DEV Community: Adam

Supply Chains, Zombie OSS, and Agent Firewalls

Adam — Fri, 29 May 2026 06:36:57 +0000

This week feels like a full-stack reality check: Gergely Orosz reports that AI is amplifying team culture (good and bad), while Cloudflare shows frontier models already chaining exploits and reviewing attacks better with multi-agent setups.

The ecosystem drama continues: SafeDep tracks 314 compromised npm packages, npm responds with staged publishing, and Andrew Nesbitt explains how open-source projects quietly become zombie dependencies.

On the practical side, Julia Evans makes a strong case for semantic HTML + native CSS, uxdesign.cc reminds AI teams that vague spinners are not UX strategy, and the database/tooling corner is unusually strong: pgsqlite, TypeORM 1.0, and Kanel 4.0 all make modern TS+SQL workflows less painful.

Bonus watch: Martin Fowler and Kent Beck reflecting on 30 years of Agile is a nice antidote to pure AI hype cycles. Also worth noting: Claw Patrol pushes agent-level security controls in the runtime itself, which is exactly where this should be heading.

Enjoy!

Signup here for the newsletter to get the weekly digest right into your inbox.

Find the 12 highlighted links of weeklyfoo #138:

AI's Impact on Software Engineers in 2026: Part 2

by Gergely Orosz

Survey of 900+ engineers — AI amplifies existing culture, codebase quality is dropping while management focuses on output, and junior devs are struggling most

🚀 Read it!, ai, engineering

Moving Away from Tailwind

by Julia Evans

Adopting semantic HTML and native CSS — component files, CSS nesting, and grid layouts without the framework dependency

📰 Good to know, css, frontend

314 npm Packages Compromised in New Supply-Chain Wave

by SafeDep Team

The mini Shai-Hulud class of supply-chain attacks returns — 314 packages including the antv family and timeago.js targeted in the latest wave

📰 Good to know, security, npm, javascript

What Claude Mythos Showed Cloudflare

by Cloudflare

Cloudflare CSO reports on Project Glasswing findings — exploit chain construction, proof generation, and adversarial multi-agent review that outperforms single-agent verification

📰 Good to know, ai, security

Dumb Ways for an Open Source Project to Die

by Andrew Nesbitt

Maintainer burnout, funding gaps, and broken tech turn still-used packages into zombies — listed everywhere, quietly dangerous for all downstream dependents

📰 Good to know, open-source, engineering

The Waiting Problem in AI Products

by uxdesign.cc

AI products ignore decades of research on wait time — users need progress indicators, ETAs, and detailed logs instead of vague spinners that force people to invent their own coping behaviors

📰 Good to know, ai, design, ux

Staged Publishing for npm Packages

by npm

npm's new staged publishing model gives packages a review period before going live — part of the npm 11.15.0 release

📰 Good to know, npm, javascript

pgsqlite

by Eran Sandler

Postgres wire-protocol adapter for SQLite — use psql, pgAdmin, and standard Postgres drivers against an SQLite database

🧰 Tools, sqlite, postgres, tools

TypeORM 1.0

by TypeORM Team

TypeScript-first ORM reaches 1.0 after years on 0.3.x — INSERT INTO SELECT support, cross-driver transaction isolation levels, and smoother PostgreSQL enum migrations

🧰 Tools, typescript, database, tools

Kanel 4.0

by Kristian Dupont

Inspects your Postgres database and generates TypeScript types for use with Knex, Zod, or Kysely

🧰 Tools, typescript, postgres, tools

Claw Patrol

by Deno Team

Security firewall for Deno agents — restricts network access and subprocess execution to prevent agent overreach

🧰 Tools, security, ai, tools

Tech Truth: Agile Evolution & the Future of SW Engineering

by Martin Fowler, Kent Beck

Martin Fowler and Kent Beck reflect on 30 years — AI as a patient tutor, what Extreme Programming got right, and why people skills still matter more than tools

📺 Videos, engineering, agile

Want to read more? Check out the full article here.

To sign up for the weekly newsletter, visit weeklyfoo.com.

Stay ahead in web development: latest news, tools, and insights #138

Adam — Mon, 25 May 2026 06:46:31 +0000

Signup here for the newsletter to get the weekly digest right into your inbox.

weeklyfoo #138 is here: your weekly digest of all webdev news you need to know! This time you'll find 32 valuable links in 4 categories! Enjoy!

🚀 Read it!

AI's Impact on Software Engineers in 2026: Part 2: Survey of 900+ engineers — AI amplifies existing culture, codebase quality is dropping while management focuses on output, and junior devs are struggling most by Gergely Orosz / ai, engineering / 16 min read

📰 Good to know

Moving Away from Tailwind: Adopting semantic HTML and native CSS — component files, CSS nesting, and grid layouts without the framework dependency by Julia Evans / css, frontend / 12 min read
Browsers Treat Big Sites Differently: Firefox and Safari ship quirks files to compensate for Chrome-only testing — test in multiple browsers regularly, not just before big launches by Den Odell / frontend, web / 11 min read
Ten Data-Backed Truths of User Experience ROI: UX fixes are 100x cheaper in the design phase — and a one-second delay reduces conversions by 20% by Smashing Magazine / design, engineering / 16 min read
The Last Six Months in LLMs: Coding agents became reliable daily tools and local open-weight models reached cutting-edge performance — Simon Willison's 6-month review by Simon Willison / ai, engineering / 10 min read
314 npm Packages Compromised in New Supply-Chain Wave: The mini Shai-Hulud class of supply-chain attacks returns — 314 packages including the antv family and timeago.js targeted in the latest wave by SafeDep Team / security, npm, javascript / 38 min read
What Claude Mythos Showed Cloudflare: Cloudflare CSO reports on Project Glasswing findings — exploit chain construction, proof generation, and adversarial multi-agent review that outperforms single-agent verification by Cloudflare / ai, security / 17 min read
Better Fluid Sizing with CSS round(): How to use the CSS round() function to snap fluid sizes to the nearest pixel or step — interactive examples included by Ahmad Shadeed / css, frontend / 9 min read
Dumb Ways for an Open Source Project to Die: Maintainer burnout, funding gaps, and broken tech turn still-used packages into zombies — listed everywhere, quietly dangerous for all downstream dependents by Andrew Nesbitt / open-source, engineering / 13 min read
CSS Gap Decorations Now in Chrome and Edge: Style flexbox, grid, and multi-column gaps directly with border-like decorations — no pseudo-elements needed by Chrome for Developers / css, frontend / 10 min read
The Pulse: Forward-Deployed Engineering Heats Up Again: OpenAI and Anthropic are creating separate FDE deployment entities while the role evolves toward solutions architecture — senior devs prefer product work over client integration by Gergely Orosz / ai, engineering / 9 min read
The Waiting Problem in AI Products: AI products ignore decades of research on wait time — users need progress indicators, ETAs, and detailed logs instead of vague spinners that force people to invent their own coping behaviors by uxdesign.cc / ai, design, ux / 1 min read
Staged Publishing for npm Packages: npm's new staged publishing model gives packages a review period before going live — part of the npm 11.15.0 release by npm / npm, javascript / 9 min read

🧰 Tools

Semble: Code search library for AI agents using natural language — 98% fewer tokens, CPU-only, sub-millisecond responses, available as MCP server or CLI by MinishLab / ai, tools
Cascade: Icons for CSS properties to visually identify them in your projects by Design Surface / design, css, tools
Re_gent: Version control for AI agents — track, replay, and audit agent decisions and state across sessions by regent-vcs / ai, tools
Hallmark: Anti-AI-slop design skill for Claude Code, Cursor, and Codex. by Hassan El Mghari / ai, design, skill
remove-ai-watermarks: CLI and library for removing visible logos, invisible watermarks, and AI provenance metadata from images generated by various models by wiltodelta / ai, tools, cli
pgsqlite: Postgres wire-protocol adapter for SQLite — use psql, pgAdmin, and standard Postgres drivers against an SQLite database by Eran Sandler / sqlite, postgres, tools
critical 8.0: Extract and inline above-the-fold critical CSS from HTML — production-ready and still actively maintained by Addy Osmani / css, performance, tools
Modern Web Guidance: Evergreen AI skills for coding agents covering UX, performance, accessibility, layouts, and CSS patterns from the Chrome team by Chrome for Developers / ai, tools, frontend
Charcuterie: Visual explorer for Unicode — browse characters, discover related glyphs, and explore scripts, symbols, and shapes across the standard by Elastiq / tools, design
distributed-system-testing: Skills for AI coding agents to plan and execute distributed system tests — claim-driven testing that validates against network partitions, concurrency, and crash-recovery scenarios by shenli / ai, testing, tools
TypeORM 1.0: TypeScript-first ORM reaches 1.0 after years on 0.3.x — INSERT INTO SELECT support, cross-driver transaction isolation levels, and smoother PostgreSQL enum migrations by TypeORM Team / typescript, database, tools
Kanel 4.0: Inspects your Postgres database and generates TypeScript types for use with Knex, Zod, or Kysely by Kristian Dupont / typescript, postgres, tools
Zero: Agent-first systems programming language inspired by Zig and Rust — one obvious path, rich stdlib, structured diagnostics, and explicit effects for external systems by Vercel / ai, tools, pl
Claw Patrol: Security firewall for Deno agents — restricts network access and subprocess execution to prevent agent overreach by Deno Team / security, ai, tools
Google Ax: Distributed agent runtime open-sourced by Google — orchestrates and scales AI agents across services by Google / ai, tools

