DEV Community: Adam

Stay ahead in web development: latest news, tools, and insights #153

Adam — Mon, 07 Sep 2026 05:35:08 +0000

Signup here for the newsletter to get the weekly digest right into your inbox.

weeklyfoo #153 is here: your weekly digest of all webdev news you need to know! This time you'll find 37 valuable links in 5 categories! Enjoy!

🚀 Read it!

Bug blindness: Why developers and power users stop noticing the bugs that drive normal users away by Dan Luu / engineering,quality / 34 min read

📰 Good to know

The rise and fall of agent civilizations: Three secret AI civilizations started and were wiped out inside OpenAI over three months by Dwarkesh Patel / ai,agents / 23 min read
Understanding ChatGPT Work: What the subscription-only tier adds - code execution with internet access, a headless browser, persistent files and parallel sub-agents by Simon Willison / ai / 12 min read
I accidentally turned LLM memory into program analysis: Swapping fuzzy agent memory for a Datalog fact store that supports incremental reasoning in vulnerability research by pwning.systems / ai,security / 21 min read
Omarchy any user process can escalate to root: A default Docker configuration let any user process become root - fixed in version 4.0.1 by 0xcc / security,linux / 5 min read
The depths of JavaScript - Minesweeper in 247 bytes: How a playable 8x8 Minesweeper with flags and cascading blanks was squeezed into a single line of JavaScript by yui and DNEK / javascript,codegolf / 17 min read
pnpm 12 rewritten in Rust, same commands and lockfile: The Rust rewrite is stable and nearly all v11 commands, flags and lockfile format carry over by Zoltan Kochan / nodejs,tooling,rust / 12 min read
htmx 4.0, the first major release in two years: Rebuilt on the Fetch API, with opt-in attribute inheritance, morphing swaps and a new hx-partial element by Carson Gross / html,htmx,frontend / 10 min read
How Zod 4.5 cut memory per schema by 9x: Method memoization took a bare z.string() from 7.5KB of heap down to 784 bytes by Colin McDonnell / typescript,performance / 4 min read
Breaking Claude Code Opus 5 auto mode: Prompt injection against auto mode landed 60-80% of the time, so it is a speed bump and not a security boundary by Johann Rehberger / ai,security,promptinjection / 13 min read
How to build a diffusion language model: Generating whole sequences at once with iterative refinement, variable-length output and error correction by Kuleshov Group / ai,ml,deepdive / 34 min read
Read your own writes off the primary with WAIT FOR: Naive replica reads were stale 992 times out of 1000 even over loopback - WAIT FOR gets that to zero for 1-2ms by Radim Marek / postgres,database / 19 min read
23x faster inserts with UUID v7 in Postgres 18: Switching a billion-row table to uuidv7(), and the exclusive lock and jittered retry loop the switchover needed by Andrew Atkinson / postgres,performance / 10 min read
The MCP tax - what each server costs before your first prompt: Measuring the context every MCP server eats, and how schema deferral changes the bill by okaneland / ai,mcp,context / 10 min read
Improving alignment and security practices: What went wrong in third-party evaluation environments in July and August, and the containment that followed by Anthropic / ai,security / 22 min read
How Turbopack chunks your JavaScript: Merging small chunks inside route groups took nextjs.org from 96 requests down to 38 without shipping more code by Next.js / javascript,bundler,performance / 11 min read
Making AI coding cheaper without sacrificing task quality: Shorter tool output can cost more when the agent has to reopen files, so compress the logs and leave the source alone by GitHub / ai,agents,context / 23 min read

🧰 Tools

GitHub Agentic Workflows: Event-triggered and scheduled AI jobs alongside your deterministic CI/CD, with guardrails and support for Claude Code, Copilot, Gemini and Codex by GitHub / github,ci,ai
vgpu: A TypeScript library for WebGPU with typed shader imports and a compact GPU-first API that also runs headless in Node.js by Vercel Labs / typescript,webgpu,graphics
lane: A git worktree manager that preserves your build cache and leaves durable notes for your agents by Luke Edwards / git,cli,agents
Rspack 2.2, Rsbuild 2.2 and Rslint 0.9: Faster builds and HMR, shorter module IDs, and Rslint now implements every rule and preset from typescript-eslint by Rspack / bundler,rust,tooling
Speedlify2: Self-hostable continuous measurement of Lighthouse scores, Core Web Vitals and Axe accessibility on GitHub Actions and Pages by Zach Leatherman / performance,tooling
pgterm: htop for all your Postgres databases - a Rust TUI with background health checks and views for queries, indexes and tables by Alex Shapalov / postgres,cli,rust
pg_shmemviz: Visualize Postgres shared memory in the browser - allocations, struct fields, padding and raw bytes read from DWARF by Bertrand Drouvot / postgres,debugging
Drydock: Diff built npm tarballs against the last published version, flagging install scripts, network access and new binaries by Jovi De Croock / npm,security,supplychain
srvx 1.0: Export one fetch handler taking a Request and returning a Response, then run it unchanged on Node, Deno or Bun by Pooya Parsa / nodejs,server,javascript
SimpleWebAuthn 14.0: The passkeys library verifies post-quantum ML-DSA passkeys and prefers ML-DSA-44 at registration on Node 24.7 and up by Matthew Miller / auth,passkeys,security
Tailcat: Netcat over Tailscale's data plane without its control plane - WireGuard tunnels, NAT hole punching and DERP relay, no account needed by Tailscale / networking,cli,go
cn: A drop-in replacement for clsx and tailwind-merge that precompiles Tailwind's conflict rules into lookup tables, and can trim itself to only the rules you use by shadcn and Aiden Bai / tailwind,javascript,css
Mantine 9.6: A lightbox, an ActionBar for contextual bulk actions and four new chart types including waffle, gauge and candlestick by Mantine / react,ui,components
styled-components to StyleX codemod: The codemod Linear built and used for its own migration by Kenneth Skovhus / react,css,codemod
Storybook 10.6: The component workshop adds CLI bindings so agents can drive Storybook's tools and skills by Storybook / react,storybook,agents

🤪 Fun

It takes 5 cloud services to hear my doorbell: A video doorbell upgrade that needed five different clouds to fix a problem the doorbell itself created by Vishal Ghaisas / fun,homeautomation / 3 min read
The AI interface museum: A visual history of how humans learned to talk to, look through, create with and delegate work to machines by Kyle Jeong / ai,history,design / 5 min read

📺 Videos

DHH on the future of programming: There are decades where nothing happens and weeks where decades happen - a long conversation on where the craft goes next by Lex Fridman and David Heinemeier Hansson / programming,ai,video
Postgres is not slow, your storage is: A POSETTE 2026 talk benchmarking local NVMe against network storage and where the latency compounds by Sai Srirampur / postgres,performance,video
Why is everyone moving to StyleX?: Scott and Wes on why the extra rigidity that annoys humans is exactly what agents thrive on by Syntax / react,css,video

Want to read more? Check out the full article here.

To sign up for the weekly newsletter, visit weeklyfoo.com.

Cheap Optimization, Agent Guardrails, and SQLite Binaries

Adam — Thu, 03 Sep 2026 06:27:20 +0000

Performance work is suddenly fun again. Dan Luu argues that AI crushed the cost of optimization, turning what used to be expensive black-belt work into something much closer to routine engineering. Cloudflare makes the case with numbers: five cache-layout changes, 100 terabytes of memory saved, and faster inserts for 1.1.1.1. And then Farid Zakaria arrives with the most delightfully strange systems idea of the week: what if your executable were a SQLite database you could query and patch with SQL?

Agent infrastructure is maturing fast. The MCP roadmap lays out where the protocol goes next, Chroma reframes agent swarms as a distributed-transactions problem with better branding, and Whip packages practical multi-agent orchestration into a lean Go harness. Meanwhile, BrowserSkill tackles a very real automation headache: letting agents use your already logged-in browser without quietly stealing the keys.

Security is very much invited to this party. Next.js patched two critical unauthenticated RCEs, so if you run it in production, this is your polite reminder to stop reading and update. Vercel's Run SDK shows how to execute untrusted JavaScript inside a tight capability boundary, and Better Auth 1.7 ships concrete OAuth, DPoP, device-flow, and MCP auth support teams can actually adopt. In short: faster systems, smarter agents, and just enough guardrails to keep the week from catching fire.

