TLDR Dev 2025-11-20

Say hello to frictionless authentication for your iOS users! Clerk's Expo SDK now offers true native Sign in with Apple support, meeting Apple's requirements for third-party sign-in while providing a seamless experience focused on privacy and ease-of-use.

Integrate in minutes—just configure OAuth in your Clerk Dashboard and let the SDK handle native flows automatically. No hacks, no extra steps—just simple, beautiful authentication that works for users and developers.

Upgrade today and give your Expo app secure, compliant onboarding with Apple's trusted ecosystem.

Next.js's Partial Prerendering (PPR) is a new rendering paradigm that optimizes performance by serving static parts of a page immediately while allowing dynamic components that need request data to render on the server. The first implementation in Next.js 14 used error throwing to detect request data access, but this caused issues with existing applications that had try/catch blocks and retry logic. The updated approach in Next.js 15 switches to a Promise-based system where request APIs like `cookies()` and `headers()` become asynchronous and return never-resolving promises during prerendering.

Geocodio, a geocoding service, experienced a $1,000 AWS bill due to unexpected data transfer charges through a NAT Gateway when syncing data to S3. The team learned that traffic between EC2 and S3, even within the same region, can route through the NAT Gateway and incur costs. The solution was to implement VPC Gateway Endpoints for S3, which provide a free, direct route, bypassing the NAT Gateway.

The AI boom is overhyped, potentially a bubble, and may not deliver on its grand promises, especially in design. While AI can be useful in small-scale applications, its implementation doesn't actually result in as many savings as expected. Instead, the true motive behind the AI frenzy is the acquisition of resources like land, energy, and water needed to power massive data centers.

"Just JavaScript" is code that works without custom transforms, allowing devs to understand and refactor their code easily. Svelte and React are not "just JavaScript" due to their unique languages/semantics and custom transforms, respectively. However, Remix 3 adheres to this principle.

Traditional SaaS go-to-market strategies don't work for AI-native products. Unlike traditional SaaS, which focuses on perfect MVPs, narrow customer profiles, and monetization-first approaches, AI-native products require breaking these rules by launching imperfect products, building viral distribution channels first, and targeting broader early customer profiles who can provide feedback and social sharing. AI-native companies must prioritize building "omnipresent" distribution channels and momentum over traditional metrics like product-market fit and willingness to pay.

New and exciting AI capabilities are helping developers unleash their creativity faster than ever. Having systems in place keeps AI outputs structured, useful, and reusable.

What: This live webinar on December 3/4 will demonstrate how Rovo, Rovo Dev, and Lovable combine to turn vibes into results. See how you and your team can prototype easily with Lovable - and then link directly across the Atlassian Teamwork Collection to drive collaboration and productivity.

Who: Presented by product managers at Atlassian and Lovable

👉 Join live: How Atlassian and Lovable transform software delivery

In the meantime, check out another can't-miss event from Atlassian, focused on strategies to future-proof your engineering org: The modern tech leader's playbook for AI-powered teamwork

FumaDocs is a documentation framework built on Next.js that uses TypeScript, MDX, and Tailwind CSS. It provides utilities, a UI, and features of Next.js App Router. FumaDocs includes built-in components and integrations, focusing on a user-friendly mobile responsive experience.

OpenAI's GPT-5.1-Codex-Max is an advanced agentic coding model built on an updated reasoning foundation and designed for long-running, detailed software engineering tasks. The model can operate across multiple context windows, enabling project-scale refactors and deep debugging sessions. GPT-5.1-Codex-Max is available in Codex.

AI can be used to scam elderly people. These journalists successfully jailbroke AI models like Meta and Gemini to generate phishing emails, which were then sent to elderly participants, resulting in 11% being phished. The journalists also investigated real-world AI scam factories in Southeast Asia and found that victims were using AI chatbots to conduct scams.

NPM recently announced that all long-lived tokens are being revoked and new tokens will only be valid for a maximum of 90 days, creating challenges for automated publishing workflows. While the proper solution is to upgrade to trusted publishing (OIDC), a tool called "github-update-secret" automatically rotates secrets across all repositories to buy time until each project can be properly migrated. This tool iterates through all repositories with admin access and updates any matching secret names with new values.

Open-source projects, often led by a single individual, should learn from Mastodon's example of gracefully transferring power to avoid the pitfalls of forever founder-led projects and guarantee long-term stability.

Linus Torvalds says that "vibe coding" is a positive entry point to programming, but unsuitable for production-level kernel development.

Blame as a Service (BaaS) is a growing market where companies like McKinsey, Ticketmaster, and UMA absorb the negative backlash from unpopular decisions, allowing their clients to maintain a positive image while maximizing profits.

Growth methodology is a data-driven development approach used by monday.com's Growth team that differs from traditional software development by requiring engineers to think like product managers and validate ideas before perfecting them.