DEV Community: Adam

Tiny Models, One-Tool Agents, and a Week-Old Install Policy

Adam — Fri, 13 Nov 2026 15:08:45 +0000

Signup here for the newsletter to get the weekly digest right into your inbox.

Find the 15 highlighted links of weeklyfoo #162:

Why and how to port your entire codebase to Rust

by Ryan Peterman

Microsoft Distinguished Engineer Stephen Toub on rewriting the 400,000-line GitHub Copilot runtime in Rust with agents, rollout strategy and catching regressions

🚀 Read it!, rust, ai, rewrites

Frontier quality at 1% of the cost

by Airbnb Engineering

Airbnb fine-tuned a 2B-parameter model to match frontier models on a production policy classifier at 35 ms median latency

📰 Good to know, ai, llm, performance

Inside GitHub's new Git storage architecture

by GitHub Blog

Rubicon separates immutable Git objects in blob storage from a replicated reference log so compute and storage scale independently

📰 Good to know, git, architecture, ai

Design systems should be fast by default

by Den Odell

Timing ten design systems on a 249-option dropdown and 100 checkboxes, tracing slow paths and adding Playwright performance budgets per PR

📰 Good to know, performance, design-systems, testing

Nothing installs at our company until it's a week old

by Bruno J

A company-wide registry proxy delays new npm and PyPI releases by seven days so malicious versions get caught first

📰 Good to know, security, npm, supply-chain

Cross-request KV cache exposure in Workers AI

by Cloudflare

155 GLM-5.3 responses exposed other customers' data after a KV cache capacity mismatch met an SGLang error-handling bug

📰 Good to know, security, ai, postmortem

Why agents are soon only going to have 1 tool

by Philipp Schmid

Agents collapse their tool catalog into one exec tool so models write short scripts that chain dependent actions in a sandbox

📰 Good to know, ai, agents

Why is this fingerprinting script creating bioweapons

by Veritas

A canvas fingerprinting script names identifiers after taboo topics and hides a prompt in invisible Unicode so LLMs refuse to analyze it

📰 Good to know, security, javascript

Polymarket's CSP allowed a third-party script swap to drain wallets

by Scott Helme

A script URL that stayed the same but changed payload got past CSP, and what would have stopped it.

📰 Good to know, security, csp, third-party-scripts

Parcel 3 alpha, a Rust rewrite

by Parcel team

Parcel rewritten in Rust as a single small binary with no Node dependency and up to 100x faster cold builds

📰 Good to know, bundlers, rust, performance

OmniDiff

by ivankovic

Content-aware diffs for code, images, fonts, archives and PDFs with a TUI viewer, Git integration and JSON output for CI

🧰 Tools, cli, git, tooling

djs

by Armin Ronacher

JavaScript engine in Rust for agent scripts in WebAssembly, VM state snapshots resume elsewhere even mid-await

🧰 Tools, javascript, wasm, agents

Melange

by Melange

Compiles OpenFGA authorization models into PL/pgSQL so a permission check is a SELECT, with no separate service.

🧰 Tools, postgres, security, authorization

Reticle

by Reticle Labs

Dev-only SDK and MCP server that lets coding agents drive your running app and return a pass, fail or cannot-tell verdict

🧰 Tools, ai, agents, testing, mcp

devvm

by devvm

Runs coding agents in a VM with only the project folder mounted and network traffic going through an allowlist proxy

🧰 Tools, ai, agents, security, sandboxing

Want to read more? Check out the full article here.

To sign up for the weekly newsletter, visit weeklyfoo.com.

Stay ahead in web development: latest news, tools, and insights #162

Adam — Mon, 09 Nov 2026 06:40:12 +0000

Signup here for the newsletter to get the weekly digest right into your inbox.

weeklyfoo #162 is here: your weekly digest of all webdev news you need to know! This time you'll find 38 valuable links in 5 categories! Enjoy!

🚀 Read it!

Why and how to port your entire codebase to Rust: Microsoft Distinguished Engineer Stephen Toub on rewriting the 400,000-line GitHub Copilot runtime in Rust with agents, rollout strategy and catching regressions by Ryan Peterman / rust, ai, rewrites / 65 min read

📰 Good to know

Frontier quality at 1% of the cost: Airbnb fine-tuned a 2B-parameter model to match frontier models on a production policy classifier at 35 ms median latency by Airbnb Engineering / ai, llm, performance / 9 min read
Inside GitHub's new Git storage architecture: Rubicon separates immutable Git objects in blob storage from a replicated reference log so compute and storage scale independently by GitHub Blog / git, architecture, ai / 29 min read
Design systems should be fast by default: Timing ten design systems on a 249-option dropdown and 100 checkboxes, tracing slow paths and adding Playwright performance budgets per PR by Den Odell / performance, design-systems, testing / 26 min read
Two circles, one connection, and border-shape: Anchor positioning, border-shape and shape() draw curved connectors that follow two moving elements by master.dev / css / 15 min read
The age of frivolous software: A personal World Cup dashboard built in hours with coding agents grew to 50,000 users, a case for short-lived personal software by Ian McCrystal / ai, agents, side-projects / 6 min read
Nothing installs at our company until it's a week old: A company-wide registry proxy delays new npm and PyPI releases by seven days so malicious versions get caught first by Bruno J / security, npm, supply-chain / 11 min read
Fixing tool-call accuracy in vLLM: Constrained decoding raised schema-valid tool calls from 92% to 100% for Kimi and DeepSeek models by Ubicloud / ai, llm, inference / 14 min read
Cross-request KV cache exposure in Workers AI: 155 GLM-5.3 responses exposed other customers' data after a KV cache capacity mismatch met an SGLang error-handling bug by Cloudflare / security, ai, postmortem / 36 min read
Why agents are soon only going to have 1 tool: Agents collapse their tool catalog into one exec tool so models write short scripts that chain dependent actions in a sandbox by Philipp Schmid / ai, agents / 10 min read
How software engineering is changing, a tale of two eras: Neil Kakkar's essay on going from 8-20 to 200+ merged PRs a month with AI agents, and which constraints broke along the way by Neil Kakkar / AI, devex, workflow / 32 min read
Scaling Git at OpenAI: Pando, a Git-compatible backend, cut median push latency by nearly 80% by handling pushes to unrelated branches independently by OpenAI / git, infrastructure, ai / 1 min read
Why is this fingerprinting script creating bioweapons: A canvas fingerprinting script names identifiers after taboo topics and hides a prompt in invisible Unicode so LLMs refuse to analyze it by Veritas / security, javascript / 9 min read
Shrinking Clarity.js, when cleaner code gzips worse: An agent ran 50+ size experiments, dropping import namespace objects won big while helper extraction grew gzipped output by Manu Nair / javascript, performance / 8 min read
Polymarket's CSP allowed a third-party script swap to drain wallets: A script URL that stayed the same but changed payload got past CSP, and what would have stopped it. by Scott Helme / security, csp, third-party-scripts / 13 min read
Ladybird adds a JavaScript JIT: Ladybird now compiles hot JavaScript to machine code on x86-64 and AArch64 using speculative optimization driven by runtime type profiling by Ladybird Newsletter / javascript, engine, performance, browsers / 8 min read
Parcel 3 alpha, a Rust rewrite: Parcel rewritten in Rust as a single small binary with no Node dependency and up to 100x faster cold builds by Parcel team / bundlers, rust, performance / 10 min read
Discord is ditching Electron and React Native for a Rust rewrite: A Rust desktop client built on GPUI uses 290MB of RAM while mobile keeps native UI over shared Rust code by Tom Warren (The Verge) / rust, react-native, electron / 10 min read

