 min read
AI-Assisted Engineers Are Burning Out. Is This Fine?: AI tools introduce hidden cognitive costs — overload, decreased fulfillment, and lost ownership — making AI a productivity trap for many developers by Evil Martians / ai, engineering, culture / 20 min read
Predicting AI Job Exposure: Predicting which jobs AI will automate is nearly impossible — the jobs will change, the tools will change, and measuring work that way doesn't hold up by Benedict Evans / ai, industry / 10 min read
React Libraries and Tools for 2026: Robin Wieruch's annual opinionated survey of the React ecosystem — from app scaffolding through state management, testing, and i18n by Robin Wieruch / react, javascript, ecosystem / 31 min read
TanStack AI in Beta: Framework and provider-agnostic AI toolkit for React, Vue, Solid, and Angular — brings TanStack's composable headless philosophy to AI integrations by TanStack / react, ai, javascript / 10 min read

🧰 Tools

sem: Semantic version control on top of Git that shows what entities changed (functions, methods, classes) not just lines by Ataraxy Labs / cli, git, developer-tools
Defending Code Reference Harness: Reference harness for testing how well LLMs defend code against adversarial prompts by Anthropic / security, ai, llm
pg_durable: PostgreSQL extension for durable, exactly-once execution of long-running tasks by Microsoft / postgresql, database, tools
gitdot: A home for great open-source software. by bkdevs / git
performative-ui: AI-native React components that signal how oversubscribed your funding round is. by Li Zhang / ui, react
free-email-domains: Maintained list of every known free email provider — useful for filtering sign-ups or validating email inputs by Kikobeats / tools, security, email
asm: Unified CLI for managing AI agent skills across Claude Code, Cursor, and Windsurf — install, search, and audit capabilities from one place by luongnv89 / tools, cli, ai
Desktop Commander MCP: MCP server that lets AI models execute shell commands, manage processes, and perform surgical code edits on local files including Excel, PDF, and Word by wonderwhy-er / tools, mcp, ai
Apache Burr: Open-source Python framework for building chatbots and agents as graphs of simple Python functions with explicit state and transition management by Apache / python, agents, tools
HelixDB: Rust OLTP database unifying graph, vector, relational, and document data in one system — designed to simplify AI memory and context management by HelixDB / database, ai, rust
MonoSketch: Browser-based ASCII sketching and diagramming tool for creating visual designs with ASCII characters — open source by MonoSketch / ascii, tools, design
DepsGuard: Rust-based tool that audits and rewrites your package manager config to disable install scripts, enforce cooldowns, and block provenance downgrades across npm, pnpm, yarn, and bun by Arnica / tools, security, npm
Bonsai: Fast sandboxed expression language for safely evaluating user-supplied rules, filters, or templates without reaching for eval by Daniel Fry / javascript, tools, security
MD This Page: Browser extension that converts any web page to clean readable Markdown in one click by Ademking / tools, browser, markdown
UIverse: Community-built library of open-source UI elements — copy as HTML/CSS, Tailwind, React, or Figma by UIverse / ui, tools, frontend
Animation Vocabulary: A glossary of common animation patterns with names you can use when prompting AI for motion design by animations.dev / design, animation, tools
Noodle: Skills-based agent orchestrator that runs itself — define skills, wire them together, let the agent figure out its own execution plan by poteto / tools, agents, ai
architect-loop: Claude Fable 5 as architect, GPT-5.5 Codex as builder, the repo as memory - a research-backed Claude Code skill for the cross-vendor agent loop by Dan McInerney / ai, claude, skills, fable, codex

🤪 Fun

Mitos: ASCII art generator that converts images, GIFs, and JavaScript into text-based illustrations with customizable character sets by Oxide Computer / ascii, art, generator / 6 min read
node_modules Heap: Walk through a node_modules folder in your browser FPS-style — absurd, delightful, and oddly educational by Andrew Nesbitt / javascript, fun, nodejs / 1 min read

Want to read more? Check out the full article here.

To sign up for the weekly newsletter, visit weeklyfoo.com.

Backdoored npm, Stolen Tokens, and VoidZero Soars

Adam — Fri, 12 Jun 2026 04:38:44 +0000

Red Hat's npm channel got backdoored — yes, the official one — so if your dependency hygiene was already anxious, Gabor Koos has the 2026 vetting checklist to restore some confidence. Meanwhile, Ammar Askar shows that a single malicious link can steal your GitHub token through a VSCode webview bug, which is the kind of vulnerability that makes you want to audit every extension you've ever installed.