Enjoy!

Signup here for the newsletter to get the weekly digest right into your inbox.

Find the 10 highlighted links of weeklyfoo #152:

There's No Reason for Software to Be Slow Anymore

by Dan Luu

AI collapsed the cost of optimization, so tricky perf work that was never worth the risk is now a trivial loop

📰 Good to know, performance,ai

The New MCP Roadmap

by MCP Team

Five priority areas for the next spec releases, including agentic messaging primitives, transport hardening and agent identity

📰 Good to know, mcp,ai

How We Saved 100 Terabytes of Memory by Optimizing 1.1.1.1's DNS Cache

by Cloudflare

Five successive changes to cache entry storage cut per-entry footprint by half, with 43 percent faster inserts

📰 Good to know, performance,dns

Agent Swarms Are a Distributed Systems Problem

by Chroma

A swarm of agents mutating shared memory is a transaction problem, and Chroma treats it like one

📰 Good to know, ai,agents

Your Executable Is a SQLite Database

by Farid Zakaria

Replacing ELF with SQLite so a binary can be queried and patched with plain SQL

📰 Good to know, systems,sqlite

Two Critical Unauthenticated RCEs Patched in Next.js

by Next.js Team

Update to 16.3.3 or 15.5.24, depending on which line you are on

📰 Good to know, security,nextjs

Whip

by Context Labs

Fast coding-agent harness in Go with background subagents and open model discovery

🧰 Tools, ai,cli

Run SDK

by Vercel

Runs untrusted JavaScript in a fresh QuickJS context per call, exposing only the host functions you pick

🧰 Tools, security,javascript

Better Auth 1.7

by Gustavo Valverde

Standards-based OAuth server with DPoP, per-API token rules, device code flow and MCP auth in its own package

🧰 Tools, auth,javascript

BrowserSkill

by Tencent

Lets agents drive your already logged-in browser through a CLI and extension without hijacking your session

🧰 Tools, ai,browser

Want to read more? Check out the full article here.

To sign up for the weekly newsletter, visit weeklyfoo.com.

Stay ahead in web development: latest news, tools, and insights #152

Adam — Sun, 30 Aug 2026 06:06:35 +0000

Signup here for the newsletter to get the weekly digest right into your inbox.

weeklyfoo #152 is here: your weekly digest of all webdev news you need to know! This time you'll find 34 valuable links in 5 categories! Enjoy!

🚀 Read it!

VMs Won't Contain Cyber-Capable Agents: Testing showed agents escaping VMs through known and unknown host bugs, so containment needs a much smaller attack surface by Trail of Bits / security,ai / 9 min read

📰 Good to know

There's No Reason for Software to Be Slow Anymore: AI collapsed the cost of optimization, so tricky perf work that was never worth the risk is now a trivial loop by Dan Luu / performance,ai / 23 min read
The New MCP Roadmap: Five priority areas for the next spec releases, including agentic messaging primitives, transport hardening and agent identity by MCP Team / mcp,ai / 8 min read
An AGENT.md to Improve LLM-Assisted Code Quality: A good coding harness beats a better model, and most of it fits in one file by Fabien Sanglard / ai,tooling / 6 min read
Fable & the End of the Free Lunch: When a cheaper model arrived every few months, optimizing your harness was a waste. That assumption just broke. by Drew Breunig / ai,llm / 2 min read
How We Saved 100 Terabytes of Memory by Optimizing 1.1.1.1's DNS Cache: Five successive changes to cache entry storage cut per-entry footprint by half, with 43 percent faster inserts by Cloudflare / performance,dns / 30 min read
Closing the AI Agent Trust Gap With Graduated Autonomy: Agents earn permissions through a rolling reliability score and four tiers, promoted slowly and demoted instantly by AWS / ai,agents / 16 min read
Why AI Coding Agents Need Context Graphs: Coding agents fail in real codebases because team context is scattered, so publish a queryable graph of typed entities instead by Postman / ai,agents / 15 min read
Making Your Data Ready for Agentic AI: Data contracts, context layers and controlled access, because pipelines built for human analysts do not survive autonomous agents by Martin Fowler / ai,data / 52 min read
Audit Your Agent Files: Agent configs have a half-life, so make every instruction earn its place again every few weeks by Addy Osmani / ai,agents / 16 min read
Agent Swarms Are a Distributed Systems Problem: A swarm of agents mutating shared memory is a transaction problem, and Chroma treats it like one by Chroma / ai,agents / 11 min read
Read Your Writes with WAIT FOR in Postgres 19: A session can block until WAL reaches a position, so only the reads that need it pay for replica lag by Gülçin Yıldırım Jelínek / postgres,database / 12 min read
Your Executable Is a SQLite Database: Replacing ELF with SQLite so a binary can be queried and patched with plain SQL by Farid Zakaria / systems,sqlite / 15 min read
Two Critical Unauthenticated RCEs Patched in Next.js: Update to 16.3.3 or 15.5.24, depending on which line you are on by Next.js Team / security,nextjs / 3 min read
DuckLabs Is Joining AWS: DuckDB, DuckLake and Quack stay MIT licensed and open source, with AWS scale behind them by DuckLabs / database,news / 9 min read
Query Pipelining in node-postgres: Two to three times the throughput and lower latency from one config change by Matteo Collina / postgres,nodejs / 10 min read

🧰 Tools

Apache Maka: Local-first AI agent workspace where interactions and session data stay on your machine by Apache / ai,agents
Proliferate: Open source AI IDE that runs Claude Code, Codex and friends in parallel isolated workspaces, self-hostable by Proliferate / ai,ide
Kern: Rootless container runtime with kernel-enforced isolation and roughly 3.5ms cold starts, no daemon by Kern / containers,runtime
PicoMQ: Durable real-time streaming over HTTP backed by S3-compatible object storage by PicoMQ / streaming,infra
GlassBox: Client-side tool that shows every signal a website can quietly collect from your browser by Code Canary / security,privacy
Blume: Drop Markdown into a folder and ship a production-grade docs site, free and open source by Hayden Bleasel / docs,tooling
Whip: Fast coding-agent harness in Go with background subagents and open model discovery by Context Labs / ai,cli
LatticeDB: Embedded property-graph database folding vector similarity, full-text search and traversal into one local engine by LatticeDB / database,search
Run SDK: Runs untrusted JavaScript in a fresh QuickJS context per call, exposing only the host functions you pick by Vercel / security,javascript
pgbot: Single read-only Go binary that prints a graded Postgres health report plus what changed since the last run by Alex Shapalov / postgres,cli
Better Auth 1.7: Standards-based OAuth server with DPoP, per-API token rules, device code flow and MCP auth in its own package by Gustavo Valverde / auth,javascript
SVGO 4.1: Node-powered SVG optimizer, now with stricter XML validation and security improvements by Kir Belevich / svg,tooling
BrowserSkill: Lets agents drive your already logged-in browser through a CLI and extension without hijacking your session by Tencent / ai,browser
Context Engineering Toolkit: Spec-driven development, subagent workflows and plugins aimed at making AI-generated code hold up by NeoLab / ai,tooling
pnpm 12: The package manager is now written in Rust, so it is faster and it also breaks things by pnpm / tooling,rust

🤪 Fun

A Walkable ASCII Cyberpunk City in One HTML File: Raycasting renders roads, buildings, cars and pedestrians entirely in ASCII characters by Grow Now! Games / fun,web / 1 min read

📺 Videos

The Creator of TypeScript on Faster TypeScript and Why AI Won't Replace SWEs: Candid hour-long interview with Anders Hejlsberg by Ryan Peterman / typescript,ai
Why Performant Code Matters But Gets Widely Ignored: Casey Muratori on profiler-driven optimization being a local minimum, reading assembly, and his critique of clean code by Gergely Orosz / performance,podcast

Want to read more? Check out the full article here.

To sign up for the weekly newsletter, visit weeklyfoo.com.

