Stay ahead in web development: latest news, tools, and insights #161

Signup here for the newsletter to get the weekly digest right into your inbox.

weeklyfoo #161 is here: your weekly digest of all webdev news you need to know! This time you'll find 41 valuable links in 5 categories! Enjoy!

🚀 Read it!

Building an isolated preview for AI-generated HTML: A srcdoc iframe runs model-written HTML on your own origin, so a security engineer breaks the naive approach and rebuilds it with sandbox and a strict CSP by Keshav Malik / security, ai, html / 14 min read

📰 Good to know

Shipping 103,802 dots in 82 KB: Quantized coordinates split into streams that expose repeated rows to Brotli, 63% smaller than compressing raw floats, plus a render loop that sleeps when idle by Layers / performance, compression, javascript / 1 min read
Planning with agents: Divided worlds, boundary objects and thicker interfaces for planning work that agents carry out while you are away by Maggie Appleton / ai, agents, planning / 24 min read
How the Claude Code team does code review: Merged PRs more than doubled while reverts fell over 40%, by moving most reading to machines, scaling human approval by risk and making rollback fast by Anthropic / ai, code-review, agents / 21 min read
A first look at TypeScript 7.1's content mappers: Content mappers turn non-TS files into virtual TypeScript, shown with CSS modules and .graphql files by Jovi De Croock / typescript, tooling / 5 min read
Parser combinators in TypeScript, built from scratch: Animated step-by-step walkthrough of the building blocks, ending with ping output parsed into typed objects by Florian Schindler / typescript, parsing / 18 min read
How engines turn dynamic objects into fast field access: Shapes and inline caches explained with runnable sketches by Max Bernstein / javascript, performance, compilers / 16 min read
Node2Shell, RCE on stock Node.js builds: The Brotli decoder flaw fixed in the latest Node security releases is now exploited in the wild, and bundled Brotli copies elsewhere need patching too by ELLIO / security, nodejs / 28 min read
Python and Postgres don't agree on what CET means: Four timezone names silently differ by an hour in summer, fixed with one curated list and tests that compare both systems by Mergify / python, postgres, timezones / 12 min read
The first search engine with fully vectorized query execution: turbopuffer v3 adopts the execution architecture of analytical databases by turbopuffer / databases, search, performance / 17 min read
Investigating a curious case of font format fallbacks: A font loaded three times as WOFF2, WOFF and TTF, traced through browser errors into Chromium source by Paul Calvano / performance, fonts, web / 9 min read
How a read replica almost took down its primary database: A lagging BI replica made the primary hold 31.7 TB of WAL while auto-growing disks crept toward a hard limit by Photoroom / postgres, postmortem, databases / 15 min read
The AI cost of JavaScript frameworks: Opus 5.5 builds the same app across frameworks over repeated runs, measuring cost, time, spec compliance, performance and accessibility, with Hono plus htmx, Astro and Nuxt among the cheapest by Nolan Lawson / ai, javascript, frameworks / 21 min read
Our AI agent executed the same successful SQL query 254 times: A model swap made a data agent loop instead of finishing, a case for whole-system evals, explicit tool contracts and bounds on repeated behavior by Funnel / ai, agents, evals / 3 min read
The case of the 9 bit AES key: Insecure randomness in PDF encryption allows decrypting protected PDFs without the password by v12 / security, cryptography / 8 min read
A select should tell you something: Customizable selects can show fonts in their typeface, local times, aligned prices or job titles, while progressively enhancing the native control by Ahmad Alfy / css, html, ux / 7 min read
GitHub Actions workflow lockfiles are generally available: Pin actions and their transitive dependencies in participating workflows by GitHub / github, ci, security / 4 min read
React.lazy, Suspense and the hidden 300ms startup delay: A lazy component can suspend even when its code is loaded and React throttles reveals to every 300ms, how one team traced and fixed it by Matthew Wong / react, performance / 16 min read
TanStack DB 1.0 RC1 and how oracles found its bugs: The reactive client data layer is API stable, and agents checked against simple reference models found many of the fixed bugs by Kyle Mathews / javascript, testing, ai / 24 min read

