fednews.fyi curates high-signal technical summaries for senior developers who want to stay sharp without the scroll. One brief. One minute. Zero fluff.
The framework's first major in years moves remote function types, drops polyfills, and raises the runtime and TypeScript floors, so the upgrade is a migration rather than a bump.
1 source
Cross-user cache poisoning in SSG and ISR is the item to act on, and the 15.x line backports only some of the set.
2 sources
Feature queries can now test for an at-rule rather than a property, and overscroll-behavior gains a value that hands scrolling to the next container without the bounce.
1 source
Serialized function bodies were not escaping closing script tags, so anything that inlines the output into HTML hands an attacker a script injection.
1 source
Two of the most hand-rolled utilities in JavaScript now ship with the runtime, with an options bag, so the lodash or copy-pasted version is no longer the default answer.
1 source
Embedded documents can now declare their own sizing, replacing the postMessage measurement loop that every embed widget has hand-rolled for a decade.
2 sources
The Svelte ecosystem's serializer accepted indices past the end of an array, and crafted input could flip between array representations to make parsing quadratic in payload size.
1 source
Cloudflare's Block and "Block on pages with ads" controls now cover mixed-use crawlers such as Googlebot and Bingbot, while domains that had the legacy Block AI Bots toggle migrate to Search: Allow plus Disallow AI Training and keep search.
1 source
Firefox 156 now reports `::-webkit-scrollbar` as unsupported in `@supports`, flipping negated feature queries onto standard scrollbar properties, and moves `text-box-trim` onto `::first-line` metrics.
1 source
Vercel replaced one cache object per target path with grouped JSONL shards, an optional inline fixed-width index, and a binary search over offsets computed at build time. If you ship a large lookup bundle, the pattern transfers; the 91% P99 cut is Vercel's own unreproduced number.
1 source
Safari Technology Preview 252 and Firefox 156 both moved `Promise.try()` onto `PromiseResolve`, so the promise your callback returns comes back unwrapped and keeps its identity.
2 sources
Edge 153 withholds `unload` handlers on 60% of page loads and climbs to 100% by Edge 155, while Chrome reaches those same shares on different milestones.
2 sources
React 19.3 stabilizes `<ViewTransition>`, which drives enter, exit, move, and resize animations via the browser's View Transition API without a flag, and adds `browser()` from `react-dom` for components that should not render on the server.
1 source
sharp below 0.35.4 inherits two libheif flaws rated critical upstream that can reach remote code execution on glibc-based Linux. The fix is a version bump or a one-line AVIF block.
2 sources
A preprint scan of 3,171 repositories finds 16% of AI coding-agent setups carry a security defect, with 9.8% installing unpinned MCP servers that run with your privileges.
1 source
CVE-2026-85625 covers sift through 17.1.3 with no patched release: a prototype-pollution path plus default `$where` compilation turns a benign `sift({})` call into arbitrary code execution.
3 sources
Vitest 5.0.0 flips `clearMocks` to true, fails the un-awaited async assertions that used to pass silently, and raises the floor to Vite 6.4.0 and Node.js 22.12.0. The 53% vm-pool gain is the second beat, not the headline.
2 sources
Chrome 154 enforces CORS and Local Network Access for Background Fetch targets on localhost and the LAN, the one item here that needs work before the September 22 stable. The CSS additions are branch work, and text decoration insets retire gradient underline hacks.
2 sources
pnpm 12.0.0 shipped stable on August 26 and 12.1/12.2 landed this week, bringing deterministic lockfiles, 2-3x faster peer resolution on cycle-heavy workspaces, workspace task orchestration, and shared build artifacts.
1 source
A week after the 327-fix build, Chrome stable moves to 152.0.7977.75/.76 with 26 fixes, including two Critical use-after-frees in WebGL and Shared Tab Groups that can lead to code execution outside the sandbox.
