FE Bits Vol.33 | Vercel April Security Incident, sizes="auto" Ends Responsive Image Pain

Published 2026-04-26 22:00 Updated 2026-04-26 22:43 1125 words 6 min read ... Page views

cos avatar

cos

FE / ACG / 手工 / 深色模式强迫症 / INFP / 兴趣广泛养两只猫的老宅女 / remote

FE Bits Vol.33 | Vercel April Security Incident, sizes="auto" Ends Responsive Image PainFE Bits Vol.32 | MUI v9 Released, A New Take on TanStack RSC, Google Cracks Down on Back Button HijackingFE Bits Vol.31 | axios Supply Chain Attack, JetStream 3.0 Released & View Transitions ToolkitFE Bits Vol.30 | TypeScript 6.0 & Next.js 16.2 Released, Safari 26.4 New FeaturesFE Bits Vol.29 | Native JSON Modules Land, CSS light-dark() Now Supports ImagesFE Bits Vol.28 | The Birth of Ai-chan, Vite 8.0 Released, Astro 6.0 LaunchedFE Bits Vol.27 | Oxfmt Beta Released, Chromium 'CSS Exploit' Was Actually a UAFFE Bits Vol.26 | Gatsby Supports React 19, Rspress 2.0 ReleasedFE Bits Vol.25 | Yarn 6 to Be Rewritten in Rust, CSS Grid Lanes ProgressFE Bits Vol.24 | Rolldown 1.0 RC, Anime.js v4.3 Auto Layout, and Chrome 145 100vw Scrollbar AwarenessFE Bits Vol.23 | jQuery 4 Released, Chrome Adds Vertical Tabs, Astro Acquired by CloudflareFE Bits Vol.22 | CSS @scope Now Widely Available, ViteLand December RecapFE Bits Vol.21 | Blog Christmas Effects and Moe Copy Update, AntV Launches InfographicFE Bits Vol.20 | Blog Updates and FEDAY Highlights, Shadcn Create ReleasedFE Bits Vol.19|New Site Features and React Discloses Two New RSC VulnerabilitiesFE Bits Vol.17|WebGPU Now Supported by All Major Browsers, Ant Design 6 Officially ReleasedFE Bits Vol.16|Cloudflare Incident Report Released, CSSWG Confirms Masonry Layout Syntax grid-lanesFE Bits Vol.15|Chrome Width/Height Animation Reflow Optimization, Node Type Stripping Goes StableFE Bits Vol.14|Chrome Supports Split Views, npm Enforces 2FA, Rspack 1.6FE Bits Vol.13|TypeScript Becomes GitHub's Most-Used Language for the First Time, VoidZero Raises $12.5M Series AFE Bits Vol.12|Next.js 16 Released, Docusaurus 3.9 AI Search, ChatGPT Atlas LaunchedFE Bits Vol.11|React Native 0.82 New Architecture Lands, Bun 1.3 Full-Stack RuntimeFE Bits Vol.10|React Compiler v1.0 Released, React Foundation Established, Vite Documentary and Vite+ LaunchFE Bits Vol.9|Chrome DevTools Launches MCP, Nuxt UI Pro Goes Open Source and FreeFE Bits Vol.8|PyCon Trip, Cloudflare's Big Bug, and NPM Sandworm AlertFE Bits Vol.7|Security Alerts for chalk, debug and Other npm Packages; Remotion Sponsors MediabunnyFE Bits Vol.6|What Changes and What Stays, Chrome's 17th Anniversary and CSS Mixins DraftFE Bits Vol.5|Nx Package Compromised, ESLint Multi-threaded Linting, and Firefox Experimental PWAFE Bits Vol.4|Next 15.5, RN 0.81, and Some Handy ToolsFE Bits Vol.3|CSS attr() Typed Evolution, PostCSS Retrospective After 12 YearsFE Bits Vol.2|V8 Speeds Up JSON.stringify 2x, Vite Weekly Downloads Surpass Webpack for the First TimeFE Bits Vol.1|Hello World, TanStack DB First Beta Release
Community highlights: Vercel discloses a security breach caused by a compromised third-party AI tool; sizes="auto" reaches full browser support, finally ending the era of hand-written sizes attributes. Curated articles cover Git 2.54's experimental git history command, Shopify performance optimization, and the 2026 technical SEO guide. Fun sites include the WebGPU-powered million-blade grass landscape False Earth and a pure-CSS recreation of Apple's Vision Pro scroll animation.

This article has been machine-translated from Chinese. The translation may contain inaccuracies or awkward phrasing. If in doubt, please refer to the original Chinese version.

