DEV Community: Adam

Stay ahead in web development: latest news, tools, and insights #148

Adam — Mon, 03 Aug 2026 05:14:14 +0000

Signup here for the newsletter to get the weekly digest right into your inbox.

weeklyfoo #148 is here: your weekly digest of all webdev news you need to know! This time you'll find 36 valuable links in 5 categories! Enjoy!

🚀 Read it!

Session revocations at scale: How Canva revokes sessions for hundreds of millions of users with encrypted cookies and in-memory lookups, and why moving revocation records to S3 cut database load and shrank the cache by Canva / engineering, security, scale / 12 min read

📰 Good to know

The new rules of context engineering for Claude 5 generation models: Anthropic cut over 80% of Claude Code's system prompt for the newer models — smaller prompts, progressive disclosure through skills, and context assembled from skills, CLAUDE.md and memory instead by Anthropic / ai, agents, claude / 23 min read
The life of a Codex conversation on disk: Walkthrough of the journal file, caches and indexes behind a Codex chat — and why clearing a thread is not the same as deleting it by Alessandro Fazio / ai, agents, tools / 2 min read
How to structure a log: Stable event names, scoped attribute keys, primitive values — and enforcing the conventions with ESLint so logs stay queryable months later by Sentry / observability, logging / 42 min read
Modeling facts and reactions with domain events: Separating a fact from its consequences so reactions can fail, evolve and scale without dragging the core business logic along by Denis Kyashif / architecture, ddd / 10 min read
Domenic Denicola's agentic coding setup: Disposable VMs, Tailscale and worktrees — how a longtime JavaScript standards figure runs coding agents day to day by Domenic Denicola / ai, agents, workflow / 22 min read
Measuring component performance with the Container Timing API: Per-component render timings straight from the browser, now in a Chrome origin trial by Harry Roberts / performance, web / 24 min read
Discovering cryptographic weaknesses with Claude: A model halved the effective key strength of the HAWK signature scheme and sped up an attack on reduced-round AES by up to 800x, working mostly on its own for a week by Anthropic / ai, security, cryptography / 22 min read
Kimi K3 architecture notes: LatentMoE, attention residuals, and dropping RoPE in favour of NoPE in a bigger open-weight model by Sebastian Raschka / ai, ml, architecture / 4 min read
MCP gets its largest update since launch: The protocol goes stateless, so remote servers run on serverless and edge infra or scale horizontally behind a load balancer by MCP / ai, mcp, protocols / 7 min read
How Figma stays ahead of vulnerabilities with agents: Precision over recall was the whole game — 70% before agents were allowed to comment on PRs, and the shared policy became a de facto threat model by Figma / security, ai, agents / 28 min read
The secure way to release an npm package in 2026: Staged publishing, trusted publishing and provenance, explained by the person behind postcss and nanoid by Andrey Sitnik / npm, security, javascript / 28 min read
npm now scans every package for malware at publish time: New versions can take minutes to become installable, and can be held or blocked outright by GitHub / npm, security / 6 min read
How GitHub is disrupting supply chain attacks on npm and Actions: The registry and Actions changes designed to cut off the techniques attackers keep reusing by GitHub / security, npm, github / 19 min read
Treat prompt changes like code deploys: Prompts are dependencies that shift production behaviour with no failing build, so gate them and default the gate to blocking by Luke Murray / ai, engineering / 6 min read
The economic benefit of refactoring: Refactoring an AI-generated codebase cut token consumption for later updates by 83 percent and made navigation cheaper by Martin Fowler / engineering, refactoring, ai / 18 min read
Your SPA is leaking memory, soak test it: Loop a Playwright flow in a single browser context and watch DOM node and listener counts to catch the leak before users do by Den Odell / javascript, performance, testing / 15 min read

🧰 Tools

scriptc: Compiles ordinary TypeScript into small native executables — no Node, no V8 in the binary, ~2ms startup and 170–200KB static builds by Vercel Labs / typescript, compiler, tools
hilos: Team chat where AI coding agents are members of the channel next to the humans — plan in a thread, the agent works on the repo and comes back with a PR to review by Pablo Stanley / ai, agents, tools
Octane: React's programming model compiled ahead of time — no VDOM, no rules-of-hooks bookkeeping, JSX and TSX supported by Dominic Gannaway / javascript, react, framework
tslog 5: Zero-dependency logger for Node, Deno, Bun and browsers — pretty or JSON output, transports, secret masking, stacks mapped back to your TypeScript lines by Eugene Terehov / typescript, logging, tools
eslint-package-json: ESLint rules that catch bad names, broken exports and invalid version ranges in package.json, and autofix most of them by Sindre Sorhus / javascript, linting, tools
Seal: Open standard for proving a file is real — sealed artifacts anchored to a public ledger that prove integrity, time and issuing certificate by Seal / security, tools
htmx 4.0: Fourth major version of the library, released — of course — on a Game Boy cartridge by htmx / web, html, tools
Codex Security: CLI and TypeScript SDK that scans repos for vulnerabilities, validates them, and tracks findings over time by OpenAI / security, cli, tools
pgGraph: Postgres extension for graph search, traversal, shortest path and relationship queries straight against ordinary tables by Evokoa / postgres, databases, tools
TurboFieldfare: Runs Gemma 4 26B on Apple Silicon in roughly 2GB of RAM by streaming weights instead of loading all 14.3GB at once by drumih / ai, llm, tools
Claude Code Merge Queue: Local merge queue for parallel coding agents, so simultaneous landings stop racing each other on push by funador / ai, agents, tools
numbat: Endpoint visibility into what AI agents actually do, with optional pre-action blocking and forensic reconstruction by Perplexity / ai, security, tools
jsdom 30: The browser environment emulator behind countless test suites picks up CSS.escape, CSS.supports and background-position-x by jsdom / javascript, testing, tools
Ada v4: The WHATWG-compliant URL parser Node depends on gets another speed pass by Yagiz Nizipli / nodejs, performance, tools
modern-tar: Zero-dependency streaming tar parser and writer by ayuhito / javascript, tools

🤪 Fun

PGSimCity: Postgres internals as a 3D city you can walk around in and break on purpose by Nikolay Samokhvalov / postgres, fun / 1 min read
A chat app that rewrites its own UI in real time: Raw HTML, CSS and JavaScript streamed straight into the DOM, so the model rebuilds its own interface into games and themes while you talk to it by Varshith V Hegde / ai, fun / 23 min read

📺 Videos

The creator of TypeScript shows off TypeScript 7: Anders Hejlsberg demos the Go-based compiler running 10x faster on VS Code's 1.3M line codebase, plus the new LSP language server by Anders Hejlsberg / typescript, video
React debugging with performance tracks: 15 minute tour of the React-specific entries that now show up in your browser DevTools by Shruti Kapoor / react, video

Want to read more? Check out the full article here.

To sign up for the weekly newsletter, visit weeklyfoo.com.

Agent Swarms, Gemini Chips, and LLMs That Fail Self-Review

Adam — Fri, 31 Jul 2026 04:37:38 +0000

The standout this week arrives courtesy of mathematics: Kevin Buzzard's post documents AI tools now writing Lean proofs for theorems they discovered themselves — the formalization feedback loop has inverted, and human mathematicians are running to keep up. Not a hypothetical; it's happening now.

Agent economics dominate the rest of the issue. Cursor's deep dive into planner-plus-worker swarms shows they beat a single frontier model on speed, quality, and cost. Stencil's prewalk pattern gives the approach a name and a workflow: have the frontier model explore and dump its understanding to a todo list, then hand execution to a cheaper model. Adam Jacob goes a step further and shows how structuring agent tasks into deterministic code cut token usage 8x — real before-and-after numbers, not vibes. Netflix spent the same energy differently: benchmarking vLLM and Triton to build their own serving stack rather than paying hosted API bills. And Google is going further still: fusing Gemini's architecture directly into silicon, so the hardware runs one model by design.

One finding deserves its own paragraph: Greptile's study shows Claude Code and Codex each catch more bugs in the other model's output than in their own. Cross-model routing for code review is no longer just a fun idea — it's the obvious call.

Security delivered a string of memorable entries. Elastic's report on the Contagious Interview campaign hides malware inside SVG images inside a fake coding-interview challenge — targeted, specific, and realistic for any JavaScript developer. Socket.dev catalogued 53 slopsquatting targets across five popular LLMs: the fake npm package names models keep hallucinating, mapped to how fast attackers are registering them. And Matteo Collina lays out why you cannot harden Node core against prototype pollution — the fix belongs at the boundary, not the runtime.

Rounding out the issue: Fetch gets typed error codes thanks to a TC39 proposal that would end the era of every network failure collapsing into a bare TypeError. Arshad Yaseen shows data-oriented design producing a JavaScript parser faster than Oxc, SWC, and Babel, with the full engineering story. Ben Dicken's animated explainer on routing queries across a petabyte of Postgres presented as a single database. Sunil Pai frames a UX problem nobody has solved yet: what does it look like when an agent is editing the same document you are, simultaneously? And Oxc type-aware linting lands stable — unhandled promises, unsafe assignments, all in Rust.

On the tools front: LoopGain cuts agent loops the moment iterations stop improving (someone had to build this), Claude Thermos keeps the prompt cache warm through long multi-subagent sessions so you don't get re-billed for re-encoding, A11Y.md hands AI agents enforceable WCAG-aligned accessibility rules as a context file, and Shadscan runs nearly 60 deterministic accessibility and composition checks on your shadcn components.

