☝( ◠‿◠ )☝ weeklyfoo 161 is here!

● weeklyfoo

Issue #161 · 2 Nov 2026 · 41 links

The web dev week,
in one coffee.

Everything worth your attention from the past seven days, in 4 categories. Read it Monday, get back to building.

Read it first

A srcdoc iframe runs model-written HTML on your own origin, so a security engineer breaks the naive approach and rebuilds it with sandbox and a strict CSP

Keshav Malik · security, ai, html · 14 min read

Quantized coordinates split into streams that expose repeated rows to Brotli, 63% smaller than compressing raw floats, plus a render loop that sleeps when idle

Layers · performance, compression, javascript · 1 min read

Merged PRs more than doubled while reverts fell over 40%, by moving most reading to machines, scaling human approval by risk and making rollback fast

Anthropic · ai, code-review, agents · 21 min read

A font loaded three times as WOFF2, WOFF and TTF, traced through browser errors into Chromium source

Paul Calvano · performance, fonts, web · 9 min read

A lagging BI replica made the primary hold 31.7 TB of WAL while auto-growing disks crept toward a hard limit

Photoroom · postgres, postmortem, databases · 15 min read

Opus 5.5 builds the same app across frameworks over repeated runs, measuring cost, time, spec compliance, performance and accessibility, with Hono plus htmx, Astro and Nuxt among the cheapest

Nolan Lawson · ai, javascript, frameworks · 21 min read

A model swap made a data agent loop instead of finishing, a case for whole-system evals, explicit tool contracts and bounds on repeated behavior

Funnel · ai, agents, evals · 3 min read

Maggie Appleton · ai, agents, planning · 24 min read

Jovi De Croock · typescript, tooling · 5 min read

Florian Schindler · typescript, parsing · 18 min read

Max Bernstein · javascript, performance, compilers · 16 min read

ELLIO · security, nodejs · 28 min read

Mergify · python, postgres, timezones · 12 min read

turbopuffer · databases, search, performance · 17 min read

v12 · security, cryptography · 8 min read

Ahmad Alfy · css, html, ux · 7 min read

GitHub · github, ci, security · 4 min read

Matthew Wong · react, performance · 16 min read

Kyle Mathews · javascript, testing, ai · 24 min read

Dependency-free JPEG XL encoder in JavaScript, about 30 KB gzipped, with WebGPU quality search, lossless, HDR and JPEG transcoding

jackskip22 · images, javascript, webgpu

Usable implementation of the Stage 2 TC39 shared structs proposal, so workers can share objects instead of serializing copies

Erik Arvidsson · javascript, concurrency

Trigger-based row history to preview and undo bad updates, deletes or migrations by transaction ID, no superuser needed

pgEdge · postgres, databases

TanStack Redact TanStack · react, performance

Biome 2.6 Biome · tooling, linting

webframe Jeff Lindsay · cli, browser

Verdaccio 7.0 Verdaccio · npm, security, registry

Ghostty 1.4 Ghostty · terminal, tools

Expo Agent CLI Expo · ai, agents, react-native

Accessible components library TetraLogical · accessibility, components, frontend

browser-whisper 2.0 Tanpreet Singh Jolly · ai, webgpu, audio

mcdview Gheop · postgres, diagrams

Bundle Philipp Dunkel · nodejs, packaging

sqlite-js-stream Matteo Collina · sqlite, nodejs, ai

html Luke Edwards · javascript, html, parsing

vinext 1.4 James Anderson · nextjs, vite, performance

OpenTUI 0.8 Anomaly · terminal, react, tui

A TypeScript compiler running inside the TypeScript type system

zzj3720 · typescript, experiments · 8 min read

Simone · reverse-engineering, bluetooth, hardware · 20 min read

Refactoring 250M lines of C++, why Google made testing mandatory, readability reviews and why the CS curriculum needs burning down

Gergely Orosz · engineering, education, podcast

Ryan Peterman · history, c, unix

John Maeda · design, engineering

Got a link for us?

Reply and tell us. We can't include everything but we'll look at anything you send. Thanks!

Sponsorship or advertising? [email protected]

Did you like this weeklyfoo?

Your opinion matters. We want to hear you.