DEV Community: Adam

Code Is Cheap, Burnout Is Not

Adam — Fri, 19 Jun 2026 04:43:27 +0000

The theme of the week is unmistakable: AI writes the code, and now everything else is the bottleneck. Christoph Nakazawa argues that with agents generating more code than humans, what matters has shifted — ownership, taste, and strict-but-fast feedback loops beat raw throughput. Carson Gross puts it bluntly: if code costs nothing to write, the bottleneck is judgment. Addy Osmani makes it explicit: undocumented goals and rationale are now high-interest technical debt in AI-assisted engineering. And Builder.io calls it: agent experience (AX) is the new developer experience.

The bad news? Evil Martians brings data showing AI-assisted engineers are burning out — hidden cognitive overload, decreased fulfillment, and lost ownership are real costs the productivity headlines skip.

On the practical front: react.doctor breaks down why useEffect keeps surprising everyone (dependency model bugs in disguise), and performance.dev documents how a Tauri+SQLite app rebuilt with TanStack Router came out twice as fast. TanStack AI just dropped in beta — framework-agnostic, composable, and potentially the React Query moment for application-level AI.

Supply chain this week: npm v12 ships default-deny for install scripts after a year of attack headlines, and DepsGuard brings policy-as-code for your package manager config across npm, pnpm, yarn, and bun. sem adds semantic version control on top of Git — diff at the function level, not the line level. pg_durable brings exactly-once task execution inside Postgres, potentially retiring your entire message queue tier. free-email-domains gives you every known free email provider in one maintained list, and asm unifies Claude Code, Cursor, and Windsurf agent skills from a single CLI.

Enjoy!

Signup here for the newsletter to get the weekly digest right into your inbox.

Find the 12 highlighted links of weeklyfoo #141:

The Intent Debt

by Addy Osmani

Undocumented goals and rationale are technical debt that agentic AI makes far more expensive

🚀 Read it!, ai, engineering, documentation

The Problem with useEffect

by react.doctor

Why useEffect runs more than expected and how to fix it with useMemo and useCallback

📰 Good to know, react, hooks

The Conductor Rewrite

by performance.dev

How a Tauri React app backed by SQLite was rebuilt to run twice as fast with TanStack Router and react-virtuoso

📰 Good to know, react, performance, tauri

Modern Engineering Values

by Christoph Nakazawa

With agents writing more code, the values that matter shift — ownership, taste, and strict-but-fast feedback loops matter more than raw throughput

📰 Good to know, engineering, ai, culture

npm v12 to Stop Running Install Scripts by Default

by GitHub

After a year of supply chain attacks, npm v12 will no longer execute pre/install/postinstall scripts unless explicitly approved via a new npm approve-scripts workflow

📰 Good to know, npm, security, javascript

AI-Assisted Engineers Are Burning Out. Is This Fine?

by Evil Martians

AI tools introduce hidden cognitive costs — overload, decreased fulfillment, and lost ownership — making AI a productivity trap for many developers

📰 Good to know, ai, engineering, culture

TanStack AI in Beta

by TanStack

Framework and provider-agnostic AI toolkit for React, Vue, Solid, and Angular — brings TanStack's composable headless philosophy to AI integrations

📰 Good to know, react, ai, javascript

sem

by Ataraxy Labs

Semantic version control on top of Git that shows what entities changed (functions, methods, classes) not just lines

🧰 Tools, cli, git, developer-tools

pg_durable

by Microsoft

PostgreSQL extension for durable, exactly-once execution of long-running tasks

🧰 Tools, postgresql, database, tools

free-email-domains

by Kikobeats

Maintained list of every known free email provider — useful for filtering sign-ups or validating email inputs

🧰 Tools, tools, security, email

asm

by luongnv89

Unified CLI for managing AI agent skills across Claude Code, Cursor, and Windsurf — install, search, and audit capabilities from one place

🧰 Tools, tools, cli, ai

DepsGuard

by Arnica

Rust-based tool that audits and rewrites your package manager config to disable install scripts, enforce cooldowns, and block provenance downgrades across npm, pnpm, yarn, and bun

🧰 Tools, tools, security, npm

Want to read more? Check out the full article here.

To sign up for the weekly newsletter, visit weeklyfoo.com.

Stay ahead in web development: latest news, tools, and insights #141

Adam — Mon, 15 Jun 2026 04:56:47 +0000

Signup here for the newsletter to get the weekly digest right into your inbox.

weeklyfoo #141 is here: your weekly digest of all webdev news you need to know! This time you'll find 42 valuable links in 4 categories! Enjoy!

🚀 Read it!

The Intent Debt: Undocumented goals and rationale are technical debt that agentic AI makes far more expensive by Addy Osmani / ai, engineering, documentation / 10 min read

📰 Good to know

The Problem with useEffect: Why useEffect runs more than expected and how to fix it with useMemo and useCallback by react.doctor / react, hooks / 4 min read
The Conductor Rewrite: How a Tauri React app backed by SQLite was rebuilt to run twice as fast with TanStack Router and react-virtuoso by performance.dev / react, performance, tauri / 16 min read
How LLMs Actually Work: Tokens, embeddings, attention, transformers, and residual connections explained from the ground up by @0xkato / ai, llm, ml / 25 min read
The Hidden Why: Behavioral Economics for UX: How psychological and social factors drive user behavior, and the 3B Framework for designing around friction by Nielsen Norman Group / ux, design, product / 11 min read
How to Make Your Design System AI-Ready: Hard-coded values and undocumented decisions break AI prototyping — structured tokens and documented constraints fix it by Smashing Magazine / design-systems, ai, frontend / 7 min read
Announcing Angular v22: Signal Forms, Angular Aria, and async reactivity graduate to stable; new experimental features include async DI, template improvements, and error boundaries by The Angular Team / angular, javascript, frontend / 1 min read
Modern Engineering Values: With agents writing more code, the values that matter shift — ownership, taste, and strict-but-fast feedback loops matter more than raw throughput by Christoph Nakazawa / engineering, ai, culture / 14 min read
Code Is Cheap: If code costs nothing to write, the bottleneck shifts to judgment — knowing what to build, what to delete, and what the system actually needs by Carson Gross / engineering, ai, simplicity / 5 min read
State of the Software Engineering Job Market in 2026, Part 2: AI engineering comp now exceeds software engineering comp; frontend-only roles are shrinking fastest; intern intake keeps falling even as hiring recovers by The Pragmatic Engineer / engineering, career, ai / 11 min read
Initial Impressions of Claude Fable 5: Hands-on notes on the new model — 1M token context, stricter guardrails, and API fallback support when safety filters trigger by Simon Willison / ai, claude, llm / 14 min read
Agent Experience Is the New Developer Experience: As AI agents become active contributors, engineering must shift from DX to AX — deterministic context layers, scoped permissions, and reliable workspaces for stateless models by Builder.io / ai, engineering, agents / 16 min read
Doing Nothing at Work: Why an 80% utilization rate protects engineers from burnout and keeps them available for high-impact opportunities by Sean Goedecke / engineering / 11 min read
Loop Engineering: Replace yourself as the agent prompter with an automated loop that drives AI agents to completion without supervision by @addyosmani / ai, engineering / 1 min read
8 Myths On Software Engineering And AI: Why AI's measured engineering impact lags its promise — from how devs spend time to measurement gaps and real adoption patterns by Brian Houck / ai, engineering, dx / 6 min read
Design Systems Are Over. Product Context Is the Work: Components stay essential but AI needs broader product context — decisions, constraints, and reasoning — to maintain coherence as it generates at scale by Robin Cannon / design-systems, ai, design / 5 min read
npm v12 to Stop Running Install Scripts by Default: After a year of supply chain attacks, npm v12 will no longer execute pre/install/postinstall scripts unless explicitly approved via a new npm approve-scripts workflow by GitHub / npm, security, javascript / 4 min read
The Fundamentals and Dev Experience of CSS @function: @function lets you define stylesheet-scoped functions that return values anywhere CSS can use one — Chromium-only for now but the potential is significant by Jane Ori / css, frontend / 20 min read
AI-Assisted Engineers Are Burning Out. Is This Fine?: AI tools introduce hidden cognitive costs — overload, decreased fulfillment, and lost ownership — making AI a productivity trap for many developers by Evil Martians / ai, engineering, culture / 20 min read
Predicting AI Job Exposure: Predicting which jobs AI will automate is nearly impossible — the jobs will change, the tools will change, and measuring work that way doesn't hold up by Benedict Evans / ai, industry / 10 min read
React Libraries and Tools for 2026: Robin Wieruch's annual opinionated survey of the React ecosystem — from app scaffolding through state management, testing, and i18n by Robin Wieruch / react, javascript, ecosystem / 31 min read
TanStack AI in Beta: Framework and provider-agnostic AI toolkit for React, Vue, Solid, and Angular — brings TanStack's composable headless philosophy to AI integrations by TanStack / react, ai, javascript / 10 min read

