Welcome back,

This last week has been flying for me, and I’ll admit I’m writing this intro in a bit of a rush (again, sorry). I’ve been knee-deep in renewing my AWS Solutions Architect Professional certification (a bit of a PITA, if I’m honest... but absolutely worth it), while also trying to wrap up a new release of Crafting Lambda Functions in Rust, the book I’m writing with James Eastham. The upcoming version includes a big new chapter on event-driven architectures, with a deep dive into how to use SQS, EventBridge, and Kinesis when building Lambda functions in Rust. If that’s your kind of thing, check out the official website and grab a copy: the new release should come out this week! Note that, even though the book is still a work in progress, it’s already available in early access: you can grab it now at a generously discounted price, and you’ll have access to all the future updates (including the final version) as they’re released.

Oh, and we also got started with Advent of Code, something I always look forward to every December... although so far I only managed to do the first 2 (in Rust, of course). If you’re curious, check out my repo, but I’m definitely more curious to know if you are tackling the challenge: please reply to this email and share your repo 😉

Now, onto the fullstack goodness of the week, because there’s a lot of stuff to love here, and I hope you’ll enjoy every single bit of it!

Quality is a habit. Practice!
— Luciano

"The best performance improvement is the transition from the nonworking state to the working state"
—J. Osterhout, Computer Scientist

The Bun is in the (Anthropic) Oven — When I first read the news, I genuinely thought this was an April Fools’ joke... but no... it’s almost Christmas, and the news is real: Anthropic has acquired Bun... Well, in practice, I think this means they acquired Oven, the company behind the Bun JavaScript runtime. I think this is the first time a JavaScript runtime company has been acquired, at least in recent memory. Anthropic’s angle is pretty clear: Bun is now strategic infrastructure for Claude Code (and the Agent SDK), right as Claude Code reportedly hit a $1B run-rate milestone. But what I’m linking here is not Anthropic’s perspective: it’s Jarred Sumner’s post (CEO of Oven). A great read if you want to learn a bit about the story of Bun and his vision for the future of this runtime. The official line is reassuring: Bun stays open-source and MIT-licensed, built in public, with the same team, still chasing Node compatibility and performance. My slightly-cynical take: if you rely on Bun as your main runtime, it’s normal to feel a little nervous that Claude Code’s needs will quietly become the roadmap’s center of gravity. That might still be a net win (I like Claude Code too), but it’s a shift worth watching. When one use case gets prioritized, I worry the larger interests of the whole community might take a back seat... Read Article

Vite 8 Beta: The Rolldown-powered Vite — I realize we’ve been covering Vite quite a few times in this newsletter, and that’s probably because I have a soft spot for it. After many years using all kinds of bundlers, and every time feeling like I needed a PhD just to learn how to configure them, Vite has always been a comfortable and reassuring tool to use that just works. So it’s great to see the Vite 8 beta land, because it feels like another major step toward the VoidZero vision: a single, fast, unified toolchain for web developers. Under the hood, Vite is now powered by Rolldown, a Rust-based bundler with Rollup-compatible APIs: think “Rollup, but with a Rust engine underneath”. The details of the new features matter, of course, but the real headline here is the direction: Vite is steadily consolidating the stack and leaning more and more into Rust for the heavy lifting, with the goal of making builds faster and behavior more consistent across the board. Read Article

Critical RCE Vulnerabilities Discovered in React & Next.js — A critical, unauthenticated remote code execution bug was found in React Server Components. Here’s the like-I’m-5 version: your server has a special “React request” endpoint that unpacks a message from the browser and turns it into work. The problem is that the unpacking logic can be fooled by a maliciously crafted request, so instead of just unpacking data it can end up running the attacker’s code on your server. The scary bit: the attack is low complexity, needs no login, and no user interaction. And there’s an extra nasty nuance: even if you don’t think you’re using React Server Functions, you may still be vulnerable simply by supporting RSC. Reports also suggest it can be highly reliable and exploitable in default setups (yes: even a production create-next-app can be in scope without special changes). Now the urgent bit: if you run Next.js App Router on Next 15.x or 16.x, assume you are affected and patch immediately. Next.js provides a handy npx fix-react2shell-next that automates the fix. If you’re not on RSC (Pages Router / older lines / pure client-side React), you may be fine, but this is serious enough to do a quick “are we in scope?” check today: it’s already marked as known exploited, with reports of active exploitation. Read Article

