The tale of a bizarre bug encountered in Google Docs

#​729 — March 28, 2025

Read on the Web

JavaScript Weekly

⭐ The State of Vue.js Report 2025 — Created with the support of the Vue and Nuxt teams, this is no mere collection of statistics and charts (though there’s plenty of both) but a thorough update on the state of both projects and an interview with Evan You on Vue (and Vite’s) latest developments. Essential reading for any Vue, Vite, or Nuxt user and a one-stop shop for understanding Vue and Nuxt as they stand right now.

Monterail

Master Chrome’s DevTools — Join Jon Kuperman for this video course diving into Chrome’s DevTools. You’ll go beyond console.log(), learning how to inspect, debug, and audit your web apps — tracking performance, identifying bottlenecks, making performance gains, and more. Level up your DevTools skills.

Frontend Masters sponsor

War Story: The Hardest Bug I Ever Debugged — A former engineer on the Google Docs team tells the tale of a bizarre error that afflicted Google Docs out of the blue about ten years ago. It’s a gnarly one and was only solved due to his swift access to V8’s engineers. If you’ve ever spent hours digging into a bug, you’ll feel glad you weren’t dealing with this one!

Jacob Voytko

Next.js’s Recent Middleware Security Woes — Last weekend, a new version of Next.js landed to resolve a security vulnerability that could allow middleware to be bypassed. Self-hosted Next.js deployments need to be upgraded immediately. The news led to many responses including deep dives into the vulnerability and criticism of how it was all handled.

Lee Robinson (Vercel)

IN BRIEF:

• Cloudflare has done some work to bring the URLPattern URL matching API to Node.js and Cloudflare Workers.

• 🤖 If you haven’t checked out Google’s Gemini AI tool recently (or ever), it now supports generating HTML, JavaScript, and React code in a ‘canvas’ mode for building components on the fly.

• 🤖 MCP Node.js Debugger is an attempt to make Node’s debugger more accessible to third-party AI coding tools (such as Cursor or Claude Code).

• 📊 Is Vite faster than Turbopack? “Well, it depends.”

RELEASES:

• Bun v1.2.7 – Bun’s HTTP server now has built-in support for reading and writing cookies using a Map-like API.

• Node v18.20.8 (LTS) – Note that Node 18 reaches ‘end-of-life’ next month.

• Sinon 20.0 – Test spies, stubs and mocks library.

• pnpm 10.7, Babel 7.27.0, ESLint 9.23.0, Neutralinojs 6.0, Material UI v7

📒 Articles & Tutorials

Writing a Tiny Undo/Redo Stack in JavaScript — You might prefer to lean upon an established approach (using Immer patches perhaps), but if you want to implement something small yourself, this might help.

Julik Tarkhanov

Land Ahoy: Leaving the Sea of Nodes — A deeply technical post from a core member of the V8 JavaScript engine team that explains the limitations of Turbofan, one of V8’s optimizing compilers. If you don’t care for the internals of how your JavaScript is compiled and run, just be assured the V8 team is working to make it run even faster.

Darius Mercadier (V8)

Which AI Model Is Best for Fixing Unit Test Errors? Claude, O3-Mini, GPT-4o? — Better context wins every time. Wallaby provides AI with test coverage and runtime values to debug smarter. MCP support coming soon.

Wallaby Team sponsor

Mission jQuery Zero: How FreeAgent Removed jQuery From Its App — Despite popular developer sentiment, jQuery’s prevalence on the Web continues to be significant but “sometimes legends need to retire”.

Colin Gemmell

▶  React Query API Design: Lessons Learned — You might know Dominik for all his work on React Query, TanStack Router, and his epic React Query – The Bad Parts series. Here, he walks us through the design choices made while building React Query and shares lessons and mistakes valuable to anyone building their own libraries. (30 minutes.)

Dominik Dorfmeister (TkDodo)

Deploying a Next.js App to Production on Any Server — A popular article from last year that’s been updated for 2025 and Next.js 15.

Kamrannetic

🔒 Protect Against AI Bots, Fraud, and Abuse in Real Time — WorkOS Radar protects your app with advanced device fingerprinting — stop fake signups, free tier abuse, bot attacks and brute force attempts today.

WorkOS sponsor

📄 Expressing Japanese Grammar in the TypeScript Type System – A curious project out of left field. Yifeng Wang

📄 Directives: A Core Feature of the Angular Toolkit Vyacheslav Borodin

📄 You Should Know This Before Choosing Next.js Eduardo Bouças

🛠 Code & Tools

Babylon.js 8.0: Microsoft’s JavaScript 3D Engine — 8.0 adds support for improved ‘image based lighting’ and ‘area lights’ for environmental lighting and shadows, extra control of the render pipeline, and a new lightweight viewer. And, as always, they have ▶️ a short video showing it all off.

Microsoft

🤖 An MCP Server for Playwright and Browser Automation — MCP (Model Context Protocol) servers enable certain LLM-based agents (such as Claude, Claude Code, and Cursor) to perform actions on a system outside of their usual sandbox. This new project from Microsoft enables such LLMs to interact with browsers via Playwright.

Microsoft

Lexical 0.29: An Easy-to-Extend Text Editor Framework from Meta — A text editor framework built by Meta with extensibility, accessibility, and cross platform support in mind (there’s even a Swift variant for iOS). There’s a live playground if you want to give it a try.

Meta / Facebook

🔎 Fuzzball: Fuzzy String Matching Library — To tackle those cases where what’s typed isn’t quite what’s wanted. There’s a neat tree-themed Web-based demo.

Nolan

• Axios 0.30 – Long-standing, promise-based isomorphic HTTP client.

• Solito 4.4 – React Native + Next.js. Now supporting Next.js 15.

• InversifyJS 7.2 – Inversion of control container for JavaScript.

• jscodeshift 17.3 – JavaScript codemod toolkit from Facebook.

• Verdaccio 6.1 – Lightweight Node.js private proxy registry.

📢  Elsewhere

A quick roundup of other interesting updates and useful resources from across the broader developer landscape:

• <select> elements have always been notoriously tricky to style with CSS but there’s a new standardized approach beginning to become available.

• ls-lint is a mature tool for linting file and directory names.

• Someone’s managed to get Go code to compile and run on the PlayStation 2.

• 👑 People’s experiments with TypeScript’s type system continue with the latest creation being a chess engine built from TypeScript types.

• LLM wrangler Simon Willison was getting annoyed at being unable to easily visualize incomplete JSON documents so he built an ‘incomplete JSON’ pretty printer.