in the audience, scratchin an itch: responsive #CSS scroll animation try it! cdpn.io/pen/debug/wB...

On point. www.mcsweeneys.net/articles/the...

I thought about things that have happened in CSS in 2025 and what I think you should probably know. Then I blogged it. frontendmasters.com/blog/what-yo... It's not *everything* — it's my own curated list.

CSS `field-sizing` on a `<textarea>` is obviously awesome. But the horizontal growth using it on an `<input>` is less clearly useful to me. But check out this design pattern I cooked up. I don't hate it. Keeps the name area compact until you need to see more. Just a bit of flexbox wrapping.

some good insight here into how (I try) to navigate conflicts on social media (which can be very confusing to folks that are very accustomed to shouting and being shouted at): www.youtube.com/watch?v=Omc3...

Do I know someone who has experience (or ability) working with Pagefind pagefind.app to implement search for an @11ty.dev based website who also happens to be available for hire? I need someone who can use the search API to create a custom implementation with custom HTML markup. Thank you #lazyWeb

Critical part of the President's new $100,000 charge for H1-B visas: The Administration can also offer a $100,000 discount to any person, company, or industry that it wants. Replacing rules with arbitrary discretion. Want visas? You know who to call and who to flatter.

If you are currently abroad and on a valid H-1b visa, starting Sunday you'll be barred from re-entering the U.S. - unless you or your employer pay $100,000 to the U.S. government. This de facto travel ban will cause chaos throughout tech and the entire economy. www.whitehouse.gov/presidential...

Please add this tiny bit-o-CSS for stable scrollbar gutters to your Reset Stylesheets www.zachleat.com/web/stable-s...

Had a great conversation with @sjoy.lol today. We both toyed around with the web as a hobby starting in the late 90s, before eventually turning it into a career much later on. We talked a lot about that, but then got into accessibility and I just loved how she referred to it as "a heart thing" 😊

So, a misused React `useEffect` hook has led to a Cloudflare outage last week? 😲🫣 blog.cloudflare.com/deep-dive-in...

the big logo on the 11ty home page is now a @fontawesome.com icon 🥰 www.11ty.dev

Fallon being the last man standing is such an indictment of Fallon

I know of many people against the AI hype, but where are the tech companies that are against it? Do they exist? Are they hiring? How can I help them?

Did you know? An Eleventy icon is now available (for free!) in Font Awesome v7: fontawesome.com/icons/eleventy Use it today with the newly released stable v1.0.0 of the Font Awesome Eleventy plugin: github.com/11ty/elevent...

a good arbiter of how close we are to bad hybrid regime shit is if the political comedy shows start getting pulled for whatever reason

I've published my perspective of the @ctrl/tinycolor NPM supply chain attack. This whole thing got me to finally make a blog. sigh.dev/posts/ctrl-t...

hmm — the favicon for microsoft.com has been broken for at least a week now

I had a great time nerding out about #WebComponents DX and #DesignSystems!

In personal news, I have started working at @freedom.press on the team @securedrop.org which is software that whistleblowers use to anonymously send documents to journalists. This is exciting and meaningful to me because:

Need help with web performance optimization? Have a tricky new build you're working on? I have two projects wrapping up and am available for new ones starting next week. sia.codes/services/

Two somewhat contradictory beliefs I hold: 1. You should absolutely overengineer your personal homepage/blog/projects. Experiment with as many things as you can as quickly as possible. 2. If you _really_ wanted to write that blog post, you'd figure it out with a .txt file. Don't overcomplicate it.

There is so much GamerGate energy in American politics and culture today. I’d never have guessed that was going to be the blueprint for what living in America would be like in 2025.

ℹ️ Don't know who needs to hear this but npm has had a --before=<date> flag since v6.9.0 (02/2019): github.com/npm/cli/blob/v… Setting a relative date is easy w/: $ npm install --before="$(date -v -7d)" # & only get registry deps that are over a week olddocs.npmjs.com/cli/v11/usin...re

Got to have a fantastic conversation with @henrihelvetica.bsky.social yesterday. The full convo will be posted over on my second channel in a few weeks... while you wait, there's a great one with @sarasoueidan.com on accessibility that went up this week as well 😊 👉 www.youtube.com/@GeneralMusi...

sometimes it’s for better and sometimes it’s for worse, but npm has always been a Big Group Project™

Heads up, there seems to be an NPM vulnerability brewing bsky.app/profile/notw... We just released `3.0.0-beta.6` of Web Awesome to lock `@ctrl/tinycolor` to v4.1.0 We'll keep an eye out as info comes out If you're using the CDN, those are pre-bundled and will not "upgrade" beyond 4.1.0 already.

