β₯ TypeScript, WebAssembly & Rust π¦
Paris, France
Joined March 2007
- Tweets6.9K
- Following466
- Followers615
- Likes4.4K
Pinned Tweet
#WebAssembly Component Model is promising, but examples are too simple or complex.
I built a REPL with plugins that work in CLI & web, sandboxed by default, and the REPL logic compiles to #WASM.
Beyond hello world but still learnable! #WASI #rust π¦
github.com/topheman/webassemβ¦
Tophe retweeted
Your regular Chrome already auto-updated to 156, so you think you're safe
You're not
The real danger here is Playwright, Puppeteer, and MCP browser tools running inside Cursor, Claude Code, or Terminal
1. Your IDE / Terminal has macOS Accessibility permissions
2. It spawns a cached Playwright Chromium (usually stuck on v131β151 or whatever)
3. That browser inherits your IDE's Accessibility permission
4. Any site your agent visits can use the GPU process to press Cmd + Space, open Terminal, and run commands on your Mac π
Check ~/Library/Caches/ms-playwright and ~/.cache/puppeteer right now and update to Playwright 1.64.1+ (Chromium 156)
π¨ BEWARE: Chrome Sandbox Escape
Full remote command execution + full chain capabilities
October has been wild
pwn.ai/blog/chrome-escape
Tophe retweeted
css tip π - the same :ππππππ-πππππππ gives you a scrollspy with no js.
.πππ {
ππππππ-ππππππ-πππππ: ππππ;
}
.πππ π:ππππππ-πππππππ {
ππππππππππ: πππππ;
πππππ: π ππππ;
}
each <π ππππ="#ππ"> in .πππ tracks its section. the link for the section in view matches :ππππππ-πππππππ and follows as you scroll.
css tip πͺ - carousel tabs with no js.
one line turns a scroll-snap carousel into a real tab list:
.ππππππππ {
ππππππ-ππππππ-πππππ: ππππππ ππππ;
}
.ππππππππ::ππππππ-ππππππ-πππππ {
πππππππ’: ππππ‘; πππ: πΎππ‘; ππππππ: πΊπΎππ‘;
}
.ππππππππ > ππ::ππππππ-ππππππ {
πππππππ: ππππ(ππππ-πππ);
}
.ππππππππ > ππ::ππππππ-ππππππ:ππππππ-πππππππ {
ππππππππππ: πππππ; πππππ: π ππππ;
}
Tophe retweeted
π¨ BREAKING: Node.js just dropped its OWN security bombshell.
4 HIGH-SEVERITY vulnerabilities patched TODAY, including one that could let hackers remotely execute malicious code on vulnerable servers.
β 10 SECURITY FLAWS were addressed in today's Node.js release, FOUR rated HIGH severity.
β REMOTE CODE EXECUTION: CVE-2026-111497 is a serious flaw in Node.js's Brotli decoder that could allow attackers to execute malicious code remotely.
β TLS SECURITY BYPASS: Two separate vulnerabilities could trick affected applications into accepting certificates for the WRONG server under certain conditions.
β Think about that. Your application could establish an encrypted connection while failing to properly verify WHO it's talking to.
β THREE MAJOR NODE.JS VERSIONS AFFECTED: Node.js 22, 24 and 26 all required emergency security updates.
β RUNNING NODE.JS 18 OR 20? Those versions are END-OF-LIFE and aren't receiving these official security patches.
β PATCH IMMEDIATELY: Update to Node.js 22.23.4, 24.22.1 or 26.12.1, depending on your release line. If you're using Docker, rebuild and redeploy your containers.
PHP AND Node.js both facing major security disclosures on the SAME DAY.
If you run a website or application, TODAY is the day to check your servers.
And remember: the public release of security patches can give attackers a roadmap to systems that haven't updated.
Don't be the last one to patch.
π¨ A MASSIVE internet security emergency is unfolding right now. π¨
Two CRITICAL vulnerabilities have been discovered in PHP, potentially putting millions of websites at risk.
β NEARLY 70% of websites with a known server-side language run PHP. The potential scale is ENORMOUS.
β TWO CRITICAL security flaws have been confirmed, each scoring 9.2/10 in severity.
β Attackers could potentially take control of vulnerable servers remotely, without authentication.
β Reports suggest PHP versions dating back to 2004 could be affected. The exact scope is still unconfirmed.
β EMERGENCY PATCHES are scheduled for TOMORROW at 10 AM ET. Website owners are being urged to prepare immediately.
β Europe's CERT-EU is warning organizations to patch ASAP or consider TAKING EXPOSED APPLICATIONS OFFLINE if they cannot be secured.
