--- title: "Angular 22 goes zoneless by default, polyfill.io resurfaces with login prompt attacks" url: https://daily.dev/posts/angular-22-goes-zoneless-by-default-polyfill-io-resurfaces-with-login-prompt-attacks-wtzsrhysj source_url: https://daily.dev/posts/angular-22-goes-zoneless-by-default-polyfill-io-resurfaces-with-login-prompt-attacks-wtzsrhysj type: freeform source: "Web Digest" published: 2026-06-06T04:18:35.854Z updated: 2026-06-06T04:18:54.349Z tags: ["security", "webdev", "typescript", "angular", "vite"] reading_time: 5 upvotes: 2 comments: 1 language: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Angular 22 goes zoneless by default, polyfill.io resurfaces with login prompt attacks **[Web Digest](https://daily.dev/sources/webdev_digest)** · 5 min read · 2 upvotes · 1 comments ## Summary Angular 22 ships with zoneless change detection on by default, Signal Forms stable, and Vitest replacing Karma as the default test runner. The polyfill.io supply chain attack domain is active again, now serving HTTP 401s that trigger browser login prompts on sites like Toshiba, Samsung, and Muji that never removed the old script tag. TypeScript's Go-based compiler (TSGO) is available in preview, cutting a 97-second VS Code build to ~10 seconds via native execution and shared-memory parallelism. The Cloudflare/VoidZero acquisition continues to generate community discussion around Vite's future. Also notable: Expo SDK 56 cuts Android cold start by 40%, TypeORM 1.0 releases after nearly a decade, Chrome 150 beta ships PWA origin migration and IndexedDB on SQLite, React 19 upgrade reverted in Gutenberg, and SvelteKit drops RAM usage from ~500MB to ~30MB versus Next.js. ## Content **TLDR:** Angular 22 is out with zoneless change detection on by default, Signal Forms stable, and Vitest replacing Karma — a genuinely significant release for Angular shops. The polyfill.io supply chain attack from 2024 is active again: the domain started responding with HTTP 401s in late May, triggering browser login prompts on Toshiba, Muji, Samsung, and other sites that never cleaned up the old script tag. Cloudflare's VoidZero acquisition is getting more coverage today, with community reaction ranging from cautious optimism to concern about long-term vendor influence. TypeScript's Go-based compiler (TSGO) is available in preview now, dropping a 97-second VS Code build to about 10 seconds. --- ## Angular 22 ships zoneless by default, Signal Forms stable, Vitest replaces Karma Angular 22 makes ChangeDetectionStrategy.OnPush the default for all new components and drops Zone.js from the default setup — a migration tool handles existing apps. Signal Forms are now stable, replacing Reactive Forms with a signal-native model. Vitest is the new default test runner, replacing Karma/Jasmine. Other additions worth noting: incremental hydration is now the default for SSR, httpResource and rxResource provide declarative async data fetching, and Angular Aria ships stable with headless accessibility primitives. Angular Material dialogs also gain direct component bindings, eliminating the MAT_DIALOG_DATA injection workaround. [Read more](https://app.daily.dev/feed-by-ids?id=TPdETu6WA&id=3zDYpVWvU) ## Polyfill.io domain reactivated, serving HTTP 401s that trigger browser login prompts The polyfill[.]io domain — seized in the 2024 supply chain attack when a Chinese entity injected malicious scripts into over 100,000 sites — went active again in late May 2026. It's now responding with HTTP 401 authentication challenges, causing browsers to display login prompts on any site that still loads the old script. Toshiba, Muji, Zojirushi, FiNC Technologies, and Samsung Smart TV sites are confirmed affected. No credential theft has been confirmed yet, but the attack surface is real: users who enter credentials into those unexpected prompts are at risk. If you haven't audited your dependencies for