On the more uplifting side: VoidZero joins Cloudflare, bringing the whole Vite, Vitest, Rolldown, and Oxc ecosystem under one very well-funded roof. Postgres 19 adds SQL/PGQ support so you can finally run Cypher-style graph queries without reaching for a separate datastore. And Anthropic pulls back the curtain on how they keep Claude contained across products — sandboxes, VMs, strict egress controls, and model training working together, because hope is not a containment strategy.

Also in this issue: Loris Cro makes the compelling case for keeping assertions alive in production (your panics are actually your friends), Harry Roberts introduces the TBT Window — the performance metric hiding in plain sight between FCP and TTI, Matt Pocock ships Sandcastle for running AI agents in provider-agnostic isolated sandboxes, and Google's Code Wiki auto-generates architecture docs that actually stay current. replacements.fyi helps you swap bloated npm packages for leaner alternatives or Node.js built-ins, Xata's DeltaX brings columnar time-series performance inside regular Postgres tables, and Alibaba's Open Code Review adds AI-powered diff analysis with line-level precision to your CLI workflow.

Enjoy!

Signup here for the newsletter to get the weekly digest right into your inbox.

Find the 13 highlighted links of weeklyfoo #140:

How to Evaluate an npm Package: 2026 Edition

by Gabor Koos

A practical checklist for vetting packages beyond star counts — provenance attestation, install scripts, CI quality, and maintainer responsiveness

🚀 Read it!, npm, javascript, security

You Must Fix Your Asserts

by Loris Cro

Disabling assertions in production lets software run under false assumptions — keep them active to trigger panics on violation or use them as compiler optimization hints

📰 Good to know, debugging, assertions, code-quality

Dozens of Red Hat npm Packages Backdoored

by Ars Technica

Supply chain attack via the official npm channel — dozens of packages compromised through a hijacked publishing account

📰 Good to know, security, npm, supply-chain

1-Click GitHub Token Stealing via a VSCode Bug

by Ammar Askar

A vulnerability in VSCode's webview security model lets attackers steal GitHub tokens through a single malicious link by bubbling keyboard events from isolated iframes

📰 Good to know, security, vscode, github

Frontend's Missing Metric: The TBT Window

by Harry Roberts

A case for tracking the FCP-to-TTI interval where TBT is counted — TBT can silently regress with no real change in blocking work as FCP or TTI shift

📰 Good to know, performance, css, web-vitals

Handling Graphs with SQL/PGQ in Postgres 19

by Hans-Jürgen Schönig

Postgres 19 adds SQL/PGQ support — declare a property graph over tables and pattern-match with Cypher-like MATCH queries, all rewritten to relational queries by the planner

📰 Good to know, postgres, graphs, sql

VoidZero Joins Cloudflare

by Cloudflare

The company behind Vite, Vitest, Rolldown, and Oxc is joining Cloudflare — the JS toolchain stack with the most momentum just found a new home

📰 Good to know, javascript, vite, tooling

How We Contain Claude Across Products

by Anthropic

Anthropic's multi-layered containment approach — sandboxes, VMs, strict egress controls, and model training — limits agent blast radius more reliably than human supervision alone

📰 Good to know, ai, security, engineering

Sandcastle

by Matt Pocock

Provider-agnostic TypeScript library for running AI coding agents in isolated sandboxes — Docker, Podman, or Vercel

🧰 Tools, ai, typescript, agents

Code Wiki

by Google for Developers

Gemini-generated repo documentation that stays up-to-date — generates natural language summaries and architecture diagrams for any repository

🧰 Tools, ai, documentation, tools

DeltaX

by Xata

Columnar storage extension for time-series data in Postgres — uses regular tables so replication, backups, and pg_dump work as usual

🧰 Tools, postgres, time-series, extensions

replacements.fyi

by e18e

Type in an npm package name and get lighter alternatives or Node.js built-in equivalents — is-number becomes a one-liner, axios becomes fetch, chalk becomes util.styleText

🧰 Tools, npm, javascript, tools

Open Code Review

by Alibaba

AI-powered code review CLI that reads git diffs, sends files to a configurable LLM via an agent with tool-use capabilities, and generates structured review comments with line-level precision

🧰 Tools, ai, code-review, cli

Want to read more? Check out the full article here.