🧰 Tools

sem: Semantic version control on top of Git that shows what entities changed (functions, methods, classes) not just lines by Ataraxy Labs / cli, git, developer-tools
Defending Code Reference Harness: Reference harness for testing how well LLMs defend code against adversarial prompts by Anthropic / security, ai, llm
pg_durable: PostgreSQL extension for durable, exactly-once execution of long-running tasks by Microsoft / postgresql, database, tools
gitdot: A home for great open-source software. by bkdevs / git
performative-ui: AI-native React components that signal how oversubscribed your funding round is. by Li Zhang / ui, react
free-email-domains: Maintained list of every known free email provider — useful for filtering sign-ups or validating email inputs by Kikobeats / tools, security, email
asm: Unified CLI for managing AI agent skills across Claude Code, Cursor, and Windsurf — install, search, and audit capabilities from one place by luongnv89 / tools, cli, ai
Desktop Commander MCP: MCP server that lets AI models execute shell commands, manage processes, and perform surgical code edits on local files including Excel, PDF, and Word by wonderwhy-er / tools, mcp, ai
Apache Burr: Open-source Python framework for building chatbots and agents as graphs of simple Python functions with explicit state and transition management by Apache / python, agents, tools
HelixDB: Rust OLTP database unifying graph, vector, relational, and document data in one system — designed to simplify AI memory and context management by HelixDB / database, ai, rust
MonoSketch: Browser-based ASCII sketching and diagramming tool for creating visual designs with ASCII characters — open source by MonoSketch / ascii, tools, design
DepsGuard: Rust-based tool that audits and rewrites your package manager config to disable install scripts, enforce cooldowns, and block provenance downgrades across npm, pnpm, yarn, and bun by Arnica / tools, security, npm
Bonsai: Fast sandboxed expression language for safely evaluating user-supplied rules, filters, or templates without reaching for eval by Daniel Fry / javascript, tools, security
MD This Page: Browser extension that converts any web page to clean readable Markdown in one click by Ademking / tools, browser, markdown
UIverse: Community-built library of open-source UI elements — copy as HTML/CSS, Tailwind, React, or Figma by UIverse / ui, tools, frontend
Animation Vocabulary: A glossary of common animation patterns with names you can use when prompting AI for motion design by animations.dev / design, animation, tools
Noodle: Skills-based agent orchestrator that runs itself — define skills, wire them together, let the agent figure out its own execution plan by poteto / tools, agents, ai
architect-loop: Claude Fable 5 as architect, GPT-5.5 Codex as builder, the repo as memory - a research-backed Claude Code skill for the cross-vendor agent loop by Dan McInerney / ai, claude, skills, fable, codex

🤪 Fun

Mitos: ASCII art generator that converts images, GIFs, and JavaScript into text-based illustrations with customizable character sets by Oxide Computer / ascii, art, generator / 6 min read
node_modules Heap: Walk through a node_modules folder in your browser FPS-style — absurd, delightful, and oddly educational by Andrew Nesbitt / javascript, fun, nodejs / 1 min read

Want to read more? Check out the full article here.

To sign up for the weekly newsletter, visit weeklyfoo.com.

Backdoored npm, Stolen Tokens, and VoidZero Soars

Adam — Fri, 12 Jun 2026 04:38:44 +0000

Red Hat's npm channel got backdoored — yes, the official one — so if your dependency hygiene was already anxious, Gabor Koos has the 2026 vetting checklist to restore some confidence. Meanwhile, Ammar Askar shows that a single malicious link can steal your GitHub token through a VSCode webview bug, which is the kind of vulnerability that makes you want to audit every extension you've ever installed.

On the more uplifting side: VoidZero joins Cloudflare, bringing the whole Vite, Vitest, Rolldown, and Oxc ecosystem under one very well-funded roof. Postgres 19 adds SQL/PGQ support so you can finally run Cypher-style graph queries without reaching for a separate datastore. And Anthropic pulls back the curtain on how they keep Claude contained across products — sandboxes, VMs, strict egress controls, and model training working together, because hope is not a containment strategy.

Also in this issue: Loris Cro makes the compelling case for keeping assertions alive in production (your panics are actually your friends), Harry Roberts introduces the TBT Window — the performance metric hiding in plain sight between FCP and TTI, Matt Pocock ships Sandcastle for running AI agents in provider-agnostic isolated sandboxes, and Google's Code Wiki auto-generates architecture docs that actually stay current. replacements.fyi helps you swap bloated npm packages for leaner alternatives or Node.js built-ins, Xata's DeltaX brings columnar time-series performance inside regular Postgres tables, and Alibaba's Open Code Review adds AI-powered diff analysis with line-level precision to your CLI workflow.

Enjoy!

Signup here for the newsletter to get the weekly digest right into your inbox.

Find the 13 highlighted links of weeklyfoo #140:

How to Evaluate an npm Package: 2026 Edition

by Gabor Koos

A practical checklist for vetting packages beyond star counts — provenance attestation, install scripts, CI quality, and maintainer responsiveness

🚀 Read it!, npm, javascript, security

You Must Fix Your Asserts

by Loris Cro

Disabling assertions in production lets software run under false assumptions — keep them active to trigger panics on violation or use them as compiler optimization hints

📰 Good to know, debugging, assertions, code-quality

Dozens of Red Hat npm Packages Backdoored

by Ars Technica

Supply chain attack via the official npm channel — dozens of packages compromised through a hijacked publishing account

📰 Good to know, security, npm, supply-chain

1-Click GitHub Token Stealing via a VSCode Bug

by Ammar Askar

A vulnerability in VSCode's webview security model lets attackers steal GitHub tokens through a single malicious link by bubbling keyboard events from isolated iframes

📰 Good to know, security, vscode, github

Frontend's Missing Metric: The TBT Window

by Harry Roberts

A case for tracking the FCP-to-TTI interval where TBT is counted — TBT can silently regress with no real change in blocking work as FCP or TTI shift

📰 Good to know, performance, css, web-vitals

Handling Graphs with SQL/PGQ in Postgres 19

by Hans-Jürgen Schönig

Postgres 19 adds SQL/PGQ support — declare a property graph over tables and pattern-match with Cypher-like MATCH queries, all rewritten to relational queries by the planner

📰 Good to know, postgres, graphs, sql

VoidZero Joins Cloudflare

by Cloudflare

The company behind Vite, Vitest, Rolldown, and Oxc is joining Cloudflare — the JS toolchain stack with the most momentum just found a new home

📰 Good to know, javascript, vite, tooling

How We Contain Claude Across Products

by Anthropic

Anthropic's multi-layered containment approach — sandboxes, VMs, strict egress controls, and model training — limits agent blast radius more reliably than human supervision alone

📰 Good to know, ai, security, engineering

Sandcastle

by Matt Pocock

Provider-agnostic TypeScript library for running AI coding agents in isolated sandboxes — Docker, Podman, or Vercel

🧰 Tools, ai, typescript, agents

Code Wiki

by Google for Developers

Gemini-generated repo documentation that stays up-to-date — generates natural language summaries and architecture diagrams for any repository

🧰 Tools, ai, documentation, tools

DeltaX

by Xata

Columnar storage extension for time-series data in Postgres — uses regular tables so replication, backups, and pg_dump work as usual

🧰 Tools, postgres, time-series, extensions

replacements.fyi

by e18e

Type in an npm package name and get lighter alternatives or Node.js built-in equivalents — is-number becomes a one-liner, axios becomes fetch, chalk becomes util.styleText

🧰 Tools, npm, javascript, tools

Open Code Review

by Alibaba

AI-powered code review CLI that reads git diffs, sends files to a configurable LLM via an agent with tool-use capabilities, and generates structured review comments with line-level precision

🧰 Tools, ai, code-review, cli

Want to read more? Check out the full article here.

To sign up for the weekly newsletter, visit weeklyfoo.com.

Stay ahead in web development: latest news, tools, and insights #140

Adam — Mon, 08 Jun 2026 04:52:25 +0000

Signup here for the newsletter to get the weekly digest right into your inbox.

weeklyfoo #140 is here: your weekly digest of all webdev news you need to know! This time you'll find 37 valuable links in 4 categories! Enjoy!

🚀 Read it!