📺 Videos

How Shopify's Design Director Shapes Product Strategy: Balancing metrics and vision, redesigning the shopping cart UX, and taking big bets on the shopping feed by Katarina Batina, Michael Riddering / design
Tech Truth: Agile Evolution & the Future of SW Engineering: Martin Fowler and Kent Beck reflect on 30 years — AI as a patient tutor, what Extreme Programming got right, and why people skills still matter more than tools by Martin Fowler, Kent Beck / engineering, agile
Harnesses in AI: A Deep Dive: How harness engineering makes AI agents reliable in production — structuring context, verification loops, and agent control by Tejas Kumar, IBM / ai, engineering
Build Agents That Run for Hours (Without Losing the Plot): Anthropic engineers on the practical challenges of long-running agents — context compaction, state management, and keeping multi-step workflows on track by Ash Prabaker, Andrew Wilson, Anthropic / ai, engineering

Want to read more? Check out the full article here.

To sign up for the weekly newsletter, visit weeklyfoo.com.

Harnesses, Slop Cannons, and Supply-Chain Alarms

Adam — Fri, 22 May 2026 04:51:06 +0000

Socket kicks off the week with a real supply-chain gut punch: 84 TanStack npm packages compromised, 12M+ weekly downloads exposed, and yet another reminder that dependency trust is not a passive activity. On the AI engineering side, LangChain, Martin Fowler, and Eugene Yan all point in the same direction: the model is only half the story — harness design, team rituals, and reusable context are what make AI systems actually useful.

manager.dev brings timeless incident wisdom (rollback first, debug second), while Jake Handy names the modern management headache: massive AI-generated PRs with suspiciously low ownership. Wasp adds a candid founder postmortem — five years and five million dollars later, inventing a new web language turned out to be the expensive scenic route.

Tool radar is packed: e2a secures agent email handoffs, Wakaru makes minified JavaScript readable again for audits, Syncpack 15.0 helps monorepos stop version drift before it becomes a lifestyle, and the TanStack Start vs Next.js interview is worth a watch if you like your framework debates with business context instead of tribal shouting.

Enjoy!

Signup here for the newsletter to get the weekly digest right into your inbox.

Find the 10 highlighted links of weeklyfoo #137:

TanStack npm Packages Compromised in Ongoing Supply-Chain Attack

by Socket

84 TanStack packages with over 12M weekly downloads hit in a supply-chain attack — deprecated versions pulled, GitHub Actions hardened with repo-owner guards and pinned action refs

🚀 Read it!, security, javascript, npm

The Anatomy of an Agent Harness

by LangChain

An AI agent is the functional combination of a core LLM and a surrounding harness — code, config, and logic for durable state, sandboxed execution, context compaction, and verification loops

📰 Good to know, ai, engineering

The Unwritten Laws of Software Engineering

by manager.dev

When production fails, roll back before debugging — and treat all untested recovery plans as fictional. Hard-won rules about dependencies, four-eyes checks, and why temporary fixes become permanent

📰 Good to know, engineering

The Slop Cannons In Your Engineering Org

by Jake Handy

A field guide to the engineer shipping huge AI-generated PRs they can't explain — confusing velocity for progress — with a manager's checklist for spotting and fixing the pattern

📰 Good to know, ai, engineering, management

5 Years and $5M Later: Inventing a New Language for Web Dev Was a Mistake

by Wasp

The Wasp co-founder reflects on why building a custom programming language for web development was a mistake — too much friction with developer adoption and high IDE tooling maintenance costs — now transitioning to a TypeScript-based SDK

📰 Good to know, engineering, opinion

How To Work and Compound With AI

by Eugene Yan

Every finished artifact — code, docs, analysis, decisions — becomes context for the next AI session and each correction updates a config that reduces future errors — a practical guide to making AI work compound over time

📰 Good to know, ai, productivity

e2a

by Mnexa-AI

Authenticated email gateway for AI agents with SPF/DKIM verification and HMAC signatures — lets agents communicate with humans via cloud webhooks or WebSocket without needing public URLs

🧰 Tools, ai, tools

Wakaru

by Pionxzh

Feed it minified bundled JavaScript and get readable source modules back — useful for code recovery, reverse-engineering, and security auditing, with an online playground

🧰 Tools, javascript, security, tools

Syncpack 15.0

by Jamie Mason

CLI tool used by Electron, Cloudflare, and Vercel that finds and fixes dependency version mismatches across entire monorepos and enforces version policies — v15.0 adds pnpm and Bun catalog support and a default release age cooldown

🧰 Tools, javascript, monorepo, tools

TanStack Start vs Next.js with Tanner Linsley

by Nuno Maduro

A candid interview covering TanStack's business model, why Start exists alongside Next.js, and framework-agnostic thinking while still deeply focusing on React

📺 Videos, javascript, react

Want to read more? Check out the full article here.

To sign up for the weekly newsletter, visit weeklyfoo.com.

Stay ahead in web development: latest news, tools, and insights #137

Adam — Mon, 18 May 2026 05:09:52 +0000

Signup here for the newsletter to get the weekly digest right into your inbox.

weeklyfoo #137 is here: your weekly digest of all webdev news you need to know! This time you'll find 28 valuable links in 5 categories! Enjoy!

🚀 Read it!

TanStack npm Packages Compromised in Ongoing Supply-Chain Attack: 84 TanStack packages with over 12M weekly downloads hit in a supply-chain attack — deprecated versions pulled, GitHub Actions hardened with repo-owner guards and pinned action refs by Socket / security, javascript, npm / 20 min read

📰 Good to know

The Anatomy of an Agent Harness: An AI agent is the functional combination of a core LLM and a surrounding harness — code, config, and logic for durable state, sandboxed execution, context compaction, and verification loops by LangChain / ai, engineering / 14 min read
The Unwritten Laws of Software Engineering: When production fails, roll back before debugging — and treat all untested recovery plans as fictional. Hard-won rules about dependencies, four-eyes checks, and why temporary fixes become permanent by manager.dev / engineering / 8 min read
I Returned to AWS and Was Reminded Hard Why I Left: Account suspension, unresponsive support, hidden billing, exorbitant egress fees, and vendor lock-in — one dev's frustrating attempt to come back to AWS after years away by fourlightyears / cloud, aws, opinion / 9 min read
HTML in Canvas: A new experimental API lets you put a layoutsubtree attribute on a canvas element to render real HTML inside it — opening up physics, distortion, and custom rendering effects on actual DOM content by Frontend Masters / frontend, web / 24 min read
How to Control Infinite CSS Animations: Combining and tweaking infinite CSS animations is harder than it looks — animation-composition property to the rescue by Frontend Masters / css, frontend / 13 min read
The Slop Cannons In Your Engineering Org: A field guide to the engineer shipping huge AI-generated PRs they can't explain — confusing velocity for progress — with a manager's checklist for spotting and fixing the pattern by Jake Handy / ai, engineering, management / 12 min read
A New HTML Element for Installing Web Apps: Chrome and Edge are testing a new install element that renders a trusted install button for PWAs with no JavaScript required — and how it compares to the Web Install API by Patrick Brosset / frontend, web, pwa / 9 min read
5 Years and $5M Later: Inventing a New Language for Web Dev Was a Mistake: The Wasp co-founder reflects on why building a custom programming language for web development was a mistake — too much friction with developer adoption and high IDE tooling maintenance costs — now transitioning to a TypeScript-based SDK by Wasp / engineering, opinion / 20 min read
How To Work and Compound With AI: Every finished artifact — code, docs, analysis, decisions — becomes context for the next AI session and each correction updates a config that reduces future errors — a practical guide to making AI work compound over time by Eugene Yan / ai, productivity / 14 min read
Patterns For Reducing Friction In AI-Assisted Development: The practices that make pair programming effective — onboarding, design discussion, shared standards — apply equally to AI coding assistants — five patterns for shifting from correcting a tool to collaborating with a teammate by Rahul Garg / ai, engineering / 13 min read

