weeklyfoo #160 is here: your weekly digest of all webdev news you need to know! This time you’ll find 40 valuable links in 5 categories! Enjoy!
🚀 Read it!
- Building a linearizable log on READ COMMITTED: Predicate locks sank their Postgres-backed metadata store, so Materialize dropped SERIALIZABLE for 3x write throughput and proved the design in Lean by Petros Angelatos / postgres, distributed-systems, formal-methods / 26 min read
📰 Good to know
- Claude reveals ECDSA curve origins: A Claude research model traced the seeds of five NIST prime curves to lrand48 seeded with Unix timestamps, solving a decades-old provenance mystery without revealing a break by Anthropic / security, cryptography, ai / 16 min read
- How D1 scales to millions of databases: Scaling the D1 control plane for millions of SQLite databases without routing every query through a central bottleneck by Cloudflare / cloudflare, databases, scale / 42 min read
- Cutting our inference bill by 68%: Cloudflare dropped average AI code review cost from $2.43 to $0.77, mostly by ordering messages so first requests actually hit the prompt cache by Cloudflare / ai, llm, cost / 34 min read
- When retries make things worse: One retry owner, operation deadlines, admission limits, shared retry budgets and jitter keep a slow dependency from becoming an outage by Wendell Adriel / reliability, backend, distributed-systems / 18 min read
- tsrs, a Rust port of TypeScript: Cloudflare and VoidZero port the Go-based TypeScript 7 compiler to Rust, claim up to 8x faster checks, run it in WebAssembly and plan to fold it into Oxc by Cloudflare / typescript, rust, tooling / 23 min read
- Announcing TypeScript 7.1 Beta: The native compiler gets 1.2 to 1.9x faster and uses 15 to 50% less memory than 7.0 by Microsoft / typescript, release / 27 min read
- Next.js security update: Two critical RCE flaws, one in use cache functions via React Server Components and one in SVG image optimization, with a public PoC already out by Vercel / security, nextjs, react / 3 min read
- JPEG XL vs AVIF: With Firefox 158 every major browser supports JPEG XL, so Jake compares it in depth against AVIF by Jake Archibald / images, performance, web / 69 min read
- Building Laminar, Ramp’s managed agents platform: A model-agnostic agent harness on Postgres, Temporal and S3 with session state independent of disposable sandboxes, async steering, subagents and shared tracing by Ramp / ai, agents, architecture / 1 min read
- Postgres 19, what changed and what to test now: With RC1 out, a walkthrough of REPACK CONCURRENTLY, pg_plan_advice, parallel autovacuum and logical replication sequence sync, each with a test checklist by Tom Kincaid / postgres, databases, release / 13 min read
- Postgres recovery_prefetch considered harmful: On by default since Postgres 15, it can overwhelm standby storage after a write burst and, with synchronous replication, block primary writes for 35 minutes by Jeremy Schneider / postgres, reliability, replication / 10 min read
- Railway security disclosure: Possible unauthorized access to customer environment variables, rotate stored secrets and private registry credentials by Railway / security, devops / 3 min read
- LLMs make formal software verification feasible at scale: Claude produced machine-checked proofs for 239 fuzz-test entry points across 123 open-source libraries by Anthropic / ai, security, verification / 22 min read
- React only where needed, moving from Next.js to Astro: 10,000+ restaurant sites moved to Astro and Cloudflare Workers with React islands, menu-page p75 LCP went from 5.4s to 0.7s by Owner / performance, astro, react / 11 min read
- php2shell, how the PHP RCE works: A multipart POST exhausts memory mid-parse, then the shutdown cleanup follows a planted pointer and runs the attacker’s payload, regardless of the app on top by Wiz / security, php / 15 min read
- Node.js October 2026 security releases: Patches include a high-severity CVE in the Brotli decoder, update your runtimes by Node.js / security, nodejs / 10 min read
