# Tech watch [Canonical source]() ## [React Server Components: critical remote code execution flaw]() A critical vulnerability enables unauthenticated remote code execution in some applications using React Server Components. It affects `react-server-dom-webpack`, `react-server-dom-parcel`, and `react-server-dom-turbopack` in the versions listed in the advisory, with a CVSS score of 9.5. The described scenario is rare: it requires responses that transport multiple typed arrays and an attacker-controlled value. React applications without a server are unaffected, as are applications that do not use a framework, bundler, or plugin supporting Server Components. Fixes are available in 19.0.9, 19.1.10, 19.2.9, and 19.3.1; affected deployments should upgrade immediately. 2026-10-23 · [Markdown]() · [Original resource]() ## [Agent skills: preserve flexibility while supplying context]() PostHog shares practical guidance for writing skills that help agents without locking them into a brittle workflow. The core idea is to load context progressively, define the goal and constraints, then let the agent choose steps that fit the repository and runtime environment. The article also addresses maintenance: separate durable structure from fast-changing details, point to a single source of truth, and regenerate skills instead of patching them indefinitely. Skills carry context and upkeep costs, so they make most sense for recurring tasks where agents lack essential context or perform poorly by default. 2026-10-23 · [Markdown]() · [Original resource]() ## [Pour brings WCAG audits from the browser into CI]() Pour brings together a browser extension, a CLI, a VS Code extension and a contrast checker to assess accessibility against WCAG 2.2. Audits identify affected elements and explain fixes; criteria that require human judgment are marked for review. The CLI can fail a CI step when it finds issues, generate an HTML report for a site, and expose tools to an agent through MCP. Automated checks assist with 51 of the 86 WCAG 2.2 criteria without claiming to determine compliance: a checklist accompanies the findings to support manual review. 2026-10-23 · [Markdown]() · [Original resource]() ## [CSS scroll-triggered animations: visualize and adjust ranges]() This Chrome DevTools extension makes CSS animations triggered by scrolling easier to debug: a minimap locates the scroller, element, and subject, while colored markers show activation and active ranges. Values can be edited live; the tool supports `ScrollTimeline`, `ViewTimeline`, and elements using `position: sticky`. Two limitations come from Chrome: relative units such as `90vh` are reduced to computed pixel values, and elements inside an `iframe` are not supported. The extension fills a gap in DevTools while built-in support remains a possible future improvement. 2026-10-22 · [Markdown]() · [Original resource]() ## [Data API builder: REST, GraphQL and MCP for your databases]() Data API builder generates REST and GraphQL endpoints, as well as MCP tools, from Azure databases and on-premises stores. It supports several backends, including Azure SQL, SQL Server, PostgreSQL, MySQL and Cosmos DB, and runs in a container or locally during development. Configuration defines entities and their permissions; DAB then translates requests into SQL. This layer reduces the API code teams need to maintain, while access remains shaped by the configuration and each database’s capabilities. 2026-10-22 · [Markdown]() · [Original resource]() ## [PGX: disposable PostgreSQL databases for agents and tests]() PGX runs isolated PostgreSQL databases inside a single Rust runtime, targeting short-lived agent, CI, and test environments. On-demand creation from a sealed template and copy-on-write on ZFS reduce the cost of branching; without block cloning, the system makes a full copy. The project is at **v0.1.0** and targets disposable databases, not production data: `fsync` is disabled, and one runtime is a single failure domain. Its benchmarks document their measurements and conditions; the PostgreSQL regression suite reports zero result differences in the stated configuration, without claiming general compatibility. 2026-10-22 · [Markdown]() · [Original resource]() ## [CSS icons as design tokens, without extra markup]() Lea Verou proposes treating icons as **CSS design tokens**: custom properties assign them to pseudo-elements, where SVG masks render them without adding markup. Components can then select or override an icon based on state, theme, or context, while keeping definitions centralized in the design system. There are trade-offs: masking mainly suits monochrome icons, URLs and registered properties behave inconsistently across browsers, and Safari needs workarounds. The post explains these constraints and introduces `@nudeui/icons`, a package that brings the system together. 2026-10-22 · [Markdown]() · [Original resource]() ## [WebMCP tools for inspecting, testing, and debugging]() This repository brings together tools for working with the WebMCP API: a Chrome extension inspects the tools exposed by a page, their input schemas, and connection issues, while a CLI evaluates whether LLMs call the right tools against defined test cases. Demos also show declarative and imperative integrations in practical interfaces. The collection helps move from experimentation toward more structured testing, while remaining a project intended to support adoption of the WebMCP API. 2026-10-22 · [Markdown]() · [Original resource]() ## [ts-rust: a Rust port of the TypeScript 7 compiler]() ts-rust ports the TypeScript 7 compiler, checker, and language server to Rust, aiming to match the Go implementation’s diagnostics and behavior. The repository reports extensive conformance and substantial speedups across several projects; in its published measurements, type checking across six open-source apps is 2.10× faster on average than TypeScript 7. The trade-offs show up in the options: `--fast` cuts runtimes further but can increase CPU and memory use, while some diagnostic differences depend on checker count or type cycles. The project is explicitly experimental and documents limitations, including in build mode and during long editor sessions. 