β WordPress, Magento, Laravel and potentially millions of other PHP-powered websites could be at risk.
β Once patches go public, hackers could reverse-engineer them and race to attack servers that haven't updated.
The vulnerabilities are CONFIRMED. The full technical details remain secret.
Tomorrow, the race between hackers and defenders begins.
This could get ugly. FAST.
Tophe retweeted
Introducing tsrs: a Rust port of the TypeScript compiler π¦
We are not forking TypeScript!
β In close collaborating with the TypeScript team
β Up to 8x faster than TS 7.0 & ~70% less memory
β Runs in WASM, so it works in your browser & on Workers
β Soon part of the Oxc toolchain
npx tsrs
blog.cloudflare.com/typescriβ¦
Tophe retweeted
RAM is the new bottleneck. Every Node.js process is fighting for memory: containers, serverless, cloud bills, k8s limits. And here's the maddening part: V8 can use half the memory with one flag, and almost nobody turns it on.
Tophe retweeted
Orchestrator V2 is now out on the stable channel in @t3dotcodes! We also thought it was time we drop the Alpha branding, so we call this release 0.1.0 Beta.
Mobile store builds are also updated. Versions 2.0.0 are available to everyone on both App Store and the Play Store!
Tophe retweeted
A @nodejs `VirtualFileSystem` pairs a storage provider (memory, a real directory, or a ZIP) with an fs-like API. Mount it, and `node:fs` operations and the module loader recognize it. No special asset API, no rewriting every dependency.
Deno is joining Cloudflare. The runtime gets one more year of support, then development ends. π¦
#Deno #Cloudflare
Tophe retweeted
Next.js 16.4
β’ Cache Components by default in new apps
β’ Static output guarantees and more control over prefetching
β’ Agent-guided upgrades and feedback
β’ 20β25% smaller Turbopack disk cache
β’ Faster development and smaller bundles
nextjs.org/blog/next-16-4
Tophe retweeted
Things included in this PR:
- Pi support.
- Auto-resume when limits reset
- T3 Code MCP (create, launch, message, wait on, read, search and interrupt threads)
- `delegate_task` lets an agent start child agents on any provider or model
- ACP Registry: add any registry agent (Devin, Cline, Kimi, Droid, and more)
- Cursor runs on the official Cursor SDK, not the (broken) CLI
- OpenCode 2 support
- Agents can rename threads, regenerate titles, link PRs and settle threads
- New MCP tools for worktree handoff, and for listing and closing previews
- Proper server-side queueing and steering
- Thread forking
- Switch provider or model in the middle of a thread
- Native subagents show as child threads in a lineage view, with their model, status and history
- Use `@` with a thread name, or drag a thread from the sidebar, to attach it as context
- Scheduled tasks
- Tons more I'm forgetting
Pumped this landed. We'll have a lot of cleanup to do to get it perfect, so expect lots of updates throughout the next few days :)
Effect runtime visualizer v3.1 is out π
- execution log indented by fiber
- one-line hints on runtime patterns
- event filters
- better on phones
#EffectTS #TypeScript #EffectViz
effect-viz.vercel.app
Tophe retweeted
Conteneurs Linux - Quand l'isolation ne tient plus kbn.im/46Qsy76
Tophe retweeted
ε
¨δΊΊι‘γ欲γγγ£γγγ€γγ
$ git branch --delete-merged
github.blog/open-source/git/β¦
Tophe retweeted
Vite+ 1.0 is here π
A single `vp` CLI for managing your Node.js runtime, package manager, and frontend toolchain. Built on top of Vite, Vitest, Rolldown, Oxc, and tsdown.
All with a single config.
Free and open source under the MIT license.
Start with `vp create` or migrate with `vp migrate`.
voidzero.dev/posts/announcinβ¦
Tophe retweeted
With LLMs, we like to think of "smart" and "dumb" as one axis (because we think of humans this way).
I'd like to argue against this framing. Instead, try to think of "smart" and "dumb" as two different axes. A model can be incredibly smart AND dumb at the same time.
For a good example of this, look at a Gemini model. They are incredibly smart: you can bench them and see the capability. The amount of knowledge Google bakes into their models is incredible. Yet when you ask it to do work, the amount of stupid things the models will do is similarly incredible. They are "smart" and "dumb" at the same time.
Similarly, look at a model like Fable 5.1. It is not quite as smart as Astra, but it is significantly less dumb. Astra is still the smartest model available today, but it is also one of the dumbest, regularly doing things that make literally no sense whatsoever.
Finding the right balance of both "smart" and "dumb" is a challenge that everyone needs to figure out, from users to researchers. If we stop thinking of it as either-or and instead realize both can exist together, understanding model behavior gets much easier.
