CSS can position tooltips now. The Anchor Positioning API sticks one element to another, and position-try-fallbacks flips it when it would overflow the viewport. Josh Comeau wrote a great intro: https://www.joshwcomeau.com/css/anchor-positioning/

There's an HTTP status code for performance. 103 Early Hints sends your preload and preconnect headers before the real response, so the browser downloads your CSS and hero image while your backend queries the database.

There's an HTTP status code for performance. 103 Early Hints sends your preload and preconnect headers before the real response, so the browser downloads your CSS and hero image while your backend queries the database.

🎤 Faris Aziz is joining #WhatTheStack! Staff Software Engineer at Smallpdf, co-founder of ZurichJS, and international speaker. His talk: “Reverse-Engineering Seniority”, from bootcamp grad to Staff Engineer in four years 🚀 📅 Sept 19 | Skopje 🎟️ wts.sh

QUERY just became a proposed standard. It carries a body like POST, and the method itself declares the request safe and idempotent, so caching and retries finally work. https://www.rfc-editor.org/info/rfc10008/

@farisaziz.com rocking @reactbarcelona.bsky.social

Where should your auth token live? I wrote an entire article where I cover: localStorage, httpOnly cookies, BFF patterns, OAuth, and more Check it out 👇 https://neciudan.dev/most-secure-way-to-store-auth-token

Maxim Salnikov @salnikov.bsky.social (Microsoft) on AI harnesses, agent ops, and what truly AI native dev teams do differently. 🎙️ New Señors at Scale: https://youtu.be/4-j5KOEMCMY

📬 A new Newsletter edition just went out. Catch up here 👇 📝 Component communication patterns in React, every way two components can share data, and how distance and value type pick the right one https://neciudan.dev/component-communication-patterns-in-react

🛡️ Want to learn frontend security? My full course is live and free 👇 90% of breaches involve web applications, yet almost no one trains frontend developers to prevent them. https://neciudan.dev/master-security

Different Hydration and Rendering Strategies, by @neciudan.dev: https://neciudan.dev/hydration-and-rendering-strategies?ref=frontenddogma.com #strategies #hydration #rendering #staticsitegeneration #incrementalstaticregeneration

🔐 Is security a problem? (Of course it is) What if we add tests for all vulnerabilities👇 📋 There's a catalog of every bug class ever recorded 🔓 You can write a security test for it Check it out 👇 (PS I also have a FREE Security Course)

Camera access is becoming an HTML element. <usermedia> in Chrome 151 handles the click, the prompt, and hands you a ready MediaStream. https://developer.chrome.com/blog/usermedia-html-element

Safari Technology Preview 247 has a built-in MCP server. Your agent can now open a real Safari window, read the console, inspect the DOM, and take its own screenshots to verify a fix. https://webkit.org/blog/18136/introducing-the-safari-mcp-server-for-web-developers/

Hydration (not the breaks in the World Cup) I wrote a breakdown of every strategy we invented to make it faster, from streaming and islands to other rendering strategies to avoid it: Check it out 👇 https://neciudan.dev/hydration-and-rendering-strategies

"The state of your application, instead of living in memory, lives in the URL." New Señors at Scale episode with @francoisbest.com, creator of nuqs: URL state internals, npm supply chain attacks, and AI agents in open source. 🎥 https://youtu.be/b3AYuuRdyf4 #React #nuqs

"The state of your application, instead of living in memory, lives in the URL." New Señors at Scale episode with @francoisbest.com, creator of nuqs: URL state internals, npm supply chain attacks, and AI agents in open source. 🎥 https://youtu.be/b3AYuuRdyf4 #React #nuqs

📬 Newsletter edition just went out. Catch up here 👇 📝 How Claude took my site three majors forward, from Astro 3 to 6 in three days → https://neciudan.dev/astro-upgrade-from-3-to-6

I broke down how sourcemaps work 👇 https://neciudan.dev/everything-you-need-to-know-about-sourcemaps

useEffect re-subscribes every time the wrong state changes. A callback inside it reads a prop, so the prop goes in the deps, and the effect rebuilds whenever it changes. useEffectEvent (stable in 19.2) reads the latest value without living in the deps

You no longer need a router library for navigation. The browser's Navigation API just hit Baseline. One navigation event fires for every navigation. intercept() owns what loads, scroll() jumps to the main content the moment it's ready.

Does your Next.js app feel slow? 16.3 kills that pause after you click a link. Turn on Cache Components and you pick how each route navigates: stream behind a loading shell, cache rendered UI, or block on purpose. Still preview, behind two flags

React gives you eight ways to share data between components. Pick wrong and your app re-renders too much. It comes down to two questions: how far apart the components are, and what kind of value moves between them. https://neciudan.dev/component-communication-patterns-in-react

Learned something about useEffectEvent that the docs didn’t tell me: You can only call them _synchronously_ in an effect. If you wrap them in e.g. a ResizeObserver callback, they might run while react is rendering, leading to: > A function wrapped in useEffectEvent can't be called during rendering.

Unless I’m wrong the docs should outline this, because I got the error where the docs say: > This error means you’re calling an Effect Event function during the render phase of your component Which I’m definitely _not_ doing.

