TypeScript gets ported again, a week of security patches, and more Interop 2027 picks

Cloudflare and VoidZero put their weight behind a Rust port of the TypeScript compiler, one of four ports in a few weeks. React, Next.js and PHP all patched remote code execution flaws, and OpenCode leaked API keys. People kept sharing their Interop 2027 rankings, and CSS got native masonry, random() and progress() write-ups. This page also catches up on six posts from last week that reached us late. 80 posts from 37 sources.

TypeScript's forking season

JavaScript Weekly leads with tsrs, Cloudflare and VoidZero's Rust port of the Go-based TypeScript 7 compiler, built with some input from the TypeScript team and heading into Oxc. Benchmarks claim up to 8x the speed of TypeScript 7.0, and it runs in WebAssembly. It's experimental, but npx tsrs works. Max Schwenk started the port with agents writing the code, and it took his company's typecheck from 80 seconds to 7.

Bytes explains why everyone is porting the compiler. TypeScript 7's native binary made it faster, but tools that used its old JavaScript API now have to talk to it over a client/server protocol. Bytes counts four ports:

• ts-rust, Theo's experimental port, type-checks the VS Code codebase in 4.8 seconds, against 9.6 seconds for the Go version.
• bun check embeds a port in Bun: 3–6.4x faster type checks with 2.2–4.9x less memory, in Bun's benchmarks.
• tsc-ts from Vercel Labs moves the compiler back to TypeScript and compiles it to native code with scriptc, with performance similar to the Go version.
• tsrs, which the VoidZero team plans to merge with Theo's port.

TypeScript 7.1 itself is in beta, with a programmatic API to build devtools on (This Week In React). React Status says type-checking MUI's docs is 1.9x faster and uses half the memory.

A week of security patches

• React and Next.js: an unauthenticated remote code execution flaw in React Server Components is patched in React 19.3.1 and the 19.0.9, 19.1.10 and 19.2.9 backports, along with a Server Functions DoS (This Week In React). Next.js patched two critical RCEs, one in use cache functions through the React bug and one in the image optimizer's SVG handling. Upgrade to 16.4.1 or 15.5.28: a public proof of concept is out (React Status).
• PHP: two flaws allow remote code execution without authentication on servers running PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP or LiteSpeed. The fixes are in 8.2.35, 8.3.36, 8.4.27 and 8.5.12, and the flaws were found with help from GPT-5.6 Sol and Gemini (midudev, in Spanish).
• OpenCode: a breach exposed OpenAI, Anthropic and Google API keys belonging to 1.4% of its users (midudev, in Spanish). The PrimeTime covers it too in OpenCode got hacked.
• Node.js: security releases for the 26.x, 24.x and 22.x lines were due on 21 October, with the most severe issue rated high (JavaScript Weekly).

Theo calls it "an unprecedented day in software history", where everything seems to have been hacked.

Interop 2027 picks, continued

Frontend Focus rounds up the rankings people shared. Its pick to start with is Josh Comeau's The Future of CSS: his top ten, from CSS functions and corner-shape to anchored container queries and scroll-triggered animations, each with live demos, current support and tips you can use today.

• Declan Chidlow ranks SVG improvements first, then the reading-flow and reading-order properties. Stuart Robson, Eric Meyer, Ana Rodrigues and Tyler Sticka shared picks too.
• To join in, rank about ten proposals: the Firefox team says that's enough to be useful.
• The State of HTML 2026 survey is open as well, covering Web Components, progressive enhancement and AI, in under 15 minutes.

CSS

Andy Bell walks through native masonry with display: grid-lanes, from Rachel Andrew's 2017 CSSWG issue and Tab Atkins-Bittner's Grid hack (which needed every item's height in advance) to how grid lanes work.

• random() from CSS Values and Units Level 5 has shipped in Safari and is rolling out in Chrome 156. Smashing Magazine tries it on playful demos: organic typography, bouncing letters, splayed cards and a punk fanzine.
• Kevin Powell replaces clamp() magic numbers with the new progress() function for fluid type, and shows the tan(atan2()) trick that does the same in every browser today.
• Seokho Song added ::highlight(*) to the specs and to Chromium, so one rule can style every custom highlight. It ships in Chrome 158.
• Temani Afif builds range sliders with custom shapes and tooltips without JavaScript, using border-shape, shape(), scroll-driven animations and @property.
• In Chris' Corner, Jason Santa Maria says "CSS finally gave the web its own grain", and Project Wallace's data shows about 10% of sites using @container queries.
• Shop Talk Show episode 737 covers alpha() and color-mix(), SVG features, Interop voting and detecting overlapping elements with CSS.