1 source
attr() drops its string-only limit, new progress() and alpha() functions grow the CSS math and color toolkit, and Promise.allKeyed plus allSettledKeyed land.
1 source
Astro's stewardship passes to Matthew Phillips as the project ships a browser playground that compiles your components on a real Astro Compiler instance, no project setup required.
1 source
The Aug 31 patch brings back the AVIF output that the critical Aug 25 security release disabled, but only when your installed sharp resolves to 0.35.4 or newer.
3 sources
text-box and sibling-count()/sibling-index() are now Baseline, so you can drop the JavaScript workarounds for precise typography and dynamic layouts.
1 source
A high-severity Renovate advisory (CVSS 8.6) can leak your GitHub credentials to an attacker-controlled host through pagination links, and with no workaround you need to upgrade to 44.11.3 or Mend images 15.4.0 before your next run.
1 source
The unload event stops firing by default for 60% of page loads in Edge 152, 100% by Edge 155, so move telemetry and state-saving to pagehide or visibilitychange before your data silently vanishes.
1 source
Safari's latest preview shows where CSS is heading with random() and corner-shape, and drops a line-clamp value worth grepping for.
1 source
Node.js can now revoke permissions at runtime and audit what it would block, so you can harden a production process without a restart.
1 source
Node.js 26.8.0 adds native ZIP archives to core, a GCM-SIV mode for Ciphers, and a stable TracingChannel, so tooling authors can drop a native dependency and you can build observability on an API that will not move.
1 source
Vercel's security checks now run in CI as a JSON-emitting CLI, so frontend teams automate 2FA, OIDC, and env-var cleanup instead of clicking through a dashboard.
1 source
Chrome 152 stable ships a standard CPU performance tier API, a network allowlist header, and CSSPseudoElement targets for backdrop clicks and mid-flight view transitions.
2 sources
Chrome 152's security drop patches 327 flaws, 10 of them Critical with sandbox escapes, and sets the new evergreen baseline every browser build has to reach.
1 source
Next.js moved its August security release forward to Aug 25, shipping 16.3.3 and 15.5.24 to close two critical RCEs, a Windows-only path traversal and a crafted-AVIF image optimization exploit.
1 source
Bun 1.4 is the first stable release on the new Rust runtime, passing 1,517 more Node.js tests and cutting idle CPU use 5x, so it is time to re-run your Node replacement benchmarks.
1 source
OpenAI now offers zero data retention for eligible frontier-model API customers, so prompts and responses stay out of training and out of staff hands unless you opt in.
1 source
Researchers ran a full remote Spectre attack against a co-located Worker in production, and the 360x speedup over 2021 makes serverless co-tenanting look far less safe.
1 source
Firefox 154 is the last gap: text-box and the sibling functions now work in every major engine, so you can delete the JavaScript and utility-class hacks doing their job.
1 source
Wiz's autonomous Red Agent exploited a GitHub Actions script-injection flaw in Snowflake's repo and exfiltrated credentials, proof that AI can weaponize CI bugs and that co-author metadata can't pin the blame.
1 source
Explicit Resource Management now runs in all three browser engines, so you can finally delete the try/finally cleanup boilerplate around handles and connections.
1 source
Solid 2.0's release candidate reworks async around promises and new Loading/Errored/Reveal primitives while retiring SolidStart, so adopters need a migration plan before the stable release.
1 source
SvelteKit 3 is frozen ahead of a stable release, so run the sv@next migrate sveltekit-3 path now and handle the breaking changes on your own timeline.
1 source
React Native 0.87 makes the Strict TypeScript API the default and turns deep internal imports into type errors, so audit your codebase now before the 0.88 opt-out removal.
1 source
The May 2026 TC39 meeting advanced five proposals to Stage 3: standardized error stack access, three iterator additions (chunking, includes, join), and RegExp buffer boundaries, joining earlier arrivals Source Phase Imports and Import Text.
