Signup here for the newsletter to get the weekly digest right into your inbox.
weeklyfoo #155 is here: your weekly digest of all webdev news you need to know! This time you'll find 35 valuable links in 5 categories! Enjoy!
🚀 Read it!
- Building a robust harness for agents in production: monday.com treats reliability as the system around the model, with input cleanup, hallucination checks, schemas, execution limits and output validation by monday.com Engineering / ai,agents,engineering / 12 min read
📰 Good to know
- Fixing top-level await in Safari: WebKit rewrote Safari's module loader in native C++ after the old one relied on the abandoned 2016 WHATWG Loader proposal, fixing top-level await and an import-order bug by WebKit Blog / javascript,safari,webkit / 9 min read
- OpenAI agents carried out an undisclosed cyberattack on RubyGems: Researchers attribute a May campaign of 2000+ malicious packages to an agent swarm that abused RubyDoc.info builds for remote execution by rubyhack.ai / security,supply-chain,ai / 20 min read
- Slow developer experience will bottleneck fast models: Once generating tokens stops being the bottleneck, the speed of everything around the editor starts to matter a lot more by Sean Goedecke / devex,ai / 4 min read
- Agentic coding is straining CI, here's how Anthropic scaled test impact analysis: A 25x jump in CI jobs in six months broke a singleton test selection service, replaced by stateless listener workers, an in-memory journal and a separate rollup consumer by Anthropic / ci,testing,ai / 16 min read
- Brownfield agentic engineering: Agentic engineering in existing codebases is about making hidden constraints visible and cheap changes trustworthy by Addy Osmani / ai,agents,engineering / 18 min read
- Control GitHub Actions cache access with cache-mode: A new setting restricts which workflows may write to a cache, closing off cache poisoning by GitHub / ci,github,security / 4 min read
- Mass scanning for exposed Vite dev servers: Attackers exploit a server.fs.deny bypass to pull credentials from .env files, patched in Vite 7.3.2 and 8.0.5 by F5 Labs / security,vite / 17 min read
- pnpm 12.4: The package manager now handles Rust crates and Python packages next to npm ones in a single workspace by pnpm / tooling,pnpm / 13 min read
- Zod 4.6: Adds validate(), a boolean check up to 35x faster than safeParse().success on invalid input with compiled schemas by Zod / typescript,validation / 16 min read
- Tom Lane on 30 years of Postgres architecture: Why Postgres uses processes rather than threads, how MVCC holds up, and which version he liked least by Tom Lane / postgres,database / 45 min read
- Plan advice in Postgres 19: pg_plan_advice and pg_stash_advice capture planner advice, enforce it selectively and apply it automatically by query id by Dimitri Fontaine / postgres,database / 15 min read
- Escaping the OpenAI Codex sandbox, twice: One escape widened patch write permissions, the other recovered a trusted token from a shared JavaScript heap, and the lesson is to keep enforcement outside the environment being constrained by Accomplish / security,ai,sandbox / 6 min read
- Small programming tricks matter: Fuzzy shell history, EXPLAIN ANALYZE, git log -S and ripgrep compound into meaningful gains when teams share them regularly by Will Keleher / tooling,productivity / 4 min read
- Why GitHub ported Copilot's runtime from Node to Rust: Ported piece by piece behind napi-rs shims while shipping daily, with the real lessons hiding in number types, logical-or semantics and a blocked event loop by GitHub Blog / rust,nodejs,performance / 84 min read
- A deep dive into JavaScript engines: How hidden classes, inline caches and deoptimization in V8 react to the code you actually write by Audrey Doyen / javascript,v8,performance / 22 min read
- The test suite is the new code review: Once agents open and review pull requests in minutes, the suite and the merge queue become the delivery bottleneck, and one repo cut relevant CI from thirteen minutes to two by Allen Hutchison / testing,ci,ai / 17 min read
🧰 Tools
- funes: Indexes agent session traces locally with vector search, BM25 and cross-encoder reranking, then returns the original text with provenance instead of summaries by Hugging Face / ai,agents,memory
- Real-SWE: Evaluates model and harness pairs on ten tasks from licensed private production codebases, where the top configuration resolved 38.8% across 640 rollouts by Specific / ai,benchmark
- @shadcn/lint: Agent-first linter for Tailwind design systems that works with existing systems without a rewrite by shadcn / tailwind,lint,ai
- Sidebranch: Visually compare UI changes between branches side by side without touching your working tree by Sidebranch / git,ui,testing
- modern-web-types: Drop-in lib.dom replacement adding TypeScript types for APIs shipped in only one browser engine, like element-scoped startViewTransition by Philip Walton / typescript,web,types
- snapdom 3.0: Zero-dependency html2canvas alternative with pseudo-element and Shadow DOM support, incremental recapture and web font embedding by Zumerlab / javascript,dom,images
- fallow: Zero-config Rust binary that finds dead code, duplication, circular dependencies and complexity hotspots in JS and TS projects by Bart Waardenburg / typescript,lint,tooling
- Pizza Bot: Local-first inbox for long-running agents with durable runs, approval queues, scheduling, checkpointing and desktop, web and terminal clients by Pizza Bot / ai,agents,opensource
- The Front-End Checklist: Almost 400 frontend quality rules for accessibility, performance, security and SEO, now reachable over MCP so agents review against the same standards by David Dias / frontend,quality,mcp
- WalShadow: Replicates Postgres into ClickHouse from the physical WAL instead of logical decoding, at roughly 200ms commit-to-visible latency by ClickHouse / postgres,clickhouse,opensource
- PostgreSQL Migrator 1.0: Single-binary Oracle and MySQL to Postgres migration with a web UI for spotting problems and COPY-based data transfers by Dalibo / postgres,migration
- TIN: Full-text search extension for Postgres by PlanetScale / postgres,search
- Worktrunk: CLI that makes git worktrees feel like branches with three core commands, plus hooks for pull requests, merging and shared build caches by Worktrunk / git,cli,tooling
- Cloudflare security audit skill: Multi-phase repository audits with reconnaissance, coverage-led hunting, adversarial validation and independent verification, using isolated agents so no worker approves its own finding by Cloudflare / security,ai,tools
- OJ: A Rust dev server that reads your existing vite.config.ts and runs Vite plugins, tuned for low memory use and fast cold starts by Lovable / rust,vite,tooling
🤪 Fun
- n64js 1.0: A Nintendo 64 emulator written in pure JavaScript by hulkholden / javascript,emulator,gamedev / 7 min read
- Know your shortcuts: An interactive 3D keyboard that lights up the keys as you hover the shortcuts of the apps you use every day by shrtcts / fun,tools / 65 min read
📺 Videos
- Casey Muratori on surprises in computer history and where bad code comes from: Two hours on computing history and the origins of bad code, deliberately recorded free of any AI doom content by Ryan Peterman / podcast,engineering
Want to read more? Check out the full article here.
To sign up for the weekly newsletter, visit weeklyfoo.com.
Top comments (0)