Monthly learnings and discoveries related to frontend, the web, and software engineering in general.

• Matt Pocock, author of many popular agent skills, joins the Pragmatic Engineer podcast to discuss online education in the age of AI, skills, context, and workflows for agentic development.

• An overview of new things you should know about HTML in mid-2026, including permission elements, customizable selects, new web components features, focusgroup, changes to the h1 element, and many more.

• initial-scale=1.0 has been part of my HTML boilerplate for as long as I remember—turns out that’s a workaround for scaling issues on iOS from before “responsive design” was even a thing. You don’t need that in your HTML today. And if you do, your page is already broken in other ways and requires a different fix.

• Now Baseline Newly Available: the text-box property, which trims the extra space every font reserves above and below its characters—the leading that makes a line box taller than the text inside it. Trimming to the cap height and the alphabetic baseline instead makes vertical spacing predictable across fonts. Kevin Powell shows how it works on YouTube.

• Also new to the Baseline: the sibling-count() and sibling-index() functions, allowing you to calculate property values based on how many siblings an element has and where it sits among them. With an explainer, too!

• The hover CSS media feature lets you query whether users can conveniently hover over things on the device they’re using. This has been around forever, and I don’t know how I missed it for so long. Handy when implementing fallbacks for hover-based interactions.

• Tailwind Labs, the company behind Tailwind, has been acquired by Shopify, hopefully putting the project on a sustainable foundation for further development after it laid off several team members earlier this year.

• Weeks after OpenAI agents escaped sandboxing and hacked Hugging Face during internal evaluations, the company published an extensive report about the incident. Check out The Rise and Fall of Agent Civilizations for a more digestible version, and The Truth about OpenAI’s “Secret AI Civilizations” for a more critical perspective.

• Two alleged TeamPCP hackers, responsible for several supply chain attacks on the Node ecosystem, have been arrested in Australia.

• The Story of VS Code 🍿

Notable releases:

• Claude Code 2.1.277, now reading AGENTS.md in projects with no CLAUDE.md.

• Claude Fable 5.1 and Mythos 5.1, claiming new highs in coding, knowledge work, and long-running tasks, plus roughly 25% lower cost for typical workloads thanks to cheaper cached token reads.

• GPT-6 Astra, OpenAI’s new flagship, with better focus and coding ability, and the first model they rate Critical for cybersecurity under their Preparedness Framework.

• Homebrew 7, speeding up installs and upgrades through concurrent downloads, plus a brew vulns command that checks what you’ve installed against the OSV advisory database, and an official native macOS app.

• pnpm 12-12.4, shipping the faster Rust rewrite and adding the pipeline command, which installs frozen dependencies and runs workspace tasks, picking only the affected projects and continuing past failures so a single CI run reports everything that’s broken. 12.4 also adds experimental support for managing Python and Cargo dependencies alongside npm packages in the same workspace.

• Safari 27, with plenty of developer tools and web platform features, including an MCP server, and support for customizable selects.

• Vitest 5, 8-25% faster depending on your setup, introducing vi.when() for mocking specific arguments, as well as a trace view for browser mode that records every interaction and assertion as a DOM snapshot you can step through afterwards.