<p><strong>TLDR:</strong> MDN rebuilt its frontend using Lit web components and Rspack, trading a React SPA for a leaner, islands-based architecture. Railway made a similar call, migrating its production frontend from Next.js to Vite and TanStack Router in two PRs with zero downtime. The Axios npm package was compromised in late March via a hijacked maintainer account, and Chrome 147 ships element-scoped view transitions as stable. Figma also opened its canvas to AI agents via a new MCP server.</p>
<hr>
<h2>MDN rebuilds on Lit and Rspack</h2>
<p>MDN’s old frontend — a React SPA called ‘yari’ built on ejected Create React App — was a poor fit for static documentation content from the start. The new stack uses Lit web components for islands of interactivity, custom server components for static HTML templating, and Rspack for builds. The practical results are hard to argue with: dev server startup dropped from 2 minutes to 2 seconds, and pages now ship only the CSS they actually need. Declarative Shadow DOM handles progressive enhancement, and browser compatibility decisions throughout were guided by the Baseline project.</p>
<h2>Railway migrates off Next.js</h2>
<p>Railway’s Next.js setup had 10-minute builds (6 of those attributable to Next.js itself), a client-heavy app that fought the framework’s server-first model, and layout workarounds that kept accumulating. They split the migration into two phases: strip all Next.js-specific APIs, then swap the framework and generate 200+ routes from the original page tree. Nitro handles the server layer now. Builds are under 2 minutes, dev server starts instantly, and routing is type-safe via TanStack Router. They lost built-in image optimization (replaced with Fastly) and had to build in-house equivalents for things like next-seo. TanStack Start’s relative immaturity is a known trade-off they’ve accepted.</p>
<h2>Axios supply chain attack</h2>
<p>On March 30, an attacker hijacked the lead Axios maintainer’s npm account and published two malicious versions (1.14.1 and 0.30.4). The payload introduced a phantom dependency that deployed a cross-platform remote access trojan on macOS, Windows, and Linux via a postinstall hook. The attacker bypassed GitHub Actions OIDC Trusted Publisher protections by publishing manually with a stolen npm token, leaving no trace in the repo. Automated scanners flagged it within six minutes; npm pulled the packages in about 3.5 hours. If you’re not already running <code>npm ci --ignore-scripts</code> in CI, now’s the time. Pin to a known-safe version and rotate credentials if you pulled those versions.</p>
<h2>Chrome 147: element-scoped view transitions</h2>
<p>Chrome 147 ships <code>Element.startViewTransition()</code> as stable, letting you scope a view transition to a DOM subtree rather than the whole document. This means multiple transitions can run concurrently, nested transitions work, and <code>position: fixed</code> layering issues go away while the rest of the page stays interactive. The feature has been in developer testing since Chrome 140 and was shaped in collaboration with the CSS Working Group. Worth experimenting with if you’ve been holding off on view transitions because of the full-document scope limitation.</p>
<hr>
<h2>Also notable</h2>
<ul>
<li><strong>Figma MCP server:</strong> Figma opened its canvas to AI agents via a new MCP server, letting tools like Claude Code, Cursor, and Codex read and write Figma files using your existing design system components and variables. A ‘skills’ system lets teams encode design conventions as markdown files. Free in beta.</li>
<li><strong>Chrome name-only containers:</strong> CSS name-only containers (Safari 26.4+) let you assign a <code>container-name</code> without a <code>container-type</code>, giving you component-scoped <code>@container</code> blocks with no build tools or BEM required — essentially what CSS Modules does, but native.</li>
<li><strong>Axios attack remediation:</strong> Safe versions are anything before 1.14.1 or 0.30.4; remove <code>plain-crypto-js</code> from your trees and audit postinstall hooks across your dependency graph.</li>
<li><strong>hucre spreadsheet engine:</strong> A zero-dependency TypeScript spreadsheet engine that reads and writes XLSX, CSV, and ODS at ~18 KB gzipped versus SheetJS’s ~300 KB, with native ESM and edge runtime support.</li>
<li><strong>Docusaurus 3.10:</strong> Rspack/SWC/LightningCSS (the ‘Faster’ bundle) is now stable and will be on by default in v4. The release also adopts npm Trusted Publishing and adds a daily Socket Firewall security workflow.</li>
<li><strong>React Status #468:</strong> Makes the case that <code>data-testid</code> attributes are an accessibility smell — role-based selectors are preferable. Also covers Next.js 16.2’s stable Adapter API and TanStack DB 0.6 adding SQLite-backed offline persistence.</li>
<li><strong>‘Amazing Refresh’ malware extension:</strong> A Chrome/Edge extension with ~100,000 installs was found exfiltrating page URLs, injecting remotely-served JavaScript into every page in the MAIN execution context, and hijacking affiliate link clicks. Reported to Google and Microsoft for removal.</li>
<li><strong>Google open-sources JSIR:</strong> A high-level intermediate representation for JavaScript aimed at enabling better tooling like linters and bundlers, covered in JavaScript Weekly issue 780.</li>
<li><strong>Railway’s Nitro layer:</strong> Worth noting separately — consolidating redirects, headers, and caching into a single Nitro server layer cleaned up a lot of the scattered config that tends to accumulate in Next.js projects.</li>
<li><strong>Design/AI survey:</strong> A survey of 200+ designers and developers found 84% are using AI tools but only 16% report strongly positive productivity outcomes. The design-to-development handoff problem remains largely unsolved, with only 21% reporting smooth handoffs.</li>
</ul>


Frontend development news, CSS techniques, framework updates, and browser API changes.

Web Digest

A roundup of notable frontend and web development news: MDN rebuilt its frontend replacing a React SPA with Lit web components and Rspack, cutting dev server startup from 2 minutes to 2 seconds. Railway migrated its production app from Next.js to Vite and TanStack Router, reducing builds from 10 minutes to under 2. The Axios npm package was compromised via a hijacked maintainer account, deploying a remote access trojan through a postinstall hook before being pulled in ~3.5 hours. Chrome 147 ships element-scoped view transitions as stable. Also covered: Figma's new MCP server for AI agents, CSS name-only containers, a malicious Chrome extension with 100k installs, and Docusaurus 3.10.

MDN ditches React for web components, Railway drops Next.js for Vite