A practical guide to three-tier design token naming conventions using Style Dictionary and Tokens Studio leads the week, alongside a Figma-to-Claude Code design-to-code workflow and WCAG 2.2 guidance on accessible session timeouts.
A supply-chain worm in @bitwarden/cli and an OAuth breach at Vercel dominate security news, while SpaceX secures a $60B option to acquire Cursor and GitHub pauses Copilot sign-ups as agentic AI overloads its infrastructure.
Agentic coding commoditizes code production but not engineering judgment, a full-stack guide covers making apps MCP- and OAuth-ready for AI agents, and the Node.js Collaboration Summit previews a new calendar-versioned release schedule starting with v27.
Evil Martians outlines six proven techniques for making sites legible to LLMs via llms.txt and Markdown content negotiation, while Addy Osmani defines agent harness engineering as the real leverage point above model choice, and Vercel Workflows reaches GA for durable AI agent execution.
Josh W. Comeau applies Disney's squash-and-stretch principle to SVG micro-interactions via the Motion library, while GSAP 3.15 ships easeReverse for natural reversed animations, and Kevin Powell demonstrates pure-CSS wrap detection with container queries.
Windsurf 2.0 integrates Devin as a cloud coding agent on every plan, Netlify drops seat-based pricing in response to AI-driven developer growth, and Linux 7.0 ships with Rust support no longer experimental and an official AI-generated-code contribution policy.
ES2026 reaches Stage 4 with the Temporal API and explicit resource management, while TanStack Start debuts an RSC model that sidesteps the React2Shell CVE affecting Next.js, and Node.js 24.15.0 stabilizes require(esm) as LTS.
Matthias Ott argues for unifying design and engineering in a single practitioner, while Carmen Ansio coins creative bypass to name how AI tooling silently forks design systems, and Shopify's Polaris team used the Pi autoresearch agent to cut CI build time by 65%.
Storybook 10.3 introduces MCP for React so AI agents can build production UI directly from real stories and tests; Nielsen Norman Group reframes AI agents as first-class users of the products we design.
GitButler raised a $17M Series A from a16z to rebuild version control for agentic workflows, while an AI-powered bot called hackerbot-claw achieved confirmed RCE in six public repos including aquasecurity/trivy via GitHub Actions exploits.
Chrome 147 ships the new border-shape property as a decoration-preserving alternative to clip-path, while CSS linear() enables true spring physics animations with no JavaScript at runtime.
The axios npm package was compromised via a hijacked maintainer account, deploying a cross-platform RAT to over 100 million weekly downloads; Bun v1.3.12 ships built-in WebView automation and Bun.cron() scheduling.