Enjoy!

Signup here for the newsletter to get the weekly digest right into your inbox.

Find the 19 highlighted links of weeklyfoo #147:

In-House LLM Serving at Netflix

by Netflix

How Netflix built an in-house LLM serving platform on vLLM and Triton instead of hosted APIs

📰 Good to know, ai,infra

Fetch Needs Error Codes

by James Snell

Fetch collapses every network failure into a bare TypeError, and a TC39 proposal would thread typed error codes through

📰 Good to know, javascript,web

No, We Can't Harden Node.js Against Prototype Pollution

by Matteo Collina

Matteo Collina argues you cannot harden Node core against prototype pollution and the fix belongs at the boundary

📰 Good to know, security,nodejs

A Practical Guide to Reducing Token Spend

by Adam Jacob

A swamp workflow structures agent tasks into deterministic code and cut token usage 8x

📰 Good to know, ai,agents

Agent Swarms and the New Model Economics

by Cursor

Planner agents decompose work and cheaper workers execute it, beating a single frontier model on speed, quality and cost

📰 Good to know, ai,agents

You Only Need the Frontier Model for One Single Edit

by Stencil

Have the frontier model explore and dump its understanding to a todo list before handing execution to a cheaper model

📰 Good to know, ai,agents

Google Is Building a Chip With Gemini Baked Into the Silicon

by The Next Web

Fusing one model's architecture into the circuitry instead of running any model on general hardware

📰 Good to know, ai,hardware

Human Mathematicians Are Being Outcounterexampled

by Kevin Buzzard

AI tools now solve theorems and write Lean proofs to prove their own results, speeding up formalization research

📰 Good to know, ai,math

One Document, Two Hands

by Sunil Pai

Designing for the case where an agent is a guest in your app, editing the same document you are

📰 Good to know, ai,agents

Engineering High-Performance Parsers with Data-Oriented Design

by Arshad Yaseen

How data-oriented design built Yuku, a JavaScript parser faster than Oxc, SWC or Babel

📰 Good to know, javascript,performance

How a Fake Interview's Coding Challenge Steals Credentials

by Elastic

A North Korean campaign hides malware in SVG images inside a fake job interview JavaScript coding challenge

📰 Good to know, security

Models Are Worse at Reviewing Their Own Code

by Greptile

Claude Code and Codex each catch more bugs in the other model's code than their own, so route reviews across models

📰 Good to know, ai,agents

Making 768 Servers Look Like 1

by Ben Dicken

An animated explainer of how a petabyte of Postgres across 256 shards presents as one database

📰 Good to know, database

Oxc Type-Aware Linting Is Stable

by Oxc

Rules relying on the TypeScript type system, like unhandled promises and unsafe assignments, now land in the Rust linter

📰 Good to know, javascript,tools

53 Slopsquatting Targets Across 5 Popular LLMs

by Sarah Gooding

A study of the fake npm package names LLMs keep inventing, and how attackers register them

📰 Good to know, security,ai

LoopGain

by LoopGain

Open-source tool that stops AI agent loops once iterations no longer improve

🧰 Tools, ai,agents,tools

A11Y.md

by Felipe Arriaga Carrico

Context system giving AI agents enforceable accessibility rules aligned with WCAG

🧰 Tools, ai,tools

Claude Thermos

by Ivan Zeigerman

Keeps the prompt cache warm during long agent sessions so waiting on subagents doesn't re-bill re-encoding

🧰 Tools, ai,agents,tools

Shadscan

by OrcDev

Static analysis for shadcn components with almost 60 deterministic accessibility, state and composition checks

🧰 Tools, react,tools

Want to read more? Check out the full article here.

To sign up for the weekly newsletter, visit weeklyfoo.com.

Stay ahead in web development: latest news, tools, and insights #147

Adam — Mon, 27 Jul 2026 04:41:18 +0000

Signup here for the newsletter to get the weekly digest right into your inbox.

weeklyfoo #147 is here: your weekly digest of all webdev news you need to know! This time you'll find 36 valuable links in 5 categories! Enjoy!

🚀 Read it!

A Runaway Model Hacked Hugging Face to Cheat Its Evals: OpenAI's writeup of a model that broke out of the eval harness rather than solving the task by OpenAI / ai,security / 1 min read

📰 Good to know

In-House LLM Serving at Netflix: How Netflix built an in-house LLM serving platform on vLLM and Triton instead of hosted APIs by Netflix / ai,infra / 14 min read
Fetch Needs Error Codes: Fetch collapses every network failure into a bare TypeError, and a TC39 proposal would thread typed error codes through by James Snell / javascript,web / 17 min read
No, We Can't Harden Node.js Against Prototype Pollution: Matteo Collina argues you cannot harden Node core against prototype pollution and the fix belongs at the boundary by Matteo Collina / security,nodejs / 7 min read
A Practical Guide to Reducing Token Spend: A swamp workflow structures agent tasks into deterministic code and cut token usage 8x by Adam Jacob / ai,agents / 10 min read
Agent Swarms and the New Model Economics: Planner agents decompose work and cheaper workers execute it, beating a single frontier model on speed, quality and cost by Cursor / ai,agents / 36 min read
You Only Need the Frontier Model for One Single Edit: Have the frontier model explore and dump its understanding to a todo list before handing execution to a cheaper model by Stencil / ai,agents / 11 min read
Google Is Building a Chip With Gemini Baked Into the Silicon: Fusing one model's architecture into the circuitry instead of running any model on general hardware by The Next Web / ai,hardware / 7 min read
Human Mathematicians Are Being Outcounterexampled: AI tools now solve theorems and write Lean proofs to prove their own results, speeding up formalization research by Kevin Buzzard / ai,math / 20 min read
One Document, Two Hands: Designing for the case where an agent is a guest in your app, editing the same document you are by Sunil Pai / ai,agents / 10 min read
Engineering High-Performance Parsers with Data-Oriented Design: How data-oriented design built Yuku, a JavaScript parser faster than Oxc, SWC or Babel by Arshad Yaseen / javascript,performance / 18 min read
How a Fake Interview's Coding Challenge Steals Credentials: A North Korean campaign hides malware in SVG images inside a fake job interview JavaScript coding challenge by Elastic / security / 16 min read
Models Are Worse at Reviewing Their Own Code: Claude Code and Codex each catch more bugs in the other model's code than their own, so route reviews across models by Greptile / ai,agents / 14 min read
Making 768 Servers Look Like 1: An animated explainer of how a petabyte of Postgres across 256 shards presents as one database by Ben Dicken / database / 13 min read
Oxc Type-Aware Linting Is Stable: Rules relying on the TypeScript type system, like unhandled promises and unsafe assignments, now land in the Rust linter by Oxc / javascript,tools / 5 min read
53 Slopsquatting Targets Across 5 Popular LLMs: A study of the fake npm package names LLMs keep inventing, and how attackers register them by Sarah Gooding / security,ai / 10 min read

🧰 Tools

LoopGain: Open-source tool that stops AI agent loops once iterations no longer improve by LoopGain / ai,agents,tools
Nativ: Free open-source app for Apple Silicon that runs AI models locally with no accounts, subscriptions or cloud by Prince Canuma / ai,tools
Flint: Visualization language that lets AI agents create charts by Microsoft / ai,tools
NameThatUI: The Visual Dictionary of UI: See the element, learn its real name, and prompt your coding agent with precision by argofowl / design,tools
Color.js: Library for working with colors following the latest specs, with new color spaces and smarter gamut mapping in 0.7 by Lea Verou / css,tools
unwasm: Build-time tooling that lets you import .wasm files like any other ES module by unjs / javascript,tools
Yuku: A JavaScript parser and analyzer engineered for speed, faster than Oxc, SWC or Babel by Arshad Yaseen / javascript,tools
A11Y.md: Context system giving AI agents enforceable accessibility rules aligned with WCAG by Felipe Arriaga Carrico / ai,tools
Puffgres: Rust tool using logical replication to mirror Postgres entities into Turbopuffer, and A24's first open source release by A24 Films / database,tools
pg_timetable 7.0: Job Scheduling for Postgres: Stand-alone scheduler storing state in your database, now with OpenTelemetry tracing and arm64 images by CYBERTEC / database,tools
better-sqlite3 13.0: The popular SQLite library moves to N-API so prebuilt binaries work across Node and Electron versions, plus a new db.explain() by Joshua Wise / database,nodejs,tools
Execa 10.0: Better process execution from Node, with a trimmed API and a killDescendants option to terminate a subprocess's descendants by Sindre Sorhus / nodejs,tools
Claude Thermos: Keeps the prompt cache warm during long agent sessions so waiting on subagents doesn't re-bill re-encoding by Ivan Zeigerman / ai,agents,tools
Shadscan: Static analysis for shadcn components with almost 60 deterministic accessibility, state and composition checks by OrcDev / react,tools
GTKX: Build native Linux desktop apps with React and GTK4, now at 1.0 release candidate by GTKX / react,tools

🤪 Fun

Decoy Font: A TTF Font That Hides What You Type: Uses separate spatial frequencies to show two different letters in the same space, misleading AI reading your screen by Mixfont / fun / 6 min read
Which AI?: Daily guessing game where you spot whether a landing page was designed by Gemini, Claude or GPT by Which AI / fun,design / 0 min read

📺 Videos

Designing 99 'No's for a Single 'Yes': Screensharing dozens of unused concepts, novel art directions and brand identities behind one final pick by Michael Riddering / design,vids
How to Think like a Performance Engineer: Which site-speed tools to trust and how to run tests that are realistic and actionable by Harry Roberts / performance,vids
WhatsApp Private Processing: Meta engineers on running confidential VMs for privacy-preserving AI at WhatsApp scale by Meta / security,vids

Want to read more? Check out the full article here.