The State of TanStack, Two Years of Full-Time OSS — Every time I see an announcement from the TanStack team, I can’t help but get excited (and if you’ve been reading this newsletter for a while, you’ll probably remember the many TanStack mentions). It’s because what they’ve shipped over the last few years has been consistently useful, high-quality, and refreshingly focused on giving developers solid primitives to build on. This time it’s not a new release: it’s Tanner Linsley reflecting on two years of doing TanStack full-time, what it took to make that sustainable, and what the ecosystem has grown into: 13 active projects, 36 core contributors, and billions of downloads... And the “what’s next” section is the real teaser: TanStack Start 1.0 improvements (including RSC support done “the TanStack way”), more Router work lined up, and even hints at a big new library in the pipeline. If you, like me, believe TanStack is on track to reshape how we build web apps over the next few years, this is the perfect “inside the kitchen” post to read: it helps you understand where they’ve been, and what they’re optimizing for next. Read Article

use-nemo: Custom React directives — Just a few weeks ago we were side-eyeing React’s growing love for custom directives like "use client" and "use server"... and hey, even if this isn’t the best long-term strategy, it is pretty cool to understand how this stuff actually works under the hood. That’s exactly what use-nemo is for: it’s a Vite plugin that lets you define your own React-like "use " directives, then runs custom build-time transformations when it finds them (injecting code/imports/comments, removing the directive string, etc.). If you’ve ever been curious about how “magic” directives are built, this repo is a fun, practical rabbit hole. Check Repo

TanStack AI — Didn’t I just say I love what the TanStack team builds and that I’ve been eagerly featuring them here? I did, yes I did... and there’s a new library worth mentioning, so here we are! This one might feel a bit beyond the usual webdev scope, since it talks about everyone’s favourite topic these days: AI. But I actually find it very promising for a few reasons! It’s still very much focused on web dev, because it tries to bridge the gap in how people build AI-powered web applications (think streaming an LLM response to the UI), and it does so with a unified, provider-agnostic approach. But it’s also built in a pretty modular way. Just a few days ago I found myself chatting with a friend about how bloated many AI libraries have become. If you want to use one of those, you suddenly have to deal with a ton of dependencies, which can make them suboptimal for many environments (Lambda is one clear case). TanStack AI seems like a contender that tackles this by providing independent but highly composable packages, so you can install only what you really need. It’s still early days, but I’m excited to see where this is going to go! Read Article

TypingSVG — Let’s close the featured articles in this issue with a cozy, neat little tool that you might enjoy: TypingSVG. It’s a tiny web app that generates those “typing text” animated SVGs you can drop into a README/profile/website, with a live preview and copy-pasteable URL/Markdown/HTML (or you can just download the SVG). The fun part is how configurable it is: Google Fonts, emojis, per-line styling, cursor styles, typing + delete speeds, background, centering, repeat... Read Article

📕 Book of the week!

Real-World Svelte: Supercharge your apps with Svelte 4 by mastering advanced web development concepts, by Tan Li Hau

Harness the power of Svelte, the cutting-edge JavaScript framework used for building high-performance web applications, with this definitive guide Svelte has quickly become a popular choice among developers seeking to build fast, responsive, and efficient web applications that are high-performing, scalable, and visually stunning. This book goes beyond the basics to help you thoroughly explore the core concepts that make Svelte stand out among other frameworks. You'll begin by gaining a clear understanding of lifecycle functions, reusable hooks, and various styling options such as Tailwind CSS and CSS variables. Next, you'll find out how to effectively manage the state, props, and bindings and explore component patterns for better organization. You'll also discover how to create patterns using actions, demonstrate custom events, integrate vanilla JS UI libraries, and progressively enhance UI elements. As you advance, you'll delve into state management with context and stores, implement custom stores, handle complex data, and manage states effectively, along with creating renderless components for specialized functionalities and learning animations with tweened and spring stores. The concluding chapters will help you focus on enhancing UI elements with transitions while covering accessibility considerations.

Buy on Amazon.com - Buy on Amazon.co.uk

Supplementary reads worth your time! ⏰

• Webhooks on AWS Lambda — Tips & Tricks
• React Router's take on React Server Components
• Can you make toast messages accessible?
• Designing For Stress And Emergency
• ty
• Designing Design Systems
• One CSS Trick to Eliminate Scrollbar Layout Shifts
• Comparing AWS Lambda Arm64 vs x86_64 Performance Across Multiple Runtimes in Late 2025
• Node.js 24 runtime now available in AWS Lambda
• Wrangling my email with Claude Code
• Better Auth
• Grid Paper
• How Hackers Use NPMSCan.com to Hack Web Apps (Next.js, Nuxt.js, React, Bun)

Show's over, folks! 🎭

Credits are rolling! If this issue sparked joy or ideas, don't be shy – reply and tell us all about it! ✨