🧰 Tools

Trees: Open-source library for high-performance file tree rendering in web apps — automatic virtualization for large datasets, built-in Git status indicators, and drag-and-drop support by pierre.computer / javascript, tools
Mochi: High-fidelity browser automation library for the Bun runtime that prioritizes fingerprint consistency over simple randomization to bypass modern bot detection by 0xchasercat / bun, automation, tools
Fontastic Space: A font pairing playground that puts Google Fonts side by side, visualizes how each letterform behaves next to the others, and scores which combinations actually work by Fontastic / design, fonts, tools
Griddy Icons: Free open-source icon family with a unique utilitarian vibe by Filip Gres, Zuzana Benova / design, icons, tools
e2a: Authenticated email gateway for AI agents with SPF/DKIM verification and HMAC signatures — lets agents communicate with humans via cloud webhooks or WebSocket without needing public URLs by Mnexa-AI / ai, tools
Smallbits: Free set of 290+ pixel-style icons drawn on an 8x8 grid — available in Figma and SVG by Smallbits / design, icons, tools
Wakaru: Feed it minified bundled JavaScript and get readable source modules back — useful for code recovery, reverse-engineering, and security auditing, with an online playground by Pionxzh / javascript, security, tools
BlueJS: Ahead-of-time JavaScript compiler that produces tiny native binaries — 5ms startup, 3.8MB peak memory, GUI app in 1.2MB by bluejs.dev / javascript, tools
Statewright: State machine guardrails that regulate AI agent tool access during workflow phases — narrows the problem space and increases coding benchmark success rates by Statewright / ai, tools
AgentMemory: Persistent long-term memory server for AI coding agents including Claude Code and Cursor — hybrid search across sessions reduces token consumption by over 90% by Rohit Ghumare / ai, tools
pg_flight_recorder: Pure SQL Postgres extension using pg_cron to continuously snapshot state — pg_stat_activity, locks, statements — giving you a rolling history of what was happening when things went wrong by Dmitry Ventin / postgres, databases, tools
boring: SSH tunnel manager that simplifies opening, persisting, and listing tunnels — supports TCP and sockets including a reverse SOCKS5 proxy, configured via TOML by Alexander Becker / cli, ssh, tools
Syncpack 15.0: CLI tool used by Electron, Cloudflare, and Vercel that finds and fixes dependency version mismatches across entire monorepos and enforces version policies — v15.0 adds pnpm and Bun catalog support and a default release age cooldown by Jamie Mason / javascript, monorepo, tools
Mockdown: Free browser-based ASCII wireframe editor for creating UI mockups, lo-fi prototypes, and text diagrams by Mockdown / design, tools
Orval: Given an OpenAPI v3 or Swagger v2 spec, generate type-safe models, request functions, React Query hooks, and mocks for React, Vue, Svelte, and Solid — also generates server-side code by Victor Bury / typescript, openapi, tools

🤪 Fun

Cursor Camp: An interactive web experience from Neal.fun full of hidden goofy details to discover — cursors swimming in a lake, anyone? by Neal.fun / fun, web / 1 min read

📺 Videos

TanStack Start vs Next.js with Tanner Linsley: A candid interview covering TanStack's business model, why Start exists alongside Next.js, and framework-agnostic thinking while still deeply focusing on React by Nuno Maduro / javascript, react

Want to read more? Check out the full article here.

To sign up for the weekly newsletter, visit weeklyfoo.com.

Terminal Comebacks, AI Reality Checks, and React Projections

Adam — Fri, 15 May 2026 04:43:08 +0000

Matteo Collina opens this week with a blunt reminder: trusted publishing helps, but social engineering still walks through the front door if maintainers aren’t careful. Then Addy Osmani, Simon Willison, and Drew Breunig pile on with the same message in different flavors — AI can move fast, but your engineering judgment still has to stay in the loop.

Alcides Fonseca makes the case for the terminal comeback tour, Ahmad Shadeed gives CSS range queries the practical guide they deserved, and Smashing Magazine reframes local-first as a full architectural inversion, not just “offline mode with better branding.” Meanwhile, Tanner Linsley shows what happens when React’s API contract gets “projected” into a tiny faster runtime, and The Pragmatic Engineer reminds everyone that AI-era traffic can break even giant platforms in very non-funny ways.

And for teams trying to operationalize all this: Addy’s Agent Skills argues for non-skippable discipline, Graphify turns scattered context into a queryable knowledge graph, Manifest routes prompts across 300+ models without torching your budget, and Warp Terminal going open source adds a little healthy pressure to the AI tool stack.

Enjoy!

Signup here for the newsletter to get the weekly digest right into your inbox.

Find the 13 highlighted links of weeklyfoo #136:

Agent Skills

by Addy Osmani

AI coding agents skip the senior-engineering work unless you encode discipline as something they cannot talk themselves out of

🚀 Read it!, ai, engineering

Why Trusted Publishing Can’t Save Us from Social Engineering

by Matteo Collina

Unmasking the risky illusion of npm’s trusted publishing amidst recent cyber attacks.

📰 Good to know, npm, security

Why TUIs Are Back

by Alcides Fonseca

Native GUI fragmentation and Electron bloat are driving a resurgence of Terminal User Interfaces — fast, automatable, and consistent across platforms

📰 Good to know, terminal, engineering

CSS Range Queries

by Ahmad Shadeed

Interactive guide on why you should use range syntax in media queries instead of min/max — visual demos included

📰 Good to know, css, frontend

Cognitive Surrender

by Addy Osmani

When AI output quietly becomes your output — engineers cross from cognitive offloading into cognitive surrender by borrowing AI confidence and treating it as their own

📰 Good to know, ai, engineering, opinion

Vibe Coding and Agentic Engineering Are Getting Closer

by Simon Willison

AI blurs the line between casual and professional engineering as dependable agents lead experts to trust generated output over documentation and tests — human expertise remains essential for production systems

📰 Good to know, ai, engineering, opinion

The Architecture of Local-First Web Development

by Smashing Magazine

A paradigm shift where app data lives on the user's device — modern implementations use SQLite compiled to WebAssembly with sync engines handling conflict resolution

📰 Good to know, engineering, database

Projecting React

by Tanner Linsley

Tanner Linsley spent a day prompting an AI agent to regenerate React's public API as a ~9KB runtime running 2-3x faster than stock React — shipped quietly and available on npm as @tanstack/redact

📰 Good to know, javascript, react, ai

AI Load Breaks GitHub – Why Not Other Vendors?

by The Pragmatic Engineer

Analysis of how AI-driven traffic overwhelmed GitHub infrastructure while other vendors avoided similar outages

📰 Good to know, engineering, ai

10 Lessons for Agentic Coding

by Drew Breunig

Durable practical guidelines for agentic coding with Codex, Claude Code, or any LLM coding agent — distilled from active experience tracking what sticks as models improve

📰 Good to know, ai, engineering

Graphify

by Safi

AI coding assistant skill (Claude Code, Codex, OpenCode, Cursor, Gemini CLI, and more). Turn any folder of code, SQL schemas, R scripts, shell scripts, docs, papers, images, or videos into a queryable knowledge graph. App code + database schema + infrastructure in one graph.

🧰 Tools, ai, skills

Manifest

by mnfst

Open-source AI model router that intelligently redirects each query to the most suitable model — 300+ models across 16+ providers, reduces AI costs by up to 70%

🧰 Tools, ai, tools

Warp Terminal Open Source

by Warp

Warp's AI-native terminal, previously closed-source, is now open sourced under Apache 2.0

🧰 Tools, terminal, tools

Want to read more? Check out the full article here.

To sign up for the weekly newsletter, visit weeklyfoo.com.

Stay ahead in web development: latest news, tools, and insights #136

Adam — Mon, 11 May 2026 04:51:17 +0000

Signup here for the newsletter to get the weekly digest right into your inbox.

weeklyfoo #136 is here: your weekly digest of all webdev news you need to know! This time you'll find 36 valuable links in 4 categories! Enjoy!