To sign up for the weekly newsletter, visit weeklyfoo.com.

Token Bills, Rust Migrations, and Agent Seatbelts

Adam — Fri, 24 Jul 2026 04:43:35 +0000

Gergely Orosz's breakdown of Bun's rapid Zig-to-Rust rewrite is the headline act this week: 535,000 lines, 64 agents, 11 days, and a token bill large enough to make your finance spreadsheet flinch. It's the clearest public data point yet for what a large-scale AI-assisted migration actually costs.

That cost theme keeps echoing elsewhere. Systima's Claude Code vs OpenCode comparison measures a 33k-versus-7k token warm-up tax before your prompt even gets a word in, PlayCode's tokenizer breakdown shows the same TypeScript can cost 73% more depending on vendor, and Vivek Haldar demonstrates the obvious escape hatch: compile repetitive agent skills down to deterministic code and keep LLMs for the fuzzy parts.

The more philosophical side of agent engineering also gets a solid showing. antirez argues you should control the ideas, not the code, Armin Ronacher warns that teams lose shared language when AI removes too much productive friction, and Dex Horthy via Pragmatic Engineer maps out where the dumb zone starts and why starting a new session is sometimes the smartest optimization.

Security remains the cold shower. Mindgard's Cursor 0day and TechCrunch's report on OpenAI Sol deleting files are timely reminders that agent autonomy still needs adult supervision. On the safer side, Mindwalk, Clawk, and DCG each tackle guardrails from a different angle: replay the agent, sandbox the agent, or stop it before it gets overconfident with your shell. Meanwhile, Scrapfly reveals your browser can be fingerprinted by floating-point math alone, Haki Benita squeezes partition pruning out of "impossible" queries, and Alisa Sireneva proves a useless if can be surprisingly useful after all.

Enjoy!

Signup here for the newsletter to get the weekly digest right into your inbox.

Find the 15 highlighted links of weeklyfoo #146:

What Can We Learn From Bun's Rapid Rust Rewrite With AI?

by Gergely Orosz

Bun moved 535,000 lines from Zig to Rust in 11 days with 64 agents, burning 5.9 billion uncached input tokens for about $165,000 at API pricing

🚀 Read it!, ai, agents, rust

Claude Code Is Way More Token-Hungry Than OpenCode

by Systima

A measured comparison showing Claude Code sends 33k tokens before reading your prompt versus OpenCode's 7k, with lower cache efficiency on identical tasks

📰 Good to know, ai, agents, tooling

Your Browser Does Math Differently on Every OS

by Scrapfly

Browsers produce OS-specific floating-point rounding in functions like Math.tanh, letting anti-bot systems fingerprint the operating system from the exact result bits

📰 Good to know, security, browser

Control the Ideas, Not the Code

by Salvatore Sanfilippo

Reading every line an LLM writes is impractical — steer the design, the behaviour, and the performance target instead, then check the implementation for correctness

📰 Good to know, ai, engineering, opinion

How I Cut an AI Agent's Token Use by 94%

by Vivek Haldar

Compiling a stable natural-language agent skill down to deterministic code cut tokens by 94% and latency by 87%, reserving LLM calls for the parts that actually need language understanding

📰 Good to know, ai, agents, performance

The Same TypeScript Costs 73% More Tokens on Claude Than GPT

by PlayCode

Every vendor's tokenizer splits the same text differently, so identical code turns into very different bills — a breakdown of what that does to effective model cost

📰 Good to know, ai, tooling

The Tower Keeps Rising

by Armin Ronacher

A project's shared language — what the concepts mean, which invariants matter, why the system has this shape — lives in review and argument as much as in code, and AI removes exactly the friction that built it

📰 Good to know, ai, engineering, opinion

Cursor 0day: When Full Disclosure Becomes the Only Protection Left

by Mindgard

A critical Cursor IDE flaw auto-executes malicious binaries planted in a project repo with no user interaction, still unfixed after seven months of disclosure attempts

📰 Good to know, security, ai, tooling

OpenAI's New Flagship Model Deletes Files On Its Own

by TechCrunch

Even before launch, OpenAI knew Sol tends to take whatever action it thinks finishes the job — including destructive ones — as long as they are not unambiguously prohibited

📰 Good to know, ai, safety

How to Achieve Pruning When Querying by Non-Partitioned Columns

by Haki Benita

When a non-partition column correlates with the partition key — sequential session IDs in time-partitioned data, say — CHECK constraints buy you pruning on it too, with a BRIN-inspired trick for outliers

📰 Good to know, postgres, performance, databases

Context Engineering With Dex Horthy

by Gergely Orosz

The man who coined the term on finding where the dumb zone starts, intentional compaction, why you-are-completely-right means start a new session, and the three ways to run a software factory

📰 Good to know, ai, agents, engineering

Quadrupling Code Performance With a Useless If

by Alisa Sireneva

Telling the CPU to predict the value stays intact turns a latency-bound loop into a throughput-bound one

📰 Good to know, performance, deepdive

Mindwalk

by cosmtrek

Replays a coding agent's session on a 3D citymap of your repo so you can see how the agent understood and moved through the codebase

🧰 Tools, ai, agents, visualization

Clawk

by clawkwork

Spins up disposable Linux VMs for coding agents behind a network allow-list, so an agent can work without risking the host or reaching anything it should not

🧰 Tools, ai, agents, security

DCG

by Dicklesworthstone

Blocks dangerous git and shell commands before an agent can run them

🧰 Tools, ai, agents, security

Want to read more? Check out the full article here.

To sign up for the weekly newsletter, visit weeklyfoo.com.

Stay ahead in web development: latest news, tools, and insights #146

Adam — Mon, 20 Jul 2026 04:52:04 +0000

Signup here for the newsletter to get the weekly digest right into your inbox.

weeklyfoo #146 is here: your weekly digest of all webdev news you need to know! This time you'll find 37 valuable links in 5 categories! Enjoy!

🚀 Read it!

What Can We Learn From Bun's Rapid Rust Rewrite With AI?: Bun moved 535,000 lines from Zig to Rust in 11 days with 64 agents, burning 5.9 billion uncached input tokens for about $165,000 at API pricing by Gergely Orosz / ai, agents, rust / 15 min read

📰 Good to know

Claude Code Is Way More Token-Hungry Than OpenCode: A measured comparison showing Claude Code sends 33k tokens before reading your prompt versus OpenCode's 7k, with lower cache efficiency on identical tasks by Systima / ai, agents, tooling / 22 min read
Your Browser Does Math Differently on Every OS: Browsers produce OS-specific floating-point rounding in functions like Math.tanh, letting anti-bot systems fingerprint the operating system from the exact result bits by Scrapfly / security, browser / 13 min read
Your Grid Lanes Will Likely Fail WCAG 2.4.3: CSS Grid Lanes place items so that visual order often diverges from DOM order, breaking keyboard navigation and failing WCAG by default by Manuel Matuzovic / css, accessibility / 15 min read
Control the Ideas, Not the Code: Reading every line an LLM writes is impractical — steer the design, the behaviour, and the performance target instead, then check the implementation for correctness by Salvatore Sanfilippo / ai, engineering, opinion / 8 min read
How I Cut an AI Agent's Token Use by 94%: Compiling a stable natural-language agent skill down to deterministic code cut tokens by 94% and latency by 87%, reserving LLM calls for the parts that actually need language understanding by Vivek Haldar / ai, agents, performance / 7 min read
The Same TypeScript Costs 73% More Tokens on Claude Than GPT: Every vendor's tokenizer splits the same text differently, so identical code turns into very different bills — a breakdown of what that does to effective model cost by PlayCode / ai, tooling / 12 min read
Collaborative Editing in Wordgard: Marijn's third take on collaborative editing in eleven years, for his new ProseMirror successor, still built on operational transformation rather than CRDTs by Marijn Haverbeke / javascript, editors, engineering / 12 min read
The Tower Keeps Rising: A project's shared language — what the concepts mean, which invariants matter, why the system has this shape — lives in review and argument as much as in code, and AI removes exactly the friction that built it by Armin Ronacher / ai, engineering, opinion / 5 min read
Cursor 0day: When Full Disclosure Becomes the Only Protection Left: A critical Cursor IDE flaw auto-executes malicious binaries planted in a project repo with no user interaction, still unfixed after seven months of disclosure attempts by Mindgard / security, ai, tooling / 12 min read
OpenAI's New Flagship Model Deletes Files On Its Own: Even before launch, OpenAI knew Sol tends to take whatever action it thinks finishes the job — including destructive ones — as long as they are not unambiguously prohibited by TechCrunch / ai, safety / 7 min read
How to Achieve Pruning When Querying by Non-Partitioned Columns: When a non-partition column correlates with the partition key — sequential session IDs in time-partitioned data, say — CHECK constraints buy you pruning on it too, with a BRIN-inspired trick for outliers by Haki Benita / postgres, performance, databases / 19 min read
Postgres Turns 30: Thirty years on from the first public Postgres CVS server going live on July 8, 1996 by Ruohang Feng / postgres, history, opensource / 7 min read
Context Engineering With Dex Horthy: The man who coined the term on finding where the dumb zone starts, intentional compaction, why you-are-completely-right means start a new session, and the three ways to run a software factory by Gergely Orosz / ai, agents, engineering / 15 min read
Harness Engineering for Coding Agent Users: The harness around the agent — the tools, checks, and feedback loops it runs inside — is becoming its own engineering discipline by Martin Fowler / ai, agents, engineering / 18 min read
Agentic Misalignment in Summer 2026: A fresh round of stress tests on whether agentic models will take harmful actions to complete a task when the guardrails are ambiguous by Anthropic / ai, safety, research / 72 min read
Quadrupling Code Performance With a Useless If: Telling the CPU to predict the value stays intact turns a latency-bound loop into a throughput-bound one by Alisa Sireneva / performance, deepdive / 5 min read

