Signup here for the newsletter to get the weekly digest right into your inbox.
weeklyfoo #154 is here: your weekly digest of all webdev news you need to know! This time you'll find 39 valuable links in 5 categories! Enjoy!
🚀 Read it!
- Half past fetch, or what await fetch() actually waits for: It resolves on the headers, not the body, with surprising consequences for connections, clone(), aborts and timeouts by Gábor Koós / javascript,web / 21 min read
📰 Good to know
- Portal by Spotify cut my Claude Code token usage by 90%: Route big file reads and predictable codegen to cheaper workers, keep debugging and architecture with the frontier model by Spotify Engineering / ai,tooling / 10 min read
- It took a year to ship WebAssembly in Anubis: Argon2id proof-of-work challenges, the same binary on client and server, SIMD and non-SIMD builds, and a wasm2js fallback by Xe Iaso / wasm,security / 2 min read
- Between the graph and the silicon: inside the Apple Neural Engine compiler: Core ML is the public part. The compiler, program format, driver and firmware underneath it are not documented at all by smolnero / hardware,ml / 14 min read
- How well do agents use test and verification techniques?: Across 26 testing conditions on a Rust Zstd task the plain default prompt performed above average, and agents kept following the requested framework only superficially by Dan Luu / ai,testing / 65 min read
- The year finding and exploiting bugs became cheap: Offensive capability is becoming abundant, so handling critical bugs in time turns into the defining task for defenders by zkSecurity / security,ai / 18 min read
- 7 AI models ran real businesses: $12,431 in fake invoices, 2,797 spam emails, $0 revenue: Seven frontier models got $300, a Mac mini and 72 hours. They spent $3,200, sent 2,797 emails and earned nothing by Bottleneck Labs / ai,agents / 11 min read
- I factored the RSA keys of a 90s certificate authority: Two 512-bit roots shipped with Netscape in 1999, each cracked on a desktop in about 30 hours, then used to issue certificates on a period-correct TLS server by Matthew McPherrin / security,crypto / 5 min read
- How to optimize when you can't do anything: A production query on a 750GB, 16 billion row table went slow, the right index would have taken over a day, so the data itself supplied the fix by Henrietta Dombrovskaya / postgres,performance / 12 min read
- Sixteen locks ought to be enough for anybody: Postgres takes a weak lock on every index of a table while planning, whether the query uses it or not, which stung once you passed 16 by Christophe Pettus / postgres,internals / 7 min read
- React 19.3: View Transitions and Fragment refs land stable, plus Trusted Types support and new Server Components capabilities by React Team / react,frontend / 18 min read
- node:bench, a built-in benchmark runner for Node core: Modelled on node:test, with a node --bench CLI and a JSON reporter. Already landed on main by James M Snell / nodejs,performance / 4 min read
- Critical remote code execution in vm2: A CVSS 10.0 sandbox escape in the widely used Node sandboxing library, patched in 3.11.7+, with the argument that vm2 should never hold genuinely untrusted code by GitLab / security,nodejs / 14 min read
- Fuzzing the state machines inside my HTTP client: Adding fast-check properties to 206 passing tests surfaced 11 real bugs in code considered fully tested by Gabor Koos / testing,javascript / 28 min read
- Native is now the future of mobile at Shopify: React Native goes back to Swift and Kotlin, because coding agents made two native implementations cheap enough to maintain. The Shop app took 12 weeks from proof of concept to release by Shopify Engineering / mobile,ai / 14 min read
- Introducing Neki, sharded Postgres: Shards real Postgres across machines while keeping the wire protocol, drivers, ORMs and extensions intact, with online resharding and failover workflows by PlanetScale / postgres,database / 7 min read
- Introducing the Agents API: The harness behind Codex opened up as an API that manages context, tools, files and subagents, with sessions that keep running for hours or days by OpenAI / ai,agents / 1 min read
- Your React app can unmount when a reader turns on Chrome Translate: Why the classic removeChild error happens, and why the usual monkey-patch hides the crash while leaving the UI broken by Davlat Aliev / react,debugging / 9 min read
🧰 Tools
- Vidact: Compiles a documented subset of React 19 into direct DOM operations, and rejects unsupported APIs at build time instead of silently falling back to the React runtime by Vidact / react,compiler
- CVE MCP Server: 27 security-intelligence tools backed by 21 APIs behind one MCP server, from CVE lookup and EPSS scoring to CISA KEV, MITRE ATT&CK, Shodan and VirusTotal by mukul975 / security,mcp
- Mesurer: Measure, inspect and capture interfaces directly in the browser, and feed the visual feedback straight back into your coding workflow by Julien Thibeaut / ui,tools
- Vitest 5.0: Up to 53% faster runs on dependency-heavy apps, a Trace View that replays Browser Mode tests step by step, and a doctor command that suggests faster settings by Vitest Team / testing,tools
- Rslib 1.0: Build pipeline from the Rspack team for shipping libraries, handling ESM and CJS side by side, Module Federation output and component CSS for React, Vue, Svelte and Solid by Rspack Team / build,tools
- vgpu: Render WebGPU shaders in the browser or headlessly in Node to a high-resolution PNG or MP4, with WGSL modules that import and export like TypeScript by Vercel / webgpu,tools
- codiff: Fast local diff viewer by Christoph Nakazawa / tools,git
- WCAG Radar: Bookmarklet and extension that runs WCAG 2.1 and 2.2 AA checks against the open page locally and marks the results up in place by Proper Access / a11y,tools
- Kafgres: A pgrx extension serving the Kafka wire protocol from a Postgres background worker, so ordinary Kafka clients produce, consume and rebalance against your database by Raynor Elgie / postgres,kafka
- chDB for Postgres: ClickHouse's chDB engine wrapped as an extension, so COPY pulls Parquet, Avro, ORC and Arrow straight from S3, GCS, Azure or HTTP by ClickHouse / postgres,data
- Copperhead: Open-source CLI agent for KiCad that edits schematic and board files in your repo and reruns ERC and DRC until they pass by Copperhead / hardware,agents
- eslint-plugin-regexp: Catches regex mistakes, with an online playground that demonstrates what it finds by Yosuke Ota / eslint,regex
- Base UI 1.8: The unstyled component library that is now shadcn/ui's default by Base UI / react,ui
- React DevTools for coding agents: Experimental package exposing React DevTools to agents through chrome-devtools-mcp by React / react,ai
- openeval: Typed prompt-plus-LLM-judge SDK and CLI for scoring model output from your own test suite by Luke Parker / ai,testing
- DPiCSS: Tiny CSS library that swaps an image for its animated or higher-definition version on click, no JavaScript involved by Olivier Blanc / css,images
🤪 Fun
- Making a Python interpreter in 1024 bytes: Integer arithmetic, indentation-based control flow, functions and recursion, in exactly 1024 bytes of C. Enough to run FizzBuzz by Austin Henley / python,c / 8 min read
- Opusfived: One-line CSS request, escalating into overengineering, scope creep, false completion and painfully familiar agent language by opusfived / ai,satire / 1 min read
📺 Videos
- The story of VS Code: Movie-length documentary in which the founding engineers cover Electron, LSP, the extension API and the forks now springing up by Microsoft / tools,history
- How can someone actually change JavaScript?: A two-minute explainer of the TC39 process from a delegate by Mikhail Barash / javascript,tc39
- Software abstraction in the age of AI-generated code: Where abstraction still earns its keep once the code writes itself by Andrei Alexandrescu / ai,engineering
Want to read more? Check out the full article here.
To sign up for the weekly newsletter, visit weeklyfoo.com.
Top comments (0)