<p><strong>TLDR:</strong> Bun’s creator rewrote 960,000 lines of Zig to Rust in six days with AI assistance, hitting 99.8% test suite pass rate on Linux. A critical RCE vulnerability in React’s Flight protocol was disclosed, affecting any default Next.js/React app. Chrome quietly downloaded a 4GB Gemini model to users without consent. Accessibility is getting a new business argument: AI agents fail hard on inaccessible sites.</p>
<hr>
<h2>Bun’s Rust rewrite passes 99.8% of tests after six days</h2>
<p>Jarred Sumner shipped a 960,000-line rewrite of Bun from Zig to Rust in six days, and 99.8% of the existing test suite passes on Linux x64 glibc. The motivation is straightforward: memory leaks and crashes consumed too much maintenance time, and Rust’s ownership model enforces lifetime correctness at compile time. A blog post is coming with benchmarks and memory usage comparisons. Worth noting: the original Bun was itself a manual line-for-line port of esbuild’s Go transpiler to Zig, done pre-LLM in three weeks.</p>
<hr>
<h2>CVE-2025-55182: RCE in React’s Flight protocol</h2>
<p>A security researcher reverse-engineered React’s undocumented Flight protocol (used by Server Components and Server Functions) and found it skipped prototype chain safety checks during property resolution. By crafting malicious Flight payloads that abuse JavaScript thenables and React’s internal Chunk object, an attacker could chain calls into Node’s module system and execute arbitrary code. The exploit worked on a fresh Next.js app with zero special configuration. Meta was notified November 30, 2025 and patched in three days. If you’re running React Server Components, check your React version.</p>
<hr>
<h2>Chrome downloaded a 4GB Gemini model without asking</h2>
<p>Google silently pushed a 4GB Gemini AI model to Chrome users’ devices without consent. This surfaced in a Linux news roundup alongside KDE Plasma 6.7 shipping a new Union style engine and fixing a KDevelop scrolling bug that was burning 80-90% CPU. The Chrome behavior is the kind of thing that erodes trust fast, especially for users on metered connections or limited storage.</p>
<hr>
<h2>AI agents fail on inaccessible sites</h2>
<p>AI agents like ChatGPT’s browser mode and Chrome’s auto-browse navigate via the accessibility tree, the same structure screen readers use. Research cited in a post today shows AI task success drops from 78% to 28% when accessibility is broken. The practical fix list is familiar: semantic HTML, labeled interactive elements, correct ARIA usage, and server-side rendering. The business case for accessibility just got a new angle that might actually land in a roadmap meeting.</p>
<hr>
<h2>Also notable</h2>
<ul>
<li><strong>Fonttrio:</strong> An open-source font pairing registry for shadcn/ui with 49 curated combinations, installable via a single CLI command and auto-configured with CSS custom properties and a typography scale. 377 GitHub stars at launch.</li>
<li><strong>trawly:</strong> A new CLI dependency scanner that reads lockfiles from npm/pnpm/Yarn and queries the OSV advisory database, flagging CVEs plus heuristic risks like install scripts, unexpected registries, and suspiciously new packages. Outputs SARIF for CI gating.</li>
<li><strong>Rails 8.1 background job progress:</strong> Three new primitives (Rails.event, Active Job lifecycle events, ActiveJob::Continuable) let you push live progress to users via Turbo Streams without any broadcast calls in the job body.</li>
<li><strong>Zed gaining VS Code converts:</strong> A post today describes switching from VS Code to Zed after its 1.0 release, citing Rust-based architecture, GPU-accelerated rendering, and native agentic AI editing as the main reasons.</li>
<li><strong>Web fork proposal:</strong> Someone proposed a competing HTML spec capped at 1.44 MiB compressed, with strict semver, a non-ambiguous formal grammar, and no JavaScript — framed as a response to the current 18+ MiB spec being captured by commercial interests.</li>
<li><strong>shadcn CLI update:</strong> The CLI now resolves package.json imports and installs registry files through portable target aliases, letting teams move beyond tsconfig-only path aliases.</li>
<li><strong>GitLab Todo Checker:</strong> A lightweight Electron/React/TypeScript tray app that polls GitLab To-Dos and lets you mark them done without opening the browser. Open source, supports self-signed SSL.</li>
</ul>


Frontend development news, CSS techniques, framework updates, and browser API changes.

Web Digest

A packed developer news roundup covering: Bun's creator rewrote 960,000 lines of Zig to Rust in six days with AI help, achieving 99.8% test pass rate. A critical RCE vulnerability (CVE-2025-55182) was found in React's Flight protocol affecting default Next.js apps. Google silently pushed a 4GB Gemini model to Chrome users without consent. Research shows AI agents' task success drops from 78% to 28% on inaccessible sites, giving accessibility a new business argument. Also covered: a font pairing registry for shadcn/ui, a CLI dependency scanner, Rails 8.1 background job progress primitives, Zed editor gaining VS Code converts, a Web fork proposal, and a GitLab Todo tray app.

Bun rewrites 960k lines in Rust, a critical React Flight RCE lands