🧰 Tools

Mindwalk: Replays a coding agent's session on a 3D citymap of your repo so you can see how the agent understood and moved through the codebase by cosmtrek / ai, agents, visualization
Clawk: Spins up disposable Linux VMs for coding agents behind a network allow-list, so an agent can work without risking the host or reaching anything it should not by clawkwork / ai, agents, security
Ant: A JavaScript runtime built from scratch in C — no V8, JavaScriptCore, or SpiderMonkey — shipping as a 9MB binary that runs npm packages with very short cold starts by theMackabu / javascript, runtime, opensource
DCG: Blocks dangerous git and shell commands before an agent can run them by Dicklesworthstone / ai, agents, security
plx: A Postgres extension that transpiles JavaScript, PHP, Python, Ruby, and even COBOL down to PL/pgSQL, so you can write stored functions in the language you already know by Command Prompt Inc. / postgres, extension, opensource
pg_re2: Google's re2 engine as a Postgres extension, trading backtracking for predictable regex execution time by David Wheeler, Philip Dubé / postgres, extension, performance
brainless: Claude Code, Codex, and Grok terminal interfaces packaged as shadcn components you can drop into a React app by Ben Swerdlow / react, shadcn, ai
Grok Build: xAI's open-source coding-agent harness and full-screen, mouse-interactive terminal UI, built to be extensible by xAI / ai, agents, opensource
Goshot: A CLI and library for turning source code into polished screenshots, in the vein of Carbon but scriptable from the terminal by Chris Watson / cli, screenshots, go
LiteParse 2: A fast, light PDF parser built in Rust with Node, WASM, and Python bindings — OCR, spatial layout awareness, and a 140-page doc parsed in about ten seconds by LlamaIndex / pdf, rust, library
Claude Code Usage Monitor: Tracks Claude Code token usage with predictions and warnings before you hit the wall by Maciek / ai, agents, cli
Tau: A minimalist agent whose real purpose is teaching you how to build coding agents by Hugging Face / ai, agents, opensource
dx-styles: A zero-runtime, compile-time CSS-in-JS alternative from Linaria's maintainer, who says runtime CSS-in-JS is winding down by Anton Evzhakov / css, javascript, library
shadcn/typeset: A drop-in typography system for rendered HTML in a single CSS file, driven by a handful of CSS variables instead of dozens of settings by shadcn / css, typography, library
burrow: A virtual machine that runs in the browser and can run Bun, a shell, Git, and local LLMs by Dhravya Shah / javascript, wasm, opensource

🤪 Fun

The 200ms Life of an HTTP Request: A scrolling visualization walking through everything that happens in the roughly 200 milliseconds of a single HTTP request by The Node Book / web, networking, visualization / 0 min read
How to Stop Claude From Saying Load-Bearing: A small script that swaps Claude's most worn-out phrases for funnier ones by Jola / ai, fun / 3 min read

📺 Videos

Fixing Bad SQL in Postgres: A 55-minute run through the most common SQL anti-patterns, each one explained and then taken apart in live psql demos by Jimmy Angelakos / postgres, sql, talk
Understanding Is the New Bottleneck: Writing the code stopped being the constraint — understanding what it does is, and that is where the tooling should aim by Geoffrey Litt / ai, agents, talk
How a Query Optimization Gave Birth to Infinite Scroll: The scroll everyone loves to hate started as a backend fix for inefficient paging queries rather than a UX decision by Hussein Nasser / backend, databases, podcast

Want to read more? Check out the full article here.

To sign up for the weekly newsletter, visit weeklyfoo.com.

TypeScript at Warp Speed, Bun's Rust Glow-Up, and Agents Everywhere

Adam — Fri, 17 Jul 2026 04:38:25 +0000

TypeScript 7.0 is officially out — the full Go-port rewrite, 10x faster compilation, validated against real-world large codebases. If you've been waiting for a reason to care about compiler speeds, here it is.

The agent beat is packed this week. Oleg Luganskiy reviewed 35 active CLI coding agents so your stack decision doesn't have to be a coin flip. Matt Rickard shows how Cognition shards codebases MapReduce-style and uses Git itself as the inter-agent communication layer — boring infrastructure, genuinely clever coordination. Jesse Vincent argues that agents write better code when the engineer building their tooling is in the loop, not at arm's length.

Security corner delivered two memorable entries: Noma Security's GitLost shows how a public GitHub issue can become a prompt injection vector that extracts data from private repos — a live attack if your agents have repository access. Anthropic's GRAM isolates dual-use knowledge into dedicated model compartments that actively resist recovery attempts, which is a more honest containment story than post-training scrubbing. And npm v12 finally ships with lifecycle scripts off by default — a supply-chain vector that's been open since npm's early days is now closed.

Also notable: Bun rewrote its runtime from Zig to Rust with Anthropic's models — faster, smaller, safer, probably the most consequential AI-assisted migration shipped in public. ECMAScript 2026 officially adds Array.fromAsync and native Base64/Hex conversion, quietly retiring whole categories of utility imports. Ubuntu's team used TLA+ to track down a 16-year-old SQLite WAL corruption bug — formal verification making a strong practical case for itself. And Kapa AI pruned 68% of RAG context with a small LLM while keeping 96% recall — small models as intelligent pre-filters, not just cheaper completions.

On the tools side: Vite+ arrives in beta as an open-source MIT toolkit unifying Vite, Vitest, and Oxlint under a single vp command (originally planned as commercial — community pressure wins). Herdr gives agents SSH-reachable persistent terminal sessions that survive disconnects. OSV.dev pulls advisories from PyPA, GitHub, Go, Rust, and more into one open API for cross-ecosystem dependency scanning. And Postgres Is Enough catalogs 89 extensions mapping Postgres onto Redis, Kafka, and Elasticsearch use cases — the single-database argument finally has a proper directory.

Enjoy!

Signup here for the newsletter to get the weekly digest right into your inbox.

Find the 15 highlighted links of weeklyfoo #145:

Announcing TypeScript 7.0

by Microsoft

TypeScript 7.0's native Go port delivers up to 10x faster compilation, tested across large-scale real-world codebases

🚀 Read it!, typescript, performance

State of CLI Coding Agents, Mid-2026

by Oleg Luganskiy

A survey of 35 actively maintained terminal-based coding agents, with Claude Code, Codex CLI, and Omp leading on memory, editing precision, and orchestration

📰 Good to know, ai, agents, tooling

Rebuilding Cognition's Agentic MapReduce

by Matt Rickard

How Cognition scales agent tasks by sharding codebases, verifying vulnerabilities in parallel, and using Git itself for inter-agent communication and fault tolerance

📰 Good to know, ai, agents, engineering

Hunting a 16-Year-Old SQLite Bug With TLA+

by Alberto Carretero

Modeling SQLite's Write-Ahead Log behavior in TLA+ to check whether dqlite was exposed to a long-standing corruption bug — it wasn't, thanks to stricter locking

📰 Good to know, sqlite, engineering

How We Taught a Small LLM to Throw Away 68% of Our RAG Context

by Kapa AI

A small, cheap LLM learned to prune 68% of retrieved RAG context chunks while keeping 96% recall, cutting cost without sacrificing accuracy

📰 Good to know, ai, engineering

Some New Agentic Patterns

by Jesse Vincent

Letting an agent work directly with the engineer building its runloop and tooling produces higher-quality results than routing every change through a human intermediary

📰 Good to know, ai, agents, engineering

What's New in ECMAScript 2026

by Pawel Grzybek

The newly approved 876-page ECMAScript 2026 spec adds Array.fromAsync, native Uint8Array Base64/Hex conversion, and more — most already usable today in browsers and runtimes

📰 Good to know, javascript, ecmascript

Rewriting Bun in Rust

by Bun

Facing recurring use-after-free and double-free bugs from Zig's manual memory management, Bun's team used Anthropic's models to rewrite the runtime in Rust, ending up faster, smaller, and safer

📰 Good to know, rust, engineering, bun

An Off Switch for Dual-Use Knowledge in AI Models

by Anthropic

Anthropic's GRAM (Gradient-Routed Auxiliary Modules) isolates dual-use knowledge like cyber offense/defense into dedicated model compartments, resisting attempts to recover removed knowledge

📰 Good to know, ai, safety

GitLost: How We Tricked GitHub's AI Agent Into Leaking Private Repos

by Noma Security

An indirect prompt injection through public GitHub issues let attackers exploit GitHub's Agentic Workflows to extract data from private repositories

📰 Good to know, security, ai, agents

npm v12 Ships With Install Scripts Off by Default

by GitHub Blog

npm 12 is now GA with lifecycle scripts and implicit node-gyp builds no longer running by default, closing off a major supply-chain attack vector

📰 Good to know, npm, security, nodejs

Vite+ Beta

by VoidZero

The Vite team's unified toolchain brings Vite, Vitest, Oxlint, and more together under a single vp command — originally planned as commercial, now open sourced under MIT

🧰 Tools, vite, tooling, javascript

Herdr

by Herdr

A terminal-based multiplexer for running multiple coding agents in persistent sessions that survive disconnects and can be reached remotely over SSH

🧰 Tools, ai, agents, cli

OSV.dev

by OSV

An open, distributed vulnerability database that aggregates open-source security advisories for scanning dependencies via API, CLI, or GitHub integration

🧰 Tools, security, opensource

Postgres Is Enough

by Goodway

A directory of 89 extensions and tools that let Postgres stand in for Redis, Elasticsearch, Kafka, and other systems

🧰 Tools, postgres, database

Want to read more? Check out the full article here.

