Claude Opus 4.6 and GPT-5.3 Codex dropped 26 minutes apart, triggering a full benchmark war — and a security researcher cracked an AI agent wide open in under two hours.
Monday.com's Vibe team shows how AI + Figma MCP cuts component handoff from meetings to minutes — plus the accessibility compliance clock ticking toward Canada's 2027–2028 ACA deadlines.
ESLint v10 draws the final line under the legacy eslintrc era — and this week also brings Deno Deploy GA, Bun's parallel script runner, and a deep look at React 19's rule-breaking use() hook.
Addy Osmani reframes "vibe coding" as disciplined agentic engineering — and a head-to-head study reveals exactly where AI debugging falls apart on real React bugs.
CSS @scope reaches Baseline and could finally replace BEM — plus OKLCH color deep dives, five underused properties Kevin Powell swears by, and Vercel's new bitmap-inspired Geist Pixel typeface.
A critical CVE in React Server Components demands immediate upgrades across Next.js 13–16 — and Anthropic ships MCP Apps, letting AI chat interfaces render fully interactive embedded UIs from any MCP server.
Node.js takes a giant leap with a new --build-sea flag that turns multi-step executable bundling into a single command — plus Bun v1.3.7 brings massive Buffer and async/await speedups across the runtime.
Addy Osmani's self-improving agent loop shows how a Claude Code agent can autonomously ship code at scale using stateless iteration and a shared AGENTS.md memory file — the most compelling agentic workflow pattern of the week.
The W3C Design Tokens spec's $extensions field finally gets a clear explainer — learn how to add tool metadata, governance notes, and accessibility data without breaking the core standard. Accessibility best practices round out the week.
Roman Komarov cracks the decade-old CSS shrinkwrap problem using only anchor positioning and scroll-driven animations — no JavaScript required. Plus: oklch color scales, anchor positioning use cases, and CSS 2026 features.
Lodash 4.17.23 patches prototype-pollution CVE-2025-134655 and stands up a new OpenJS-backed Technical Steering Committee, Cloudflare acquires The Astro Technology Company keeping the framework MIT-licensed, cURL shuts down its bug bounty over AI-slop submissions, and a VS Code zero-click exploit is shown to silently reprogram Cursor AI agents.
Nicholas Zakas charts the engineer's shift from coder to AI orchestrator as GitHub Mission Control and VS Code agents redefine the IDE, Cloudflare's Astro acquisition hands the framework resources to ship Astro 6, WebAssembly moves from niche to production frontend powering image editors and AI inference, and Node.js publishes a codemod to drop Chalk for native util.styleText.