To sign up for the weekly newsletter, visit weeklyfoo.com.

Stay ahead in web development: latest news, tools, and insights #140

Adam — Mon, 08 Jun 2026 04:52:25 +0000

Signup here for the newsletter to get the weekly digest right into your inbox.

weeklyfoo #140 is here: your weekly digest of all webdev news you need to know! This time you'll find 37 valuable links in 4 categories! Enjoy!

🚀 Read it!

How to Evaluate an npm Package: 2026 Edition: A practical checklist for vetting packages beyond star counts — provenance attestation, install scripts, CI quality, and maintainer responsiveness by Gabor Koos / npm, javascript, security / 17 min read

📰 Good to know

You Must Fix Your Asserts: Disabling assertions in production lets software run under false assumptions — keep them active to trigger panics on violation or use them as compiler optimization hints by Loris Cro / debugging, assertions, code-quality / 15 min read
Build Agents, Not Pipelines: Pipelines use fixed logic for predictability at scale; agents manage their own control flow for complex reasoning — a practical guide to knowing which to reach for by Sean Goedecke / ai, agents, llm / 13 min read
Figma Make, Now on Your Local Code: Designers can now edit directly in the production codebase from Figma — visual edits, annotations, and PR creation without context switching by Figma / figma, design, tools / 9 min read
Your Process' Memory Is a File: Linux's /proc/pid/mem allows direct read and write access to a process's address space using standard file semantics by Michal Zalewski / linux, systems / 7 min read
Websites Have a New Way to Spy on Visitors: Analyzing Their SSD Activity: The FROST method uses JavaScript to measure SSD timing patterns and infer which apps and tabs a visitor has open — a covert browser-based side-channel by Ars Technica / security, privacy, browser / 7 min read
Dozens of Red Hat npm Packages Backdoored: Supply chain attack via the official npm channel — dozens of packages compromised through a hijacked publishing account by Ars Technica / security, npm, supply-chain / 7 min read
Why Does tsgo Use So Much Memory?: A deep dive into the Go-powered TypeScript 7 compiler and why it can chew through gigabytes on large projects by Zack Radisic / typescript, performance, compilers / 12 min read
1-Click GitHub Token Stealing via a VSCode Bug: A vulnerability in VSCode's webview security model lets attackers steal GitHub tokens through a single malicious link by bubbling keyboard events from isolated iframes by Ammar Askar / security, vscode, github / 14 min read
Chrome DevTools MCP Server Stable in Chrome 149: The MCP server and CLI for Chrome DevTools letting AI coding agents drive debugging and perf audits is now officially stable by Chrome for Developers / chrome, devtools, mcp, ai / 10 min read
HTML-in-Canvas API Origin Trial: Draw live interactive HTML and CSS into a canvas element — combining DOM accessibility and text layout with performant low-level graphics by Chrome for Developers / html, canvas, chrome, frontend / 8 min read
Frontend's Missing Metric: The TBT Window: A case for tracking the FCP-to-TTI interval where TBT is counted — TBT can silently regress with no real change in blocking work as FCP or TTI shift by Harry Roberts / performance, css, web-vitals / 19 min read
Handling Graphs with SQL/PGQ in Postgres 19: Postgres 19 adds SQL/PGQ support — declare a property graph over tables and pattern-match with Cypher-like MATCH queries, all rewritten to relational queries by the planner by Hans-Jürgen Schönig / postgres, graphs, sql / 1 min read
The Night Our Tables Wouldn't Stop Growing: A production incident where a stray statement_timeout quietly broke logical replication and caused tables to balloon overnight by Semab Tariq / postgres, production, incident / 11 min read
VoidZero Joins Cloudflare: The company behind Vite, Vitest, Rolldown, and Oxc is joining Cloudflare — the JS toolchain stack with the most momentum just found a new home by Cloudflare / javascript, vite, tooling / 13 min read
Every Byte Matters: Packing data into Struct-of-Arrays instead of Array-of-Structs aligns access with cache lines — the technique can yield up to 30x performance improvements on sequential workloads by Fathi Zakaria / performance, engineering, systems / 6 min read
How We Contain Claude Across Products: Anthropic's multi-layered containment approach — sandboxes, VMs, strict egress controls, and model training — limits agent blast radius more reliably than human supervision alone by Anthropic / ai, security, engineering / 24 min read