To sign up for the weekly newsletter, visit weeklyfoo.com.

Stay ahead in web development: latest news, tools, and insights #145

Adam — Mon, 13 Jul 2026 04:51:43 +0000

Signup here for the newsletter to get the weekly digest right into your inbox.

weeklyfoo #145 is here: your weekly digest of all webdev news you need to know! This time you'll find 39 valuable links in 5 categories! Enjoy!

🚀 Read it!

Announcing TypeScript 7.0: TypeScript 7.0's native Go port delivers up to 10x faster compilation, tested across large-scale real-world codebases by Microsoft / typescript, performance / 26 min read

📰 Good to know

State of CLI Coding Agents, Mid-2026: A survey of 35 actively maintained terminal-based coding agents, with Claude Code, Codex CLI, and Omp leading on memory, editing precision, and orchestration by Oleg Luganskiy / ai, agents, tooling / 1 min read
Rebuilding Cognition's Agentic MapReduce: How Cognition scales agent tasks by sharding codebases, verifying vulnerabilities in parallel, and using Git itself for inter-agent communication and fault tolerance by Matt Rickard / ai, agents, engineering / 5 min read
PostgreSQL and the OOM Killer: Why We Use Strict Memory Overcommit: Why strict memory overcommit prevents catastrophic OOM kills in PostgreSQL, and what a kernel bug in production revealed about getting that configuration right by Burak Yucesoy / postgres, engineering / 18 min read
Hunting a 16-Year-Old SQLite Bug With TLA+: Modeling SQLite's Write-Ahead Log behavior in TLA+ to check whether dqlite was exposed to a long-standing corruption bug — it wasn't, thanks to stricter locking by Alberto Carretero / sqlite, engineering / 31 min read
How We Taught a Small LLM to Throw Away 68% of Our RAG Context: A small, cheap LLM learned to prune 68% of retrieved RAG context chunks while keeping 96% recall, cutting cost without sacrificing accuracy by Kapa AI / ai, engineering / 11 min read
Some New Agentic Patterns: Letting an agent work directly with the engineer building its runloop and tooling produces higher-quality results than routing every change through a human intermediary by Jesse Vincent / ai, agents, engineering / 10 min read
What's New in ECMAScript 2026: The newly approved 876-page ECMAScript 2026 spec adds Array.fromAsync, native Uint8Array Base64/Hex conversion, and more — most already usable today in browsers and runtimes by Pawel Grzybek / javascript, ecmascript / 7 min read
React Router v8: A deliberately boring major release with incremental changes, a new yearly release cadence, and updated baselines for Node, React, and Vite by Remix / react, javascript / 8 min read
Where Do Your LLM API Keys Actually Live?: Whether a provider API key sits inside your app process or behind a gateway determines the blast radius when a dependency gets compromised by Hadil / ai, security / 38 min read
Why We Built Yet Another Postgres Connection Pooler: PgDog is a new Postgres connection pooler with a built-in SQL parser to properly manage session state, SET commands, and LISTEN/NOTIFY, built on Rust's Tokio by Lev Kokotov / postgres, engineering / 6 min read
Get Ready for the CSS border-shape Property: On the heels of shape() and corner-shape, the new border-shape property unlocks fancy decorations, neat animations, and more — Chromium-only for now by Temani Afif / css, frontend / 13 min read
Google's Toolkit to Make Your Website Agent-Ready: A new Lighthouse toolkit that audits how agent-friendly your site is, checking accessibility tree quality, layout stability, and WebMCP integration by Google / ai, agents, web / 9 min read
Rewriting Bun in Rust: Facing recurring use-after-free and double-free bugs from Zig's manual memory management, Bun's team used Anthropic's models to rewrite the runtime in Rust, ending up faster, smaller, and safer by Bun / rust, engineering, bun / 53 min read
An Off Switch for Dual-Use Knowledge in AI Models: Anthropic's GRAM (Gradient-Routed Auxiliary Modules) isolates dual-use knowledge like cyber offense/defense into dedicated model compartments, resisting attempts to recover removed knowledge by Anthropic / ai, safety / 8 min read
GitLost: How We Tricked GitHub's AI Agent Into Leaking Private Repos: An indirect prompt injection through public GitHub issues let attackers exploit GitHub's Agentic Workflows to extract data from private repositories by Noma Security / security, ai, agents / 8 min read
npm v12 Ships With Install Scripts Off by Default: npm 12 is now GA with lifecycle scripts and implicit node-gyp builds no longer running by default, closing off a major supply-chain attack vector by GitHub Blog / npm, security, nodejs / 5 min read

🧰 Tools

Otari: An open-source, OpenAI-compatible LLM gateway for managing API keys, enforcing budgets, and tracking usage across 40+ providers from one endpoint by Mozilla AI / ai, llm, gateway
Vite+ Beta: The Vite team's unified toolchain brings Vite, Vitest, Oxlint, and more together under a single vp command — originally planned as commercial, now open sourced under MIT by VoidZero / vite, tooling, javascript
WordGard: A modular, collaborative-editing-ready rich text editor library from the creator of ProseMirror and Eloquent JavaScript by Marijn Haverbeke / javascript, editor, library
vinext: Cloudflare's Vite plugin reimplementing Next.js's API surface by Cloudflare / vite, nextjs, cloudflare
Herdr: A terminal-based multiplexer for running multiple coding agents in persistent sessions that survive disconnects and can be reached remotely over SSH by Herdr / ai, agents, cli
Apify MCP Server: Lets AI agents discover and run Apify Store Actors, access storages and results, and pull Apify docs directly into a coding assistant by Apify / ai, mcp, agents
OSV.dev: An open, distributed vulnerability database that aggregates open-source security advisories for scanning dependencies via API, CLI, or GitHub integration by OSV / security, opensource
OverflowGuard: A React component and custom element that adapts layouts around content instead of breakpoints, media queries, or magic numbers by Artur Marczyk / react, css, frontend
Postgres Is Enough: A directory of 89 extensions and tools that let Postgres stand in for Redis, Elasticsearch, Kafka, and other systems by Goodway / postgres, database
Tinbase: A Supabase-compatible backend in a single binary using PGlite and pg-mem, for a local Supabase-like dev experience without Docker by Sanket Sahu / postgres, supabase, database
Level Up Your Accessibility Game: 128 questions to practice WCAG 2.2, ARIA, semantic HTML, keyboard, and contrast, with plain-English answers by a11y.quest / accessibility, tools
GeoSQL: A geospatial analytics tool with a map-based validation loop to improve accuracy of spatial queries on PostGIS, BigQuery, and Snowflake by Dekart / postgres, geospatial, tools
Upyo 0.5: A Cross-Runtime Email Sending Library: A unified, type-safe API for sending emails over SMTP and HTTP-based providers like SendGrid or Amazon SES, working across Node, Deno, Bun, and edge runtimes by Hong Minhee / email, nodejs, library
node-calls-python: Calls Python directly from Node, in-process, without spawning a subprocess by hmenyus / nodejs, python, interop
Traycer: An open-source AI orchestration app that connects existing agent subscriptions for parallel operation with shared memory, model switching, and cross-device sync by Traycer / ai, agents, orchestration
react-easy-crop: A React component for interactive image and video cropping with dragging, zooming, and rotation, supporting any image format by Valentin Hervieu / react, image, library
native: A toolkit from Vercel Labs for building native desktop apps with web technologies by Vercel Labs / desktop, toolkit

🤪 Fun

Engineering a Brainrot Art Installation on an Orange Pi Zero: An infinite-scroll BrainRot TV art piece with procedural audio and a decay meter, squeezed onto a $15 Orange Pi Zero by Google AI / hardware, art / 11 min read
GTA2 Web: The top-down classic GTA 2 ported to run natively in the browser, with WebRTC peer-to-peer multiplayer added on top by Erik Markus Kannike / games, webrtc / 1 min read

📺 Videos

I Read Every Major CS Paper From the Last 100 Years: A tour through the major CS papers behind today's LLMs, tracing how decades of research led to modern AI by Fireship / ai, cs
Frontend Minimalism in Action: Do More With Less JavaScript: Peter Kröner explores building maintainable, resilient frontends by relying on web standards and minimalist engineering over hype-driven dependencies by Peter Kröner / frontend, talk
How Kubernetes Networking Really Works: A Packet's Journey: Tracing a real packet across a live cluster to show how traffic moves between Pods using network namespaces, veth pairs, bridges, and routing tables by Ashwin Sriram / kubernetes, networking, talk

Want to read more? Check out the full article here.

To sign up for the weekly newsletter, visit weeklyfoo.com.

