weeklyfoo #159 is here: your weekly digest of all webdev news you need to know! This time you’ll find 40 valuable links in 5 categories! Enjoy!
🚀 Read it!
- How to effectively debug when you no longer understand the code: Three production investigations, a latency regression, a memory leak and a kernel-level hang, show how to steer coding agents through unfamiliar systems by separating facts from hypotheses and comparing failures with a control by Cindy Sridharan / ai, agents, debugging / 1 min read
📰 Good to know
- Speculative decoding, the art of guessing well: Deep walkthrough of drafting several tokens cheaply and verifying them in one target-model pass, with acceptance and speedup formulas, EAGLE-3, multi-token prediction and diffusion drafters by astralord / ai, llm, performance / 66 min read
- The dirty pages surprise, when a read-only query writes terabytes: A MonetDB count-distinct query saturates an NVMe drive because Linux flushes dirty pages from memory-mapped scratch files, and moving them to tmpfs cuts runtime from 73 minutes to 97 seconds by swingbit / databases, linux, performance / 11 min read
- The first reduction in their history, 64-day Let’s Encrypt certificates: Let’s Encrypt starts issuing 64-day certificates on October 14 by Scott Helme / security, tls / 7 min read
- Why WebMCP matters: Sites expose JavaScript tools to agents instead of being driven through screenshots and DOM inspection, with a Shopify checkout experiment running 2.7 times faster at 58% lower cost by Yoav Weiss / ai, agents, web / 10 min read
- Can we make React faster using the React Compiler?: In a 2,000-row microbenchmark inlining alone slows rendering from 444 ms to 1,038 ms by removing per-row caches, while adding block DOM updates cuts it to 164 ms by Jimmy Miller / react, performance, compiler / 30 min read
- How I found a $90,000 remote code execution vulnerability in Google: Google’s DevSite reused an OAuth secret from a readable Flask session cookie as the signing key, letting forged sessions reach unsafe pickle deserialization by Simon Koeck / security, bug-bounty / 5 min read
- Deno is joining Cloudflare: The Deno team folds celld into workerd so Durable Objects can be self-hosted, while the Deno runtime gets a final year of fixes, Deno Deploy closes in six months and JSR moves to Cloudflare by Ryan Dahl / deno, cloudflare, javascript / 5 min read
- Bun 1.4.3 adds bun check, a built-in TypeScript type checker: A port of the TypeScript 7 checker that reads tsconfig.json, reports the same errors as tsc and runs 3-6x faster, plus much lower idle CPU usage by Jarred Sumner / bun, typescript / 70 min read
- TanStack Start 1.0: The full-stack framework for React and Solid reaches its first stable release by TanStack / react, solid, framework / 24 min read
- Responsive iframes: The new frame-sizing CSS property lets iframes size themselves to their content height, Chromium-only for now by Chrome for Developers / css, html, chrome / 15 min read
- Redesigning source control at Anthropic: Anthropic replaced Git with Scion after daily merges grew from 2,500 to over 30,000, using server-side commits, sparse checkouts and layered caches to cut infrastructure footprint 200x and free 25% of CI CPU by Anthropic / git, infrastructure, monorepo / 22 min read
- Rewinding the exponential, how we keep hardware usage down: Cloudflare’s pipeline handles two billion events per second, and product-specific schemas, zstd, later replication, earlier sampling and aggregation deferred two and a half years of hardware growth by Cloudflare / data, performance, infrastructure / 30 min read
- Are harnesses worth the cost?: Ten runs on a Java API service show a behavioral harness lifting a weaker model from three to ten successes at lower cost than a stronger unharnessed model, with caveats by Martin Fowler / ai, agents, engineering / 23 min read
- Gemini 4 Argon: Google DeepMind’s new flagship model for complex software engineering, research and robotics, with a one-million-token output window by Google DeepMind / ai, llm, google / 23 min read
- How savepoints throttled our Postgres queue: Adding workers to a Postgres-based queue made it slower because of per-job SAVEPOINTs, and claiming jobs with a lease fixed it by Rory Malcolm / postgres, queues, performance / 18 min read