🚀 Read it!

Agent Skills: AI coding agents skip the senior-engineering work unless you encode discipline as something they cannot talk themselves out of by Addy Osmani / ai, engineering / 13 min read

📰 Good to know

Why Trusted Publishing Can’t Save Us from Social Engineering: Unmasking the risky illusion of npm’s trusted publishing amidst recent cyber attacks. by Matteo Collina / npm, security / 8 min read
Agentic Coding Is a Trap: The shift toward agentic coding risks atrophying developers’ critical thinking and implementation skills while increasing complexity by Lars Faye / ai, engineering / 14 min read
Why TUIs Are Back: Native GUI fragmentation and Electron bloat are driving a resurgence of Terminal User Interfaces — fast, automatable, and consistent across platforms by Alcides Fonseca / terminal, engineering / 8 min read
Agents with Taste: Coding agents don’t know what great animations feel like — on the gap between AI leverage and visual judgment in frontend work by Emil Kowalski / ai, frontend / 5 min read
I Am Worried About Bun: Post-Anthropic acquisition concerns about Bun’s future — the runtime remains excellent, but the worry is whether it gets the same enshittification seen in other developer tools by wwj.dev / javascript, engineering / 7 min read
CSS Range Queries: Interactive guide on why you should use range syntax in media queries instead of min/max — visual demos included by Ahmad Shadeed / css, frontend / 6 min read
Wiki Builder: A Claude Code Plugin for Building LLM Knowledge Bases by Elvis Saravia / ai, wiki, knowledge / 8 min read
Claude Code Is Not Making Your Product Better: At the frontier, the bottleneck is taste — AI raises the floor for everyone but won’t help artisans create better products, only generic ones by E.T. Handing / ai, engineering, opinion / 12 min read
Cognitive Surrender: When AI output quietly becomes your output — engineers cross from cognitive offloading into cognitive surrender by borrowing AI confidence and treating it as their own by Addy Osmani / ai, engineering, opinion / 13 min read
Postgres 19’s Most Exciting Features: An opinionated look at v19 highlights — pg_plan_advice, DDL extraction, online REPACK CONCURRENTLY, and observability improvements by Tianzhou / postgres, database / 13 min read
I tracked 430 hours of Claude Code usage.: 73% was wasted on these 9 patterns. by Mnimiy / ai, tokens / 1 min read
Vibe Coding and Agentic Engineering Are Getting Closer: AI blurs the line between casual and professional engineering as dependable agents lead experts to trust generated output over documentation and tests — human expertise remains essential for production systems by Simon Willison / ai, engineering, opinion / 10 min read
The Architecture of Local-First Web Development: A paradigm shift where app data lives on the user's device — modern implementations use SQLite compiled to WebAssembly with sync engines handling conflict resolution by Smashing Magazine / engineering, database / 35 min read
Projecting React: Tanner Linsley spent a day prompting an AI agent to regenerate React's public API as a ~9KB runtime running 2-3x faster than stock React — shipped quietly and available on npm as @tanstack/redact by Tanner Linsley / javascript, react, ai / 18 min read
From React to Web Components: A Migration That Saved 100KB: Migrating a site from React to native Web Components led to patterns that grew into the nanotags library — 100KB lighter with better performance by Pavel Grinchenko (Evil Martians) / javascript, frontend / 15 min read
AI Load Breaks GitHub – Why Not Other Vendors?: Analysis of how AI-driven traffic overwhelmed GitHub infrastructure while other vendors avoided similar outages by The Pragmatic Engineer / engineering, ai / 16 min read
10 Lessons for Agentic Coding: Durable practical guidelines for agentic coding with Codex, Claude Code, or any LLM coding agent — distilled from active experience tracking what sticks as models improve by Drew Breunig / ai, engineering / 4 min read

🧰 Tools

Graphify: AI coding assistant skill (Claude Code, Codex, OpenCode, Cursor, Gemini CLI, and more). Turn any folder of code, SQL schemas, R scripts, shell scripts, docs, papers, images, or videos into a queryable knowledge graph. App code + database schema + infrastructure in one graph. by Safi / ai, skills
Acai: Spec-driven software development toolkit with a feature.yaml format, CLI, and dashboard for tracking requirements from spec to code to tests by acai.sh / engineering, cli
Agent Desktop: Native desktop automation CLI for AI agents — 53 commands using OS accessibility trees, structured JSON output, no screenshots needed by lahfir / ai, cli, automation
Manifest: Open-source AI model router that intelligently redirects each query to the most suitable model — 300+ models across 16+ providers, reduces AI costs by up to 70% by mnfst / ai, tools
Flue: Experimental TypeScript framework for building headless AI agents using a runtime-agnostic harness — define agent logic and context through Markdown files with minimal code by Astro / ai, typescript
Openhare: AI-powered cross-platform desktop SQL client for querying and exploring databases by Sun Jian / ai, database
Agentic Inbox: Self-hosted React 19 and React Router 7 web email app built heavily on Cloudflare APIs — open sourced by Cloudflare / ai, tools, github
Formisch: Modular, type-safe, framework-agnostic form library for JavaScript by open-circle / javascript, tools
ShaderPad: Lightweight dependency-free WebGL shader library for embedding creative shader effects on any page — no boilerplate by Riley J. Shaw / webgl, tools
pg_column_tetris: Postgres extension that enforces optimal column alignment to minimize row padding waste — shows bytes lost to padding or blocks inefficient table creation by Roger Welin / postgres, database
Token Optimizer: Find the ghost tokens. Fix them. Survive compaction. Avoid context quality decay. by Alex Greenshpun / ai, tokens
Warp Terminal Open Source: Warp's AI-native terminal, previously closed-source, is now open sourced under Apache 2.0 by Warp / terminal, tools
Plow: HTTP benchmarking tool with real-time terminal stats, configurable concurrency and ramp-up, JSON output, and a web UI by six-ddc / tools, cli, performance
deepsec: Agent-powered vulnerability scanning for codebases — from Vercel Labs by Vercel Labs / security, ai, tools
Open Agents: Open-source three-layer framework for deploying durable background coding agents that run multi-step processes independently of a single request lifecycle, with tools for file management and GitHub PR automation by Vercel Labs / ai, tools, github
tsz: WIP Rust-based TypeScript compiler claiming to outperform tsgo — community watching if it becomes TypeScript 8 by tsz.dev / typescript, tools
Mirage: Unified virtual file system that lets AI agents interact with S3, Google Drive, Slack, and more through a single directory tree via standard Unix-like commands by strukto-ai / ai, tools

🤪 Fun

Datatype, font: Variable font that turns text characters into charts and data visualizations by Frank Tisellano / design, fun / 3 min read

Want to read more? Check out the full article here.

To sign up for the weekly newsletter, visit weeklyfoo.com.

10x TypeScript, Intent Debt, and Patch That Kernel

Adam — Fri, 08 May 2026 04:43:24 +0000

TypeScript 7.0 Beta drops with a Go-powered rewrite and roughly 10x compiler performance — your morning coffee break just got a lot shorter.

The AI discourse this week is having an identity crisis. Martin Fowler argues that treating prompts as first-class, version-controlled artifacts is the next maturity leap for LLM-assisted development. Tim Kellogg maps out three mutable agent memory types — Files, Memory Blocks, and Skills — and why editable memory is the real unlock. Simme introduces "intent debt" — the hidden cost of deploying agents without documenting what they're actually supposed to do — while The Last Software Engineer argues that when agents handle all implementation, judgment is all that's left. And Mario Zechner and Armin Ronacher, who actually shipped production agentic systems, are walking back their own enthusiasm: junior engineers still win on value.

Security corner: Andrew Nesbitt shows how insecure Actions defaults make GitHub CI the weakest link in your supply chain, and CVE-2026-31431 is a Linux kernel privilege escalation hiding since 2017 — any unprivileged user, Python script, root access. Patch now.

Stripe runs 5% of tests per CI build in a 50M-line monorepo using C++ file-access tracking. If your test suite runs everything on every PR, this one should sting a little. Josh Comeau returns with the definitive guide to CSS scroll-driven animations — no JavaScript, no excuses.

On tools: Dirac cuts AI coding agent API costs by 64.8% using AST manipulation, and Perry compiles TypeScript straight to native executables without a runtime dependency.

Enjoy!

Signup here for the newsletter to get the weekly digest right into your inbox.

