CrowdStrike took down GlassWorm, a supply chain campaign that trojanized VS Code extensions to steal developer credentials from 300+ GitHub repos, while DeepSeek slashed V4-Pro prices 75%, further intensifying the AI pricing war.
CSS contrast-color() reaches Baseline Newly Available across Chrome, Firefox, and Safari, enabling self-correcting accessible palettes without JavaScript, alongside new @scope and No-Vary-Search caching techniques.
Addy Osmani defines the 'orchestration tax' — human judgment as the serial bottleneck throttling parallel AI agents — while Evil Martians documents a growing developer burnout crisis driven by AI-assisted workflows increasing perceived workload.
Deno 2.8 lands six new subcommands and jumps to 76% Node.js API compatibility, while a patched CVE-2026-23870 exposes how React's Flight protocol deserializer creates unauthenticated denial-of-service endpoints in every Next.js App Router app.
Five supply chain attacks struck in 48 hours — including the Mini Shai-Hulud npm worm hitting hundreds of @antv packages and a poisoned Nx Console VS Code extension with 2.2 million installs — exposing the entire dev pipeline from IDE to CI/CD.
Storybook 10.4 introduces AI-driven automated story writing and interaction tests for components, while ARIA research confirms that aria-label on generic div and span elements produces unpredictable screen reader behavior across all major AT combinations.
CSS gains native gap decoration with expanded column-rule and a new row-rule property for grid and flex, and Chrome 138 ships sibling-index() and sibling-count() for JavaScript-free staggered animations and automatic layouts.
Safari 26.5 ships the :open pseudo-class and Anchor Positioning fixes, while Chrome 137 introduces the CSS if() function for native inline conditional logic in stylesheets.
The Mini Shai-Hulud worm compromised 42 TanStack npm packages via GitHub Actions OIDC token theft, while Bun v1.3.14 landed built-in image processing and experimental HTTP/3 server support.
The Mini Shai-Hulud npm worm hit TanStack, Mistral AI SDK, and 160+ packages via GitHub Actions OIDC exploit, while GitHub Copilot launched usage-based flex pricing with a new Max plan at $100/month.
NNG research confirms that lean 2-5 person design-system teams outperform by design, while GitHub's accessibility agent reviewed 3,535 PRs with a 68% resolution rate using a two-sub-agent architecture.
GitHub's Issues team cut P10 navigation latency from 600ms to 70ms using IndexedDB caching and service worker preheating, while Shopify replaced Redis with MySQL SKIP LOCKED for scalable inventory reservations.
