Front-End Fire

TJ VanToll, Paige Niedringhaus, Jack Herrington

A weekly show that helps you stay up to date on the latest and greatest in the front-end world.

  1. VOR 3 TAGEN

    React Goes Independent: Inside the New React Foundation

    It’s been a big week for React devs as the annual React Conf just wrapped up in Las Vegas.  The biggest news? React and React Native are moving out from under Meta to a new React Foundation with an independent technical governance structure. The React Foundation’s mission will be to support the React community and ecosystem, and a board of directors will steer it going forward. Also in time for React Conf, React 19.2 dropped, and it brings new features like partial pre-rendering, a new useEffectEvent hook, and an component that lets devs prioritize rendering  tomaintain state and make navigation faster. Not to be outdone, Cloudflare announced a new RPC protocol called Cap’n Web, which is a pure TypeScript implementation. What makes Cap’n Web unique is that it supports bi-directional calling, promise pipelining, and lets users design RPC interfaces that look like regular JavaScript APIs. Chapter Markers: 03:18 - React Foundation07:10 - React Compiler 1.0 and React 19.217:13 - Cap’n Web24:19 - Opera Neon27:16 - The EU is considering cookie law changes31:43 - The Internet Archive hits 1 trillion pages33:33 - What’s making us happyLinks: Paige - Cap’n Web pure TypeScript RPC systemJack - Introducing the React FoundationTJ - React 19.2European policymakers may be fixing the cookie banner headache they createdOpera wants you to pay $20 per month for its new AI browserCelebrating 1 Trillion Web Pages Archived What Makes Us Happy this Week: Paige - The Terminal List: Dark Wolf TV seriesJack - Fender Acoustasonic guitarTJ - Portable stadium seat additionThanks as always to our sponsor, the Blue Collar Coder channel on YouTube. You can join us in our Discord channel, explore our website and reach us via email, or talk to us on X, Bluesky, or YouTube. Front-end Fire websiteBlue Collar Coder on YouTubeBlue Collar Coder on DiscordReach out via emailTweet at us on X @front_end_fireFollow us on Bluesky @front-end-fire.comSubscribe to our YouTube channel @Front-EndFirePodcast

    41 Min.
  2. 22. SEPT.

    npm Under Siege: The “Shai-Hulud” Worm Attack

    The supply chain attacks on npm continue and this week, Crowdstrike’s npm packages fell victim to the “Shai-Hulud” worm.  To mitigate the potential of downloading these malicious packages, consider pinning specific package versions in JS projects and using 2FA to publish new package versions to npm. Also this week, WebAssembly Specification (Wasm) released v3.0. This version dramatically expands the memory Wasm apps can use, supports multiple memory usage, and now allows garbage collection. It’s been a while since we last covered LLM options for folks who want to run their own models locally or in the browser, so Jack gives a quick rundown of some of the best options out today.  There’s WebLLM from MLC, MediaPipe from Google, and ONNX from Microsoft, and although none are easily interchangeable with another, if cost, privacy, or working offline are concerns of your LLM-enabled app, these may be good options to explore. Chapter Markers: 00:58 - npm supply chain attack16:28 - Wasm 3.023:34 - LLM options in the browser34:41 - Jack’s experience at CascadiaJS and a discussion on the value of in-person conferences in 202541:54 - GitHub’s new MCP registry43:26 - Microsoft Paint is getting project files46:54 - What’s making us happyLinks: Paige - “Shai-Hulud” supply chain attack on npm continues against Crowdstrike npm packages and pnpm 10.16 minimumReleaseAge settingJack - LLM options in the browser: WebLLM, MediaPipe, ONNXTJ - Wasm 3.0GitHub’s new MCP registryMicrosoft Paint is getting its own Photoshop-like project filesPaige - Great British Bake Off season 16 is back!Jack - YoyosTJ - phishyurl.comThanks as always to our sponsor, the Blue Collar Coder channel on YouTube. You can join us in our Discord channel, explore our website and reach us via email, or talk to us on X, Bluesky, or YouTube. Front-end Fire websiteBlue Collar Coder on YouTubeBlue Collar Coder on DiscordReach out via emailTweet at us on X @front_end_fireFollow us on Bluesky @front-end-fire.comSubscribe to our YouTube channel @Front-EndFirePodcast

