Connection Allowlists: A Firewall Inside the Browser
Chrome 152 shipped Connection Allowlists on August 25, 2026: one HTTP header declares where your page may connect, and the browser blocks the rest.
Blog
Node.js 26.8 Ships Native ZIP in node:zlib
Node.js 26.8.0 adds native ZIP read/write to node:zlib via ZipFile, ZipEntry and ZipBuffer — one less dependency, with real caveats to watch.
Kitesurf: Cloudflare's Browser Built for AI Agents
Cloudflare's Kitesurf is an agent-first browser running in V8 isolates on Workers — 3–7x less CPU and memory than Chromium.
Agent Plugins 1.0: One Package for Skills and MCP
Agent Plugins 1.0 hit GA in VS Code and Copilot CLI on August 12, 2026 — one portable package for agent skills and MCP servers. What it standardizes.
Node.js 26.7.0 Adds Perfetto Tracing Support
Node.js 26.7.0 adds Perfetto tracing: protobuf .pftrace files instead of legacy JSON trace events. What changed, how to build it, and the caveats.
npm Worm Plants Hooks in Your AI Coding Agent
An npm worm hit keyv and 400+ packages on August 4, 2026 — and planted SessionStart hooks in .claude/settings.json. What to check and pin.
Node.js 26.6: TCP Sockets Move to Worker Threads
Node.js 26.6.0 makes net.Server and net.Socket transferable to worker threads — real parallelism in one process, no IPC tax. Here are the caveats.
WebMCP: Turn Your Website Into Agent Tools
Since Chrome 149, WebMCP lets your page declare callable tools to AI agents instead of being guessed at. Code examples, plus the real caveats.
Import-Time npm Malware Bypasses --ignore-scripts
July 2026's npm attacks run at import time, not install time — so --ignore-scripts and install-script blocking no longer stop them. Here's what does.
Node.js Fixes 10 CVEs, 4 in the Permission Model
Node.js shipped 22.23.2, 24.18.1 and 26.5.1 on July 29, 2026, closing 10 CVEs — four in the permission model. What to patch and what to stop assuming.
x402: HTTP 402 Is Finally a Real Payment Protocol
The Linux Foundation launched x402 with 40 members on July 14, 2026. How HTTP 402 became a real payment handshake for AI agents and paid APIs.
Oxlint Type-Aware Linting Goes Stable: 12× Faster
Oxlint type-aware linting is stable: 59 of 61 typescript-eslint rules, 12× faster on VS Code, powered by the tsgolint engine built on TypeScript 7.
npm 12: Install Scripts Are Opt-In Now
npm 12 disabled install scripts by default on July 8, 2026. A practical migration guide: approve-scripts, the allowlist, and what breaks in CI.
PostgreSQL 19: Less Application Code, More SQL
PostgreSQL 19 Beta 2 landed July 16, 2026: single-trip upsert reads, read-your-writes on replicas, and standard temporal updates — less app code.
Next.js July 2026 Security Release: 9 CVEs Patched
Next.js shipped its first scheduled security release on July 20, 2026: 9 CVEs patched, including a middleware bypass and SSRF. What changed and how to upgrade.
Temporal Lands in ES2026: JavaScript Dates, Fixed
In March 2026 Temporal reached Stage 4 and joined ES2026: immutable types, time zones from the ground up, and duration math with no libraries. What changed, and how to adopt it safely.
MCP 2026-07-28: Real Auth for AI Agents
The MCP 2026-07-28 spec makes agent auth real: OAuth 2.1 resource servers, RFC 8707 audience-bound tokens, and CIMD. What changes, and how to prepare.
TypeScript 7: A Native Compiler, 10× Faster
TypeScript 7.0 hit GA on July 8, 2026: a native compiler rewritten in Go that builds 10× faster. What changed, the caveats, and how to upgrade safely.
QUERY: HTTP's first new method in years
RFC 10008 (June 2026) adds QUERY — a request that's safe and cacheable like GET, but carries a body like POST. What gap does it close, and when should you actually use it?