Edition 23: Is your CI slower every single week, what npm and GitHub changed about supply chain attacks | Craig Abbott on accessibility

Edition number 23. Why your pipeline keeps getting slower while your agent keeps getting faster, Craig Abbott on the accessibility problems no automated checker will ever catch, and the week npm and GitHub shipped a pile of supply chain defenses.

New article: Frontend CI/CD in the age of AI, part 1

Your agent writes the feature in 5 minutes. Why does CI take thirty to tell you whether it worked?

And how much of that half hour is spent on tests the agent wrote because it likes writing tests?

This one is all about CI and how to make it faster. Check it out.

Read the full article here

Podcast: Craig Abbott on accessibility at scale

New episode of Señors @ Scale is out. Craig Abbott is a Principal Accessibility Specialist at TetraLogical and was Head of Accessibility at the UK's Department for Work and Pensions, where he built the practice from nothing and open sourced the DWP Accessibility Manual.

We get into why passing every automated check does not mean anyone can use your product, how to stop accessibility walking out the door when the one person who cared about it leaves, running screen reader tests in CI with Playwright and Guidepup, and what it means that 95.8% of the top million sites fail automated checks while the LLMs writing your frontend trained on all of them.

Watch the full episode on YouTube

Listen on Spotify

Community reads

Supply chain security

The secure way to release an npm package in 2026 by Andrey Sitnik and Travis Turner — attackers automate package theft with LLMs now, and this is the checklist for making your release expensive to hijack.

Disrupting supply chain attacks on npm and GitHub Actions by Greg Ose and Zachary Steindler — what GitHub and npm changed after the last few months of attacks, including install scripts being off by default in npm v12.

Testing and tooling

Visual Regression Testing: The Most Important Test You're Not Running by How To Test Frontend — 100% coverage and every test green, and the page can still render completely broken.

Stacked pull requests are now in public preview by GitHub — stacked PRs are out of private preview, and you can build a stack from the terminal or from github.com.

CSS and the web platform

Something Nobody Told You About The Image Element (It Can Overflow!) by Temani Afif — the img element is both a container and its own content, which is how an image ends up overflowing itself.

What's new in web UI by Bramus and Una Kravets — 35 new capabilities in one post, including corner-shape, native CSS scroll-spy, contrast-color() and if() for conditional styling.

Engineering leadership

There is No Such Thing as Technical Debt by Mike Longin — the metaphor bundles deliberate tradeoffs together with plain obsolescence, then hides both on an engineering backlog where they never compete with product work.

AI

We're Shipping Faster While Understanding Less by Eric Roby — he ships more code than at any point in his career and understands a smaller share of it than ever, and he reads that as the job changing under him.

Miscellaneous Thoughts About Building Stuff with AI in July 2026 by Brent Ozar — he caught Codex opening a browser window to ask Claude to do the thing Codex itself was forbidden from doing.

Latent Space as a New Medium by Kevin Kelly — the compressed map of everything a model knows is a space you can travel through, which he argues makes it the newest artistic medium.

Kimi K3 and Kimi K3 Fast with ZDR and US-based providers now on AI Gateway by Vercel — Kimi K3 lands on the AI Gateway with zero data retention and US-based providers, for teams that data residency rules have been blocking.

Book recommendation

Four Thousand Weeks: Time Management for Mortals by Oliver Burkeman

Oliver Burkeman wrote the Guardian's weekly psychology column from 2006 to 2020, which is fourteen years spent working through the productivity industry on everyone else's behalf.

This is one of the most influencial books I read recently, it really helped changed my mindset on Productivity.

Find it on Goodreads

Meme of the week

Conferences

ZurichJS

ZurichJS is still on my list this year. It's single track, so you can keep up with the whole thing, and the people running it know what they're doing.

Use code REACTJSBARCELONA_10 for 10% off tickets.

More info and tickets

CityJS Athens

CityJS lands in Athens this October. Adding it here because the CityJS events are consistently worth the trip.

My link takes 10% off the ticket price for you.

More info and tickets

React Day Berlin

React Day Berlin takes over Kosmos on December 4, a space-age theatre from the 1960s on Karl-Marx-Allee, and then runs a second remote-only day on December 7. Around 800 people in the room, another 5,000 watching from everywhere else, and 40+ speakers across tracks on AI assisted coding, AI engineering, full-stack architecture, and growing into a senior or tech lead role.

Register through my badge and the remote ticket is free, which normally costs €90 at the early bird rate. You get the HD stream and the free remote workshops, and the recordings afterwards.

Register with my badge and watch for free

That's it for this one.

If you're enjoying these, share the subscribe link with your team on Slack:

neciudan.dev/subscribe