My favorite from this week is "On Rendering the Sky, Sunsets, and Planets" because I really like when the programming, science and art merge together in such beatutiful way.
News
TanStack's postmortem on the May npm compromise that published 84 malicious versions across 42 packages. The interesting part is the attack chain—`pull_request_target`, GitHub Actions cache poisoning, and OIDC token extraction from runner memory. Useful, scary checklist material.
Jarred Sumner says Bun's experimental Zig-to-Rust rewrite passes 99.8% of the existing test suite on Linux x64 glibc. Amazing proof of what a large test suite plus agents can do; also a reminder that "passes tests" and "production-safe runtime rewrite" are not the same sentence.
Article
Harry Roberts explains `No-Vary-Search`, the response header that lets browsers reuse cached responses across irrelevant query params. Great fit for `utm_*`, `fbclid`, and other tracking baggage; very dangerous if you ignore params that actually change HTML.
Practical reminder that correct recursive JavaScript can still crash once the call stack runs out. Covers tail recursion, why TCO is not portable across modern JS engines, and when to switch to loops, explicit stacks, or trampolines.
Evil Martians migrated an Astro marketing site from React components to Custom Elements and saved 100 KB of JavaScript without losing functionality. `nanotags` wraps the painful Web Components parts with typed props, refs, cleanup, events, and nanostores.
Tanner Linsley experiments with a scoped React projection for TanStack Start instead of a general React fork. The numbers are wild—about 80-85% smaller runtime, 2.24x faster router navigation, 700 tests passing, and one honest RSC-heavy LCP regression.
Maxime Heckel goes deep on atmospheric scattering shaders in the browser. Raymarching, Rayleigh and Mie scattering, ozone absorption, planet shells, LUTs, and interactive demos—the kind of article where the math is hard but the visuals pull you through.
Library&tools
Open-source React component for WYSIWYG Markdown and MDX editing. Supports content CSS styling, editable CodeMirror code blocks, tables, images, frontmatter, directives, Markdown shortcuts, source/diff view, and configurable Markdown output.
tsz plans an opt-in Sound Mode for stricter user-authored TypeScript. It closes method-parameter bivariance holes, bans explicit `any`, and turns `useUnknownInCatchVariables`, `noUncheckedIndexedAccess`, and `exactOptionalPropertyTypes` into defaults. Not full soundness, but a sane direction.
OpenAPI-to-TypeScript client generator that covers models, request functions, and mocks from Swagger v2 or OpenAPI v3 specs. Nice ecosystem support—Fetch, Axios, React Query, Vue Query, Svelte Query, Solid Query, Angular, SWR, Zod, MSW, and even an MCP server.
Mature HTML-to-plain-text converter for Node.js. Handles block and inline tags, tables with spans, links with hrefs, Unicode, wrapping, selector-based formatting, batch compilation for performance, and a separate CLI package. Useful for emails, feeds, and AI-friendly text extraction.
CLI that picks local LLMs based on your actual hardware instead of just "largest model that fits". Detects GPU, CPU, RAM, ranks Hugging Face models by benchmark quality, recency, VRAM fit, estimated speed, and evidence confidence; can also run or print snippets.
JetBrains MCP plugin that gives agents IDE-native actions—typed refactors, inspections, debugger, test runs, screenshots, and plugin APIs. The pitch is fewer cleanup loops than file-only edits. As someone living inside agent tooling, this is exactly the interesting layer.