Faster Compilers, Twelve-Factor Agents, and Kubernetes in Your Browser

Adam — Thu, 09 Jul 2026 15:07:48 +0000

The GPU finally got its own origin story: Fergus Finn's bottom-up walkthrough of what actually happens when you run a kernel is the kind of infrastructure literacy that pays dividends whether you're writing CUDA or just squinting at inference latency. Worth the read.

On the speed front, the VS Code team's adoption of the TypeScript 7 compiler is peak "benchmark theatre" — in the best way. Type-checking: 36s → 5s. Watch mode: 80s → 20s. If you needed permission to finally take compiler rewrites seriously, here's your permit.

The agent ecosystem keeps industrializing: 12 Factor Agents brings the famous twelve-factor vocabulary to LLM apps, Oak promises sub-second working tree mounts purpose-built for parallel agent workflows, Weave Router cuts inference costs 40–70% without leaking your API keys off-device, and Apple quietly shipped an official MCP server for Safari's dev tools. Browser-integrated agent tooling is moving from experiment to table stakes.

Security filed three interesting dispatches: Matteo Collina argues that CVE-2026-48931 should have been routine hardening — not a CVE — and the mis-classification broke node-fetch users across Google APIs, Firebase, and Backstage. Reddit's spam-detection internals got accidentally exposed by a debugging glitch (awkward). And npm now locks high-impact package accounts into 72 hours of read-only mode after any account-recovery action — a quiet but very sensible guardrail.

The SQL standard picked up QUALIFY and INSERT ... BY NAME at the latest working-group meeting. Postgres implications inbound; time to start planning your migrations.

And if you've ever shipped a React SSR page and wondered why LCP went red: Ivan Akulov's piece on hydration mismatches plus font swap is your forensic playbook. Also, someone ported Kubernetes to the browser. Completely unnecessary. Completely on-brand.

Enjoy!

Signup here for the newsletter to get the weekly digest right into your inbox.

Find the 12 highlighted links of weeklyfoo #144:

What Happens When You Run a GPU Kernel

by Fergus Finn

A step-by-step breakdown of what the CPU, driver, and GPU actually do during kernel execution — from pushbuffer writes to warp scheduling

🚀 Read it!, engineering, gpu, performance

Iterating Faster on VS Code with TypeScript 7

by VS Code Team

How the VS Code team adopted the Go-based TypeScript 7 compiler incrementally — type-checking dropped from 36s to 5s, watch mode from 80s to 20s

📰 Good to know, typescript, engineering, tooling

A Peek Into Reddit's Anti-Spam Internals

by Lyra

How a leaked debugging glitch revealed Reddit's moderation stack, including its spam-detection algorithms and use of the Perspective API

📰 Good to know, engineering, security

I Ported Kubernetes to the Browser

by Sam Rose

webernetes is a TypeScript port of Kubernetes that runs pod lifecycles, deployment tracking, and simulated networking entirely in the browser

📰 Good to know, engineering, kubernetes

New SQL Standard Features With Postgres Implications

by Peter Eisentraut

QUALIFY, INSERT ... BY NAME, and JOIN TO ONE were adopted into the draft SQL standard at the latest standards meeting, with an update on the still-debated 'key joins' proposal

📰 Good to know, database, postgres, sql

CVE-2026-48931 Shouldn't Have Been a CVE

by Matteo Collina

Matteo Collina on why his own http.Agent security fix should have shipped as ordinary hardening, not a CVE, and how it broke node-fetch@2 users across Google APIs, Firebase, and Backstage

📰 Good to know, node, security, engineering

npm Locks High-Impact Accounts After Recovery Actions

by GitHub

Maintainers of the most popular packages are now locked into 72 hours of read-only mode after changing their email or using a 2FA recovery code

📰 Good to know, npm, security, supply-chain

Introducing the Safari MCP Server for Web Developers

by WebKit Team

Apple's new Safari MCP server lets AI coding agents inspect the DOM, console, network, performance, and accessibility of a local Safari browser

📰 Good to know, ai, tools, web

The Hidden Cost of Hydration Mismatches

by Ivan Akulov

How a single hydration mismatch, combined with web font swapping, can push a React page's Largest Contentful Paint from green into the red

📰 Good to know, react, performance, frontend

12 Factor Agents

by HumanLayer

Principles for building reliable LLM-powered applications, inspired by the 12-factor app methodology

🧰 Tools, ai, agents, framework

Oak

by Oak

Version control built for agent workflows — content-addressed storage gives instant branch cloning, and working trees mount in about a second without a full git-style clone

🧰 Tools, git, tools, ai

Weave Router

by Weave

Local model router that picks the best LLM for each prompt in under 50ms and cuts inference costs 40-70% without ever sending API keys off-device

🧰 Tools, ai, llm, tools

Want to read more? Check out the full article here.

To sign up for the weekly newsletter, visit weeklyfoo.com.

Stay ahead in web development: latest news, tools, and insights #144

Adam — Mon, 06 Jul 2026 05:03:20 +0000

Signup here for the newsletter to get the weekly digest right into your inbox.

weeklyfoo #144 is here: your weekly digest of all webdev news you need to know! This time you'll find 32 valuable links in 5 categories! Enjoy!

🚀 Read it!

What Happens When You Run a GPU Kernel: A step-by-step breakdown of what the CPU, driver, and GPU actually do during kernel execution — from pushbuffer writes to warp scheduling by Fergus Finn / engineering, gpu, performance / 34 min read

📰 Good to know

Code Is the Easy Part: How a startup untangled a billing system by simplifying the data model and encoding unrecorded business rules, cutting invoicing time from a week to two days by Swizec Teller / engineering / 15 min read
What Happened After 2,000 People Tried to Hack My AI Assistant: Prompt injections are still a real security problem but defenses are getting better — field notes from opening an AI assistant to public attack by Fernando Iturriaga / ai, security / 5 min read
Iterating Faster on VS Code with TypeScript 7: How the VS Code team adopted the Go-based TypeScript 7 compiler incrementally — type-checking dropped from 36s to 5s, watch mode from 80s to 20s by VS Code Team / typescript, engineering, tooling / 15 min read
Deno 2.9: Native desktop app packaging, 2x faster cold starts, quick migration from npm lockfiles, and a target of Node.js 26 compatibility by Bartek Iwańczuk / javascript, deno, tooling / 30 min read
A Peek Into Reddit's Anti-Spam Internals: How a leaked debugging glitch revealed Reddit's moderation stack, including its spam-detection algorithms and use of the Perspective API by Lyra / engineering, security / 34 min read
I Ported Kubernetes to the Browser: webernetes is a TypeScript port of Kubernetes that runs pod lifecycles, deployment tracking, and simulated networking entirely in the browser by Sam Rose / engineering, kubernetes / 16 min read
New SQL Standard Features With Postgres Implications: QUALIFY, INSERT ... BY NAME, and JOIN TO ONE were adopted into the draft SQL standard at the latest standards meeting, with an update on the still-debated 'key joins' proposal by Peter Eisentraut / database, postgres, sql / 7 min read
Meta's AI Storage Blueprint at Scale: How Meta rebuilt its BLOB storage metadata subsystem with tiered caching and prefetching to keep GPUs fed and speed up AI research velocity by Meta Engineering / ai, engineering, infrastructure / 16 min read
CVE-2026-48931 Shouldn't Have Been a CVE: Matteo Collina on why his own http.Agent security fix should have shipped as ordinary hardening, not a CVE, and how it broke node-fetch@2 users across Google APIs, Firebase, and Backstage by Matteo Collina / node, security, engineering / 16 min read
npm Locks High-Impact Accounts After Recovery Actions: Maintainers of the most popular packages are now locked into 72 hours of read-only mode after changing their email or using a 2FA recovery code by GitHub / npm, security, supply-chain / 4 min read
Building an Intern: How the team built Junior, an AI intern in Slack that takes instructions, does research, and gets steered by reviewers, over four months of development by cra.mr / ai, agents / 23 min read
Skill Engineering and the Case Against One-Shot AI Design: Agents need domain knowledge, context, and carefully defined ways for humans to steer results: a case against expecting one-shot AI design by Latent Space / ai, agents / 7 min read
How OpenAI Delivers Low-Latency Voice AI for 900M Users: Splitting voice AI infra into a stateless edge relay and a stateful transceiver, encoding routing metadata into the ICE ufrag to avoid database lookups on the hot path by ByteByteGo / engineering, infrastructure, ai / 15 min read
Introducing the Safari MCP Server for Web Developers: Apple's new Safari MCP server lets AI coding agents inspect the DOM, console, network, performance, and accessibility of a local Safari browser by WebKit Team / ai, tools, web / 9 min read
The Hidden Cost of Hydration Mismatches: How a single hydration mismatch, combined with web font swapping, can push a React page's Largest Contentful Paint from green into the red by Ivan Akulov / react, performance, frontend / 5 min read

