Tag
160 articles tagged #Web Development.
P.01Laravel 13 needs PHP 8.3 and changes CSRF, cache and session defaults. What breaks when you upgrade from 12, in order of risk, with the fixes.
P.02Next.js 16.4 recommends Cache Components for every app and makes them the default in create-next-app. What changed, what to enable, and whether to upgrade.
P.03A service worker is a script that sits between your page and the network. Register one, cache assets, serve offline, and ship updates without stale-cache bugs.
P.04Next.js 15 stops getting security patches on October 21, 2026. Here is the upgrade path to 16: codemods, the breaking changes that bite, and a safe rollout.
P.05Chrome 154 shipped September 22, 2026. What can affect your site: HTTP warnings, popover light dismiss, WebSocket options and new CSS, plus a test list.
P.06SameSite cookies stop most CSRF, but not all. Learn when you still need tokens and Origin checks, with working Express code and a test you can run.
P.07Go 1.27 shipped August 19 with generic methods, json/v2 under the hood and a GA goroutine leak profile. What to test before you bump go.mod.
P.08Moving from encoding/json to json/v2 in Go 1.27: the strict defaults that change behavior, the options that restore v1, and a safe rollout order.
P.09Signals are the reactivity model behind Angular, Vue, Solid, and Svelte 5. Here's how they actually work, and the TC39 proposal to standardize them.
P.10TC39's Stage 3 import defer proposal loads a module without running it until you touch it. What problem it solves and why you can't ship it yet.
P.11A practical RBAC pattern for Node.js and Postgres: roles, permissions, a middleware that checks both, and the traps that turn clean RBAC into unmaintainable spaghetti.
P.12Chrome's stable channel now ships every two weeks, not four, starting with Chrome 153 on Sept. 8, 2026. Here's what changes for testing and extensions.
P.13A heavy JavaScript task freezes your UI because it runs on the same thread as rendering. Here's how Web Workers fix that, with real benchmark numbers.
P.14WebTransport hit Baseline in March 2026 when Safari 26.4 shipped it. Here's what it actually does, how it differs from WebSockets, and when to reach for it.
P.15The :open pseudo-class, Baseline since May 2026, styles <details>, <dialog>, and <select> in their expanded state with one selector. No JS classes needed.
P.16React 19.3 shipped September 9, 2026, and turned two long-experimental APIs stable: View Transitions and Fragment Refs. What changed and whether to upgrade.
P.17Axum is the default for new Rust APIs in 2026, Actix-web wins on raw throughput, and Rocket wins on ergonomics. Here is which one fits your team.
P.18The CSS if() function lets a single property branch on media, container, or feature conditions. What it does, the syntax, and where it still can't replace JS.
P.19Shared database or one per customer? Most SaaS teams pick wrong for their stage and pay later. How the three patterns trade off, and which one you need.
P.20One CSS property finally styles the browser's own select, options and icons included, with no dropdown library. The syntax, an example, and real support.
P.21column-rule now works in grid and flexbox, and row-rule joins it. Draw dividers between items in two lines of CSS, plus what to do about support.
P.22ES2026's using and await using close files, connections, and locks when a block ends, with no try/finally. The syntax, real examples, and support today.
P.23Chrome 147, Firefox 146, and Safari 26 all ship contrast-color(), which picks black or white text to meet WCAG AA on any background. Syntax and fallback.
P.24Float16Array stores numbers in half the bytes of Float32Array, trading precision most workloads never used. What it's for, what it costs, where it fails.
P.25Django 6.1 adds QuerySet.fetch_mode() to catch accidental N+1s, ON DELETE pushed into the database, and one MAILERS setting replacing loose EMAIL_ config.
P.26Random UUIDs wreck index locality; auto-increment leaks counts and won't shard. What UUIDv7, ULID, and Snowflake each give you, and the real tradeoffs.
P.27Plain mod-N hashing reshuffles almost every key when you add a server. Consistent hashing moves roughly 1/N instead. Working code and a real simulation.
P.28Shopify hiring split into two jobs, theme customization and app or headless work, that share a platform and little else. How to tell which one you need.
P.29Chrome 152 shipped CSS pseudo-classes matching video and audio state, a CPU Performance API for device tiers, and the start of the end for client-side XSLT.
P.30Chrome 152 added :playing, :paused, :buffering, and :muted as real pseudo-classes. A runnable custom player built on them, plus the JS fallback.
P.31The W3C Design Tokens group shipped a stable exchange format backed by Adobe, Figma, and Google. What it standardizes, and how to migrate an existing setup.