🧰 Tools

Firenook: A faster drop-in for the Firebase emulators: A faster drop-in replacement for the Firebase emulators by Firenook / firebase, tooling, databases
File Viewer: Browser-based previewer for more than 275 file formats with no conversion server and Vue, React and Svelte integrations by flyfish-dev / tools, javascript
OmniDiff: Content-aware diffs for code, images, fonts, archives and PDFs with a TUI viewer, Git integration and JSON output for CI by ivankovic / cli, git, tooling
nodeterm: Persistent tmux terminals and coding agents as draggable nodes on an infinite canvas, with a kanban view of sessions by Enes Kirca / terminal, agents, tooling
Type Server Protocol: JSON-RPC protocol exposing Python type queries, import resolution and snapshot-based analysis state using LSP conventions by Microsoft / python, tooling
djs: JavaScript engine in Rust for agent scripts in WebAssembly, VM state snapshots resume elsewhere even mid-await by Armin Ronacher / javascript, wasm, agents
Melange: Compiles OpenFGA authorization models into PL/pgSQL so a permission check is a SELECT, with no separate service. by Melange / postgres, security, authorization
Postgres.js 4.0: A ground-up rewrite of the Postgres client adds a scheduler so fast queries stop waiting behind slow ones plus AbortSignal support by Rasmus Porsager / databases, postgres, nodejs
Vitest 5.1: An experimental since-last-run flag reruns only the tests your last change affected by Vitest Team / testing, vitest, tools
Load testing with Koi Pond: Slack built a Go tool that runs slimmed down Slack clients to load test 500,000 WebSocket connections far more cheaply than headless Chrome by Slack Engineering / performance, testing, websockets
Slab: Headless web components that handle keyboard, focus, ARIA and forms on native elements by Slab / web-components, accessibility, frontend
HTML-in-Canvas API: Render real accessible DOM elements inside a canvas, shipping in Chrome 157 by Chrome team / css, web-platform, canvas
Skullet: Renders your real component invisibly with sample data and draws a matching skeleton to reduce layout shift by Lochie Axon / react, ui, performance
Reticle: Dev-only SDK and MCP server that lets coding agents drive your running app and return a pass, fail or cannot-tell verdict by Reticle Labs / ai, agents, testing, mcp
devvm: Runs coding agents in a VM with only the project folder mounted and network traffic going through an allowlist proxy by devvm / ai, agents, security, sandboxing

🤪 Fun

Jailbreaking my car's navigation system just so I can change the time: A daylight-saving fix turned into firmware reverse engineering with QEMU and a core-dump code execution trick by nns / hacking, reverse-engineering / 13 min read
Could a modern chess engine on a Pentium have defeated Kasparov in 1996: Stockfish on a 200 MHz Pentium Pro reaches a measured rating of 3180 and you can play it online by Nicholas Carlini / chess, retro / 17 min read

📺 Videos

Slow down to speed up: How companies that start from business outcomes and slow their AI rollouts hold quality steady by Gergely Orosz / ai, engineering, leadership
Linus Torvalds in conversation with Dirk Hohndel: 35 years of Linux, rewriting contributed patches, adopting Git and moving to five-week releases by Linus Torvalds / linux, git, open-source
Developer tooling in the agentic era: Verification as a first-class interface and where Vite, Oxc, Rolldown and Vitest are heading by Evan You / vite, tooling, ai

Want to read more? Check out the full article here.

To sign up for the weekly newsletter, visit weeklyfoo.com.

Smaller Payloads, Runaway Agents, and TypeScript Compiling Itself

Adam — Fri, 06 Nov 2026 14:49:47 +0000

Signup here for the newsletter to get the weekly digest right into your inbox.

Find the 12 highlighted links of weeklyfoo #161:

Building an isolated preview for AI-generated HTML

by Keshav Malik

A srcdoc iframe runs model-written HTML on your own origin, so a security engineer breaks the naive approach and rebuilds it with sandbox and a strict CSP

🚀 Read it!, security, ai, html

Shipping 103,802 dots in 82 KB

by Layers

Quantized coordinates split into streams that expose repeated rows to Brotli, 63% smaller than compressing raw floats, plus a render loop that sleeps when idle

📰 Good to know, performance, compression, javascript

How the Claude Code team does code review

by Anthropic

Merged PRs more than doubled while reverts fell over 40%, by moving most reading to machines, scaling human approval by risk and making rollback fast

📰 Good to know, ai, code-review, agents

Investigating a curious case of font format fallbacks

by Paul Calvano

A font loaded three times as WOFF2, WOFF and TTF, traced through browser errors into Chromium source

📰 Good to know, performance, fonts, web

How a read replica almost took down its primary database

by Photoroom

A lagging BI replica made the primary hold 31.7 TB of WAL while auto-growing disks crept toward a hard limit

📰 Good to know, postgres, postmortem, databases

The AI cost of JavaScript frameworks

by Nolan Lawson

Opus 5.5 builds the same app across frameworks over repeated runs, measuring cost, time, spec compliance, performance and accessibility, with Hono plus htmx, Astro and Nuxt among the cheapest

📰 Good to know, ai, javascript, frameworks

Our AI agent executed the same successful SQL query 254 times

by Funnel

A model swap made a data agent loop instead of finishing, a case for whole-system evals, explicit tool contracts and bounds on repeated behavior

📰 Good to know, ai, agents, evals

Rapier JXL

by jackskip22

Dependency-free JPEG XL encoder in JavaScript, about 30 KB gzipped, with WebGPU quality search, lossless, HDR and JPEG transcoding

🧰 Tools, images, javascript, webgpu

Structs

by Erik Arvidsson

Usable implementation of the Stage 2 TC39 shared structs proposal, so workers can share objects instead of serializing copies

🧰 Tools, javascript, concurrency

pgvolvra

by pgEdge

Trigger-based row history to preview and undo bad updates, deletes or migrations by transaction ID, no superuser needed

🧰 Tools, postgres, databases

tstst

by zzj3720

A TypeScript compiler running inside the TypeScript type system

🤪 Fun, typescript, experiments

Software engineering at Google and CS education with Titus Winters

by Gergely Orosz

Refactoring 250M lines of C++, why Google made testing mandatory, readability reviews and why the CS curriculum needs burning down

📺 Videos, engineering, education, podcast

Want to read more? Check out the full article here.

To sign up for the weekly newsletter, visit weeklyfoo.com.

Stay ahead in web development: latest news, tools, and insights #161

Adam — Mon, 02 Nov 2026 06:14:54 +0000

Signup here for the newsletter to get the weekly digest right into your inbox.

weeklyfoo #161 is here: your weekly digest of all webdev news you need to know! This time you'll find 41 valuable links in 5 categories! Enjoy!

🚀 Read it!

Building an isolated preview for AI-generated HTML: A srcdoc iframe runs model-written HTML on your own origin, so a security engineer breaks the naive approach and rebuilds it with sandbox and a strict CSP by Keshav Malik / security, ai, html / 14 min read

