<p><strong>TLDR:</strong> Vite 8 lands with Rolldown and Oxc replacing the old esbuild/Rollup split, with real-world build time cuts of 38-64%. NestJS v12 is targeting early Q3 2026 with a full CommonJS-to-ESM migration and a modernized toolchain. Mozilla formally opposes Chrome’s browser-native Prompt API, citing interoperability risks and a troubling precedent around Google’s ToS on a web standard. TypeScript 7 Beta is now the default in Visual Studio 2026 Insiders, bringing up to 10x faster compile times.</p>
<hr>
<h2>Vite 8 and the VoidZero platform</h2>
<p>Vite 8 replaces esbuild and Rollup with a Rust-based core: Rolldown as the bundler, Oxc for parsing and transforms. Teams are reporting 38-64% build time improvements in real projects, with dev/prod parity now built in. VoidZero is also shipping Vite+ (a unified CLI for build, test, lint, format, and deploy) and Void (a Cloudflare Workers deployment platform), though both are early-stage and the lock-in risk on Void is worth watching before committing.</p>
<h2>NestJS v12 roadmap</h2>
<p>NestJS published a draft PR for v12, targeting early Q3 2026. The headline is a full ESM migration across all official packages, made practical by Node.js’s <code>require(esm)</code> support. The toolchain gets a full swap too: Jest out for Vitest, ESLint out for oxlint, Webpack out for Rspack. Native Standard Schema support lands in route decorators, meaning Zod, Valibot, and ArkType become first-class alternatives to class-validator. No migration guide yet, but packages will appear under the <code>next</code> npm tag before stable.</p>
<h2>Mozilla opposes Chrome’s browser-native Prompt API</h2>
<p>Mozilla filed a formal negative position on the Prompt API proposed for web standardization. The core objection: developers will inevitably tune system prompts to specific model quirks, recreating the browser-sniffing mess of the early 2000s. There’s also a harder concern — Chrome’s implementation requires users to agree to Google’s Generative AI Prohibited Uses Policy, which sets a genuinely uncomfortable precedent for a web platform API. Chrome also silently downloads a 4.4 GB model onto user devices. Mozilla’s counter-proposal is to ship a web extension exposing a Prompt-like API with developer-specified models before any standardization happens.</p>
<h2>TypeScript 7 Beta is now the default in Visual Studio 2026 Insiders</h2>
<p>Visual Studio 2026 18.6 Insiders 3 ships TypeScript 7 Beta as the default built-in SDK. The native port delivers up to 10x faster compile times and around 8x faster project load times via native execution and shared-memory parallelism. Known issues are real though: missing quick fixes, incomplete Find All References, broken import updates on file rename, and JSDoc auto-generation not working. You can pin to TypeScript 6.x via npm or revert through Tools &gt; Options if any of those hit you.</p>
<hr>
<h2>Also notable</h2>
<ul>
<li><strong>NPM brownout for Yarn v1 audit endpoint:</strong> NPM silently deprecated <code>/-/npm/v1/security/audits</code>, causing <code>yarn audit</code> to return 410 errors with no public announcement. Full retirement is July 15, 2026. Migrate to the Bulk Advisory API or switch to <code>npm audit</code>.</li>
<li><strong>Vercel pricing investigation:</strong> A detailed breakdown found a $23,000 bill from a DDoS attack (traffic billed at $0.15/GB), a $286 actual bill on a $20 plan, and image optimization adding a 7x multiplier. The Hobby plan takes sites offline at limits with no throttling or warning.</li>
<li><strong>Astro 6.2:</strong> Ships a redesigned SVG optimizer API, an experimental custom logger with JSON output for coding agents, and a <code>getFontFileURL()</code> helper for prerendering. Also previews Astro v7 alpha with Vite 8 and the Rust compiler as default.</li>
<li><strong>VoidZero experimental Angular compiler:</strong> Built on Oxc, claims up to 20x faster build performance over existing Angular tooling. Early-stage, but worth tracking if Angular build times are a pain point.</li>
<li><strong>Servo 0.1.0:</strong> 530 commits, first <a href="http://crates.io" target="_blank" rel="noopener nofollow">crates.io</a> publication. Adds keyboard/tab navigation, FreeBSD support, step debugging in DevTools, <code>input[type=range]</code>, <code>::first-letter</code>, <code>background-blend-mode</code>, and a 10% reduction in BoxFragment memory usage.</li>
<li><strong>CSS <code>random()</code> and <code>random-item()</code>:</strong> CSS Values and Units Level 5 introduces native randomness functions, keeping generative layout decisions in the styling layer without delegating to JavaScript.</li>
<li><strong>CSS scroll-driven animations:</strong> The Animation Timeline API (<code>animation-timeline: view()</code> / <code>scroll()</code>) lets you link keyframe animations to scroll progress with no JavaScript.</li>
<li><strong>LinkedIn extension scanning:</strong> LinkedIn has been silently detecting installed Chrome extensions since at least 2017 using a hardcoded list of 6,278 extension IDs, combining results with 48 other signals. A criminal investigation has been opened in Bavaria and DMA non-compliance is being examined.</li>
<li><strong>Malicious AI Chrome extensions:</strong> Unit 42 identified 18 extensions disguised as AI productivity tools, using WebSocket C2 channels, DOM scraping of Gmail, and API key harvesting. All 18 were reported to Google.</li>
<li><strong>pnpm 11.0:</strong> Ships with a SQLite-backed package index, native publishing tooling, isolated global installs, and supply-chain protection on by default.</li>
<li><strong>DPoP browser storage:</strong> RFC 9449 binds OAuth tokens to a client key pair, but non-extractable CryptoKeys in IndexedDB don’t prevent XSS — attackers can invoke <code>crypto.subtle.sign()</code> without extracting the private key. BFF pattern remains the current standard; Firefox also fails to store CryptoKey objects in IndexedDB at all.</li>
<li><strong>Flutter 3.44:</strong> Makes Swift Package Manager the default for iOS/macOS, replacing CocoaPods which enters maintenance mode with its registry going read-only December 2, 2026. 61% of the top 100 iOS plugins have already migrated.</li>
<li><strong>Browser rendering and task boundaries:</strong> A useful explainer confirming the browser won’t render while a macrotask runs or microtasks drain — only after the current macrotask completes and the microtask queue is empty.</li>
<li><strong>Carousel accessibility and reduced motion:</strong> A <code>@media (prefers-reduced-motion: reduce)</code> oversight can cause logo carousels to stack vertically and break entirely — worth auditing if you have any scroll-based layout components.</li>
</ul>


Frontend development news, CSS techniques, framework updates, and browser API changes.

Web Digest

A developer news roundup covering several major releases and industry developments. Vite 8 replaces esbuild and Rollup with Rust-based Rolldown and Oxc, delivering 38-64% build time improvements. NestJS v12 targets Q3 2026 with a full ESM migration, swapping Jest for Vitest, ESLint for oxlint, and Webpack for Rspack. Mozilla formally opposes Chrome's browser-native Prompt API over interoperability concerns and Google's ToS precedent. TypeScript 7 Beta becomes the default in Visual Studio 2026 Insiders with up to 10x faster compile times. Also covered: pnpm 11.0 with SQLite-backed package index, Astro 6.2, Servo 0.1.0, CSS random() functions, malicious AI Chrome extensions, Vercel pricing concerns, and more.

Vite 8 ships Rust-based core, NestJS v12 targets full ESM migration