P.32React Router v8 shipped as a deliberately boring release. What the version bump requires, what the codemod handles, and the three things that catch teams.
P.33Prepared statements and parameterized queries stop SQL injection, as the OWASP cheat sheet says. Where ORMs quietly reintroduce it, and how to check your code.
P.34WebMCP is a W3C proposal letting a page register JavaScript functions as tools an agent calls in-browser, no server MCP. How it works, and where it breaks.
P.35Integration tests that boot every dependency are slow and flaky. Contract testing checks that consumer and provider agree on a shape without either running.
P.36Qwik skips hydration instead of optimizing it. How resumability actually works, what Qwik 2.0 changed, and the honest tradeoffs before you ship on it.
P.37@scope applies CSS only inside part of the DOM, with a lower bound that excludes nested components. No BEM, no Shadow DOM. Syntax and where it falls short.
P.38GitHub restricted stargazers and watchers to admins and collaborators in July 2026. It stopped spam scraping, and took Star History and OSS Insight with it.
P.39DDD has a reputation for ceremony that scares teams off before they see the idea. The idea is simple and solves a real problem. What it is, and when to use it.
P.40Chrome and Edge can prerender the next page before a user clicks, with no SPA rewrite. How the Speculation Rules API works, what it wastes, and shipping it.
P.41OAuth 2.1 is still an IETF draft, but most providers enforce it already. What changed from 2.0, plus a checklist for auditing your own implementation.
P.42No Access-Control-Allow-Origin is the most Googled web error for a reason. What CORS is, why the browser enforces it, and how to configure it properly.
P.43field-sizing: content reached Baseline in June 2026. The one line of CSS that replaces the scrollHeight hack for auto-growing textareas, and where it stops.
P.44Build browser push yourself with the Push API, Notifications API and a service worker. No OneSignal, no Firebase. The full setup, VAPID keys included.
P.45Rails isn't the default startup choice anymore, but it didn't disappear. Where it still wins, where Next.js and Django beat it, and who should learn it.
P.46Searches for React 20 keep climbing, but the latest release is 19.2.7. What actually shipped in the 19.2 line, including useEffectEvent, and why.
P.47Vercel's first monthly Next.js security release shipped July 21 with 4 high and 5 medium advisories. What they cover, and why Server Actions keep appearing.
P.48Agents that shop or call paid APIs need a way to pay without a card in the prompt. What Google's AP2 and Coinbase's x402 each do, in plain terms.
P.49Next.js 16.3 cuts Turbopack dev memory roughly 90% on large apps, extends the disk cache to next build, and ships a native Rust React Compiler.
P.50Trusted Types, shape(), and contrast-color() all reached Baseline in early 2026. What each replaces, with working code, and what newly available means.
P.51After a 13-CVE surprise release in May, Vercel moved Next.js to a monthly, pre-announced security cadence. What it promises, and how to plan upgrades.
P.52Temporal hit Stage 4 and ships unflagged in Chrome 144, Firefox 139, and Node 26. Migrating common Date patterns to PlainDate, ZonedDateTime, and Duration.
P.53Astro 7.0 rewrote its compiler in Rust, jumped to Vite 8, and switched markdown parsers by default. What changed, what was removed, and how to upgrade.
P.54Webhooks push the moment something happens; polling asks repeatedly. How to decide, with code for both, and the hybrid most production systems land on.
P.55Vite 8 replaced its dual esbuild and Rollup setup with Rolldown, a Rust bundler, by default. What changed, the real build times, and whether migrating pays.
P.56Idempotency keys let a client retry a request that may have already succeeded, without double-charging a card. The pattern, in Postgres and in Redis.
P.57An N+1 bug turns one page load into hundreds of round trips. What causes it, how to spot it in Django, Rails, and Prisma, and the eager-loading fixes.
P.58OAuth handles authorization, OIDC adds identity on top, and SAML is the older enterprise SSO standard still running much of the corporate world. How to pick.
P.59Astro 6.4 ships a pluggable markdown pipeline and Sätteri, a Rust processor that speeds up content-heavy builds. It can't run your remark plugins yet.
P.60TC39 is standardizing signals, the reactive pattern already inside Vue, Solid, Angular, and Preact. Years from browsers, but it changes what to build on.
P.61FastAPI's June 2026 refactor preserves routes instead of cloning them, makes dynamic registration work, and adds app.frontend() for serving SPAs.
P.62TC39 finalised eight proposals for ES2026. Temporal gets the headlines, but Iterator Helpers, Set methods, Promise.try, and RegExp.escape matter too.
