Frontend & JS Digest — Week 11

CVE-2026-2441 is a use-after-free bug in Chrome's Blink engine triggered by `@font-feature-values`—JavaScript exploits the resulting memory flaw to execute arbitrary code in the sandbox. The "CSS exploit" headline is sensationalized; CSS parsing creates the vulnerable condition, but the actual attack is pure JS. Update your Chromium-based browser now.

Hands-on walkthrough of Conflict-free Replicated Data Types—builds Last Write Wins Registers and Maps from scratch, explaining how commutative, associative, and idempotent merge operations guarantee eventual consistency across peers with no central server. Great foundation before reaching for a sync library.

Interactive visual breakdown of Andrej Karpathy's 200-line GPT—covers tokenization, softmax, backpropagation, attention, embeddings, and the Adam optimizer training loop on 32,000 names. Probably the most accessible entry point into transformer internals without a formal ML background.

Scanned 500 public React, Vue, and Angular repos and found 86% had at least one missing-cleanup pattern across 55,864 instances; each unhandled cleanup retains ~8 KB per mount/unmount cycle. Top offenders: timer cleanup (43.9%), event listener removal (19%), and subscription cleanup (13.9%). The numbers are a bit alarming.

Pure CSS rolling number animation using attr(), sibling-index(), and mod() to isolate individual digits and animate them vertically—no JavaScript required. Surprisingly elegant use of newer CSS functions; the technique extends naturally to custom easing and jitter effects.

Reactive data store and sync engine for local-first apps at 6.2–13.2 kB gzipped with zero dependencies; supports both key-value and tabular data, built-in CRDT sync for cross-device replication, optional React bindings, and 100% test coverage. Solid foundation for offline-capable apps without a heavy database client.

Open, storage-agnostic sync engine development kit for local-first applications; supports PGlite, SQLite, TinyBase, and browser storage as backends with WebSockets and Broadcast Channel as transports. Compose a sync pipeline from your own connectors without vendor lock-in—good companion to TinyBase if you need more flexibility.

React component library for building cron expressions with a visual UI; supports both Unix 5-field and Quartz 6–7-field formats with automatic conversion between them, TypeScript, full i18n with custom translation functions, and WCAG accessibility compliance.

Locutus ports standard library functions from 18 languages—Swift, PHP, Go, Python, and more—into individually importable TypeScript/JavaScript; 671 functions total, tree-shakeable. Handy when you want hasPrefix() or replacingOccurrences() in JS without writing them yourself.

Replace "github.com" with "0github.com" in any PR or diff URL to get a heatmap visualization of code changes—color-coded intensity helps surface hot spots in large reviews at a glance. Simple idea, immediately useful for navigating big diffs.

Hand-transcribed recreation of the terminal font from the 1983 WarGames film—95 ASCII characters in Normal, Double, and Raster variants, available as TTF, OTF, WOFF2, and FON. Licensed CC BY-NC-SA 4.0. For when "terminal aesthetic" has to go all the way.