Page 3 of 6. 110 briefs in the archive, newest first.
Next.js moved its August security release forward to Aug 25, shipping 16.3.3 and 15.5.24 to close two critical RCEs, a Windows-only path traversal and a crafted-AVIF image optimization exploit.
1 source
Bun 1.4 is the first stable release on the new Rust runtime, passing 1,517 more Node.js tests and cutting idle CPU use 5x, so it is time to re-run your Node replacement benchmarks.
1 source
OpenAI now offers zero data retention for eligible frontier-model API customers, so prompts and responses stay out of training and out of staff hands unless you opt in.
1 source
Researchers ran a full remote Spectre attack against a co-located Worker in production, and the 360x speedup over 2021 makes serverless co-tenanting look far less safe.
1 source
Firefox 154 is the last gap: text-box and the sibling functions now work in every major engine, so you can delete the JavaScript and utility-class hacks doing their job.
1 source
Wiz's autonomous Red Agent exploited a GitHub Actions script-injection flaw in Snowflake's repo and exfiltrated credentials, proof that AI can weaponize CI bugs and that co-author metadata can't pin the blame.
1 source
Explicit Resource Management now runs in all three browser engines, so you can finally delete the try/finally cleanup boilerplate around handles and connections.
1 source
Solid 2.0's release candidate reworks async around promises and new Loading/Errored/Reveal primitives while retiring SolidStart, so adopters need a migration plan before the stable release.
1 source
SvelteKit 3 is frozen ahead of a stable release, so run the sv@next migrate sveltekit-3 path now and handle the breaking changes on your own timeline.
1 source
React Native 0.87 makes the Strict TypeScript API the default and turns deep internal imports into type errors, so audit your codebase now before the 0.88 opt-out removal.
1 source
The May 2026 TC39 meeting advanced five proposals to Stage 3: standardized error stack access, three iterator additions (chunking, includes, join), and RegExp buffer boundaries, joining earlier arrivals Source Phase Imports and Import Text.
1 source
Mozilla's PACT design rethinks web rate limiting as a zero-knowledge exchange where a site learns exactly one bit about you, under the limit or not, with CAPTCHA as the fallback instead of identity or device attestation.
1 source
Astro 7.2's experimental incremental builds reuse unchanged pages across runs, so large static sites stop re-rendering thousands of slug routes for every content edit.
1 source
Node.js 26.7.0 adds Perfetto tracing support, so server-side profile output opens in the same Perfetto tooling you already use for browser performance work.
1 source
Chrome 151 stable ships `<usermedia>`, a browser-controlled camera and microphone element, plus declarative manual slot assignment, moving web components toward framework-less patterns.
1 source
Safari 27 beta ships a customizable native `<select>` and the case-sensitive `s` selector modifier, killing two of the oldest CSS workarounds you maintain.
1 source
Astro 7.1 ships first-class Content Security Policy support with granular script and style directives, so you can tighten your policy without the classic migration pain.
1 source
Upgrade to 16.3 and you get the opt-in Instant Navigations suite plus default-on disk caching and native Node streams that cut dev memory up to 90% and lift SSR throughput about 22%, all with zero code changes.
2 sources
TypeScript 7.0, the Go-based native compiler, hits GA with 8-12x faster builds and first-error times under 1.3s in VS Code, but ships no stable API, so tooling stays on 6.x via the @typescript/typescript6 alias.
1 source
Chrome 150 stable ships text-fit, which fits text to its container width in pure CSS and lets you drop FitText-style measurement JavaScript, though the spec stays a W3C draft with no Baseline support yet.
1 source
Weekday mornings. 60-second reads. Unsubscribe anytime.