AI Attack Surface, Git on S3, CSS Chaos

Adam — Fri, 28 Aug 2026 06:23:33 +0000

Agents are now writing exploits faster than most teams can write postmortems. Matthew Green's warning that software is about to "go dark" lands hard this week, and the signal keeps stacking: Wiz showed an autonomous red agent exploiting a fresh GitHub Actions flaw, Margin Research framed the new "half-day" exploit cycle, and Daniel Miessler's prompt-injection-worm scenario reads less like sci-fi and more like sprint planning. If that wasn't enough, PortSwigger demonstrates CSS abuse inside email clients, which is not the kind of "responsive design" anyone asked for.

Under the hood, infrastructure engineers are rebuilding old ideas for new pressure. Cursor's Git at Any Scale and Chroma's WAL-on-object-storage teardown both point to the same pattern: object storage is becoming the new systems substrate. On the model side, Gustafson's PagedAttention explainer shows how borrowing virtual-memory ideas can stop KV cache waste from eating your GPU budget, while Annie Sexton's Compression Is Prediction is a great reminder that LLM intuition still benefits from old-school information theory.

There is also a deceptively practical frontend gotcha on why the img element can overflow in surprising ways. Plus, Lorin Hochstein's GitHub autoscaling postmortem is a sharp reminder that outages are often system-interaction failures, not villain-of-the-week components. For tooling, Saggar is a small but real quality-of-life win if your terminal tabs currently feel like a crowded airport gate.

Enjoy!

Signup here for the newsletter to get the weekly digest right into your inbox.

Find the 12 highlighted links of weeklyfoo #151:

Everything Is About to Go Dark

by Matthew Green

On AI-written software, its security fallout, and what happens to lawful access to communications

📰 Good to know, security

Something Nobody Told You About the Image Element

by master.dev

The img element is container and content at once, so object-fit and border-radius can make it overflow in surprising ways

📰 Good to know, css,frontend

Compression Is Prediction

by Annie Sexton

Compressors and language models turn out to be solving the same problem, walked through from the basics

📰 Good to know, ai,deepdive

Red Agent Exploits Snowflake Vuln Missed by Copilot

by Wiz

An autonomous agent found and exploited a GitHub Actions flaw five days after it was introduced

📰 Good to know, security,ai

Git at Any Scale

by Cursor

Why Git packfiles break down on a server, and the stateless S3 write-ahead-log architecture Cursor built to get linearizable pushes

📰 Good to know, engineering,git

I Am Worried About a Prompt Injection Worm

by Daniel Miessler

Semi-autonomous agents roaming the internet with too much authority are the AI security problem to watch

📰 Good to know, security,ai

CSS, the Bomb Inside Your Inbox

by Gareth Heyes

How CSS in email clients is ripe for exploitation, with a pile of working attack techniques

📰 Good to know, security,css

PagedAttention, Virtual Memory for the KV Cache

by Gustafson

Borrowing OS paging for the KV cache so a shared pool of fixed-size blocks cuts waste and lifts throughput

📰 Good to know, ai,performance

GitHub, Autoscaling, and the Component Substitution Fallacy

by Lorin Hochstein

The outage came from an autoscaling policy that ignored the Istio sidecar limits, not from one broken component

📰 Good to know, devops,engineering

How We Built Our Write-Ahead Log

by Chroma

Long writeup on building a WAL on object storage, and why 60-year-old System R ideas suddenly matter again

📰 Good to know, databases,engineering

Introducing the Half-Day

by Margin Research

AI-found exploits arrive faster than any human researcher can produce them, and what that does to the vulnerability market

📰 Good to know, security,ai

Saggar

by Marginal Utility

Native macOS terminal manager that surfaces which shells, tests and coding agents are waiting on a decision

🧰 Tools, macos,cli

Want to read more? Check out the full article here.

To sign up for the weekly newsletter, visit weeklyfoo.com.

Stay ahead in web development: latest news, tools, and insights #151

Adam — Sun, 23 Aug 2026 14:43:27 +0000

Signup here for the newsletter to get the weekly digest right into your inbox.

weeklyfoo #151 is here: your weekly digest of all webdev news you need to know! This time you'll find 36 valuable links in 5 categories! Enjoy!

🚀 Read it!

Agent Memory as a Moat: How persisting and scoping agent memory turns stateless models into systems that compound context over time by Redis / ai,agents / 17 min read

📰 Good to know

Maximizing the Value of Your Claude Code Sessions: Clear context between tasks, set model and effort early, use @-mentions so tokens spent go to the actual task by Anthropic / ai,tools / 29 min read
Auto-Research with Codex and a 232x Faster Kernel: Long writeup on hitting a 232x speedup on a batched Householder QR kernel with blocked algorithms, profiling loops and model-driven iteration by Sankalp / ai,performance / 29 min read
A Quick Look at Zero-Knowledge Proofs: How a prover convinces a verifier without handing over the solution, and where ZKPs help beyond crypto, like age verification by Max Bernstein / security,crypto / 12 min read
Everything Is About to Go Dark: On AI-written software, its security fallout, and what happens to lawful access to communications by Matthew Green / security / 15 min read
Something Nobody Told You About the Image Element: The img element is container and content at once, so object-fit and border-radius can make it overflow in surprising ways by master.dev / css,frontend / 9 min read
Protobuf Finally Has LSP Support: Buf shipped the first full Language Server Protocol implementation for Protobuf, so proto files get real IDE support by Buf / tools,protobuf / 5 min read
Compression Is Prediction: Compressors and language models turn out to be solving the same problem, walked through from the basics by Annie Sexton / ai,deepdive / 24 min read
Red Agent Exploits Snowflake Vuln Missed by Copilot: An autonomous agent found and exploited a GitHub Actions flaw five days after it was introduced by Wiz / security,ai / 9 min read
Git at Any Scale: Why Git packfiles break down on a server, and the stateless S3 write-ahead-log architecture Cursor built to get linearizable pushes by Cursor / engineering,git / 60 min read
Consistency Is the New Latency: Agents reading stale replicas build whole reasoning chains on wrong facts, and writing those back creates hallucination debt by AWS / databases,ai / 13 min read
I Am Worried About a Prompt Injection Worm: Semi-autonomous agents roaming the internet with too much authority are the AI security problem to watch by Daniel Miessler / security,ai / 6 min read
CSS, the Bomb Inside Your Inbox: How CSS in email clients is ripe for exploitation, with a pile of working attack techniques by Gareth Heyes / security,css / 51 min read
PagedAttention, Virtual Memory for the KV Cache: Borrowing OS paging for the KV cache so a shared pool of fixed-size blocks cuts waste and lifts throughput by Gustafson / ai,performance / 20 min read
GitHub, Autoscaling, and the Component Substitution Fallacy: The outage came from an autoscaling policy that ignored the Istio sidecar limits, not from one broken component by Lorin Hochstein / devops,engineering / 6 min read
How We Built Our Write-Ahead Log: Long writeup on building a WAL on object storage, and why 60-year-old System R ideas suddenly matter again by Chroma / databases,engineering / 24 min read
Introducing the Half-Day: AI-found exploits arrive faster than any human researcher can produce them, and what that does to the vulnerability market by Margin Research / security,ai / 10 min read

🧰 Tools

Code Storage: API-only Git storage from ex-GitHub engineers, already backing Lovable and Bolt for user-generated code by Pierre Computer Company / git,api
oj: A bundler with Vite's API and performance that uses far less memory by Rapha Amorim / bundler,javascript
Mole: Deep-research agent that works under an expense budget and verifies its claims with citations by lajosdeme / ai,agents
AI CSS: Free customizable UI components for AI agents, covering thinking states, tool calls, streaming text and structured output by aicss / ui,ai
Morphicons: Morph any stroke SVG icon into any other, closed-form rotation plus spring physics, zero dependencies by Guillermo Lopez Gomez / ui,icons
Saggar: Native macOS terminal manager that surfaces which shells, tests and coding agents are waiting on a decision by Marginal Utility / macos,cli
TermDOM: Build terminal UIs and interactive CLIs with plain HTML, CSS and DOM APIs by TermDOM / cli,javascript
MicroLighter: Small client-side syntax highlighter built on the CSS Custom Highlights API by Dave Rupert / css,javascript
Origin: A git forge for the agentic era, from the Cursor team by Cursor / git,ai
Needle: 14MB foundation model for tool calling on tiny devices like phones, wearables and robots by Cactus Compute / ai,models
Tegaki: Generate stroke data from any font and render handwriting animations in React, Svelte, Vue, Solid, Astro or vanilla JS by gkurt / animation,javascript
Bun 1.4: 1,500 more Node.js tests passing, five times less CPU, 35% less memory, plus Bun.Image, Bun.WebView and HTTP/3 by Bun / javascript,node
SvelteKit 3.0 RC: Vite 8 with Rolldown, error boundaries, validated env vars and remote functions by Svelte / javascript,frameworks
Preact 11.0 RC: Adds use(), createPortal() and useEffectEvent() among other things by Preact / javascript,frontend
Astro 7.2: Incremental static builds, and you can now opt out of session support by Astro / javascript,frameworks

