16 blogs · daily
Blogs
Every published essay, newest first. 16 in total.
react#02
Server Actions stopped being a React feature and became a transport
Three libraries, one primitive, and the typed-RPC problem nobody solved cleanly
Server Actions are no longer an RSC escape hatch. They are the de facto mutation transport, and the libraries built on top reveal what is missing.
pnpm#03
pnpm catalogs went from convenience to baseline. Here is what nobody mentions.
Workspace-wide dependency pinning is now in pnpm and Bun. The interesting story is what it surfaces, not what it solves.
pnpm catalogs and Bun catalogs are now the default monorepo pattern for pinning workspace dependencies. The trade-offs are sharper than the docs admit.
google-io#04
I/O 2026 turned agents into an API line item
Managed Agents, Antigravity 2.0, WebMCP, and the developer pieces of a keynote that was really about pricing
Three days after the I/O 2026 keynote, the line that matters is not a model. It is pay-per-run agent pricing.
supabase#05
Supabase shipped a handler. The line about agents is the news.
@supabase/server collapses Edge Function boilerplate to one wrapper - and is the first major backend SDK to say out loud that one of its design constraints was "do not confuse the model."
Supabase shipped @supabase/server, collapsing Edge Function boilerplate to one wrapper - and admitting its shape was designed for coding agents.
security#06
The Mini Shai-Hulud Worm: How TeamPCP Poisoned GitHub Actions to Forge SLSA Provenance
Exploring the three-stage exploit chain that hijacked TanStack's release pipeline: pull_request_target, cache poisoning, and OIDC token memory scraping.
On May 11, 2026, TeamPCP hijacked TanStack's release pipeline using GitHub Actions cache poisoning and OIDC token memory scraping to forge SLSA Build Level 3 provenance.
react#07
Next.js 16 made React Compiler stable. It didn't make it default.
The gap between stable and default is the only thing you need to read this week.
React Compiler v1.0 is shipping in production at Meta. Vercel left it off by default. The reason is Babel — and the answer is annotation mode.
postgres#08
Postgres 18 stopped reading one block at a time
The new async I/O subsystem is the foundation release. The 8x is in the next one.
Postgres 18 ships true async I/O. Cold sequential scans 3x faster - but only if you flip the switch, and only on the workloads that actually use it.
drizzle#09
Drizzle 1.0-rc.1 makes the ORM tax disappear
JIT-compiled row mappers, a codec layer, and a casing rewrite — Drizzle is now claiming raw-driver speed on its hot path.
Drizzle v1.0.0-rc.1 ships opt-in JIT row mappers that the team says make the ORM as fast as raw drivers. Here is what changed and why.
rolldown#10
Rolldown 1.0 shipped. Vite is now Rust under the hood - and Rollup is quietly being retired.
The bundler underneath the most widely used frontend tool on the planet has been rewritten in Rust. Most teams will only notice the CI bill.
Rolldown 1.0 stable shipped May 7. Vite 8 already runs on it. Linear cut production builds from 46s to 6s. Rollup is gracious about it.
cloudflare#11
Cloudflare just made durable execution per-tenant. That changes who can use it.
Dynamic Workflows ships the missing piece for AI agent platforms - workflow code that differs every request.
Dynamic Workflows lets a Workers deployment run a different workflow definition per tenant. Five years of durable-execution orthodoxy assumed the opposite.
tanstack#12
TanStack Start hit 1.0. It is the first real non-Vercel React framework in years.
Router-first, Vite-powered, vendor-neutral. What v1 actually ships, where it falls short, and why it matters this week.
TanStack Start tagged v1.0 with no keynote. It is the first credible non-Vercel option for new React apps in roughly five years.
bun#13
Bun's Rust rewrite merged in six days. 13,000 unsafe blocks came with it.
PR #30412 ships about a million lines of agent-authored Rust. The test suite passes. Soundness is a different question.
Bun merged a million-line, Claude-authored Rust rewrite on May 14. 99.8% of tests pass. About 13,000 unsafe blocks come with it.
nextjs#14
Next.js patched 13 CVEs in one afternoon. The pattern matters more than the count.
May 7's coordinated release is the fourth round of RSC fixes since December — and it reframes the Server Function endpoint as a public API.
Vercel shipped 13 advisories on May 7 — DoS, SSRF, cache poisoning, auth bypass, XSS. The pattern reframes RSC as a public API.
remix#15
Remix 3 finally shipped — without React
The April beta is a different framework wearing the same name.
Remix 3 Beta drops React for a Preact fork, replaces hooks with imperative this.update(), and ships with no migration path from v2.
nodejs#16
Node.js 26 turns on Temporal — and quietly retires Date
The Temporal API is now a default global. Here is what that changes, and what it does not.
Node 26 enables Temporal by default. The Date object is not going away, but starting now you no longer have to reach for it first.