P.63Deno 2.9 ships deno desktop, turning any web project into a native app with no Electron boilerplate. What it's for, and when to stay on Tauri instead.
P.64Svelte 5 runes changed the reactivity model in ways that matter for hiring. The pool is small but experienced. How to find, screen, and evaluate them.
P.65Next.js 16.3 preview added Instant Navigations, giving server-rendered apps the snappy feel of a client-side SPA. What changed, and when to use it.
P.66All three frameworks matured and all three make different tradeoffs. The four questions that settle it, and why there's no universally right answer.
P.67TanStack Start hit 1.x stable and is closing on Next.js in downloads. An honest comparison: what each is good at, where each falls short, how to decide.
P.68WordPress runs 43% of the web, but the title covers everyone from theme configurers to block API engineers. How to find one who builds what you need.
P.69Phoenix LiveView is production-ready for real-time web applications. Here is what it enables, where it fits, and why teams choosing it are not making an exotic choice.
P.70Frontend developer means different things to different teams. The core screen: HTML semantics, CSS fundamentals, Core Web Vitals, and skill beyond React.
P.71Laravel 12 is a different framework from the one people picture when they dismiss PHP. The stack, the tooling, and when a team should actually reach for it.
P.72Rails 8 changed the deployment and infrastructure story. A developer who kept up looks different from one working off 2019 knowledge. What to screen for.
P.73Full-stack means something different to every team. How to define what you need, catch specialists in disguise, and know when a generalist is the right call.
P.74Svelte 5's runes replaced magic variable tracking with explicit reactive primitives. A year into production: what changed, what improved, what surprised.
P.75Playwright dominates scraping now, but tooling is the easy part. A practical guide to scraping that works, and the legal lines to know before you ship.
P.76The OWASP API Security Top 10 catalogs the most exploited API vulnerabilities, from broken authorization to unsafe consumption, each fixable with targeted code.
P.77SolidJS skips the virtual DOM entirely, compiling to real DOM operations with fine-grained signal-based reactivity. Here's what that means in practice.
P.78Three.js makes WebGL usable. React Three Fiber makes Three.js feel like React. The fastest path to interactive 3D on the web, and how to use it.
P.79TanStack Router brings full TypeScript inference to URL params, search params, and loader data. Here's what that looks like in practice and when it's worth adopting.
P.80AVIF and WebP now have near-universal browser support. Here's the image optimization stack that actually improves LCP scores in production in 2026.
P.81XState v5 ships a rewritten API that's smaller and easier to read than v4. Here's how state machines help in production UI, and what the migration looks like.
P.82Cursor's rules system encodes your team's architecture, naming, and coding standards into the AI's context, so every engineer gets consistent suggestions.
P.83Most web apps are missing four or five headers that would neutralize entire classes of attack. What each header does, what to set, and where defaults leave you exposed.
P.84Alpine.js adds dropdowns, modals, tabs and form behaviour straight in your HTML, with no build step and no framework. When that's exactly right.
P.85Deno 2 ships with full Node.js compatibility, npm support, and a revised standard library. Here's what that means for teams evaluating it as a serious Node alternative.
P.86TypeScript 5.0 replaced experimentalDecorators with the TC39 Stage 3 proposal: different syntax, more capable, now the standard way to write decorators.
P.87CSS @layer lets you set explicit priority between your reset, base, components, and utilities. Here's how cascade layers work in production stylesheets.
P.88ElysiaJS gives Bun APIs fast routing, TypeBox validation, and type inference that reaches the client with no codegen step. How it works and when to pick it.
P.89Redux is overkill for most React apps: Zustand and Jotai cover most state needs with far less boilerplate. Here is when to use each and how they actually work.
P.90An ADR captures why a technical choice was made, not just what. One page per decision, stored in the repo. Here's the format and how to make it stick.
P.91ESLint 9 made flat config the default and deprecated .eslintrc. Here's what changed, why it's better, and how to migrate without breaking your setup.
P.92Git hooks enforced by Lefthook, Husky, or lint-staged stop broken code and style violations before they reach CI. How to build a hook setup teams actually keep using.
P.93Choosing between react-i18next, next-intl, and Lingui comes down to your framework: next-intl for Next.js App Router, react-i18next elsewhere.
P.94Inngest handles background job scheduling, retries, and observability with no Redis or worker process to run. How it works, and when it beats BullMQ or Temporal.
P.95Three real authentication options for Next.js apps, with different trade-offs on control, cost, and setup time. Here's what each one actually involves.