- PgBouncer 1.26.1: Fixes three CVEs, the worst letting a client who knows one user’s password log in as another user, even a superuser, with SCRAM auth by PgBouncer / postgres, security / 2 min read
- Muse Spark Open: Meta’s open-weight multimodal MoE model with 816B total and 42B active parameters and a one-million-token context, runnable on two M5 Ultra Mac Studios by Meta / ai, llm, open-weights / 4 min read
🧰 Tools
- REA: Gives coding agents tools to reverse engineer native binaries, JavaScript and Electron applications and browser behavior by REA / ai, agents, reverse-engineering
- OpenCode 2.0: Big update to the open coding agent with background subagents, a code mode that lets models script MCP tool calls, and JS and Effect clients to drive it by OpenCode / ai, agents, cli
- Shaders: 190+ WebGPU effect components like ripples, glows and ASCII dissolves for React, Vue, Svelte, Solid or plain JS, now MIT licensed by Simon Le Marchant / webgpu, shaders, open-source
- Tamagui 3: One React UI codebase for web and native, now with Tailwind-style props and React Strict DOM support by Nate Wienert / react, react-native, ui
- Partytown 1.0: Relocates third-party scripts into a Web Worker instead of the main thread, now out of beta after five years by Builder.io / performance, javascript
- AI Policy: Community collection of ready-made contribution policies for open source projects, from welcoming AI contributions to human-only by ai-policy.dev / ai, open-source
- Bifrost: Open-source AI gateway with an OpenAI-compatible API, provider failover, load balancing, semantic caching, virtual keys, budgets and MCP support by Maxim / ai, gateway, open-source
- CSS Text Effects: 114 animated text effects in pure CSS, from aurora gradients and glitches to split-flap boards and liquid fills, no JavaScript by Colorion / css, animation, typography
- pg-delta: Supabase’s open source schema diff engine that turns two Postgres databases into an ordered migration covering RLS policies, grants and domains by Supabase / postgres, migrations, open-source
- pg_disorder: Postgres extension that shuffles results of SELECTs without ORDER BY to surface ordering bugs in tests by viralpraxis / postgres, testing
- reseter.css 3.0: Major rework of the modern CSS reset, full and mini variants wrapped in a reset cascade layer, logical properties throughout and about 1KB compressed by Krish Gupta / css, reset
- once: Caches command output so repeated runs return instantly by alex0ptr / cli, caching
- imapkit: Embeddable, scriptable IMAP server for testing email clients with in-memory mailboxes and scripted faults, driven from tests or a REST API by Postal Systems / email, testing
- caniname: CLI tool to check project name availability on npm, Netlify and more by Bramus van Damme / cli, npm
- p-queue 10: Promise queue with concurrency control and rate limiting, now zero dependencies, an EventTarget and AsyncLocalStorage aware by Sindre Sorhus / javascript, nodejs, async
- Void: Open-source deployment platform, SDK and CLI that brings full-stack development and Cloudflare deployment into a Vite workflow, inferring bindings and provisioning infrastructure by Cloudflare / cloudflare, vite, deployment
- SPACE: Perplexity open-sources the sandbox platform behind Computer as a foundation for safer agent systems by Perplexity / ai, agents, sandbox
🤪 Fun
- The Restroom Archive: An ongoing repository of 3D-scanned publicly accessible restrooms, 193 so far in 85 cities across 13 countries by Restroom Archive / fun, 3d / 11 min read
- Handwired: turn your regular JavaScript code into a neural net: No training, exact yet fully differentiable, and runnable in a browser without a GPU by Cheng Lou / fun, javascript, ai / 1 min read
📺 Videos
- Taming microservice overload, our journey to modular monoliths: Five teams running 90+ microservices at the Port of Rotterdam use DDD and event storming to move back to modular monoliths by Mario Klaver / architecture, microservices, devoxx
- Structured concurrency looms: Oracle architects explain the design of Project Loom’s structured concurrency, treating related tasks as one unit of work for simpler cancellation and errors by Alan Bateman, Viktor Klang / java, concurrency, devoxx
- NodeConf EU 2026 talks: All talks from NodeConf EU 2026, covering Node’s new FFI, Emscripten and WebAssembly, V8 heap management and performance profiling by NodeConf EU / nodejs, conference, performance