How to Evaluate an npm Package: 2026 Edition: A practical checklist for vetting packages beyond star counts — provenance attestation, install scripts, CI quality, and maintainer responsiveness by Gabor Koos / npm, javascript, security / 17 min read

📰 Good to know

You Must Fix Your Asserts: Disabling assertions in production lets software run under false assumptions — keep them active to trigger panics on violation or use them as compiler optimization hints by Loris Cro / debugging, assertions, code-quality / 15 min read
Build Agents, Not Pipelines: Pipelines use fixed logic for predictability at scale; agents manage their own control flow for complex reasoning — a practical guide to knowing which to reach for by Sean Goedecke / ai, agents, llm / 13 min read
Figma Make, Now on Your Local Code: Designers can now edit directly in the production codebase from Figma — visual edits, annotations, and PR creation without context switching by Figma / figma, design, tools / 9 min read
Your Process' Memory Is a File: Linux's /proc/pid/mem allows direct read and write access to a process's address space using standard file semantics by Michal Zalewski / linux, systems / 7 min read
Websites Have a New Way to Spy on Visitors: Analyzing Their SSD Activity: The FROST method uses JavaScript to measure SSD timing patterns and infer which apps and tabs a visitor has open — a covert browser-based side-channel by Ars Technica / security, privacy, browser / 7 min read
Dozens of Red Hat npm Packages Backdoored: Supply chain attack via the official npm channel — dozens of packages compromised through a hijacked publishing account by Ars Technica / security, npm, supply-chain / 7 min read
Why Does tsgo Use So Much Memory?: A deep dive into the Go-powered TypeScript 7 compiler and why it can chew through gigabytes on large projects by Zack Radisic / typescript, performance, compilers / 12 min read
1-Click GitHub Token Stealing via a VSCode Bug: A vulnerability in VSCode's webview security model lets attackers steal GitHub tokens through a single malicious link by bubbling keyboard events from isolated iframes by Ammar Askar / security, vscode, github / 14 min read
Chrome DevTools MCP Server Stable in Chrome 149: The MCP server and CLI for Chrome DevTools letting AI coding agents drive debugging and perf audits is now officially stable by Chrome for Developers / chrome, devtools, mcp, ai / 10 min read
HTML-in-Canvas API Origin Trial: Draw live interactive HTML and CSS into a canvas element — combining DOM accessibility and text layout with performant low-level graphics by Chrome for Developers / html, canvas, chrome, frontend / 8 min read
Frontend's Missing Metric: The TBT Window: A case for tracking the FCP-to-TTI interval where TBT is counted — TBT can silently regress with no real change in blocking work as FCP or TTI shift by Harry Roberts / performance, css, web-vitals / 19 min read
Handling Graphs with SQL/PGQ in Postgres 19: Postgres 19 adds SQL/PGQ support — declare a property graph over tables and pattern-match with Cypher-like MATCH queries, all rewritten to relational queries by the planner by Hans-Jürgen Schönig / postgres, graphs, sql / 1 min read
The Night Our Tables Wouldn't Stop Growing: A production incident where a stray statement_timeout quietly broke logical replication and caused tables to balloon overnight by Semab Tariq / postgres, production, incident / 11 min read
VoidZero Joins Cloudflare: The company behind Vite, Vitest, Rolldown, and Oxc is joining Cloudflare — the JS toolchain stack with the most momentum just found a new home by Cloudflare / javascript, vite, tooling / 13 min read
Every Byte Matters: Packing data into Struct-of-Arrays instead of Array-of-Structs aligns access with cache lines — the technique can yield up to 30x performance improvements on sequential workloads by Fathi Zakaria / performance, engineering, systems / 6 min read
How We Contain Claude Across Products: Anthropic's multi-layered containment approach — sandboxes, VMs, strict egress controls, and model training — limits agent blast radius more reliably than human supervision alone by Anthropic / ai, security, engineering / 24 min read

🧰 Tools

Website Spec: A platform-agnostic specification of the technical features every decent website should have. by Joost de Valk / spec, web, seo, a11y
Sandcastle: Provider-agnostic TypeScript library for running AI coding agents in isolated sandboxes — Docker, Podman, or Vercel by Matt Pocock / ai, typescript, agents
Flowsint: Open-source graph-based OSINT tool that maps relationships between domains, IP addresses, and social media profiles by reconurge / security, osint, tools
Hocuspocus 4: Plug-and-play real-time collaboration backend based on Yjs — runs on Node, Bun, Deno, or Cloudflare Workers by Tiptap / collaboration, yjs, real-time
React Native Runtimes: Run React Native components and functions across multiple JS threads to prevent main UI lag — offload heavy work like chat screens and large lists to dedicated secondary runtimes by Margelo / react-native, javascript, performance
Paseo: Self-hosted, privacy-focused platform for orchestrating and running multiple AI coding agents across mobile, desktop, and CLI environments by getpaseo / ai, agents, tools
HueGrid: Generate gradients across 22+ modes including mesh blending, noise-based organics, aurora effects, and particle fields by HueGrid / design, gradients, tools
Letterbox: Pick a font, choose your colors, and watch letters shaped by text come alive — a typographic playground by Letterbox / typography, design, fun
Liquid DOM: DOM-based implementation of Apple's liquid glass effect using HTML-in-Canvas and WebGPU by AndrewPrifer / css, webgpu, frontend, demo
Curlwind: No-build Tailwind utility generator — drop in a CDN URL with query params specifying only the classes you need, any variants, and custom prefixes by Steve Bauman / tailwind, css, tools
Code Wiki: Gemini-generated repo documentation that stays up-to-date — generates natural language summaries and architecture diagrams for any repository by Google for Developers / ai, documentation, tools
DeltaX: Columnar storage extension for time-series data in Postgres — uses regular tables so replication, backups, and pg_dump work as usual by Xata / postgres, time-series, extensions
replacements.fyi: Type in an npm package name and get lighter alternatives or Node.js built-in equivalents — is-number becomes a one-liner, axios becomes fetch, chalk becomes util.styleText by e18e / npm, javascript, tools
Mnemo: Local-first AI memory layer that stores persistent knowledge in a SQLite knowledge graph and injects relevant context into LLM sessions automatically by zaydmulani09 / ai, memory, tools
Open Code Review: AI-powered code review CLI that reads git diffs, sends files to a configurable LLM via an agent with tool-use capabilities, and generates structured review comments with line-level precision by Alibaba / ai, code-review, cli
Boxes: Cloud workbench for running multiple AI coding agents in parallel within isolated, persistent virtual machines — monitor and manage from any device by Boxes / ai, agents, tools
The Auth Book: Free comprehensive guide to authentication — sessions, passkeys, OAuth, and CSRF prevention for developers who want to understand the fundamentals by Pilcrow / auth, security, web

📺 Videos

Stop Using :invalid and :valid — Use This Instead: A 3-minute CSS tip on a better approach to inline form validation using CSS without JavaScript hacks by Zoran Jambor / css, forms, frontend
Postgres at 30 — A Chat with Its Creator: Mike Stonebraker covers how Postgres came to be, where Google and Amazon get databases wrong, and what he's building next by The Peterman Pod / postgres, interview, databases
All 17 TanStack Projects in One App: 14-minute tour of the entire TanStack ecosystem — Start, Router, Form, Query, and more all demonstrated in a single application by Jack Herrington / javascript, tanstack, react

Want to read more? Check out the full article here.

To sign up for the weekly newsletter, visit weeklyfoo.com.

Supply-Chain Sirens and Agent Upgrade Fever

Adam — Fri, 05 Jun 2026 05:04:30 +0000

This week opens with a full-on supply-chain thriller: Ars Technica details TeamPCP poisoning hundreds of open-source packages, and GitHub’s npm update lands at exactly the right moment with staged publishing and tighter install-time controls.

Performance nerds are eating well: Yelp’s Rspack migration cut build times hard, Linear’s architecture teardown shows what “feels instant” really costs in engineering effort, and RuneScape on 56K proves constraints still produce timeless ideas.

On the AI/dev workflow front, Builder.io calls out the “AI PR slop” tax, while Anthropic and Stripe’s talk show where serious agent orchestration is heading. Add in FLUE, Skybridge, and Kysely 0.29, and the tooling layer is moving almost as fast as the model layer.

Also worth pinning to your “save me later” list: Node stream leak failure modes, the sneaky PostgreSQL now() transaction-time trap, Deno 2.8, and a quietly important accessibility reminder from Manuel Matuzovic: don’t put aria-label on generic div/span elements unless you enjoy unpredictable screen-reader behavior.

Enjoy!

Signup here for the newsletter to get the weekly digest right into your inbox.

