Hello August ☔☔☔

Another month has brought the release of models that apparently write better code than you! While being a human in the loop isn't always great (ask Laura Summers), I'm also excited about everything this has enabled people to create. Setting aside Bun's rewrite and the accompanying blog post, I'm especially amazed by Burrow, a project that brings Bun, Git, the shell, and a coding agent together in the browser tab.

Releases

Browsers

Chrome 151

• ruby-overhang property
• Declarative shadow DOM manual slot assignment
• read-only animation attribute to the AnimationEvent and TransitionEvent interfaces -declarative <usermedia> capability element

Firefox 153

• HTML parsing rules for <select> has been updated. Enables future support for customizable select eleements
• muted attribute has been updated for the audio and video elements to reflect when it is added to or removed from DOM.
• ::webkit-scrollbar pseudo-element is now recognised
• TC39 Intl.Locale info proposal
• import source syntax is supported

IDE

• Jetbrains Air adds support for other harnesses using ACP
• CodePen 2.0 - Beloved in browser demo tool now has compiler for processing libraries and even deployment.
• Codex open sources their security toolkit - codex security
• Google cloud launches agent sandboxes
• Deep Agents has introduced Dynamic subagents with a QuickJS sandbox
• MCP protocol update bring support for serverless state and MCP apps. It also brings support for MCP extensions.
• Claude desktop app comes with an in built browser
• The Session you cannot take with you - Pi - Providers claim to prevent distillation, but they make it harder to switch providers during a session.

Better Auth gets acquired

Vercel gets a new library.

TypeScript 7

The Go rewrite has been ridiculously stable through the release cycle. I would recommend you to try it out if you are already on v5 or v6. You might still need to keep v6 around for ESLint plugins and the like.

Oxlint

Type aware linting is now stable, implements 59 out of 61 TypeScript ESLint rules.

Octane JS

Successor to Infero, same programming model as React but with a more powerful compiler. Also integrates with TSRX, which we had talked about in releases last month.

Astro 7.1

• run multiple dev servers side by side with a new --ignore-lock flag
• fine grained CSP control for inline scripts and styles
• lower memory usage for large content collections

Shadcn adds support for new frameworks

• support for base-ui and react-aria
• support for huge icons

Flue 2

TypeScript Agent project gets React hook style interface.

npm 12

• install time security defaults are now on
• 2FA bypass tokens will no longer publish directly

nanoid 6

4x faster

Wordgard

New in browser text editor library from author of ProseMirror. Release blog post

Frontend Framework Benchmarks

The same app, build over different frameworks, then benchmarked. There's also Stack match where you can specify some parameters and choose which framework wins.

Nuxt 4.5

• Vite 8 support, Rspack 2 support
• Experimental SSR streaming
• useLayout composable
• named views
• forwarded preload hints on prefetch

tldraw offline

Let your agents draw up tldraw files offline

scriptc - Vercel labs

TypeScript to native compiler, compiles 90% of TypeScript language natively and include QuickJS for the rest.

OpenCV 5

(I know this isn't JS/TS, but such an important update to the machine learning ecosystem)

• model support coverage has gone to 80%
• three different engines, with backward compatiblity support
• LLMs and VLM support inside OpenCV

In the Spotlight 🔦

The Great RSC Dilemma: Drop Them or Master Them?

React Server Components were pitched as the ultimate performance silver bullet, but real-world usage is proving much more complicated. On one end of the spectrum, the TanStack team shared why they stopped using RSCs on TanStack.com—finding that after optimizing dependencies with TanStack Highlight, RSCs yielded no measurable performance gains while making the codebase harder to reason about (though their sites did get a slick new look).

Aurora Sharff's deep dive on experimenting with RSCs for performance and UX in Next.js explores how to navigate React 19's often enigmatic APIs when you do need those elusive performance wins.

Security

• Anatomy of a Frontier Lab Agent Intrusion: A Technical Timeline of the July 2026 Incident - OpenAI's model testing went berserk and tried to hack Huggingface.
• Next.js security release July 2026
• Remove code execution issue on GitHub: CVE-2026-3854
• CVE-2026-48931 Shouldn't Have Been a CVE - Matteo Collina
• React denial of service in server functions

Tutorials

Bun in Rust

The most awaited blog post of the year is finally here. Jarred Sumner details the tale of how Fable and dynamic workflows helped rewrite Bun in Rust and how the tests are friends they made along the way.