📰 Good to know

Shipping 103,802 dots in 82 KB: Quantized coordinates split into streams that expose repeated rows to Brotli, 63% smaller than compressing raw floats, plus a render loop that sleeps when idle by Layers / performance, compression, javascript / 1 min read
Planning with agents: Divided worlds, boundary objects and thicker interfaces for planning work that agents carry out while you are away by Maggie Appleton / ai, agents, planning / 24 min read
How the Claude Code team does code review: Merged PRs more than doubled while reverts fell over 40%, by moving most reading to machines, scaling human approval by risk and making rollback fast by Anthropic / ai, code-review, agents / 21 min read
A first look at TypeScript 7.1's content mappers: Content mappers turn non-TS files into virtual TypeScript, shown with CSS modules and .graphql files by Jovi De Croock / typescript, tooling / 5 min read
Parser combinators in TypeScript, built from scratch: Animated step-by-step walkthrough of the building blocks, ending with ping output parsed into typed objects by Florian Schindler / typescript, parsing / 18 min read
How engines turn dynamic objects into fast field access: Shapes and inline caches explained with runnable sketches by Max Bernstein / javascript, performance, compilers / 16 min read
Node2Shell, RCE on stock Node.js builds: The Brotli decoder flaw fixed in the latest Node security releases is now exploited in the wild, and bundled Brotli copies elsewhere need patching too by ELLIO / security, nodejs / 28 min read
Python and Postgres don't agree on what CET means: Four timezone names silently differ by an hour in summer, fixed with one curated list and tests that compare both systems by Mergify / python, postgres, timezones / 12 min read
The first search engine with fully vectorized query execution: turbopuffer v3 adopts the execution architecture of analytical databases by turbopuffer / databases, search, performance / 17 min read
Investigating a curious case of font format fallbacks: A font loaded three times as WOFF2, WOFF and TTF, traced through browser errors into Chromium source by Paul Calvano / performance, fonts, web / 9 min read
How a read replica almost took down its primary database: A lagging BI replica made the primary hold 31.7 TB of WAL while auto-growing disks crept toward a hard limit by Photoroom / postgres, postmortem, databases / 15 min read
The AI cost of JavaScript frameworks: Opus 5.5 builds the same app across frameworks over repeated runs, measuring cost, time, spec compliance, performance and accessibility, with Hono plus htmx, Astro and Nuxt among the cheapest by Nolan Lawson / ai, javascript, frameworks / 21 min read
Our AI agent executed the same successful SQL query 254 times: A model swap made a data agent loop instead of finishing, a case for whole-system evals, explicit tool contracts and bounds on repeated behavior by Funnel / ai, agents, evals / 3 min read
The case of the 9 bit AES key: Insecure randomness in PDF encryption allows decrypting protected PDFs without the password by v12 / security, cryptography / 8 min read
A select should tell you something: Customizable selects can show fonts in their typeface, local times, aligned prices or job titles, while progressively enhancing the native control by Ahmad Alfy / css, html, ux / 7 min read
GitHub Actions workflow lockfiles are generally available: Pin actions and their transitive dependencies in participating workflows by GitHub / github, ci, security / 4 min read
React.lazy, Suspense and the hidden 300ms startup delay: A lazy component can suspend even when its code is loaded and React throttles reveals to every 300ms, how one team traced and fixed it by Matthew Wong / react, performance / 16 min read
TanStack DB 1.0 RC1 and how oracles found its bugs: The reactive client data layer is API stable, and agents checked against simple reference models found many of the fixed bugs by Kyle Mathews / javascript, testing, ai / 24 min read

🧰 Tools

Rapier JXL: Dependency-free JPEG XL encoder in JavaScript, about 30 KB gzipped, with WebGPU quality search, lossless, HDR and JPEG transcoding by jackskip22 / images, javascript, webgpu
TanStack Redact: Build plugin that swaps React and React DOM for a smaller synchronous reimplementation, with reported 20-70% smaller client builds by TanStack / react, performance
Structs: Usable implementation of the Stage 2 TC39 shared structs proposal, so workers can share objects instead of serializing copies by Erik Arvidsson / javascript, concurrency
Biome 2.6: Adds formatting for Markdown, YAML and SCSS, plus JavaScript plugins for custom lint rules as a preview by Biome / tooling, linting
webframe: Run browser-dependent scripts from the command line by Jeff Lindsay / cli, browser
Verdaccio 7.0: Self-hosted npm registry and proxy adds staged publishing, 2FA and stricter ownership checks by Verdaccio / npm, security, registry
Ghostty 1.4: Complete Kitty graphics support, security fixes, faster terminal I/O and scrollback compression that cuts memory use by 70-90% by Ghostty / terminal, tools
Expo Agent CLI: Experimental CLI that helps agents pick the right build, launch an app and smoke-test it, with structured output and runtime inspection by Expo / ai, agents, react-native
Accessible components library: Accessible components with working examples, code, guidance and the test scenarios to check them by TetraLogical / accessibility, components, frontend
browser-whisper 2.0: Runs Whisper, Moonshine and other speech models in the browser over WebGPU with WASM fallback, timestamps and live mic input by Tanpreet Singh Jolly / ai, webgpu, audio
pgvolvra: Trigger-based row history to preview and undo bad updates, deletes or migrations by transaction ID, no superuser needed by pgEdge / postgres, databases
mcdview: Turns a Postgres, Prisma, pgModeler or Rails schema into a searchable, shareable interactive ER diagram by Gheop / postgres, diagrams
Bundle: Freeze a Node app and its dependency tree into a signed ZIP that Node 26's virtual file system runs directly, no npm install by Philipp Dunkel / nodejs, packaging
sqlite-js-stream: Litestream ported to TypeScript on node sqlite by an AI agent, streaming the SQLite WAL to S3 by Matteo Collina / sqlite, nodejs, ai
html: HTML parser 3-6x faster than other JavaScript parsers, with source offsets and CSS selectors by Luke Edwards / javascript, html, parsing
vinext 1.4: Vite-based Next.js reimplementation now uses 43% less server CPU per request in its HN clone benchmark by James Anderson / nextjs, vite, performance
OpenTUI 0.8: Terminal UI library with React bindings behind OpenCode now repaints only what changed by Anomaly / terminal, react, tui

🤪 Fun

Reverse engineering a Beyblade launch tracker: Bluetooth teardown from hardware inspection to captured payloads to decoding how the accessory reports launches by Simone / reverse-engineering, bluetooth, hardware / 20 min read
tstst: A TypeScript compiler running inside the TypeScript type system by zzj3720 / typescript, experiments / 8 min read

📺 Videos

Brian Kernighan on Bell Labs and why C won: Interview at Princeton about life at Bell Labs, the people he worked with, Unix and the origins of Hello World by Ryan Peterman / history, c, unix
Design and engineering are the same thing: Opening lecture for the Dyson School of Engineering, 43 minutes of thoughts collected over the years by John Maeda / design, engineering
Software engineering at Google and CS education with Titus Winters: Refactoring 250M lines of C++, why Google made testing mandatory, readability reviews and why the CS curriculum needs burning down by Gergely Orosz / engineering, education, podcast

Want to read more? Check out the full article here.

To sign up for the weekly newsletter, visit weeklyfoo.com.

Leaner Sites, Cheaper Reviews, and Tetris Becomes Snake

Adam — Fri, 30 Oct 2026 13:52:44 +0000

Signup here for the newsletter to get the weekly digest right into your inbox.

Find the 9 highlighted links of weeklyfoo #160:

How D1 scales to millions of databases

by Cloudflare

Scaling the D1 control plane for millions of SQLite databases without routing every query through a central bottleneck

📰 Good to know, cloudflare, databases, scale

Cutting our inference bill by 68%

by Cloudflare

Cloudflare dropped average AI code review cost from $2.43 to $0.77, mostly by ordering messages so first requests actually hit the prompt cache

📰 Good to know, ai, llm, cost

Building Laminar, Ramp's managed agents platform

by Ramp

A model-agnostic agent harness on Postgres, Temporal and S3 with session state independent of disposable sandboxes, async steering, subagents and shared tracing

📰 Good to know, ai, agents, architecture

React only where needed, moving from Next.js to Astro

by Owner

10,000+ restaurant sites moved to Astro and Cloudflare Workers with React islands, menu-page p75 LCP went from 5.4s to 0.7s

📰 Good to know, performance, astro, react

php2shell, how the PHP RCE works

by Wiz

A multipart POST exhausts memory mid-parse, then the shutdown cleanup follows a planted pointer and runs the attacker's payload, regardless of the app on top

📰 Good to know, security, php

PGX

by PGRun

Hosts thousands of isolated throwaway Postgres databases in one process, cloned from a template in milliseconds, for agent sandboxes and per-PR tests

🧰 Tools, postgres, testing, ai

env.style

by Ryan George

Wraps your Next.js or Vite config to tint the favicon per environment so you see at a glance where you are

🧰 Tools, dx, nextjs, vite

The Tetris script that becomes Snake once prettified

by Robert Vähhi

Chaining semantic quirks in pretty-printers and deobfuscators turns the cleaned-up output into a different program

🤪 Fun, javascript, security, fun

What happens when AI writes your C++ code?

by Greg Law, Mark Williamson

Benchmarking how well LLMs debug a half-million line C++ codebase, where they still lag at debugging versus writing

📺 Videos, ai, cpp, debugging

Want to read more? Check out the full article here.

To sign up for the weekly newsletter, visit weeklyfoo.com.

Stay ahead in web development: latest news, tools, and insights #160

Adam — Mon, 26 Oct 2026 04:56:02 +0000

Signup here for the newsletter to get the weekly digest right into your inbox.

weeklyfoo #160 is here: your weekly digest of all webdev news you need to know! This time you'll find 40 valuable links in 5 categories! Enjoy!

🚀 Read it!

