<h2>Must know</h2>
<ul>
<li><strong>Axios npm package hijacked in sophisticated supply chain attack</strong>: The ubiquitous Axios HTTP client, with over 300 million weekly downloads, was compromised on March 31, 2026, after an attacker hijacked a lead maintainer’s npm credentials. Malicious versions 1.14.1 and 0.30.4 injected a hidden dependency that deployed a cross-platform Remote Access Trojan (RAT) designed to exfiltrate AWS keys and API tokens. Socket and Vercel reported that the malware self-deletes to evade forensics, so developers who installed these versions must assume full system compromise and rotate all secrets immediately. <a href="https://app.daily.dev/feed-by-ids?id=RlEVDfzaA&amp;id=6mR1VFvvx&amp;id=fK3XmAk18" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Module Federation 2.0 solves micro frontend bloat at Swiggy</strong>: Swiggy’s engineering team successfully migrated their B2B dashboards from a fragmented S3-per-app architecture to a unified Module Federation 2.0 setup. This move eliminated roughly 638 KB of duplicate JavaScript per remote app and resolved persistent ‘singleton traps’ where libraries like styled-components were being loaded multiple times. According to Swiggy Bytes, the team also implemented a clever popup-based postMessage strategy to migrate authenticated users across domains without triggering browser storage partitioning blocks. <a href="https://app.daily.dev/posts/0IigpOvLI" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Inertia.js v3.0 drops Axios for native XHR and optimistic UI</strong>: The official release of Inertia.js v3.0 marks a major architectural shift, replacing Axios with a built-in XHR client to shave 15KB off bundle sizes. A new <code>useHttp</code> hook provides reactive state for non-navigation requests, while first-class optimistic update support now includes automatic rollbacks for failed server responses. Laravel News notes that this version is ESM-only and introduces breaking API changes, but significantly improves SSR performance by running within the Vite dev process. <a href="https://app.daily.dev/posts/WWmxp0DEw" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
<h2>Good to know</h2>
<ul>
<li><strong>Pretext library claims 500x faster web text layout</strong>: Built by React pioneer Cheng Lou, this 15KB engine bypasses the DOM for text measurement using pure math and Canvas to eliminate scroll jumping and jank. <a href="https://app.daily.dev/posts/MEe3G5Jez" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Cloudflare Workflows now generates visual diagrams from TypeScript</strong>: Using a Rust-based AST parser via WebAssembly, the dashboard now statically derives and visualizes execution graphs from your code. <a href="https://app.daily.dev/posts/2kRwcIErj" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>TanStack Start adds experimental import protection</strong>: The framework now uses a Vite plugin to enforce strict boundaries between server and client code, halting builds if server-only packages leak into the bundle. <a href="https://app.daily.dev/posts/1vUKo1yob" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Cypress natural language testing enters beta</strong>: The <code>cy.prompt</code> feature allows writing E2E test steps in plain English, featuring improved element targeting and automatic exclusion of sensitive DOM data. <a href="https://app.daily.dev/posts/tcv9Jrqtr" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>React2AWS lets you define infrastructure with JSX</strong>: This open-source tool uses a Tailwind-inspired className pattern to declare VPCs, Lambdas, and S3 buckets as nested React components that compile to Terraform. <a href="https://app.daily.dev/posts/YqbhLHTeP" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Video.js v10 beta merges major players into one framework</strong>: A ground-up rewrite merging Plyr and Vidstack into a composable, tree-shakable core that reduces default bundle sizes by up to 88%. <a href="https://app.daily.dev/posts/esarQysuG" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Node.js 22.22.2 LTS addresses high severity security flaws</strong>: The latest security release fixes prototype pollution in HTTP headers and wraps SNICallback in try/catch to prevent TLS-related crashes. <a href="https://app.daily.dev/posts/Wjr34d3yd" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
<h2>Bullshit police</h2>
<ul>
<li><strong>The AI ROI crisis is finally arriving</strong>: While VCs scream about ‘agentic flywheels,’ a Multitudes study reveals that AI tools are mostly just driving a 20% surge in out-of-hours commits and developer burnout. Only 31% of UK firms report any actual positive ROI, as the ‘productivity’ gains are being swallowed by a 91% jump in PR review time for ‘almost-right’ AI slop. <a href="https://app.daily.dev/feed-by-ids?id=dl9dAiLtW&amp;id=hJM0KLyxN&amp;id=eHJQJ585q" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Microsoft branding is a Copilot fever dream</strong>: Microsoft has reached peak naming absurdity with a lineup including GitHub Copilot, Microsoft 365 Copilot, Copilot+ PC, and even Copilot Checkout. Critics correctly point out this chaotic proliferation is designed to juice shareholder value rather than help users distinguish between a chat interface and a hardware spec. <a href="https://app.daily.dev/posts/4ps31zSby" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Vibe coding is dismantling endpoint security</strong>: The industry’s rush to ‘vibe code’ has created a massive blind spot where AI agents require broad filesystem access that bypasses traditional EDR. Check Point researchers found that attackers are now ditching malware to simply embed malicious instructions in .env and .toml files, which your helpful AI agent will gladly execute with high privileges. <a href="https://app.daily.dev/feed-by-ids?id=oIVFAwpCR&amp;id=6mpb4ZX7P" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