1 source
Mozilla's PACT design rethinks web rate limiting as a zero-knowledge exchange where a site learns exactly one bit about you, under the limit or not, with CAPTCHA as the fallback instead of identity or device attestation.
1 source
Astro 7.2's experimental incremental builds reuse unchanged pages across runs, so large static sites stop re-rendering thousands of slug routes for every content edit.
1 source
Node.js 26.7.0 adds Perfetto tracing support, so server-side profile output opens in the same Perfetto tooling you already use for browser performance work.
1 source
Chrome 151 stable ships `<usermedia>`, a browser-controlled camera and microphone element, plus declarative manual slot assignment, moving web components toward framework-less patterns.
1 source
Safari 27 beta ships a customizable native `<select>` and the case-sensitive `s` selector modifier, killing two of the oldest CSS workarounds you maintain.
1 source
Astro 7.1 ships first-class Content Security Policy support with granular script and style directives, so you can tighten your policy without the classic migration pain.
1 source
Upgrade to 16.3 and you get the opt-in Instant Navigations suite plus default-on disk caching and native Node streams that cut dev memory up to 90% and lift SSR throughput about 22%, all with zero code changes.
2 sources
TypeScript 7.0, the Go-based native compiler, hits GA with 8-12x faster builds and first-error times under 1.3s in VS Code, but ships no stable API, so tooling stays on 6.x via the @typescript/typescript6 alias.
1 source
Chrome 150 stable ships text-fit, which fits text to its container width in pure CSS and lets you drop FitText-style measurement JavaScript, though the spec stays a W3C draft with no Baseline support yet.
1 source
Deno 2.9 ships the experimental deno desktop command, compiling Next.js, Astro, Fresh, and other framework apps into native desktop binaries with auto-updates, plus CSS module imports and post-quantum crypto in Web Crypto.
1 source
Opus 5 is the new default model in Claude Code at the same $5/$25 pricing as Opus 4.8, scoring within 0.5% of Fable 5 on CursorBench 3.2 for half the cost per task.
3 sources
CVE-2026-44907 (CVSS 7.5) allows unauthenticated remote attackers to trigger CPU exhaustion and OOM conditions via crafted HTTP requests to Server Function endpoints.
2 sources
Next.js shipped its first pre-announced monthly security release on July 20, patching 9 vulnerabilities (4 high severity) across v16.2.11 and v15.5.21.
1 source
Microsoft Edge 151 swaps its legacy C++ XML parser for a Rust implementation, eliminating memory-corruption bugs in DOMParser and SVG parsing. Also ships CSS alpha() and Shadow DOM reference targets.
1 source
Running npx shadcn init now selects Base UI instead of Radix, with docs and scaffolding surfacing Base UI first. Radix remains fully supported and not deprecated.
1 source
Vite patches CVE-2026-39363 (arbitrary file read via dev server WebSocket) and CVE-2026-39364 (server.fs.deny bypass), affecting versions 6.x, 7.x, and 8.x. Fixed in 6.4.2, 7.3.2, and 8.0.5.
2 sources
React Compiler v1.0 shifts performance optimization from a runtime engineering problem to a build-time step, making manual memoization the exception rather than the rule. Here is when you still need it—and when to let go.
2 sources
Astro 7.0 rewrites the .astro compiler in Rust, upgrades to Vite 8 with the Rolldown bundler, and replaces the remark/rehype Markdown pipeline with a native Rust processor called Sätteri.
1 source
Safari Technology Preview 247 bundles an MCP server with 17 tools that let AI coding agents inspect the DOM, capture screenshots, read console output, and run JavaScript against a live browser, all running locally with no data leaving your machine.
1 source
SvelteKit now accepts its full config inside vite.config.js, making svelte.config.js optional. This is a preview of how SvelteKit 3 will require Vite native configuration, alongside typed environment variables and File object support in remote functions.
