<p><strong>TLDR:</strong> Angular v22 promotes Signal Forms, Angular Aria, and async resource APIs to stable, and adds a @Service decorator to replace the verbose @Injectable pattern. A security researcher published a working one-click exploit for github.dev that steals full GitHub OAuth tokens via a malicious Jupyter notebook — no patch is available yet. The HTTP/2 Bomb DoS attack, discovered by OpenAI’s Codex agent, can exhaust 32 GB of server RAM in 20 seconds from a single machine; nginx 1.29.8 and Apache mod_http2 2.0.41 have patches but IIS and Envoy do not. Node.js is moving to one major release per year starting with Node 27 in October 2026, with every release becoming LTS.</p>
<hr>
<h2>Angular v22 promotes Signal Forms, Angular Aria, and async APIs to stable</h2>
<p>Angular v22 is out with three features graduating to stable: Signal Forms (reactive, composable forms that replace both reactive and template-driven approaches), Angular Aria (12 accessible UI primitives), and the async reactivity APIs — resource and httpResource for declarative data fetching. The release also ships a new @Service decorator to replace @Injectable({providedIn:‘root’}), injectAsync for lazy-loading services with code splitting, and OnPush as the default change detection strategy for new apps. Template syntax gains arrow functions, spread syntax, multi-case @switch matching, and exhaustive switch checks. Webpack support is deprecated in favor of the TSGo-based builder. <a href="https://app.daily.dev/posts/rUxCOsGKd" target="_blank" rel="noopener nofollow">Read more</a></p>
<h2>github.dev zero-day: one-click OAuth token theft via malicious Jupyter notebook</h2>
<p>A security researcher published a working exploit for github.dev that steals a victim’s full GitHub OAuth token — read/write access to all private repositories — in a single click. The attack chains a malicious Jupyter notebook markdown cell with injected JavaScript, postMessage-based simulated keystrokes to bypass publisher trust checks, and a local workspace extension that installs an attacker-controlled extension and exfiltrates the token. No CVE has been assigned and no complete patch is available. Mitigation right now is clearing cookies and local site data for github.dev, auditing .vscode/extensions folders, and avoiding unfamiliar github.dev links. <a href="https://app.daily.dev/feed-by-ids?id=mfJ7Z99Ko&amp;id=ToUNnEovz&amp;id=BJvyHcT2P&amp;id=DG7cfN1YN" target="_blank" rel="noopener nofollow">Read more</a></p>
<h2>HTTP/2 Bomb: single client exhausts 32 GB server RAM in 20 seconds, patches out for nginx and Apache</h2>
<p>A new DoS technique called HTTP/2 Bomb combines HPACK compression amplification with HTTP/2 flow-control stalling to exhaust server memory from a single 100 Mbps connection. Against Apache httpd and Envoy, one client can consume 32 GB of RAM in roughly 20 seconds. The attack works against default HTTP/2 configurations of nginx, Apache, IIS, Envoy, and Cloudflare Pingora. Patches are available for nginx 1.29.8 and Apache mod_http2 2.0.41 (CVE-2026-49975), but IIS, Envoy, and Pingora remain unpatched. Mitigations include disabling HTTP/2, routing through a CDN or reverse proxy, and enforcing hard header-count limits. <a href="https://app.daily.dev/posts/u9xAtKOl2" target="_blank" rel="noopener nofollow">Read more</a></p>
<h2>Node.js moves to one major release per year starting with Node 27</h2>
<p>Starting with Node 27 in October 2026, Node.js is dropping to one major release per year, and every release will become LTS — eliminating the odd/even versioning split where odd-numbered versions were short-lived and rarely adopted in production. A six-month Alpha channel replaces the current early-testing window, and version numbers will align with the calendar year of their initial Current release. LTS support windows stay at roughly 30 months. The change was driven by maintainer burnout from managing multiple concurrent release lines and backporting fixes for versions with minimal real-world adoption. <a href="https://app.daily.dev/posts/kyUQjAzOC" target="_blank" rel="noopener nofollow">Read more</a></p>
<hr>
<h2>Also notable</h2>
<ul>
<li><strong>Chrome 149: CSS gap decorations, bfcache WebSocket fix, Intl.Locale variants:</strong> Chrome 149 ships CSS gap decorations for styling grid and flexbox gaps without hacks, fixes WebSocket connections blocking bfcache entry (the browser now proactively closes them, enabling instant back/forward navigation), and completes cross-browser support for Intl.Locale.prototype.variants. <a href="https://app.daily.dev/posts/oMNbeUTCy" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Chrome 149 DevTools: MCP server stable at v1.1.1, Gemini 3 in AI assistance panel:</strong> The DevTools for agents MCP server and CLI hit stable at v1.1.1 with custom third-party tool support and WebMCP debugging; the AI assistance panel gets widget-based responses, Lighthouse integration, and a ‘Copy to coding agent’ button powered by Gemini 3. <a href="https://app.daily.dev/posts/mKIYWeyy1" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>React ecosystem: React Router ships 7 CVEs including RCE, TanStack Form 1.33 adds FormGroup API:</strong> This Week in React #284 flags critical security patches for React Router and Remix covering 7 CVEs including RCE, CSRF, and XSS — update immediately; TanStack Form 1.33 ships the new FormGroup API, and the React Compiler Rust port is nearing merge. <a href="https://app.daily.dev/posts/vVzhKro2W" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Hallmark v1.1: 4 new themes and a Custom mode for AI-generated UIs:</strong> Hallmark v1.1 adds 4 new themes (Carnival, Lumen, Hum, Cobalt), hand-built SVGs and animations, and a Custom mode that generates fully custom pages from scratch while still passing its anti-slop quality gates — installable via npx skills add nutlope/hallmark. <a href="https://app.daily.dev/posts/jOhInggH2" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>CSS @function lands in Chrome 148 with typed parameters and cascade support:</strong> The experimental CSS @function at-rule ships in Chrome 148, letting you define reusable custom CSS functions with typed parameters, default values, return types, and support for @media and @container inside the function body — circular dependencies are caught and invalidated by the browser. <a href="https://app.daily.dev/posts/VKoFgouTS" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>


Frontend development news, CSS techniques, framework updates, and browser API changes.

Web Digest

Angular v22 promotes Signal Forms, Angular Aria, and async resource APIs to stable, adds a @Service decorator, and deprecates Webpack in favor of a TSGo-based builder. A security researcher published a working one-click exploit for github.dev that steals full GitHub OAuth tokens via a malicious Jupyter notebook — no patch is available yet. A new DoS technique called HTTP/2 Bomb can exhaust 32 GB of server RAM in 20 seconds from a single machine; nginx 1.29.8 and Apache mod_http2 2.0.41 have patches but IIS and Envoy do not. Node.js is moving to one major release per year starting with Node 27 in October 2026, with every release becoming LTS. Also covered: Chrome 149 CSS gap decorations, React Router CVEs including RCE, and CSS @function landing in Chrome 148.

Angular v22 ships Signal Forms stable, github.dev OAuth token exploit goes public