P.96Rails 8 replaces Redis, Memcached, and Node with Solid Queue, Solid Cache, Solid Cable, and Kamal 2, so a single server and database can run production.
P.97Three viable paths to cross-platform mobile in 2026. Which one makes sense depends on your team, your deadlines, and how much of the device you actually need.
P.98The Date object has been broken for 30 years. Temporal is its replacement, now shipping in browsers and Node.js. Here's what actually changed and how to use it.
P.99Storybook 8 is faster and easier to configure than it was. More useful is the workflow shift: building in isolation makes components genuinely decoupled.
P.100WebGPU is now in Chrome, Firefox, and Safari: a general-purpose GPU compute layer, not just graphics, for ML inference, image processing, and simulation.
P.101Three different approaches to styling a web application — Tailwind, CSS Modules, and CSS-in-JS libraries — and the team contexts where each one actually makes sense.
P.102Manifest V3 changed how Chrome extensions work. What matters for developers today: service workers, declarativeNetRequest, and the gotchas nobody warns you about.
P.103CRDTs and sync engines make local-first apps feel instant and merge edits without conflicts. Here is how they work and whether your app actually needs them.
P.104CSS, Framer Motion, and GSAP each solve different animation problems in 2026. Here's how to pick the right one for your project and skip the rest.
P.105The View Transitions API and scroll-driven animations are now baseline in every major browser. Here's what they replace and working code for both.
P.106Sanity, Contentful, Strapi and Payload compared on the criteria that decide it: who edits the content, where it's hosted, and whether schema lives in git.
P.107A growing class of AI agent frameworks controls a browser like a human: clicking, typing, navigating. What works in production, and when to reach for it.
P.108Go has real strengths and real limitations for backend APIs. Here's what teams actually gain and give up choosing it over Node.js or Python in 2026.
P.109A hands-on comparison of Typesense, Meilisearch, and Algolia for production SaaS search: self-hosting, performance, pricing, and real implementation patterns.
P.110Building SaaS billing on Stripe means handling subscription plans, the Meter API for usage-based pricing, webhook reliability, and the Customer Portal.
P.111Zod is the standard for runtime type validation in TypeScript: one schema drives API contracts, form validation, and environment variables across your stack.
P.112A Playwright E2E suite that scales reuses auth state across tests, follows a folder structure built for growth, and configures CI to isolate real flakiness.
P.113Password resets and invoices are infrastructure. Here's how SPF, DKIM, DMARC, IP warmup, and bounce handling decide whether your email lands in the inbox or spam.
P.114Stripe's API now covers far more than checkout. This breaks down which Stripe products agencies actually need, which are overkill, and where teams get burned.
P.115Media queries ask how wide the viewport is. Container queries ask how wide the component's parent is. That shift changes how you build reusable components.
P.116If your design system needs to work in React, Vue, and a legacy jQuery app simultaneously, Web Components are the only native answer. Lit makes them practical to write.
P.117The implicit flow is dead and tutorials still teach it. How authorization code flow with PKCE works, where tokens belong, and where SPA auth goes wrong.
P.118Google's crawler runs JavaScript, but on a delay and with different limits than a browser. Here's where JS app SEO actually breaks, and how to test for it.
P.119PWAs got a second wind once iOS 16.4 enabled push notifications and iOS 17 improved install flow. The gap between PWA and native is now narrow enough to matter.
P.120AI SDK 7 replaces maxSteps with stopWhen: isStepCount(), renames system to instructions, and moves structured output into generateText. Working code for each.
P.121Hono started as a tiny router for Cloudflare Workers and became the default for edge APIs. What it does well, and why "runs everywhere" actually holds.
P.122Interaction to Next Paint replaced First Input Delay in 2024, and most sites still haven't caught up. Here's why INP is harder and how to actually fix it.
P.123Client state is easy. Server state, which lives on a backend and changes on its own, is where React apps make a mess. TanStack Query handles it cleanly.
P.124Position one element relative to another in pure CSS. No Popper.js, no positioning logic, no recalculation on scroll. How anchor positioning works.
P.125shadcn/ui is now the default starting point for React UIs. Here's what it actually is, why copy-paste beats npm install, and how to use it without accumulating a mess.
P.126Caching is high-leverage and consistently misunderstood. How Cache-Control and ETags actually work, why stale content happens, and how to design for it.
P.127URL versioning, header versioning, and content negotiation compared with real code. Here's how to pick one and retire old versions without stranding clients.
P.128Tailwind v4 moves configuration from JavaScript to CSS, drops the content array, and ships a faster engine. What the breaking changes mean for a real migration.
