Some friction is healthy in our online interactions. You shouldn't be able to send a bug report without a reproduction. You shouldn't be able to create a PR without understanding the issue (and the solution). You should (try to) be aware of their context before replying to an unknown person online.

To recap, NPM allows 2FA TOTP token reuse within the token’s validity window. I reported this and was told it’s a “known low-risk issue” and that they “don’t consider this to present a significant security risk.” So, let’s look at how this seemingly small issue could be leveraged by a phisher. 1/

Just show the prompt and save us all time and resources. distantprovince.by/posts/its-ru...

The browser has everything you need, why not everything needs to be server-rendered and how preloading can alleviate complexity. jovidecroock.com/blog/platform

In SF for work and have a free afternoon & night (and might sneak away during this week too), anyone have recommendations?

From the thread: "Attacks from bot compromised Next.js assets spiked on 2025-12-05 from the usual 100 IP baseline to close to a 1000." If you're not 100% sure you're NOT vulnerable, you should patch your Next.js apps ASAP. And if you're 100% sure... patch anyway.

This is a new sort of post for me. Trust in OSS is a thing I care a lot about. This post is my attempt to frame AI slop PRs as an attack on trust in open source.

Finally got myself a KVM switch for swapping between my work & personal device and my god am I kicking myself for not doing it sooner. All monitors have kinda awful on-screen displays, with awkward controls to boot, but swapping display inputs was a ~40 second process with mine previously.

RSCs were a mistake. I went back to a client-side only solution using Preact for my latest project because the complexity you buy into is simply not worth the benefit of RSCs.

The changed code is a small fraction of an open source contribution. Your commitment to understand the issue, how your proposed solution fits with the project, and be ready to own and push the review process forward is the biggest chunk of the work. Your effort is the contribution, not the code.

Hello friends and welcome to a new “How is ESM vs CJS going!” 33.4% of the popular packages on npm now includes ESM. Up from 29.6% half a year ago. We have a third! ESM-only is up from 11.5% to 12.6%. This is also the impact of half a year of Node 18 being EOL, making `require(esm)` available

Firefox 147 is getting the Navigation API 🎉 🎉 🎉 See bugzilla.mozilla.org/show_bug.cgi...

If your business model doesn’t work without breaking the law, you’re not in business. You’re in organized crime.

Inspired by perfnow.nl, I've dusted off drafts of my network and device situation analysis. Good news/bad news: devices and networks are improving, but pages are swelling. The web is usable for the wealthy, but less so for everyone else. infrequently.org/2025/11/perf...

Wanted to write up a few quick slides for something, picked up a JS tool that I've heard a little about, and the default initializer crashed StackBlitz. Tried it locally just to see it attempts to load 150mb of JS. Nice Even after an hour of culling patches FF still struggles with the huge bundles

one downside of LLMs in OSS is _huge_ walls of text in issues, where the text does technically make sense but reads like a student trying to meet a character limit 😅

The GitHub PR “N hidden items, Load more…” UI is one of the *most* annoying things about its interface—and that says something! When I am working with a large, long-running PR (and yes, there are valid reasons for those!) I’d like to just be able to read the whole dang thing, please and thank you!

I stared into the abyss and 12MB of uncompressed JS, containing thousands of SVG icons, webpacked into cursed React components stared backed like a horrifying fractal of beady little eyes.

Remember that Intuit (the owner of Turbotax) lobbied extensively to kill Direct File, which did tax filing for free and somehow managed to make a good and intuitive user experience without AI.

My first advice to junior contributors is to STOP using vibe coding for PRs. OSS is always about people more than about code. We don't need more code generated by LLM, we need more people who care.

Vibe coding PRs - STOP please...

Gecko: Intent to prototype and ship: Navigation API

Calling all web developers! Browsers are all meeting up next week (www.w3.org/events/tpac/...). I want your voice to be heard! Tell me your biggest problems, and tell me what you want to see from the platform. What problems are tough to solve, but could be easier?

Joys of American insurance: dental office tells me to check with my provider to see if I'm covered, my provider's list meanwhile is 5+ years out of date in some cases -- one "active" listed dentist retired back in 2019. I guess I'm figuring out if I'm covered or not when I get billed, huh?

Reason: Push is only half of whats needed. Web Push is gated behind install. Install for native is easy, for web apps it's hidden to the point developers are forced to build native apps, the very developers that would be using web push. Missing lots of features. webventures.rejh.nl/blog/2024/we...