1 source
Vercel shipped Next.js 16.3 in preview with partial prefetching for instant route transitions, bundled AGENTS.md for AI tooling, and a React-introspecting agent browser that lets coding agents inspect component state at runtime.
1 source
Date pickers, accessibility compliance, and AI-generated spaghetti code top the list of frustrations from 120+ senior developers surveyed at JSNation and React Summit, even as AI coding tools reach mainstream adoption.
1 source
Vite+ Beta bundles Vite 7, a runtime, and a package manager into a single workflow with smart caching and a migration CLI, targeting teams tired of stitching together separate build, run, and dependency tools.
1 source
Seven new JavaScript features reach stage 4, including precise floating-point math, built-in Base64 for binary data, and cross-realm error detection. Temporal and Explicit Resource Management slip to ES2027.
1 source
AI tool adoption among developers hit 84% this year, but deployment still assumes Git fluency, terminal comfort, and DNS knowledge. The "vibe coding" movement has outpaced the deploy tooling.
1 source
The threat group behind the Miasma worm has expanded its attack surface to VS Code extensions, using them as a vector to compromise GitHub accounts and inject malicious code into open source projects.
2 sources
The :open pseudo-class is now supported in every major browser, letting you style open states of <dialog>, <details>, and <select> without JavaScript or custom attribute toggling.
2 sources
At JSNation's 2026 Open Source Awards, TanStack Start was recognized for rethinking full-stack React, while TanStack AI won for its TypeScript-first, provider-agnostic AI SDK with 265 E2E tests across 10 providers.
1 source
A staged migration with 95% config reuse let Yelp swap Webpack for Rust-powered Rspack, cutting integration builds in half and enabling portable CI caching that Webpack could not support.
1 source
Coming in July 2026, npm v12 disables automatic install scripts, git dependencies, and remote URL resolution by default. Every frontend team needs an allowlist before the upgrade lands.
1 source
Evan You and the VoidZero team join Cloudflare with a $1M Vite Ecosystem Fund and a promise: all projects stay MIT-licensed, community-driven, and vendor-agnostic.
2 sources
Deno 2.8 jumps from 42% to 76% Node.js compatibility, makes the npm: prefix optional, and adds a Rust-powered dependency resolver that cuts cold installs by 3.6x.
1 source
The v7 alpha rewrites the CSS parser, brings CSS custom properties and media queries to React Native, and adds a built-in animation adapter. No Reanimated required.
2 sources
React Native 0.86 brings comprehensive edge-to-edge display support on Android 15+ and improved DevTools performance tracing, continuing the project's commitment to zero-breaking-change upgrades.
1 source
Babel 8 modernizes the most-installed npm package: ESM-only distribution, no more ES5 transpilation by default, and first-class TypeScript types baked into every package.
1 source
AI agents can now set up Storybook autonomously in complex projects, generating configs, mocks, stories, and interaction tests without human intervention.
1 source
WebAssembly Garbage Collection (WasmGC) is now supported in all major browsers and Node.js. This removes the biggest barrier to running managed languages (Java, Kotlin, Dart, OCaml) directly in the browser at near-native speed.
1 source
Scroll-driven animations achieved Baseline status in 2026, meaning they're available in all major browsers. Parallax, scroll-triggered reveals, and progress-linked animations now work with pure CSS, no JavaScript, no IntersectionObserver, no animation libraries.
1 source
Node.js 26 ships the Temporal API enabled by default, no experimental flag. Also includes V8 14.6, `Map.getOrInsert`, pure JS `buffer`, and updated `Intl.NumberFormat` v3. Corepack has been removed.
1 source
HackerOne launched an AI platform that autonomously discovers and validates security vulnerabilities. It combines agentic AI with the company's existing bug bounty triage data to reduce false positives and speed up remediation.
1 source
CSS Gap Decorations let you draw rules and borders in the gaps between Grid, Flexbox, and multi-column items. `column-rule` and `row-rule` now work with inset, visibility, and color properties, replacing hacky background tricks.