polyfill.io references, now is the time. [Read more](https://app.daily.dev/posts/ppl2wCqf7) ## TypeScript Go compiler preview cuts a 97-second VS Code build to 10 seconds The TypeScript team's Go rewrite (TSGO, shipping as TypeScript 7.0) is available now via `npm install @typescript/native-preview`, with a VS Code extension in the marketplace. The speedup comes from native execution and shared-memory parallelism across all CPU cores — the live demo on the VS Code codebase showed a full build dropping from roughly 97 seconds to about 10 seconds. VS Code, Slack, Notion, and Figma are already running it, and one Microsoft team reported saving 400 CI hours per month. The port used automated scripts and AI agents to translate the codebase file by file, reusing existing tests throughout. [Read more](https://app.daily.dev/posts/A5w77sEDG) ## Cloudflare/VoidZero acquisition: community reaction and what changes for Vite The Cloudflare acquisition of VoidZero is generating continued discussion today. The concrete commitments: $1M ecosystem fund administered by the Vite core team, all tools stay MIT-licensed, and Vite becomes the foundation for Cloudflare's unified CLI (cf dev as a superset of vite dev). Vite is at ~129M weekly downloads. Developer reaction is split — Cloudflare's track record with Astro is cited as a positive precedent, while the BastionZero shutdown gets raised as a counterexample. This is covered in the previous digest but the community conversation is still active and worth watching. [Read more](https://app.daily.dev/feed-by-ids?id=OWxEbcxOB&id=zm5JNJI3T&id=hl5O5iaLH) --- ## Also notable - **Expo SDK 56 cuts Android cold start 40%, ships Expo Observe in public beta:** Expo SDK 56 brings 40% faster Android cold start times via pre-compiled binaries, and Expo Observe — a new open source production performance monitoring library — is in public beta, free for up to 10,000 MAU for at least three months, tracking launch time, bundle load time, and time-to-interactive per screen. [Read more](https://app.daily.dev/posts/2CM18IrEZ) - **TypeORM 1.0 released after nearly a decade, requires Node.js 20+:** TypeORM's first major release since 2016 merges 575 PRs, drops heavy dependencies, upgrades the compile target to ES2023 (Node.js 20+ required), adds INSERT INTO ... SELECT and RETURNING clause support, and ships a codemod for migrating from 0.3.x. [Read more](https://app.daily.dev/posts/XLLvkfXOc) - **Chrome 150 beta: PWA origin migration, IndexedDB on SQLite, flex-wrap:balance:** Chrome 150 beta ships PWA Origin Migration (move installed PWAs to a new origin without user reinstall via a two-way manifest handshake), rewrites IndexedDB on SQLite, and adds flex-wrap:balance, comma-separated container queries, and text-fit for responsive typography. [Read more](https://app.daily.dev/feed-by-ids?id=WooQsgMsV&id=7409N8Oyh) - **React 19 upgrade reverted in Gutenberg after plugin breakage:** The WordPress core team rolled back the React 19 upgrade in Gutenberg 23.3.0 after discovering widespread plugin breakage, and is investigating compatibility issues before re-attempting the migration. [Read more](https://app.daily.dev/posts/yyqdzNzKE) - **SvelteKit drops Next.js instances from ~500MB to ~30MB RAM in production:** Lesse Studio's rebuild replaced Next.js with SvelteKit and Bun, dropping per-instance RAM from ~500MB to ~20MB, running the full frontend, SSR, and a custom CMS backed by Drizzle ORM on SQLite as a single process. [Read more](https://app.daily.dev/posts/QJAfLmleX) --- Tags: [#security](https://daily.dev/tags/security), [#webdev](https://daily.dev/tags/webdev), [#typescript](https://daily.dev/tags/typescript), [#angular](https://daily.dev/tags/angular), [#vite](https://daily.dev/tags/vite) [View this post on daily.dev](https://daily.dev/posts/angular-22-goes-zoneless-by-default-polyfill-io-resurfaces-with-login-prompt-attacks-wtzsrhysj)