<p><strong>TLDR:</strong> TypeScript 6.0 is out today and it’s a transitional release — the last one built on the JavaScript compiler before the Go-native 7.0 takes over. Several tsconfig defaults have changed in ways that will break existing projects if you’re not paying attention. Rails pushed security patches across three active versions covering 10 vulnerabilities. On the tooling side, Google Stitch picked up a significant update that’s getting attention from teams using AI-assisted frontend workflows.</p>
<hr>
<h2>TypeScript 6.0</h2>
<p>This is a bridge release, not a feature drop. The headline is that several tsconfig defaults have changed: <code>strict</code> is now <code>true</code>, <code>module</code> defaults to <code>esnext</code>, <code>target</code> defaults to <code>es2025</code>, and <code>types</code> defaults to an empty array — that last one alone can cut build times by up to 50% by stopping TypeScript from auto-importing every <code>@types/*</code> package in node_modules. New standard library additions include Temporal API types, <code>Map.getOrInsert</code> / <code>Map.getOrInsertComputed</code>, and <code>RegExp.escape</code>. On the deprecation side, <code>--baseUrl</code>, <code>--outFile</code>, <code>node</code> module resolution, <code>es5</code> target, and AMD/UMD/SystemJS modules are all on their way out. The Go-native 7.0 compiler is already available as a preview in VS Code — 6.0 exists largely to get your tsconfig into a state where that migration hurts less.</p>
<h2>Rails security releases</h2>
<p>Versions 7.2.3.1, 8.0.4.1, and 8.1.2.1 are out with fixes for 10 security vulnerabilities. No details on severity in the release notes, but the guidance is to upgrade immediately. If you’re on anything older than 7.2, you’re on an unsupported series.</p>
<h2>Google Stitch update</h2>
<p>Stitch’s March “Vibe Design” update adds Voice Canvas for conversational UI iteration, autonomous prototyping that generates screen flows, and MCP-based integration with coding agents and Firebase. The workflow getting traction: use Stitch to generate a design system and export a <code>design.md</code> file, then hand that off to Claude Code to apply the design language across an existing codebase. It’s not pixel-perfect, but it gives AI-built apps a more consistent visual foundation without burning tokens on design iteration. Stitch’s launch reportedly hit Figma’s stock around 8%.</p>
<h2>A startup scrapped 18 months of code</h2>
<p>The founder of QA automation company Autonoma wrote up what they learned. The technical critique of Next.js Server Actions is worth reading: sequential global execution, poor observability, security footguns, errors used as flow control, and 8GB RAM container requirements. They rewrote using React with tRPC, a Hono backend, and Argo for Kubernetes-native workflow orchestration. The broader lesson about skipping tests early and losing a client because of it is less surprising, but the Server Actions breakdown is specific enough to be useful.</p>
<hr>
<h2>Also notable</h2>
<ul>
<li><strong>cc-lens:</strong> Open source local monitoring dashboard for Claude Code — reads from <code>~/.claude/</code>, no telemetry, launched via <code>npx cc-lens</code>, built with Next.js 15 and React 19. Covers token usage, costs, session replays, and activity heatmaps.</li>
<li><strong>SolidJS 2.0 beta:</strong> Async-first reactivity, a new Loading component, pending UI expressions, and an action primitive for mutations.</li>
<li><strong>Astro 6:</strong> Rewritten dev server that matches production runtimes including Cloudflare Workers via workerd, automatic font self-hosting, built-in CSP generation, and live content collections.</li>
<li><strong>Vite 8:</strong> Replaces the dual esbuild/Rollup architecture with a single Rolldown bundler in Rust — 10-30x faster production builds with maintained plugin compatibility.</li>
<li><strong>Bombadil:</strong> Early-stage open source tool from Antithesis bringing property-based testing to web UIs, runs in local environments and CI.</li>
<li><strong>CSS anchor positioning for arrows:</strong> A detailed walkthrough of drawing directional arrows between draggable elements using only CSS — anchor positioning, <code>clip-path</code>, <code>atan</code>, <code>hypot</code>, and <code>CSS if()</code> with no JavaScript.</li>
<li><strong>GPC opt-out UX:</strong> California’s CCPA now requires confirmation when honoring Global Privacy Control signals; OneTrust and others are implementing it with an “Accept All” button that overrides the signal when clicked.</li>
<li><strong>Test IDs as an a11y smell:</strong> The argument that <code>data-testid</code> selectors mask inaccessible markup, and that role-based selectors via Testing Library or Playwright provide implicit accessibility testing.</li>
<li><strong>Liminal:</strong> Browser-based Laravel IDE running PHP 8.4 via WebAssembly — includes CodeMirror 6, Tailwind v4 preview, Artisan terminal, and shareable URLs encoding file state. SQLite only, no external network access from PHP.</li>
<li><strong>Ryan Carniato on async in frameworks:</strong> The observation that most frameworks incorrectly fuse the “consume” and “block” phases of async handling, which causes architectural problems downstream.</li>
<li><strong>CSS <code>corner-shape</code> animations:</strong> Hands-on exploration of combining scroll-driven animations with the new <code>corner-shape</code> property in Chrome 139+, including <code>superellipse()</code> values and <code>mix-blend-mode: difference</code> effects.</li>
<li><strong>In-browser AI inference:</strong> QCon London talk covering Transformers.js, WebLLM, WebGPU, Chrome’s Prompt API with Gemini Nano, and the WebNN API for NPU access — practical rule of thumb: choose in-browser when privacy, latency, offline capability, or cost predictability outweigh the constraints of smaller models.</li>
</ul>


Frontend development news, CSS techniques, framework updates, and browser API changes.

Web Digest

TypeScript 6.0 is out as a transitional release before the Go-native 7.0 compiler. Key breaking changes include strict mode defaulting to true, module defaulting to esnext, target to es2025, and types defaulting to an empty array (cutting build times up to 50%). Deprecated features include --baseUrl, node module resolution, es5 target, and AMD/UMD/SystemJS modules. Rails pushed security patches across versions 7.2.3.1, 8.0.4.1, and 8.1.2.1 covering 10 CVEs with immediate upgrade recommended. Google Stitch received a 'Vibe Design' update adding Voice Canvas, autonomous prototyping, and MCP integration with coding agents. Other notable releases include SolidJS 2.0 beta with async-first reactivity, Astro 6 with a rewritten dev server, and Vite 8 replacing its dual bundler architecture with Rolldown for 10-30x faster builds. A startup postmortem details technical issues with Next.js Server Actions leading to a rewrite using React, tRPC, Hono, and Argo.

TypeScript 6.0 ships breaking defaults, Rails patches 10 CVEs