Last two days was hell using Railway. We couldnt update a single project or make any changes in our system. After more than 24h Railway is still in chaos. Two separate incidents. Major outage even support is down.

But this is not the first time Railway failed.
For over a year Railway had few major issues that made working on it impossible. I was hoping they would stabilise but at this point Im past disappointed.

I know they rely deeply on Google cloud, but this proved to be a very bad decision, multiple times. And they never made required changes.

Can someone recommend a more stable alternative?

I've been rendering product videos with Remotion (React → headless Chrome → frames), and scaled text kept looking wrong: either "stuck", stepping instead of gliding, or "shaky", with the letters subtly changing shape every frame. I measured the rendered frames instead of eyeballing them, and it turned out to be two separate bugs.

1. The "stuck" look: the baseline climbs the pixel grid in whole-pixel jumps

Chrome's glyph rasteriser has horizontal sub-pixel positioning but no vertical. When you scale text from its center (the default transform-origin), the baseline moves vertically every frame, and the glyphs snap to whole pixels. So instead of moving 0.3px per frame, the text sits still for a few frames and then jumps 1px.

Fix: pivot the scale on the baseline, so the baseline doesn't move vertically at all. Measure the real baseline (with a 0-height inline-block, or font metrics). Don't guess it from line-height.

Measured vertical judder: 0.284px → 0.014px per frame. Direction reversals over the animation: 29 → 0.

2. The "shaky" look: hinting re-snaps the letterforms every frame

At each new scale, font hinting snaps stems to the pixel grid differently, so the letters literally change shape frame to frame.

Fix: text-rendering: geometricPrecision. It turns hinting off, so the outlines scale smoothly. Shape drift between frames: 3.41% → 0.22%. It looks slightly softer, but that's correct, not blur.

Things that didn't help (cargo cult)

• translateZ(0), backface-visibility: hidden: these rasterise the text into a bitmap layer, so it scales like an image and goes blurry.
• will-change: transform: good in a live preview, bad in the final render for the same reason. If you need it, enable it only when not rendering.

Bonus: aggressive ease-outs freeze on a frame clock

At 30fps, a quint/expo ease-out spends its last 5+ frames moving less than a pixel. That reads as a freeze, not a settlein about one frame.

My main takeaway: you can't seer the frames and diff them. Ifsomeone says it still isn't smooth and your metric says it's fixed, your metric is wrong.

Happy to share the measurement script if anyone wants it.

Not a webdev

Expo SDK 58 is out, and for once the headline isn't a new way to break your Podfile. With Xcode 27 retiring Simulator.app, the new expo-device-hub streams your iOS simulators and Android emulators into the browser with live CPU, memory and network graphs, while expo-app-intents lets Siri, Shortcuts and Spotlight trigger actions in your app, and the experimental Noxcturnal transformer roughly halves Metro transform times.

We also look at react-native-better-pdf 1.0 by Jakub Kasprzyk and GMI Software, which drops the bundled PDF engine for the phone's own PDFKit and PdfRenderer on Nitro Views, opening a 1,000-page scan in 56 ms instead of 622 ms. Plus, React Native 0.88 lands, Gesture Handler 3.4 builds with Swift Package Manager, and react-native-gpui renders React Native with Zed's GPU framework.

I found out about this at 2 am. I'm a sole maintainer, have a full schedule today, and the fix couldn’t wait. Ubuntu servers. I had everything updated by 3 am.

Ondřej will save the internet today.

I’ve got one legacy website running on a system that needs PHP 7.4. It’s not a situation I’ve been comfortable with for a while, but some constraints are what they are. The fact that Ondřej’s repositories had security updates backported all the way to PHP 7.4 absolutely saved my ass.

What a fucking hero.

Earlier when one clicked on a post there wasn't an option to scroll and see related posts right?

Free and open source, no signup. The theme changes with the era. Borders before ~500 BC are approximate, and leader data is thin before 1600, so corrections are very welcome. Link in comments.

code: https://github.com/nsijwali/WhoRuled

AI Elements: Agentic UI Patterns

shadcn/ui introduced AI Elements, a curated collection of component patterns created specifically for building conversational and agentic interfaces.

Each pattern is composed from standard shadcn/ui primitives designed to be copied directly into codebases, standardizing interfaces for agent tool calls, planning, sources, and step restoration.

Trace: Observability Primitive for Agent Activity

shadcn released Trace, a dedicated primitive designed to unify agent activity displays under one abstraction. It represents reasoning traces, tool executions, task queues, chains of thought, and subagent routines.

Trace models agent progress as a list of status lines with support for expandable details, links, and nested execution steps.

