31 blogs · daily
Blogs
Every published blog, newest first. 31 in total.
npm#02
npm v12 turns off install scripts. Every other package manager got there first.
Three install-time defaults flip to deny in July 2026. The mechanism is solid, the allowlist is the work, and the threat model is honest about what it cannot stop.
npm v12 blocks install scripts, git deps, and remote tarballs by default in July 2026. How approve-scripts works, what breaks, and what it still can't stop.
ai-coding#03
The Ethics of AI in Software Development: Responsibility and Bias
An agent deleted a production database during a code freeze, then misreported the backups. The questions about bias and accountability stopped being hypothetical.
AI writes, tests, and ships code now. What the research shows about bias, insecure output, and who is accountable when an agent breaks production.
postgres#04
Postgres 19 lets you control the query planner. It spent 20 years refusing.
pg_plan_advice gives operators a sanctioned way to stabilize and override query plans, without becoming the hint system the project always rejected.
PostgreSQL 19 Beta 1 ships pg_plan_advice, a sanctioned way to stabilize and override query plans after two decades of refusing optimizer hints.
elixir#05
Elixir is now gradually typed. Nobody wrote a single annotation.
Four years of set-theoretic types research landed in v1.20. The interesting part is what the team refused to ask of its users.
Elixir v1.20 type checks every program with zero annotations. How inference-first typing works, and what it trades away against the TypeScript model.
mcp#06
Your agent spends 55,000 tokens before it reads your prompt
AGENTS.md, Agent Skills, and MCP looked like rival standards. Token economics turned them into layers, and pushed all three toward the same design: load nothing until it is needed.
GitHub's MCP server costs 55k tokens before the first message. How AGENTS.md, Skills, and MCP split the agent context problem and converged on lazy loading.
prisma#07
Prisma 7 deleted its Rust engine and got faster
Removing the systems language sped the ORM up. The reason rewrites how you weigh polyglot architecture.
Prisma 7 dropped its Rust query engine for a TypeScript and WASM compiler. Queries run up to 3.4x faster, the client shrank 90%, and the edge opened up.
vitest#08
Your component tests run in a fake browser. Even jsdom's maintainer asks why.
Vitest 4 made real browsers the default path for component testing. Simulation is now the thing you opt into.
jsdom's maintainer questions why it exists while Vitest browser mode goes stable. What simulation still buys, what it cannot fake, and what to migrate first.
view-transitions#09
View Transitions went cross-browser. The SPA lost its best excuse.
Same-document transitions reached Baseline and cross-document shipped in Chrome, Edge, and Safari. The case for a client-side router just narrowed.
Cross-document View Transitions now ship in Chrome, Edge, and Safari. A server-rendered site gets app-like navigation in CSS, with no client-side router.
typescript#10
typescript-eslint owns typed linting. Oxlint and Biome are coming from opposite directions.
Two Rust linters hit 1.0 in the same week. The fight is not about speed - it is about who owns the type checker.
Oxlint borrows the official Go compiler; Biome wrote its own type engine. Same goal, opposite bets, and a clear CI playbook for now.
signals#11
Signals won the reactivity war. React said no on purpose.
How Angular, Vue, Svelte, Solid, and Preact rebuilt a 2010 idea, why TC39 is trying to standardize it, and the case React makes for going the other way.
Angular, Vue, Svelte, Solid, and Preact all run on signals now, and TC39 wants them in the language. React is the deliberate holdout. Here is why.
local-first#12
ElectricSQL deleted bidirectional sync. The whole category followed.
Read-path sync, optimistic clients, server-authoritative writes: how Electric, Zero, and TanStack DB converged on one architecture, and what it costs you.
ElectricSQL dropped bidirectional CRDT sync for read-path shapes. Zero and TanStack DB landed in the same place. The 2026 sync stack and its real costs.
tailwindcss#13
Tailwind v4 moved your config into CSS. The migration tail is the part nobody benchmarks.
CSS-first @theme blocks and the Oxide engine made the framework faster than ever. The plugin ecosystem, AI completions, and design-system packages are still living in v3.
Tailwind v4 retired tailwind.config.js, swapped PostCSS for Lightning CSS, and made Oxide the default. The ecosystem is still catching up.
typescript#14
TypeScript 7 is 10x faster. The API the ecosystem was built on is gone.
The Go port breaks the in-process compiler API. typescript-eslint, ts-morph, and your custom transformers now talk to the compiler across a process boundary.
TypeScript 7's Go compiler is 10x faster, but the Strada API that typescript-eslint, ts-morph, and transformers import does not cross the language boundary.
mcp#15
MCP became a remote-first protocol. The spec changed underneath you.
Streamable HTTP, OAuth 2.1, and the audience-binding rule that closes a class of bugs.