Find the 12 highlighted links of weeklyfoo #135:

Structured Prompt-Driven Development

by Martin Fowler

Treating AI prompts as first-class version-controlled artifacts to make LLM-assisted changes governable, reviewable, and reusable

🚀 Read it!, ai, engineering, prompting

Selective Test Execution at Stripe

by Stripe Engineering

How Stripe runs only 5% of tests per CI build in a 50M-line Ruby monorepo — C++ file access tracking selects exactly which tests to run based on changed code paths

📰 Good to know, engineering, ci, testing

Agent Memory Patterns

by Tim Kellogg

The three types of mutable memory for agents — Files, Memory Blocks, and Skills — and how editable memory makes agents dramatically more capable

📰 Good to know, ai, agents

TypeScript 7.0 Beta: 10x Faster Compilation

by Microsoft

The Go-powered TypeScript port in beta — about 10x faster compiler performance, already close to production-ready

📰 Good to know, typescript, javascript

GitHub Actions Is the Weakest Link

by Andrew Nesbitt

How insecure defaults make Actions a major supply chain attack vector — and what maintainers can do today without waiting for GitHub to fix the defaults

📰 Good to know, security, ci, supply-chain

Scroll-Driven Animations

by Josh W. Comeau

Deep dive into the new CSS animation-timeline API for native scroll-driven animations without JavaScript

📰 Good to know, css, frontend, animation

Building Pi and What Makes Self-Modifying Software Fascinating

by Gergely Orosz

Mario Zechner and Armin Ronacher on automation bias, declining AI code quality, and why junior engineers are more valuable than AI agents

📰 Good to know, ai, agents, engineering, opinion

The Last Software Engineer

by Epic Product Engineer

As AI agents automate implementation, engineering value shifts to judgment — what to build and why, and owning the consequences of those decisions

📰 Good to know, ai, engineering, opinion

The End of Just Ask Sarah

by Simme

AI agents only know their context window — the shift from human institutional memory to explicit machine-readable docs reveals a new kind of technical debt called intent debt

📰 Good to know, ai, agents, documentation

Copy Fail (CVE-2026-31431)

by security researchers

Critical Linux kernel flaw since 2017 — unprivileged local users gain root access via a Python script, posing severe risk to container clusters without kernel update or disabling algif_aead

📰 Good to know, security, linux

Dirac

by dirac-run

Open-source AI coding agent for VS Code and CLI that cuts API costs by 64.8% through AST manipulation and optimized context curation

🧰 Tools, ai, coding, tools

Perry

by perryts

Cross-platform TypeScript compiler that compiles directly to native executables without a runtime

🧰 Tools, typescript, tools

Want to read more? Check out the full article here.

To sign up for the weekly newsletter, visit weeklyfoo.com.

Stay ahead in web development: latest news, tools, and insights #135

Adam — Mon, 04 May 2026 04:47:14 +0000

Signup here for the newsletter to get the weekly digest right into your inbox.

weeklyfoo #135 is here: your weekly digest of all webdev news you need to know! This time you'll find 35 valuable links in 4 categories! Enjoy!

🚀 Read it!

Structured Prompt-Driven Development: Treating AI prompts as first-class version-controlled artifacts to make LLM-assisted changes governable, reviewable, and reusable by Martin Fowler / ai, engineering, prompting / 37 min read

📰 Good to know

Selective Test Execution at Stripe: How Stripe runs only 5% of tests per CI build in a 50M-line Ruby monorepo — C++ file access tracking selects exactly which tests to run based on changed code paths by Stripe Engineering / engineering, ci, testing / 2 min read
Thoughts and Feelings Around Claude Design: Figma's locked-down format kept it out of AI training data while LLMs learned code — the source of truth is shifting back to code, making Figma look pre-AI by Sam Henri Gold / ai, design / 7 min read
The Woes of Sanitizing SVGs: How Scratch's repeated manual SVG sanitization failures led to XSS and HTTP leaks — and why iframe+CSP sandboxing is the only sustainable path by muffin / security, frontend / 16 min read
Agent Memory Patterns: The three types of mutable memory for agents — Files, Memory Blocks, and Skills — and how editable memory makes agents dramatically more capable by Tim Kellogg / ai, agents / 8 min read
AI Fluency Index: Anthropic studied 9,830 Claude conversations and identified 24 fluency behaviors — only 30% of users set collaboration terms upfront, showing most are stuck at the prompt-and-fix level by Anthropic / ai, research / 14 min read
How AI Is Changing Operating Systems: Ubuntu's approach to AI hardware enablement — native CUDA packaging, NPU support, x86_64 architecture variants, and early plans for agentic workflows at the OS level by Gergely Orosz / engineering, ai, linux / 14 min read
TypeScript 7.0 Beta: 10x Faster Compilation: The Go-powered TypeScript port in beta — about 10x faster compiler performance, already close to production-ready by Microsoft / typescript, javascript / 20 min read
GitHub Actions Is the Weakest Link: How insecure defaults make Actions a major supply chain attack vector — and what maintainers can do today without waiting for GitHub to fix the defaults by Andrew Nesbitt / security, ci, supply-chain / 12 min read
Scroll-Driven Animations: Deep dive into the new CSS animation-timeline API for native scroll-driven animations without JavaScript by Josh W. Comeau / css, frontend, animation / 20 min read
Why Ghostty Is Leaving GitHub: Mitchell Hashimoto moves Ghostty off GitHub after 18 years due to frequent outages affecting professional collaboration by Mitchell Hashimoto / tools, engineering, opinion / 5 min read
What's Actually New in JavaScript: All the useful features from ES2025 and ES2026 in one place: iterator helpers, Promise.try, Map.getOrInsert, Temporal, and more by Neciu Dan / javascript, frontend / 35 min read
Building Pi and What Makes Self-Modifying Software Fascinating: Mario Zechner and Armin Ronacher on automation bias, declining AI code quality, and why junior engineers are more valuable than AI agents by Gergely Orosz / ai, agents, engineering, opinion / 9 min read
The End of Responsive Images: Mat Marquis reflects on 14 years of srcset/sizes headaches — the new sizes=auto for lazy-loaded images is now cross-browser and eliminates manual calculations entirely by Mat Marquis / css, frontend, responsive / 20 min read
Constructable Stylesheets and adoptedStyleSheets: One Parse, Every Shadow Root: Create CSSStyleSheet objects in JavaScript and share them across Shadow DOM — parse CSS once per component class instead of per element by Rob Levin / css, web-components, frontend / 14 min read
React Compiler at 18 Months: Eighteen months in, the compiler's real wins are eliminating forgotten-dependency bugs and missing memos — not benchmark speedups. Adoption blockers in brownfield apps and what's next by Sascha Bäuerlein / react, javascript, engineering / 12 min read
The Last Software Engineer: As AI agents automate implementation, engineering value shifts to judgment — what to build and why, and owning the consequences of those decisions by Epic Product Engineer / ai, engineering, opinion / 10 min read
The End of Just Ask Sarah: AI agents only know their context window — the shift from human institutional memory to explicit machine-readable docs reveals a new kind of technical debt called intent debt by Simme / ai, agents, documentation / 8 min read
Copy Fail (CVE-2026-31431): Critical Linux kernel flaw since 2017 — unprivileged local users gain root access via a Python script, posing severe risk to container clusters without kernel update or disabling algif_aead by security researchers / security, linux / 5 min read
Fresh 2.3: Deno's full-stack framework gains first-class WebSocket support, ships zero JS for static pages, and adds one-attribute View Transitions API integration by Bartek Iwańczuk / javascript, deno, frontend / 10 min read
The Pulse: Token Spend Breaks Budgets: Companies are hitting AI token budget overruns and switching strategies — from real-time measurement to cheaper models and local alternatives by Gergely Orosz / ai, engineering / 17 min read
Firefox Maker Pushes Back Against Google's Prompt API: Mozilla argues Chrome's built-in LLM Prompt API harms web interoperability and neutrality — the API lets web pages directly prompt a browser-provided language model by Mozilla / browser, ai, standards / 11 min read

