How Edge-Level Image Optimization Fixes the Bugs That Break Lighthouse Scores

·1 views

A developer working on a Laravel and Livewire landing page saw their Lighthouse performance score drop from 66 to 41 after implementing a manual responsive-image pipeline using Sharp CLI and Blade components. Three bugs caused the regression: duplicate hero image requests, misconfigured sizes attributes, and oversized WebP variants that were not tuned per breakpoint. These issues stemmed from a build-time approach that required predicting every image size and format in advance, making it prone to drift whenever layouts changed. While researching alternative approaches, the developer examined Tencent EdgeOne Makers, whose Edge Functions handle image format conversion and resizing dynamically at request time rather than at build time. This edge-level approach eliminates the need for a static breakpoint list, removing the class of manual errors that caused the original score regression.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Auterix Tool Aims to Keep AI Coding Assistants Aligned With Project Architecture

AI coding assistants like Cursor, Claude Code, and GitHub Copilot often lose track of architectural constraints after several conversation turns, leading to silent regressions and broken code patterns. The core issue is that context is treated as a conversational artifact rather than a persistent contract, causing inconsistencies especially when switching between tools with separate config files. A developer encountered these problems firsthand while building a Next.js app across multiple AI tools, finding that rules set in one config did not carry over to another. To address this, they built a tool called Auterix that enforces a four-stage workflow requiring the assistant to verify project constraints, generate an explicit diff, and obtain user approval before modifying any file. The approach shifts AI-assisted coding from memory-dependent assistance to a structured, verifiable process aimed at preventing architectural drift.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Developer Releases SparkleCore: Free Local Roleplay Platform With Long-Term AI Memory

A self-described hobbyist programmer has published SparkleCore, a free and open-source project, on GitHub. The tool was built to address frustrations with subscription-based online chatbots that frequently lose conversational context. SparkleCore runs entirely offline and combines local LLM inference with a long-term memory system based on the Method of Loci cognitive technique. The platform also includes RPG quest features, real-time character vitals, keyword LoreBooks, and local server integrations. It requires no subscription, collects no user data, and allows users to supply their own AI model.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

How to Set Up SSH Authentication for GitHub on Ubuntu

Developers using HTTPS personal access tokens for GitHub authentication face repeated password prompts and token expirations that disrupt workflows. SSH (Secure Shell) offers a more reliable alternative by using asymmetric cryptography to authenticate without passwords or tokens. The setup involves generating an Ed25519 or RSA key pair on an Ubuntu machine, then registering the public key with a GitHub account. Once configured, the SSH agent handles authentication silently in the background, eliminating manual credential entry. The guide walks through key generation, SSH agent setup, and verification steps to establish a stable, long-term GitHub connection.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

SSRF Vulnerabilities: How 'Paste a URL' Features Can Expose Your Servers

Server-Side Request Forgery (SSRF) has risen from an obscure security finding to one of the highest-impact vulnerabilities in the OWASP Top 10, driven by the widespread adoption of features that fetch URLs on a user's behalf. Common examples include webhooks, image proxies, PDF generators, and link preview tools — all of which share the same risk: the server, not the user's browser, makes the outbound request. Because servers typically have access to internal networks and cloud metadata endpoints, an attacker can craft a malicious URL to reach private services, admin panels, or databases that would otherwise be unreachable from the public internet. On major cloud platforms like AWS, GCP, and Azure, this can allow an attacker to retrieve live IAM credentials via the instance metadata endpoint at 169.254.169.254, potentially granting access to storage, databases, and other cloud resources. The vulnerability requires no authentication bypass, no memory corruption, and no deserialization — only a text field that accepts a URL and a server willing to fetch it.

0 comments Read more at DEV Community