🤪 Fun

A Daily Doodle Website as a Joyful Middle Finger to AI Art: Bakatako is a browser-based daily doodle site where art has to be drawn on its own canvas, so everything is human-made by Creative Bloq / fun,art / 16 min read
Firefox in WebAssembly: There is nothing to see here, it is just a browser running in your browser by Puter / wasm,fun / 1 min read

📺 Videos

Creator of TypeScript on the 10x Faster Compiler: Anders Hejlsberg on why Go over Rust, how little the rewrite leaned on LLMs, and whether AI replaces juniors by Ryan Peterman / typescript,ai
From Chrome DevTools to AI Engineering with Addy Osmani: 14 years at Google, the risk of cognitive surrender, and why an AI model can never be accountable by Gergely Orosz / ai,career

Want to read more? Check out the full article here.

To sign up for the weekly newsletter, visit weeklyfoo.com.

SQLite Bug Hunts, Leaked Reasoning Traces, and pnpm Goes Rust

Adam — Fri, 21 Aug 2026 04:48:02 +0000

Databases are having a moment — and not always a comfortable one. Tailscale spent six months chasing a recurring corruption bug before landing a fix inside SQLite itself, a sixteen-year-old bug hiding in plain sight. If that makes you feel better about your own incident timelines, PlanetScale's write-up on Postgres subtransactions will undo that: past 64 subtransactions, throughput drops from 7,200 TPS to 160 — a cliff nobody put on the map. On the upside, Michael Malis rebuilt the Postgres query engine with SIMD and operator fusion to get 300x analytics gains, and Shopify quietly replaced Redis with MySQL for inventory reservations using SKIP LOCKED for ACID guarantees — proof that sometimes the boring choice is the correct one.

The AI and security angle is uncomfortably lively. Simon Willison assembled the full timeline of how OpenAI's agents accidentally hammered Hugging Face, which reads like a cautionary tale about autonomous infra-probing at scale. Stolen Thoughts takes it further: encrypted reasoning traces, replayed into jailbroken sibling models, leaked keys, tokens, and PII across over 315,000 decoded blocks. And Matteo Collina describes triaging 20–40 AI-generated security reports a week as a maintainer — the pushback threshold has to go up or OSS maintainers will drown.

On the tooling front: pnpm 12 is a Rust rewrite with only three behavioural differences from pnpm 11 — respectably compatible for a ground-up rewrite. Docker Sandboxes runs coding agents in their own microVMs with a Docker daemon inside, solving isolation and reproducibility at once. Hunk is a terminal diff viewer built specifically for reviewing agent-written code, and njsscan 1.0 brings zero-config SAST to Node.js with about 70 semgrep rules out of the box. Finally, revision prompting makes the case for giving LLMs an input diff and asking for a patch instead of a rewrite — a small workflow change with real downstream payoff.

Enjoy!

Signup here for the newsletter to get the weekly digest right into your inbox.

Find the 12 highlighted links of weeklyfoo #150:

How Tailscale tracked down a 16-year-old SQLite bug

by Tailscale

Six months of recurring database corruption, ending in a fix inside SQLite itself.

🚀 Read it!, databases, debugging

Now we have a timeline of the OpenAI accidental attack against Hugging Face

by Simon Willison

Full breakdown of how OpenAI agents probing infrastructure ended up hammering Hugging Face, with the internal timeline of what happened.

📰 Good to know, security, ai

Triaging the AI Horde

by Matteo Collina

A maintainer on sorting real security bugs from 20-40 AI-written reports a week, and why the pushback threshold has to go up.

📰 Good to know, security, oss

We replaced Redis with MySQL for inventory reservations and it scaled

by Shopify

Shopify moved reservations to MySQL with SKIP LOCKED for ACID guarantees and fewer oversells on peak days.

📰 Good to know, database, mysql

Revision prompting improves industrial LLM processes

by Revision Prompting

Feed the model the original input, its original output and the input diff, then ask for a patch instead of a rewrite.

📰 Good to know, ai, llm

Stolen thoughts

by Stolen Thoughts

Encrypted reasoning traces replayed into jailbroken sibling models leaked keys, tokens and PII across 315,320 decoded blocks.

📰 Good to know, security, ai

The dangers of Postgres subtransactions

by PlanetScale

Past 64 subtransactions throughput fell from 7,200 TPS to 160, and new read replicas refuse connections.

📰 Good to know, postgres, performance

Rebuilding Postgres for 300x faster analytics

by Michael Malis

Batching, operator fusion and SIMD in a query engine, from the creator of pgrust.

📰 Good to know, postgres, performance

Docker Sandboxes

by Docker

Run coding agents in their own microVMs with a Docker daemon inside.

🧰 Tools, ai, docker

pnpm 12, the Rust rewrite

by pnpm

Release candidate with only three behavioural differences from pnpm 11.

🧰 Tools, tooling, pnpm

njsscan 1.0

by Ajin Abraham

Zero-config SAST for Node with around 70 semgrep rules for XSS, SSRF, eval, JWT and NoSQL injection.

🧰 Tools, security, nodejs

Hunk

by Ben Vinegar

A terminal diff viewer built to make reviewing agent-written code manageable.

🧰 Tools, cli, review

Want to read more? Check out the full article here.

To sign up for the weekly newsletter, visit weeklyfoo.com.

Stay ahead in web development: latest news, tools, and insights #150

Adam — Mon, 17 Aug 2026 04:55:55 +0000

Signup here for the newsletter to get the weekly digest right into your inbox.

weeklyfoo #150 is here: your weekly digest of all webdev news you need to know! This time you'll find 36 valuable links in 5 categories! Enjoy!

🚀 Read it!

How Tailscale tracked down a 16-year-old SQLite bug: Six months of recurring database corruption, ending in a fix inside SQLite itself. by Tailscale / databases, debugging / 20 min read

📰 Good to know

Now we have a timeline of the OpenAI accidental attack against Hugging Face: Full breakdown of how OpenAI agents probing infrastructure ended up hammering Hugging Face, with the internal timeline of what happened. by Simon Willison / security, ai / 6 min read
Triaging the AI Horde: A maintainer on sorting real security bugs from 20-40 AI-written reports a week, and why the pushback threshold has to go up. by Matteo Collina / security, oss / 4 min read
atproto for distributed systems engineers: Atproto explained as a shared data model plus public APIs for NoSQL services, aimed at decentralising high-scale backends. by atproto / distributed, protocols / 8 min read
We replaced Redis with MySQL for inventory reservations and it scaled: Shopify moved reservations to MySQL with SKIP LOCKED for ACID guarantees and fewer oversells on peak days. by Shopify / database, mysql / 15 min read
How we pushed CDC into Postgres and turned replication into clockwork: A push-based change data capture extension for Postgres that keeps data and schema changes in sync with low latency. by Snowflake / postgres, data / 12 min read
Revision prompting improves industrial LLM processes: Feed the model the original input, its original output and the input diff, then ask for a patch instead of a rewrite. by Revision Prompting / ai, llm / 5 min read
Migrating a large Flow monorepo to TypeScript: Yelp moved 1.4 million lines off Flow over several years, and the writeup reads as a guide to running any long migration. by Yelp / typescript, migration / 14 min read
How the Astro team built a software factory to slash its issue count: Agent-driven triage took Astro from over 200 open issues down to 30. by Matthew Phillips / ai, oss / 25 min read
Everything I learned shipping Device Bound Session Credentials: Sessions bound to a private key the browser generates in hardware and cannot export. by Scott Helme / security, web / 21 min read
Stolen thoughts: Encrypted reasoning traces replayed into jailbroken sibling models leaked keys, tokens and PII across 315,320 decoded blocks. by Stolen Thoughts / security, ai / 21 min read
When a job offer becomes a zero-day attack: Lazarus shipped modified PDF viewers into the defence sector and chained a zero-day into a rootkit. by Check Point / security / 25 min read
I put GitHub Copilot behind a MITM proxy: What Copilot actually sends home, from context assembly to interaction logging. by Lighthouse / security, ai / 18 min read
The dangers of Postgres subtransactions: Past 64 subtransactions throughput fell from 7,200 TPS to 160, and new read replicas refuse connections. by PlanetScale / postgres, performance / 18 min read
Rebuilding Postgres for 300x faster analytics: Batching, operator fusion and SIMD in a query engine, from the creator of pgrust. by Michael Malis / postgres, performance / 11 min read
Adding a second middleware broke our TypeScript types: A key-filtering idiom that leaks undefined on optional properties collapsed a return type to an empty object. by Linell Bonnette / typescript, debugging / 13 min read