The Goldilocks customizable select height - Jake Archibald

When Jake Archibald creates a custom select with CSS, he uses so many CSS properties that I didn't even know existed.

position-area: self-block-end span-self-inline-end;
position-try-order: most-block-size;
position-try-fallbacks:
   self-block-start span-self-inline-end,
   self-block-end span-self-inline-start,
   self-block-start span-self-inline-start;

A Field Guide to Fable: Finding Your Unknowns

Anthropic has released two models last month, and both come with caveats to know for better usage.

• With Fable, the blog post explains how the model itself can handle long-horizon tasks. However, this means you need to identify what is unknown in your prompt at the beginning.
• With Opus 5 release, the Anthropic team found that AGENTS.md files with it's instructions did not do anything to improve the model output, 80% of Claude Code system prompt was removed. They argue that the same should happen to your CLAUDE.md files.

To be read alongside:

• How Mozilla Uses Claude Mythos to find Firefox bugs before hackers do - How I AI - YouTube
• Do Context Files Help Coding Agents? A Two-Agent Ablation Study on Real Repositories - The answer is No, it doesn't help improve correctness.

Hidden Cost of Hydration Mismatches - Ivan Akulov

This blog post examines how a hydration error on your app, that can cause the React to re-do the work on DOM can cause your LCP numbers to tank.

The Absolute State of Management

Alex Russell argues that most state management libraries actually manage how state is propagated. True state management involves handling conflicting state and controlling when updates are issued. The examples he points to are local-sync libraries.

Fun reads alongside on React state:

• Do we need state management libraries anymore? - Author explores a similar point and describes each popular state management library and it's working - how they end up at useSyncExternalStore
• React Hook Form Avoids State. TanStack Form Scopes It. - RHF library became very popular because it did not have a state store backing up it's inputs, the same architecture that might have gotten it into trouble with the React compiler. Author explores how Tanstack Form takes a different approach.

In short

• What's new in ECMA script 2026
• GitHub Sponsors has reached $100 million transferred to open source
• Anime.js turns 10 years old
• After the hit that was Pretext, Cheng Lou introduces new library Freerange - a zero-API tool that automatically deduces your code’s numerical ranges
• Paper shaders are free and open source
• Why AI Tokens are so Expensive - Computerphile - YouTube
• Tanner Linsley on building TanStack to grow on without him him - Buildlog
• Engineering High-Performance Parsers with Data-Oriented Design - From Author of Yuku parser.
• Tobias Koppers on chunking in modern bundlers.
• Design engineering skills for agents: ui-skills
• The case for polyfills - Lea Verou
• A benchmark specifically for React related tasks - React bench
• State of zero runtime CSS in JS libraries from author of Linaria and dx-styles
• Soak test frontend with Playwright

In Other News

Google is building an AI fence around the Internet it once championed

Google has always stood for an open web and grown by making more products and information available online. However, with the shift toward AI agents, Sundar Pichai’s claim that Google is sending more helpful clicks to websites does not align with reality. Google is sending far less traffic to the open web and increasingly absorbing other products into its ecosystem. Now, named Google Zero by The Verge, there's an irony between what Google the company is and the company it wants to become.

Why millions of Android phones knew Venezuela was about to shake - YouTube

When the earthquake occurred in Venezuela earlier this month, Android phones alerted people about the approaching quake. The phones use accelerometers to detect fast-moving primary waves (P-waves) and warn users before the destructive secondary waves (S-waves) arrive.

Things To Notice On Your Next Flight - StarTalk - YouTube

In this StarTalk Explainer, astrophysicist Neil deGrasse Tyson and comedian Chuck Nice peel back the layers of aviation, revealing the fascinating physics and engineering that make modern flight possible.

The mean preference is a bad estimate of preferences

Image generation models are designed to produce aesthetically pleasing images that appeal to as many people as possible. However, people have different artistic preferences. They may agree that qualities such as effort are valuable, but their specific tastes can differ significantly. The author explores, using mathematical analysis, how these differences translate into the reward functions of these models.

AI updates

• Fable 5 model is back and still on subscription. Anthropic also released a smaller Opus model - Opus 5 which does almost just as well as Fable on coding benchmarks.
• OpenAI released three different model families - Luna, Terra and Sol - in increasing order of power. Luna and Terra also had a late month rate cut that made them affordable.
• An open source Chinese model caught up to Fable to Sol as Kimi K3 released.
• Muse Spark 1.1 - Meta's model sits with the frontier models
• Grok 4.5 - SpaceX's first model after Cursor acquisition is really good.
• Deepseek had a moment when they released updated Deepseek v4 Flash (0731) with a huge jump in benchmark scores.
• Video models - Seedance 5 Pro from Bytedance, Flux 3, Minimax H3
• Laguna S2.1 from Pooside is a small model that excels in coding tasks.

Looking Ahead

• HTML Day - August 6