<p><strong>TLDR:</strong> WWDC26 is the dominant story today: Safari 27 beta lands with CSS Grid Lanes for native masonry layouts, a fully styleable native select element, and 525 bug fixes. On the security side, six CVEs in protobuf.js — including a remote code execution flaw — have patches available and deserve immediate attention given the library’s 50M weekly downloads. VS Code 1.123 adds a two-hour auto-update delay for extensions as a supply chain defense. Zero 1.0 also shipped, marking the first stable release of Rocicorp’s web sync engine after two years.</p>
<hr>
<h2>Safari 27 beta ships CSS Grid Lanes, customizable select, and 525 bug fixes</h2>
<p>Safari 27 is the biggest Safari release in recent memory — 58 new features and 525 bug fixes, which the WebKit team calls the largest fix count in recent history. The headline additions for frontend developers are CSS Grid Lanes (<code>display: grid-lanes</code>), which gives you masonry-style layouts in three lines of CSS without JavaScript, and <code>appearance: base-select</code> for fully styleable native select elements. Also shipping: scroll anchoring to prevent viewport jumps, WebAssembly JSPI for async interop, transform-aware anchor positioning, a rewritten ESM loader that fixes top-level await bugs, and the <code>&lt;model&gt;</code> HTML element expanding to iOS, iPadOS, and macOS. The Grid Lanes session from WWDC26 is worth watching if you’ve been waiting for native masonry. <a href="https://app.daily.dev/feed-by-ids?id=Cz81sVUy5&amp;id=uhPitKBPU&amp;id=STXXnBSo1&amp;id=wDz0YCSQg" target="_blank" rel="noopener nofollow">Read more</a></p>
<h2>protobuf.js RCE vulnerability (CVE-2026-44291) patched in 7.5.6 and 8.0.2</h2>
<p>Cyera disclosed six CVEs in protobuf.js, the JavaScript Protocol Buffers library with over 50 million weekly downloads. The worst one, CVE-2026-44291, lets attackers turn schema-derived data into executable code via JavaScript’s <code>Function()</code> constructor — full RCE inside Node.js processes. A separate CLI flaw (CVE-2026-44295) allows code injection through crafted schema names. The catch is that protobuf.js often arrives as a transitive dependency through gRPC tooling and Google Cloud libraries, so you may be exposed without knowing it. Patches are in protobuf.js 7.5.6 and 8.0.2, and protobuf.js-cli 1.2.1 or 2.0.2. Check your lock files. <a href="https://app.daily.dev/posts/sSMnsKxPA" target="_blank" rel="noopener nofollow">Read more</a></p>
<h2>VS Code 1.123 adds two-hour extension auto-update delay as supply chain defense</h2>
<p>VS Code now waits two hours before auto-applying extension updates, giving the ecosystem time to catch compromised releases before they land on developer machines. The delay applies to all publishers except Microsoft, GitHub, and OpenAI. You can still manually trigger updates immediately. This follows similar moves from RubyGems, Bun, npm, pnpm, and Yarn — time-based installation delays are becoming a standard layer in supply chain defense. <a href="https://app.daily.dev/posts/qA1dOnHqw" target="_blank" rel="noopener nofollow">Read more</a></p>
<h2>Zero 1.0 released — first stable version of Rocicorp’s web sync engine</h2>
<p>After two years and 50+ releases, Rocicorp has tagged Zero 1.0. Functionally it’s a minor update to 0.26.2 — the version bump is mostly symbolic — with the main addition being a schema change hook for Supabase that works around its missing event trigger support. Zero pairs a client library with a read-only Postgres cache and runs ZQL queries locally first, syncing authoritative results in the background. Community reception is warm on developer experience but cautious on production use: Postgres-only, no view syncing, a 718 KB uncompressed client bundle, and no SSR yet. Worth watching if you’re evaluating ElectricSQL, InstantDB, or PowerSync. <a href="https://app.daily.dev/posts/p3ihqDXLE" target="_blank" rel="noopener nofollow">Read more</a></p>
<hr>
<h2>Also notable</h2>
<ul>
<li><strong>Astro 6.4 ships Rust-based Markdown processor, cuts build times by over a minute:</strong> Astro 6.4 introduces a pluggable Markdown processor API with a Rust-based processor that removes over a minute from site builds, plus an updated Cloudflare adapter with experimental advanced routing. <a href="https://app.daily.dev/posts/7H0jTV911" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>WWDC26: Safari web extension packager no longer requires Xcode or a Mac:</strong> Safari 27 ships a new extension packager via App Store Connect that removes the Xcode and Mac requirement, with the resulting extension running across iOS, iPadOS, macOS, and visionOS. <a href="https://app.daily.dev/feed-by-ids?id=Oa43AazH9&amp;id=STXXnBSo1" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>GitHub cut Issues navigation from 1,200ms to 700ms using IndexedDB and stale-while-revalidate:</strong> GitHub’s engineering post details how they reduced Issues page navigation latency by combining IndexedDB caching, stale-while-revalidate, cache preheating, and a service worker. <a href="https://app.daily.dev/posts/553DB9Gdu" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>OpenTUI: React TUI library built on Zig and Bun with lower memory use than Ink:</strong> OpenTUI uses Bun’s FFI to bridge TypeScript to native Zig rendering, offering built-in flexbox via Yoga, no hard-coded FPS cap, and a useTimeline hook for animations — positioned as a direct Ink alternative. <a href="https://app.daily.dev/posts/dSYf9Z0oE" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>CSS @function stagger technique enables scroll-driven animations from a single progress value:</strong> A Frontend Masters post demonstrates using the new CSS <code>@function</code> rule with <code>sibling-index()</code> and <code>clamp()</code> to drive staggered animations from one shared progress value, compatible with scroll-driven animations and keyframes. <a href="https://app.daily.dev/posts/1FvBhIWqV" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>


Frontend development news, CSS techniques, framework updates, and browser API changes.

Web Digest

A developer news roundup covering several major stories: Safari 27 beta arrives with CSS Grid Lanes for native masonry layouts, a styleable native select element, and 525 bug fixes. Six CVEs in protobuf.js (50M weekly downloads) include a critical RCE flaw via JavaScript's Function() constructor — patches are available in versions 7.5.6 and 8.0.2. VS Code 1.123 introduces a two-hour auto-update delay for extensions as a supply chain defense measure. Zero 1.0 marks the first stable release of Rocicorp's web sync engine. Also notable: Astro 6.4 ships a Rust-based Markdown processor cutting build times significantly, GitHub reduced Issues navigation latency from 1,200ms to 700ms using IndexedDB, and new CSS @function stagger techniques for scroll-driven animations.

Safari 27 ships masonry layout and customizable select, protobuf.js RCE patched