Find the 15 highlighted links of weeklyfoo #139:

How Soon is now() in PostgreSQL

by Oskar Dudycz

now() isn't the current time but when the transaction started, which matters when a retry loop sees the same frozen timestamp and never makes progress

🚀 Read it!, postgres, sql, engineering

A hacker group is poisoning open source code at an unprecedented scale

by Ars Technica

TeamPCP has corrupted hundreds of open source tools in supply chain attacks even breaching GitHub via a poisoned VSCode extension

📰 Good to know, security, open-source

Staged Publishing and New Install Controls for npm

by GitHub

npm and pnpm now support a review period before packages go live on the registry, with new options to control package sourcing

📰 Good to know, npm, javascript, security

Optimizing Build Times by Migrating from Webpack to Rspack

by Benson Pan

How Yelp cut build times in half with the Rust-powered webpack drop-in and what they learned about barrel files

📰 Good to know, performance, javascript, build

Don't Put aria-label on Generic Elements like Divs

by Manuel Matuzovic

Why slapping aria-label on a plain div or span is a spec violation and how screen readers across browsers show wildly inconsistent results

📰 Good to know, accessibility, html, a11y

The Production Playbook for Node.js Stream Leaks

by Durgesh Pawar

Five failure modes for Node streams that sail past tests and code review then break under real traffic, from unnoticed disconnects to leftover upstream fetches

📰 Good to know, nodejs, performance, engineering

How Linear is So Fast: A Technical Breakdown

by performance.dev

A teardown of Linear's local-first architecture, aggressive code splitting, granular observables, and GPU-accelerated animations

📰 Good to know, performance, engineering, frontend

How 2004 RuneScape Fit a Multiplayer RPG into 56K Dial-Up

by jkm.dev

A deep dive into the custom bit-packing protocol that kept a massive MMO playable on dial-up using shared world state

📰 Good to know, performance, engineering, history

I Didn't Become a Developer to Review AI Slop

by builder.io

AI made it cheap to open pull requests but not trustworthy, burying developers in mystery diffs that look clean on the surface but hide bugs and debt

📰 Good to know, ai, engineering, review

Introducing Dynamic Workflows in Claude Code

by Anthropic

Claude can now write orchestration scripts that spin up hundreds of parallel subagents for complex end-to-end tasks, in research preview for Max and Enterprise plans

📰 Good to know, ai, agents, engineering

Deno 2.8

by Deno

Biggest minor release yet with improved Node.js compatibility, native package manager improvements, and new runtime features

🧰 Tools, deno, javascript, runtime

FLUE

by Fred K. Schott

A TypeScript agent harness framework from the Astro team, akin to Claude Code with tasks, sandboxing and agent skills but entirely headless and programmable

🧰 Tools, ai, agents, typescript

Kysely 0.29

by Kysely

Type-safe TypeScript SQL query builder adds compile-time table scoping, read-only access enforcement at the type level, and AbortSignal query cancellation

🧰 Tools, typescript, sql, tools

Skybridge

by Alpic AI

Full-stack React framework for type-safe MCP applications and servers, with hot module reloading and a local emulator for AI environments like Claude and ChatGPT

🧰 Tools, mcp, react, ai

Gents in the Monorepo: How Stripe Uses LLM Coding Agents

by Chris Ruiz

Chris Ruiz from Stripe walks through agent strategies in production, from autonomous minions producing PRs from Slack to Claude Code-based agents executing multi-step migrations

📺 Videos, ai, agents, monorepo

Want to read more? Check out the full article here.

To sign up for the weekly newsletter, visit weeklyfoo.com.

Stay ahead in web development: latest news, tools, and insights #139

Adam — Mon, 01 Jun 2026 05:09:19 +0000

Signup here for the newsletter to get the weekly digest right into your inbox.

weeklyfoo #139 is here: your weekly digest of all webdev news you need to know! This time you'll find 39 valuable links in 5 categories! Enjoy!

🚀 Read it!

How Soon is now() in PostgreSQL: now() isn't the current time but when the transaction started, which matters when a retry loop sees the same frozen timestamp and never makes progress by Oskar Dudycz / postgres, sql, engineering / 12 min read

📰 Good to know

The State of CSS Centering in 2026: Modern approaches to centering elements using place-self, anchor positioning, and text-box by Temani Afif / css, frontend / 16 min read
A hacker group is poisoning open source code at an unprecedented scale: TeamPCP has corrupted hundreds of open source tools in supply chain attacks even breaching GitHub via a poisoned VSCode extension by Ars Technica / security, open-source / 11 min read
Microsoft's Quiet Claude Code Retreat and the Real Cost of Enterprise AI: Microsoft cancels most Claude Code licenses in its Experiences and Devices group telling engineers to migrate to Copilot CLI by June 30 by The Next Web / ai, engineering / 11 min read
Staged Publishing and New Install Controls for npm: npm and pnpm now support a review period before packages go live on the registry, with new options to control package sourcing by GitHub / npm, javascript, security / 6 min read
Chrome Previews Declarative Partial Updates: Two new experimental HTML APIs in Chrome 148 for out-of-order updates via template-for and setHTML/streamHTML, with polyfills available by Chrome Developers / chrome, html, frontend / 18 min read
Optimizing Build Times by Migrating from Webpack to Rspack: How Yelp cut build times in half with the Rust-powered webpack drop-in and what they learned about barrel files by Benson Pan / performance, javascript, build / 8 min read
Agentic Engineering Patterns: A growing guide collecting coding practices and patterns for getting the best results from coding agents by Simon Willison / ai, agents, engineering / 3 min read
Don't Put aria-label on Generic Elements like Divs: Why slapping aria-label on a plain div or span is a spec violation and how screen readers across browsers show wildly inconsistent results by Manuel Matuzovic / accessibility, html, a11y / 4 min read
Framework-Agnostic Design Systems: A Practical Approach to Web Components: An accessible guide that covers managing, building and packaging design system components across frameworks by Scott Riley / design-systems, web-components, frontend / 54 min read
The Production Playbook for Node.js Stream Leaks: Five failure modes for Node streams that sail past tests and code review then break under real traffic, from unnoticed disconnects to leftover upstream fetches by Durgesh Pawar / nodejs, performance, engineering / 21 min read
TOAST: Where Postgres Hides Big Values: A deep dive into how Postgres transparently stores oversized rows out of line and what that means for performance by Radim Marek / postgres, performance, engineering / 15 min read
How Linear is So Fast: A Technical Breakdown: A teardown of Linear's local-first architecture, aggressive code splitting, granular observables, and GPU-accelerated animations by performance.dev / performance, engineering, frontend / 26 min read
How Vercel Cut Build Wait Times from 90 Seconds to 5: Hive, an internal platform on AWS Firecracker microVMs, gave Vercel an 18x gain by stacking faster cold boots, a warm pool, and millisecond boot times by ByteByteGo / performance, engineering, devops / 14 min read
How 2004 RuneScape Fit a Multiplayer RPG into 56K Dial-Up: A deep dive into the custom bit-packing protocol that kept a massive MMO playable on dial-up using shared world state by jkm.dev / performance, engineering, history / 30 min read
I Didn't Become a Developer to Review AI Slop: AI made it cheap to open pull requests but not trustworthy, burying developers in mystery diffs that look clean on the surface but hide bugs and debt by builder.io / ai, engineering, review / 14 min read
Introducing Dynamic Workflows in Claude Code: Claude can now write orchestration scripts that spin up hundreds of parallel subagents for complex end-to-end tasks, in research preview for Max and Enterprise plans by Anthropic / ai, agents, engineering / 19 min read