    57 Min.
  3. 15. SEPT.

    npm’s Biggest Supply Chain Attack (and What We Learned)

    Just 5 months ago we covered how Storybook 9 was in beta, and already Storybook 10 is in beta. The biggest change is that Storybook is going all in on ESM and dropping CJS support, which is making for some big performance gains and smaller bundle sizes. This past week, npm suffered the largest supply chain attack in its history when a prolific OSS maintainer got phished. Luckily, the attack was noticed and reported within the hour and it looks like the hackers got next to nothing for their efforts, but it serves as another reminder to be extra careful before clicking links in emails. In the same security vein, browser company Brave uncovered a security vulnerability in AI-browser Comet where malicious instructions on a web page could cause the agent to “go rogue” while it was being asked to summarize a page’s contents. Perplexity has since added more guardrails to try and mitigate this sort of thing, but be cognizant of the data and site access you’re giving to AI agents. Timestamps: 1:12 - Storybook 107:53 - npm’s supply chain attack17:24 - Brave discloses a security vulnerability in Comet26:38 - You’re absolutely right!35:26 - What’s making us happyLinks: Paige - Storybook 10 beta and Storybook 9 featuresJack - npm just suffered the largest supply chain attack in its historyTJ - Brave discloses a security vulnerability in CometSomeone made a customizable website to count how many times Claude Code says “You’re absolutely right!” in a dayPaige - Silicon Valley TV showJack - Shokz OpenComm2 bone conduction headphonesTJ - macOS text message forwardingThanks as always to our sponsor, the Blue Collar Coder channel on YouTube. You can join us in our Discord channel, explore our website and reach us via email, or talk to us on X, Bluesky, or YouTube. Front-end Fire websiteBlue Collar Coder on YouTubeBlue Collar Coder on DiscordReach out via emailTweet at us on X @front_end_fireFollow us on Bluesky @front-end-fire.comSubscribe to our YouTube channel @Front-EndFirePodcast

    50 Min.
  4. 8. SEPT.

    Warp Code and the Future of Agent-Driven Dev

    The Google vs. the US anti-trust lawsuit has finally drawn to a close, and (spoiler alert) Google doesn’t have to sell Chrome (or Android, for that matter). Going forward it will have to share certain search data with its rivals, and that’s about it, so this is definitely a big win for Google any way you look at it. The popular terminal company Warp just unveiled Warp Code - a suite of features for shipping agent-generated code “all the way from prompt to production” via the Warp terminal. Warp Code offers an agent-driven terminal-first approach, with visual code review of agent changes, and a native file editor for minor edits in an attempt to eliminate the context switching devs have to do nowadays between their AI agents, IDEs, and GitHub.  In a twist no one saw coming, SaaS behemoth Atlassian has bought AI-browser Dia (and its maker The Browser Company) for $610 million. Atlassian wants to position Dia as the AI-browser for users at work and time will tell if that bet pays off. Timestamps: 02:34 - Google doesn't have to sell Chrome10:17 - Warp Code22:56 - Atlassian buys The Browser Company31:48 - Anthropic raises $13 billion34:54 - OpenAI is building an AI-powered hiring platform39:42 - What’s making us happy Links: Paige - Atlassian buys The Browser Company for $610 millionJack - Warp terminal unveils Warp CodeTJ - Google doesn’t have to sell Chrome after allTJ - Addy Osmani’s blog post on the history of ChromeAnthropic raises $13 billion Series FOpenAI is building an AI-powered hiring platformPaige - BenQ RD280U programming monitorJack - Alien: Earth TV seriesTJ - Severance TV seriesThanks as always to our sponsor, the Blue Collar Coder channel on YouTube. You can join us in our Discord channel, explore our website and reach us via email, or talk to us on X, Bluesky, or YouTube. Front-end Fire websiteBlue Collar Coder on YouTubeBlue Collar Coder on DiscordReach out via emailTweet at us on X @front_end_fireFollow us on Bluesky @front-end-fire.comSubscribe to our YouTube channel @Front-EndFirePodcast