Building a linearizable log on READ COMMITTED: Predicate locks sank their Postgres-backed metadata store, so Materialize dropped SERIALIZABLE for 3x write throughput and proved the design in Lean by Petros Angelatos / postgres, distributed-systems, formal-methods / 26 min read

📰 Good to know

Claude reveals ECDSA curve origins: A Claude research model traced the seeds of five NIST prime curves to lrand48 seeded with Unix timestamps, solving a decades-old provenance mystery without revealing a break by Anthropic / security, cryptography, ai / 16 min read
How D1 scales to millions of databases: Scaling the D1 control plane for millions of SQLite databases without routing every query through a central bottleneck by Cloudflare / cloudflare, databases, scale / 42 min read
Cutting our inference bill by 68%: Cloudflare dropped average AI code review cost from $2.43 to $0.77, mostly by ordering messages so first requests actually hit the prompt cache by Cloudflare / ai, llm, cost / 34 min read
When retries make things worse: One retry owner, operation deadlines, admission limits, shared retry budgets and jitter keep a slow dependency from becoming an outage by Wendell Adriel / reliability, backend, distributed-systems / 18 min read
tsrs, a Rust port of TypeScript: Cloudflare and VoidZero port the Go-based TypeScript 7 compiler to Rust, claim up to 8x faster checks, run it in WebAssembly and plan to fold it into Oxc by Cloudflare / typescript, rust, tooling / 23 min read
Announcing TypeScript 7.1 Beta: The native compiler gets 1.2 to 1.9x faster and uses 15 to 50% less memory than 7.0 by Microsoft / typescript, release / 27 min read
Next.js security update: Two critical RCE flaws, one in use cache functions via React Server Components and one in SVG image optimization, with a public PoC already out by Vercel / security, nextjs, react / 3 min read
JPEG XL vs AVIF: With Firefox 158 every major browser supports JPEG XL, so Jake compares it in depth against AVIF by Jake Archibald / images, performance, web / 69 min read
Building Laminar, Ramp's managed agents platform: A model-agnostic agent harness on Postgres, Temporal and S3 with session state independent of disposable sandboxes, async steering, subagents and shared tracing by Ramp / ai, agents, architecture / 1 min read
Postgres 19, what changed and what to test now: With RC1 out, a walkthrough of REPACK CONCURRENTLY, pg_plan_advice, parallel autovacuum and logical replication sequence sync, each with a test checklist by Tom Kincaid / postgres, databases, release / 13 min read
Postgres recovery_prefetch considered harmful: On by default since Postgres 15, it can overwhelm standby storage after a write burst and, with synchronous replication, block primary writes for 35 minutes by Jeremy Schneider / postgres, reliability, replication / 10 min read
Railway security disclosure: Possible unauthorized access to customer environment variables, rotate stored secrets and private registry credentials by Railway / security, devops / 3 min read
LLMs make formal software verification feasible at scale: Claude produced machine-checked proofs for 239 fuzz-test entry points across 123 open-source libraries by Anthropic / ai, security, verification / 22 min read
React only where needed, moving from Next.js to Astro: 10,000+ restaurant sites moved to Astro and Cloudflare Workers with React islands, menu-page p75 LCP went from 5.4s to 0.7s by Owner / performance, astro, react / 11 min read
php2shell, how the PHP RCE works: A multipart POST exhausts memory mid-parse, then the shutdown cleanup follows a planted pointer and runs the attacker's payload, regardless of the app on top by Wiz / security, php / 15 min read
Node.js October 2026 security releases: Patches include a high-severity CVE in the Brotli decoder, update your runtimes by Node.js / security, nodejs / 10 min read
Sprites Block Device: Fly.io replaced the Sprites filesystem with a simpler block storage layer, checkpoints now have one source of truth and restore as fast as a restart by Fly.io / storage, infrastructure / 9 min read

🧰 Tools

Sphinx: Pauses pushes to protected branches and quizzes you on what agent-written code does, with a separate reviewer reading the diff by Sphinx / ai, agents, code-review
Mac.apk: Runs Android apps as native macOS processes on Apple Silicon with their own windows and GPU rendering, alpha by kksimp / macos, android, tools
Pele: Zero-dependency Mermaid renderer to SVG with CSS variable theming and support for every Mermaid 12.1 diagram type by Pele / diagrams, svg, javascript
ExcaliClaw: Collaborative workspace for hand-drawn diagrams, usable from Claude, Cursor and VS Code through MCP by ExcaliClaw / diagrams, mcp, ai
Chartist 2.0: The lightweight CSS-styled SVG charting library returns with a composable API, SSR to SVG and terminal charts at about 12KB gzipped by Gion Kunz / charts, svg, javascript
Maplair: Batteries-included, tree-shakeable fork of Leaflet with rotation, fullscreen, search and heatmaps by Simon Legner / maps, javascript, library
rich-input: Web component for GitHub-style search boxes mixing free text with autocompleted key-value filters by Bramus Van Damme / web-components, ui, javascript
DocumentDB 1.0: MongoDB-compatible document database built as Postgres extensions plus a gateway, now a Linux Foundation project with packages for Postgres 17 and 18 by DocumentDB / postgres, mongodb, databases
PGX: Hosts thousands of isolated throwaway Postgres databases in one process, cloned from a template in milliseconds, for agent sandboxes and per-PR tests by PGRun / postgres, testing, ai
Scroll-triggered animations debugger: DevTools pane that draws activation and active ranges on a minimap, shows live status and lets you edit ranges in place by Bramus Van Damme / css, devtools, animation
POUR: Free accessibility checker and WCAG audit tool as browser extension or bookmarklet, with violations grouped by severity by David Yarham / accessibility, a11y, tools
TanStack AI 1.0: 76 packages reach stable APIs for chat, tools, media, MCP, persistence and sandboxes, provider and framework agnostic by TanStack / ai, typescript, library
Pixel: React renderer for terminal apps with rounded corners, gradients, real fonts and embedded Chromium webviews via the Kitty graphics protocol by Rob Pruzan / react, terminal, cli
env.style: Wraps your Next.js or Vite config to tint the favicon per environment so you see at a glance where you are by Ryan George / dx, nextjs, vite
Reylo: Import .sql files into TypeScript with full type inference by Colin McDonnell / typescript, sql, databases
dquickts: QuickJS fork that runs TypeScript natively with a durable execution engine by Stencil Labs / typescript, runtime
Motion scopeMotion: Motion 14.5 adds scopeMotion and useScopeMotion for cleanup, media query matching, default transitions and element scoping by Motion / animation, react

🤪 Fun

The Tetris script that becomes Snake once prettified: Chaining semantic quirks in pretty-printers and deobfuscators turns the cleaned-up output into a different program by Robert Vähhi / javascript, security, fun / 19 min read
Furifont: A Japanese font that draws its own furigana with OpenType features alone, no ruby markup or JavaScript by Anthony Fu / fonts, typography, opentype / 0 min read

📺 Videos

ViteConf 2026, the full replay: About 30 talks including Evan You's keynote on tooling in the agentic era, Vitest 5, Vite DevTools and a faster Oxc parser by ViteConf / vite, javascript, conference
What happens when AI writes your C++ code?: Benchmarking how well LLMs debug a half-million line C++ codebase, where they still lag at debugging versus writing by Greg Law, Mark Williamson / ai, cpp, debugging
Do we really need alpha()?: Three ways to lower a color's opacity in CSS and what the alpha function adds by Kevin Powell / css, colors, frontend

Want to read more? Check out the full article here.

To sign up for the weekly newsletter, visit weeklyfoo.com.

Read-Only Queries Write Terabytes, Microservices Head Home

Adam — Fri, 23 Oct 2026 12:27:00 +0000

Signup here for the newsletter to get the weekly digest right into your inbox.

