Signup here for the newsletter to get the weekly digest right into your inbox.
weeklyfoo #152 is here: your weekly digest of all webdev news you need to know! This time you'll find 34 valuable links in 5 categories! Enjoy!
🚀 Read it!
- VMs Won't Contain Cyber-Capable Agents: Testing showed agents escaping VMs through known and unknown host bugs, so containment needs a much smaller attack surface by Trail of Bits / security,ai / 9 min read
📰 Good to know
- There's No Reason for Software to Be Slow Anymore: AI collapsed the cost of optimization, so tricky perf work that was never worth the risk is now a trivial loop by Dan Luu / performance,ai / 23 min read
- The New MCP Roadmap: Five priority areas for the next spec releases, including agentic messaging primitives, transport hardening and agent identity by MCP Team / mcp,ai / 8 min read
- An AGENT.md to Improve LLM-Assisted Code Quality: A good coding harness beats a better model, and most of it fits in one file by Fabien Sanglard / ai,tooling / 6 min read
- Fable & the End of the Free Lunch: When a cheaper model arrived every few months, optimizing your harness was a waste. That assumption just broke. by Drew Breunig / ai,llm / 2 min read
- How We Saved 100 Terabytes of Memory by Optimizing 1.1.1.1's DNS Cache: Five successive changes to cache entry storage cut per-entry footprint by half, with 43 percent faster inserts by Cloudflare / performance,dns / 30 min read
- Closing the AI Agent Trust Gap With Graduated Autonomy: Agents earn permissions through a rolling reliability score and four tiers, promoted slowly and demoted instantly by AWS / ai,agents / 16 min read
- Why AI Coding Agents Need Context Graphs: Coding agents fail in real codebases because team context is scattered, so publish a queryable graph of typed entities instead by Postman / ai,agents / 15 min read
- Making Your Data Ready for Agentic AI: Data contracts, context layers and controlled access, because pipelines built for human analysts do not survive autonomous agents by Martin Fowler / ai,data / 52 min read
- Audit Your Agent Files: Agent configs have a half-life, so make every instruction earn its place again every few weeks by Addy Osmani / ai,agents / 16 min read
- Agent Swarms Are a Distributed Systems Problem: A swarm of agents mutating shared memory is a transaction problem, and Chroma treats it like one by Chroma / ai,agents / 11 min read
- Read Your Writes with WAIT FOR in Postgres 19: A session can block until WAL reaches a position, so only the reads that need it pay for replica lag by Gülçin Yıldırım JelÃnek / postgres,database / 12 min read
- Your Executable Is a SQLite Database: Replacing ELF with SQLite so a binary can be queried and patched with plain SQL by Farid Zakaria / systems,sqlite / 15 min read
- Two Critical Unauthenticated RCEs Patched in Next.js: Update to 16.3.3 or 15.5.24, depending on which line you are on by Next.js Team / security,nextjs / 3 min read
- DuckLabs Is Joining AWS: DuckDB, DuckLake and Quack stay MIT licensed and open source, with AWS scale behind them by DuckLabs / database,news / 9 min read
- Query Pipelining in node-postgres: Two to three times the throughput and lower latency from one config change by Matteo Collina / postgres,nodejs / 10 min read
🧰 Tools
- Apache Maka: Local-first AI agent workspace where interactions and session data stay on your machine by Apache / ai,agents
- Proliferate: Open source AI IDE that runs Claude Code, Codex and friends in parallel isolated workspaces, self-hostable by Proliferate / ai,ide
- Kern: Rootless container runtime with kernel-enforced isolation and roughly 3.5ms cold starts, no daemon by Kern / containers,runtime
- PicoMQ: Durable real-time streaming over HTTP backed by S3-compatible object storage by PicoMQ / streaming,infra
- GlassBox: Client-side tool that shows every signal a website can quietly collect from your browser by Code Canary / security,privacy
- Blume: Drop Markdown into a folder and ship a production-grade docs site, free and open source by Hayden Bleasel / docs,tooling
- Whip: Fast coding-agent harness in Go with background subagents and open model discovery by Context Labs / ai,cli
- LatticeDB: Embedded property-graph database folding vector similarity, full-text search and traversal into one local engine by LatticeDB / database,search
- Run SDK: Runs untrusted JavaScript in a fresh QuickJS context per call, exposing only the host functions you pick by Vercel / security,javascript
- pgbot: Single read-only Go binary that prints a graded Postgres health report plus what changed since the last run by Alex Shapalov / postgres,cli
- Better Auth 1.7: Standards-based OAuth server with DPoP, per-API token rules, device code flow and MCP auth in its own package by Gustavo Valverde / auth,javascript
- SVGO 4.1: Node-powered SVG optimizer, now with stricter XML validation and security improvements by Kir Belevich / svg,tooling
- BrowserSkill: Lets agents drive your already logged-in browser through a CLI and extension without hijacking your session by Tencent / ai,browser
- Context Engineering Toolkit: Spec-driven development, subagent workflows and plugins aimed at making AI-generated code hold up by NeoLab / ai,tooling
- pnpm 12: The package manager is now written in Rust, so it is faster and it also breaks things by pnpm / tooling,rust
🤪 Fun
- A Walkable ASCII Cyberpunk City in One HTML File: Raycasting renders roads, buildings, cars and pedestrians entirely in ASCII characters by Grow Now! Games / fun,web / 1 min read
📺 Videos
- The Creator of TypeScript on Faster TypeScript and Why AI Won't Replace SWEs: Candid hour-long interview with Anders Hejlsberg by Ryan Peterman / typescript,ai
- Why Performant Code Matters But Gets Widely Ignored: Casey Muratori on profiler-driven optimization being a local minimum, reading assembly, and his critique of clean code by Gergely Orosz / performance,podcast
Want to read more? Check out the full article here.
To sign up for the weekly newsletter, visit weeklyfoo.com.
Top comments (0)