This week has two recurring themes: supply chains are on fire, and infrastructure keeps getting weirder in a good way. The high-signal alert is Socket's report on the keyv/cacheable compromise, plus Better Stack's video on the worm that hopped from npm into Go — together they make a convincing case for treating package updates like unexploded ordnance, just with semver.
On the protocol and platform side, Stateless MCP is the kind of change that makes a spec feel instantly more practical, Cloudflare Computer turns Durable Objects into a tiny SQLite-backed machine room, and Workers gaining inbound TCP and gRPC quietly expands what an edge app can be.
There are also a few excellent reminders that the boring details are never actually boring: Your JSON is lying to you catalogs the silent breakage around BigInt, Date and undefined, Promise.allKeyed reaching stage 3 promises less async object-wrangling, and a Ruby warning hunt that cut heap usage by 60% is pure performance-detective catnip.
The standout deep read is PlanetScale's massively parallel Postgres backup write-up, which is delightfully large-scale and slightly intimidating. And on the tools side, gh stack makes stacked PRs less painful, Varlock tries to keep your env files AI-safe without wrecking your workflow, and Syncular bets that local-first SQLite plus CRDT conflict resolution should be your default starting point.
Enjoy!
Signup here for the newsletter to get the weekly digest right into your inbox.
Find the 12 highlighted links of weeklyfoo #149:
Massively parallel Postgres backups
by PlanetScale
Consistent encrypted snapshots of petabyte-scale sharded Postgres every 12 hours via WAL replay and parallelism across shards
🚀 Read it!, postgres,database,infra
Curiosity reduced the heap size by 60%
by Mostly Obvious
Chasing a filtered-out Ruby warning revealed OpenTelemetry force-loading 200 AWS SDK classes at boot, cutting heap 60% and boot time 36%
📰 Good to know, ruby,performance,debugging
Cloudflare Computer
by Cloudflare
A virtual file system inside a Durable Object with SQLite as authoritative state, running agent code in isolates, containers or a browser
📰 Good to know, cloudflare,agents,infra
keyv and cacheable compromised by a credential-stealing worm
by Socket
An active npm supply chain incident with hundreds of packages affected so far
📰 Good to know, security,npm,supplychain
Your JSON is lying to you
by Gabor Koos
A parse and stringify round trip quietly mangles big integers, undefined and Date, so make the conversion boundaries explicit
📰 Good to know, javascript,json
Cloudflare Workers adds inbound TCP connections and gRPC
by Cloudflare
Workers can now terminate raw TCP and speak gRPC, currently in private beta
📰 Good to know, cloudflare,workers
Await dictionary of Promises reaches stage three
by TC39
Promise.allKeyed lets you await an object of promises and destructure the result
📰 Good to know, javascript,tc39
Stateless MCP has recaptured my interest
by Simon Willison
MCP 2.0 drops the session requirement, making servers far simpler to build
📰 Good to know, ai,mcp
gh stack
by GitHub
GitHub CLI extension for stacked PRs that automates branch creation, rebasing and PR base branches, with AI agent integration
🧰 Tools, git,cli,github
Varlock
by Theo Ephraim
Makes your env files AI-safe without breaking your app
🧰 Tools, tools,security,ai
Syncular
by Syncular
Offline-first SQL sync giving every client a local SQLite database backed by a server-side commit log, with CRDT conflict resolution
🧰 Tools, sqlite,sync,tools
The largest supply chain attack just infected Go
by Better Stack
The Shai Hulud worm jumped ecosystems from npm to Go, and what that means for both
📺 Videos, security,supplychain,go
Want to read more? Check out the full article here.
To sign up for the weekly newsletter, visit weeklyfoo.com.
Top comments (0)