🧰 Tools

a11ysupport.io: Check if accessibility features work across browser and screen reader combinations by a11ysupport / accessibility, a11y, tools
tiks: Procedural UI sounds for the web with zero audio files by rexa-developer / audio, ui, javascript
theSVG: Search and ship 6047 brand SVG icons with npm, React, Vue, Svelte, CLI, and MCP server support by Gagan Deep Singh / icons, svg, tools
Brownies: Lightweight JavaScript library for managing cookies, localStorage, sessionStorage, and IndexedDB using standard property accessors by franciscop / javascript, storage, browser
Webwright: SWE-style browser agent framework that gives agents a terminal to launch browser sessions and complete long-horizon web tasks end-to-end by Microsoft / ai, agents, tools
Deno 2.8: Biggest minor release yet with improved Node.js compatibility, native package manager improvements, and new runtime features by Deno / deno, javascript, runtime
Pico: Ultra-tiny router for Cloudflare Workers and Deno at under 400 bytes by Yusuke Wada / javascript, router, serverless
TEGAKI: Animated Handwriting from Any Font: Turns any font including non-English into animated handwriting and works with all major frameworks, with built-in handwriting fonts and a live playground by Gokhan Kurt / typography, animation, javascript
FLUE: A TypeScript agent harness framework from the Astro team, akin to Claude Code with tasks, sandboxing and agent skills but entirely headless and programmable by Fred K. Schott / ai, agents, typescript
Helmet.js 8.2: Express middleware that sets HTTP security headers like Content-Security-Policy and Strict-Transport-Security, now updated after a year by Hahn and Baldwin / security, express, nodejs
Kysely 0.29: Type-safe TypeScript SQL query builder adds compile-time table scoping, read-only access enforcement at the type level, and AbortSignal query cancellation by Kysely / typescript, sql, tools
Retune: Visual design tool that lets you select and modify website elements directly in the browser while an AI agent writes the corresponding code, integrating with Claude Code and Cursor by Retune / ai, design, tools
OpenPencil: Open-source design editor that natively opens Figma .fig files using a Kiwi binary codec to ensure round-trip fidelity by OpenPencil / design, figma, open-source
Resend Claude Code Plugin: Official Claude Code plugin with skills for creating React Emails, sending and receiving with Resend, agent inbox setup, and built-in Resend MCP server by Resend / ai, email, tools
Skybridge: Full-stack React framework for type-safe MCP applications and servers, with hot module reloading and a local emulator for AI environments like Claude and ChatGPT by Alpic AI / mcp, react, ai
pip-it-up: Pop any React UI component into a floating picture-in-picture window with a few lines of code by Saurabh Shakya / react, ui, javascript
heerich.js: Minimalist JavaScript engine that constructs 3D voxel scenes and renders them as pristine SVGs by meodai / javascript, 3d, generative

🤪 Fun

BEMoji: BEM methodology but with emoji as class names by Tom Hayes / css, bem, humor / 10 min read
JS Crossword: A hand-crafted crossword puzzle where all the answers are JavaScript that seriously tests your JS knowledge by Lyra Rebane / javascript, fun, games / 2 min read

📺 Videos

What's new in Web UI at Google I/O 2026: Google IO session covering new CSS features, baseline updates, and browser capabilities shipping in 2026 by Google Chrome Developers / frontend, css, google
Gents in the Monorepo: How Stripe Uses LLM Coding Agents: Chris Ruiz from Stripe walks through agent strategies in production, from autonomous minions producing PRs from Slack to Claude Code-based agents executing multi-step migrations by Chris Ruiz / ai, agents, monorepo
Introducing WebMCP: Agents in the Browser: RL Nabors walks through MCP Apps that bundle HTML, CSS and JavaScript into a single file rendered in an iframe by the agent, and WebMCP for letting browser agents call your site's existing functions by RL Nabors / mcp, ai, browser

Want to read more? Check out the full article here.

To sign up for the weekly newsletter, visit weeklyfoo.com.

Supply Chains, Zombie OSS, and Agent Firewalls

Adam — Fri, 29 May 2026 06:36:57 +0000

This week feels like a full-stack reality check: Gergely Orosz reports that AI is amplifying team culture (good and bad), while Cloudflare shows frontier models already chaining exploits and reviewing attacks better with multi-agent setups.

The ecosystem drama continues: SafeDep tracks 314 compromised npm packages, npm responds with staged publishing, and Andrew Nesbitt explains how open-source projects quietly become zombie dependencies.

On the practical side, Julia Evans makes a strong case for semantic HTML + native CSS, uxdesign.cc reminds AI teams that vague spinners are not UX strategy, and the database/tooling corner is unusually strong: pgsqlite, TypeORM 1.0, and Kanel 4.0 all make modern TS+SQL workflows less painful.

Bonus watch: Martin Fowler and Kent Beck reflecting on 30 years of Agile is a nice antidote to pure AI hype cycles. Also worth noting: Claw Patrol pushes agent-level security controls in the runtime itself, which is exactly where this should be heading.

Enjoy!

Signup here for the newsletter to get the weekly digest right into your inbox.

Find the 12 highlighted links of weeklyfoo #138:

AI's Impact on Software Engineers in 2026: Part 2

by Gergely Orosz

Survey of 900+ engineers — AI amplifies existing culture, codebase quality is dropping while management focuses on output, and junior devs are struggling most

🚀 Read it!, ai, engineering

Moving Away from Tailwind

by Julia Evans

Adopting semantic HTML and native CSS — component files, CSS nesting, and grid layouts without the framework dependency

📰 Good to know, css, frontend

314 npm Packages Compromised in New Supply-Chain Wave

by SafeDep Team

The mini Shai-Hulud class of supply-chain attacks returns — 314 packages including the antv family and timeago.js targeted in the latest wave

📰 Good to know, security, npm, javascript

What Claude Mythos Showed Cloudflare

by Cloudflare

Cloudflare CSO reports on Project Glasswing findings — exploit chain construction, proof generation, and adversarial multi-agent review that outperforms single-agent verification

📰 Good to know, ai, security

Dumb Ways for an Open Source Project to Die

by Andrew Nesbitt

Maintainer burnout, funding gaps, and broken tech turn still-used packages into zombies — listed everywhere, quietly dangerous for all downstream dependents

📰 Good to know, open-source, engineering

The Waiting Problem in AI Products

by uxdesign.cc

AI products ignore decades of research on wait time — users need progress indicators, ETAs, and detailed logs instead of vague spinners that force people to invent their own coping behaviors

📰 Good to know, ai, design, ux

Staged Publishing for npm Packages

by npm

npm's new staged publishing model gives packages a review period before going live — part of the npm 11.15.0 release

📰 Good to know, npm, javascript

pgsqlite

by Eran Sandler

Postgres wire-protocol adapter for SQLite — use psql, pgAdmin, and standard Postgres drivers against an SQLite database

🧰 Tools, sqlite, postgres, tools

TypeORM 1.0

by TypeORM Team

TypeScript-first ORM reaches 1.0 after years on 0.3.x — INSERT INTO SELECT support, cross-driver transaction isolation levels, and smoother PostgreSQL enum migrations

🧰 Tools, typescript, database, tools

Kanel 4.0

by Kristian Dupont

Inspects your Postgres database and generates TypeScript types for use with Knex, Zod, or Kysely

🧰 Tools, typescript, postgres, tools

Claw Patrol

by Deno Team

Security firewall for Deno agents — restricts network access and subprocess execution to prevent agent overreach

🧰 Tools, security, ai, tools

Tech Truth: Agile Evolution & the Future of SW Engineering

by Martin Fowler, Kent Beck

Martin Fowler and Kent Beck reflect on 30 years — AI as a patient tutor, what Extreme Programming got right, and why people skills still matter more than tools

📺 Videos, engineering, agile

Want to read more? Check out the full article here.

To sign up for the weekly newsletter, visit weeklyfoo.com.

Stay ahead in web development: latest news, tools, and insights #138

Adam — Mon, 25 May 2026 06:46:31 +0000

Signup here for the newsletter to get the weekly digest right into your inbox.

weeklyfoo #138 is here: your weekly digest of all webdev news you need to know! This time you'll find 32 valuable links in 4 categories! Enjoy!

🚀 Read it!

AI's Impact on Software Engineers in 2026: Part 2: Survey of 900+ engineers — AI amplifies existing culture, codebase quality is dropping while management focuses on output, and junior devs are struggling most by Gergely Orosz / ai, engineering / 16 min read

📰 Good to know

Moving Away from Tailwind: Adopting semantic HTML and native CSS — component files, CSS nesting, and grid layouts without the framework dependency by Julia Evans / css, frontend / 12 min read
Browsers Treat Big Sites Differently: Firefox and Safari ship quirks files to compensate for Chrome-only testing — test in multiple browsers regularly, not just before big launches by Den Odell / frontend, web / 11 min read
Ten Data-Backed Truths of User Experience ROI: UX fixes are 100x cheaper in the design phase — and a one-second delay reduces conversions by 20% by Smashing Magazine / design, engineering / 16 min read
The Last Six Months in LLMs: Coding agents became reliable daily tools and local open-weight models reached cutting-edge performance — Simon Willison's 6-month review by Simon Willison / ai, engineering / 10 min read
314 npm Packages Compromised in New Supply-Chain Wave: The mini Shai-Hulud class of supply-chain attacks returns — 314 packages including the antv family and timeago.js targeted in the latest wave by SafeDep Team / security, npm, javascript / 38 min read
What Claude Mythos Showed Cloudflare: Cloudflare CSO reports on Project Glasswing findings — exploit chain construction, proof generation, and adversarial multi-agent review that outperforms single-agent verification by Cloudflare / ai, security / 17 min read
Better Fluid Sizing with CSS round(): How to use the CSS round() function to snap fluid sizes to the nearest pixel or step — interactive examples included by Ahmad Shadeed / css, frontend / 9 min read
Dumb Ways for an Open Source Project to Die: Maintainer burnout, funding gaps, and broken tech turn still-used packages into zombies — listed everywhere, quietly dangerous for all downstream dependents by Andrew Nesbitt / open-source, engineering / 13 min read
CSS Gap Decorations Now in Chrome and Edge: Style flexbox, grid, and multi-column gaps directly with border-like decorations — no pseudo-elements needed by Chrome for Developers / css, frontend / 10 min read
The Pulse: Forward-Deployed Engineering Heats Up Again: OpenAI and Anthropic are creating separate FDE deployment entities while the role evolves toward solutions architecture — senior devs prefer product work over client integration by Gergely Orosz / ai, engineering / 9 min read
The Waiting Problem in AI Products: AI products ignore decades of research on wait time — users need progress indicators, ETAs, and detailed logs instead of vague spinners that force people to invent their own coping behaviors by uxdesign.cc / ai, design, ux / 1 min read
Staged Publishing for npm Packages: npm's new staged publishing model gives packages a review period before going live — part of the npm 11.15.0 release by npm / npm, javascript / 9 min read

