<p><strong>TLDR:</strong> A <code>docs/PORTING.md</code> file surfaced in the Bun repo suggesting the runtime is at least exploring a migration from Zig to Rust, possibly with AI-assisted tooling. Separately, pnpm 11 landed with meaningful supply chain security defaults that are worth knowing about. There’s also some community anxiety about Bun’s acquisition by Anthropic and what that means for the project’s independence. On the CSS front, a couple of solid practical posts dropped today on fixed-height card fragility and media query range syntax.</p>
<hr>
<h2>Bun may be porting from Zig to Rust</h2>
<p>A <code>docs/PORTING.md</code> guide appeared in the Bun repository, and it’s aimed at coding agents — which suggests AI-assisted migration work rather than a casual experiment. Nothing is confirmed, and the Bun team hasn’t made an announcement. But Zig-to-Rust is a significant architectural bet if it’s real, and the fact that it’s documented at all means someone is thinking seriously about it. Worth watching.</p>
<h2>pnpm 11 ships supply chain security defaults</h2>
<p>pnpm 11 now blocks newly published packages for 24 hours by default via Minimum Release Age, blocks exotic subdependencies, and consolidates build-script controls under a new <code>allowBuilds</code> model. It also adds native publish commands (no longer delegating to npm CLI), built-in SBOM generation in CycloneDX 1.7 and SPDX 2.3 formats, a SQLite-backed store for faster installs, and requires Node.js 22. Looking further ahead, pnpm v12 plans to integrate Pacquet, a Rust-based install engine, with warm-cache benchmarks dropping from 2.3s to under one second.</p>
<h2>Community concern over Bun’s Anthropic acquisition</h2>
<p>A post making the rounds argues that Claude Code’s quality has noticeably degraded since Anthropic acquired Bun in December 2025 — citing reduced reasoning effort, billing confusion, and unexpected behavior tied to git history. The author isn’t calling for people to leave Bun, but has switched personal projects to pnpm for package management as a precaution. The worry is that the same product neglect visible in Claude Code could eventually reach Bun itself. It’s one developer’s read, but the concern about corporate acquisition affecting an indie runtime’s trajectory is legitimate.</p>
<h2>Fixed-height CSS cards are more fragile than they look</h2>
<p>A practical post today walks through exactly why fixed-height cards break — longer translations, user font scaling, missing images — and how to fix them properly using intrinsic sizing, CSS Grid stretch alignment, and flexbox column layout. The key moves: remove the fixed height, let the grid handle equal heights via stretch, convert cards to flex column containers, and use <code>clamp()</code> for fluid typography. There’s also a stress-test mode demonstrated to surface layout failures before shipping. If you’re still reaching for <code>height: 300px</code> on cards, this is worth reading.</p>
<hr>
<h2>Also notable</h2>
<ul>
<li><strong>Media query range syntax:</strong> CSS Media Queries Level 4 range syntax (<code>300px &lt;= width &lt;= 500px</code>) has been well-supported since March 2023 and eliminates the subtle bug where two queries sharing a breakpoint value hide both elements simultaneously. Works with container queries too.</li>
<li><strong>CSS <code>n of</code> selectors for form validation:</strong> A Frontend Masters post shows how <code>:nth-child(n of &lt;selector-list&gt;)</code> combined with <code>:has()</code> and <code>:placeholder-shown</code> can drive conditional form validation feedback without JavaScript. A WebKit bug with state-based <code>n of</code> styling is noted.</li>
<li><strong>Void deployment platform:</strong> VoidZero’s new Void platform deploys full-stack Vite apps with a single command on Cloudflare Workers, auto-provisioning databases, storage, auth, and queues by analyzing your code. Trade-off is vendor lock-in through its proprietary backend SDK.</li>
<li><strong>Parasito:</strong> A new TypeScript-first HTTP testing library with a unified fluent API for Express, Fastify, H3, Hono, plain Node handlers, and remote URLs — chainable assertions, promise-based, consistent across frameworks.</li>
<li><strong>Swiggy × JioHotstar integration:</strong> Swiggy’s engineering team embedded food ordering inside the JioHotstar streaming app for IPL season in 8 weeks, solving cross-company auth via RSA-encrypted phone number sharing, redesigning layouts for split-screen viewports, and implementing two-layer rate limiting for traffic spikes.</li>
<li><strong>Bun Windows binary shrinks 17 MB:</strong> The next Bun release cuts its Windows x64 binary by 17 MB.</li>
<li><strong>Contact Form 7 feature freeze:</strong> Version 6.2 is the final major release; only security patches going forward. The successor <a href="http://Contactable.io" target="_blank" rel="noopener nofollow">Contactable.io</a> isn’t expected until 2028. WPForms has a built-in CF7 importer if you need to migrate.</li>
<li><strong>CSS color palettes roundup:</strong> A curated list of CSS color palettes including uchū, flexoki, and the accessibility-focused reasonable colours, plus generators and notes on using <code>oklch</code> for generative color work.</li>
<li><strong>Email validation quiz:</strong> A 21-question quiz at e-mail.wtf based on RFC 5322 surfaces how many technically valid email addresses — quoted strings with spaces, emoji domains, parenthetical comments — get rejected by real services including Gmail. The only reliable validation is sending a confirmation email.</li>
</ul>


Frontend development news, CSS techniques, framework updates, and browser API changes.

Web Digest

A roundup of notable developer news: Bun's repository surfaced a docs/PORTING.md file hinting at a potential Zig-to-Rust migration using AI-assisted tooling, though nothing is confirmed. pnpm 11 shipped with meaningful supply chain security defaults including a 24-hour minimum release age for new packages, exotic subdependency blocking, native publish commands, built-in SBOM generation, and a SQLite-backed store. There's also community concern about Bun's acquisition by Anthropic and potential product neglect. On the CSS side, practical posts cover fixed-height card fragility and CSS Media Queries Level 4 range syntax. Additional items include a new Vite deployment platform, a TypeScript HTTP testing library, and Contact Form 7 entering feature freeze.

Bun explores a Zig-to-Rust port, pnpm 11 ships supply chain defaults