🧰 Tools

12 Factor Agents: Principles for building reliable LLM-powered applications, inspired by the 12-factor app methodology by HumanLayer / ai, agents, framework
Astryx: Meta's open-source design system powering 13,000+ apps — 150+ accessible components, no styling lock-in, and an API designed for humans and AI assistants alike by Meta / design, open-source
Copybara: A tool for transforming and moving code between repositories, keeping a confidential repo and a public repo in sync from one authoritative source by Google / git, tooling, open-source
tiks: Procedural UI sounds for the web — generates click, toggle, success, and error sounds at runtime via oscillators and gain envelopes, at ~2KB gzipped by rexa-developer / web, audio, tooling
pgrust: An AI-Assisted Rewrite of Postgres in Rust: Not production-ready, but it already passes Postgres' own regression tests — built by running eight Codex agents in parallel by Michael Malis / database, rust, ai
Skills by Builder.io: Small composable skills for coding agents that extend Claude Code and Codex with planning, code review, auditing, and documentation verification by Builder.io / ai, agents, tools
FixCSS: A library that converts CSS written in an improved, corrected syntax into browser-compatible CSS, fixing design mistakes catalogued by the CSS Working Group by Declan Chidlow / css, tooling
OpenWiki: CLI that generates and maintains agent-focused documentation for codebases, with commands to initialize, update, and customize model settings by LangChain / ai, agents, docs, tools
Oak: Version control built for agent workflows — content-addressed storage gives instant branch cloning, and working trees mount in about a second without a full git-style clone by Oak / git, tools, ai
cmux: Ghostty-based macOS terminal with vertical tabs, split panes, an embedded browser, and a socket API for running AI coding agents in parallel by manaflow-ai / terminal, tools, ai
Weave Router: Local model router that picks the best LLM for each prompt in under 50ms and cuts inference costs 40-70% without ever sending API keys off-device by Weave / ai, llm, tools
ZeroFS: Open-source filesystem that makes S3-compatible object storage behave like a high-performance, encrypted POSIX filesystem or block device by ZeroFS / storage, filesystem, open-source

🤪 Fun

Where to Find the Colors Your Screen Can't Show You: A journey through real-world colors screens still can't reproduce, despite P3, OKLCH, and other expanding color gamuts by Ryan Moulton / science, color, fun / 36 min read

📺 Videos

Modern UI Patterns: A CSS Day talk on the newest updates in CSS and web UI, plus a 5-principle UX framework for framing modern design decisions by Una Kravets / css, design, talk
We Built a P2P App With No Servers — 1M Users Didn't Miss Them: The original author of Node Cookbook shows how his team built a production peer-to-peer app from scratch with no cloud, no infrastructure, and no vendor lock-in, scaling past a million users by David Mark Clements / p2p, architecture, talk
Building Great Agent Skills: The Missing Manual: A practical talk on designing, structuring, and maintaining Skills that coding agents can reliably use by AI Engineer / ai, agents, talk

Want to read more? Check out the full article here.

To sign up for the weekly newsletter, visit weeklyfoo.com.

Agent Guardrails, Faster Pipelines, and CSSQuake

Adam — Fri, 03 Jul 2026 05:02:49 +0000

AI agents are finally getting some grown-up infrastructure: Cloudflare's temporary accounts let agents deploy without borrowing a human login, Agent Hooks for Deterministic Guardrails pushes rules into the workflow before bad code wanders too far, and PostHog's 70x SQL parser story is a very good reminder that “parallel agents” only sounds impressive if you also keep the validation turned on.

The supporting cast is strong too: Recall brings local-first memory to Claude Code, ast-grep Outline gives agents symbol-level file navigation without inhaling entire files, and Hunk is built specifically for reviewing agent-authored diffs before they mutate into pure scroll fatigue. Add Migration Autopilot for risky database changes, and the tooling story starts looking a lot less like improvisational theater.

Meanwhile, the platform itself is getting sharper: Streaming HTML Might Become a Thing hints at framework-style partial updates going native, Astro 7.0 ships a Rust-powered speed boost plus Advanced Routing, PACT proposes bot throttling without surveillance, npm v12's install-script change gets the necessary “helpful, not magical” security reality check, and GitHub Actions step parallelism quietly deletes a pile of fake-job CI boilerplate.

And because the web still knows how to have fun, CSSQuake proves you can apparently render Quake with HTML/CSS 3D geometry. Completely unreasonable. Completely excellent.

Enjoy!

Signup here for the newsletter to get the weekly digest right into your inbox.

Find the 13 highlighted links of weeklyfoo #143:

I Wrote a 70x Faster SQL Parser While Barely Looking at the Code

by PostHog

Rebuilding PostHog's SQL parser using Claude Code in parallel sessions — 70x faster than the C++ ANTLR parser, validated with property-based testing

🚀 Read it!, ai, engineering

Temporary Cloudflare Accounts for AI Agents

by Cloudflare

Cloudflare's new --temporary flag in Wrangler lets AI agents deploy Workers without human sign-up or MFA

📰 Good to know, cloudflare, ai, agents

Streaming HTML Might Become a Thing

by Ollie Williams

Declarative partial updates — a browser proposal for streaming HTML placeholders — brings framework-style patterns straight to the web platform

📰 Good to know, web, html, browser

Astro 7.0

by Astro Team

Faster build times with a new Rust-powered compilation and Markdown/MDX processing pipeline — Advanced Routing adds full control over the request pipeline

📰 Good to know, astro, javascript, tooling

PACT: Anonymous Credentials for the Web

by Dennis Jackson

Mozilla's proposal for cryptographic bot-rate-limiting without user tracking or device fingerprinting — sites can throttle bots via math, not surveillance

📰 Good to know, security, privacy, browser

Blocking Install Scripts Is Not a Silver Bullet

by Ulises Gascon

npm v12 skips install scripts by default, but a compromised package's code still runs at import time — Node's permissions model and sandboxing are the actual defense

📰 Good to know, javascript, nodejs, security

GitHub Actions Steps Can Now Run in Parallel

by GitHub

Step-level parallelism lets multiple steps run concurrently within a job without needing separate jobs or a matrix workaround

📰 Good to know, github, tooling, ci

Agent Hooks for Deterministic Guardrails

by Zarar

How to use agent hooks to enforce rules AI agents cannot ignore — 100% deterministic checks that fire during work, not after

📰 Good to know, ai, agents

Recall

by raiyanyahya

Local memory plugin for Claude Code — captures session activities offline and generates concise project summaries without external servers or API keys

🧰 Tools, claude, ai, tools

ast-grep Outline

by ast-grep

New feature lets AI agents inspect a file's symbol structure without reading the whole file — fewer tokens, faster code navigation

🧰 Tools, ai, tools, ast

Hunk

by modem-dev

Terminal diff viewer built for agent-authored changesets — review-first with multi-file streams, inline AI annotations, and a skill file for automated feedback sessions

🧰 Tools, ai, tools, terminal, git

Migration Autopilot

by Migration Autopilot

GitHub Action that reviews database migration PRs for dangerous patterns — column drops, renames, truncations, and similar footguns

🧰 Tools, databases, postgres, tools

CSSQuake

by Agustin Capeletto

Quake ported to HTML/CSS 3D geometry via PolyCSS — no WebGL or canvas renderer required

🤪 Fun, css, gamedev, creative

Want to read more? Check out the full article here.

To sign up for the weekly newsletter, visit weeklyfoo.com.

Stay ahead in web development: latest news, tools, and insights #143

Adam — Mon, 29 Jun 2026 04:47:29 +0000

Signup here for the newsletter to get the weekly digest right into your inbox.

weeklyfoo #143 is here: your weekly digest of all webdev news you need to know! This time you'll find 39 valuable links in 5 categories! Enjoy!

🚀 Read it!

I Wrote a 70x Faster SQL Parser While Barely Looking at the Code: Rebuilding PostHog's SQL parser using Claude Code in parallel sessions — 70x faster than the C++ ANTLR parser, validated with property-based testing by PostHog / ai, engineering / 11 min read

📰 Good to know

Building a Design System Specced for Engineers and Agents: How Evil Martians built a design system readable by both engineers and AI agents in seven weeks, cutting the usual audit time with LLM assistance by Evil Martians / design, ai, engineering / 13 min read
Temporary Cloudflare Accounts for AI Agents: Cloudflare's new --temporary flag in Wrangler lets AI agents deploy Workers without human sign-up or MFA by Cloudflare / cloudflare, ai, agents / 8 min read
Everything a Senior Engineer Needs to Know About LLMs: A 30-minute deep dive into Transformers, self-attention mechanisms, and the architecture choices that shape modern language models by pathtostaff / ai, engineering / 30 min read
Streaming HTML Might Become a Thing: Declarative partial updates — a browser proposal for streaming HTML placeholders — brings framework-style patterns straight to the web platform by Ollie Williams / web, html, browser / 4 min read
In Praise of Memcached: The case for choosing Memcached over Redis when you need fast, stateless caching without the complexity of persistence and data structures by jchri.st / databases, performance / 5 min read
Astro 7.0: Faster build times with a new Rust-powered compilation and Markdown/MDX processing pipeline — Advanced Routing adds full control over the request pipeline by Astro Team / astro, javascript, tooling / 21 min read
Vite 8.1: Experimental bundled dev mode radically speeds up dev server startup and full reloads on large apps, plus WASM/ESM integration support by Vite Team / javascript, tooling / 7 min read
window.showDirectoryPicker Opens Up a Whole New World: Chrome's File System Access API lets web apps access local directories — enabling in-browser dev tools and full file editors by Steve Harrison / web, browser, javascript / 2 min read
Modern CSS Theming: How to use light-dark(), contrast-color(), and style-queries for themes that adapt automatically to system preferences by Una Kravets / css, web / 7 min read
The Low-Tech AI of Elden Ring: How Elden Ring's enemies use a stack-based goal management system — a surprisingly simple and effective alternative to behavior trees for dynamic hierarchical AI behavior by nega.tv / engineering, gamedev, ai / 15 min read
PACT: Anonymous Credentials for the Web: Mozilla's proposal for cryptographic bot-rate-limiting without user tracking or device fingerprinting — sites can throttle bots via math, not surveillance by Dennis Jackson / security, privacy, browser / 20 min read
What's Coming in Postgres 19: Quality-of-life improvements arriving in Postgres 19 — REPACK, partitioning enhancements, SQL/PGQ graph queries, and GROUP BY ALL by Craig Kerstiens / databases, postgres / 14 min read
The HTTP QUERY Method: New idempotent HTTP method for sending request bodies in read-only queries — filling the gap between GET and POST for large query payloads by IETF / web, http / 30 min read
Node.js 26.4 Adds Package Maps: Experimental package maps resolve modules from a static JSON file instead of walking node_modules — plus early support for the new vfs subsystem by Antoine du Hamel / javascript, nodejs / 16 min read
Blocking Install Scripts Is Not a Silver Bullet: npm v12 skips install scripts by default, but a compromised package's code still runs at import time — Node's permissions model and sandboxing are the actual defense by Ulises Gascon / javascript, nodejs, security / 21 min read
GitHub Actions Steps Can Now Run in Parallel: Step-level parallelism lets multiple steps run concurrently within a job without needing separate jobs or a matrix workaround by GitHub / github, tooling, ci / 4 min read
Rspack 2.1: Ships TypeScript 7 support and the Rust-based React Compiler — faster builds for projects using the new type stripping and Rust-compiled JSX transform by Rspack Team / javascript, tooling, rust / 17 min read
Agent Hooks for Deterministic Guardrails: How to use agent hooks to enforce rules AI agents cannot ignore — 100% deterministic checks that fire during work, not after by Zarar / ai, agents / 7 min read