P.129OpenAPI-first API development means writing the spec before code, then generating server types, request validation, and client SDKs from it.
P.130Not every real-time feature needs WebSockets. Server-Sent Events handle most push scenarios with far less complexity. How to choose, with working code.
P.131Every public API needs rate limiting, but the algorithm you choose shapes the user experience and the failure modes. Here's how each approach works and when to use it.
P.132Passkeys are mainstream now, with native support from Apple, Google, and Microsoft. Here's what WebAuthn looks like in real code, and when to use it.
P.133Playwright E2E tests break because of fragile selectors, shared test state, or overly broad scope, not the tool itself. Fix those and tests survive UI changes.
P.134HTTP/3 is in production at every major CDN and supported by all modern browsers. Whether it actually helps your application depends on factors most guides don't explain.
P.135WebRTC makes video calls and live features possible, but production hits NAT traversal, signaling, and codec problems no demo ever shows you.
P.136The honest read on web developer demand after AI's impact, which roles are hot, which are cooling, and what the working week actually looks like across employment types.
P.137Real revenue, profit margins, and owner take-home for solo, boutique, mid-size, and enterprise web agencies, including the messy parts most income reports skip.
P.138Five different things people mean by 'update' (content, dependencies, performance, design, full rebuild) and how often each should actually happen.
P.139When proximity actually matters, when it doesn't, and how to evaluate local agencies without falling for the 'we have an office in your city' theatre.
P.140A practical framework for selecting an ecommerce website development agency, with checkout UX, speed, mobile conversion, and platform trade-offs.
P.141Astro's stable CSP hashes its scripts and styles into a per-page meta tag, with no nonces. How to set up security.csp in Astro 6 and 7, and where it stops.
P.142EditorPickLearn how to migrate to Next.js 16 with Turbopack as the default bundler, React Compiler integration, and cache components. Step-by-step guide with code examples.
P.143SvelteKit remote functions let components call typed server code without writing API routes. How they work in Svelte 5.49, with code and React comparisons.
P.144EditorPickTypeScript 6.0 is the last compiler written in JavaScript and the bridge to the Go-based TypeScript 7. Its new defaults, deprecations, and a safe upgrade order.
P.145Micro-frontends work when 4+ teams need independent deploys and fail when performance is the priority. We cover Module Federation 2.0 and real tradeoffs.
P.146EditorPickA deep dive into how we built codercops.com with Astro 5 SSR, Supabase as a CMS, Git-based content, and Edge Functions. Architecture decisions and lessons learned.
P.147A 16-package starter set for TypeScript projects: ESLint, Prettier, Vitest, Playwright, MSW, Zod, ky and more, with current versions and the packages to skip.
P.148CSS has changed more in the last 2 years than the previous 10. Here is what is production-ready, what to adopt now, and what you can stop using.
P.149The low-code market is projected to hit $264B by 2032, but that doesn't mean every app belongs on Bubble or Retool. A framework for knowing which is right for you.
P.150Web accessibility is legally required and ethically essential. Here's a practical guide to building accessible applications with WCAG 2.2 compliance.
P.151Run npx astro add cloudflare, build, then wrangler deploy. Static pages serve from Workers static assets; on-demand routes run in the Worker. Astro 7 setup.
P.152jQuery 4.0 shipped January 17, 2026, its first major version in a decade, and it still runs 77% of JS-powered websites. Here's what's new and who should upgrade.
P.153EditorPickAI-first web agencies build apps with built-in intelligence, like chatbots and predictive features, as one product instead of two disconnected teams.
P.154EditorPickChoose a web development agency by checking comparable work, who will build it, code ownership, performance and support terms. A checklist with red flags.
P.155Choosing a modern web app stack means weighing Next.js vs Astro vs Remix, SQL vs NoSQL, and Vercel vs AWS against your project's actual priorities, not trends.
P.156From $800 landing pages to $500K platforms, here is the real breakdown of web development costs in 2026 by project type, region, and complexity.
P.157Pick Astro for sites people read and Next.js for apps people operate. A decision guide for agency and marketing sites, checked against Astro 7 and Next.js 16.
P.158An $800 landing page gets you a custom design, responsive layout, lead form, and SEO basics. Here's the real breakdown by price point, with conversion data.
P.159EditorPickReact 19 shipped Server Components, Actions, a built-in compiler, and new hooks like useOptimistic and use(). Here's what changed and how to migrate.
P.160Step-by-step guide to configuring a complete full-stack development environment with Python, Django backend, and React frontend.