Monthly-ish learnings and discoveries related to frontend, the web, and software engineering in general.

Curated by me, Andreas 👋 mostly for myself and my dear coworkers at DigitalService.

🎅🏻 December 2025

• The Chrome team is showing off all the new CSS features of 2025 in their CSS Wrapped.

• Parse, don’t validate.

• From that same article, the concept of Shotgun parsing:

Shotgun parsing is a programming antipattern whereby parsing and input-validating code is mixed with and spread across processing code. […] Shotgun parsing necessarily deprives the program of the ability to reject invalid input instead of processing it.

• Starting with macOS Tahoe, you can protect SSH keys by storing them in your Mac’s Secure Enclave.

• Learn how to use modern CSS color features for advanced use cases like generating color schemes in part 2 of the Pragmatic Guide to Modern CSS Colors.

• New to the Baseline: the CookieStore API, a simpler way of reading and setting cookies.

• Explore large HTML documents on the web, and find out how to analyze big network payloads, identify performance bottlenecks, and optimize performance of large pages.

• Did you know that you can get most of TypeScript by using JSDoc comments in plain old JavaScript files? Learn more about the nuances of JavaScript typing using JSDoc, and check out Svelte for a case study of why you might want this.

• Woke up to your web service unexpectedly mining Bitcoin? Perhaps you’re affected by the 10/10 vulnerability in React Server Components. If you’re curious about the details, check out the explainer of this “juxtaposition of a glaring omission of a safety check, combined with a stunningly brilliant mechanism to exploit it.”

• On a similar but less serious note, Ordering Pizza with Code is a fun watch covering reverse engineering, AI phone calls, and MCP servers—and a good reminder to secure your APIs on the server-side because clients can’t be trusted.

• What actually makes you senior: reducing ambiguity.

• Don’t design or develop needy programs 🙇‍♂️

Notable releases:

• Try out the preview of TypeScript 7, the native rewrite of the TypeScript compiler, in your editor and projects.

• Oxfmt, a Prettier-compatible formatter by the Vite team, with its first alpha release.

• Oxlint, now supporting type-aware linting in alpha—allowing you to “catch bugs by utilizing TypeScript’s type system.”

• Devstral 2, the latest agentic, open source coding model by Mistral—to my knowledge the only European competitor in the LLM AI space 🥹🇪🇺 accompanied by their own CLI tool.

• Safari 26.2, packed with support for recent web standards such as invoker commands, field sizing, sibling count, the scrollend event, and the Navigation API—all of which are now closer to being universally supported.

• Chrome 144 Beta, adding support for the long-awaited Temporal API 🎉

Previous editions

• 🚴‍♂️ November 2025: Date pickers, designing URLs, rotting software
• 🎃 October 2025: Making progress, CSS colors, lots of releases
• 💨 September 2025: Supply-chain security, platform APIs, evil package managers
• ⛵️ August 2025: State of CSS, debugging Java in VS Code, building software quickly
• 🌞 July 2025: JSNation 2025, JSON modules, CSS if()
• 🏝️ June 2025: AI skepticism, Safari 26, Remix waking up

Find all previous editions in the archive.