Stay ahead in web development: latest news, tools, and insights #148

#webdev #weeklyfoo #javascript #node

Signup here for the newsletter to get the weekly digest right into your inbox.

weeklyfoo #148 is here: your weekly digest of all webdev news you need to know! This time you'll find 36 valuable links in 5 categories! Enjoy!

🚀 Read it!

Session revocations at scale: How Canva revokes sessions for hundreds of millions of users with encrypted cookies and in-memory lookups, and why moving revocation records to S3 cut database load and shrank the cache by Canva / engineering, security, scale / 12 min read

📰 Good to know

The new rules of context engineering for Claude 5 generation models: Anthropic cut over 80% of Claude Code's system prompt for the newer models — smaller prompts, progressive disclosure through skills, and context assembled from skills, CLAUDE.md and memory instead by Anthropic / ai, agents, claude / 23 min read
The life of a Codex conversation on disk: Walkthrough of the journal file, caches and indexes behind a Codex chat — and why clearing a thread is not the same as deleting it by Alessandro Fazio / ai, agents, tools / 2 min read
How to structure a log: Stable event names, scoped attribute keys, primitive values — and enforcing the conventions with ESLint so logs stay queryable months later by Sentry / observability, logging / 42 min read
Modeling facts and reactions with domain events: Separating a fact from its consequences so reactions can fail, evolve and scale without dragging the core business logic along by Denis Kyashif / architecture, ddd / 10 min read
Domenic Denicola's agentic coding setup: Disposable VMs, Tailscale and worktrees — how a longtime JavaScript standards figure runs coding agents day to day by Domenic Denicola / ai, agents, workflow / 22 min read
Measuring component performance with the Container Timing API: Per-component render timings straight from the browser, now in a Chrome origin trial by Harry Roberts / performance, web / 24 min read
Discovering cryptographic weaknesses with Claude: A model halved the effective key strength of the HAWK signature scheme and sped up an attack on reduced-round AES by up to 800x, working mostly on its own for a week by Anthropic / ai, security, cryptography / 22 min read
Kimi K3 architecture notes: LatentMoE, attention residuals, and dropping RoPE in favour of NoPE in a bigger open-weight model by Sebastian Raschka / ai, ml, architecture / 4 min read
MCP gets its largest update since launch: The protocol goes stateless, so remote servers run on serverless and edge infra or scale horizontally behind a load balancer by MCP / ai, mcp, protocols / 7 min read
How Figma stays ahead of vulnerabilities with agents: Precision over recall was the whole game — 70% before agents were allowed to comment on PRs, and the shared policy became a de facto threat model by Figma / security, ai, agents / 28 min read
The secure way to release an npm package in 2026: Staged publishing, trusted publishing and provenance, explained by the person behind postcss and nanoid by Andrey Sitnik / npm, security, javascript / 28 min read
npm now scans every package for malware at publish time: New versions can take minutes to become installable, and can be held or blocked outright by GitHub / npm, security / 6 min read
How GitHub is disrupting supply chain attacks on npm and Actions: The registry and Actions changes designed to cut off the techniques attackers keep reusing by GitHub / security, npm, github / 19 min read
Treat prompt changes like code deploys: Prompts are dependencies that shift production behaviour with no failing build, so gate them and default the gate to blocking by Luke Murray / ai, engineering / 6 min read
The economic benefit of refactoring: Refactoring an AI-generated codebase cut token consumption for later updates by 83 percent and made navigation cheaper by Martin Fowler / engineering, refactoring, ai / 18 min read
Your SPA is leaking memory, soak test it: Loop a Playwright flow in a single browser context and watch DOM node and listener counts to catch the leak before users do by Den Odell / javascript, performance, testing / 15 min read

🧰 Tools

scriptc: Compiles ordinary TypeScript into small native executables — no Node, no V8 in the binary, ~2ms startup and 170–200KB static builds by Vercel Labs / typescript, compiler, tools
hilos: Team chat where AI coding agents are members of the channel next to the humans — plan in a thread, the agent works on the repo and comes back with a PR to review by Pablo Stanley / ai, agents, tools
Octane: React's programming model compiled ahead of time — no VDOM, no rules-of-hooks bookkeeping, JSX and TSX supported by Dominic Gannaway / javascript, react, framework
tslog 5: Zero-dependency logger for Node, Deno, Bun and browsers — pretty or JSON output, transports, secret masking, stacks mapped back to your TypeScript lines by Eugene Terehov / typescript, logging, tools
eslint-package-json: ESLint rules that catch bad names, broken exports and invalid version ranges in package.json, and autofix most of them by Sindre Sorhus / javascript, linting, tools
Seal: Open standard for proving a file is real — sealed artifacts anchored to a public ledger that prove integrity, time and issuing certificate by Seal / security, tools
htmx 4.0: Fourth major version of the library, released — of course — on a Game Boy cartridge by htmx / web, html, tools
Codex Security: CLI and TypeScript SDK that scans repos for vulnerabilities, validates them, and tracks findings over time by OpenAI / security, cli, tools
pgGraph: Postgres extension for graph search, traversal, shortest path and relationship queries straight against ordinary tables by Evokoa / postgres, databases, tools
TurboFieldfare: Runs Gemma 4 26B on Apple Silicon in roughly 2GB of RAM by streaming weights instead of loading all 14.3GB at once by drumih / ai, llm, tools
Claude Code Merge Queue: Local merge queue for parallel coding agents, so simultaneous landings stop racing each other on push by funador / ai, agents, tools
numbat: Endpoint visibility into what AI agents actually do, with optional pre-action blocking and forensic reconstruction by Perplexity / ai, security, tools
jsdom 30: The browser environment emulator behind countless test suites picks up CSS.escape, CSS.supports and background-position-x by jsdom / javascript, testing, tools
Ada v4: The WHATWG-compliant URL parser Node depends on gets another speed pass by Yagiz Nizipli / nodejs, performance, tools
modern-tar: Zero-dependency streaming tar parser and writer by ayuhito / javascript, tools

🤪 Fun

PGSimCity: Postgres internals as a 3D city you can walk around in and break on purpose by Nikolay Samokhvalov / postgres, fun / 1 min read
A chat app that rewrites its own UI in real time: Raw HTML, CSS and JavaScript streamed straight into the DOM, so the model rebuilds its own interface into games and themes while you talk to it by Varshith V Hegde / ai, fun / 23 min read

📺 Videos

The creator of TypeScript shows off TypeScript 7: Anders Hejlsberg demos the Go-based compiler running 10x faster on VS Code's 1.3M line codebase, plus the new LSP language server by Anders Hejlsberg / typescript, video
React debugging with performance tracks: 15 minute tour of the React-specific entries that now show up in your browser DevTools by Shruti Kapoor / react, video

Want to read more? Check out the full article here.

To sign up for the weekly newsletter, visit weeklyfoo.com.

DEV Community