Sébastien Rigaux

Tech watch

Page 5 of 22

GitHub advisory for critical remote code execution in React Server Components, showing the React logo and affected npm packages.

A critical vulnerability enables unauthenticated remote code execution in some applications using React Server Components. It affects react-server-dom-webpack, react-server-dom-parcel, and react-server-dom-turbopack in the versions listed in the advisory, with a CVSS score of 9.5.

The described scenario is rare: it requires responses that transport multiple typed arrays and an attacker-controlled value. React applications without a server are unaffected, as are applications that do not use a framework, bundler, or plugin supporting Server Components. Fixes are available in 19.0.9, 19.1.10, 19.2.9, and 19.3.1; affected deployments should upgrade immediately.

mattcarrollcodeFound via JavaScript Weekly

Illustration of a paper frying pan holding ribbons and origami shapes on a grid background, with the text “skill-pilled”.

PostHog shares practical guidance for writing skills that help agents without locking them into a brittle workflow. The core idea is to load context progressively, define the goal and constraints, then let the agent choose steps that fit the repository and runtime environment.

The article also addresses maintenance: separate durable structure from fast-changing details, point to a single source of truth, and regenerate skills instead of patching them indefinitely. Skills carry context and upkeep costs, so they make most sense for recurring tasks where agents lack essential context or perform poorly by default.

Ian VanagasFound via JavaScript Weekly

A black-and-white crowd behind the pour logo and the slogan “Make the web work for everyone”.

Pour brings together a browser extension, a CLI, a VS Code extension and a contrast checker to assess accessibility against WCAG 2.2. Audits identify affected elements and explain fixes; criteria that require human judgment are marked for review.

The CLI can fail a CI step when it finds issues, generate an HTML report for a site, and expose tools to an agent through MCP. Automated checks assist with 51 of the 86 WCAG 2.2 criteria without claiming to determine compliance: a checklist accompanies the findings to support manual review.

Found via Frontend Focus

Screenshot of Chrome DevTools showing the extension panel, its minimap, activation and active ranges, and their editing fields.

This Chrome DevTools extension makes CSS animations triggered by scrolling easier to debug: a minimap locates the scroller, element, and subject, while colored markers show activation and active ranges. Values can be edited live; the tool supports ScrollTimeline, ViewTimeline, and elements using position: sticky.

Two limitations come from Chrome: relative units such as 90vh are reduced to computed pixel values, and elements inside an iframe are not supported. The extension fills a gap in DevTools while built-in support remains a possible future improvement.

@bramusFound via Frontend Focus

Preview of the Azure/data-api-builder GitHub repository, showing the Azure logo and a project description.

Data API builder generates REST and GraphQL endpoints, as well as MCP tools, from Azure databases and on-premises stores. It supports several backends, including Azure SQL, SQL Server, PostgreSQL, MySQL and Cosmos DB, and runs in a container or locally during development.

Configuration defines entities and their permissions; DAB then translates requests into SQL. This layer reduces the API code teams need to maintain, while access remains shaped by the configuration and each database’s capabilities.

GitHub preview of the pgrundev/pgx repository, described as lightweight PostgreSQL for AI agents, written in Rust.

PGX runs isolated PostgreSQL databases inside a single Rust runtime, targeting short-lived agent, CI, and test environments. On-demand creation from a sealed template and copy-on-write on ZFS reduce the cost of branching; without block cloning, the system makes a full copy.

The project is at v0.1.0 and targets disposable databases, not production data: fsync is disabled, and one runtime is a single failure domain. Its benchmarks document their measurements and conditions; the PostgreSQL regression suite reports zero result differences in the stated configuration, without claiming general compatibility.

Illustration of a button with a trash icon alongside SVG and CSS code snippets.

Lea Verou proposes treating icons as CSS design tokens: custom properties assign them to pseudo-elements, where SVG masks render them without adding markup. Components can then select or override an icon based on state, theme, or context, while keeping definitions centralized in the design system.

There are trade-offs: masking mainly suits monochrome icons, URLs and registered properties behave inconsistently across browsers, and Safari needs workarounds. The post explains these constraints and introduces @nudeui/icons, a package that brings the system together.

Lea VerouFound via Frontend Focus

GitHub preview for the GoogleChromeLabs/webmcp-tools repository, showing its name, a description of WebMCP utilities and demos, and the Chrome Labs logo.

This repository brings together tools for working with the WebMCP API: a Chrome extension inspects the tools exposed by a page, their input schemas, and connection issues, while a CLI evaluates whether LLMs call the right tools against defined test cases.

Demos also show declarative and imperative integrations in practical interfaces. The collection helps move from experimentation toward more structured testing, while remaining a project intended to support adoption of the WebMCP API.

GitHub banner for the pingdotgg/ts-rust repository, describing it as an experimental Rust port of the TypeScript 7 compiler.

ts-rust ports the TypeScript 7 compiler, checker, and language server to Rust, aiming to match the Go implementation’s diagnostics and behavior. The repository reports extensive conformance and substantial speedups across several projects; in its published measurements, type checking across six open-source apps is 2.10× faster on average than TypeScript 7.

