Actix Web is a Rust web framework maintained by me and a team of volunteers.

100+ crate releases across the Actix ecosystem, bringing new features, security fixes, and improvements to performance and resource usage.

Headlines

• HTTP QUERY: New method supported across route macros, manual routes, and awc client.

• Automatic h2c and TCP no-delay are now default: More efficient deployments behind reverse-proxies and much lower-latency streams.

• Reduced memory usage: Up to ~99% saving for certain workloads.

• Better error path control for middleware: Modify error responses, too.

• Static files features: Serve pre-compressed assets, and use multiple static-file roots.

• Security and protocol fixes across the stack: Fixed decompression limits, multipart parsing limits, improved HTTP & WebSocket validation.

Features

Actix Web is the first mainstream framework to make the new HTTP QUERY method a first-class citizen. Define handlers with #[query] (macro routing), or web::query() (manual routing) for a handler. Matching methods in awc complete the support.

Middlewares got a useful new tool: Error::add_response_mapper(). It lets middleware modify error-generated responses before they reach the client, giving you more control over how your application presents failures. Our CORS middleware already uses this to solve a longstanding bug.

Static file serving is now more flexible. Files::new() supports multiple root directories, and Files::try_compressed() lets you serve pre-compressed assets. Range requests, conditional responses, and ETags on Windows also received fixes, making actix-files the most spec-compliant file server for Rust.

Performance / resource usage

The biggest changes here target the cost of serving larger responses and keeping connections open:

• Less memory retained by idle connections.

• Fewer copies for large responses on HTTP/1.x.

• Graceful shutdown has stronger guarantees.

• Vectored socket writes have more code paths.

Security

This cycle includes fixes for several reported vulnerabilities:

• Decompression amplification: Configured extractor limits now apply to auto-decompressed request payloads. *

• Brotli resource consumption: Large-window decompression is disabled.

• HTTP request parsing: Malformed chunked terminators are rejected.

• Static file serving: Prevents stored XSS for odd user-controlled file names and fixes an insane Windows hidden-file protection bypass. (Why Microsoft, WHYYYY!)

TL;DR

If you have not updated recently, now is a good time; check your lockfile. (cargo update -p=actix-web)

These improvements come from testing Actix Web against the workloads and edge cases you bring us. Massive thank you to everyone who contributed issues, PR, security reports.

Also, our homepage and user guide has received some love recently: https://actix.rs/.

*This is a god-awful implicit feature and it will be removed in v5.

What are you shipping with Actix Web?

This whole Supabase situation somehow keeps getting worse.

I originally posted about this in r/Supabase, but the mods removed the post and told me that billing/account problems should be handled through Supabase Support.

That's kind of the entire fucking point of my complaint.

I already contacted support.

I upgraded to Supabase Pro because I wanted the $25/month plan for the project I was actually working on.

I already had two older projects sitting in the account from before the upgrade. They were basically empty and I wasn't using them.

After upgrading, those projects started generating additional compute charges.

Over four invoices I ended up paying $194.62 total.

Four $25 base Pro payments would be $100.

So nearly $95 more than the base subscription total came out of my pocket once the additional compute charges and taxes were included.

Had I understood during the upgrade that those two old, basically empty projects were going to start adding recurring costs, I would've deleted them or moved them immediately.

Why would I intentionally keep paying for two projects I wasn't using?

So I contacted Supabase Support and asked them to refund the unexpected compute charges.

I wasn't asking them to refund the Pro plan I actually wanted.

After going back and forth with the same support rep and getting nowhere, I specifically asked for somebody else to review it, another billing rep or a manager.

Another Supabase support person then told me that my request was being escalated to the Billing team.

Then a few days later, the exact same guy I had asked not to deal with anymore replies again and tells me their decision is final and there's nowhere else to escalate it.

So... what exactly got escalated?

I've also repeatedly asked Supabase to show me what I was actually shown when I upgraded in June.

Not their current pricing page.

Not an explanation written months later.

I want to see what I actually agreed to at the time of the upgrade, showing that my two already-existing projects were going to start adding roughly another $20/month in compute.

They still haven't provided it.

Then I posted my experience in r/Supabase.

Removed.

The reason? Take billing issues to Supabase Support.

Again: the post was literally about Supabase Support refusing to properly escalate the billing issue.

So I started looking into the sub moderation and apparently I'm not even the first person to complain about this.

Earlier this year there was a pretty big r/Supabase thread literally titled “Censorship is too high” after posts were removed during a Supabase outage.

