Stay ahead in web development: latest news, tools, and insights #162

Signup here for the newsletter to get the weekly digest right into your inbox.

weeklyfoo #162 is here: your weekly digest of all webdev news you need to know! This time you'll find 38 valuable links in 5 categories! Enjoy!

🚀 Read it!

• Why and how to port your entire codebase to Rust: Microsoft Distinguished Engineer Stephen Toub on rewriting the 400,000-line GitHub Copilot runtime in Rust with agents, rollout strategy and catching regressions by Ryan Peterman / rust, ai, rewrites / 65 min read

📰 Good to know

• Frontier quality at 1% of the cost: Airbnb fine-tuned a 2B-parameter model to match frontier models on a production policy classifier at 35 ms median latency by Airbnb Engineering / ai, llm, performance / 9 min read
• Inside GitHub's new Git storage architecture: Rubicon separates immutable Git objects in blob storage from a replicated reference log so compute and storage scale independently by GitHub Blog / git, architecture, ai / 29 min read
• Design systems should be fast by default: Timing ten design systems on a 249-option dropdown and 100 checkboxes, tracing slow paths and adding Playwright performance budgets per PR by Den Odell / performance, design-systems, testing / 26 min read
• Two circles, one connection, and border-shape: Anchor positioning, border-shape and shape() draw curved connectors that follow two moving elements by master.dev / css / 15 min read
• The age of frivolous software: A personal World Cup dashboard built in hours with coding agents grew to 50,000 users, a case for short-lived personal software by Ian McCrystal / ai, agents, side-projects / 6 min read
• Nothing installs at our company until it's a week old: A company-wide registry proxy delays new npm and PyPI releases by seven days so malicious versions get caught first by Bruno J / security, npm, supply-chain / 11 min read
• Fixing tool-call accuracy in vLLM: Constrained decoding raised schema-valid tool calls from 92% to 100% for Kimi and DeepSeek models by Ubicloud / ai, llm, inference / 14 min read
• Cross-request KV cache exposure in Workers AI: 155 GLM-5.3 responses exposed other customers' data after a KV cache capacity mismatch met an SGLang error-handling bug by Cloudflare / security, ai, postmortem / 36 min read
• Why agents are soon only going to have 1 tool: Agents collapse their tool catalog into one exec tool so models write short scripts that chain dependent actions in a sandbox by Philipp Schmid / ai, agents / 10 min read
• How software engineering is changing, a tale of two eras: Neil Kakkar's essay on going from 8-20 to 200+ merged PRs a month with AI agents, and which constraints broke along the way by Neil Kakkar / AI, devex, workflow / 32 min read
• Scaling Git at OpenAI: Pando, a Git-compatible backend, cut median push latency by nearly 80% by handling pushes to unrelated branches independently by OpenAI / git, infrastructure, ai / 1 min read
• Why is this fingerprinting script creating bioweapons: A canvas fingerprinting script names identifiers after taboo topics and hides a prompt in invisible Unicode so LLMs refuse to analyze it by Veritas / security, javascript / 9 min read
• Shrinking Clarity.js, when cleaner code gzips worse: An agent ran 50+ size experiments, dropping import namespace objects won big while helper extraction grew gzipped output by Manu Nair / javascript, performance / 8 min read
• Polymarket's CSP allowed a third-party script swap to drain wallets: A script URL that stayed the same but changed payload got past CSP, and what would have stopped it. by Scott Helme / security, csp, third-party-scripts / 13 min read
• Ladybird adds a JavaScript JIT: Ladybird now compiles hot JavaScript to machine code on x86-64 and AArch64 using speculative optimization driven by runtime type profiling by Ladybird Newsletter / javascript, engine, performance, browsers / 8 min read
• Parcel 3 alpha, a Rust rewrite: Parcel rewritten in Rust as a single small binary with no Node dependency and up to 100x faster cold builds by Parcel team / bundlers, rust, performance / 10 min read
• Discord is ditching Electron and React Native for a Rust rewrite: A Rust desktop client built on GPUI uses 290MB of RAM while mobile keeps native UI over shared Rust code by Tom Warren (The Verge) / rust, react-native, electron / 10 min read

🧰 Tools

• Firenook: A faster drop-in for the Firebase emulators: A faster drop-in replacement for the Firebase emulators by Firenook / firebase, tooling, databases
• File Viewer: Browser-based previewer for more than 275 file formats with no conversion server and Vue, React and Svelte integrations by flyfish-dev / tools, javascript
• OmniDiff: Content-aware diffs for code, images, fonts, archives and PDFs with a TUI viewer, Git integration and JSON output for CI by ivankovic / cli, git, tooling
• nodeterm: Persistent tmux terminals and coding agents as draggable nodes on an infinite canvas, with a kanban view of sessions by Enes Kirca / terminal, agents, tooling
• Type Server Protocol: JSON-RPC protocol exposing Python type queries, import resolution and snapshot-based analysis state using LSP conventions by Microsoft / python, tooling
• djs: JavaScript engine in Rust for agent scripts in WebAssembly, VM state snapshots resume elsewhere even mid-await by Armin Ronacher / javascript, wasm, agents
• Melange: Compiles OpenFGA authorization models into PL/pgSQL so a permission check is a SELECT, with no separate service. by Melange / postgres, security, authorization
• Postgres.js 4.0: A ground-up rewrite of the Postgres client adds a scheduler so fast queries stop waiting behind slow ones plus AbortSignal support by Rasmus Porsager / databases, postgres, nodejs
• Vitest 5.1: An experimental since-last-run flag reruns only the tests your last change affected by Vitest Team / testing, vitest, tools
• Load testing with Koi Pond: Slack built a Go tool that runs slimmed down Slack clients to load test 500,000 WebSocket connections far more cheaply than headless Chrome by Slack Engineering / performance, testing, websockets
• Slab: Headless web components that handle keyboard, focus, ARIA and forms on native elements by Slab / web-components, accessibility, frontend
• HTML-in-Canvas API: Render real accessible DOM elements inside a canvas, shipping in Chrome 157 by Chrome team / css, web-platform, canvas
• Skullet: Renders your real component invisibly with sample data and draws a matching skeleton to reduce layout shift by Lochie Axon / react, ui, performance
• Reticle: Dev-only SDK and MCP server that lets coding agents drive your running app and return a pass, fail or cannot-tell verdict by Reticle Labs / ai, agents, testing, mcp
• devvm: Runs coding agents in a VM with only the project folder mounted and network traffic going through an allowlist proxy by devvm / ai, agents, security, sandboxing

🤪 Fun

• Jailbreaking my car's navigation system just so I can change the time: A daylight-saving fix turned into firmware reverse engineering with QEMU and a core-dump code execution trick by nns / hacking, reverse-engineering / 13 min read
• Could a modern chess engine on a Pentium have defeated Kasparov in 1996: Stockfish on a 200 MHz Pentium Pro reaches a measured rating of 3180 and you can play it online by Nicholas Carlini / chess, retro / 17 min read

📺 Videos

• Slow down to speed up: How companies that start from business outcomes and slow their AI rollouts hold quality steady by Gergely Orosz / ai, engineering, leadership
• Linus Torvalds in conversation with Dirk Hohndel: 35 years of Linux, rewriting contributed patches, adopting Git and moving to five-week releases by Linus Torvalds / linux, git, open-source
• Developer tooling in the agentic era: Verification as a first-class interface and where Vite, Oxc, Rolldown and Vitest are heading by Evan You / vite, tooling, ai

Want to read more? Check out the full article here.

To sign up for the weekly newsletter, visit weeklyfoo.com.