Harry Roberts exposes how a preload hint can silently expand the TBT Window and inflate Total Blocking Time scores, while Addy Osmani argues that loop engineering with tools like Codex and Claude Code demands more — not less — developer judgment.
VoidZero — the team behind Vite, Rolldown, and Oxc — is joining Cloudflare, while cross-document View Transitions land in Chrome, Edge, and Safari enabling pure-CSS page animations for multi-page apps.
A wave of npm supply-chain attacks hit the ecosystem in early June: the Miasma worm compromised 57 packages using a novel Phantom Gyp technique, while @redhat-cloud-services packages shipped a self-spreading credential harvester.
Atlassian's Hardik Pandya outlines a three-layer approach — Markdown specs, design tokens, and audit scripts — to make design systems AI-ready, while NNG maps four distinct design roles AI has created.
Ability Summit 2026 panelists from GitHub and Deque argue that fixing accessibility at PR stage is already too late, while a new Axe Aggregate Reporter tool consolidates axe-core Playwright results into a single shareable report.
Express.js patches three critical multiparty DoS CVEs (upgrade to 4.3.0 immediately), while Astro 6.4 ships a pluggable Markdown pipeline with a new Rust-based processor, Satteri, cutting build times by over a minute.
Chrome 148 is experimenting with Declarative Partial Updates for native out-of-order HTML streaming without JavaScript, and Google I/O 2026 debuted Web MCP — exposing website functionality as agent-callable tool APIs.
CrowdStrike took down GlassWorm, a supply chain campaign that trojanized VS Code extensions to steal developer credentials from 300+ GitHub repos, while DeepSeek slashed V4-Pro prices 75%, further intensifying the AI pricing war.
CSS contrast-color() reaches Baseline Newly Available across Chrome, Firefox, and Safari, enabling self-correcting accessible palettes without JavaScript, alongside new @scope and No-Vary-Search caching techniques.
Addy Osmani defines the 'orchestration tax' — human judgment as the serial bottleneck throttling parallel AI agents — while Evil Martians documents a growing developer burnout crisis driven by AI-assisted workflows increasing perceived workload.
Deno 2.8 lands six new subcommands and jumps to 76% Node.js API compatibility, while a patched CVE-2026-23870 exposes how React's Flight protocol deserializer creates unauthenticated denial-of-service endpoints in every Next.js App Router app.
Five supply chain attacks struck in 48 hours — including the Mini Shai-Hulud npm worm hitting hundreds of @antv packages and a poisoned Nx Console VS Code extension with 2.2 million installs — exposing the entire dev pipeline from IDE to CI/CD.