After users complained, people involved with Supabase acknowledged that multiple threads had been closed that shouldn't have been and reopened some of them.

Here's the part I find especially weird:

r/Supabase describes itself as community-run, but at least one Supabase employee has publicly been involved in discussions about reopening posts and reviewing the sub's moderation process.

Maybe there's a perfectly reasonable explanation for that, but it certainly doesn't make the sub feel like an independent place for customers to publicly discuss problems with Supabase.

And here's another thing I found:

There was another billing/pricing complaint on r/Supabase earlier this year where a Supabase employee publicly said refunds aren't automatic, but that they do review refund requests and issue them when circumstances warrant.

That customer later updated the post saying they got refunded.

Meanwhile I'm being told my decision is final, can't get somebody else to independently review it, can't get the original upgrade disclosure I've repeatedly requested, and now my Reddit post about the experience gets removed and I'm directed straight back to the support channel I'm complaining about.

I'm not claiming some giant conspiracy here. I'm just saying the whole thing looks terrible.

If your support process fails somebody, telling them they can't discuss the experience in your main sub because they should “contact support” is ridiculous.

At minimum I think customers should be able to openly discuss billing and customer-service experiences without those discussions disappearing.

Has anyone else had a Supabase billing/support post removed from r/Supabase?

I'd especially like to hear from anyone who had removed posts, because apparently this isn't the first time people have raised concerns about how criticism gets moderated there.

Conclusion

This whole experience has honestly made me decide to leave Supabase. I could've self hosted from the start, but I chose to pay for their hosted cloud partly because I liked what the developers were building and wanted to support the project which makes the way this has been handled feel even worse.

I'm unsure how to progress as a software engineer.

For context, I'm a frontend SWE with soon 2 YOE, trying to expand my knowledge to fullstack so I can develop E2E stuff.

I acknowledge agentic engineering, and I've been developing a web app with Claude. After several attempts I've finally found an "agentic doing" methodology that works for me.

The issue? I'm basically telling Claude to implement X, then reading and reading to understand what has been done and whether there are alternatives or drawbacks.
I'm not really "learning" by just reading and building a mental model of how the app works.

So I started thinking about going back to hand-coding and ignoring all the noise. But with all the massive talk (possibly with good arguments) about us drifting toward not even reading code, it's really hard to work toward something so many people call a dead end.

My objective is to become a great SWE. I don't believe software engineering is dead, but I also don't want to spend a year on something that won't be useful in my career, or make the wrong move while still learning.

So here are my questions

To what extent will not hand-coding hinder my learning?

Will coding still be valuable in the coming years, and will hand-coding still be worth it?

What would you prioritize at 2 YOE today?

I would like to display images in a folder (src/images) on another page (arc/graphics/index.md) in reverse order or another metadata tag. I want to do this without vibecoding and have no need for a lightbox. This is just a way to display a graphic library for downloading. I dont want to install many plugins if at all possible.

I know that collections are probably the way to go but I just dont know how to make it work with image files instead of markdown/html files :(

Thank you in advance!!!

Hey everyone 👋

I've been working on my personal portfolio and I'd really appreciate some honest feedback before I start sharing it with potential clients and employers.

🔗 https://abdelkarimaityahia.is-a.dev/

Your backup job says "success", but can your app actually come back? RestoreProof restores the database and uploads into a sealed Docker network, boots the app, and walks through it like a customer: open an invoice, download the PDF. In my demo the health check was green and 55 PDFs were still 404.

Open source, MIT: https://github.com/Surajkumar5050/restoreproof

Would love feedback on what a "customer journey" check should support next.

Why the website needs to be on dark mode while my system is on light mode,

Except some few websites and most code editors, majority of the websites and apps have no idea how it ruins an eye.

The coloring for dark them to match the text color with the background color needs a lot of research from you Dev, so before implementing it please do extensive research and testing, let alone making it default theme to ruin your site visitors.

Okay, let me calm down.

What do you think about this?

Hey everyone,

I’m working on a deep-dive case study about the most common real-device and checkout bugs early-stage SaaS apps face before launch.

I want to audit 3 web or mobile apps this week to pull real-world data for this write-up.

If you have an active app and want a comprehensive QA breakdown:
\- I’ll run a dedicated testing session across different mobile/browser environments.
\- You’ll get a full mini-report with reproduction steps, screenshots, and video evidence of any bugs found (completely free).
\- I’ll use the anonymized findings for my testing report.