I think I found a chromium bug - when using moveBefore on a focussed input where you have a selection range it loses its selection range. Chrome bug: issues.chromium.org/issues/45482...

“Instead of smoothing the path for everyday tasks, iOS 26 makes users relearn basics while enduring a constant parade of visual stunts.”

For some bizarre reason StackOverflow recently shipped an update which replaces date stamps with "Over a year ago", as if that was more useful. Now I have to hover and check each to see if "Over a year ago" means 2023 or 2013. Well done guys, what an update.

Signals flip the script. React renders where you create state. Signals render where you use state. Same state, but you are pushed into patterns that will lead to better performance by default. One paradigm shift away from memoization hell. 🎯 www.jovidecroock.com/blog/state-v...

@preact/signals currently* has an issue with how it handles changing signal references within useComputed's captured scope and we were hoping to get a bit of feedback from the community, if anyone wants to offer their opinions and feelings on the matter.

Gecko: Intent to prototype: Sanitizer API

”We fed our horse and a competing jet engine hay for a week and then measured their hooves. The results will astound you.” Web dev discourse in 2025.

Gosh I just love having to open devtools up & fix my banks' broken website so I can log in and pay them money. This is like the 5th time I've done it too, second largest bank in the world and they can't be bothered to write a few E2E tests.

[rebase] autoStash = true This has changed my life, how did I not know it was an option?! I've spent a silly amount of time over the years bouncing off rebase attempts, stashing, then trying to rebase again & having to remember to pop the stash afterwards, but no more!

Write good commit messages. Yes, even when you’re working on a solo project or one where you work with just one or two other people. Your memory isn’t as good as you think it is (almost no one’s is!) and you’ll be glad you wrote it down. Tonight’s example for me was this: github.com/true-myth/tr...

Shame Apple forgets to mention that one company already tried and twist the law into an excuse to kill PWAs in Europe ¯\_(ツ)_/¯ www.apple.com/newsroom/202...

your regularly scheduled reminder not to let the triangle company host your projects

Not a comment on any particular site but event delegation seems to have fallen by the wayside for many front end devs which is a real shame. Perhaps the component model makes it too easy to forget about how things piece together, i.e., the effects of component being rendered 100+ times on a page.

I made a submission to #Interop 2026 – the WebKit bug that results in a race condition with multiple top-level awaits in different modules: github.com/web-platform... We’ve talked about this one on here @rich-harris.dev and @jensimmons.bsky.social Let me know if I should add anything else?

Honestly I think that's true for a _lot_ of the maintainer in the ecosystem overall. Even if our libraries directly "compete" with each other in usage terms, most of us are out here chatting, learning, borrowing ideas, and on the same page trying to solve problems and push the ecosystem forward.

Upvote this feature for Interop 2026: github.com/web-platform...

pnpm v10.16.0 adds "minimumReleaseAge", a setting for defining how long a version has to have been published before pnpm will install it. A nice countermeasure against accidental installs of short-lived compromised packages before they get taken down. Not a 100% fix, but a great additional step!

i really wish browsers let you define your own handlers for import attributes. like, imagine you could do something like this:

The missing link in JavaScript tooling Some thoughts on the fractured nature of our tools how we could unify them all. I feel like this would remove many barriers framework devs run into. marvinh.dev/blog/unifyin...

My tiny contribution to preact-iso: Narrowing route props

agree with all this and i'll actually go further: usage of trivial dependencies like is-number or shebang-regex is a strong indicator that a library is low quality

plex got pwned, reset your passwords

I had the audacity to try to use my ultrawide monitor with a macbook (totally rejected it, DP 1.2 only and I can't customize the damn resolution) and in that process my monitor settings reset for my personal device and everything looks *wrong*. This shall bug me for weeks, I know it.

What if some client-side browsing features were part of the web platform? Direct CSS reflection of URL state, snappy pending/optimistic UI, URL-to-scroll-snap binding, and some basic same-document navigation use cases, with JS being only an option. github.com/WICG/declara... Inviting feedback!

Fresh 2 has graduated to beta releases - essentially release candidates before a stable release. Fresh can now act as a Vite plugin, opening the door to HMR, faster boot times, and Cloudflare deployments. deno.com/blog/fresh-a...