Schedule

Today, every website downloads and stores its own copy of large files like AI models, WebAssembly modules, Web fonts, and popular JavaScript libraries. If two websites use the same file, the browser downloads it twice. In this talk, I present the Cross-Origin Storage (COS) API — a proposed shared cache where files are identified by their SHA-256 hash, not by URL. I show both the imperative JavaScript API and the declarative forms via import attributes, HTML, and CSS, with live demos.

JavaScript Framework authors face a brutal tradeoff when it comes to observability, either ship "blind" code and rely on 3rd parties to brittlely monkey-patch your API, or bloat your bundle with heavy observability dependencies. Both options hurt developer experience and performance.Tracing Channels changed this. A native, zero-dependency pattern that allows frameworks to emit events that are contextualized, and execution-correlated end to end.In this session, I'll show how tracing channels enable open observability APIs that progressively enhance with newer Node.js versions and gracefully degrade with zero overhead. We will also take a look at how popular libraries and frameworks that we use today implement their tracing channels and the patterns that allows them to benefit users and APM providers.Stop paying the instrumentation tax.

QUIC in Node.js has been a work in progress for a long time and we're very nearly there. If you want to know how to use it, you can refer to the docs. If you want to know some of the gnarly details of what's happening under the API, this is the talk. We're going to go deep.

JavaScript has been around for almost 30 years and we are still finding ways to hurt ourselves with it.Sit back, relax, and join me on this journey through the history of JS security vulnerabilities. We will be starting in the days of innerHTML abuse and Cross-Site Request Forgery, moving along through the JSON hijacking era, making a stop to take a look at npm supply chain abuse, and landing in what we’re all dealing with presently: how AI assisted coding is introducing new vulnerabilities in ways we have not had to deal with before. By the end, you’ll have a better understanding of how JS’s attack surface has evolved, why bugs keep resurfacing under new names (cough cough, it’s trust), and what patterns to watch out for with current code you’re shipping. You’ll also understand why XSS has always been a top OWASP injection vulnerability, and will continue to be until we enforce better security practices.You don't need a security background to follow along, you just need to have run npm install and trusted what came back.

Learn how 3 creative award winning projects work, who and why they make them, and how you can get started as well.The three websites could be Shopify's editions, and two other award winning websites made by agencies or by me.

The slowest smartphone your code will ever run on is ridiculously fast in an objective sense. So why does every burrito taxi website feel like trying to run in waist-deep molasses? Gather round this here campfire for (largely anonymised) tales from ten years of PWA consulting performance remediation purgatory.

I have been running an AI second brain as a developer for the past year, and it saves me at least 20 hours every week. It knows my repos and the conventions in each one, dispatches coding work to run in the background, drafts my email replies, and pings me on Slack when something needs my attention. In this talk I will show you how to build one in TypeScript.We will walk through the four parts that make it work. The memory is just markdown files that the agent writes to and curates itself.

Today’s generation of web AI is largely confined to server roundtrips: users type into a prompt box, wait seconds for a cloud API response, and pay per-token fees while streaming sensitive private data to remote servers.But the next frontier of web development is rich, sensory, and on-device. Modern web applications can now perceive the user’s physical environment through the camera and microphone, process visual and spatial feeds at 60 frames per second, and fuse that perception with on-device language reasoning—all executing locally on the client's GPU with zero cloud infrastructure.In this fast-paced 20-minute talk, we showcase what the future of web applications looks like with High-Performance, Multimodal Web AI, powered by Google's LiteRT (@litertjs/core and @litert-lm/core):Perception at 60 FPS: How WebGPU compute pipelines allow web apps to run real-time monocular depth estimation, multi-class segmentation, and 4x neural super-resolution directly on live video and canvas feeds.On-Device Cognitive Reasoning: How running local language models (like Gemma 4) in browser VRAM enables instant comprehension, summarization, and conversation without network latency.The Multimodal Fusion Loop: How perception models pass structured visual and spatial features directly to on-device reasoning models, enabling web apps to understand what users see and point at in real time.Actionable In-Browser Agents: How local models can invoke JavaScript functions and browser APIs to manipulate the DOM, edit media, or interact with local storage automatically.Through live interactive demonstrations—including real-time spatial vision copilots and in-browser media editing studios—attendees will discover how to transition from building passive web pages to creating responsive, intelligent multimodal web experiences.

AI has made code generation nearly free, but reliable systems still require architectural intent. While the world is moving toward having many agents orchestrate and manage your code, this approach can also lead to brittle orchestration and unverified execution. So in this talk, we'll focus on the right primitives you can use to turn rapid prototypes into coherent production systems. Learn how to design agent infrastructure that offers high observability and scales effectively.

For years, frontend engineering has focused on building interfaces for people to interact with applications through screens. We learned to design for different interaction models, from mouse and keyboard to screen readers and voice control.Now with AI agents comes another interaction model. Instead of navigating buttons and forms, they can increasingly interact with applications through structured capabilities such as WebMCP and other agent interfaces. This raises a new question: what does good frontend design look like when not every interaction goes through the UI?In this session, we'll explore how accessibility principles provide a useful foundation for thinking about agent experiences, and why frontend engineering is becoming more important rather than less.

AI systems have a new class of vulnerabilities that most developers aren't thinking about yet. This talk covers how they work, what's been exploited in the wild, and where the field is headed.

In this talk, we’ll explore how to build multimodal AI agents that understand voice, interpret images, hold short-term memory, and respond intelligently - all running entirely in the browser. No server, no cloud APIs, and no installation. Using modern tools like WebGPU and WebAssembly, we’ll see how far the open web has come in enabling real-time, privacy-preserving AI experiences.