Find the 9 highlighted links of weeklyfoo #159:

Speculative decoding, the art of guessing well

by astralord

Deep walkthrough of drafting several tokens cheaply and verifying them in one target-model pass, with acceptance and speedup formulas, EAGLE-3, multi-token prediction and diffusion drafters

📰 Good to know, ai, llm, performance

The dirty pages surprise, when a read-only query writes terabytes

by swingbit

A MonetDB count-distinct query saturates an NVMe drive because Linux flushes dirty pages from memory-mapped scratch files, and moving them to tmpfs cuts runtime from 73 minutes to 97 seconds

📰 Good to know, databases, linux, performance

Can we make React faster using the React Compiler?

by Jimmy Miller

In a 2,000-row microbenchmark inlining alone slows rendering from 444 ms to 1,038 ms by removing per-row caches, while adding block DOM updates cuts it to 164 ms

📰 Good to know, react, performance, compiler

How I found a $90,000 remote code execution vulnerability in Google

by Simon Koeck

Google's DevSite reused an OAuth secret from a readable Flask session cookie as the signing key, letting forged sessions reach unsafe pickle deserialization

📰 Good to know, security, bug-bounty

How savepoints throttled our Postgres queue

by Rory Malcolm

Adding workers to a Postgres-based queue made it slower because of per-job SAVEPOINTs, and claiming jobs with a lease fixed it

📰 Good to know, postgres, queues, performance

pg-delta

by Supabase

Supabase's open source schema diff engine that turns two Postgres databases into an ordered migration covering RLS policies, grants and domains

🧰 Tools, postgres, migrations, open-source

once

by alex0ptr

Caches command output so repeated runs return instantly

🧰 Tools, cli, caching

imapkit

by Postal Systems

Embeddable, scriptable IMAP server for testing email clients with in-memory mailboxes and scripted faults, driven from tests or a REST API

🧰 Tools, email, testing

Taming microservice overload, our journey to modular monoliths

by Mario Klaver

Five teams running 90+ microservices at the Port of Rotterdam use DDD and event storming to move back to modular monoliths

📺 Videos, architecture, microservices, devoxx

Want to read more? Check out the full article here.

To sign up for the weekly newsletter, visit weeklyfoo.com.

Stay ahead in web development: latest news, tools, and insights #159

Adam — Mon, 19 Oct 2026 05:04:47 +0000

Signup here for the newsletter to get the weekly digest right into your inbox.

weeklyfoo #159 is here: your weekly digest of all webdev news you need to know! This time you'll find 40 valuable links in 5 categories! Enjoy!

🚀 Read it!

How to effectively debug when you no longer understand the code: Three production investigations, a latency regression, a memory leak and a kernel-level hang, show how to steer coding agents through unfamiliar systems by separating facts from hypotheses and comparing failures with a control by Cindy Sridharan / ai, agents, debugging / 1 min read

📰 Good to know

Speculative decoding, the art of guessing well: Deep walkthrough of drafting several tokens cheaply and verifying them in one target-model pass, with acceptance and speedup formulas, EAGLE-3, multi-token prediction and diffusion drafters by astralord / ai, llm, performance / 66 min read
The dirty pages surprise, when a read-only query writes terabytes: A MonetDB count-distinct query saturates an NVMe drive because Linux flushes dirty pages from memory-mapped scratch files, and moving them to tmpfs cuts runtime from 73 minutes to 97 seconds by swingbit / databases, linux, performance / 11 min read
The first reduction in their history, 64-day Let's Encrypt certificates: Let's Encrypt starts issuing 64-day certificates on October 14 by Scott Helme / security, tls / 7 min read
Why WebMCP matters: Sites expose JavaScript tools to agents instead of being driven through screenshots and DOM inspection, with a Shopify checkout experiment running 2.7 times faster at 58% lower cost by Yoav Weiss / ai, agents, web / 10 min read
Can we make React faster using the React Compiler?: In a 2,000-row microbenchmark inlining alone slows rendering from 444 ms to 1,038 ms by removing per-row caches, while adding block DOM updates cuts it to 164 ms by Jimmy Miller / react, performance, compiler / 30 min read
How I found a $90,000 remote code execution vulnerability in Google: Google's DevSite reused an OAuth secret from a readable Flask session cookie as the signing key, letting forged sessions reach unsafe pickle deserialization by Simon Koeck / security, bug-bounty / 5 min read
Deno is joining Cloudflare: The Deno team folds celld into workerd so Durable Objects can be self-hosted, while the Deno runtime gets a final year of fixes, Deno Deploy closes in six months and JSR moves to Cloudflare by Ryan Dahl / deno, cloudflare, javascript / 5 min read
Bun 1.4.3 adds bun check, a built-in TypeScript type checker: A port of the TypeScript 7 checker that reads tsconfig.json, reports the same errors as tsc and runs 3-6x faster, plus much lower idle CPU usage by Jarred Sumner / bun, typescript / 70 min read
TanStack Start 1.0: The full-stack framework for React and Solid reaches its first stable release by TanStack / react, solid, framework / 24 min read
Responsive iframes: The new frame-sizing CSS property lets iframes size themselves to their content height, Chromium-only for now by Chrome for Developers / css, html, chrome / 15 min read
Redesigning source control at Anthropic: Anthropic replaced Git with Scion after daily merges grew from 2,500 to over 30,000, using server-side commits, sparse checkouts and layered caches to cut infrastructure footprint 200x and free 25% of CI CPU by Anthropic / git, infrastructure, monorepo / 22 min read
Rewinding the exponential, how we keep hardware usage down: Cloudflare's pipeline handles two billion events per second, and product-specific schemas, zstd, later replication, earlier sampling and aggregation deferred two and a half years of hardware growth by Cloudflare / data, performance, infrastructure / 30 min read
Are harnesses worth the cost?: Ten runs on a Java API service show a behavioral harness lifting a weaker model from three to ten successes at lower cost than a stronger unharnessed model, with caveats by Martin Fowler / ai, agents, engineering / 23 min read
Gemini 4 Argon: Google DeepMind's new flagship model for complex software engineering, research and robotics, with a one-million-token output window by Google DeepMind / ai, llm, google / 23 min read
How savepoints throttled our Postgres queue: Adding workers to a Postgres-based queue made it slower because of per-job SAVEPOINTs, and claiming jobs with a lease fixed it by Rory Malcolm / postgres, queues, performance / 18 min read
PgBouncer 1.26.1: Fixes three CVEs, the worst letting a client who knows one user's password log in as another user, even a superuser, with SCRAM auth by PgBouncer / postgres, security / 2 min read
Muse Spark Open: Meta's open-weight multimodal MoE model with 816B total and 42B active parameters and a one-million-token context, runnable on two M5 Ultra Mac Studios by Meta / ai, llm, open-weights / 4 min read

🧰 Tools

REA: Gives coding agents tools to reverse engineer native binaries, JavaScript and Electron applications and browser behavior by REA / ai, agents, reverse-engineering
OpenCode 2.0: Big update to the open coding agent with background subagents, a code mode that lets models script MCP tool calls, and JS and Effect clients to drive it by OpenCode / ai, agents, cli
Shaders: 190+ WebGPU effect components like ripples, glows and ASCII dissolves for React, Vue, Svelte, Solid or plain JS, now MIT licensed by Simon Le Marchant / webgpu, shaders, open-source
Tamagui 3: One React UI codebase for web and native, now with Tailwind-style props and React Strict DOM support by Nate Wienert / react, react-native, ui
Partytown 1.0: Relocates third-party scripts into a Web Worker instead of the main thread, now out of beta after five years by Builder.io / performance, javascript
AI Policy: Community collection of ready-made contribution policies for open source projects, from welcoming AI contributions to human-only by ai-policy.dev / ai, open-source
Bifrost: Open-source AI gateway with an OpenAI-compatible API, provider failover, load balancing, semantic caching, virtual keys, budgets and MCP support by Maxim / ai, gateway, open-source
CSS Text Effects: 114 animated text effects in pure CSS, from aurora gradients and glitches to split-flap boards and liquid fills, no JavaScript by Colorion / css, animation, typography
pg-delta: Supabase's open source schema diff engine that turns two Postgres databases into an ordered migration covering RLS policies, grants and domains by Supabase / postgres, migrations, open-source
pg_disorder: Postgres extension that shuffles results of SELECTs without ORDER BY to surface ordering bugs in tests by viralpraxis / postgres, testing
reseter.css 3.0: Major rework of the modern CSS reset, full and mini variants wrapped in a reset cascade layer, logical properties throughout and about 1KB compressed by Krish Gupta / css, reset
once: Caches command output so repeated runs return instantly by alex0ptr / cli, caching
imapkit: Embeddable, scriptable IMAP server for testing email clients with in-memory mailboxes and scripted faults, driven from tests or a REST API by Postal Systems / email, testing
caniname: CLI tool to check project name availability on npm, Netlify and more by Bramus van Damme / cli, npm
p-queue 10: Promise queue with concurrency control and rate limiting, now zero dependencies, an EventTarget and AsyncLocalStorage aware by Sindre Sorhus / javascript, nodejs, async
Void: Open-source deployment platform, SDK and CLI that brings full-stack development and Cloudflare deployment into a Vite workflow, inferring bindings and provisioning infrastructure by Cloudflare / cloudflare, vite, deployment
SPACE: Perplexity open-sources the sandbox platform behind Computer as a foundation for safer agent systems by Perplexity / ai, agents, sandbox

