Tech watch

TanStack Redact 0.2.0 replaces React and React DOM in the browser without changing application code. Its stable integrations support TanStack Start, Vite, Vinext, and Next.js; with the latter two, React still handles server rendering while Redact takes over hydration and client rendering.

TanStack’s measurements show bundle reductions from 20.4% to 70.5% across its reference apps, but actual savings vary by project. The tradeoff is explicit: Redact renders synchronously, without React’s time slicing or interruptible rendering. A heavy render can therefore delay input, so compatibility and the busiest screens should be checked in each application.

OpnForm is an open-source form builder available as both a managed cloud service and a self-hosted application. Its repository documents practical operational details: bundle-size limits, PostgreSQL index migrations that keep writes available, isolated Docker environments for worktrees, and dependency security checks. It also provides an MCP server that lets AI agents create and preview drafts, with versioned previews that support restoring earlier revisions.

Tanner Linsley’s AI-driven React projection experiment has become a TanStack project used in production. Redact is a smaller, React-compatible runtime that already works with Start, Next.js, Vinext, and Vite. On the server, React still handles SSR and Server Components.

The tradeoff is in rendering: Redact renders synchronously, without React’s time slicing. As the blog post acknowledges, a heavy render can still delay input. The smaller runtime therefore comes with a constraint worth considering for interfaces that need to remain responsive under load.

WebCheck brings publicly exposed domain information into one interface: DNS, TLS certificates, HTTP headers, subdomains, detected technologies, and potential threat-list matches. It offers 44 checks and can also examine redirects, trackers, and email configuration.

The results provide a useful starting point for surface-level checks, not a substitute for a thorough audit: some data, such as vulnerabilities linked by Shodan, depends on external sources. The project is open source, can be self-hosted, and provides an API.

RAG-Anything is a framework built on LightRAG for indexing and querying documents that mix text, images, tables, equations, and charts. It coordinates parsing and content analysis in a single multimodal pipeline.

The project combines vector similarity with a knowledge graph, provides processors for different content types, and can pass retrieved images to a vision model during queries. A recent change also routes rendered charts through the image pipeline while preserving captions and extracted text. To update a previously indexed document, multimodal reprocessing must be explicitly enabled with force_multimodal_reprocess=True.

MicroKit collects copy-ready interactions—animated buttons, tabs, inputs and hover effects—with React or CSS and Tailwind variants. Each component is copied separately in JavaScript or TypeScript, with no package to install; 26 of the 54 have no dependencies, while 28 use lucide-react.

The code is MIT-licensed, and Tailwind variants are designed for versions 3 and 4. In the Next.js App Router, most components work in server components; those using state, refs or event handlers need « use client ».

UI SFX groups 78 interface events into 12 sonic styles, so teams can compare how the same feedback feels without changing what it means. The library includes 72 one-shots and six loops, with interactive previews that place sounds in product flows.

Install it with npm install uisfx; its TypeScript API plays sounds and lets callers stop a loop when the associated state ends. Audio files use the CC0 license, while the runtime is MIT-licensed—a clear split that supports reuse in web and native projects alike.

This specification brings together 178 topics covering a website’s technical responsibilities, including HTML, accessibility, security, performance, SEO, privacy and resilience. Each topic explains why it matters and how to implement it, with items marked as required, recommended, optional or to avoid.

A yes/no checklist turns those criteria into an audit that teams can revisit after fixes. Grounded in primary sources and platform-agnostic, the specification is also available to agents through a read-only MCP server, with no authentication required for its reference tools.

The W3C has launched a second pilot in its open-source program: a polyfill for WebMCP, an incubating JavaScript API that lets applications expose functions as tools callable by agents and assistive technologies. The polyfill is intended to support experimentation and interoperability as the specification evolves.

Plans include publishing an npm package, tracking Web Platform Tests coverage, and advancing lifecycle events and declarative support. If WebMCP moves onto the standards track and interoperable native implementations emerge, the polyfill would be phased out gradually.

Expired domains behind old analytics and advertising tags have been bought and repurposed to redirect visitors to malicious content, including the Coruna and DarkSword iOS exploit kits. Report URI and iVerify describe a chain that filters visitors and tailors its payload to the device; security scanners may receive only an empty response.

The case shows how a forgotten third-party script remains an active dependency: its domain can change hands without any site change. The article recommends auditing tags, monitoring loaded scripts, and restricting their domains with a Content Security Policy.

WebSub defines a notification protocol between publishers and subscribers: a subscriber discovers a hub, registers a callback URL, and receives updates from the hub over HTTP. The specification covers subscription validation, renewal, and delivery retries, while leaving the mechanism publishers use to notify hubs unspecified.

The updated W3C Recommendation adds safeguards against XSS attacks during subscription verification. It also specifies HMAC signatures for notifications: SHA-1 remains common for compatibility, the document notes, but recommends at least SHA-256 when TLS transport may be compromised.

The W3C repository presents ActivityPub, a decentralized social networking protocol that combines a client-to-server API with a federated server-to-server API. Built on the ActivityStreams 2.0 JSON-LD format, it supports extensible activity descriptions and different kinds of social applications.

The repository also explains how to evolve a published recommendation: clarifications belong in the Primer, corrections follow an errata process, and breaking changes require a new working group. That formal governance reflects the deployment cost of changing a protocol used by many independently operated servers.

Standard.site proposes shared lexicons for publishing platforms on AT Protocol. The goal is to give indexers and tools a common schema while making content easier to discover and move between hosts.

The standard describes metadata for publications, documents, and subscriptions without prescribing a content format. Each platform can choose which lexicons to implement. Verification uses a /.well-known/site.standard.publication route to link a domain to its publication, and an HTML tag to associate a document with its AT-URI.

next-themes applies the theme as the page loads, respects the system preference, and syncs the choice across tabs. Its ThemeProvider works with both the App Router and pages/, while a hook lets components switch themes or handle multiple variants.

One architectural detail matters: the browser-stored theme is unavailable during server rendering. UI that depends on useTheme should wait until the client component mounts to avoid hydration errors. The library also updates the <html> attribute—suppressHydrationWarning is recommended—and remains independent of the CSS solution in use.

Plane brings work-item tracking, cycles, modules, pages, and analytics together in an open-source project management platform, with self-hosting options through Docker or Kubernetes. Its repository also documents a substantial architecture effort: migrating the interface to the Propel design system in stages, with tests, accessibility checks, and the gradual removal of legacy components. The web app uses React and React Router, with Django on the API side.

oh-my-hermes adds an orchestration layer to Hermes Agent: it maps work categories to models and reasoning effort, loads skills on demand, and can turn a goal into a graph of parallel tasks. Each task keeps a separate write scope, while a distinct node verifies the outcome.

A notable architectural choice is separating preparation from execution evidence: a plan is not treated as completed work, and an agent’s claim that it finished does not validate the result. The project also offers review-gated memory and a dedicated TUI, without replacing or patching Hermes Agent.