We all know React as the community favorite library for developing web and mobile but what about devices on the edge? Edge/Embedded devices have significant restrictions on resources (memory, disk space, and compute) but that doesn't mean React can't be deployed to them. In this talk we'll discus...

Most React applications treat state as the single source of truth. But what happens when time itself lives outside React?

While building a production multi-track timeline engine, we discovered that the Web Audio transport, not React state had to become the canonical timeline. In this t...

Kenton Varda advocates for using CapnWeb, an RPC protocol, over REST for web APIs, emphasizing benefits for humans and AI agents. CapnWeb simplifies client-server communications by treating them as function calls. TypeScript type checking ensures method accuracy in CapnWeb across JavaScript runtimes. Stubs in CapnWeb allow method calls to execute on remote objects and simulate all possible method names for remote calls. Converting REST APIs to CapnWeb streamlines code and improves API calls. CapnWeb enhances API functionality with object-specific RPC sessions and promises pipelining for multilevel API optimization. AI agent security challenges are addressed with sandboxing and token protection in CapnWeb. CapnWeb capabilities for AI agents include passing restricted CapnWeb stubs and exploring capability-based security with CapnProto.

Modern web development still relies on a strong separation between HTML/CSS for UI and Canvas/WebGL for rendering. In practice, combining both often leads to complex synchronization logic and a series of workarounds.In this talk, we’ll first walk through how these problems are typically so...

JavaScript uses Garbage Collection (GC) for memory management. As a result, many developers that use JavaScript based systems, such as NodeJS, assume that they’re free of memory issues. Unfortunately this is incorrect, and many NodeJS-based services suffer from memory management problems such as...

When React 18 was released with the first concurrent features, the documentation clearly stated, “The most important addition in React 18 is something we hope you never have to think about: concurrency.”
It’s been a few years, and by now it’s clear that this statement was optimistic. You def...

Introducing Node.js security overview, defining vulnerabilities, non-vulnerabilities, and preventive measures. Discussing Node.js API input validation, real vulnerabilities like HTTP server crashes, and the importance of Node.js security in widely used platforms. Discussing the importance of Node.js maintenance, the introduction of experimental permissions in Node.js 20, and the seatbelt philosophy to protect against malicious code. Discussing the importance of maintaining up-to-date Node.js versions and using tools like npx isMyNodeVulnerable for security checks. Discussing the importance of Node.js security releases, funding, and dependency vulnerability assessment for a safer Node.js environment. Using Node.js Dependency Vulnerability Assessment to evaluate and address potential vulnerabilities, ensuring automated security checks and updates for a safer Node.js environment. Automating Node.js security release process, including configuration files for dependencies, extensive testing across various environments, and creating security release issues and blog posts automatically. Support for various environments, extensive testing with over 55 suites and 5,000 unit tests, automation efforts to streamline processes, and the establishment of a maintenance threat model for enhanced security measures. For a single pull request, it takes six hours to run tests, automation efforts in progress, maintenance threat model to address security risks, permission model roadmap, ongoing discussions on security reports, and plans for the Node.js Collaborator Summit. Active community involvement in Node.js security development, four security releases from 2024 to 2026 addressing various vulnerabilities, end-of-life version strategy with Node.js 16 and 18 having high weekly downloads, and the approach to issuing CVEs for end-of-life versions. Node.js project's strategy adjustment for CVEs to include end-of-life versions, importance of Node.js threat model, trust boundaries, and developer responsibilities. Node.js protection against network data, upgrade recommendations for different Node.js versions, and upcoming changes in Node.js release schedule.

Claude Code is no longer just a coding assistant, it's becoming an operating system for software development. In this talk, I'll walk through how reusable templates, agents, hooks, skills, and MCP integrations can transform Claude Code into a structured, composable workflow engine. Drawing from b...