🧰 Tools

Hucre: Zero-dependency, tree-shakeable spreadsheet engine with embedded images, hyperlinks, password protection and pivot tables. by Wind / javascript, library
TanStack Table v9: Tree-shakeable architecture, state moved to TanStack Store, and big memory wins on large datasets. by Kevin Van Cott / react, library
Docker Sandboxes: Run coding agents in their own microVMs with a Docker daemon inside. by Docker / ai, docker
scriptc: An experimental TypeScript-to-native compiler from Vercel Labs, falling back to a bundled QuickJS engine for dynamic parts. by Vercel Labs / typescript, compiler
pnpm 12, the Rust rewrite: Release candidate with only three behavioural differences from pnpm 11. by pnpm / tooling, pnpm
OpenChamber: An agentic development environment that keeps code and session data local across multiple models. by OpenChamber / ai, tooling
sqlfmt: A gofmt-style formatter for SQL, with a web version for prepping queries in slides and posts. by Dimitri Fontaine / sql, tooling
Sourcebot: Self-hosted code search, navigation and question answering across many repositories. by Sourcebot / oss, search
njsscan 1.0: Zero-config SAST for Node with around 70 semgrep rules for XSS, SSRF, eval, JWT and NoSQL injection. by Ajin Abraham / security, nodejs
Vitest 5.0 release candidate: The next major of the Vite-native test runner is up for testing. by Vitest / testing, tooling
Hunk: A terminal diff viewer built to make reviewing agent-written code manageable. by Ben Vinegar / cli, review
Biome useReactCompiler rule: Runs React Compiler in lint mode and reports which components and hooks would not compile safely. by Biome / tooling, react
Foreman: A software factory that moves each GitHub or Linear task through classifier, analyst, implementer and reviewer stations. by Vercel Labs / ai, agents
Computer: Give your agent a computer. by Cloudflare / ai, agents
Argos: Visual review of product changes, so teammates and agents can comment on the diffs before merge. by Argos / testing, review

🤪 Fun

Plethora: A world of tiny interactive bits, games, art, music, puzzles and strange little experiences. by Plethora / interactive, fun / 4 min read
js1024 2026 results: Three winners in 1024 bytes of JavaScript, with readable and minified source so you can steal the techniques. by js1024 / javascript, fun / 33 min read

📺 Videos

Everything you learned about SSL is deprecated: TLS 1.3, forward secrecy going mandatory, free certificates, and lifetimes falling to 47 days. by Todd Gardner / security, tls
How Anthropic uses Claude Code, agentic software engineering at scale: The context engineering primitives behind plugins and agent teams, and why the KV cache makes swapping rules expensive. by Daisy Hollman / ai, engineering
It is like 10,000 streams when what you need is a queue: Event sourcing, Kafka and RabbitMQ, and the head of line blocking you get from picking wrong. by Chris Simon / architecture, messaging

Want to read more? Check out the full article here.

To sign up for the weekly newsletter, visit weeklyfoo.com.

Supply-Chain Worms, Edge SQLite, and Lying JSON

Adam — Fri, 14 Aug 2026 05:18:32 +0000

This week has two recurring themes: supply chains are on fire, and infrastructure keeps getting weirder in a good way. The high-signal alert is Socket's report on the keyv/cacheable compromise, plus Better Stack's video on the worm that hopped from npm into Go — together they make a convincing case for treating package updates like unexploded ordnance, just with semver.

On the protocol and platform side, Stateless MCP is the kind of change that makes a spec feel instantly more practical, Cloudflare Computer turns Durable Objects into a tiny SQLite-backed machine room, and Workers gaining inbound TCP and gRPC quietly expands what an edge app can be.

There are also a few excellent reminders that the boring details are never actually boring: Your JSON is lying to you catalogs the silent breakage around BigInt, Date and undefined, Promise.allKeyed reaching stage 3 promises less async object-wrangling, and a Ruby warning hunt that cut heap usage by 60% is pure performance-detective catnip.

The standout deep read is PlanetScale's massively parallel Postgres backup write-up, which is delightfully large-scale and slightly intimidating. And on the tools side, gh stack makes stacked PRs less painful, Varlock tries to keep your env files AI-safe without wrecking your workflow, and Syncular bets that local-first SQLite plus CRDT conflict resolution should be your default starting point.

Enjoy!

Signup here for the newsletter to get the weekly digest right into your inbox.

Find the 12 highlighted links of weeklyfoo #149:

Massively parallel Postgres backups

by PlanetScale

Consistent encrypted snapshots of petabyte-scale sharded Postgres every 12 hours via WAL replay and parallelism across shards

🚀 Read it!, postgres,database,infra

Curiosity reduced the heap size by 60%

by Mostly Obvious

Chasing a filtered-out Ruby warning revealed OpenTelemetry force-loading 200 AWS SDK classes at boot, cutting heap 60% and boot time 36%

📰 Good to know, ruby,performance,debugging

Cloudflare Computer

by Cloudflare

A virtual file system inside a Durable Object with SQLite as authoritative state, running agent code in isolates, containers or a browser

📰 Good to know, cloudflare,agents,infra

keyv and cacheable compromised by a credential-stealing worm

by Socket

An active npm supply chain incident with hundreds of packages affected so far

📰 Good to know, security,npm,supplychain

Your JSON is lying to you

by Gabor Koos

A parse and stringify round trip quietly mangles big integers, undefined and Date, so make the conversion boundaries explicit

📰 Good to know, javascript,json

Cloudflare Workers adds inbound TCP connections and gRPC

by Cloudflare

Workers can now terminate raw TCP and speak gRPC, currently in private beta

📰 Good to know, cloudflare,workers

Await dictionary of Promises reaches stage three

by TC39

Promise.allKeyed lets you await an object of promises and destructure the result

📰 Good to know, javascript,tc39

Stateless MCP has recaptured my interest

by Simon Willison

MCP 2.0 drops the session requirement, making servers far simpler to build

📰 Good to know, ai,mcp

gh stack

by GitHub

GitHub CLI extension for stacked PRs that automates branch creation, rebasing and PR base branches, with AI agent integration

🧰 Tools, git,cli,github

Varlock

by Theo Ephraim

Makes your env files AI-safe without breaking your app

🧰 Tools, tools,security,ai

Syncular

by Syncular

Offline-first SQL sync giving every client a local SQLite database backed by a server-side commit log, with CRDT conflict resolution

🧰 Tools, sqlite,sync,tools

The largest supply chain attack just infected Go

by Better Stack

The Shai Hulud worm jumped ecosystems from npm to Go, and what that means for both

📺 Videos, security,supplychain,go

Want to read more? Check out the full article here.

To sign up for the weekly newsletter, visit weeklyfoo.com.

Stay ahead in web development: latest news, tools, and insights #149

Adam — Mon, 10 Aug 2026 06:08:36 +0000

Signup here for the newsletter to get the weekly digest right into your inbox.

weeklyfoo #149 is here: your weekly digest of all webdev news you need to know! This time you'll find 36 valuable links in 5 categories! Enjoy!

