Vlad Coroiu

[Firefox for Web Developers @FirefoxWebDevs]

CSS style() queries landed in Firefox 151 making them newly available across engines. Here's how they work:

[Pierre @pierrecomputer]

diffshub[dot]com

Take any public diff from GitHub and virtualize it nearly instantly, no matter how large, with DiffsHub. Built to show off our brand new CodeView component.

To try it out, replace `github` with `diffshub` in your address bar.

[TANSTACK @tan_stack]

New in TanStack Router: more control over dynamic route params.

Use params.parse to accept or skip a candidate, with priority for overlapping dynamic params.

[Una 🇺🇦 @Una]

Gap decorations are now in Chromium 149 (stable rollout in 5 days)!

Shoutout to the folks at @MSEdgeDev for the implementation, post, and demos:

https://t.co/mkjspRpIcc

[Una 🇺🇦 @Una]

OoooOOooh! Guess what! As of Chrome 149, shape() works in shape-outside!

So you can really *shape* your UI's 😉*

rect() and xywh() are also supported for shape-outside in Chrome 149

*(just let me have my Mom joke)

[TANSTACK @tan_stack]

Our official post mortem on the security issue earlier today: https://t.co/m1CuiGy30b

[TANSTACK @tan_stack]

SECURITY ADVISORY — TanStack npm packages
A supply-chain compromise affecting 42 @tanstack/* packages (84 versions total) was published to npm earlier today at approximately 19:20 and 19:26 UTC. Two malicious versions per package.
Status: ACTIVE — packages are deprecated, npm security engaged, publish path being shut down.
Severity: HIGH — payload exfiltrates AWS, GCP, Kubernetes, and Vault credentials, GitHub tokens, .npmrc contents, and SSH keys.
If you installed any @tanstack/* package between 19:20 and 19:30 UTC today, treat the host as potentially compromised:
• Rotate cloud, GitHub, and SSH credentials immediately
• Audit cloud audit logs for the last several hours
• Pin to a prior known-good version and reinstall from a clean lockfile
Detection — the malicious manifest contains:
"optionalDependencies": {
"@tanstack/setup": "github:tanstack/router#79ac49ee..."
}
Any version with this entry is compromised. The payload is delivered via a git-resolved optionalDependency whose prepare script runs router_init.js (~2.3 MB, smuggled into each tarball at the package root).
Unpublish is blocked by npm policy for most affected packages due to existing third-party dependents. All 84 versions are being deprecated with a SECURITY warning, and npm security has been engaged to pull tarballs at the registry level.
Full technical breakdown, complete package and version list, and rolling status updates:
https://t.co/Zy8qG7PA9f
Credit to the security researcher for responsible disclosure.

[Dominik 🔮 @TkDodo]

📢 Happy to announce that @tan_stack Query now has a lit adapter

🙏 The adapter is v0.1 - your feedback will help us getting the APIs to stable

🙌 Shoutout to Gaurav Chugh for contributing it

https://t.co/JKNXsNTAUs

[Ryan Florence @ryanflorence]

In the era of AI it's wild you can ship a beta without a proper guides website

npx remix@next new my-app

> what do remix components look like?

[Firefox for Web Developers @FirefoxWebDevs]

CSS's light-dark() now accepts images, making it simpler to define alternate values for a dark color scheme. Here's how it works:

[Firefox for Web Developers @FirefoxWebDevs]

sizes="auto" landed in Firefox 150, making responsive images simpler and more reliable. Here's when you can use it, and how…

[Sindre Sorhus @sindresorhus]

For the past two months I have been working hard on Ky 2 and now it's finally out.

All bugs fixed. All GitHub issues resolved. Cleaner API, stricter behavior, fewer footguns.

New `baseUrl` option fixes URL handling, `searchParams` option now merges, retries are now more precise by distinguishing failure types, built-in JSON schema validation.

Ky is a tiny JS HTTP client built on top of the built-in Fetch.

https://t.co/vT0spSRYhe

[Una 🇺🇦 @Una]

Web platform news 🗞️

Landing in Chrome 148: sticky positioning now works on a per-axis basis

This means you can have sticky elements that track different scroll containers on different axes.

(📽️ from @bramus's article, 🔗⬇️)

[Firefox for Web Developers @FirefoxWebDevs]

hasUAVisualTransition landed in Firefox 149, making it available across all major engines. As well as having a very catchy name, it lets you avoid doubling up on page transitions. Here's how it works:

[Aiden Bai @aidenybai]

Introducing element-source

Get the source file location of any DOM (or native!) element

Works w/ React, Vue, Svelte, and Solid

[Una 🇺🇦 @Una]

While contrast-color() only returns black or white, there are workarounds!

If you register a new custom property, you can use style queries for full color palette customization (but make sure to test the contrast yourself!)

Another technique is using the contrast-color() value inside of color-mix() to provide a tint variant.

This demo shows method 1 where you can get warmer light colors and blue-tinted darks instead of pure black and white.

Cons: Firefox doesn't support style queries yet so browser support is limited for now (though it is an Interop 2026 feature!).

[Rob Palmer @robpalmer2]

ECMAScript excitement 😉

Congrats to Ben Allen @igalia on advancing Intl era & monthCode to Stage 4 at @TC39 today 🎉

It extends Temporal by defining handling of era, eraCode & monthCode for non-ISO-8601 calendars.

https://t.co/GbQlo4YxXI

[Rob Palmer @robpalmer2]

ECMAScript EXTRA-SPECIAL excitement 😉

🚨🚨🚨 IT'S ABOUT TIME! 🚨🚨🚨

Congrats to @therealptomato on advancing Temporal to Stage 4 at @TC39 today 🎉

Temporal is the replacement for the JavaScript Date API 👍

[Boshen @boshen_c]

Oxlint and Oxfmt are gaining critical mass. 2.4M and 1.6M weekly downloads.

Oxlint and Oxfmt are the latest and fastest JavaScript linter and formatter.

Try them out if you haven't: https://t.co/XeiQeltJWx

[MDN Web Docs @MozDevNet]

Meet the CSS Custom Highlight API ✨

Style arbitrary text ranges without modifying the DOM.
📝 Great for search results
💻 Syntax highlighting
📚 Text annotations

Learn how it works 👇
https://t.co/edQtMd3ydS