npm v12 blocks install scripts by default after Injective and jscrambler supply-chain attacks; Vercel acquires Better Auth to build scoped AI agent identity as a first-class primitive.
CSS Anchor Positioning arrives as a production-ready JavaScript-free tooltip and dropdown system, and @starting-style finally lets CSS animate elements in from a hidden state.
Cloudflare launches Workers Cache to eliminate CPU billing on cache hits at the edge, while GitHub's Copilot team shows that rewriting agent tool instructions cut review costs 20% without changing the tools themselves.
Bun rewrote its entire runtime from Zig to Rust in 11 days using 64 Claude agents, fixing 128 bugs; meanwhile TypeScript 7 ports the compiler to Go for a 10x speed boost.
Storybook 10.3 ships an MCP server that lets AI agents query your component library directly, and Evil Martians released Storybook Workbench agent skills for auditing vibe-coded codebases.
Native CSS masonry lands with display: grid-lanes (shipping in Safari 26.4), and Jake Archibald documents how calc-size() solves the sizing challenge for the new customizable select ::picker(select) dropdown.
VoidZero's Vite+ beta unifies six tools under a single vp CLI, while Next.js 16.3 ships Turbopack with up to 90% dev-server memory savings and a Rust React Compiler delivering 20-50% compile speed gains.
15 malicious JetBrains Marketplace plugins stole AI API keys from 70,000 developers over 8 months, and Cursor's DuneSlide flaws (CVSS 9.8) let prompt injection escape the sandbox — two supply-chain and AI-tool security wake-up calls in a single week.
WebAIM Million 2026 finds 95.9% of pages still fail WCAG — prompting a call to treat accessibility as an operational capability like security — while Figma's new community shader library shows promise but hits limits when AI agents try to export shaders to browser code.
Vercel Ship 2026 debuts the Agent Stack and a Vercel Agent that autonomously files fix PRs, Safari Technology Preview 247 ships a built-in MCP server for browser-driven AI debugging, and Cloudflare announces the Monetization Gateway using the x402 protocol to charge AI agents per resource.
Four Weekly Digest editions connected Rust toolchains, modern CSS, AI-ready design systems, and agent workflows with attacks that turned package and configuration metadata into execution paths.
Una Kravets demonstrates a Baseline-2026 declarative CSS theming system combining light-dark(), contrast-color(), and style queries, while Polypane explores the emerging pure-CSS random() function across seven JavaScript-free demos.