🚀 Read it!

Massively parallel Postgres backups: Consistent encrypted snapshots of petabyte-scale sharded Postgres every 12 hours via WAL replay and parallelism across shards by PlanetScale / postgres,database,infra / 12 min read

📰 Good to know

Curiosity reduced the heap size by 60%: Chasing a filtered-out Ruby warning revealed OpenTelemetry force-loading 200 AWS SDK classes at boot, cutting heap 60% and boot time 36% by Mostly Obvious / ruby,performance,debugging / 4 min read
The development pipeline is a production system: A team with a broken pipeline cannot produce software, so treat it like production by Jerry Orr / engineering,ci / 3 min read
Next.js 16.3: Lower dev memory, faster builds, Instant Navigations and Partial Prefetching without touching application code by Vercel / nextjs,react,frontend / 15 min read
Cloudflare Computer: A virtual file system inside a Durable Object with SQLite as authoritative state, running agent code in isolates, containers or a browser by Cloudflare / cloudflare,agents,infra / 26 min read
keyv and cacheable compromised by a credential-stealing worm: An active npm supply chain incident with hundreds of packages affected so far by Socket / security,npm,supplychain / 13 min read
Your JSON is lying to you: A parse and stringify round trip quietly mangles big integers, undefined and Date, so make the conversion boundaries explicit by Gabor Koos / javascript,json / 28 min read
Cloudflare Workers adds inbound TCP connections and gRPC: Workers can now terminate raw TCP and speak gRPC, currently in private beta by Cloudflare / cloudflare,workers / 25 min read
Stacked pull requests are now in public preview: GitHub gets native support for chaining dependent PRs by GitHub / git,github / 7 min read
Await dictionary of Promises reaches stage three: Promise.allKeyed lets you await an object of promises and destructure the result by TC39 / javascript,tc39 / 8 min read
Soft navigations enter the mainstream: Chrome 151 ships PerformanceSoftNavigation so SPA route changes can finally be measured properly by Chrome / performance,frontend / 23 min read
Cloudflare Wallets: A programmable wallet giving agents a username and spending limits so they can pay for APIs on their own by Cloudflare / cloudflare,agents,payments / 25 min read
Stateless MCP has recaptured my interest: MCP 2.0 drops the session requirement, making servers far simpler to build by Simon Willison / ai,mcp / 8 min read
Case-folding source code at memory speed: GitHub's Blackbird code search folds ASCII at over 45 GiB/s per core with a branch-free loop and byte-space arithmetic by GitHub / performance,search,systems / 31 min read
How Cloudflare enforces engineering standards using AI: Codex is a governed set of standards that agents retrieve and apply at the point of work by Cloudflare / engineering,ai,cloudflare / 26 min read
iCloud Private Relay is leaking real IP addresses: Sites that use, or merely pretend to use, passkeys can pull the address the relay was supposed to hide by MacRumors / security,privacy,apple / 13 min read

🧰 Tools

gh stack: GitHub CLI extension for stacked PRs that automates branch creation, rebasing and PR base branches, with AI agent integration by GitHub / git,cli,github
use-webmcp-tool: React hook exposing app functions as callable tools for browser AI agents via the experimental WebMCP spec by Google Chrome Labs / react,ai,mcp
OpenWork: Open source alternative to Claude Cowork by different-ai / ai,agents,opensource
TanStack Charts: Framework-neutral declarative chart grammar rendering to SVG or canvas, styled however you want by TanStack / dataviz,javascript,tools
Virtua: Small fast virtual list and grid component for React, Vue, Solid, Svelte and Angular by inokawa / frontend,performance,tools
Varlock: Makes your env files AI-safe without breaking your app by Theo Ephraim / tools,security,ai
better-result: Lightweight Result type for TypeScript with generator-based composition by Dylan Mulroy / typescript,tools
vlt 1.0: Drop-in npm alternative whose query command runs 60+ CSS-like selectors over your dependency graph by Darcy Clarke / npm,tools,cli
anydoc: Rust library with Node and WASM bindings converting 14 document formats into Markdown, including a 1600 page PDF in under two seconds by Firecrawl / tools,documents,rust
devalue 5.9: Like JSON.stringify but handles cyclical references, regexes, Map, Set and custom types by Svelte / javascript,tools
Blossom Carousel: Builds on native scrolling instead of replacing it, and only loads the drag engine when a pointer device shows up by Jesper Vos / frontend,ui,tools
ffmpeg webCLI: Browser-based video editor running 30+ operations locally through ffmpeg.wasm with no upload by Tejaswi Gowda / video,wasm,tools
Syncular: Offline-first SQL sync giving every client a local SQLite database backed by a server-side commit log, with CRDT conflict resolution by Syncular / sqlite,sync,tools
unbash: Zero dependency bash parser by webpro / bash,tools
celld: Self-hosted distributed Durable Objects and Workers, one SQLite database per object, coordinated through an S3-compatible bucket by Ryan Dahl / deno,durableobjects,tools
Base UI 1.7: Smaller component bundles for the unstyled library that is now the shadcn/ui default by Base UI / react,ui,tools

🤪 Fun

Mow the lawn as efficiently as you can: A silly puzzle that doubles as a lesson in interactive storytelling by The Pudding / fun,dataviz / 11 min read

📺 Videos

The largest supply chain attack just infected Go: The Shai Hulud worm jumped ecosystems from npm to Go, and what that means for both by Better Stack / security,supplychain,go
JavaScript has a third comment syntax: Hashbang comments are real, in the spec, and shown off in two minutes by Mat Marquis / javascript
How SQLite got its reliability reputation: Richard Hipp on the tools, practices and design choices behind it, in 50 minutes by Richard Hipp / sqlite,database,testing

Want to read more? Check out the full article here.

To sign up for the weekly newsletter, visit weeklyfoo.com.

Stateless MCP, Tiny Executables, and Claude Cracks Crypto

Adam — Fri, 07 Aug 2026 05:31:28 +0000

The headline this week belongs to supply-chain hygiene: Andrey Sitnik — the person behind postcss and nanoid — explains staged publishing, trusted publishing, and provenance in the clearest current npm release playbook out there. And as if on cue, GitHub announced npm now scans every package for malware at publish time — new versions can be held or blocked outright, which is either reassuring or slightly terrifying depending on your deploy pipeline.

The context engineering conversation keeps evolving. Anthropic cut over 80% of Claude Code's system prompt for the newer models — smaller prompts, progressive disclosure through skills, CLAUDE.md and memory instead of prompt bloat. Meanwhile, Alessandro Fazio walked through every journal file, cache, and index behind a Codex conversation — a file-level tour that changes how you think about what "delete thread" actually means.

Tooling was unusually interesting this week. Vercel Labs' scriptc compiles ordinary TypeScript into native executables with ~2ms startup and 170–200KB static builds — no Node, no V8. Octane compiles React's programming model away entirely ahead of time, no VDOM, no hooks bookkeeping. TurboFieldfare runs Gemma 4 26B on Apple Silicon in roughly 2GB of RAM by streaming weights rather than loading all 14GB at once — a cheat code for local-model experiments. And Claude Code Merge Queue solves a very 2026 problem: parallel coding agents racing each other to push.

On the security and observability side: Figma's agent-based vulnerability workflow hit 70% precision before allowing agents to comment on PRs, and a shared policy became a de facto threat model. Anthropic's Claude weakened HAWK and sped up an AES attack by 800x, mostly unsupervised for a week — the strongest public example yet of AI doing real applied cryptanalysis. And MCP's largest update since launch goes stateless, finally letting remote servers run on serverless and edge infra.

The standout read is Canva's session revocation teardown: encrypted cookies, in-memory lookups, and why moving revocation records to S3 cut database load at hundreds-of-millions-of-users scale.

Also worth a look: Harry Roberts' Container Timing API piece brings per-component render timings straight from the browser (currently an origin trial), and Sentry's log structure guide makes the case for stable event names and lint-enforced attribute keys — the boring discipline that makes logs usable months later.

Enjoy!

Signup here for the newsletter to get the weekly digest right into your inbox.