Browsers and the platform

• Safari now blocks "identity resolution" trackers at the domain level: third parties that take the email address you type into a form and turn it into a cross-site, cross-device ID (Frontend Focus).
• WebKit gained an ApplicationManifest API for looking up a PWA's web manifest, plus fixes for SVG text with vector-effect: non-scaling-stroke and for layers under blur() and drop-shadow() filters (Igalia). Nikolas Zimmermann measures the Layer-Based SVG Engine against the legacy one, since none of its compositing features matter until it's at least as fast.
• Modern Web Weekly takes apart "service worker hell": workers that don't update or get stuck waiting, stale content and broken offline mode after an update all have logical causes, and skipWaiting() and clients.claim() sometimes make things worse.
• Chris Ferdinandi built a speech-to-text app with the SpeechRecognition API. It works in Chrome, Edge and Safari, but not in Vivaldi or Firefox.
• Smashing Newsletter #581 is about JavaScript: native JSON modules with import attributes, and Elena, Ariel Salminen's library for progressive web components that avoid layout shifts, accessibility problems and server-rendering limits.
• Smashing Magazine on accordion icons: the caret is the safest choice, split buttons are harmful, and with no icon at all users expect a new page.
• The W3C added a thread panel to its mailing list archives, and the Web of Things Working Group rechartered for IoT interoperability and physical AI.

Frameworks and JavaScript

TanStack Start 1.0 was the news last week, and React Status has the follow-up. Tanner Linsley says React Server Components felt like "this box we had to check to be taken seriously as a React framework", and tanstack.com no longer uses them. In a benchmark of the same app, Start handled 2.9x–8.6x more dynamic requests than Next.js 16.4 and built about 1.7x faster. There are official guides for migrating from Next.js.

• React Native 0.88 switches to the web event model with no breaking changes, and Expo SDK 58 is ready for iOS 27 and the iPhone Duo (This Week In React). React DevTools for agents now has official docs (React Status).
• Astro 7.4 adds a --timings flag for astro build, and Bun has a draft PR for binaries with no JIT or bytecode. Darcy Clarke thanks Deno for pushing Node and npm to adopt its best ideas (JavaScript Weekly).
• Syntax asks why Bun spelled the end of Deno, along with OpenCode 2.0 and TanStack Start 1.0. In Syntax Weekly, VoidZero open-sourced its Void framework with Cloudflare deploys.
• LogRocket tries OctaneJS, a compiled framework that keeps React's programming model but drops the runtime virtual DOM, and Vercel's vgpu, which hides WebGPU's pipeline and buffer setup.
• Master.dev continues its TanStack AI series with structured output, including streaming a partial JSON structure, and links to Dominik's Vertical Codebase: co-locating code by area of the app rather than by type.
• A security engineer at Master.dev builds an isolated preview for AI-generated HTML: the iframe everyone writes first, broken three ways, then rebuilt.
• Chris Ferdinandi tried documentation-driven development: writing the docs first made the tests easier, and the tests made the code easier.
• Bramus released GTA.js, a reimplementation of the 1997 Grand Theft Auto engine in JavaScript and WebGL, written mostly by Gemini.

AI, agents and the mood

Reverse engineering with AI kept going. Kevin Powell writes that companies wanted AI to replace staff, not their products: Opus 5.5 turns out to be very good at decompiling, and ArtCraft, a free suite of Adobe clones, aims to copy their features within a month. Front-End Fire says the developer who vibe-coded Adobe replacements last week is back with clones of Word, Excel and PowerPoint, and midudev covers people hacking their smart TVs to remove ads (in Spanish).

• Anthropic built its own version control system to replace Git, for 30,000 code changes a day (midudev, in Spanish).
• Adam Jacob joins Syntax on software factories: building trust in agent-generated code, black-box testing, domain-driven design as the agent's vocabulary, and adversarial review for accessibility.
• CodePen AI is out. CodePen Radio explains how they got there, from open-weight models to ChatGPT-6 Luna.
• LogRocket ran five AI code review tools on the same codebase, and Qodo came out fastest and most detailed.
• Linus Torvalds says banning AI from Linux development would be absurd, and midudev asks whether AI should make us work less (both in Spanish).
• Theo asks whether we still need smarter models, and Web Dev Simplified explains how to choose a permission system for your app.

Catching up from last week

These were published between 13 and 18 October, but reached us after last week's page was written.

• Smashing Newsletter #580 is a CSS issue: Vadim Makeev printed nine variations of Warhol's Marilyn Monroe from one SVG with CSS linked parameters, and responsive iframes have landed in Chrome.
• Jan Varga spent most of his career on Gecko, and working on Servo in Rust made him notice abstractions that had stopped looking like design choices.
• Stefan Judis on Blake Watson's state of the industry: "I used to be proud of my deep platform knowledge. Turns out Claude knows more."
• Theo says most of the features engineers build are just prompts, and you can make life easier by prompting better.