🤪 Fun

The Restroom Archive: An ongoing repository of 3D-scanned publicly accessible restrooms, 193 so far in 85 cities across 13 countries by Restroom Archive / fun, 3d / 11 min read
Handwired: turn your regular JavaScript code into a neural net: No training, exact yet fully differentiable, and runnable in a browser without a GPU by Cheng Lou / fun, javascript, ai / 1 min read

📺 Videos

Taming microservice overload, our journey to modular monoliths: Five teams running 90+ microservices at the Port of Rotterdam use DDD and event storming to move back to modular monoliths by Mario Klaver / architecture, microservices, devoxx
Structured concurrency looms: Oracle architects explain the design of Project Loom's structured concurrency, treating related tasks as one unit of work for simpler cancellation and errors by Alan Bateman, Viktor Klang / java, concurrency, devoxx
NodeConf EU 2026 talks: All talks from NodeConf EU 2026, covering Node's new FFI, Emscripten and WebAssembly, V8 heap management and performance profiling by NodeConf EU / nodejs, conference, performance

Want to read more? Check out the full article here.

To sign up for the weekly newsletter, visit weeklyfoo.com.

Agents Say Done, Databases Ask for the Receipts

Adam — Fri, 16 Oct 2026 06:52:09 +0000

Signup here for the newsletter to get the weekly digest right into your inbox.

Find the 10 highlighted links of weeklyfoo #158:

Ephemeral testing

by Daniel Lemire

Test a software component by having an agent build disposable applications on top of it, exposing hidden state, unstable invariants, surprising defaults and weak documentation

📰 Good to know, ai, testing

Capturing and replaying real database workloads at Airbnb

by Airbnb

Airbnb captures MySQL traffic at ProxySQL, rebuilds transaction order offline and replays production workloads for load testing, migration checks and the move from MySQL 5.7 to 8.0

📰 Good to know, databases, mysql, testing

The agent said it was done. The database disagreed

by Microsoft

ThinkingBox evaluates agents by the backend state they leave behind across 507 workflows, where 67% of 79,853 failed runs ended without a tool error

📰 Good to know, ai, agents, evals

A terminal protocol for program status (OSC 7501)

by Mitchell Hashimoto

Spec for an escape sequence that lets any program tell the terminal whether it is idling, working, waiting on the user, finished or failed, and why

📰 Good to know, terminal, tools

A hitchhiker's guide to Postgres text search

by Cortex

Cortex replaced a Lucene-based search architecture with Postgres full-text search, a custom query parser, weighted ranking and CDC-fed indexes, cutting public API p95 latency from 13.3 to 1.54 seconds

📰 Good to know, postgres, search, databases

A single POST freezes any Next.js server

by Simon Koeck

React Server Components flaw where a roughly 900 KB request forces quadratic FormData work and blocks the Node.js event loop, fixed in React 19.0.6, 19.1.7 and 19.2.6

📰 Good to know, security, react, nextjs

pgx-bm25 1.0

by PGX Inc.

Pure C BM25 ranked full-text search extension whose indexes live in the index relation's pages, so WAL logging, replication and VACUUM work as usual

🧰 Tools, postgres, search, opensource

e2e

by Tester Army

Agent-driven end-to-end testing for web and mobile apps that records successful agent steps and replays them without model calls until the app changes

🧰 Tools, ai, testing, playwright

TanStack Intent

by TanStack

CLI to generate, validate and ship agent skills alongside your library, versioned with the package and discovered by agents from node_modules

🧰 Tools, ai, agents, tooling

Responsibly dimming the lights in the software factory

by Victor Rentea

Steps and milestones for raising the quality of AI-generated code until code review intensity can safely go down, without cognitive debt and skill erosion

📺 Videos, ai, agents, codereview

Want to read more? Check out the full article here.

To sign up for the weekly newsletter, visit weeklyfoo.com.

Stay ahead in web development: latest news, tools, and insights #158

Adam — Mon, 12 Oct 2026 04:44:17 +0000

Signup here for the newsletter to get the weekly digest right into your inbox.

weeklyfoo #158 is here: your weekly digest of all webdev news you need to know! This time you'll find 40 valuable links in 5 categories! Enjoy!

🚀 Read it!

How ChatGPT Intelligent UI works: Reverse-engineering tour from a model-written DIL format through server-side compilation, sandboxed client execution and native rendering, including how streaming recompiles partial output and preserves keyed state by OpenUI / ai, ui, frontend / 22 min read

📰 Good to know

Agents don't need memory. They need documentation.: Vector-search memory surfaces similar snippets without proving they are current or relevant, while a structured Markdown workspace of specs, decisions and instructions gives agents auditable context by liao.gg / ai, agents / 6 min read
Ephemeral testing: Test a software component by having an agent build disposable applications on top of it, exposing hidden state, unstable invariants, surprising defaults and weak documentation by Daniel Lemire / ai, testing / 9 min read
Introducing Beam, Reflection's 501B open-weight model: Sparse Mixture-of-Experts model with 501 billion total and 23 billion active parameters aimed at coding, reasoning and agentic workloads, with Apache 2.0 weights planned for later this month by Reflection AI / ai, llm, opensource / 19 min read
Capturing and replaying real database workloads at Airbnb: Airbnb captures MySQL traffic at ProxySQL, rebuilds transaction order offline and replays production workloads for load testing, migration checks and the move from MySQL 5.7 to 8.0 by Airbnb / databases, mysql, testing / 13 min read
The agent said it was done. The database disagreed: ThinkingBox evaluates agents by the backend state they leave behind across 507 workflows, where 67% of 79,853 failed runs ended without a tool error by Microsoft / ai, agents, evals / 19 min read
Introducing Mistral Large 4: One-trillion-parameter multimodal model in public preview with 49 billion active parameters, 160+ languages and open weights planned for later this month by Mistral AI / ai, llm, opensource / 13 min read
A terminal protocol for program status (OSC 7501): Spec for an escape sequence that lets any program tell the terminal whether it is idling, working, waiting on the user, finished or failed, and why by Mitchell Hashimoto / terminal, tools / 7 min read
Upgrading a 56TB database by mostly not moving it: Facing a mandatory Aurora reboot deadline, Trigger moved just 2% of its data to PlanetScale, with a candid postmortem covering a pgcopydb patch and a failed first cutover by Daniel Sutton / postgres, databases, migration / 21 min read
pgvector 0.8.7 released: Fixes a bug where creating an IVFFlat index could lead to arbitrary code execution by pgvector / postgres, security, vector / 1 min read
A hitchhiker's guide to Postgres text search: Cortex replaced a Lucene-based search architecture with Postgres full-text search, a custom query parser, weighted ranking and CDC-fed indexes, cutting public API p95 latency from 13.3 to 1.54 seconds by Cortex / postgres, search, databases / 16 min read
Claude Haiku 5.5: Fast, low-cost model for summarization, classification, browser use and subagent tasks, with average running costs about 75% lower than Haiku 4.5 and adjustable effort by Anthropic / ai, llm, anthropic / 11 min read
GPT-6 and Intelligent UI for everyone: GPT-6 rolls out in ChatGPT with Intelligent UI, which combines text, graphics, forms, charts and interactive tools in a response and can start answering while still reasoning or searching by OpenAI / ai, llm, openai / 1 min read
We built our own cloud agents runtime: The shared runtime behind PostHog's agents built on Temporal workflows, VM sandboxes, snapshots and resumable run logs, with every run designed to survive the loss of its sandbox by PostHog / ai, agents, infrastructure / 13 min read
Don't merge what you didn't run: A test gate for agent-written code that reinstalls from scratch, runs the full suite three times, rejects removed or skipped tests and restores the base branch's tests against the new code by Runtime / ai, agents, testing / 11 min read
A single POST freezes any Next.js server: React Server Components flaw where a roughly 900 KB request forces quadratic FormData work and blocks the Node.js event loop, fixed in React 19.0.6, 19.1.7 and 19.2.6 by Simon Koeck / security, react, nextjs / 6 min read
Deno joins Cloudflare: Cloudflare is acquiring Deno, with a Rust rewrite of workerd, first-class self-hosting for Durable Objects and a secured future for the Deno runtime on the roadmap by Cloudflare / deno, cloudflare, javascript / 26 min read
Introducing the Personal Agent Protocol: A new protocol for personal agents that is built on top of OAuth by Bret Taylor, Clay Bavor / ai, agents, auth / 8 min read