Find the 15 highlighted links of weeklyfoo #148:

Session revocations at scale

by Canva

How Canva revokes sessions for hundreds of millions of users with encrypted cookies and in-memory lookups, and why moving revocation records to S3 cut database load and shrank the cache

🚀 Read it!, engineering, security, scale

The new rules of context engineering for Claude 5 generation models

by Anthropic

Anthropic cut over 80% of Claude Code's system prompt for the newer models — smaller prompts, progressive disclosure through skills, and context assembled from skills, CLAUDE.md and memory instead

📰 Good to know, ai, agents, claude

The life of a Codex conversation on disk

by Alessandro Fazio

Walkthrough of the journal file, caches and indexes behind a Codex chat — and why clearing a thread is not the same as deleting it

📰 Good to know, ai, agents, tools

How to structure a log

by Sentry

Stable event names, scoped attribute keys, primitive values — and enforcing the conventions with ESLint so logs stay queryable months later

📰 Good to know, observability, logging

Measuring component performance with the Container Timing API

by Harry Roberts

Per-component render timings straight from the browser, now in a Chrome origin trial

📰 Good to know, performance, web

Discovering cryptographic weaknesses with Claude

by Anthropic

A model halved the effective key strength of the HAWK signature scheme and sped up an attack on reduced-round AES by up to 800x, working mostly on its own for a week

📰 Good to know, ai, security, cryptography

MCP gets its largest update since launch

by MCP

The protocol goes stateless, so remote servers run on serverless and edge infra or scale horizontally behind a load balancer

📰 Good to know, ai, mcp, protocols

How Figma stays ahead of vulnerabilities with agents

by Figma

Precision over recall was the whole game — 70% before agents were allowed to comment on PRs, and the shared policy became a de facto threat model

📰 Good to know, security, ai, agents

The secure way to release an npm package in 2026

by Andrey Sitnik

Staged publishing, trusted publishing and provenance, explained by the person behind postcss and nanoid

📰 Good to know, npm, security, javascript

scriptc

by Vercel Labs

Compiles ordinary TypeScript into small native executables — no Node, no V8 in the binary, ~2ms startup and 170–200KB static builds

🧰 Tools, typescript, compiler, tools

Octane

by Dominic Gannaway

React's programming model compiled ahead of time — no VDOM, no rules-of-hooks bookkeeping, JSX and TSX supported

🧰 Tools, javascript, react, framework

Codex Security

by OpenAI

CLI and TypeScript SDK that scans repos for vulnerabilities, validates them, and tracks findings over time

🧰 Tools, security, cli, tools

TurboFieldfare

by drumih

Runs Gemma 4 26B on Apple Silicon in roughly 2GB of RAM by streaming weights instead of loading all 14.3GB at once

🧰 Tools, ai, llm, tools

Claude Code Merge Queue

by funador

Local merge queue for parallel coding agents, so simultaneous landings stop racing each other on push

🧰 Tools, ai, agents, tools

PGSimCity

by Nikolay Samokhvalov

Postgres internals as a 3D city you can walk around in and break on purpose

🤪 Fun, postgres, fun

Want to read more? Check out the full article here.

To sign up for the weekly newsletter, visit weeklyfoo.com.

Stay ahead in web development: latest news, tools, and insights #148

Adam — Mon, 03 Aug 2026 05:14:14 +0000

Signup here for the newsletter to get the weekly digest right into your inbox.

weeklyfoo #148 is here: your weekly digest of all webdev news you need to know! This time you'll find 36 valuable links in 5 categories! Enjoy!

🚀 Read it!

Session revocations at scale: How Canva revokes sessions for hundreds of millions of users with encrypted cookies and in-memory lookups, and why moving revocation records to S3 cut database load and shrank the cache by Canva / engineering, security, scale / 12 min read

📰 Good to know

The new rules of context engineering for Claude 5 generation models: Anthropic cut over 80% of Claude Code's system prompt for the newer models — smaller prompts, progressive disclosure through skills, and context assembled from skills, CLAUDE.md and memory instead by Anthropic / ai, agents, claude / 23 min read
The life of a Codex conversation on disk: Walkthrough of the journal file, caches and indexes behind a Codex chat — and why clearing a thread is not the same as deleting it by Alessandro Fazio / ai, agents, tools / 2 min read
How to structure a log: Stable event names, scoped attribute keys, primitive values — and enforcing the conventions with ESLint so logs stay queryable months later by Sentry / observability, logging / 42 min read
Modeling facts and reactions with domain events: Separating a fact from its consequences so reactions can fail, evolve and scale without dragging the core business logic along by Denis Kyashif / architecture, ddd / 10 min read
Domenic Denicola's agentic coding setup: Disposable VMs, Tailscale and worktrees — how a longtime JavaScript standards figure runs coding agents day to day by Domenic Denicola / ai, agents, workflow / 22 min read
Measuring component performance with the Container Timing API: Per-component render timings straight from the browser, now in a Chrome origin trial by Harry Roberts / performance, web / 24 min read
Discovering cryptographic weaknesses with Claude: A model halved the effective key strength of the HAWK signature scheme and sped up an attack on reduced-round AES by up to 800x, working mostly on its own for a week by Anthropic / ai, security, cryptography / 22 min read
Kimi K3 architecture notes: LatentMoE, attention residuals, and dropping RoPE in favour of NoPE in a bigger open-weight model by Sebastian Raschka / ai, ml, architecture / 4 min read
MCP gets its largest update since launch: The protocol goes stateless, so remote servers run on serverless and edge infra or scale horizontally behind a load balancer by MCP / ai, mcp, protocols / 7 min read
How Figma stays ahead of vulnerabilities with agents: Precision over recall was the whole game — 70% before agents were allowed to comment on PRs, and the shared policy became a de facto threat model by Figma / security, ai, agents / 28 min read
The secure way to release an npm package in 2026: Staged publishing, trusted publishing and provenance, explained by the person behind postcss and nanoid by Andrey Sitnik / npm, security, javascript / 28 min read
npm now scans every package for malware at publish time: New versions can take minutes to become installable, and can be held or blocked outright by GitHub / npm, security / 6 min read
How GitHub is disrupting supply chain attacks on npm and Actions: The registry and Actions changes designed to cut off the techniques attackers keep reusing by GitHub / security, npm, github / 19 min read
Treat prompt changes like code deploys: Prompts are dependencies that shift production behaviour with no failing build, so gate them and default the gate to blocking by Luke Murray / ai, engineering / 6 min read
The economic benefit of refactoring: Refactoring an AI-generated codebase cut token consumption for later updates by 83 percent and made navigation cheaper by Martin Fowler / engineering, refactoring, ai / 18 min read
Your SPA is leaking memory, soak test it: Loop a Playwright flow in a single browser context and watch DOM node and listener counts to catch the leak before users do by Den Odell / javascript, performance, testing / 15 min read

🧰 Tools

scriptc: Compiles ordinary TypeScript into small native executables — no Node, no V8 in the binary, ~2ms startup and 170–200KB static builds by Vercel Labs / typescript, compiler, tools
hilos: Team chat where AI coding agents are members of the channel next to the humans — plan in a thread, the agent works on the repo and comes back with a PR to review by Pablo Stanley / ai, agents, tools
Octane: React's programming model compiled ahead of time — no VDOM, no rules-of-hooks bookkeeping, JSX and TSX supported by Dominic Gannaway / javascript, react, framework
tslog 5: Zero-dependency logger for Node, Deno, Bun and browsers — pretty or JSON output, transports, secret masking, stacks mapped back to your TypeScript lines by Eugene Terehov / typescript, logging, tools
eslint-package-json: ESLint rules that catch bad names, broken exports and invalid version ranges in package.json, and autofix most of them by Sindre Sorhus / javascript, linting, tools
Seal: Open standard for proving a file is real — sealed artifacts anchored to a public ledger that prove integrity, time and issuing certificate by Seal / security, tools
htmx 4.0: Fourth major version of the library, released — of course — on a Game Boy cartridge by htmx / web, html, tools
Codex Security: CLI and TypeScript SDK that scans repos for vulnerabilities, validates them, and tracks findings over time by OpenAI / security, cli, tools
pgGraph: Postgres extension for graph search, traversal, shortest path and relationship queries straight against ordinary tables by Evokoa / postgres, databases, tools
TurboFieldfare: Runs Gemma 4 26B on Apple Silicon in roughly 2GB of RAM by streaming weights instead of loading all 14.3GB at once by drumih / ai, llm, tools
Claude Code Merge Queue: Local merge queue for parallel coding agents, so simultaneous landings stop racing each other on push by funador / ai, agents, tools
numbat: Endpoint visibility into what AI agents actually do, with optional pre-action blocking and forensic reconstruction by Perplexity / ai, security, tools
jsdom 30: The browser environment emulator behind countless test suites picks up CSS.escape, CSS.supports and background-position-x by jsdom / javascript, testing, tools
Ada v4: The WHATWG-compliant URL parser Node depends on gets another speed pass by Yagiz Nizipli / nodejs, performance, tools
modern-tar: Zero-dependency streaming tar parser and writer by ayuhito / javascript, tools