💬 "WebMCP exposes a layer that tells the agent: this is what this website can do. If you want to log in, call this tool." Susanna Wong (@studioswong) of @typeform on WebMCP, offline browser models, and evals for non-deterministic features. 🎧 https://youtu.be/l-plMwhOzS8

📬 Newsletter edition 16th went out👇 📝 New article on why service workers are still unused, and how I used one to finally kill the "failed to fetch dynamically imported module" error after every deploy: https://neciudan.dev/why-are-we-not-using-service-workers

🛡️ My Frontend Security Course is FREE All 7 modules are live now 👇 Supply chain, XSS, AI security, CSRF, broken access control, and misconfiguration are all shown across React, Vue, Angular, and Vanilla JS. https://neciudan.dev/master-security

⚡ TanStack cut TypeScript type-checking work by up to 86% in Table V9. The biggest single win wasn't a refactor. It was two keywords: marking generic params `in out` so the compiler skips its structural variance fallback. Do you ever profile your types? Check the full article in the thread 🧵

🔐 JWTs became the default for login settings, even though they were never built for it. Revoking one means tracking the server state. And once you have a state, a plain cookie session does the same job. JWTs or cookie sessions, which side are you on? Read more in 🧵

A nice story from @neciudan.dev - micro-frontends were overhyped and unproven. After speaking with industry leaders who implemented them at scale, I changed my mind. This talk covers the trade-offs, implementation journey, and choosing the right tools. Watch it now www.youtube.com/watch?v=68P_...

🌍 Server-rendered time always shows the wrong timezone. A new WHATWG proposal teaches the <time> element to render dates in the visitor's own timezone and locale, with zero JavaScript. Still stage 1, so now is the time to weigh in. Link in thread 🧵

🤖 I let an AI agent upgrade my Astro blog 3 major versions on its own. Build time down, vulns halved, bundle 95% smaller on some pages. Then it broke my login in production. Would you trust it with a version bump? https://neciudan.dev/astro-upgrade-from-3-to-6

Want to know more about the React newsletter? Here's a glimpse behind the scenes

"I scroll seven straight days of a 2,000-profile X list until I hit last week's tweets. Then I stop." How @sebastienlorber.com curates This Week in React for 45,000+ devs every week. Newsletters at Scale, on Señors at Scale 👇 https://youtu.be/YVs2KWvMjLM

📬 Newsletter edition 15 just went out. Catch up here 👇 📝 New article on everything inside a sourcemap, and how it can quietly expose your codebase: https://neciudan.dev/everything-you-need-to-know-about-sourcemaps

📬 I write one email a week about the JavaScript and web dev problems I'm actually hitting in production. 3,200+ developers have already subscribed. How about you? Subscribe here: https://neciudan.dev/subscribe

The job is shifting from prompting coding agents to designing the systems that prompt them. It's Loop Engineering: a recursive goal the agent iterates on until done, with a separate model checking it. https://addyo.substack.com/p/loop-engineering

You can now stream HTML straight into the DOM, instead of buffering the whole response and dumping it in with innerHTML. response.textStream() piped into div.streamHTML() fills the element in as it arrives, sanitized by default. Chrome Canary only

Most people see empty UI as a bug and reach for a spinner. If a section pops in after navigation, you forgot to preload it. Fix the preload, not the skeleton. Sharp piece on killing loading states: https://jjenzz.com/best-loading-states-are-no-loading-states/

Service workers shipped in every browser back in 2018, and almost nobody uses them. I dug into where they pay off (Slack, Mux, a Vite deploy of mine): https://neciudan.dev/why-are-we-not-using-service-workers

I have been a huge mono-repo fan since I started using it, thanks to my time at Celonis, I got to work on it full-time for more than 3 years, here is my experience which I shared with Dan Neciu during our disussion.

New episode with @santoshyadav.dev 🚨 We talk about Monorepos! Code reviews and more! Check it out 👇 https://www.youtube.com/playlist?list=PLeeGnEj5psFIwWJfpCwnedMsFApK6CvRr

⚡Featured posts this week: ✨ HTML-first site doubled our users: @moh-kohn.eurosky.social ✨ AI Doesn't Write Good Software: @adrianferrera.dev ✨ Web perf measurement is necessary: @tammyeverts.com ✨ Why are we not using Service Workers?: @neciudan.dev 🙏 Special thanks to the authors! #webperf

📬 Newsletter edition 14 just went out. Catch up here 👇 📝 New article, a gentle introduction to TanStack Query: https://neciudan.dev/a-gentle-introduction-to-tanstack-query

I host Señors @ Scale, a podcast about building software at serious scale. Hour-long conversations on architecture, migrations that went sideways, and the decisions behind systems serving millions of users. Subscribe here: https://www.youtube.com/@NeciuDan

Claude Code skills do not propagate to subagents. There are 14 metadata fields that do all the work All 14+ SKILL.md fields 👇 https://blog.fadamakis.com/skill-md-has-14-metadata-fields-use-them-correctly-763883717b26/

The :open pseudo-class is now Baseline. 🥳 It matches details, dialog, select, and date inputs while they're open. A select never gets an open attribute, so this state was unreachable in CSS until now. https://developer.mozilla.org/en-US/docs/Web/CSS/Reference/Selectors/:open

Everything You Need to Know About Sourcemaps, by @neciudan.dev: https://neciudan.dev/everything-you-need-to-know-about-sourcemaps?ref=frontenddogma.com #javascript #sourcemaps

You can block paint while the HTML parser keeps going: blocking="render" on a script tag. Made for components that measure layout before the first render, like priority-plus nav. Great write-up 👇: https://www.jayfreestone.com/writing/intentional-render-blocking-javascript/ @jayfreestone.com