🧰 Tools

Website Spec: A platform-agnostic specification of the technical features every decent website should have. by Joost de Valk / spec, web, seo, a11y
Sandcastle: Provider-agnostic TypeScript library for running AI coding agents in isolated sandboxes — Docker, Podman, or Vercel by Matt Pocock / ai, typescript, agents
Flowsint: Open-source graph-based OSINT tool that maps relationships between domains, IP addresses, and social media profiles by reconurge / security, osint, tools
Hocuspocus 4: Plug-and-play real-time collaboration backend based on Yjs — runs on Node, Bun, Deno, or Cloudflare Workers by Tiptap / collaboration, yjs, real-time
React Native Runtimes: Run React Native components and functions across multiple JS threads to prevent main UI lag — offload heavy work like chat screens and large lists to dedicated secondary runtimes by Margelo / react-native, javascript, performance
Paseo: Self-hosted, privacy-focused platform for orchestrating and running multiple AI coding agents across mobile, desktop, and CLI environments by getpaseo / ai, agents, tools
HueGrid: Generate gradients across 22+ modes including mesh blending, noise-based organics, aurora effects, and particle fields by HueGrid / design, gradients, tools
Letterbox: Pick a font, choose your colors, and watch letters shaped by text come alive — a typographic playground by Letterbox / typography, design, fun
Liquid DOM: DOM-based implementation of Apple's liquid glass effect using HTML-in-Canvas and WebGPU by AndrewPrifer / css, webgpu, frontend, demo
Curlwind: No-build Tailwind utility generator — drop in a CDN URL with query params specifying only the classes you need, any variants, and custom prefixes by Steve Bauman / tailwind, css, tools
Code Wiki: Gemini-generated repo documentation that stays up-to-date — generates natural language summaries and architecture diagrams for any repository by Google for Developers / ai, documentation, tools
DeltaX: Columnar storage extension for time-series data in Postgres — uses regular tables so replication, backups, and pg_dump work as usual by Xata / postgres, time-series, extensions
replacements.fyi: Type in an npm package name and get lighter alternatives or Node.js built-in equivalents — is-number becomes a one-liner, axios becomes fetch, chalk becomes util.styleText by e18e / npm, javascript, tools
Mnemo: Local-first AI memory layer that stores persistent knowledge in a SQLite knowledge graph and injects relevant context into LLM sessions automatically by zaydmulani09 / ai, memory, tools
Open Code Review: AI-powered code review CLI that reads git diffs, sends files to a configurable LLM via an agent with tool-use capabilities, and generates structured review comments with line-level precision by Alibaba / ai, code-review, cli
Boxes: Cloud workbench for running multiple AI coding agents in parallel within isolated, persistent virtual machines — monitor and manage from any device by Boxes / ai, agents, tools
The Auth Book: Free comprehensive guide to authentication — sessions, passkeys, OAuth, and CSRF prevention for developers who want to understand the fundamentals by Pilcrow / auth, security, web

📺 Videos

Stop Using :invalid and :valid — Use This Instead: A 3-minute CSS tip on a better approach to inline form validation using CSS without JavaScript hacks by Zoran Jambor / css, forms, frontend
Postgres at 30 — A Chat with Its Creator: Mike Stonebraker covers how Postgres came to be, where Google and Amazon get databases wrong, and what he's building next by The Peterman Pod / postgres, interview, databases
All 17 TanStack Projects in One App: 14-minute tour of the entire TanStack ecosystem — Start, Router, Form, Query, and more all demonstrated in a single application by Jack Herrington / javascript, tanstack, react

Want to read more? Check out the full article here.

To sign up for the weekly newsletter, visit weeklyfoo.com.

Supply-Chain Sirens and Agent Upgrade Fever

Adam — Fri, 05 Jun 2026 05:04:30 +0000

This week opens with a full-on supply-chain thriller: Ars Technica details TeamPCP poisoning hundreds of open-source packages, and GitHub’s npm update lands at exactly the right moment with staged publishing and tighter install-time controls.

Performance nerds are eating well: Yelp’s Rspack migration cut build times hard, Linear’s architecture teardown shows what “feels instant” really costs in engineering effort, and RuneScape on 56K proves constraints still produce timeless ideas.