🤪 Fun

PGSimCity: Postgres internals as a 3D city you can walk around in and break on purpose by Nikolay Samokhvalov / postgres, fun / 1 min read
A chat app that rewrites its own UI in real time: Raw HTML, CSS and JavaScript streamed straight into the DOM, so the model rebuilds its own interface into games and themes while you talk to it by Varshith V Hegde / ai, fun / 23 min read

📺 Videos

The creator of TypeScript shows off TypeScript 7: Anders Hejlsberg demos the Go-based compiler running 10x faster on VS Code's 1.3M line codebase, plus the new LSP language server by Anders Hejlsberg / typescript, video
React debugging with performance tracks: 15 minute tour of the React-specific entries that now show up in your browser DevTools by Shruti Kapoor / react, video

Want to read more? Check out the full article here.

To sign up for the weekly newsletter, visit weeklyfoo.com.

Agent Swarms, Gemini Chips, and LLMs That Fail Self-Review

Adam — Fri, 31 Jul 2026 04:37:38 +0000

The standout this week arrives courtesy of mathematics: Kevin Buzzard's post documents AI tools now writing Lean proofs for theorems they discovered themselves — the formalization feedback loop has inverted, and human mathematicians are running to keep up. Not a hypothetical; it's happening now.

Agent economics dominate the rest of the issue. Cursor's deep dive into planner-plus-worker swarms shows they beat a single frontier model on speed, quality, and cost. Stencil's prewalk pattern gives the approach a name and a workflow: have the frontier model explore and dump its understanding to a todo list, then hand execution to a cheaper model. Adam Jacob goes a step further and shows how structuring agent tasks into deterministic code cut token usage 8x — real before-and-after numbers, not vibes. Netflix spent the same energy differently: benchmarking vLLM and Triton to build their own serving stack rather than paying hosted API bills. And Google is going further still: fusing Gemini's architecture directly into silicon, so the hardware runs one model by design.

One finding deserves its own paragraph: Greptile's study shows Claude Code and Codex each catch more bugs in the other model's output than in their own. Cross-model routing for code review is no longer just a fun idea — it's the obvious call.

Security delivered a string of memorable entries. Elastic's report on the Contagious Interview campaign hides malware inside SVG images inside a fake coding-interview challenge — targeted, specific, and realistic for any JavaScript developer. Socket.dev catalogued 53 slopsquatting targets across five popular LLMs: the fake npm package names models keep hallucinating, mapped to how fast attackers are registering them. And Matteo Collina lays out why you cannot harden Node core against prototype pollution — the fix belongs at the boundary, not the runtime.

Rounding out the issue: Fetch gets typed error codes thanks to a TC39 proposal that would end the era of every network failure collapsing into a bare TypeError. Arshad Yaseen shows data-oriented design producing a JavaScript parser faster than Oxc, SWC, and Babel, with the full engineering story. Ben Dicken's animated explainer on routing queries across a petabyte of Postgres presented as a single database. Sunil Pai frames a UX problem nobody has solved yet: what does it look like when an agent is editing the same document you are, simultaneously? And Oxc type-aware linting lands stable — unhandled promises, unsafe assignments, all in Rust.

On the tools front: LoopGain cuts agent loops the moment iterations stop improving (someone had to build this), Claude Thermos keeps the prompt cache warm through long multi-subagent sessions so you don't get re-billed for re-encoding, A11Y.md hands AI agents enforceable WCAG-aligned accessibility rules as a context file, and Shadscan runs nearly 60 deterministic accessibility and composition checks on your shadcn components.

Enjoy!

Signup here for the newsletter to get the weekly digest right into your inbox.

Find the 19 highlighted links of weeklyfoo #147:

In-House LLM Serving at Netflix

by Netflix

How Netflix built an in-house LLM serving platform on vLLM and Triton instead of hosted APIs

📰 Good to know, ai,infra

Fetch Needs Error Codes

by James Snell

Fetch collapses every network failure into a bare TypeError, and a TC39 proposal would thread typed error codes through

📰 Good to know, javascript,web

No, We Can't Harden Node.js Against Prototype Pollution

by Matteo Collina

Matteo Collina argues you cannot harden Node core against prototype pollution and the fix belongs at the boundary

📰 Good to know, security,nodejs

A Practical Guide to Reducing Token Spend

by Adam Jacob

A swamp workflow structures agent tasks into deterministic code and cut token usage 8x

📰 Good to know, ai,agents

Agent Swarms and the New Model Economics

by Cursor

Planner agents decompose work and cheaper workers execute it, beating a single frontier model on speed, quality and cost

📰 Good to know, ai,agents

You Only Need the Frontier Model for One Single Edit

by Stencil

Have the frontier model explore and dump its understanding to a todo list before handing execution to a cheaper model

📰 Good to know, ai,agents

Google Is Building a Chip With Gemini Baked Into the Silicon

by The Next Web

Fusing one model's architecture into the circuitry instead of running any model on general hardware

📰 Good to know, ai,hardware

Human Mathematicians Are Being Outcounterexampled

by Kevin Buzzard

AI tools now solve theorems and write Lean proofs to prove their own results, speeding up formalization research

📰 Good to know, ai,math

One Document, Two Hands

by Sunil Pai

Designing for the case where an agent is a guest in your app, editing the same document you are

📰 Good to know, ai,agents

Engineering High-Performance Parsers with Data-Oriented Design

by Arshad Yaseen

How data-oriented design built Yuku, a JavaScript parser faster than Oxc, SWC or Babel

📰 Good to know, javascript,performance

How a Fake Interview's Coding Challenge Steals Credentials

by Elastic

A North Korean campaign hides malware in SVG images inside a fake job interview JavaScript coding challenge

📰 Good to know, security

Models Are Worse at Reviewing Their Own Code

by Greptile

Claude Code and Codex each catch more bugs in the other model's code than their own, so route reviews across models

📰 Good to know, ai,agents

Making 768 Servers Look Like 1

by Ben Dicken

An animated explainer of how a petabyte of Postgres across 256 shards presents as one database

📰 Good to know, database

Oxc Type-Aware Linting Is Stable

by Oxc

Rules relying on the TypeScript type system, like unhandled promises and unsafe assignments, now land in the Rust linter

📰 Good to know, javascript,tools

53 Slopsquatting Targets Across 5 Popular LLMs

by Sarah Gooding

A study of the fake npm package names LLMs keep inventing, and how attackers register them

📰 Good to know, security,ai

LoopGain

by LoopGain

Open-source tool that stops AI agent loops once iterations no longer improve

🧰 Tools, ai,agents,tools

A11Y.md

by Felipe Arriaga Carrico

Context system giving AI agents enforceable accessibility rules aligned with WCAG

🧰 Tools, ai,tools

Claude Thermos

by Ivan Zeigerman

Keeps the prompt cache warm during long agent sessions so waiting on subagents doesn't re-bill re-encoding

🧰 Tools, ai,agents,tools

Shadscan

by OrcDev

Static analysis for shadcn components with almost 60 deterministic accessibility, state and composition checks

🧰 Tools, react,tools

Want to read more? Check out the full article here.

To sign up for the weekly newsletter, visit weeklyfoo.com.