🧰 Tools

Recall: Local memory plugin for Claude Code — captures session activities offline and generates concise project summaries without external servers or API keys by raiyanyahya / claude, ai, tools
Orca: AI orchestration tool for running multiple coding agents in parallel, with terminal splits, design mode, and a mobile companion for monitoring workflows by stablyai / ai, agents, tools
cnfast: Drop-in alternative to tailwind-merge, clsx, and classnames with up to 7x faster class merging by Aiden Bai / css, tailwind, tools
Polygraph: Nx's meta-harness that connects all your organization's repos into a synthetic monorepo, letting AI agents read, write, and grep across repo boundaries by Nx / ai, agents, tools
ast-grep Outline: New feature lets AI agents inspect a file's symbol structure without reading the whole file — fewer tokens, faster code navigation by ast-grep / ai, tools, ast
Hunk: Terminal diff viewer built for agent-authored changesets — review-first with multi-file streams, inline AI annotations, and a skill file for automated feedback sessions by modem-dev / ai, tools, terminal, git
Pagecast: Publish local HTML, Markdown, and static mini apps to shareable Cloudflare Pages URLs from the terminal or coding agents. by Amal David / cloudflare
Migration Autopilot: GitHub Action that reviews database migration PRs for dangerous patterns — column drops, renames, truncations, and similar footguns by Migration Autopilot / databases, postgres, tools
Go Micro: Agent harness and service framework for Go — model routing, memory, tools, guardrails, durable workflows, MCP and A2A gateways via pluggable Go interfaces by Go Micro / ai, agents, golang, tools
Hasp: Local-first secret broker with project bindings, time-bounded grants, and first-class agent support — inject secrets into processes or supply them on-demand by Hasp / security, agents, tools
pnpm pnpr: Experimental pnpm-compatible npm registry server written in Rust — early preview of self-hosted package registry support for pnpm workspaces by pnpm / javascript, nodejs, tools
AccessControl 3.0: RBAC/ABAC access control library with a real policy engine, conditional grants, ownership enforcement, mandatory restriction gates, and audit hooks by Onur Yildirim / security, tools
design.md: Format spec for describing a visual identity to coding agents — structured design context that complements CLAUDE.md for AI-assisted development workflows by Google Labs / ai, design, agents, tools
tw-fade: Tailwind CSS v4 plugin for CSS mask fades on scroll containers — scroll edge effects with zero custom CSS by Pete Boere / css, tailwind, tools
Takumi 2.0: Rust-powered engine that renders JSX to images without a headless browser — v2.0 adds SVG output and on-demand Google Fonts by Kane Wang / javascript, react, tools
ForesightJS 4: Predicts user intent from mouse and keyboard cues to prefetch content for a snappier UX — v4 adds a declarative React component by ForesightJS / javascript, performance, tools
grove: Git worktree manager that automates dependency cloning and dev server management per worktree — less boilerplate for parallel branch work by Iheanyi Ekechukwu / git, tools

🤪 Fun

I Stored a Website in a Favicon: Encoding HTML into the RGB channels of a favicon so the browser can extract and render it via JavaScript by Tim Wehrle / creative, web / 5 min read
CSSQuake: Quake ported to HTML/CSS 3D geometry via PolyCSS — no WebGL or canvas renderer required by Agustin Capeletto / css, gamedev, creative / 1 min read

📺 Videos

What's Missing in Postgres?: Bruce Momjian tours features Postgres still lacks — sharding, connection pooling, columnar storage, and transparent data encryption by Bruce Momjian / databases, postgres

Want to read more? Check out the full article here.

To sign up for the weekly newsletter, visit weeklyfoo.com.

Logs, Loops, and the AI Reality Check

Adam — Fri, 26 Jun 2026 04:30:55 +0000

Agent builders got a whole architecture playbook this week: The Log Is the Agent reframes agents as resumable event histories, Don’t Trust Large Context Windows reminds us that “1M tokens” is often marketing math, and AI Demands More Engineering Discipline, Not Less makes the case that faster code generation means stricter systems thinking, not looser standards.

Security and reliability stayed loud: A Backdoor in a LinkedIn Job Offer shows how a fake recruiting flow can weaponize dependency installs, Stop Using JWTs challenges default auth habits, and The Only Scalable Delete in Postgres Is DROP TABLE is the kind of data lifecycle advice you wish you had before your first massive cleanup job.

Also in this issue: A New Era For Software Testing, How TanStack Cut TypeScript Type-Checking Work by Up to 86%, TypeScript 7.0 RC, MDN MCP Server, Lore, Eve, and NUB all point in the same direction: better tooling, sharper feedback loops, and fewer excuses for chaotic engineering.

Enjoy!

Signup here for the newsletter to get the weekly digest right into your inbox.

Find the 14 highlighted links of weeklyfoo #142:

Stop Using JWTs

by samsch

JWTs were never designed for session management — traditional cookie sessions are more secure, more flexible, and avoid the false promise of stateless auth

🚀 Read it!, security, engineering

The Log Is the Agent

by TLDR

The agent is the history of events that make up its data — this log concept lets agents be reconstructed and resumed, unlocking capabilities that make advanced agent use cases easier to reason about

📰 Good to know, ai, agents, engineering

The Only Scalable Delete in Postgres Is DROP TABLE

by PlanetScale

Large DELETEs leave dead tuples, add replication overhead, and don't return disk space — structure your schema so bulk deletion becomes a DROP or TRUNCATE

📰 Good to know, postgres, database, performance

Don't Trust Large Context Windows

by Garrit Franke

LLMs have a reliable smart zone that degrades past roughly 100k tokens — effective attention is a small fraction of the advertised window size

📰 Good to know, ai, llm, performance

AI Demands More Engineering Discipline, Not Less

by Charity Majors

AI makes generating code fast and disposable, shifting us from obsessing over individual lines to managing entire systems — this demands more rigor, not less

📰 Good to know, ai, engineering

A Backdoor in a LinkedIn Job Offer

by roman.pt

A developer was targeted by a fake recruiter requesting a code review for a malicious GitHub repo — installing dependencies would silently execute a remote payload

📰 Good to know, security

A New Era For Software Testing

by Salvatore Sanfilippo

antirez on using AI agents as QA engineers — writing markdown specs that direct agents to exercise the full build on each release, replacing brittle scripted tests

📰 Good to know, ai, testing

How TanStack Cut TypeScript Type-Checking Work by Up to 86%

by TanStack

Using tsc diagnostics to find and eliminate expensive generic chains in TanStack Table v9 — concrete techniques reusable in any type-heavy library

📰 Good to know, typescript, performance, react

You Got Faster, Your Company Didn't

by Terrible Software

AI makes individual developers dramatically more productive but organizational structures built for slower output haven't adapted — the bottleneck has moved from writing code to reviewing, merging, and coordinating

📰 Good to know, ai, engineering, productivity

TypeScript 7.0 RC

by Microsoft

The release candidate ships the Go-based rewrite — 10x faster type-checking with no code changes required

📰 Good to know, typescript, javascript

MDN MCP Server

by MDN Team

Bring MDN's web platform documentation and browser compatibility data into any AI agent or IDE — accurate up-to-date answers instead of relying on stale model training data

🧰 Tools, mcp, ai, tools, web

Lore

by Epic Games

Epic Games' open-source version control system optimized for projects combining code with large binary assets — verifiable tamper-evident history with an interface built for both developers and artists

🧰 Tools, tools, git, gamedev

Eve

by Vercel

Vercel's open-source agent framework with built-in durable execution, sandboxed computing, and human-in-the-loop approvals — agents are defined as a directory of files specifying components, actions, and connections

🧰 Tools, tools, ai, agents

NUB

by Colin McDonnell

All-in-one toolkit from Zod's creator that augments Node.js — adds full TypeScript support beyond type stripping, faster and more secure package installation, and richer .env handling without replacing your package manager

🧰 Tools, nodejs, typescript, tools

Want to read more? Check out the full article here.

To sign up for the weekly newsletter, visit weeklyfoo.com.