On the AI/dev workflow front, Builder.io calls out the “AI PR slop” tax, while Anthropic and Stripe’s talk show where serious agent orchestration is heading. Add in FLUE, Skybridge, and Kysely 0.29, and the tooling layer is moving almost as fast as the model layer.

Also worth pinning to your “save me later” list: Node stream leak failure modes, the sneaky PostgreSQL now() transaction-time trap, Deno 2.8, and a quietly important accessibility reminder from Manuel Matuzovic: don’t put aria-label on generic div/span elements unless you enjoy unpredictable screen-reader behavior.

Enjoy!

Signup here for the newsletter to get the weekly digest right into your inbox.

Find the 15 highlighted links of weeklyfoo #139:

How Soon is now() in PostgreSQL

by Oskar Dudycz

now() isn't the current time but when the transaction started, which matters when a retry loop sees the same frozen timestamp and never makes progress

🚀 Read it!, postgres, sql, engineering

A hacker group is poisoning open source code at an unprecedented scale

by Ars Technica

TeamPCP has corrupted hundreds of open source tools in supply chain attacks even breaching GitHub via a poisoned VSCode extension

📰 Good to know, security, open-source

Staged Publishing and New Install Controls for npm

by GitHub

npm and pnpm now support a review period before packages go live on the registry, with new options to control package sourcing

📰 Good to know, npm, javascript, security

Optimizing Build Times by Migrating from Webpack to Rspack

by Benson Pan

How Yelp cut build times in half with the Rust-powered webpack drop-in and what they learned about barrel files

📰 Good to know, performance, javascript, build

Don't Put aria-label on Generic Elements like Divs

by Manuel Matuzovic

Why slapping aria-label on a plain div or span is a spec violation and how screen readers across browsers show wildly inconsistent results

📰 Good to know, accessibility, html, a11y

The Production Playbook for Node.js Stream Leaks

by Durgesh Pawar

Five failure modes for Node streams that sail past tests and code review then break under real traffic, from unnoticed disconnects to leftover upstream fetches

📰 Good to know, nodejs, performance, engineering

How Linear is So Fast: A Technical Breakdown

by performance.dev

A teardown of Linear's local-first architecture, aggressive code splitting, granular observables, and GPU-accelerated animations

📰 Good to know, performance, engineering, frontend

How 2004 RuneScape Fit a Multiplayer RPG into 56K Dial-Up

by jkm.dev

A deep dive into the custom bit-packing protocol that kept a massive MMO playable on dial-up using shared world state

📰 Good to know, performance, engineering, history

I Didn't Become a Developer to Review AI Slop

by builder.io

AI made it cheap to open pull requests but not trustworthy, burying developers in mystery diffs that look clean on the surface but hide bugs and debt

📰 Good to know, ai, engineering, review

Introducing Dynamic Workflows in Claude Code

by Anthropic

Claude can now write orchestration scripts that spin up hundreds of parallel subagents for complex end-to-end tasks, in research preview for Max and Enterprise plans

📰 Good to know, ai, agents, engineering

Deno 2.8

by Deno

Biggest minor release yet with improved Node.js compatibility, native package manager improvements, and new runtime features

🧰 Tools, deno, javascript, runtime

FLUE

by Fred K. Schott

A TypeScript agent harness framework from the Astro team, akin to Claude Code with tasks, sandboxing and agent skills but entirely headless and programmable

🧰 Tools, ai, agents, typescript

Kysely 0.29

by Kysely

Type-safe TypeScript SQL query builder adds compile-time table scoping, read-only access enforcement at the type level, and AbortSignal query cancellation

🧰 Tools, typescript, sql, tools

Skybridge

by Alpic AI

Full-stack React framework for type-safe MCP applications and servers, with hot module reloading and a local emulator for AI environments like Claude and ChatGPT

🧰 Tools, mcp, react, ai

Gents in the Monorepo: How Stripe Uses LLM Coding Agents

by Chris Ruiz

Chris Ruiz from Stripe walks through agent strategies in production, from autonomous minions producing PRs from Slack to Claude Code-based agents executing multi-step migrations

📺 Videos, ai, agents, monorepo

Want to read more? Check out the full article here.

To sign up for the weekly newsletter, visit weeklyfoo.com.