🧰 Tools

Semble: Code search library for AI agents using natural language — 98% fewer tokens, CPU-only, sub-millisecond responses, available as MCP server or CLI by MinishLab / ai, tools
Cascade: Icons for CSS properties to visually identify them in your projects by Design Surface / design, css, tools
Re_gent: Version control for AI agents — track, replay, and audit agent decisions and state across sessions by regent-vcs / ai, tools
Hallmark: Anti-AI-slop design skill for Claude Code, Cursor, and Codex. by Hassan El Mghari / ai, design, skill
remove-ai-watermarks: CLI and library for removing visible logos, invisible watermarks, and AI provenance metadata from images generated by various models by wiltodelta / ai, tools, cli
pgsqlite: Postgres wire-protocol adapter for SQLite — use psql, pgAdmin, and standard Postgres drivers against an SQLite database by Eran Sandler / sqlite, postgres, tools
critical 8.0: Extract and inline above-the-fold critical CSS from HTML — production-ready and still actively maintained by Addy Osmani / css, performance, tools
Modern Web Guidance: Evergreen AI skills for coding agents covering UX, performance, accessibility, layouts, and CSS patterns from the Chrome team by Chrome for Developers / ai, tools, frontend
Charcuterie: Visual explorer for Unicode — browse characters, discover related glyphs, and explore scripts, symbols, and shapes across the standard by Elastiq / tools, design
distributed-system-testing: Skills for AI coding agents to plan and execute distributed system tests — claim-driven testing that validates against network partitions, concurrency, and crash-recovery scenarios by shenli / ai, testing, tools
TypeORM 1.0: TypeScript-first ORM reaches 1.0 after years on 0.3.x — INSERT INTO SELECT support, cross-driver transaction isolation levels, and smoother PostgreSQL enum migrations by TypeORM Team / typescript, database, tools
Kanel 4.0: Inspects your Postgres database and generates TypeScript types for use with Knex, Zod, or Kysely by Kristian Dupont / typescript, postgres, tools
Zero: Agent-first systems programming language inspired by Zig and Rust — one obvious path, rich stdlib, structured diagnostics, and explicit effects for external systems by Vercel / ai, tools, pl
Claw Patrol: Security firewall for Deno agents — restricts network access and subprocess execution to prevent agent overreach by Deno Team / security, ai, tools
Google Ax: Distributed agent runtime open-sourced by Google — orchestrates and scales AI agents across services by Google / ai, tools

📺 Videos

How Shopify's Design Director Shapes Product Strategy: Balancing metrics and vision, redesigning the shopping cart UX, and taking big bets on the shopping feed by Katarina Batina, Michael Riddering / design
Tech Truth: Agile Evolution & the Future of SW Engineering: Martin Fowler and Kent Beck reflect on 30 years — AI as a patient tutor, what Extreme Programming got right, and why people skills still matter more than tools by Martin Fowler, Kent Beck / engineering, agile
Harnesses in AI: A Deep Dive: How harness engineering makes AI agents reliable in production — structuring context, verification loops, and agent control by Tejas Kumar, IBM / ai, engineering
Build Agents That Run for Hours (Without Losing the Plot): Anthropic engineers on the practical challenges of long-running agents — context compaction, state management, and keeping multi-step workflows on track by Ash Prabaker, Andrew Wilson, Anthropic / ai, engineering

Want to read more? Check out the full article here.

To sign up for the weekly newsletter, visit weeklyfoo.com.

Harnesses, Slop Cannons, and Supply-Chain Alarms

Adam — Fri, 22 May 2026 04:51:06 +0000

Socket kicks off the week with a real supply-chain gut punch: 84 TanStack npm packages compromised, 12M+ weekly downloads exposed, and yet another reminder that dependency trust is not a passive activity. On the AI engineering side, LangChain, Martin Fowler, and Eugene Yan all point in the same direction: the model is only half the story — harness design, team rituals, and reusable context are what make AI systems actually useful.

manager.dev brings timeless incident wisdom (rollback first, debug second), while Jake Handy names the modern management headache: massive AI-generated PRs with suspiciously low ownership. Wasp adds a candid founder postmortem — five years and five million dollars later, inventing a new web language turned out to be the expensive scenic route.

Tool radar is packed: e2a secures agent email handoffs, Wakaru makes minified JavaScript readable again for audits, Syncpack 15.0 helps monorepos stop version drift before it becomes a lifestyle, and the TanStack Start vs Next.js interview is worth a watch if you like your framework debates with business context instead of tribal shouting.

Enjoy!

Signup here for the newsletter to get the weekly digest right into your inbox.

Find the 10 highlighted links of weeklyfoo #137:

TanStack npm Packages Compromised in Ongoing Supply-Chain Attack

by Socket

84 TanStack packages with over 12M weekly downloads hit in a supply-chain attack — deprecated versions pulled, GitHub Actions hardened with repo-owner guards and pinned action refs

🚀 Read it!, security, javascript, npm

The Anatomy of an Agent Harness

by LangChain

An AI agent is the functional combination of a core LLM and a surrounding harness — code, config, and logic for durable state, sandboxed execution, context compaction, and verification loops

📰 Good to know, ai, engineering

The Unwritten Laws of Software Engineering

by manager.dev

When production fails, roll back before debugging — and treat all untested recovery plans as fictional. Hard-won rules about dependencies, four-eyes checks, and why temporary fixes become permanent

📰 Good to know, engineering

The Slop Cannons In Your Engineering Org

by Jake Handy

A field guide to the engineer shipping huge AI-generated PRs they can't explain — confusing velocity for progress — with a manager's checklist for spotting and fixing the pattern

📰 Good to know, ai, engineering, management

5 Years and $5M Later: Inventing a New Language for Web Dev Was a Mistake

by Wasp

The Wasp co-founder reflects on why building a custom programming language for web development was a mistake — too much friction with developer adoption and high IDE tooling maintenance costs — now transitioning to a TypeScript-based SDK

📰 Good to know, engineering, opinion

How To Work and Compound With AI

by Eugene Yan

Every finished artifact — code, docs, analysis, decisions — becomes context for the next AI session and each correction updates a config that reduces future errors — a practical guide to making AI work compound over time

📰 Good to know, ai, productivity

e2a

by Mnexa-AI

Authenticated email gateway for AI agents with SPF/DKIM verification and HMAC signatures — lets agents communicate with humans via cloud webhooks or WebSocket without needing public URLs

🧰 Tools, ai, tools

Wakaru

by Pionxzh

Feed it minified bundled JavaScript and get readable source modules back — useful for code recovery, reverse-engineering, and security auditing, with an online playground

🧰 Tools, javascript, security, tools

Syncpack 15.0

by Jamie Mason

CLI tool used by Electron, Cloudflare, and Vercel that finds and fixes dependency version mismatches across entire monorepos and enforces version policies — v15.0 adds pnpm and Bun catalog support and a default release age cooldown

🧰 Tools, javascript, monorepo, tools

TanStack Start vs Next.js with Tanner Linsley

by Nuno Maduro

A candid interview covering TanStack's business model, why Start exists alongside Next.js, and framework-agnostic thinking while still deeply focusing on React

📺 Videos, javascript, react

Want to read more? Check out the full article here.

To sign up for the weekly newsletter, visit weeklyfoo.com.

Stay ahead in web development: latest news, tools, and insights #137

Adam — Mon, 18 May 2026 05:09:52 +0000

Signup here for the newsletter to get the weekly digest right into your inbox.

weeklyfoo #137 is here: your weekly digest of all webdev news you need to know! This time you'll find 28 valuable links in 5 categories! Enjoy!

🚀 Read it!

