<p><strong>TLDR:</strong> Bun’s next release trims 8 MB of startup memory on Linux, with larger gains for long-running processes. Apple’s Safari MCP server from Technology Preview 247 is getting real scrutiny from the community — the official tool covers the basics, but a community alternative already ships 96 tools with auth and cookie access. The AI-generated web is now a measurable problem: 74% of new pages are AI-written and automated traffic crossed 51% of all web traffic. Authentication patterns are worth revisiting too, with a solid writeup on the BFF pattern and Chrome’s Device Bound Session Credentials.</p>
<hr>
<h2>Bun’s next version uses 8 MB less memory at startup on Linux</h2>
<p>The upcoming Bun release cuts 8 MB from baseline memory usage on Linux at startup, and the gains are larger for long-running applications. This applies to anything using the runtime or <code>bun test</code>, so CI pipelines and containerized workloads both benefit. A Bun v1.4 release post is also reportedly coming Tuesday with an accompanying video. <a href="https://daily.dev/feed-by-ids?id=jCbwcoQ4L&amp;id=yT6totDyY" target="_blank" rel="noopener nofollow">Read more</a></p>
<h2>Safari MCP server: what the official tool covers and where it falls short</h2>
<p>Apple’s official Safari MCP server in Technology Preview 247 exposes 17 WebDriver-based tools — navigation, DOM inspection, element interaction, network capture, console output, and screenshots — all running locally via safaridriver with no data sent to Apple. The gaps are real though: no headless mode, no performance profiling, no Lighthouse audits, and no access to real browser sessions or cookies. A community alternative called safari-mcp fills some of those holes with 96 tools on stable Safari, including auth and network mocking. Worth treating as complementary to Chrome DevTools MCP rather than a replacement. <a href="https://daily.dev/posts/mQPujp7fU" target="_blank" rel="noopener nofollow">Read more</a></p>
<h2>74% of new web pages are AI-generated, automated traffic now exceeds human traffic</h2>
<p>Data from Ahrefs, Graphite, Imperva, and NewsGuard puts AI-generated content at 74% of new web pages, with automated traffic crossing 51% of all web traffic. AI content farm sites have grown 60-fold since 2023, and writing projects on Upwork are down 32% year-over-year. <a href="http://WordPress.com" target="_blank" rel="noopener nofollow">WordPress.com</a> formalized this in March 2026 by letting AI agents autonomously publish entire sites via MCP. The model collapse risk — AI trained on AI output producing increasingly degraded results — is the longer-term concern, and content provenance standards like C2PA exist but rely on voluntary adoption. <a href="https://daily.dev/posts/nh2Qw4AFm" target="_blank" rel="noopener nofollow">Read more</a></p>
<h2>Modern authentication patterns: BFF, httpOnly cookies, and Chrome’s DBSC</h2>
<p>A thorough walkthrough of authentication security covers the full progression from localStorage JWT storage through in-memory tokens, httpOnly cookies with CSRF defenses, and OAuth refresh token rotation. The practical recommendation is to store sessions in httpOnly cookies backed by a server-side session store, and for OAuth flows to move all token handling behind a Backend for Frontend so the browser never holds tokens directly. Chrome’s Device Bound Session Credentials (DBSC) get a mention as a hardware-level defense against the infostealer/pass-the-cookie threat that’s increasingly relevant. React-specific code for collapsing concurrent refresh requests into a single in-flight promise is included. <a href="https://daily.dev/posts/7ihO9Es5Q" target="_blank" rel="noopener nofollow">Read more</a></p>
<hr>
<h2>Also notable</h2>
<ul>
<li><strong>Opera 1.92 ships Paste Protect to block ClickFix clipboard attacks:</strong> Opera’s new Paste Protect feature scans clipboard content for malicious patterns on Windows, macOS, and Linux, blocking ClickFix-style attacks that trick users into pasting and executing malware commands — enabled by default with a developer whitelist option for trusted sites like GitHub. <a href="https://daily.dev/posts/cQVfnX96q" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Brave 1.92 adds built-in tab Containers with four default categories:</strong> Brave 1.92 introduces cookie and site data isolation per tab via Containers, shipping four default categories (Personal, Work, Social, School) plus custom and temporary options — force-enableable now via brave://flags for users already on 1.92. <a href="https://daily.dev/posts/AtcykVHvO" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Self-hosted LogRocket alternative runs on a $6 VPS using rrweb and pgvector:</strong> Rewind is an open-source session replay platform using rrweb, BullMQ, Redis, PostgreSQL with pgvector for semantic search, and Drizzle ORM — deployable with one Docker Compose command on a $6 VPS as a full LogRocket replacement. <a href="https://daily.dev/posts/x5p4shDWZ" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>DeepSeek cached input pricing at $0.01/M tokens can undercut Gemini for high-volume structured tasks:</strong> A cost comparison with a full Node.js benchmarking service shows DeepSeek’s $0.01/M cached input rate undercutting Gemini 2.0/2.5 Flash for high-volume structured workloads, though Gemini holds advantages at base rates and for complex reasoning — with GDPR/HIPAA compliance flagged as a blocker for DeepSeek in regulated environments. <a href="https://daily.dev/posts/xYmSrWQg6" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>


Frontend development news, CSS techniques, framework updates, and browser API changes.

Web Digest

Bun's next release trims 8 MB of startup memory on Linux, with larger gains for long-running processes. Apple's Safari MCP server from Technology Preview 247 is getting real scrutiny from the community — the official tool covers the basics, but a community alternative already ships 96 tools with auth and cookie access. The AI-generated web is now a measurable problem: 74% of new pages are AI-written and automated traffic crossed 51% of all web traffic. Authentication patterns are worth revisiting too, with a solid writeup on the BFF pattern and Chrome's Device Bound Session Credentials.

Bun cuts 8 MB startup memory, Safari MCP server gets a deeper look