TLDR DEV 2025-12-12

Get the guide ↗️

DENIAL OF SERVICE AND SOURCE CODE EXPOSURE IN REACT SERVER COMPONENTS

The React team has disclosed new high-severity Denial of Service (DoS) and medium-severity Source Code Exposure vulnerabilities in React Server Components. The DoS allows malicious requests to hang servers, while the exposure can leak hardcoded secrets from server functions, though neither enables Remote Code Execution. These issues are follow-ups to the recent React2Shell vulnerability. Previous patches (19.0.2, 19.1.3, and 19.2.2) were incomplete.

RED HERRINGS AND AI SLOP: DEBUNKING REACT2SHELL MISINFORMATION

This article debunks widespread misinformation about the React2Shell vulnerability, explaining how React's 700-line obfuscated patch led researchers and AI tools to chase false leads like the $F primitive and property traversal gadgets that couldn't actually be exploited. The real vulnerability occurs much earlier in the RSC request lifecycle than expected, affecting any server processing RSC requests through multipart/form-data payloads with specific Flight protocol operators.

PROGRAMMERS AND SOFTWARE DEVELOPERS LOST THE PLOT ON NAMING THEIR TOOLS

Modern software development increasingly uses obscure or "fun" names for tools and libraries, rather than descriptive ones, causing a cognitive burden for developers. This is different from other engineering fields and earlier programming practices, which prioritize clarity and function in their naming.

CRAFT SOFTWARE THAT MAKES PEOPLE FEEL SOMETHING

This dev paused his development on Boo, a personal code editor they built solely for themselves, to work on a new programming language. Boo was never intended for mainstream use or open-sourcing, and the repetitive work of it ruined their joy and ability to create inspiring software.

INTRODUCING GPT-5.2

OpenAI has launched GPT-5.2, its most advanced frontier model, designed for professional knowledge work and long-running agents. This new model sets state-of-the-art benchmarks across various areas, including coding, long-context understanding, vision, tool-calling, and factuality, performing at or above human expert levels in knowledge tasks.

VOTE FOR THE WEB FEATURES YOU WANT TO SEE

A new upvote system has been launched across web platforms like web.dev and caniuse.com for devs to directly vote for which web features are most important to them for browser vendors to prioritize.

AN SVG IS ALL YOU NEED

SVG files can be used to create interactive, permanent, and shareable environments for scientific papers. They are powerful vector graphics that can embed data, be processed client-side to generate visualizations, and have interactive controls without server-side support. This makes them durable and easily shareable.

PRODUCT ENGINEERING TEAMS MUST OWN SUPPLY CHAIN RISK

Modern software products are assembled from various third-party components, creating a complex "software supply chain" that is an easy target for attacks due to historically implicit trust. This vulnerability leads to risks like credential theft and widespread compromise, negatively impacting product outcomes, customer trust, and business revenue. The solution is to make trust explicit and verifiable using cryptographic attestations and frameworks to prove the origin and integrity of dependencies.

BIDICALC

bidicalc is a bidirectional calculator that can change variable cells so that formula results match changes made.

HOW AI CODING AGENTS HID A TIMEBOMB IN OUR APP

If something matters, you have to encode it as a test, not just write a comment about it.

DEPRECATE LIKE YOU MEAN IT

Traditional deprecation warnings are ineffective, so a funny way to force migration to newer versions is to make deprecated functions progressively return incorrect results.

BUILD WITH GEMINI DEEP RESEARCH

Gemini Deep Research is now available to developers via the new Interactions API.