Astro 7 ships a triple-layer Rust migration cutting real-world builds 15-61%, while Next.js 16.3 adds Instant Navigations and first-party AI agent Skills, and Vercel's AI SDK 7 graduates into a full agent runtime with WorkflowAgent and HarnessAgent.
North Korean group Sapphire Sleet compromised 145 Mastra npm packages via a hijacked contributor account, prompting npm to introduce a 72-hour publishing freeze for high-impact accounts, while the White House signed an executive order mandating post-quantum cryptography for federal agencies by 2030.
The DTCG Color Module series advocates OKLCH-structured tokens with Style Dictionary for automated WCAG-compliant ramps, while the Open Design System Format (ODSF) packages design systems as machine-readable bundles for AI coding agents.
Stack Overflow warns that AI-generated Node.js backends ship serious security defaults unless frameworks like DaloyJS refuse to boot on unsafe config, while Mozilla proposes PACT anonymous credentials as a privacy-preserving alternative to device-attestation anti-bot schemes.
141 Mastra npm packages were hit by a supply-chain attack injecting a trojanized dayjs clone, and JetBrains IDE plugins stole AI API keys from nearly 70,000 installs, while the U.S. suspended Anthropic Fable 5 access for foreign nationals.
Vercel open-sourced its internal TypeScript agent framework eve, and AI agent security dominated the week with the AutoJack RCE exploit against AutoGen Studio and Meta's AI assistant hijacking 20,000 Instagram accounts via confused-deputy flaws.
Evil Martians built a complete AI-assisted design system for Currents in seven weeks using OKLCH tokens readable by LLMs, while Style Dictionary automated WCAG contrast generation at build time.
CSS Day 2026 showcased masonry layout via grid-lanes shipping in Safari 26.4, styleable select via appearance: base-select, and CSS style queries now baseline-supported across all browsers.
Node.js patched eleven CVEs including a critical WebCrypto AES overflow and TLS wildcard bypass, while Angular 22 makes OnPush the default change detection strategy, completing its signals-based reactivity model.
Native CSS @function lands in Chromium 139 — bringing typed parameters and runtime-context conditionals without Sass — while Safari ships Grid Lanes, a CSS-only masonry layout, and WebKit publishes an interactive field guide at gridlanes.webkit.org.
The Miasma supply chain worm hit 73 Microsoft GitHub repositories by planting malicious AI-tool config files, while npm 12 will disable lifecycle install scripts by default to close the ecosystem's largest code-execution attack surface.
A French court ordered Carrefour to make its e-commerce platform EAA-compliant within six months — the first major enforcement action — while Auth0's design team reports eliminating the design-to-engineering handoff by letting designers commit fixes directly to the codebase.