🧰 Tools

AIMAC: Tests 43 AI models by prompting them to build web pages and auditing the output for accessibility violations by AIMAC / ai, accessibility, testing
Awesome Harness Engineering: Awesome list for AI agent harness engineering: tools, patterns, evals, memory, MCP, permissions, observability, and orchestration. by ai-boost / ai, tools
Skills: Skills for Real Engineers. Straight from my .claude directory. by Matt Pocock / skills, ai
wuphf: Slack for AI employees that build and maintain their own wiki. Get Claudes, Codexes, OpenClaws and local LLMs to collaborate and do your work autonomously while never losing context. by wuphf.team / ai, agents
Dirac: Open-source AI coding agent for VS Code and CLI that cuts API costs by 64.8% through AST manipulation and optimized context curation by dirac-run / ai, coding, tools
Pi: Minimalist self-modifying AI coding agent built for stability — designed because Claude Code became unpredictable as features accumulated by Mario Zechner / ai, agents, tools
Honker: Postgres NOTIFY/LISTEN semantics for SQLite — low-latency cross-process events without a daemon or broker by Russell Romney / databases, sqlite, tools
OpenSpec: Spec-driven development framework that adds a lightweight specification layer between humans and AI coding assistants — align on requirements before any code is written by Fission AI / ai, tools, github
Perry: Cross-platform TypeScript compiler that compiles directly to native executables without a runtime by perryts / typescript, tools
Pu.sh: Minimalist coding-agent harness in 400 lines of shell script — a lightweight alternative to heavier AI coding frameworks by pu.sh / ai, agents, tools

📺 Videos

Prompting 101: Anthropic's applied AI team just showed how to actually prompt Claude properly. by Hannah Moran, Christian Ryan / ai, anthropic
Design at Scale at Ramp: Diego Zaks on how Ramp uses AI at 1,500 people — 99.5% daily usage, 1,500 internal apps in six weeks, non-engineers writing 12% of production code by UX Tools / ai, design, agents
OpenClaw for Designers: Tommy's walkthrough of his AI agent harness for designers — SOUL.md, USER.md, MCP connections to Figma and Slack, and what it actually costs to run a self-improving design stack by UX Tools / ai, design, agents

Want to read more? Check out the full article here.

To sign up for the weekly newsletter, visit weeklyfoo.com.

Agent Vaults, Slop Cops, and No More PRs

Adam — Fri, 01 May 2026 05:13:28 +0000

The theme this week writes itself: AI agents are running production systems, they're getting faster to deploy, they're occasionally breaking in, and someone finally built a lockbox for your API keys.

Addy Osmani charts four architectural bets for the next generation of agentic systems. Cloudflare shares actual numbers: 93% of their R&D now uses AI tools built on their own platform, pushing weekly merge requests from 5,600 to over 8,700 — the most concrete productivity benchmark any major infrastructure company has published. Slack Engineering rounds it out with the hardest problem: keeping long-running agents on-mission without context drift.

The security picture is getting complicated. The Vercel April 2026 incident is essential reading — a compromised third-party AI tool gave attackers access to sensitive customer data, and Guillermo explicitly called out the role of AI in accelerating the attack. Agent Vault from Infisical is the direct response: an open-source HTTP credential proxy that prevents AI agents from ever directly touching your API keys, blocking both accidental exfiltration and prompt injection at the network layer.

Meanwhile, the ecosystem is quietly reshuffling. One open-source maintainer is no longer accepting external PRs — LLM-generated code only, human contributions redirected to feedback and architecture. Evil Martians maps which LLM discoverability techniques actually work versus the eight that sound plausible but don't. Frontend Masters delivers the accessibility wake-up call: AI-generated UI looks right but fails screen readers, optimizing for visual fidelity while ignoring the accessibility tree entirely.

On tools: Rspack 2.0 ships meaningful Rust-powered build performance without touching your existing webpack config, Slop Cop catches LLM prose patterns before your writing sounds like everyone else's AI output, and aube enters the package manager competition from the creator of mise — performance-first, security-conscious, drop-in npm replacement.

Enjoy!

Signup here for the newsletter to get the weekly digest right into your inbox.

Find the 11 highlighted links of weeklyfoo #134:

The Agent Stack Bet

by Addy Osmani

Most production agents today feature fragile session logic, shared service accounts, and weak security models — four architectural bets for the next generation of agentic systems

🚀 Read it!, ai, engineering

Vercel April 2026 Security Incident

by Vercel

A compromised third-party AI tool gave attackers access to sensitive Vercel customer data — Guillermo noted the attack was significantly accelerated by AI

📰 Good to know, security

The AI Engineering Stack Cloudflare Built Internally

by Cloudflare

93% of Cloudflare's R&D uses AI tools built on their own platform — MCP servers, access layer, and agent tooling pushed weekly merge requests from 5,600 to over 8,700

📰 Good to know, ai, engineering

Managing Context in Long-Run Agentic Applications

by Slack Engineering

Slack Engineering on maintaining alignment across complex long-running agent systems — techniques for balancing continuity and creativity in multi-agent teams

📰 Good to know, ai, engineering, agents

I Don't Want Your PRs Anymore

by dpc.pw

An open source maintainer closes external PRs in favor of LLM-generated code — future contributions should focus on feedback, architecture, and bug reports

📰 Good to know, ai, engineering, open-source

Making Your Site Visible to LLMs: 6 Techniques That Work, 8 That Don't

by Evil Martians

Practical guide to LLM discoverability — structured data, llms.txt, clean semantic HTML, and eight techniques that actually don't help

📰 Good to know, ai, seo, frontend

AI-Generated UI Is Inaccessible by Default

by Frontend Masters

AI tools produce React components that look correct but fail screen readers — div soup with no roles, keyboard support, or ARIA state because models optimize for visual fidelity while ignoring the accessibility tree

📰 Good to know, ai, accessibility, frontend

Rspack 2.0

by Rspack

Rust-powered webpack-compatible bundler ships v2.0 with significantly faster builds, improved ESM output, and broad framework support across Next.js, Vue, Svelte, and Solid

📰 Good to know, javascript, tools, performance

Slop Cop

by awnist

Browser-based writing editor that flags rhetorical and structural patterns common in generic LLM prose

🧰 Tools, ai, writing, tools

aube

by Jeff Dickey

New Node.js package manager from the creator of mise — drop-in replacement for npm with raw performance focus and security-conscious defaults

🧰 Tools, node, tools

Agent Vault

by Infisical

Open-source HTTP credential proxy that prevents AI agents from handling sensitive API keys directly — transparently injects credentials at the network layer to block exfiltration and prompt injection

🧰 Tools, ai, security, tools, github

Want to read more? Check out the full article here.

To sign up for the weekly newsletter, visit weeklyfoo.com.

Stay ahead in web development: latest news, tools, and insights #134

Adam — Mon, 27 Apr 2026 04:57:32 +0000

Signup here for the newsletter to get the weekly digest right into your inbox.

weeklyfoo #134 is here: your weekly digest of all webdev news you need to know! This time you'll find 32 valuable links in 5 categories! Enjoy!

🚀 Read it!

The Agent Stack Bet: Most production agents today feature fragile session logic, shared service accounts, and weak security models — four architectural bets for the next generation of agentic systems by Addy Osmani / ai, engineering / 8 min read

📰 Good to know

Introducing Claude Design: Anthropic's new product for creating designs, prototypes, and presentations using Claude Opus 4.7 — available in research preview for Pro, Max, Team, and Enterprise by Anthropic / ai, design / 7 min read
Claude Opus 4.7 System Prompt Changes: Claude's system prompt changes from Opus 4.6 to 4.7 — less pushy, more concise, new browser and Office agent tools, expanded safety guidelines by Simon Willison / ai / 7 min read
Six Levels of Dark Mode: Eight progressive methods for dark mode implementation — from basic HTML meta tags and CSS properties to advanced media queries and JavaScript color scheme switching by Matthias Beitl / css, frontend / 10 min read
Vercel April 2026 Security Incident: A compromised third-party AI tool gave attackers access to sensitive Vercel customer data — Guillermo noted the attack was significantly accelerated by AI by Vercel / security / 7 min read
Building a UI Without Breakpoints: Using flex calc(infinity) and container queries to build responsive layouts that naturally adapt without explicit media query breakpoints by Frontend Masters / css, frontend / 14 min read
The AI Engineering Stack Cloudflare Built Internally: 93% of Cloudflare's R&D uses AI tools built on their own platform — MCP servers, access layer, and agent tooling pushed weekly merge requests from 5,600 to over 8,700 by Cloudflare / ai, engineering / 23 min read
Managing Context in Long-Run Agentic Applications: Slack Engineering on maintaining alignment across complex long-running agent systems — techniques for balancing continuity and creativity in multi-agent teams by Slack Engineering / ai, engineering, agents / 17 min read
OWASP NPM Security Best Practices: Continually updated checklist covering lifecycle script disabling, typosquatting, trusted publishing, and dependency confusion by OWASP / security, npm / 22 min read
I Don't Want Your PRs Anymore: An open source maintainer closes external PRs in favor of LLM-generated code — future contributions should focus on feedback, architecture, and bug reports by dpc.pw / ai, engineering, open-source / 5 min read
Making Your Site Visible to LLMs: 6 Techniques That Work, 8 That Don't: Practical guide to LLM discoverability — structured data, llms.txt, clean semantic HTML, and eight techniques that actually don't help by Evil Martians / ai, seo, frontend / 20 min read
AI-Generated UI Is Inaccessible by Default: AI tools produce React components that look correct but fail screen readers — div soup with no roles, keyboard support, or ARIA state because models optimize for visual fidelity while ignoring the accessibility tree by Frontend Masters / ai, accessibility, frontend / 21 min read
Rspack 2.0: Rust-powered webpack-compatible bundler ships v2.0 with significantly faster builds, improved ESM output, and broad framework support across Next.js, Vue, Svelte, and Solid by Rspack / javascript, tools, performance / 18 min read
Details That Make Interfaces Feel Better: Small UI polish details that compound into better-feeling interfaces — balanced text wrapping, concentric border radius, tabular numbers, interruptible CSS transitions, and more by Jakub / css, frontend / 10 min read