- Sprites Block Device: Fly.io replaced the Sprites filesystem with a simpler block storage layer, checkpoints now have one source of truth and restore as fast as a restart by Fly.io / storage, infrastructure / 9 min read
🧰 Tools
- Sphinx: Pauses pushes to protected branches and quizzes you on what agent-written code does, with a separate reviewer reading the diff by Sphinx / ai, agents, code-review
- Mac.apk: Runs Android apps as native macOS processes on Apple Silicon with their own windows and GPU rendering, alpha by kksimp / macos, android, tools
- Pele: Zero-dependency Mermaid renderer to SVG with CSS variable theming and support for every Mermaid 12.1 diagram type by Pele / diagrams, svg, javascript
- ExcaliClaw: Collaborative workspace for hand-drawn diagrams, usable from Claude, Cursor and VS Code through MCP by ExcaliClaw / diagrams, mcp, ai
- Chartist 2.0: The lightweight CSS-styled SVG charting library returns with a composable API, SSR to SVG and terminal charts at about 12KB gzipped by Gion Kunz / charts, svg, javascript
- Maplair: Batteries-included, tree-shakeable fork of Leaflet with rotation, fullscreen, search and heatmaps by Simon Legner / maps, javascript, library
- rich-input: Web component for GitHub-style search boxes mixing free text with autocompleted key-value filters by Bramus Van Damme / web-components, ui, javascript
- DocumentDB 1.0: MongoDB-compatible document database built as Postgres extensions plus a gateway, now a Linux Foundation project with packages for Postgres 17 and 18 by DocumentDB / postgres, mongodb, databases
- PGX: Hosts thousands of isolated throwaway Postgres databases in one process, cloned from a template in milliseconds, for agent sandboxes and per-PR tests by PGRun / postgres, testing, ai
- Scroll-triggered animations debugger: DevTools pane that draws activation and active ranges on a minimap, shows live status and lets you edit ranges in place by Bramus Van Damme / css, devtools, animation
- POUR: Free accessibility checker and WCAG audit tool as browser extension or bookmarklet, with violations grouped by severity by David Yarham / accessibility, a11y, tools
- TanStack AI 1.0: 76 packages reach stable APIs for chat, tools, media, MCP, persistence and sandboxes, provider and framework agnostic by TanStack / ai, typescript, library
- Pixel: React renderer for terminal apps with rounded corners, gradients, real fonts and embedded Chromium webviews via the Kitty graphics protocol by Rob Pruzan / react, terminal, cli
- env.style: Wraps your Next.js or Vite config to tint the favicon per environment so you see at a glance where you are by Ryan George / dx, nextjs, vite
- Reylo: Import .sql files into TypeScript with full type inference by Colin McDonnell / typescript, sql, databases
- dquickts: QuickJS fork that runs TypeScript natively with a durable execution engine by Stencil Labs / typescript, runtime
- Motion scopeMotion: Motion 14.5 adds scopeMotion and useScopeMotion for cleanup, media query matching, default transitions and element scoping by Motion / animation, react
🤪 Fun
- The Tetris script that becomes Snake once prettified: Chaining semantic quirks in pretty-printers and deobfuscators turns the cleaned-up output into a different program by Robert Vähhi / javascript, security, fun / 19 min read
- Furifont: A Japanese font that draws its own furigana with OpenType features alone, no ruby markup or JavaScript by Anthony Fu / fonts, typography, opentype / 0 min read
📺 Videos
- ViteConf 2026, the full replay: About 30 talks including Evan You’s keynote on tooling in the agentic era, Vitest 5, Vite DevTools and a faster Oxc parser by ViteConf / vite, javascript, conference
- What happens when AI writes your C++ code?: Benchmarking how well LLMs debug a half-million line C++ codebase, where they still lag at debugging versus writing by Greg Law, Mark Williamson / ai, cpp, debugging
- Do we really need alpha()?: Three ways to lower a color’s opacity in CSS and what the alpha function adds by Kevin Powell / css, colors, frontend