Why the 2025-06-18 MCP spec retires stdio as the default, and what Streamable HTTP plus OAuth 2.1 require in production.
typescript#16
Standard Schema is quietly winning the validator war
Zod, Valibot, and ArkType agreed on a tilde-prefixed property. Lock-in dissolved.
Standard Schema added one property to Zod, Valibot, and ArkType. Picking a validator is no longer a wedge into your whole stack.
react#17
Server Actions stopped being a React feature and became a transport
Three libraries, one primitive, and the typed-RPC problem nobody solved cleanly
Server Actions are no longer an RSC escape hatch. They are the de facto mutation transport, and the libraries built on top reveal what is missing.
pnpm#18
pnpm catalogs went from convenience to baseline. Here is what nobody mentions.
Workspace-wide dependency pinning is now in pnpm and Bun. The interesting story is what it surfaces, not what it solves.
pnpm catalogs and Bun catalogs are now the default monorepo pattern for pinning workspace dependencies. The trade-offs are sharper than the docs admit.
google-io#19
I/O 2026 turned agents into an API line item
Managed Agents, Antigravity 2.0, WebMCP, and the developer pieces of a keynote that was really about pricing
Three days after the I/O 2026 keynote, the line that matters is not a model. It is pay-per-run agent pricing.
supabase#20
Supabase shipped a handler. The line about agents is the news.
@supabase/server collapses Edge Function boilerplate to one wrapper - and is the first major backend SDK to say out loud that one of its design constraints was "do not confuse the model."
Supabase shipped @supabase/server, collapsing Edge Function boilerplate to one wrapper - and admitting its shape was designed for coding agents.
security#21
The Mini Shai-Hulud Worm: How TeamPCP Poisoned GitHub Actions to Forge SLSA Provenance
Exploring the three-stage exploit chain that hijacked TanStack's release pipeline: pull_request_target, cache poisoning, and OIDC token memory scraping.
On May 11, 2026, TeamPCP hijacked TanStack's release pipeline using GitHub Actions cache poisoning and OIDC token memory scraping to forge SLSA Build Level 3 provenance.
react#22
Next.js 16 made React Compiler stable. It didn't make it default.
The gap between stable and default is the only thing you need to read this week.
React Compiler v1.0 is shipping in production at Meta. Vercel left it off by default. The reason is Babel — and the answer is annotation mode.
postgres#23
Postgres 18 stopped reading one block at a time
The new async I/O subsystem is the foundation release. The 8x is in the next one.
Postgres 18 ships true async I/O. Cold sequential scans 3x faster - but only if you flip the switch, and only on the workloads that actually use it.
drizzle#24
Drizzle 1.0-rc.1 makes the ORM tax disappear
JIT-compiled row mappers, a codec layer, and a casing rewrite — Drizzle is now claiming raw-driver speed on its hot path.
Drizzle v1.0.0-rc.1 ships opt-in JIT row mappers that the team says make the ORM as fast as raw drivers. Here is what changed and why.
rolldown#25
Rolldown 1.0 shipped. Vite is now Rust under the hood - and Rollup is quietly being retired.
The bundler underneath the most widely used frontend tool on the planet has been rewritten in Rust. Most teams will only notice the CI bill.
Rolldown 1.0 stable shipped May 7. Vite 8 already runs on it. Linear cut production builds from 46s to 6s. Rollup is gracious about it.
cloudflare#26
Cloudflare just made durable execution per-tenant. That changes who can use it.
Dynamic Workflows ships the missing piece for AI agent platforms - workflow code that differs every request.
Dynamic Workflows lets a Workers deployment run a different workflow definition per tenant. Five years of durable-execution orthodoxy assumed the opposite.
tanstack#27
TanStack Start hit 1.0. It is the first real non-Vercel React framework in years.
Router-first, Vite-powered, vendor-neutral. What v1 actually ships, where it falls short, and why it matters this week.
TanStack Start tagged v1.0 with no keynote. It is the first credible non-Vercel option for new React apps in roughly five years.
bun#28
Bun's Rust rewrite merged in six days. 13,000 unsafe blocks came with it.
PR #30412 ships about a million lines of agent-authored Rust. The test suite passes. Soundness is a different question.
Bun merged a million-line, Claude-authored Rust rewrite on May 14. 99.8% of tests pass. About 13,000 unsafe blocks come with it.
nextjs#29
Next.js patched 13 CVEs in one afternoon. The pattern matters more than the count.
May 7's coordinated release is the fourth round of RSC fixes since December — and it reframes the Server Function endpoint as a public API.
Vercel shipped 13 advisories on May 7 — DoS, SSRF, cache poisoning, auth bypass, XSS. The pattern reframes RSC as a public API.
remix#30
Remix 3 finally shipped — without React
The April beta is a different framework wearing the same name.
Remix 3 Beta drops React for a Preact fork, replaces hooks with imperative this.update(), and ships with no migration path from v2.