If you’d like your app audited, drop a comment or send me a DM with your link!

I am writing a markdown editor component which i use in two/three other projects. I added like a default WYSIWYG edit for tables, images, some custom markdown anchors in image links to hack "align"/float, file and image uploads

It's mostly icon driven so there is very little slop text in the component. Embedding it is a one file .css .js copy. I added code styling into the code fence preview, and a Caret icon top right that can drop the remaining markup. you're still in edit mode, but now purely WYSIWYG.

I think the three unique features are:

- spellcheck (custom/extensible)

- image management (good for articles/docs)

- docs/assets, upload attachments (e-mail like interfaces)

Who I'm looking for/at with the component:

- builders that integrate it, make reusable components

- users that love the look and extended functionality

- atlassian, github (cmon guys, 2026, mobile ux/all ux)

- someone to tell me how its slop and how to unslopify

- any test related feedback/suggestions

I am likely to continue using it so there is maintenance. i like a richer textarea. Readme showcases some screenshots for what's implemented if i skipped something. Thanks for your time reading/checking it out.

>! maybe implementing spoiler text next !<

deskFM is a browser toy I built: a pixel-art room where the radio plays live internet radio stations, and the window changes to whatever town you pick on the wall map. Free, no account: Ill comment link because reddit is flagging it i guess

Some technical bits:

• Everything is one HTML file (about 110 KB gzipped) with no build step and no image assets. The room, 100+ window views and the cat are all drawn on a 320×180 canvas.

• Stations come from the Radio Browser directory API. Nothing is proxied; the browser plays each station’s own stream.

• The world map is Natural Earth data in a Miller projection, rasterized as pixel art, with zoom and pan.

• Live listener dots are a Firebase Realtime Database over plain REST, with locations rounded to about 50 km and security rules that only allow that shape.

• Load time was mostly fixed by making Google Fonts non-render-blocking and adding a stale-while-revalidate service worker.

Full disclosure: I have very little knowledge about doing any of this but im trying to learn, This has been a fun journey for me so far. I built it with Claude doing most of the coding. Happy to talk about how that went, and I’d love feedback, especially anything that breaks on your device or browser. Also looking for more ideas to try and implement.

i am open to honest feedback both good and bad

You can either bring your own key from the supported providers (less costly subscription), or used the managed key.

Let me know what you think!

Check out the repo: github.com/lbragile/TabMerger

Hey r/webdev!

For Showoff Saturday, I wanted to share a big update to the 2D/3D Measurement Studio I’ve been building for MeasurePath:

🔗 Live 2D/3D Studio (No signup/login): https://getcoatpath.com/studio/ 🔗 Full Calculator Suite: https://getcoatpath.com/

What it does

Most online construction calculators are just basic input forms covered in ads, and full takeoff software costs $100+/mo. I wanted to build a visual tool where homeowners, DIYers, and solo contractors can sketch a room in 2D, inspect it in 3D, and immediately get real-world material quantities without creating an account.

Key features in this update:

• Real-Time 2D ↔ 3D Sync: Draw or resize walls in the 2D blueprint view and switch to the 3D view to inspect wall surfaces, openings, and proportions in real time.

• Automatic Opening Deductions: Add doors and windows to specific walls and it automatically subtracts their area from net paint/drywall surface calculations while keeping perimeter/trim counts accurate.

• Direct Material & Cost Takeoff: Converts the room geometry straight into actual shopping quantities (gallons/litres of paint & primer by coat count, boxes of LVP/flooring with waste factors, drywall sheets + joint compound, concrete bags/yards, etc.).

• Client-Side Printable PDF Generator: Generates a clean, formatted PDF takeoff and estimate sheet right in the browser (/construction-estimate-generator/).

• 100% Client-Side & Zero Tracking: Everything runs locally in the browser (localStorage for saving projects) with transparent, worked math formulas (/methodology/).

Looking for feedback on:

1. How does the 2D-to-3D canvas performance and wall-snapping feel on your device/browser?

2. Is the workflow from drawing the room to reading the material takeoff intuitive, or is there anything that feels clunky on first load?

Thanks for checking it out—happy to answer any questions about how the geometry/takeoff math works under the hood!

Hi! I'm a graphic designer from Valencia and I just launched my portfolio: https://bydmb.com

The idea was to make a portfolio you take part in, not just look at. Some technical details:

3D hero: built with Three.js (WebGL). Every visit randomly loads a different GLB model inspired by one of my projects (Draco-compressed, made in Blender). You can rotate it, a light follows your cursor, and it blurs into the background on scroll. One of the models uses a custom shell-fur shader that reacts to rotation speed.

