Friday Issue No. 162
After a longer-than-planned break, the reading habit is officially back. The JavaScript side of this issue is a mixed bag, with some entries showing how much you can now achieve with CSS alone. The big one is HTML-in-Canvas in Chrome 157, which lets you mix ordinary DOM into 2D, WebGL and WebGPU canvases and opens the door to everything from wobbly buttons to entire games. Nolan Lawson also benchmarks what it costs when AI agents build the same app in a dozen frameworks, and Node lines up security releases for versions 26, 24 and 22.
In the CSS world, the star is random(), the stylesheet's first proper random number function, which is either a lovely tool or a licence for chaos depending on your restraint. There is also a nostalgic trip through IE6-era hacks, a front-end checklist with more than 350 rules and its own MCP, animated borders and neat CSS-only annotations. Mixed news brings a slightly late Halloween story about DeadTag, where forgotten website tags became a delivery network for iPhone spyware, plus Addy Osmani on the code nobody reads and a proper long read on why AI has not replaced software engineers. Happy reading!
JavaScript News
The AI cost of JS frameworks
This is a fun project. Coding agents were instructed to build the same small Pokémon app, one per framework, and the results were benchmarked on cost, time, tokens, code size and Lighthouse quality. Of course, all should be taken with a pinch of salt, but the results are still interesting: Hono with htmx came out cheapest, Angular the most expensive, and vanilla JavaScript somehow cost more than several frameworks.
https://nolanlawson.com/2026/10/28/the-ai-cost-of-javascript-frameworks/
Node.js security releases
New versions of the 26.x, 24.x and 22.x lines are coming, and each fixes issues rated HIGH severity. They are planned for Wednesday, the 11th of November, which is probably a coincidence with Remembrance Day, but that is my interpretation.
https://nodejs.org/en/blog/vulnerability/november-2026-security-releases
zero-js
This is really interesting: a C-like language that compiles to plain HTML and CSS, so calculations, drawing, input and animation all run with zero bytes of JavaScript. Worth digging into the source to see how it works.
Internet Protocol
A beautifully made app showing how the internet works, packet by packet. You can choose between the core, application and security sections, and the animations explain everything in detail, decoding every packet byte by byte, and you can pause every animation.
https://protocol-explorer-alpha.vercel.app/
HTML-in-Canvas in Chrome 157
This is a door to bad UI or superb experiences on the web. You can mix HTML DOM inside a canvas: use the ordinary DOM, then render it through 2D, WebGL or WebGPU and do whatever you want, like wobbly buttons, a shooting game or destroying an HTML form. You know, you get the idea.
https://developer.chrome.com/blog/html-in-canvas
Example from Wes: https://x.com/wesbos/status/2041594973674483851
npm names and rules
What happens when you want to use a nice name for your project but npm won't let you? The name "estee" was blocked for being too similar to "espree" and "testem", and support could not override the automatic typosquat protection. Kind of a sad story, to be honest.
https://smoores.dev/post/no_npm_estee_is_not_a_typo/
HTML & CSS News
CSS Random()
What a time to be alive. CSS gets a random() function. Actually, that is a bit scary, as this might trigger some silly blinking, moving and changing shapes all over the web, just to get this function into the latest designs. Probably goes well with that HTML-in-Canvas.
https://developer.mozilla.org/en-US/docs/Web/CSS/Reference/Values/random
Basic examples of three blocks that get a different colour and position every time you refresh the screen, and a short video on the possibilities.
https://codepen.io/editor/chriscoyier/pen/0198e31d-9802-74f7-a4be-4f13cd233d78
and a short video on possibilities
https://www.youtube.com/watch?v=Uy3xsfAD8s0
Old school CSS
This post is for those who were lucky (or not) enough to play with IE6 and the joy of adding different quirks to adjust the funny box model and so on. 🙂 I didn't know about the !banana trick, where IE 7 and earlier treated almost any word after the exclamation mark as !important. In any case, a lovely trip into history and a bit of an eye twitch from the long nights spent fixing unexplained bugs back then.
https://vale.rocks/posts/css-relics
Front-end Checklist
A great collection with more than 350 rules around launch, review, accessibility, SEO and more. It also comes with an MCP for structured AI reviews.
Animating CSS borders
An interesting approach to animating borders using CSS custom properties.
https://css-tricks.com/animating-css-border-image/
Neat Annotations
CSS-only annotations, which look rather good.
https://github.com/syabro/neat-annotations
Mixed News
Halloween story about DeadTags
“…That's the gap that DeadTag exploits: the operator buys those expired domains as soon as they come up for sale. The moment they own one, every website still carrying the old tag starts loading the attackers' new code, on every page and for every visitor, without the site owner changing anything or noticing anything.”
The Code Nobody Reads
Another great post from Addy Osmani on future coding and how much code developers will read. Although, for some this is probably not even future anymore.
https://addyo.substack.com/p/the-code-nobody-reads
Why AI hasn’t replaced software engineers, and won’t
This is a proper Friday long read on the subject, which is probably interesting for most developers.
https://www.normaltech.ai/p/why-ai-hasnt-replaced-software-engineers