🧰 Tools

MDV: Markdown superset with embedded charts, KPI cards, and data visualizations using declarative syntax — renders to self-contained HTML or PDF with a VS Code live preview extension by drasimwagan / markdown, tools, github
Slop Cop: Browser-based writing editor that flags rhetorical and structural patterns common in generic LLM prose by awnist / ai, writing, tools
Yuku: High-performance JavaScript/TypeScript compiler and toolchain written in Zig — 100% JS spec compliant by Yuku Toolchain / javascript, typescript, tools, github
Claude Context: MCP plugin that gives AI coding agents deep codebase understanding — indexes millions of code lines with vector search and AST-based chunking to cut token usage by Zilliz / ai, tools, mcp, github
Cloudflare cf CLI: Preview of Cloudflare's new CLI tool for working with its various services — local dev and resource explorer features by Cloudflare / tools, cloudflare
Laws of Software Engineering: Collection of 56 principles and patterns that shape software systems, teams, and decisions by Community / engineering, tools
Is It Agent Ready?: Scan any website to check how well it's structured for AI agent access — checks llms.txt, structured data, and agent-readable content by Is It Agent Ready / ai, tools, agents
Argent: Agentic toolkit for AI assistants to autonomously control, profile, and debug iOS Simulators with native React Native support — operates locally without data collection by Software Mansion / ai, tools, ios, github
Broccoli: Converts Linear tickets into GitHub Pull Requests using AI models like Claude and Codex — runs entirely in your own Google Cloud project for privacy with automated planning, implementation, and code reviews by BeSImple / ai, tools, github
aube: New Node.js package manager from the creator of mise — drop-in replacement for npm with raw performance focus and security-conscious defaults by Jeff Dickey / node, tools
Agent Vault: Open-source HTTP credential proxy that prevents AI agents from handling sensitive API keys directly — transparently injects credentials at the network layer to block exfiltration and prompt injection by Infisical / ai, security, tools, github
Portless: Replace port numbers with named local URLs for local development — cleaner URLs for multi-service dev environments by Vercel Labs / tools, github
TSRX: TypeScript language extension described as a spiritual successor to JSX — compiles to React, Preact, Solid, and Ripple with control flow, scoped styles, and a live playground by Dominic Gannaway / typescript, javascript, tools
React Arborist 3.5: Tree view component for React with folders, drag and drop sorting, filtering, and keyboard navigation — the VS Code sidebar experience in one component by James Kerr / react, tools, github

🤪 Fun

Liquid Glass WebGL Effects for HTML: WebGL-powered glass refraction and blur effects for any HTML element — reproduce iOS 26's liquid glass aesthetic with an interactive playground by Yassine Bouanane / webgl, css, fun / 13 min read

📺 Videos

Designing The Next Flow State: Amelia Wattenberger on the missing abstraction in AI coding — a living spec, a markdown document between you and the agents as the shared source of truth by UX Tools / ai, design, engineering
The Future of MCP: MCP co-creator David Soria Parra on what agents look like in 2026 — connectivity as the key abstraction, skills and MCP as the integration stack, and why 2026 is the year agents go to production by David Soria Parra / ai, mcp, agents
Agentic Design: Video essay for designers building agent harnesses — how stochastic, scholastic, and deterministic design represent fundamentally different bets on design labor and who owns the final artifact by UX Tools / ai, design

Want to read more? Check out the full article here.

To sign up for the weekly newsletter, visit weeklyfoo.com.

Builders, Coasters, and 30 Plugins Gone Rogue

Adam — Fri, 24 Apr 2026 04:49:33 +0000

Gergely Orosz surveyed 900+ software engineers and found three archetypes emerging in the AI era: builders, shippers, and coasters. The breakdown of who's thriving, who's just shipping faster, and who's quietly coasting is the most grounded portrait of the profession right now.

The bigger question is what comes next. James Stanier maps three scenarios for whether the traditional mentorship pipeline can survive an AI-compressed learning curve — and the answer matters for everyone at every level of seniority. Addy Osmani formalizes the new skill that will separate high-functioning AI teams from the rest: Agentic Engine Optimization — structuring your docs for agent discoverability, parsability, and token efficiency. Tim Davis names the fundamental shift: we're no longer building deterministic systems — we're assembling probabilistic ones, from code no single human designed end-to-end, reviewed under time pressure. The accountability questions that creates haven't been answered yet.

Orhun Parmaksiz makes the principled case against vibe-coding: letting AI handle the tedious parts while you keep only the interesting ones isn't a productivity hack — it's how craft and maintainability erode together. The practical complement: TkDodo's vertical codebase — stop organizing your codebase by technical type and start organizing by domain, so everything that belongs together actually lives together.

Christian Ekrem demonstrates how branded types and discriminated unions let TypeScript carry proof that validation already happened — no defensive if-checks scattered across files, zero runtime overhead.

Security brought two head-turners this week: someone purchased 30 WordPress plugins specifically to plant backdoors across the portfolio (the acquisition vector most threat models never account for), and Cal.com closed its main repository after five years of open source because AI can now find and exploit public vulnerabilities faster than maintainers can patch them. The security calculus for open-source projects has quietly shifted.

Jonathan Chart's index deep dive covers composite index order, partial indexes, functional indexes, and EXPLAIN — the fundamentals that turn mysterious slow queries into five-minute fixes.

Finally: GitHub Stacked PRs just went native with one-click merging and AI agent integration — the pattern that was too painful to adopt at scale has officially graduated to mainstream. And Google's Magika is now open source: AI-powered file type detection for 200+ content types, the same model powering Google's own user safety infrastructure.

Enjoy!

Signup here for the newsletter to get the weekly digest right into your inbox.

Find the 12 highlighted links of weeklyfoo #133:

The Impact of AI on Software Engineers in 2026

by Gergely Orosz

Survey of 900+ engineers reveals three archetypes - builders, shippers, coasters - and how AI tools affect each differently in cost, productivity, and professional identity

🚀 Read it!, ai, engineering

Agentic Engine Optimization (AEO)

by Addy Osmani

How to structure docs so AI coding agents can actually use them - discoverability, parsability, token efficiency, and access control

📰 Good to know, ai, engineering

Who Will Be the Senior Engineers of 2035?

by James Stanier

Three scenarios for how AI will reshape the way senior engineers emerge - and whether the traditional mentorship pipeline can survive

📰 Good to know, engineering, ai

Write Less Code, Be More Responsible

by Orhun Parmaksiz

Against the vibe-coding trend - why letting AI handle the tedious parts while you keep the fun ones is a recipe for quality and maintainability decline

📰 Good to know, ai, engineering

Parse, Don't Validate in TypeScript

by Christian Ekrem

Branded types and discriminated unions let TypeScript carry proof that validation already happened - no more defensive if checks scattered across files

📰 Good to know, typescript, javascript

30 WordPress Plugins Backdoored After Acquisition

by anchor.host

A buyer purchased 30 plugins of varying popularity and planted a backdoor in all of them - a supply chain attack via legitimate ownership

📰 Good to know, security

Things You Didn't Know About Indexes

by Jonathan Chart

Composite index order, partial indexes, functional indexes, and EXPLAIN - a practical deep dive on where indexes help and where they hurt

📰 Good to know, database, engineering

Cal.com Goes Closed Source After 5 Years

by Cal.com

AI can now rapidly find and exploit open-source vulnerabilities - Cal.com closes its main repo while releasing Cal.diy under MIT for hobbyists

📰 Good to know, open-source, engineering

The Vertical Codebase

by TkDodo

Stop splitting code by technical type (components, hooks, utils) - group by functionality instead so everything in a domain lives together regardless of type

📰 Good to know, engineering

Probabilistic Engineering and the 24-7 Employee

by Tim Davis

The shift from deterministic to probabilistic engineering - code generated by stochastic systems, reviewed under time pressure, assembled into wholes no single human ever designed end-to-end

📰 Good to know, engineering, ai

GitHub Stacked PRs

by GitHub

Native stacked PR workflow - break large changes into small reviewable pull requests and merge the whole stack in one click, with AI agent integration

🧰 Tools, git, github, tools

Magika

by Google

Google's AI-powered file type detection that identifies 200+ content types using a lightweight deep learning model - used internally for user safety

🧰 Tools, ai, tools, github

Want to read more? Check out the full article here.