🧰 Tools

Panda CSS 2.0: Same css() API with a much faster compiler rebuilt in Rust, plus publishable design systems, view-transition styling, an ESLint plugin and a new typography preset by Panda CSS / css, cssinjs, frontend
Postgres MCP Server: Microsoft's Rust-powered MCP server, installed via npm, that lets AI coding agents work with Postgres on Azure or anywhere else by Microsoft / postgres, mcp, ai
pgx-bm25 1.0: Pure C BM25 ranked full-text search extension whose indexes live in the index relation's pages, so WAL logging, replication and VACUUM work as usual by PGX Inc. / postgres, search, opensource
Next.js 16.4: Cache Components on by default for new apps, static-render guarantees, finer prefetch controls, agent-assisted upgrades and React 19.3 by Vercel / nextjs, react, frontend
Remix 3: Rebuilt full-stack framework with no React required, shipping a type-safe router, auth, an ORM, an asset server and its own component model by Remix / javascript, framework, fullstack
Lightpanda 1.0: Headless browser built from scratch in Zig that uses a fraction of Chrome's CPU and memory, driven by Puppeteer, Playwright or plain JavaScript by Francis Bouvier / browser, automation, zig
Pi 1.0: The minimal Node.js-based coding agent adds MCP and non-LLM model support through Codemode by Earendil / ai, agents, nodejs
JavaScript Framework Benchmark for Chrome 154: Results for 196 ways to implement the same app, how each performs and how large they are by Stefan Krause / javascript, performance, benchmark
e2e: Agent-driven end-to-end testing for web and mobile apps that records successful agent steps and replays them without model calls until the app changes by Tester Army / ai, testing, playwright
TanStack Charts 1.0: Composable, type-safe charting system built from marks, scales, axes and interactions instead of rigid chart types, with custom renderers and SVG or Canvas output by TanStack / charts, typescript, frontend
TanStack Intent: CLI to generate, validate and ship agent skills alongside your library, versioned with the package and discovered by agents from node_modules by TanStack / ai, agents, tooling
Node.js 26.11: New --process-timeout flag that ends a process after a set time even mid-busy-loop, virtual table support in node:sqlite, Buffer.stringLength() and tier 2 support for Alpine on x64 by Antoine du Hamel / nodejs, javascript
H3 v2: The minimal HTTP framework behind Nitro and Nuxt rebuilt around standard Request and Response, so one app runs on Node, Bun, Deno and Workers by Pooya Parsa / javascript, http, framework
pnpm 12.10: Experimental loaded linker lets Node load dependencies straight from the pnpm store, skipping node_modules linking by pnpm / pnpm, nodejs, tooling
Hono 5.0 RC: The web-standards server framework goes ESM-only, requires Node 22.12+ and moves runtime adapters into separate packages by Hono / javascript, framework
Bootstrap 6 alpha: Ground-up modernization with the Sass module system, more native browser APIs and elements, ESM-only JavaScript plugins and a slew of new CSS standards by Bootstrap / css, frontend, bootstrap
calc-input: Custom input element that accepts arithmetic expressions, shows the formula on focus and the result on blur, with a safe parser and native form validation instead of eval() by Bramus Van Damme / webcomponents, forms, frontend

🤪 Fun

Destroy this website: Steer a tiny orange character that jumps across headings and images and shoots page elements to pieces by Sprite Fusion / fun, web / 3 min read
I put Smash Bros Melee in my living room: Hours after the Melee decompilation hit 100%, a developer had Fox and Marth fighting in their apartment through a Meta Quest, with a write-up of how the match got into the headset by Kevin / fun, gaming, vr / 31 min read

📺 Videos

Building resilient systems with Sam Newman: The Building Microservices author on microservices as a last resort, three rules of distributed systems, idempotency keys versus fingerprints and resisting cognitive surrender to AI by Gergely Orosz / architecture, distributedsystems, ai
Harness engineering on Rails: An agent is really a loop, so move judgment out of AGENTS.md and into deterministic tools like custom RuboCop cops, generators, hooks and focused review skills by Joël Quenneville / ai, agents, rails
Responsibly dimming the lights in the software factory: Steps and milestones for raising the quality of AI-generated code until code review intensity can safely go down, without cognitive debt and skill erosion by Victor Rentea / ai, agents, codereview

Want to read more? Check out the full article here.

To sign up for the weekly newsletter, visit weeklyfoo.com.

Agents Need Guardrails, CSS Likes More, Kafka Moves In

Adam — Fri, 09 Oct 2026 04:52:07 +0000

The agent news this week sounds like a safety review with a side of performance: a reconstruction details how 700 OpenAI agents escaped constrained evals and attacked Hugging Face, while Codex auto-review has a second model inspect risky tool calls before they run. Another 325,000-trial study found 13 models steering personas they thought were wealthy toward pricier picks; hard price caps were the fix. For teams tuning agents, Anthropic's eval-design workflow uses reviewed test sets and held-out checks to guard against overfitting, OpenAPPA checks data flow before each tool call, and BM25 reminds us lexical search can still beat embeddings.

Elsewhere, V8 object prototypes prove that tiny internals can have big consequences: changing object shapes doubled WebStreams pipe throughput in Node core. GitHub's CSS-in-JS migration likewise found that shipping more CSS can be cheaper than runtime styling. For tooling, Vite+ puts most JavaScript dev chores behind one CLI, Safe Not Safe gives Postgres migrations a private browser-side preflight, and Kafgres runs a Kafka-compatible broker inside Postgres at a very non-toy 700 MB/s. Your database may now be the message broker—sure, why not.

Enjoy!

Signup here for the newsletter to get the weekly digest right into your inbox.

Find the 11 highlighted links of weeklyfoo #157:

Optimizing objects with null prototypes

by Matteo Collina

Why proto null literals get stuck in V8 dictionary mode, and how switching to classes or Object.setPrototypeOf doubled WebStreams pipe throughput in Node core

📰 Good to know, nodejs, v8, performance

Improving site performance by shipping more CSS

by GitHub

How github.com migrated from CSS-in-JS to CSS Modules to drop client and server runtime styling costs while keeping component encapsulation

📰 Good to know, css, performance, frontend

Revealing the details of how OpenAI agents hacked Hugging Face

by SwarmTraces

Reconstruction of how a swarm of 700 agents escaped constrained eval environments, chaining a million short links and 80k payloads into Hugging Face systems

📰 Good to know, ai, agents, security

Personal AI agents quietly upsell users they think are rich

by Stacksweep

Across 325k trials and 13 models, agents recommended pricier options to personas they inferred were wealthy, and only hard price caps closed the gap

📰 Good to know, ai, agents, research

Automating eval design and hillclimbing with Claude

by Anthropic

The new build-eval and hillclimb commands build reviewed test sets and graders, then improve prompts, skills or harness code one change at a time with held-out checks against overfitting

📰 Good to know, ai, evals, agents

Announcing Vite+ 1.0

by VoidZero

One stable CLI entry point for runtime, package manager, dev server, tests, builds, linting, formatting and task caching

📰 Good to know, vite, javascript, tooling

Codex auto-review

by OpenAI

How a second model judges risky agent tool calls before they run, and how it holds up against prompt injection

📰 Good to know, ai, agents, security

Safe Not Safe

by Safe Not Safe

Checks PostgreSQL migrations locally in the browser with a WASM parser and deterministic rules, no upload or account

🧰 Tools, postgres, databases, tools

OpenAPPA

by Archestra

Open-source deterministic guardrail for coding agents that checks before every tool call whether data may flow to a destination, with security labels, tool contracts and remedy plans

🧰 Tools, ai, agents, security

Kafgres 0.2

by Raynor Elgie

A Kafka-compatible broker running inside Postgres, now at 700 MB/s write throughput on a single box

🧰 Tools, postgres, kafka, streaming

The unreasonable effectiveness of BM25 for agentic search

by Jo Kristian Bergum

Why plain lexical search often beats embeddings when agents do the retrieval

📺 Videos, ai, search

Want to read more? Check out the full article here.