TanStack npm Packages Compromised in Ongoing Supply-Chain Attack: 84 TanStack packages with over 12M weekly downloads hit in a supply-chain attack — deprecated versions pulled, GitHub Actions hardened with repo-owner guards and pinned action refs by Socket / security, javascript, npm / 20 min read

📰 Good to know

The Anatomy of an Agent Harness: An AI agent is the functional combination of a core LLM and a surrounding harness — code, config, and logic for durable state, sandboxed execution, context compaction, and verification loops by LangChain / ai, engineering / 14 min read
The Unwritten Laws of Software Engineering: When production fails, roll back before debugging — and treat all untested recovery plans as fictional. Hard-won rules about dependencies, four-eyes checks, and why temporary fixes become permanent by manager.dev / engineering / 8 min read
I Returned to AWS and Was Reminded Hard Why I Left: Account suspension, unresponsive support, hidden billing, exorbitant egress fees, and vendor lock-in — one dev's frustrating attempt to come back to AWS after years away by fourlightyears / cloud, aws, opinion / 9 min read
HTML in Canvas: A new experimental API lets you put a layoutsubtree attribute on a canvas element to render real HTML inside it — opening up physics, distortion, and custom rendering effects on actual DOM content by Frontend Masters / frontend, web / 24 min read
How to Control Infinite CSS Animations: Combining and tweaking infinite CSS animations is harder than it looks — animation-composition property to the rescue by Frontend Masters / css, frontend / 13 min read
The Slop Cannons In Your Engineering Org: A field guide to the engineer shipping huge AI-generated PRs they can't explain — confusing velocity for progress — with a manager's checklist for spotting and fixing the pattern by Jake Handy / ai, engineering, management / 12 min read
A New HTML Element for Installing Web Apps: Chrome and Edge are testing a new install element that renders a trusted install button for PWAs with no JavaScript required — and how it compares to the Web Install API by Patrick Brosset / frontend, web, pwa / 9 min read
5 Years and $5M Later: Inventing a New Language for Web Dev Was a Mistake: The Wasp co-founder reflects on why building a custom programming language for web development was a mistake — too much friction with developer adoption and high IDE tooling maintenance costs — now transitioning to a TypeScript-based SDK by Wasp / engineering, opinion / 20 min read
How To Work and Compound With AI: Every finished artifact — code, docs, analysis, decisions — becomes context for the next AI session and each correction updates a config that reduces future errors — a practical guide to making AI work compound over time by Eugene Yan / ai, productivity / 14 min read
Patterns For Reducing Friction In AI-Assisted Development: The practices that make pair programming effective — onboarding, design discussion, shared standards — apply equally to AI coding assistants — five patterns for shifting from correcting a tool to collaborating with a teammate by Rahul Garg / ai, engineering / 13 min read

🧰 Tools

Trees: Open-source library for high-performance file tree rendering in web apps — automatic virtualization for large datasets, built-in Git status indicators, and drag-and-drop support by pierre.computer / javascript, tools
Mochi: High-fidelity browser automation library for the Bun runtime that prioritizes fingerprint consistency over simple randomization to bypass modern bot detection by 0xchasercat / bun, automation, tools
Fontastic Space: A font pairing playground that puts Google Fonts side by side, visualizes how each letterform behaves next to the others, and scores which combinations actually work by Fontastic / design, fonts, tools
Griddy Icons: Free open-source icon family with a unique utilitarian vibe by Filip Gres, Zuzana Benova / design, icons, tools
e2a: Authenticated email gateway for AI agents with SPF/DKIM verification and HMAC signatures — lets agents communicate with humans via cloud webhooks or WebSocket without needing public URLs by Mnexa-AI / ai, tools
Smallbits: Free set of 290+ pixel-style icons drawn on an 8x8 grid — available in Figma and SVG by Smallbits / design, icons, tools
Wakaru: Feed it minified bundled JavaScript and get readable source modules back — useful for code recovery, reverse-engineering, and security auditing, with an online playground by Pionxzh / javascript, security, tools
BlueJS: Ahead-of-time JavaScript compiler that produces tiny native binaries — 5ms startup, 3.8MB peak memory, GUI app in 1.2MB by bluejs.dev / javascript, tools
Statewright: State machine guardrails that regulate AI agent tool access during workflow phases — narrows the problem space and increases coding benchmark success rates by Statewright / ai, tools
AgentMemory: Persistent long-term memory server for AI coding agents including Claude Code and Cursor — hybrid search across sessions reduces token consumption by over 90% by Rohit Ghumare / ai, tools
pg_flight_recorder: Pure SQL Postgres extension using pg_cron to continuously snapshot state — pg_stat_activity, locks, statements — giving you a rolling history of what was happening when things went wrong by Dmitry Ventin / postgres, databases, tools
boring: SSH tunnel manager that simplifies opening, persisting, and listing tunnels — supports TCP and sockets including a reverse SOCKS5 proxy, configured via TOML by Alexander Becker / cli, ssh, tools
Syncpack 15.0: CLI tool used by Electron, Cloudflare, and Vercel that finds and fixes dependency version mismatches across entire monorepos and enforces version policies — v15.0 adds pnpm and Bun catalog support and a default release age cooldown by Jamie Mason / javascript, monorepo, tools
Mockdown: Free browser-based ASCII wireframe editor for creating UI mockups, lo-fi prototypes, and text diagrams by Mockdown / design, tools
Orval: Given an OpenAPI v3 or Swagger v2 spec, generate type-safe models, request functions, React Query hooks, and mocks for React, Vue, Svelte, and Solid — also generates server-side code by Victor Bury / typescript, openapi, tools

🤪 Fun

Cursor Camp: An interactive web experience from Neal.fun full of hidden goofy details to discover — cursors swimming in a lake, anyone? by Neal.fun / fun, web / 1 min read

📺 Videos

TanStack Start vs Next.js with Tanner Linsley: A candid interview covering TanStack's business model, why Start exists alongside Next.js, and framework-agnostic thinking while still deeply focusing on React by Nuno Maduro / javascript, react

Want to read more? Check out the full article here.

To sign up for the weekly newsletter, visit weeklyfoo.com.

Terminal Comebacks, AI Reality Checks, and React Projections

Adam — Fri, 15 May 2026 04:43:08 +0000

Matteo Collina opens this week with a blunt reminder: trusted publishing helps, but social engineering still walks through the front door if maintainers aren’t careful. Then Addy Osmani, Simon Willison, and Drew Breunig pile on with the same message in different flavors — AI can move fast, but your engineering judgment still has to stay in the loop.

Alcides Fonseca makes the case for the terminal comeback tour, Ahmad Shadeed gives CSS range queries the practical guide they deserved, and Smashing Magazine reframes local-first as a full architectural inversion, not just “offline mode with better branding.” Meanwhile, Tanner Linsley shows what happens when React’s API contract gets “projected” into a tiny faster runtime, and The Pragmatic Engineer reminds everyone that AI-era traffic can break even giant platforms in very non-funny ways.

And for teams trying to operationalize all this: Addy’s Agent Skills argues for non-skippable discipline, Graphify turns scattered context into a queryable knowledge graph, Manifest routes prompts across 300+ models without torching your budget, and Warp Terminal going open source adds a little healthy pressure to the AI tool stack.

Enjoy!

Signup here for the newsletter to get the weekly digest right into your inbox.

Find the 13 highlighted links of weeklyfoo #136:

Agent Skills

by Addy Osmani

AI coding agents skip the senior-engineering work unless you encode discipline as something they cannot talk themselves out of

🚀 Read it!, ai, engineering

Why Trusted Publishing Can’t Save Us from Social Engineering

by Matteo Collina

Unmasking the risky illusion of npm’s trusted publishing amidst recent cyber attacks.