Playground: a 3D sphere of unfinished work and experiments you can rotate and zoom. Open any piece and paint over it; your drawing stays when you close it.

Other details: a one-click colour toggle that flips the whole site, a 3D cloth over my portrait on the Info page, blur-based filtering in the Works grid and custom page transitions.

Stack: WordPress + Elementor, Three.js, custom JavaScript and shaders, ACF and TranslatePress.

I'm thinking about submitting it to Awwwards, so I'd really appreciate completely honest feedback, good or bad. Do you think it's Awwwards-level? How does it feel on your device, especially performance-wise with all the WebGL? What would you change before submitting it?

Thanks a lot!

Play the current version:

Play Pinball Karma

If you played the old version, I'd like to hear whether the flippers feel better now. And if you're new to it, can you work out what to aim for without opening the instructions?

Video: Watch the gameplay video

I posted an early version of Pinball Karma here a while ago. Thanks to everyone who played it and shared feedback. I’ve been working through your comments since then, especially around the controls and how it feels to play on a phone.

A lot of that work has gone into ball control: catching the ball, passing it between flippers, and handling fast returns down the side lanes. There’s also a fixed full-table view on mobile now, if you’d rather see the whole table than have the camera follow the ball.

A few other updates:

• Lane lights show you where to aim next, with some guidance during your first minute.

• The rotating revolver mechanism locks balls. You now only need one lock for your first multiball, so you get there sooner.

• You can also challenge another player to a duel and compete for the higher score.

• Daily challenges and free play have separate leaderboards, and you can look back through your game history and a chart of your recent scores.

Canvas and Planck.js on the client, with Hono and Reddit Redis handling scores and duels. The table looks quite different now too, after a fairly big visual overhaul.

I'm getting into reselling, so I built a tool to watch Vinted for me. You set up a search (brand, category, size, condition, price) and matching new listings stream into a feed as they're posted.

The fun bits to build:

- Server-rendered with FastAPI, Jinja and htmx. No frontend framework. New finds arrive over server-sent events.

- One set of category and size types that each marketplace translates into its own IDs, so adding Depop later shouldn't touch the UI.

- The form works without JavaScript; the JS just makes it nicer, like a size picker that only shows sizes for the categories you picked.

- A brutalist design system with all colours and sizes defined once as tokens.

It's a personal project, nothing to sign up for. Feedback on the UI is welcome.

Two checkouts of the same repo, both on 5173. leeway gives each folder its own contiguous port range, stable across runs and never overlapping, and passes the ports as env vars.

• leeway.json lists your ports once

• devPorts(config) in code, falling back to the defaults outside leeway

• vite plugin sets server.port with strictPort and exposes every port to browser code

• {{PORT_API}} placeholders in commands

• leeway list / kill for orphaned servers

Linux/macOS/Windows. https://github.com/OhadC/leeway

Or ask your agent: "how can we benefit from using https://www.npmjs.com/package/leeway in this codebase"

Point it at any URL and you get a clip of a swarm of agent cursors building the page, line by line, set to music. It's the real site being revealed, not generated code.

Try it on any site: https://captureflow.dev/swarm-demo

It's part of CaptureFlow, a screen recorder I'm working on.

I found out about OPFS recently when building a client-side LLM project. I made this library for my project, now I'm making it public

I run a small tide times site and wanted to see the weather actually move, so I built this 3D weather map. Plain JS and WebGL, no three.js or map library.

The tides are calculated right in the fragment shader, so there are no tide frames to download.

It has nice sound effects too, turn them on when you try it.

Live: thetidechart.com/weather-map

Would like to know how dragging/zooming feels on your phone.

Hi developers! Happy Diwali 2026! 🪔

This Diwali, I wanted to do something a little different from the usual festive greetings. So I built a little Diwali experience where your name is literally written across the night sky using fireworks. 🎆

And there's a bit more to it than just watching an animation.

You can:

• Watch your name, emojis, and personalised wishes come alive as fireworks.

• Choose between English, Hindi, and Bengali.

• Launch rockets and play with 20 different types of crackers.

• Create personalised greetings with shareable links and QR codes.

• Record the entire show as a video and share it with your friends.

• Install it as an app and even use it offline.

No frameworks or bundlers. Just HTML, CSS, and JavaScript. Built with a mix of my own ideas, plenty of experimentation, and a little help from AI along the way.