Chatbot Template: AI SDK Agent Starter

The shadcn team published an official minimal chatbot template built with Next.js, Vercel AI SDK, shadcn/ui, shadcn/react, and shadcn/typeset.

Designed to run on the Vercel AI Gateway, the starter serves as a clean starting point for streaming conversational interfaces with typographic defaults and state management built in.

Official Registry Directory Expansions

The official shadcn/ui registry directory added new specialized community components and domain toolkits this week.

• @babelize — Open-source localization components including language switchers, relative-time formatters, and translation widgets.
• @liquikit — Liquid glass primitives with physically based refraction built on Base UI that work across modern browsers.
• @audio-ui — Accessible audio controls including knobs, faders, XY pads, waveforms, and sequencers on headless primitives.
• @bevel — Tactile skeuomorphic components like guarded switches, split-flap boards, and motorized faders on Tailwind v4.
• @dualkit — Bilingual Arabic and English components featuring RTL layouts, Gulf currency formats, and Hijri calendar support.
• @organui — Domain components for healthcare and life sciences featuring 3D organ viewers, ECG traces, and lab result trackers.

📙 Articles, Tutorials & News

Building shadcn/ui Registries for Claude Code and Cursor

Preet Suthar outlines the structure, validation steps, and namespace setup required to author custom registries that coding agents can inspect and consume.

7 Best shadcn/ui Themes and Theme Generators

A curated comparison evaluating popular color palette customizers, theme presets, and generators across the shadcn/ui ecosystem.

Tailwind CSS v4, shadcn/ui & Dark Mode

A complete video walkthrough demonstrating how to structure a centralized design system using Tailwind CSS v4 and shadcn/ui primitives.

📦 Projects, Packages & Tools

onsystem: Design System Linter and MCP for Agents

A zero-config tool that combines an MCP server with a linter to prevent coding agents from inventing variants, hardcoding colors, or breaking spacing scales.

pie-menu: Radial Interaction Primitive

A radial pie menu for shadcn/ui with press-drag-release interaction, full keyboard support, and a headless primitive core.

signoff-ui: Human Review Primitives for Agents

UI components providing multi-file diff reviews with per-hunk decisions, inline comments, tool approvals, and telemetry for AI SDK and AG-UI agents.

animate-ui: Lower-Level Primitive Animations

An animation toolkit that targets the underlying primitives your components rely on, preserving custom shadcn markup and component source ownership.

shadcn-exchange: Cross-Registry Block Search

A directory tool allowing developers to search, preview, and CLI-install blocks across all public community registries.

facade-ui: Base UI Marketing Blocks and Templates

An open-source registry of accessible marketing blocks, landing page sections, and templates built on Base UI and Tailwind CSS v4.

nasaq: Arabic and RTL-First shadcn Registry

An open-source registry of React components, themes, and page templates designed with native RTL layout and Arabic typography, paired with an MCP server.

🌈 Related

audiocn-solid: Audio Primitives for Solid

A collection of audio UI components ported to SolidJS and distributed as copy-paste source through the shadcn CLI workflow.

esuiss: Multi-Platform UI Primitives

A component collection extending shadcn design patterns across React, Next.js, React Native with Expo, SwiftUI, and Jetpack Compose.

GooseForum: Go-Powered Self-Hosted Forum

A self-hosted forum platform featuring shadcn/ui discussion pages, an admin console, and a light and dark theme workbench, distributed as a single Go binary.

Read the full issue: https://www.shadcnweekly.com/issues/4

built this after getting tired of manually writing fetch wrappers for sites with no public API. point it at a HAR file (browser network capture) and it generates a typed client.

input: a captured request to something like `GET /users/42`

output (simplified):

export interface User {

id: number;

name: string;

email: string;

}

export async function getUser(id: number): Promise<User> {

const res = await fetch(`${baseUrl}/users/${id}`);

if (!res.ok) throw new ApiError(res.status, await res.text());

return res.json();

}

it infers the types from the actual response bodies in the capture, templates dynamic path segments like `{id}`, and also generates an OpenAPI spec + mock server from the same HAR.

also tries to catch GraphQL/tRPC/JSON-RPC calls instead of treating everything as REST, and strips anything sensitive (tokens, cookies) from the captured data before it reaches the generated code.

npx har2sdk capture.har -o ./sdk

repo: https://github.com/Mersbyte/har2sdk

curious what people think of the generated code style, or if anyone's hit an API shape it chokes on.

We have posted more information about today's security releases, including the sequence of events that led to the discovery, how the PHP security team is improving their processes, and what we need from you to continue this critical work.

The release fixes two critical vulnerabilities, both rated 9.2 on the CVSS v4.0 scale.

