WEBVTT

1
00:00:00.420 --> 00:00:07.160
What's up everyone? Welcome to Next in Dev, a weekly overview of all the news I could find in the modern web dev industry.

2
00:00:07.200 --> 00:00:25.030
This week, Anthropic accidentally published the entire source code for Claude Code, Railway's brand new CDN leaked authenticated user sessions, Google wants you to dump your AI chatbot for Gemini, and Cloudflare announced a WordPress successor that half the internet thought was an April Fools' joke.

3
00:00:25.500 --> 00:00:34.460
Let's dive in. The biggest story this week is an embarrassing one. Anthropic accidentally leaked Claude Code's source code through an NPM packaging error.

4
00:00:34.520 --> 00:00:44.240
A recent release contained a source map file pointing to a zip archive on Anthropic's own cloud storage. There were nearly 2,000 TypeScript files and over 500,000 lines of code.

5
00:00:44.380 --> 00:00:56.030
A security researcher flagged it on X, and within hours, the code base was mirrored across GitHub with 84,000 stars before Anthropic could start issuing takedowns. What's actually in the code is fascinating.

6
00:00:56.060 --> 00:01:04.960
There's a three-layer memory architecture where the agent treats its own memory as hints rather than facts, and verifies everything against the actual code base.

7
00:01:05.220 --> 00:01:14.560
There's also an unreleased autonomous mode that lets Claude Code work in the background while you're away, and there's further evidence of an upcoming model codenamed Capybara.

8
00:01:14.920 --> 00:01:21.440
This comes days after Fortune reported that Anthropic had already left 3,000 internal files publicly accessible.

9
00:01:21.720 --> 00:01:27.680
Two leaks in one week from the company whose entire brand is built on being more careful than everyone else isn't great.

10
00:01:27.740 --> 00:01:37.280
The features are impressive engineering, but this is a $19 billion ARR company, and it just gave every competitor a free look into how the sausage is made.

11
00:01:37.460 --> 00:01:45.490
Source map leaks are an easy mistake, but Anthropic chose to position itself as the safe one, and they need to earn it operationally, not just philosophically.

12
00:01:45.780 --> 00:01:56.650
Speaking of things leaking, Railway launched CDN support on March 27th. Three days later, a configuration update accidentally enabled caching on domains that had CDN turned off.

13
00:01:56.820 --> 00:02:04.360
For about an hour, Railway cached and served HTTP GET responses, including authenticated ones, across affected domains.

14
00:02:04.420 --> 00:02:13.140
Railway's incident report says roughly.05% of domains were affected, but users on the support forums reported being logged in as other users entirely.

15
00:02:13.220 --> 00:02:23.180
One user had evidence of customer data being exposed and hadn't received any notification almost 48 hours later. Railway acknowledged they didn't even have CDN logs initially.

16
00:02:23.600 --> 00:02:29.760
If you're running anything with authenticated users on Railway, audit your cache headers today. Google had a busy week.

17
00:02:30.100 --> 00:02:40.170
They launched a switching tool for Gemini that lets you import memories and full chat history from other AI chatbots. This is similar to Anthropic's switching tool that released around the Pentagon kerfuffle.

18
00:02:40.500 --> 00:02:50.560
The memory import works through a copy/paste workflow where Gemini gives you a prompt, you paste it into your current app, it generates a summary, and you paste that back into Gemini.

19
00:02:50.800 --> 00:03:02.020
For chat history, you can upload a zip file. Google is betting that once you're inside the Gemini ecosystem with Gmail, Photos, and Search all connected, you won't want to leave. I get the thinking, but I don't agree.

20
00:03:02.360 --> 00:03:13.700
Separately, Google released Gemma 4. The 31B dense model ranks number three among all open models on Arena AI, outcompeting models 20 times its size. What's most interesting is the license.

21
00:03:14.020 --> 00:03:24.470
Gemma 4 is Apache 2.0, a real open source license, not the restrictive terms they used for previous Gemma releases. Google is directly responding to community criticism with this move.

22
00:03:24.760 --> 00:03:30.430
They've claimed previous models have been open, but the licenses they've provided have always been more restrictive than that.

23
00:03:30.720 --> 00:03:36.940
Cloudflare announced MDash, an open source TypeScript CMS they're calling the spiritual successor to WordPress.

24
00:03:37.340 --> 00:03:49.540
It runs serverless on workers, uses Astro as its front end framework, and has a fundamentally different plugin security model. Each plugin runs in its own isolated sandbox and declares exactly what permissions it needs.

25
00:03:49.620 --> 00:04:00.300
No file system access, no database access unless explicitly granted. This seeks to address the fact that 96% of WordPress security issues come from plugins, but the early criticism is fair.

26
00:04:00.620 --> 00:04:08.329
Search Engine Journal pointed out that there's no visual site builder, setup requires a CLI, and the announcement is entirely developer-focused.

27
00:04:08.520 --> 00:04:20.579
At version 0.1, this is a developer preview, not a WordPress replacement, but the plugin security model is actually innovative, and if Cloudflare builds out the user experience, this could become significant.

28
00:04:20.680 --> 00:04:26.000
Also, launching on April 1st was a choice. A lot of people dismissed it as an April Fools' joke.

29
00:04:26.240 --> 00:04:34.550
On the topic of CMSs, Payload released version 381 with an LLM evaluation suite for testing whether AI coding tools generate correct Payload code.

30
00:04:34.720 --> 00:04:43.180
This is Payload building automated benchmarks to make sure that when you ask Claude Code or Cursor to scaffold a collection, the output follows Payload conventions.

31
00:04:43.460 --> 00:04:53.140
Much of this release is focused on stability and adjusting dependencies. Claude Code pushed seven releases since I last covered it, 2.1.84 through 2.1.90.

32
00:04:53.340 --> 00:05:03.380
Highlights include a PowerShell tool for Windows, transcript search, and major performance fixes. Auto mode now actually respects explicit user boundaries like don't push or wait before doing something.

33
00:05:03.600 --> 00:05:15.050
Previously, it could override those instructions, which is a pretty big trust issue for an autonomous coding tool. And yes, 2.1.88 was the version that leaked the source code. It's been pulled down.

34
00:05:15.100 --> 00:05:17.120
Now for a few rapid fire things.

35
00:05:17.160 --> 00:05:36.000
Figma launched Make Kits and Make Attachments, which are kits that let design system teams package their NPM components with guidelines that teach Figma Make how to use them, and attachments let you bring real data sets, screenshots, and brand docs into prompts so prototypes use actual content instead of placeholders.

36
00:05:36.200 --> 00:05:39.880
AI image tools also expanded to FigJam, Slides, and Buzz.

37
00:05:40.160 --> 00:05:49.660
Astro 6.1 added global sharp image encoding defaults, advanced configuration for non-English typography, and internationalization fallback routes for integrations.

38
00:05:49.820 --> 00:06:02.240
Tan Stack Router replaced its reactive core with a signal graph built on Alien Signals. Client-side navigation dropped about 35% in React. No API changes required. It's the same hooks, just with fewer re-renders.

39
00:06:02.469 --> 00:06:14.220
What did I miss? Let me know by leaving a comment wherever you're watching or listening, or by joining my Discord server and subscribing to the Next in Dev newsletter at nlvcodes.com. Thanks for watching or listening.

40
00:06:14.560 --> 00:06:15.520
See you in the next one.

41
00:06:15.900 --> 00:06:35.240
[outro music]