🚨 Malicious update to @ctrl/tinycolor on npm is part of an active supply chain attack hitting 40+ packages across multiple maintainers. Audit & remove affected versions. Our analysis of the malware: socket.dev/blog/tinycol... #NodeJS #JavaScript

Honestly serious: JUST DON'T UPDATE PACKAGES RIGHT NOW. It is unclear to me yet, but this is looking pretty wide spread. Better be safe than sorry, just go touch some grass.

Viewport behavior in Safari 26 is utterly broken. 🙄😭 Time to get Viewports into #Interop2026 because viewports on iOS have gotten only worse since I did the initial research in, *checks notes*, 2022 — github.com/web-platform...

Hosting a website on a disposable vape bogdanthegeek.github.io/blog/project...

TypePad is closing down at the end of the month and Phil Gyford has shared the process for downloading a TypePad blog (so that you can turn it into “a pretty self-contained ‘static HTML’ site”). [gyford.com]

It's late on a Saturday night, but I just wrote this, so I’m putting it here. bobmonsour.com/blog/organiz...

pnpm v10.16.0 adds "minimumReleaseAge", a setting for defining how long a version has to have been published before pnpm will install it. A nice countermeasure against accidental installs of short-lived compromised packages before they get taken down. Not a 100% fix, but a great additional step!

This is a wonderful post explaining how to make animations feel "right" (or why sometimes you don't need to animate at all). 👇 emilkowal.ski/ui/you-dont-...

The big problem is investors will keep pouring money because *if* one of them hits, it's going to be worth an unfathomable amount. A lot saw that as a matter of when, and hoping to hitch to the right horse. Now I wonder how much is just sunk cost fallacy at play. futurism.com/six-months-a...

Just to be blunt, if you want Wired and 404 and The Verge to employ reporters who understand the memes on bullet casings and can connect them to gaming culture while having the legal and support resources to deal with waves of harassment when we do it… you have to subscribe and pay for the work

trying to estimate how much the saas is gonna cost

no-build is the best north star for a build tool

I started a new open source project: Multiocular shows what’s changed in your node_modules after dependency updates. Right now it just shows a diff, but I have many of idea. It is part of my long-running fight against Supply Chain Attacks. github.com/multiocular-...

Issue 78 - Why it's called Eleventy, 11ty Meetup 9/17, Speaking of CMS's, The ZeroPoint starter, Vento 2 has arrived, Performance debgugging?, Components on the island...And 4 releases, 33 posts, and 13 sites to see https://11tybundle.dev/blog/11ty-bundle-78/ #11ty @11ty.dev

Imagine a web page that loads instantly, deploys effortlessly, and never needs a security update.
 #webstandards #css #html

Random TIL for the day, inadvertently via @zachleat.com's post here www.zachleat.com/web/history-... - the US had a _different_ Dennis the Menace, which explains the 1993 movie that really confused me with it's visuals as a teen. Only took a few decades to work it out 🤦

Hackers just hijacked npm packages with 2–3 billion weekly downloads. All that access… and they only stole $500 of crypto 🤯 Sloppiest supply chain attack ever. But if they’d been smarter? Could’ve been catastrophic. I broke it down on @riskybusiness.bsky.social. Full video here 👇

Love seeing @marcgrabanski.com front and center here showing off what his team has built and offering it at a (once-a-year) discount. Frontend Masters is a great place to learn to code better and you pay a fair price for it. www.frontendmasters.com/sale/?utm_so...

You HAVE to check out @matthiasott.com's website: matthiasott.com Extremely creative and well-built, you can even play around with customization knobs (using design tokens!) like a musical instrument!

WRITING IS FUN AND COOL

Re the incidents lately: I think npm needs to provide a flow where we can block a workflow (gh action) until a user goes to a URL to 2fa and approve it Most of us maintainers would be happy to do that extra step imo

icymi i’ve the honor of speaking about personal websites at this year’s @webdevconf.com. the lineup is full of utter heavyweights, titans of the industry, and i hope you’ll join us. get tickets at webdevconf.com :)

Hi friends. Blogging is fun, so I started again. I hope you’ll take a look and follow along at @notetoself.studio notetoself.studio