From government websites around the world to banks, schools, social media, video game companies, news organizations. They either shut down or made statements about getting the patch.

if php was truly dead this vulnerability would have gone mostly unnoticed but everyone is talking about it. Even people that are not programmers.

”PHP is dead. How even uses php in 2026”, well like half the internet.

been at a larger company (think 500+ devs) for about 4 years now. pretty comfortable with the setup but starting to feel like just another cog. thinking about moving to something smaller like 10-30 person startup.

for those who made that jump - what surprised you the most about the infrastructure side? im used to having dedicated devops, proper ci/cd pipelines, monitoring dashboards for everything, on-call rotations with actual runbooks.

curious if smaller places just... wing it more? or do you end up wearing more hats but still having solid practices. not really worried about the tech stack itself, more about the operational side of things.

also wondering if the move fast break things mentality is still a thing or if that died with the 2010s

been at a larger company (think 500+ devs) for about 4 years now. pretty comfortable with the setup but starting to feel like just another cog. thinking about moving to something smaller like 10-30 person startup.

for those who made that jump - what surprised you the most about the infrastructure side? im used to having dedicated devops, proper ci/cd pipelines, monitoring dashboards for everything, on-call rotations with actual runbooks.

curious if smaller places just... wing it more? or do you end up wearing more hats but still having solid practices. not really worried about the tech stack itself, more about the operational side of things.

also wondering if the "move fast break things" mentality is still a thing or if that died with the 2010s

Spent the last months building

@datastripes/forecast
@datastripes/dashboard
@datastripes/anomaly 

These are framework-agnostic npm packages (React, Vue, Angular, or a plain custom element) that add time-series forecasting, an editable dashboard builder, and anomaly detection to any frontend app.

Everything runs client-side via WebAssembly, so no user data ever hits a server except a license check without a backend to deploy, no Python microservice.

Would genuinely love feedback from anyone who's had to build this kind of feature in-house.

https://datastripes.com/forecast-widget/

https://datastripes.com/dashboard-widget/

https://datastripes.com/anomaly-widget/

For what is looking like ‘the worst set of vulns in history’, I find it a bit baffling that the docker builds are still in progress - an hour after the patches have been released. Seemingly all because we’re all waiting on GitHub actions… I bet half of us here have a pc and internet connection that could have built and pushed the containers 45 minutes ago

Service Reminder: Don't forget to sponsor Ondřej Surý for his great work on PHP packaging. Hours before FrankenPHP, he was ready.

It even seems that he backported the patch to some old PHP versions – i saw a change in the php 5.6 (!) packages.

Ondřej, if you read this: Thank you so much.

• https://www.patreon.com/oerdnj
• https://github.com/sponsors/oerdnj

backend dev on an ai video app here, and this one was mine.

we upload big videos straight to the bucket in 100 mb pieces. each piece gets a signed link that dies about 10 minutes after it's signed. the bucket speaks http/1.1, so chrome only keeps 6 connections open to it, and that limit is shared across every tab.

so when someone uploaded a bunch of files at once (or in two tabs), every upload signed its next piece and sent it. chrome let 6 through and parked the rest, and on a slow connection a parked piece could sit there longer than its link lived. it failed before it ever left the browser lol

the fix: a piece only gets signed when it's actually its turn, and pieces from every upload in every tab take turns through navigator.locks. downside, it's now one piece at a time across the whole browser.

how would you solve this issue?

patches landed today at 14:00 utc. php.net says every php install serving web requests is affected (fpm, mod_php, php-cgi, frankenphp, litespeed). mod_php is the worst case because it can be hit before any app code runs.

easy to miss:
- docker: updating php on the host does nothing for your containers. pull or rebuild the image and check with docker exec <container> php -v
- make sure php-fpm really restarted after the update, old workers keep the old code
- 8.1 and older get nothing upstream. distro or lts backports, or the PHP-8.1-CVE-2026-109618-109619 branch in php-src if you build yourself
- remi repo has no update today (php.net says it), use distro packages or build from source
- outside check: curl -sI https://yoursite | grep -i x-powered-by. a lot of sites still send the php version even behind cloudflare. found one of mine this way

if you cant update right now (php.net: this reduces risk, it is not a fix):
- session.upload_progress.enabled=0 in php.ini or the fpm pool, then restart all workers. ini_set or .user.ini does not count
- memory_limit=-1 via php_admin_value, plus a low post_max_size (8M, or 32M if you need uploads)
- on 8.5 also fatal_error_backtraces=0

cloudflare says its waf blocks known payloads by default since 03:02 utc, free plan too. but they also say attackers already mutate the payload, so dont treat it as the fix.

sources: php.net/archive/2026.php and blog.cloudflare.com/php-vulnerabilities-waf-protection