🧰 Tools

Rapier JXL: Dependency-free JPEG XL encoder in JavaScript, about 30 KB gzipped, with WebGPU quality search, lossless, HDR and JPEG transcoding by jackskip22 / images, javascript, webgpu
TanStack Redact: Build plugin that swaps React and React DOM for a smaller synchronous reimplementation, with reported 20-70% smaller client builds by TanStack / react, performance
Structs: Usable implementation of the Stage 2 TC39 shared structs proposal, so workers can share objects instead of serializing copies by Erik Arvidsson / javascript, concurrency
Biome 2.6: Adds formatting for Markdown, YAML and SCSS, plus JavaScript plugins for custom lint rules as a preview by Biome / tooling, linting
webframe: Run browser-dependent scripts from the command line by Jeff Lindsay / cli, browser
Verdaccio 7.0: Self-hosted npm registry and proxy adds staged publishing, 2FA and stricter ownership checks by Verdaccio / npm, security, registry
Ghostty 1.4: Complete Kitty graphics support, security fixes, faster terminal I/O and scrollback compression that cuts memory use by 70-90% by Ghostty / terminal, tools
Expo Agent CLI: Experimental CLI that helps agents pick the right build, launch an app and smoke-test it, with structured output and runtime inspection by Expo / ai, agents, react-native
Accessible components library: Accessible components with working examples, code, guidance and the test scenarios to check them by TetraLogical / accessibility, components, frontend
browser-whisper 2.0: Runs Whisper, Moonshine and other speech models in the browser over WebGPU with WASM fallback, timestamps and live mic input by Tanpreet Singh Jolly / ai, webgpu, audio
pgvolvra: Trigger-based row history to preview and undo bad updates, deletes or migrations by transaction ID, no superuser needed by pgEdge / postgres, databases
mcdview: Turns a Postgres, Prisma, pgModeler or Rails schema into a searchable, shareable interactive ER diagram by Gheop / postgres, diagrams
Bundle: Freeze a Node app and its dependency tree into a signed ZIP that Node 26's virtual file system runs directly, no npm install by Philipp Dunkel / nodejs, packaging
sqlite-js-stream: Litestream ported to TypeScript on node sqlite by an AI agent, streaming the SQLite WAL to S3 by Matteo Collina / sqlite, nodejs, ai
html: HTML parser 3-6x faster than other JavaScript parsers, with source offsets and CSS selectors by Luke Edwards / javascript, html, parsing
vinext 1.4: Vite-based Next.js reimplementation now uses 43% less server CPU per request in its HN clone benchmark by James Anderson / nextjs, vite, performance
OpenTUI 0.8: Terminal UI library with React bindings behind OpenCode now repaints only what changed by Anomaly / terminal, react, tui

🤪 Fun

Reverse engineering a Beyblade launch tracker: Bluetooth teardown from hardware inspection to captured payloads to decoding how the accessory reports launches by Simone / reverse-engineering, bluetooth, hardware / 20 min read
tstst: A TypeScript compiler running inside the TypeScript type system by zzj3720 / typescript, experiments / 8 min read

📺 Videos

Brian Kernighan on Bell Labs and why C won: Interview at Princeton about life at Bell Labs, the people he worked with, Unix and the origins of Hello World by Ryan Peterman / history, c, unix
Design and engineering are the same thing: Opening lecture for the Dyson School of Engineering, 43 minutes of thoughts collected over the years by John Maeda / design, engineering
Software engineering at Google and CS education with Titus Winters: Refactoring 250M lines of C++, why Google made testing mandatory, readability reviews and why the CS curriculum needs burning down by Gergely Orosz / engineering, education, podcast