TLDR DEV 2026-09-11

Register now

NATIVE IS NOW THE FUTURE OF MOBILE AT SHOPIFY

Shopify is moving its major mobile apps from React Native back to Swift and Kotlin because coding agents have made maintaining two native implementations much cheaper. Its Helix workflow breaks migrations into small, tested checkpoints with visual and adversarial review. The Shop app went from proof of concept to a native release in 12 weeks, and the 300+ screen Shopify app is next.

REWRITING A NODE.JS SERVICE IN GO WITH AGENTS

Checkly used Claude Code to rewrite a JavaScript service processing 92 million daily messages in Go, guided by a black-box test harness that checked its behavior against production data. The 13,000-line rewrite launched with zero incidents, 70% fewer pods, and 60% fewer database sessions, though a mismatch between the test and production queue configurations exposed the importance of modeling every dependency accurately

THE DEATHRAY: A SIMPLE WAY FOR AN UNTRUSTED SITE TO FREEZE A MAC

A single WebGPU page can lock the graphics stack on M-series Macs across Safari, Chrome, and Firefox, leaving WindowServer unresponsive until the machine restarts. The exploit is just an infinite compute shader plus a render pass waiting on the same buffer. It is an example of how a browser API can cross process boundaries and become a system-level denial of service.

WHY YOUR WEBSITE SHOULD NEVER STOP CHANGING

Websites should be treated as living systems that continuously adapt after launch instead of decaying as messaging, design systems, accessibility, and performance requirements drift. The hard part isn't agent capability but governance: teams want automated monitoring and routine fixes, while meaningful changes still need constraints, auditability, and human review.

AI HAS MADE PROGRAMMING SO BORING

AI has stripped programming—and other creative work—of ownership and satisfaction, replacing week-long craft with instant prompting and machine-generated code reviews. The thread splits between people who feel the same loss of agency and others who say AI remains useful when developers set the architecture, examples, tests, and review loop.

INTRODUCING THE OPENAI AGENTS API

OpenAI's Agents API packages Codex's long-running harness into a public-beta API that manages context, tools, files, recovery, and subagent orchestration. Developers choose an OpenAI-hosted sandbox, their own infrastructure, or a partner environment. Sessions can run asynchronously for hours or days without teams building the durable execution layer themselves.

INTRODUCING NEKI: SHARDED POSTGRES

PlanetScale's Neki shards real Postgres across multiple machines while preserving the standard wire protocol, drivers, ORMs, extensions, and familiar SQL behavior. A router plans and fans queries across shard groups, while online workflows handle schema changes, failovers, version upgrades, imports, and resharding.

DRYDOCK

Drydock reviews the exact npm, PyPI, or VS Code artifact that will be published, catching risky changes that source-code reviews can miss. It flags additions such as install scripts, network access, credential reads, and new binaries, then lets maintainers approve or reject the release without handling their publishing credentials.

TESTING GOOGLE'S "MODERN-WEB-GUIDANCE" SKILL ON A REAL REACT APP

Google's modern-web-guidance skill gives LLMs an on-device index of current frontend practices, helping compensate for stale training data. In a Vite and React test, it caught missing form semantics, input attributes, and dark-mode issues, though it does not inspect code directly and can use 4,500 to 7,000 tokens.

AN ALIGNMENT ASSESSMENT OF RECENT CYBERSECURITY INCIDENTS

Anthropic investigates four cases where Claude escaped misconfigured cybersecurity evaluations and accessed real systems, including publishing malicious PyPI packages and entering a security vendor's database. The incidents exposed two recurring failures: biased reasoning that dismissed evidence of real-world access and reckless pursuit of assigned tasks.

DETECTING AND COUNTERING MISUSE OF AI: SEPTEMBER 2026

Anthropic's recent threat report documents how state-backed groups, criminals, and spyware vendors are using AI to automate cyberattacks, surveillance, fraud, weapons research, and model theft at greater speed and scale.

CLAUDE, CHANGE THE “ADD TO CART” BUTTON TO BLUE

An interactive satire turns a one-line CSS request into an escalating tour of overengineering, scope creep, false completion, and painfully familiar agent language.

RUST IS NOW A TIER-1 LANGUAGE AT MICROSOFT

Microsoft now treats Rust as Tier-1 alongside C++, C#, and TypeScript, meaning internal teams get a paved path through secure toolchains, platform integration, SDL compliance, and production workflows.

BUN VS THE NODE.JS TEST SUITE

Bun's live tracker visualizes its compatibility with Node.js v26.3.0 by mapping each upstream test from parallel, sequential, js-native-api, and node-api.