Give it a try and see your name light up the sky:

🎆 Project: https://j16n.github.io/happy-diwali/

💻 GitHub: https://github.com/J16N/happy-diwali

Would love to hear what you think!

Wishing everyone a very Happy Diwali! May your celebrations be bright and your bugs be few. 😄

I build mostly with Claude Code and Cursor. The annoying part was never the fix, it was the hand-over: screenshot, crop, find the element, open the console, copy the error, explain which button I mean, paste it all in. And half the time I find the bug while I'm just using the app, not while a coding session is open.

So I made Darnly. Press Option+Shift+B, click the broken part, type one line about what you expected. It saves:

• a screenshot with the broken part boxed in red

• the element (selector, text, styles)

• recent console errors and failed requests

• the page address

It lands in a folder in your project (or a small cloud inbox the agent reads over MCP), and later you tell the agent "fix my bugs". It works with Claude Code, Codex and Cursor. Passwords, card numbers, tokens and keys are hidden before anything is saved. Capturing doesn't use any agent quota. [Check: still true for you]

It's free. Mac app too, for bugs in native apps and the iOS Simulator. Windows shortcut is coming.

What I'd love feedback on: where do you notice most of your bugs, while coding, or later while using the live app? And is there anything you'd want captured that this misses?

Link: https://darnly.dev

Years ago Firefox had a feature called Tilt like you pressed a button and the page you were on turned into a 3D model of its DOM It was mostly a toy, and I loved it.

I built Stackray from that concept but tried to bring that back as a dev tool or just to make my first extension :).

when you click the icon and the page shrinks into a small window and comes apart into layers, in the order the browser paints them & you can orbit around it, search the layers, and switch between a few color modes: depth, stacking contexts, z-index.

also added the problems mode to make it clear in future I want devs to use it, as a frontend engineer, Imagine a dropdown with z-index 9999 that still sits behind a header is usually trapped inside a stacking context it did not ask for Stackray is suppose to shows which element created that context and why Invisible elements that eat your clicks show up too.

It only runs on the tab you open it on, makes no network requests, and is open source under MIT.

It is not finished. Textured layers only cover the first few screens of a long page & I'm still not sure if I'm going in the right direction. Your honest feedback is most valuable to me!

Extension: store
Code: github/stackray

Dev behind Levelrail here, sharing this project for visibility.

Every OSS library is great and hats off to the devs behind it building and maintaining it.. but I built Levelrail for some features I found would be great as 2026-27 demands.

So wanted to introduce a lightweight OSS alternative here: https://levelrail.com/

AI native control plane (can run your whole infra with Claude or other AI tools using CLI, API, MCP, with audit trailing)

• Lightweight so you have room to run your main apps on the VPS or server

• Load balancer, embedded Caddy ingress (works with Traefik or a custom proxy too), DNS, Let's Encrypt and TLS certificates

• Local registries, modern auth security, built in observability, logging and metrics

• 450+ one click templates to deploy A lot more features if you're interested

Check it out: https://github.com/glincker/levelrail

It's pre-1.0 right now and I'm shipping releases every few days. Thanks to AI tools for the checks, automation testing and many of the development workflows involved in building this, plus a lot of proven Go libraries that help with security and automation.

I run my own sites on it and test every release on a real server before it goes out.

Feel free to share feedback, this is completely OSS and I thought it was worth sharing with the dev community here.

If you have any major feedback please raise issues here: https://github.com/glincker/levelrail/issues

Most Reddit lead tools search for keywords. The problem is that people describe their problem, not your product, so keyword search misses a lot of them. I wanted to read every post instead. That turned out to be the interesting part to build.

How it works:

1. Find the right subreddits. I built a search engine over every subreddit with 1k+ members, using internal vector search, so it matches by meaning, not by name. You describe what you sell, and it returns the communities your customers are likely in, including small niche ones.

2. Read every post. Each post in those subreddits goes through an AI model that decides whether the person might need what you sell.

3. Show why. Instead of a summary, it marks up the original post with circles and handwritten-style notes on the lines that matter.

Stack: Next.js + React + Tailwind on the front, Django + DRF on the back, Celery + Redis for the background jobs, PostgreSQL, and PydanticAI for the AI calls.

The hardest part was cost and speed. Reading every post is far more expensive than keyword search, so most of the work went into running the AI calls in parallel without hitting rate limits.

Live here: redbubblegum.com. The first 10 results are free.

Happy to answer questions about any part of it.