Signup here for the newsletter to get the weekly digest right into your inbox.
weeklyfoo #150 is here: your weekly digest of all webdev news you need to know! This time you'll find 36 valuable links in 5 categories! Enjoy!
🚀 Read it!
- How Tailscale tracked down a 16-year-old SQLite bug: Six months of recurring database corruption, ending in a fix inside SQLite itself. by Tailscale / databases, debugging / 20 min read
📰 Good to know
- Now we have a timeline of the OpenAI accidental attack against Hugging Face: Full breakdown of how OpenAI agents probing infrastructure ended up hammering Hugging Face, with the internal timeline of what happened. by Simon Willison / security, ai / 6 min read
- Triaging the AI Horde: A maintainer on sorting real security bugs from 20-40 AI-written reports a week, and why the pushback threshold has to go up. by Matteo Collina / security, oss / 4 min read
- atproto for distributed systems engineers: Atproto explained as a shared data model plus public APIs for NoSQL services, aimed at decentralising high-scale backends. by atproto / distributed, protocols / 8 min read
- We replaced Redis with MySQL for inventory reservations and it scaled: Shopify moved reservations to MySQL with SKIP LOCKED for ACID guarantees and fewer oversells on peak days. by Shopify / database, mysql / 15 min read
- How we pushed CDC into Postgres and turned replication into clockwork: A push-based change data capture extension for Postgres that keeps data and schema changes in sync with low latency. by Snowflake / postgres, data / 12 min read
- Revision prompting improves industrial LLM processes: Feed the model the original input, its original output and the input diff, then ask for a patch instead of a rewrite. by Revision Prompting / ai, llm / 5 min read
- Migrating a large Flow monorepo to TypeScript: Yelp moved 1.4 million lines off Flow over several years, and the writeup reads as a guide to running any long migration. by Yelp / typescript, migration / 14 min read
- How the Astro team built a software factory to slash its issue count: Agent-driven triage took Astro from over 200 open issues down to 30. by Matthew Phillips / ai, oss / 25 min read
- Everything I learned shipping Device Bound Session Credentials: Sessions bound to a private key the browser generates in hardware and cannot export. by Scott Helme / security, web / 21 min read
- Stolen thoughts: Encrypted reasoning traces replayed into jailbroken sibling models leaked keys, tokens and PII across 315,320 decoded blocks. by Stolen Thoughts / security, ai / 21 min read
- When a job offer becomes a zero-day attack: Lazarus shipped modified PDF viewers into the defence sector and chained a zero-day into a rootkit. by Check Point / security / 25 min read
- I put GitHub Copilot behind a MITM proxy: What Copilot actually sends home, from context assembly to interaction logging. by Lighthouse / security, ai / 18 min read
- The dangers of Postgres subtransactions: Past 64 subtransactions throughput fell from 7,200 TPS to 160, and new read replicas refuse connections. by PlanetScale / postgres, performance / 18 min read
- Rebuilding Postgres for 300x faster analytics: Batching, operator fusion and SIMD in a query engine, from the creator of pgrust. by Michael Malis / postgres, performance / 11 min read
- Adding a second middleware broke our TypeScript types: A key-filtering idiom that leaks undefined on optional properties collapsed a return type to an empty object. by Linell Bonnette / typescript, debugging / 13 min read
🧰 Tools
- Hucre: Zero-dependency, tree-shakeable spreadsheet engine with embedded images, hyperlinks, password protection and pivot tables. by Wind / javascript, library
- TanStack Table v9: Tree-shakeable architecture, state moved to TanStack Store, and big memory wins on large datasets. by Kevin Van Cott / react, library
- Docker Sandboxes: Run coding agents in their own microVMs with a Docker daemon inside. by Docker / ai, docker
- scriptc: An experimental TypeScript-to-native compiler from Vercel Labs, falling back to a bundled QuickJS engine for dynamic parts. by Vercel Labs / typescript, compiler
- pnpm 12, the Rust rewrite: Release candidate with only three behavioural differences from pnpm 11. by pnpm / tooling, pnpm
- OpenChamber: An agentic development environment that keeps code and session data local across multiple models. by OpenChamber / ai, tooling
- sqlfmt: A gofmt-style formatter for SQL, with a web version for prepping queries in slides and posts. by Dimitri Fontaine / sql, tooling
- Sourcebot: Self-hosted code search, navigation and question answering across many repositories. by Sourcebot / oss, search
- njsscan 1.0: Zero-config SAST for Node with around 70 semgrep rules for XSS, SSRF, eval, JWT and NoSQL injection. by Ajin Abraham / security, nodejs
- Vitest 5.0 release candidate: The next major of the Vite-native test runner is up for testing. by Vitest / testing, tooling
- Hunk: A terminal diff viewer built to make reviewing agent-written code manageable. by Ben Vinegar / cli, review
- Biome useReactCompiler rule: Runs React Compiler in lint mode and reports which components and hooks would not compile safely. by Biome / tooling, react
- Foreman: A software factory that moves each GitHub or Linear task through classifier, analyst, implementer and reviewer stations. by Vercel Labs / ai, agents
- Computer: Give your agent a computer. by Cloudflare / ai, agents
- Argos: Visual review of product changes, so teammates and agents can comment on the diffs before merge. by Argos / testing, review
🤪 Fun
- Plethora: A world of tiny interactive bits, games, art, music, puzzles and strange little experiences. by Plethora / interactive, fun / 4 min read
- js1024 2026 results: Three winners in 1024 bytes of JavaScript, with readable and minified source so you can steal the techniques. by js1024 / javascript, fun / 33 min read
📺 Videos
- Everything you learned about SSL is deprecated: TLS 1.3, forward secrecy going mandatory, free certificates, and lifetimes falling to 47 days. by Todd Gardner / security, tls
- How Anthropic uses Claude Code, agentic software engineering at scale: The context engineering primitives behind plugins and agent teams, and why the KV cache makes swapping rules expensive. by Daisy Hollman / ai, engineering
- It is like 10,000 streams when what you need is a queue: Event sourcing, Kafka and RabbitMQ, and the head of line blocking you get from picking wrong. by Chris Simon / architecture, messaging
Want to read more? Check out the full article here.
To sign up for the weekly newsletter, visit weeklyfoo.com.
Top comments (0)