About This Newsletter

This issue's URL: https://blog.cosine.ren/post/weekly-33
This newsletter aims to be updated every Sunday.
Subscribe via RSS.
WeChat public account: FE Bits (前端周周谈 FE Bits). Click "read original" to view the source article.
QQ discussion group 598022684 / Discord server

This newsletter's content is also open-sourced at fe-bits-weekly. Feel free to follow along.

Today is April 26, 2026, Sunday.

Random Musings

I've been feeling like the writing has gotten a bit stale lately, so I'm starting a casual column where I share random things I find interesting — not limited to tech. Could be a fun fact, a thought, something I used ages ago that resurfaced this week, or just me rambling about whatever.

How to live a happy life? A light-hearted topic.

  • Eat well, drink well — don't feel guilty about spending money on things that make you happy.
  • Your physical and mental health come first. This isn't about consumerism; it's about not feeling guilty for spending on yourself.
  • If you're unhappy and need a break, take one. If you want to slack off, go for it.
  • Compare less — comparison is the thief of joy.
  • Have an anchor for your happiness — a person, a hobby, a goal, anything that gives you something to hold onto when things get rough. (Yes, casually running a build for fun totally counts as an anchor.)

On relationships:

  • You often see people online lamenting that they'll never find a partner or that their life is over for various reasons.
  • Setting aside the trolls, the premise of finding a partner is that you also need to work on becoming someone worth loving. If you don't even like yourself, why would someone else?
  • Even when you do find someone, it will never be perfect. There's no such thing as a perfectly compatible person, so don't set impossibly high standards. You're not perfect either — finding someone willing to grow together with you is already pretty great.
  • Most importantly: don't make any one thing your entire life. There's so much more — friends, family, hobbies. Putting all your happiness on one person creates too much pressure and isn't fair to either of you.

That's all I'll say. I hope everyone finds their own happiness — whether it's a relationship or something else entirely. Wishing you all joy!

Personal Updates

Jumped into vacation mode early this weekend, didn't look at much tech. Honestly should rename this to Cosine Weekly Bits (lol).

Playing Reverse: Otherverse — been hyped since last year's mid-year BW and it's finally out. The scenery absolutely gets me; a big part of why I play is for the environments and the anime aesthetic. Stunning landscapes, and rain, snow, clear skies, sunrises and sunsets each have their own beauty. Plus you can do aerial photography.

A cherry blossom tree scene I stumbled upon, perfectly matched with the weather at the time.

A railway track I found by chance……

Happened to teleport to a waypoint at sunset — a moment of serene beauty.

Stained glass in a side-quest church…… forgive the screenshot quality — it's way more stunning in-game.

Already bought a spacious apartment in-game.

The city in this game truly feels alive — every shop can be seamlessly entered. Boss designs are also impressive, like driving into that undersea tunnel anomaly.

Sometimes I think I'm so childish — playing games, watching monthly anime, eating good food, and that's enough to keep me satisfied. Twenty-some years of rinse and repeat.

Chatting with my sister, I realized that college students still deal with the same old drama as always. Next week is the May Day holiday and I'll be traveling to Japan for the entire break — super excited.

Ecosystem & Community Updates

  • What's New in WebGPU (Chrome 147-148): Covers the latest WebGPU updates in Chrome 147 and 148, including WGSL indexing extensions and Linux platform support improvements.

  • Vercel April 2026 security incident: Vercel disclosed an April 2026 incident in which a third-party AI tool led to internal system and environment variable exposure. The breach originated from the compromise of Context.ai, a third-party AI tool used by a Vercel employee. The attacker used it to take over the employee's Google Workspace account and infiltrate Vercel's internal systems, resulting in unauthorized access to some customers' Environment Variables. Vercel has since partnered with Google Mandiant to remediate the issue, confirmed that npm packages were unaffected, and strongly recommends that affected users rotate credentials immediately and enable MFA.

  • The end of responsive images: Responsive images standard co-author Mat Marquis announces that with full browser support for sizes="auto", developers can finally stop manually calculating and writing complex sizes attributes.

Articles

Tools

  • jameskerr/react-arborist: A fully-featured tree view component for the React ecosystem, aiming to deliver an interaction experience on par with the VSCode sidebar, Mac Finder, or Figma's layers panel.

Fun Sites

See the Pen bNweEOB by undeadinstitute (@undeadinstitute) on CodePen.

If you enjoyed this, leave a comment~

... Page views
© 2020 - 2026 cos @cosine
Powered by theme astro-koharu · Inspired by Shoka