2026-10-22 · [Markdown]() · [Original resource]() ## [dotnetup: user-local .NET toolchain manager for frictionless installs]() Microsoft introduces `dotnetup`, a toolchain manager for .NET inspired by rustup and nvm, designed to simplify installing, updating, and managing multiple SDK and runtime versions without admin rights. The tool operates entirely in the user’s home directory, respects `global.json`, lets you track version channels or install daily builds, and streamlines cleanup of obsolete versions. It targets CI/CD use cases and aims for a unified experience across macOS, Linux, and soon Windows. 2026-10-20 · [Markdown]() · [Original resource]() ## [croc: fast, secure, cross-platform file transfer]() croc enables sending files or text between two devices with end-to-end encryption, no network setup, and no user account. The tool works via CLI or a web interface, generates a shareable code, and supports multi-file, folder, and resumable transfers. It stands out for its ease of use, cross-platform support, and a user experience often considered more polished than Magic Wormhole. 2026-10-20 · [Markdown]() · [Original resource]() ## [REA: agent-powered reverse engineering for binaries and applications]() REA offers a unified approach to reverse engineering, driven by agents that can analyze native binaries, JavaScript/Electron apps, websites, or databases without source code access. The tool integrates with agents like Claude Code or Cursor, provides evidence and limitations for each analysis, and leverages native tools (Hopper, Ghidra, IDA) for deep inspection. The documentation details supported scenarios, provider setup, and CLI workflows, with concrete examples of feature-level reverse engineering from real applications. 2026-10-19 · [Markdown]() · [Original resource]() ## [React project structure: from single file to modular monorepo]() This comprehensive overview walks through organizing a React project, from a single file to a modular monorepo structure. The author details how to split code (files, technical folders, feature folders, domains, packages) and the impact of each approach on maintainability, dependency isolation, and scalability. Concrete examples illustrate how to evolve the architecture as the project grows, with clear rules to prevent cross-feature dependencies and encourage reuse. 2026-10-19 · [Markdown]() · [Original resource]() ## [sqlsimtools: simulate and compare SQL Server workloads locally]() sqlsimtools provides an open-source toolkit to **test, replay, and compare SQL Server workloads** without any hosted service or external telemetry. It offers four modes: a local Studio UI, a native CLI, a Python workflow, and an AI agent-driven experiment builder. The same suite applies to SQL Server 2019–2025, Azure SQL, and Microsoft Fabric, on Windows or Ubuntu, with local installation and direct execution against your chosen target. 2026-10-17 · [Markdown]() · [Original resource]() ## [React Aria Sheet: swipeable overlay and mobile-friendly release]() React Aria v1.22.0 introduces the **Sheet** component, a swipeable overlay leveraging native browser scroll gestures for smooth, touch-friendly transitions—well suited for mobile trays and notifications. This release also brings Turbopack support for locale optimization, improved handling of interactive widgets like the virtual keyboard, and various fixes for collections, ComboBox, and forms. 2026-10-16 · [Markdown]() · [Original resource]() ## [vinext 1.1.0: Next.js parity fixes and stale-while-revalidate cache]() vinext 1.1.0, the Vite plugin reimplementing the Next.js API, brings many behaviors in line with Next.js, especially for the App Router (redirect handling, metadata, special errors) and cache management. This release introduces **stale-while-revalidate** for `use cache`, serving stale entries while regenerating them in the background, and fixes several cache and server-side rendering inconsistencies. A milestone for those seeking a deploy-anywhere alternative to Next.js. 2026-10-16 · [Markdown]() · [Original resource]() ## [Chrome: auto-sizing iframes to their content with CSS]() Chrome 154 introduces the `frame-sizing: content-height` CSS property, letting iframes automatically match their content’s height without scripts or message passing. This requires the embedded page to opt in with a meta tag and explicitly allow the parent domain, so adoption depends on both sides cooperating. The article details practical use cases (payments, widgets, dynamic forms), compatibility constraints, and best practices to avoid information leaks or layout shifts. 2026-10-16 · [Markdown]() · [Original resource]() ## [Engram: persistent memory for MCP-compatible AI agents]() Engram provides **persistent memory** for AI agents, compatible with any agent supporting the MCP protocol (Claude Code, Gemini CLI, Codex, VS Code, etc.). The tool runs as a single Go binary with no external dependencies, storing memories in a SQLite file with built-in FTS5 search. It features a TUI, Git sync, and a self-hostable cloud extension, while remaining local-first and open source under the MIT license. 2026-10-16 · [Markdown]() · [Original resource]() ## [Navbar Gallery: curated navigation bar design inspiration]() Navbar Gallery offers a curated selection of navigation bars from a wide range of websites, including static navbars, dropdowns, mega menus, sidebars, search bars, and announcement banners. Each example is browsable by type and links to the original site, making it easy to compare concrete navigation patterns for interface design. This resource helps designers quickly find relevant navigation solutions without sifting through generic galleries. 2026-10-16 · [Markdown]() · [Original resource]() ## [Footer Design gallery: curated website footer inspiration]() Footer Design offers a **curated gallery of website footers** from diverse projects, sortable by style and type. This resource lets you quickly browse concrete examples for inspiration when designing or updating interfaces. It features typographic, illustrated, grid-based and animated approaches, making it a practical UI/UX reference. 2026-10-16 · [Markdown]() · [Original resource]() Page 5 / 22 [Previous]() [Next]()