Stack Overflow warns that AI-generated Node.js backends ship serious security defaults unless frameworks like DaloyJS refuse to boot on unsafe config, while Mozilla proposes PACT anonymous credentials as a privacy-preserving alternative to device-attestation anti-bot schemes.
141 Mastra npm packages were hit by a supply-chain attack injecting a trojanized dayjs clone, and JetBrains IDE plugins stole AI API keys from nearly 70,000 installs, while the U.S. suspended Anthropic Fable 5 access for foreign nationals.
Vercel open-sourced its internal TypeScript agent framework eve, and AI agent security dominated the week with the AutoJack RCE exploit against AutoGen Studio and Meta's AI assistant hijacking 20,000 Instagram accounts via confused-deputy flaws.
Evil Martians built a complete AI-assisted design system for Currents in seven weeks using OKLCH tokens readable by LLMs, while Style Dictionary automated WCAG contrast generation at build time.
CSS Day 2026 showcased masonry layout via grid-lanes shipping in Safari 26.4, styleable select via appearance: base-select, and CSS style queries now baseline-supported across all browsers.
Node.js patched eleven CVEs including a critical WebCrypto AES overflow and TLS wildcard bypass, while Angular 22 makes OnPush the default change detection strategy, completing its signals-based reactivity model.
Native CSS @function lands in Chromium 139 — bringing typed parameters and runtime-context conditionals without Sass — while Safari ships Grid Lanes, a CSS-only masonry layout, and WebKit publishes an interactive field guide at gridlanes.webkit.org.
The Miasma supply chain worm hit 73 Microsoft GitHub repositories by planting malicious AI-tool config files, while npm 12 will disable lifecycle install scripts by default to close the ecosystem's largest code-execution attack surface.
A French court ordered Carrefour to make its e-commerce platform EAA-compliant within six months — the first major enforcement action — while Auth0's design team reports eliminating the design-to-engineering handoff by letting designers commit fixes directly to the codebase.
Safari 27 beta lands 58 new features including WebAssembly JSPI and a rewritten ESM loader, while Rolldown 1.0 — the Rust bundler powering Vite 8 — delivers build speeds 10-30x faster than Rollup after VoidZero joined Cloudflare.
Bot traffic now exceeds human traffic at 57% of web requests per Cloudflare, and Stack Overflow launched Stack Overflow for Agents to prevent AI coding agents from repeatedly reinventing the same bug fixes and architectural patterns.
Biome v2.5 hits 500 lint rules with cross-file CSS-class analysis, while Angular 22 ships OnPush by default and a new WebMCP API letting Angular services register as browser-native AI agent tools.
