The Datasette SQL injection patched in 1.0a38 and 0.65.3 leaks private tables via unescaped filter columns. The check, upgrade, and why execute-sql is no fix.
Make your site agent-readable in four layers — readable, discoverable, callable, payable. Three are build-time files; only /mcp needs a Worker.
Ads for AI agents are live. TIME serves crawlers a 42 KB markdown site with sponsored blocks; humans and Googlebot get 1.2 MB of HTML. I measured all of it.
React Server Components in 2026: the mental model that finally clicks, the use client boundary rules, and when NOT to use them — with the Web Vitals payoff.
Streaming HTML out of order without JavaScript: how Declarative Partial Updates and Declarative Shadow DOM reorder content natively in Chrome 148.
FastAPI 0.138.0 ships app.frontend() — a native way to serve React, Vue, and Svelte SPA builds. How it works, real use cases, and what it still can't do.