The trade-offs show up in the options: --fast cuts runtimes further but can increase CPU and memory use, while some diagnostic differences depend on checker count or type cycles. The project is explicitly experimental and documents limitations, including in build mode and during long editor sessions.

dotnetup toolchain manager presentation on the official .NET Blog

Microsoft introduces dotnetup, a toolchain manager for .NET inspired by rustup and nvm, designed to simplify installing, updating, and managing multiple SDK and runtime versions without admin rights. The tool operates entirely in the user’s home directory, respects global.json, lets you track version channels or install daily builds, and streamlines cleanup of obsolete versions. It targets CI/CD use cases and aims for a unified experience across macOS, Linux, and soon Windows.

Chet Husk

croc encrypted file transfer between browser and terminal

croc enables sending files or text between two devices with end-to-end encryption, no network setup, and no user account. The tool works via CLI or a web interface, generates a shareable code, and supports multi-file, folder, and resumable transfers. It stands out for its ease of use, cross-platform support, and a user experience often considered more polished than Magic Wormhole.

Zackary Scholl

Screenshot of the REA repository on GitHub

REA offers a unified approach to reverse engineering, driven by agents that can analyze native binaries, JavaScript/Electron apps, websites, or databases without source code access. The tool integrates with agents like Claude Code or Cursor, provides evidence and limitations for each analysis, and leverages native tools (Hopper, Ghidra, IDA) for deep inspection. The documentation details supported scenarios, provider setup, and CLI workflows, with concrete examples of feature-level reverse engineering from real applications.

morluto

Header illustration for the React folder structure article on Robin Wieruch’s site

This comprehensive overview walks through organizing a React project, from a single file to a modular monorepo structure. The author details how to split code (files, technical folders, feature folders, domains, packages) and the impact of each approach on maintainability, dependency isolation, and scalability. Concrete examples illustrate how to evolve the architecture as the project grows, with clear rules to prevent cross-feature dependencies and encourage reuse.

Robin Wieruch

Visual overview of sqlsimtools with Studio, CLI, Python, and AI agent

sqlsimtools provides an open-source toolkit to test, replay, and compare SQL Server workloads without any hosted service or external telemetry. It offers four modes: a local Studio UI, a native CLI, a Python workflow, and an AI agent-driven experiment builder. The same suite applies to SQL Server 2019–2025, Azure SQL, and Microsoft Fabric, on Windows or Ubuntu, with local installation and direct execution against your chosen target.

Microsoft

Sheet component illustration and highlights from React Aria v1.22.0 release

React Aria v1.22.0 introduces the Sheet component, a swipeable overlay leveraging native browser scroll gestures for smooth, touch-friendly transitions—well suited for mobile trays and notifications. This release also brings Turbopack support for locale optimization, improved handling of interactive widgets like the virtual keyboard, and various fixes for collections, ComboBox, and forms.

Adobe

Screenshot of the vinext 1.1.0 release page on GitHub

vinext 1.1.0, the Vite plugin reimplementing the Next.js API, brings many behaviors in line with Next.js, especially for the App Router (redirect handling, metadata, special errors) and cache management. This release introduces stale-while-revalidate for use cache, serving stale entries while regenerating them in the background, and fixes several cache and server-side rendering inconsistencies. A milestone for those seeking a deploy-anywhere alternative to Next.js.

github-actions

Article illustration: auto-sizing iframes in Chrome with CSS

Chrome 154 introduces the frame-sizing: content-height CSS property, letting iframes automatically match their content’s height without scripts or message passing. This requires the embedded page to opt in with a meta tag and explicitly allow the parent domain, so adoption depends on both sides cooperating. The article details practical use cases (payments, widgets, dynamic forms), compatibility constraints, and best practices to avoid information leaks or layout shifts.

Ahmad Elalfy

Tool

Engram: persistent memory for MCP-compatible AI agents

engram.gentlemanprogramming.comPermalink

Engram provides persistent memory for AI agents, compatible with any agent supporting the MCP protocol (Claude Code, Gemini CLI, Codex, VS Code, etc.). The tool runs as a single Go binary with no external dependencies, storing memories in a SQLite file with built-in FTS5 search. It features a TUI, Git sync, and a self-hostable cloud extension, while remaining local-first and open source under the MIT license.

Gentleman-Programming

Preview of Navbar Gallery, collection of navigation bar designs

Navbar Gallery offers a curated selection of navigation bars from a wide range of websites, including static navbars, dropdowns, mega menus, sidebars, search bars, and announcement banners. Each example is browsable by type and links to the original site, making it easy to compare concrete navigation patterns for interface design. This resource helps designers quickly find relevant navigation solutions without sifting through generic galleries.

Christina Liubynska

Footer Design gallery preview

Footer Design offers a curated gallery of website footers from diverse projects, sortable by style and type. This resource lets you quickly browse concrete examples for inspiration when designing or updating interfaces. It features typographic, illustrated, grid-based and animated approaches, making it a practical UI/UX reference.

Footer Design