To sign up for the weekly newsletter, visit weeklyfoo.com.

Stay ahead in web development: latest news, tools, and insights #157

Adam — Mon, 05 Oct 2026 04:33:26 +0000

Signup here for the newsletter to get the weekly digest right into your inbox.

weeklyfoo #157 is here: your weekly digest of all webdev news you need to know! This time you'll find 38 valuable links in 5 categories! Enjoy!

🚀 Read it!

How I could have accessed 17 trillion Microsoft records: An internal Microsoft analytics service accepted unsigned JWTs, letting a forged admin identity run SQL across 17.3 trillion rows by faav / security, jwt / 11 min read

📰 Good to know

Optimizing objects with null prototypes: Why proto null literals get stuck in V8 dictionary mode, and how switching to classes or Object.setPrototypeOf doubled WebStreams pipe throughput in Node core by Matteo Collina / nodejs, v8, performance / 7 min read
Improving site performance by shipping more CSS: How github.com migrated from CSS-in-JS to CSS Modules to drop client and server runtime styling costs while keeping component encapsulation by GitHub / css, performance, frontend / 20 min read
Revealing the details of how OpenAI agents hacked Hugging Face: Reconstruction of how a swarm of 700 agents escaped constrained eval environments, chaining a million short links and 80k payloads into Hugging Face systems by SwarmTraces / ai, agents, security / 36 min read
Personal AI agents quietly upsell users they think are rich: Across 325k trials and 13 models, agents recommended pricier options to personas they inferred were wealthy, and only hard price caps closed the gap by Stacksweep / ai, agents, research / 7 min read
Automating eval design and hillclimbing with Claude: The new build-eval and hillclimb commands build reviewed test sets and graders, then improve prompts, skills or harness code one change at a time with held-out checks against overfitting by Anthropic / ai, evals, agents / 17 min read
Announcing Vite+ 1.0: One stable CLI entry point for runtime, package manager, dev server, tests, builds, linting, formatting and task caching by VoidZero / vite, javascript, tooling / 7 min read
Codex auto-review: How a second model judges risky agent tool calls before they run, and how it holds up against prompt injection by OpenAI / ai, agents, security / 9 min read
DevDay 2026 recap: More than 20 announcements across ChatGPT, Codex and models, including agents with ongoing responsibilities, cloud Codex environments, a Decisions API and an Agents API by OpenAI / ai, agents, openai / 1 min read
Introducing GPT-6.1 Sol: Near-Astra performance on coding, computer use and professional work at one-fifth of the token price by OpenAI / ai, llm, openai / 1 min read
Introducing Dots: Always-on GPT-6 Astra agents with their own cloud computers, 4,000+ app connections and access via ChatGPT, Slack, Teams and voice by OpenAI / ai, agents, openai / 1 min read
PostgreSQL 19 beta 4 released: Mostly about what was removed, including SQL/PGQ and FOR PORTION OF, with a release candidate due in weeks by PostgreSQL / postgres, databases / 5 min read
Can your Postgres survive a bad query?: What happens on four Postgres cloud providers when queries eat all the RAM, and why work_mem does not prevent it by ClickHouse / postgres, databases / 19 min read
Spectre bug returns to haunt JIT engines: Branch Target Reuse revives Spectre v2 against JIT engines by reusing stale branch predictions by The Register / security, cpu / 9 min read
A FUSE server for an in-house storage backend: How an OCaml-native read-only FUSE server with parallel reads and zero-copy buffers took large-file throughput from 30 MiB/s to 1.3 GiB/s by Jane Street / linux, ocaml, performance / 11 min read
SvelteKit 3 is here: Removes deprecated APIs, adopts native subpath imports and Vite 8 with Rolldown, and ships a migration command by Svelte / svelte, javascript, frontend / 2 min read
Preact 11: After more than six years of work, the release brings a new hydration system, automatic ref forwarding and improved React compatibility by Preact / preact, javascript, frontend / 3 min read
Effect 4.0: Rebuilt from the ground up, the library is now 5x smaller, 6.4x faster and uses 86% less memory by Effect / typescript, effect / 5 min read

🧰 Tools

Atlas: Source control for coding agents that links commits to the sessions, prompts, tool calls and reasoning that produced them by pacifio / ai, agents, git
Mobile MCP: One MCP interface for agents to automate native iOS and Android apps across simulators, emulators and real devices by mobile-next / mcp, mobile, testing
Safe Not Safe: Checks PostgreSQL migrations locally in the browser with a WASM parser and deterministic rules, no upload or account by Safe Not Safe / postgres, databases, tools
Floci: Free local emulators for AWS, Azure, GCP and OCI with real service engines and no cloud account needed by Floci / cloud, testing, tools
OpenRig: Multi-agent harness that runs Claude Code and Codex sessions as one persistent team with YAML topologies, shared queues, a TUI and tmux recovery by mvschwarz / ai, agents, cli
OpenAPPA: Open-source deterministic guardrail for coding agents that checks before every tool call whether data may flow to a destination, with security labels, tool contracts and remedy plans by Archestra / ai, agents, security
jevgrep: CLI that searches code using natural language by David Zhang / cli, search, ai
Size Limit: Performance budget tool that fails CI when a change pushes bundle size or load time over the limit by Andrey Sitnik / javascript, performance, ci
MSW 3.0: API mocking library goes ESM-only, adds a Vite plugin, GraphQL subscriptions and intercepts page navigations and form submissions by MSW / testing, javascript, api
Kafgres 0.2: A Kafka-compatible broker running inside Postgres, now at 700 MB/s write throughput on a single box by Raynor Elgie / postgres, kafka, streaming
pg_raw_parse: Rust bindings to the Postgres parser with 20 to 60x faster parsing than pg_query.rs by PgDog / postgres, rust
tinyjs: Desktop apps on the system native webview instead of a bundled browser, with a runtime of about 6 MB by tinyjs / desktop, javascript, tools
celld: Self-hosted, distributed Durable Objects with a SQLite database per object, backed by object storage and compatible with Cloudflare config by celld / cloudflare, sqlite, serverless
Moli: Headless browser built for agents by Lexmount / browser, agents, tools
OpenShell: Private, sandboxed runtime for autonomous agents by NVIDIA / agents, security, sandbox

🤪 Fun

We didn't start the scaling: A website that pushes AI-generated content to its limit by Domenic Denicola / ai, web / 35 min read
We ported the original Doom to SQL: The 1993 FPS logic and renderer running in SQL with 89 CTEs, returning each frame as a bitmap by CedarDB / sql, games / 30 min read

📺 Videos

Andres Freund on where Linux helps and hurts Postgres: A candid Kernel Recipes talk on io_uring, huge pages, futexes and atomic writes by Andres Freund / postgres, linux
WebMCP - Stop scraping the web, start calling it: A WebMCP spec co-author shows how explicit tool contracts replace agents guessing their way through pages by Patrick Brosset / ai, agents, web
The unreasonable effectiveness of BM25 for agentic search: Why plain lexical search often beats embeddings when agents do the retrieval by Jo Kristian Bergum / ai, search

Want to read more? Check out the full article here.

To sign up for the weekly newsletter, visit weeklyfoo.com.