📰 Good to know, npm, security

Why TUIs Are Back

by Alcides Fonseca

Native GUI fragmentation and Electron bloat are driving a resurgence of Terminal User Interfaces — fast, automatable, and consistent across platforms

📰 Good to know, terminal, engineering

CSS Range Queries

by Ahmad Shadeed

Interactive guide on why you should use range syntax in media queries instead of min/max — visual demos included

📰 Good to know, css, frontend

Cognitive Surrender

by Addy Osmani

When AI output quietly becomes your output — engineers cross from cognitive offloading into cognitive surrender by borrowing AI confidence and treating it as their own

📰 Good to know, ai, engineering, opinion

Vibe Coding and Agentic Engineering Are Getting Closer

by Simon Willison

AI blurs the line between casual and professional engineering as dependable agents lead experts to trust generated output over documentation and tests — human expertise remains essential for production systems

📰 Good to know, ai, engineering, opinion

The Architecture of Local-First Web Development

by Smashing Magazine

A paradigm shift where app data lives on the user's device — modern implementations use SQLite compiled to WebAssembly with sync engines handling conflict resolution

📰 Good to know, engineering, database

Projecting React

by Tanner Linsley

Tanner Linsley spent a day prompting an AI agent to regenerate React's public API as a ~9KB runtime running 2-3x faster than stock React — shipped quietly and available on npm as @tanstack/redact

📰 Good to know, javascript, react, ai

AI Load Breaks GitHub – Why Not Other Vendors?

by The Pragmatic Engineer

Analysis of how AI-driven traffic overwhelmed GitHub infrastructure while other vendors avoided similar outages

📰 Good to know, engineering, ai

10 Lessons for Agentic Coding

by Drew Breunig

Durable practical guidelines for agentic coding with Codex, Claude Code, or any LLM coding agent — distilled from active experience tracking what sticks as models improve

📰 Good to know, ai, engineering

Graphify

by Safi

AI coding assistant skill (Claude Code, Codex, OpenCode, Cursor, Gemini CLI, and more). Turn any folder of code, SQL schemas, R scripts, shell scripts, docs, papers, images, or videos into a queryable knowledge graph. App code + database schema + infrastructure in one graph.

🧰 Tools, ai, skills

Manifest

by mnfst

Open-source AI model router that intelligently redirects each query to the most suitable model — 300+ models across 16+ providers, reduces AI costs by up to 70%

🧰 Tools, ai, tools

Warp Terminal Open Source

by Warp

Warp's AI-native terminal, previously closed-source, is now open sourced under Apache 2.0

🧰 Tools, terminal, tools

Want to read more? Check out the full article here.

To sign up for the weekly newsletter, visit weeklyfoo.com.

Stay ahead in web development: latest news, tools, and insights #136

Adam — Mon, 11 May 2026 04:51:17 +0000

Signup here for the newsletter to get the weekly digest right into your inbox.

weeklyfoo #136 is here: your weekly digest of all webdev news you need to know! This time you'll find 36 valuable links in 4 categories! Enjoy!

🚀 Read it!

Agent Skills: AI coding agents skip the senior-engineering work unless you encode discipline as something they cannot talk themselves out of by Addy Osmani / ai, engineering / 13 min read

📰 Good to know

Why Trusted Publishing Can’t Save Us from Social Engineering: Unmasking the risky illusion of npm’s trusted publishing amidst recent cyber attacks. by Matteo Collina / npm, security / 8 min read
Agentic Coding Is a Trap: The shift toward agentic coding risks atrophying developers’ critical thinking and implementation skills while increasing complexity by Lars Faye / ai, engineering / 14 min read
Why TUIs Are Back: Native GUI fragmentation and Electron bloat are driving a resurgence of Terminal User Interfaces — fast, automatable, and consistent across platforms by Alcides Fonseca / terminal, engineering / 8 min read
Agents with Taste: Coding agents don’t know what great animations feel like — on the gap between AI leverage and visual judgment in frontend work by Emil Kowalski / ai, frontend / 5 min read
I Am Worried About Bun: Post-Anthropic acquisition concerns about Bun’s future — the runtime remains excellent, but the worry is whether it gets the same enshittification seen in other developer tools by wwj.dev / javascript, engineering / 7 min read
CSS Range Queries: Interactive guide on why you should use range syntax in media queries instead of min/max — visual demos included by Ahmad Shadeed / css, frontend / 6 min read
Wiki Builder: A Claude Code Plugin for Building LLM Knowledge Bases by Elvis Saravia / ai, wiki, knowledge / 8 min read
Claude Code Is Not Making Your Product Better: At the frontier, the bottleneck is taste — AI raises the floor for everyone but won’t help artisans create better products, only generic ones by E.T. Handing / ai, engineering, opinion / 12 min read
Cognitive Surrender: When AI output quietly becomes your output — engineers cross from cognitive offloading into cognitive surrender by borrowing AI confidence and treating it as their own by Addy Osmani / ai, engineering, opinion / 13 min read
Postgres 19’s Most Exciting Features: An opinionated look at v19 highlights — pg_plan_advice, DDL extraction, online REPACK CONCURRENTLY, and observability improvements by Tianzhou / postgres, database / 13 min read
I tracked 430 hours of Claude Code usage.: 73% was wasted on these 9 patterns. by Mnimiy / ai, tokens / 1 min read
Vibe Coding and Agentic Engineering Are Getting Closer: AI blurs the line between casual and professional engineering as dependable agents lead experts to trust generated output over documentation and tests — human expertise remains essential for production systems by Simon Willison / ai, engineering, opinion / 10 min read
The Architecture of Local-First Web Development: A paradigm shift where app data lives on the user's device — modern implementations use SQLite compiled to WebAssembly with sync engines handling conflict resolution by Smashing Magazine / engineering, database / 35 min read
Projecting React: Tanner Linsley spent a day prompting an AI agent to regenerate React's public API as a ~9KB runtime running 2-3x faster than stock React — shipped quietly and available on npm as @tanstack/redact by Tanner Linsley / javascript, react, ai / 18 min read
From React to Web Components: A Migration That Saved 100KB: Migrating a site from React to native Web Components led to patterns that grew into the nanotags library — 100KB lighter with better performance by Pavel Grinchenko (Evil Martians) / javascript, frontend / 15 min read
AI Load Breaks GitHub – Why Not Other Vendors?: Analysis of how AI-driven traffic overwhelmed GitHub infrastructure while other vendors avoided similar outages by The Pragmatic Engineer / engineering, ai / 16 min read
10 Lessons for Agentic Coding: Durable practical guidelines for agentic coding with Codex, Claude Code, or any LLM coding agent — distilled from active experience tracking what sticks as models improve by Drew Breunig / ai, engineering / 4 min read

🧰 Tools

Graphify: AI coding assistant skill (Claude Code, Codex, OpenCode, Cursor, Gemini CLI, and more). Turn any folder of code, SQL schemas, R scripts, shell scripts, docs, papers, images, or videos into a queryable knowledge graph. App code + database schema + infrastructure in one graph. by Safi / ai, skills
Acai: Spec-driven software development toolkit with a feature.yaml format, CLI, and dashboard for tracking requirements from spec to code to tests by acai.sh / engineering, cli
Agent Desktop: Native desktop automation CLI for AI agents — 53 commands using OS accessibility trees, structured JSON output, no screenshots needed by lahfir / ai, cli, automation
Manifest: Open-source AI model router that intelligently redirects each query to the most suitable model — 300+ models across 16+ providers, reduces AI costs by up to 70% by mnfst / ai, tools
Flue: Experimental TypeScript framework for building headless AI agents using a runtime-agnostic harness — define agent logic and context through Markdown files with minimal code by Astro / ai, typescript
Openhare: AI-powered cross-platform desktop SQL client for querying and exploring databases by Sun Jian / ai, database
Agentic Inbox: Self-hosted React 19 and React Router 7 web email app built heavily on Cloudflare APIs — open sourced by Cloudflare / ai, tools, github
Formisch: Modular, type-safe, framework-agnostic form library for JavaScript by open-circle / javascript, tools
ShaderPad: Lightweight dependency-free WebGL shader library for embedding creative shader effects on any page — no boilerplate by Riley J. Shaw / webgl, tools
pg_column_tetris: Postgres extension that enforces optimal column alignment to minimize row padding waste — shows bytes lost to padding or blocks inefficient table creation by Roger Welin / postgres, database
Token Optimizer: Find the ghost tokens. Fix them. Survive compaction. Avoid context quality decay. by Alex Greenshpun / ai, tokens
Warp Terminal Open Source: Warp's AI-native terminal, previously closed-source, is now open sourced under Apache 2.0 by Warp / terminal, tools
Plow: HTTP benchmarking tool with real-time terminal stats, configurable concurrency and ramp-up, JSON output, and a web UI by six-ddc / tools, cli, performance
deepsec: Agent-powered vulnerability scanning for codebases — from Vercel Labs by Vercel Labs / security, ai, tools
Open Agents: Open-source three-layer framework for deploying durable background coding agents that run multi-step processes independently of a single request lifecycle, with tools for file management and GitHub PR automation by Vercel Labs / ai, tools, github
tsz: WIP Rust-based TypeScript compiler claiming to outperform tsgo — community watching if it becomes TypeScript 8 by tsz.dev / typescript, tools
Mirage: Unified virtual file system that lets AI agents interact with S3, Google Drive, Slack, and more through a single directory tree via standard Unix-like commands by strukto-ai / ai, tools

🤪 Fun

Datatype, font: Variable font that turns text characters into charts and data visualizations by Frank Tisellano / design, fun / 3 min read

Want to read more? Check out the full article here.

To sign up for the weekly newsletter, visit weeklyfoo.com.