Articles on web development, modern web technologies, performance optimization, and software engineering practices.
An out-of-band Next.js patch fixes a critical remote code execution bug in the Node.js ImageResponse API, traced to how the Satori SVG renderer escapes dynamic input. A second, larger release addressing nine more vulnerabilities ships September 30.
Safari 26.4 shipped the finalized display: grid-lanes syntax for native CSS masonry, with Chrome and Firefox updating their flagged implementations to match. Here's how to adopt it today without breaking keyboard navigation in browsers that don't support it yet.
The one window each year where a working developer gets direct input into what Chrome, Safari, Firefox and Edge prioritise closes on September 23. Here is what makes a proposal survive selection, and what does not.
React 19.3 shipped on September 9 and made Fragment Refs stable. You can now attach event listeners, observers and focus management to a group of siblings without adding a DOM node — or modifying the components you don't own.
Firefox 154 shipped sibling-index() and sibling-count() on August 18, making both Baseline Newly available. An element can now read its own position in CSS — which quietly retires the Sass @for loop and the style={{'--i': i}} prop.
SvelteKit 3 is in release candidate, and its most consequential feature is still behind an experimental flag. Remote functions let you call a server function directly from a component — which deletes a whole layer of boilerplate and moves your security boundary somewhere new.
Tell us what you're trying to build. A discovery call, a one-page summary within 48 hours, a proposal within a week.