Replies in <2h
21 articles in “Web Development” — newest first.
CVE-2026-97229 was exploited from inside a CI config file. A technical look at the attack chain, Onigmo's role, and how to harden your own CI against hostile input.
Practical guide to testing your git/curl/python against the compromised eMudhra intermediates, verifying with the researcher's test domains, and manually fixing macOS trust stores.
How the new Goose language achieves memory safety using data stacks instead of a heap, and why its benchmarks claim it beats C++ and Rust
Scroll-driven animations shipped everywhere via Interop 2026, and scroll-triggered animations are an Interop 2027 candidate. Here's what you can delete from your JS today.
A technical breakdown of the GLM-5.3 Workers AI incident — 155 affected responses, the SGLang bug, and lessons for anyone self-hosting inference.
Stripe webhooks are the root of most payment bugs: duplicate events, undefined ordering, silent failure. Two real solutions: the open-source stripe-no-webhooks library, and a scheduled-sync pattern you can build yourself. With Next.js and Postgres code.
A practical Next.js 16 guide to Server Actions: when to prefer them over Route Handlers, the framework's built-in protections (CSRF, bodySizeLimit, allowedOrigins), and fixing the 'Failed to find Server Action' error after every deploy.
Wire a payment gateway into Next.js App Router with Route Handlers: order creation, gateway redirect, webhook verification, and idempotent payment handling.
A practical comparison of offset pagination, cursor pagination, and infinite scroll for App Router, with Server Actions and IntersectionObserver, plus how to choose for a store catalog.
Why even a fully static page ships framework runtime in Next.js, how one blogger hit a perfect 100 with Hono, and what you can apply to your site.
The Brotli flaw behind Node2Shell now affects HTTP clients across languages (HTTP2Shell) — patched versions and an upgrade checklist.
whatsapp-mcp lets your AI agent search and read your WhatsApp messages — no server, running in your own Cloudflare account. Setup, limits, and risks.
A practical guide to rate limiting Next.js route handlers with Upstash Redis sliding windows, an in-memory fallback, and correct 429 responses with Retry-After.
A practical Next.js App Router guide to Server Actions: calling them from forms, validating input, revalidating paths and tags, and avoiding cache mistakes.
Implement schema.org Product markup with JSON-LD in the Next.js App Router, with full code, common template mistakes, and a pre-publish validation checklist.
In Next.js 15 params and searchParams are Promises. Without await the page breaks or goes stale. The correct pattern, common mistakes, and a 30-second fix.
Practical guide to auth with Next.js Middleware — session checks, protected routes, smart redirects and secure token handling without leaking to the client.
Practical guide to Next.js image optimization with next/image, modern formats, correct sizes, and smart caching to fix LCP and Core Web Vitals.
Practical guide to validating Next.js forms with Zod and React Hook Form — one shared schema for client and Server Actions, clean errors and solid UX.
Tailwind v4 drops the JavaScript config for a CSS-first @theme block and ships a Rust-based Oxide engine that builds ~5x faster. Step-by-step v3→v4 migration guide with comparison tables, code, and pitfalls.
firebase-admin dies on workerd because protobufjs generates code at runtime. The fix: plain fetch + WebCrypto for JWT, Firestore REST with real transactions.