To sign up for the weekly newsletter, visit weeklyfoo.com.

Stay ahead in web development: latest news, tools, and insights #133

Adam — Mon, 20 Apr 2026 04:57:10 +0000

Signup here for the newsletter to get the weekly digest right into your inbox.

weeklyfoo #133 is here: your weekly digest of all webdev news you need to know! This time you'll find 36 valuable links in 4 categories! Enjoy!

🚀 Read it!

The Impact of AI on Software Engineers in 2026: Survey of 900+ engineers reveals three archetypes - builders, shippers, coasters - and how AI tools affect each differently in cost, productivity, and professional identity by Gergely Orosz / ai, engineering / 16 min read

📰 Good to know

Agentic Engine Optimization (AEO): How to structure docs so AI coding agents can actually use them - discoverability, parsability, token efficiency, and access control by Addy Osmani / ai, engineering / 16 min read
How Complex Is My Code?: Code complexity beyond algorithmic efficiency - human cognitive effort, psycholinguistic insights, and why metrics are better for prioritizing refactoring than measuring quality by Phil / engineering / 13 min read
Why MDN Was Rebuilt Without React: React was just a wrapper around static content - MDN now uses a custom render pipeline and Lit web components by MDN / frontend, engineering / 33 min read
Moving Railway's Frontend Off Next.js: Railway migrated 200+ routes from Next.js to Vite and TanStack Router with zero downtime - faster builds, better type safety, and a simpler client-side architecture by Railway / frontend, engineering / 7 min read
Uber's Agentic System for Instant Design Specs: How Uber built an agentic pipeline to automate design spec generation in minutes, cutting manual handoff work between designers and engineers by Ian Guisard / ai, design / 13 min read
Who Will Be the Senior Engineers of 2035?: Three scenarios for how AI will reshape the way senior engineers emerge - and whether the traditional mentorship pipeline can survive by James Stanier / engineering, ai / 16 min read
Write Less Code, Be More Responsible: Against the vibe-coding trend - why letting AI handle the tedious parts while you keep the fun ones is a recipe for quality and maintainability decline by Orhun Parmaksiz / ai, engineering / 6 min read
The Hidden Cost of Building Workflow Editors: Build vs buy analysis for React Flow-based editors - custom node state, undo/redo, and real-time sync pile up faster than teams expect by workflowbuilder.io / engineering, frontend / 10 min read
TanStack Start Gets RSC But Not Like Next.js: Client-owned tree, server functions via createServerFn only, and RSC as a plain React Flight stream you fetch with TanStack Query - a genuinely different approach than Next.js by TanStack / frontend, engineering / 19 min read
Parse, Don't Validate in TypeScript: Branded types and discriminated unions let TypeScript carry proof that validation already happened - no more defensive if checks scattered across files by Christian Ekrem / typescript, javascript / 13 min read
SVG Filters Guide: Getting Started with the Basics: Filter regions, color interpolation, and cross-browser consistency - a solid primer on a power feature most devs skip by Ana Tudor / css, frontend / 18 min read
Squash and Stretch on the Web: Disney animation principles applied to web motion - how squash and stretch adds polish and physicality to UI interactions by Josh W. Comeau / css, frontend / 15 min read
Why AI Sucks at Front End: AI design is trained on ancient solutions and unoriginal UI patterns - Adam Argyle's rant on why AI still can't do frontend well by Adam Argyle / ai, frontend / 14 min read
30 WordPress Plugins Backdoored After Acquisition: A buyer purchased 30 plugins of varying popularity and planted a backdoor in all of them - a supply chain attack via legitimate ownership by anchor.host / security / 10 min read
Things You Didn't Know About Indexes: Composite index order, partial indexes, functional indexes, and EXPLAIN - a practical deep dive on where indexes help and where they hurt by Jonathan Chart / database, engineering / 12 min read
Cal.com Goes Closed Source After 5 Years: AI can now rapidly find and exploit open-source vulnerabilities - Cal.com closes its main repo while releasing Cal.diy under MIT for hobbyists by Cal.com / open-source, engineering / 19 min read
What We Learned Building a Rust Runtime for TypeScript: Encore's experience replacing the Node.js runtime with a custom Rust-based one for TypeScript - tradeoffs, surprises, and lessons by Ivan Cernja / engineering, typescript / 18 min read
The Vertical Codebase: Stop splitting code by technical type (components, hooks, utils) - group by functionality instead so everything in a domain lives together regardless of type by TkDodo / engineering / 11 min read
Probabilistic Engineering and the 24-7 Employee: The shift from deterministic to probabilistic engineering - code generated by stochastic systems, reviewed under time pressure, assembled into wholes no single human ever designed end-to-end by Tim Davis / engineering, ai / 22 min read
Design and Engineering, as One: Most teams still use an 1898 industrial model that separates design from engineering - a case for deeper integration beyond better handoff processes by Matthias Ott / design, engineering / 30 min read
Cloudflare Email Service: Now in public beta. Ready for your agents by Thomas Gauvin, Eric Falcão / emails, cloudflare / 13 min read

🧰 Tools

Multica: Open-source platform integrating AI coding agents into dev teams as autonomous teammates - they claim tasks, write code, and report progress via a Go-based local daemon by multica.ai / ai, tools, github
Letta Code: Memory-first coding harness for long-lived AI agents that persist across sessions and accumulate skills like a permanent teammate by docs.letta.com/letta-code / ai, tools, github
GitHub Stacked PRs: Native stacked PR workflow - break large changes into small reviewable pull requests and merge the whole stack in one click, with AI agent integration by GitHub / git, github, tools
Delphitools: 40+ simple online tools with no logins or tracking - SVG optimizer, Tailwind shade generator, background remover, palette generator, and more by Ruby Morgan Voigt / tools
Magika: Google's AI-powered file type detection that identifies 200+ content types using a lightweight deep learning model - used internally for user safety by Google / ai, tools, github
Pompelmi 1.0: Antivirus File Scanning from Node: ClamAV wrapper for scanning malicious uploads in Node apps - standalone, no daemon required, spawns ClamAV on-demand by pompelmi contributors / javascript, tools, security
Micro-ML: Forecasting and Clustering for Node: 56KB WASM-powered library with regression, smoothing, clustering, and classification - no TensorFlow.js needed by Adam Perliński / javascript, tools, github
Hyperframes: Open-source HTML-based video rendering framework with first-class AI agent support - non-interactive CLI for agent-driven workflows, renders to MP4 locally or in Docker by HeyGen / tools, ai, github
Typescale AI: Typography scale and design token generator - creates consistent text hierarchies from H1 to H6 and body text with design token output by typescale.ai / design, tools
Animata: ~200 animation-focused React components built with Tailwind CSS - animated beams, spreading cards, glitching text, Slack-style hero screen by Codse / react, tools
Marky: A lightweight easy to use markdown viewer by Garrett Graves / markdown

🤪 Fun

100 Jumps: Jump without missing - a small physics-based browser game by boredzebra.com / fun, game / 1 min read
Chess in Pure SQL: A fully playable chess game rendered and run entirely with SELECT and UPDATE statements - no app server, no JavaScript, just SQL by dbpro.app / fun, sql / 5 min read
Slitscanner: Upload an image, set scan settings, move it around - creates slit-scan photography distortion art, neat for background images by Matt Soria / fun, art / 3 min read

Want to read more? Check out the full article here.

To sign up for the weekly newsletter, visit weeklyfoo.com.