    52 Min.
  5. 1. SEPT.

    Bun v1.2: SQL, YAML & Security Scans

    Last episode, we lamented Claude’s lack of checkpoints to roll back code when it goes off the rails. Other devs feel the same, and this week Checkpoints for Claude Code debuted. It’s an MCP server that follows Claude Code, creating checkpoints when tasks are completed, allowing for easy reverts when needed. The Bun team quietly pushed some nice new features in Bun v1.2. Highlights include: a unified SQL client with zero dependencies, native YAML file support, OS native credential storage for secrets, and a security scanner API that scans packages for vulnerabilities before installation. And MCP-UI, a toolkit of interactive UI components for MCP has new features to support resources beyond text like embedded iframes and even raw HTML. Not all agents with MCP support can handle these new resources, but if they can, users can see product photos, data visualizations, and other mini sites right in their AI chat. In the Lightning News section for this week, the folks at Deno leading the charge to get Oracle to relinquish its trademark for JavaScript need our help. Those legal bills aren’t going to pay themselves and Deno’s pockets aren’t nearly as deep as Oracle’s, so if you care about making JavaScript public domain (which it absolutely should be), please consider donating so they can keep fighting the good fight to free JS. Every little bit helps. Timestamps: 00:48 - Claude Code thinking modes & checkpoints10:33 - Bun v1.217:04 - MCP-UI updates23:06 - Claude for Chrome28:12 - Donate to help Deno fight Oracle30:24 - What’s making us happyLinks: Paige - Bun v1.2Jack - MCP-UI updatesTJ - Claude Code Thinking Modes & Claude Code CheckpointsClaude for ChromeDonate to help Deno keep fighting Oracle in courtPaige - Zima Dental PodJack - Foundation TV seriesTJ - Babe Ruth commits fraudThanks as always to our sponsor, the Blue Collar Coder channel on YouTube. You can join us in our Discord channel, explore our website and reach us via email, or talk to us on X, Bluesky, or YouTube. Front-end Fire websiteBlue Collar Coder on YouTubeBlue Collar Coder on DiscordReach out via emailTweet at us on X @front_end_fireFollow us on Bluesky @front-end-fire.comSubscribe to our YouTube channel @Front-EndFirePodcast

    42 Min.
  6. 25. AUG.

    Alchemy: IaC Without Terraform

    The latest craze for MCP this week? Instead of multiple MCP servers with different tools, use an MCP server that accepts programming code as tool inputs - a single “ubertool” if you will. AI agents like Claude Code are pretty good at writing code, but letting the agent write and execute code to invoke API functions instead of using a defined MCP server doesn’t seem like the most efficient use of LLM tokens, but it's another approach to consider. In infrastructure news, there’s a library called Alchemy that lets devs write their Infrastructure as Code in pure TypeScript. No Terraform files, no dependencies, just async functions, stored in plain JSON files, that runs anywhere JS can run. For web devs, the future of IaC has arrived. Next.js has made their last big release before v16 in the form of 15.5. Highlights of this minor release include: production turbopack builds, stable support for the Node.js runtime in middleware, fully typed routes, and deprecation warnings in preparation for Next.js 16. Timestamps: 00:57 - Dangers of the “ubertool”09:54 - Alchemy Infrastructure as Code (IaC)15:27 - Next.js 15.524:57 - How CodeRabbit AI got hacked27:48 - 32:37 - Claudia41:31 - hidden=until-found45:26 - What’s making us happyLinks: Paige - Alchemy Infrastructure as Code (IaC)Jack - Dangers of the “ubertool”TJ - Next.js 15.5How CodeRabbit AI got hackedClaudiahidden=until-foundPaige - The Art Thief bookJack - Alien: Earth TV seriesTJ - Pips NYT gameThanks as always to our sponsor, the Blue Collar Coder channel on YouTube. You can join us in our Discord channel, explore our website and reach us via email, or talk to us on X, Bluesky, or YouTube. Front-end Fire websiteBlue Collar Coder on YouTubeBlue Collar Coder on DiscordReach out via emailTweet at us on X @front_end_fireFollow us on Bluesky @front-end-fire.comSubscribe to our YouTube channel @Front-EndFirePodcast

    55 Min.

Info

A weekly show that helps you stay up to date on the latest and greatest in the front-end world.

Das gefällt dir vielleicht auch