1 source
CVE-2026-11645 is the fifth Chrome zero-day exploited in 2026, an out-of-bounds read/write in the V8 JavaScript/WebAssembly engine. CVSS 8.8. Patch is in Chrome 149. The pace of Chrome zero-days is accelerating.
2 sources
Rubrik Agent Cloud adds governance, immutable repo snapshots, and an "Agent Rewind" feature for Claude Code and Claude Cowork. Targets organizations where AI agents can commit, push, and deploy without human approval.
1 source
AI-generated code gets higher marks than human code during review, but 82% of orgs hit production failures from it, 86% of senior devs spend more time fixing it, and a new term is born: agent debt.
2 sources
The Go-native `tsgo` compiler is now in public beta. On the 1.5M-line VS Code codebase: 7.5s vs 77.8s for the JS compiler. Language service startup drops from 9.6s to 1.2s. Memory use cut roughly in half.
1 source
Vercel shipped Next.js 16.2 with sub-second dev startup, 350% faster RSC payloads via V8 JSON optimizations, and AGENTS.md auto-scaffolding that gives coding agents version-matched project documentation.
1 source
Apple's next-gen Foundation Models were built in collaboration with Google Gemini. Small Business Program developers get free cloud API access. Core AI framework lets you run full LLMs locally on Apple Silicon.
1 source
Apple's Xcode 27 integrates coding agents from Anthropic, Google, and OpenAI directly into the IDE, with self-validating agents that write tests, check previews, and run simulators autonomously. MCP and ACP support built in.
1 source
Microsoft moved Copilot from flat-rate to per-token billing on June 1, and heavy users are seeing costs jump from double digits to thousands per month. We break down the new pricing, who's affected, and the alternatives gaining traction.
1 source
Google announced WebMCP, an open standard turning websites into agent toolkits, and built-in Gemini Nano in Chrome for on-device AI. Here's what the agentic web means for how we build and how users interact with our applications.
1 source
Two long-awaited CSS features landed in Chrome 147: border-shape for non-rectangular element borders, and element-scoped view transitions that animate individual components without full-page transitions. Here's how they work and what they replace.
1 source
Microsoft shipped the TypeScript 7.0 beta with a ground-up Go rewrite. The new native compiler is roughly 10x faster and uses shared-memory multi-threading. Here's what changes for your toolchain and how to prepare for the 6.0 → 7.0 jump.
2 sources
A coordinated security disclosure on May 6 patched 12 vulnerabilities across Next.js, including middleware bypass, XSS, and SSRF. Patches were NOT backported to 13.x or 14.x. If you haven't upgraded to 15.x or 16.x, now is the time.
1 source
RSCs flip the traditional component model on its head. Components now run on the server by default, client interactivity becomes opt-in. Here's what changes for how you think about data fetching, bundle size, and composition.
1 source
CVE-2026-42826 lets unauthenticated attackers extract sensitive data from Azure DevOps with zero user interaction. CVSS score of 10.0, the highest possible. Here's what's exposed and how to check if you're patched.
2 sources
Position tooltips, popovers, and dropdowns relative to any anchor element , without a single line of JavaScript. Native anchor positioning replaces a decade of third-party positioning libraries.
1 source
The React Foundation officially launched under the Linux Foundation, making React, React Native, and JSX community-governed projects. Meta is no longer the sole owner. Here's why this matters for the ecosystem's long-term health.
2 sources
Middleware is no longer constrained to the Edge runtime subset. Fluid Compute gives you the full Node.js API surface while keeping the same global latency profile. Auth, feature flags, and geo-routing just got simpler.
1 source
A coordinated campaign injected malicious code into 14 widely-used npm packages last week. We break down the affected packages, detection steps for your lockfile, and the one CI flag that catches this.
1 source
Weekday mornings. 60-second reads. Unsubscribe anytime.