<p><strong>TLDR:</strong> Prisma Next benchmarks show ~50% higher peak throughput and a 9x smaller bundle than Prisma 7, with p95 latency dropping from 41.8ms to 4.4ms under load. npm v12’s July arrival gets more concrete: four named supply chain incidents — Nx s1ngularity, Shai-Hulud worm, axios hijack, and Mini Shai-Hulud — all exploited install scripts, and npm 11.16.0 lets you audit your exposure now. Phoenix LiveView 1.0.2 ships colocated CSS with optional @scope support. Zero 1.0, Rocicorp’s sync engine, hits stable after two years.</p>
<hr>
<h2>Prisma Next benchmarks: 50% faster, 9x smaller bundle than Prisma 7</h2>
<p>Prisma Next, the TypeScript-native rewrite, hits ~12,500 req/s peak versus ~8,300 for Prisma 7, and closes the gap with the raw pg driver from 58% to 87% of its throughput. The more striking number is p95 latency at high concurrency: 4.4ms versus 41.8ms. Bundle size drops from 1.32MB to 148.5KB gzipped, which matters a lot for serverless and edge. It’s still Early Access — Prisma 7 is the production recommendation — but these numbers make the migration case pretty clear once it stabilizes. <a href="https://app.daily.dev/posts/SSSzV40UK" target="_blank" rel="noopener nofollow">Read more</a></p>
<h2>npm v12 supply chain context: four named incidents, one fix</h2>
<p>The upcoming npm v12 change to opt-in install scripts now has named incidents behind it: Nx s1ngularity, Shai-Hulud worm, axios hijack, and Mini Shai-Hulud all ran malicious code during npm install without the user ever importing the compromised package. npm 11.16.0 is available now with advisory-mode warnings so you can run npm approve-scripts and audit your allowlist before July. Git and remote-URL dependencies are also blocked by default in v12. If you maintain a package that ships install scripts, start thinking about prebuilt binaries. <a href="https://app.daily.dev/feed-by-ids?id=v9aauCCWH&amp;id=VgjUjSS9s&amp;id=G6Wf3GIB6" target="_blank" rel="noopener nofollow">Read more</a></p>
<h2>Phoenix LiveView 1.0.2 ships colocated CSS with optional scoping</h2>
<p>LiveView 1.0.2’s headline feature is Colocated CSS — write CSS directly inside HEEx component templates, with optional CSS @scope for isolation. Getting there required splitting HEEx template compilation into separate tokenization and parsing steps, which is a meaningful internal refactor. The release also adds a TagFormatter behaviour for running Prettier on script and style tags during mix format, JSON encoding for LiveView.JS structs, and granular test warning configuration. If you’re on LiveView, this one’s worth reading the changelog carefully. <a href="https://app.daily.dev/posts/QYFR7VFn8" target="_blank" rel="noopener nofollow">Read more</a></p>
<h2>WebMCP origin trial opens in Chrome 149</h2>
<p>Chrome 149 starts an origin trial for WebMCP, Google’s proposed standard for exposing website capabilities as structured tools for in-browser AI agents. The two APIs — a declarative HTML-attribute approach and an imperative registerTool() function — let agents call defined actions instead of scraping the DOM or guessing at element positions. It’s early and Chrome-only for now, but if you’re building anything that agents might interact with, this is the spec to watch. Feedback goes to GitHub. <a href="https://app.daily.dev/feed-by-ids?id=mxmntAVri&amp;id=nQjKLYDAC" target="_blank" rel="noopener nofollow">Read more</a></p>
<hr>
<h2>Also notable</h2>
<ul>
<li><strong>Zero 1.0 stable: Rocicorp’s sync engine ships after two years:</strong> Rocicorp released Zero 1.0, the first stable version of its client-server sync engine, with a schema change hook for Supabase and multiple bug fixes. <a href="https://app.daily.dev/posts/mkNIvSXNQ" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>headingoffset is not the Document Outline Algorithm revival:</strong> Firefox’s new headingoffset HTML attribute manually offsets heading levels for content reuse but gives browsers no new structural understanding — misusing it risks WCAG violations, and authors should wait for confirmed cross-browser support before shipping it. <a href="https://app.daily.dev/posts/ixQmdWm36" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>VS Code team: Claude Opus raised agent code survival rate from 55% to 86%, tripling issue volume:</strong> The VS Code team found switching from GPT-4.1 to Claude Opus pushed agent code survival rates from 55% to 86%, but the resulting 3x increase in issues and PRs forced a complete rethink of their planning and CI systems. <a href="https://app.daily.dev/posts/xZlMuLSgD" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Astro 3-to-6 migration: 44% faster builds, 96-98% less JS, one production outage:</strong> A documented Astro 3-to-6 upgrade using Claude as the primary assistant measured 44% faster builds and up to 98% less JS on course pages, with a production outage caused by PKCE auth flow breakage during the Server Islands migration. <a href="https://app.daily.dev/posts/LzejUKvdk" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Commander.js 15.0 goes ESM-only, Cucumber.js 13.0 rebuilds parallel runtime on worker threads:</strong> Node Weekly 628 flags Commander.js 15.0 as ESM-only and Cucumber.js 13.0 as a parallel runtime rebuild on worker threads — both breaking changes worth checking before your next dependency update. <a href="https://app.daily.dev/posts/G6Wf3GIB6" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>


Frontend development news, CSS techniques, framework updates, and browser API changes.

Web Digest

A developer news roundup covering several notable releases and updates. Prisma Next benchmarks show ~50% higher throughput, 9x smaller bundle size, and p95 latency dropping from 41.8ms to 4.4ms compared to Prisma 7. npm v12's upcoming opt-in install scripts change is contextualized with four named supply chain incidents (Nx s1ngularity, Shai-Hulud worm, axios hijack, Mini Shai-Hulud), all exploiting install scripts; npm 11.16.0 is available now for auditing exposure. Phoenix LiveView 1.0.2 ships colocated CSS with optional @scope support. Zero 1.0, Rocicorp's sync engine, reaches stable. Also covered: Chrome 149 WebMCP origin trial, VS Code team's Claude Opus agent findings, Astro 3-to-6 migration results, and Commander.js/Cucumber.js breaking changes.

Prisma Next hits 50% faster throughput, npm v12 supply chain details sharpen