The Brief #26.43 · Chrome 156, TypeScript in Rust, and DeepSeek V4.1 Flash

Chrome 156 is out with random(), a CSS function for random values, and :navigation-source, a selector for view transitions.

DeepSeek and Meta released open-weight models, Next.js fixed two bugs that let attackers run code on your server, and Cloudflare is porting the TypeScript compiler to Rust.

Then there’s the latest in DevTools, what’s coming to Chrome, more decision models, and WebSockets on Vercel.

DeepSeek V4.1 Flash and Muse Spark Open

On October 17, DeepSeek released DeepSeek V4.1 Flash 1017, an update to the V4.1 Flash model from September.

The weights are on Hugging Face under the MIT license, which lets you use them however you want as long as you keep the copyright notice. The model has 552 billion parameters, but it uses only 16 billion of them per token it writes.

Artificial Analysis scored it 45 at $0.26 a task, 2 points more than Claude Haiku 5.5 got for $0.21.

The same day, DeepSeek opened its Search and Fetch APIs to everyone. They let an AI agent run web searches and get the content of a page as Markdown. Both cost $0.75 per 1,000 successful calls.

When you use Claude Code, Codex, or DeepSeek Harness (the company’s own agent tool) with DeepSeek’s API, their web searches and page fetches go through these APIs. Those calls are free until October 31 at 16:00 UTC.

Meta released Muse Spark Open on October 15 and calls it the open-weights version of Muse Spark. It uses about 42 billion of its 816 billion parameters per token. It takes text, images, video, and audio as input, with a context window of 1M tokens.

Meta doesn’t sell it on its Model API. You can download it from Hugging Face once Meta approves your request, or use it through Google Cloud’s Model Garden or a hosting company like Together AI.

It scored 39 on Artificial Analysis’ Intelligence Index, at $0.84 a task. That’s well below the 48 for Muse Spark 1.3, the version you get through Meta’s API.

Muse Spark Open’s license lets you use, change, and sell the model for free, but your product has to show “Built with Muse Spark Open” prominently, like in its settings or documentation. Companies that make more than $20 million a year also need a separate agreement with Meta before they offer the model to other people through an API. You don’t need that agreement to use it inside your own product.

DeepSeek’s MIT license doesn’t have either of those conditions.

Muse Spark Open’s full download is about 1.6 TB. In Meta’s guide, a compressed version of about 530 GB runs on four NVIDIA Blackwell Ultra GPUs, or on two Mac Studios with M5 Ultra chips and 512 GB of RAM each.

Chrome 156

Chrome 156 came out on October 20 with 353 security fixes, none of them for a bug Google knew attackers were using.

This version adds the CSS random() function and overflow: scroll clip, for boxes that scroll in a single direction. If a dynamic import() fails to download its module, the browser tries the download again the next time your code calls it.

Chrome was also going to let you leave out syntax and inherits in @property rules starting with 156, but that change moved to version 159.

random() returns a random value between a minimum and a maximum you give it. When a rule with random() matches several elements, each one gets a different value. The CSS below puts each piece of confetti at a random spot and turns it to a random angle.

.confetti span {
	top: random( 0%, 100% );
	left: random( 0%, 100% );
	rotate: random( 0deg, 360deg );
}

A browser without random() ignores those three declarations and draws all the pieces in the same spot, with no rotation. Safari added random() in version 26.2. Firefox doesn’t have it yet.

Version 156 also adds :navigation-source, a CSS selector for the link or button that started the current navigation. It’s mainly for view transitions, the animation the browser can play between one page and the next.

In a grid of products, a:navigation-source .thumb { view-transition-name: active-image; } gives that name only to the thumbnail inside the link you clicked. The browser can then grow the thumbnail into the product photo on the next page, if you turn on view transitions for the two pages and that photo has the same view-transition-name. Firefox and Safari don’t support :navigation-source.

Chrome announced on October 16 that unload handlers haven’t run by default since version 155, which came out on October 6.

Sites used the unload event to run code as a page closed, like saving the user’s data or sending analytics. On phones, it often didn’t run at all, because the operating system closes pages in the background to free up memory. And on desktop, an unload handler kept the page out of the back/forward cache, where the browser holds the page you just left in memory, ready to show it again instantly.

Instead of unload, Chrome recommends visibilitychange for saving data, because the moment a page becomes hidden is the last reliable time to do it. For code that has to run as you leave the page, it recommends pagehide.

Sites can still turn unload back on with a Permissions Policy, an opt-out Google has no plans to remove for now. Chrome on iPhones and iPads uses Safari’s engine and may keep firing unload. Other browsers built on Chromium will get the change soon, unless they switch the default back.

Security updates

On October 14, the Next.js team released Next.js 16.4.1 and 15.5.28 to fix three security bugs. Two of them are rated Critical and let an attacker run their own code on your server without logging in.

Wherever your app runs, update it with npm install next@16.4.1 or, on Next.js 15, with npm install next@15.5.28. Next.js 14 and older don’t get a fixed version.

Go released 1.27.3 and 1.26.10 on October 19 with a fix that blocks eight compromised intermediate certificates. Go compiles its standard library into every program, which means a program you built with an older version keeps accepting certificates signed with them until you rebuild it with the new one.

TypeScript in Rust

Cloudflare and VoidZero announced on October 20 that they’re porting the TypeScript compiler to Rust, in a project called tsrs. VoidZero makes Vite and has been part of Cloudflare since June.

The two teams are building tsrs inside Oxc (VoidZero’s set of JavaScript tools written in Rust) and “in close collaboration with the TypeScript team”. Cloudflare says they aren’t forking TypeScript, because that team should stay in full control of the language.

In Cloudflare’s benchmark, tsrs was up to 8 times faster than TypeScript 7.0 and used about 70% less memory, with both running the same number of type checkers in parallel. TypeScript 7.0 is the official port to Go. When it came out on July 8, it was already about 10 times faster than TypeScript 6.

Cloudflare and VoidZero picked Rust for WebAssembly, the format that lets code written in other languages run in a browser. A Go program compiled to WebAssembly has to bring along Go’s garbage collector (the part that frees memory the program stops using), but a Rust program doesn’t need one. According to Cloudflare, the lower memory use means whole development environments with type checking can run in a browser tab or on Workers.

For now, tsrs is experimental. You can try it with npx tsrs. Cloudflare lists some differences from TypeScript, like the order it prints errors in, and plans to shrink them before a stable release.

The TypeScript team released TypeScript 7.1 beta a few hours later. Cloudflare measured it at up to 2.5 times faster than 7.0 and says some of the optimizations behind that came from tsrs. The beta is on npm as typescript@beta.

TypeScript 7.1 lets you declare the type of an import based on its import attribute, like the with { type: 'css' } you add to load a file as a stylesheet. The declaration below makes every import with that attribute a CSSStyleSheet.

// In a .d.ts file in your project
declare module '*' with { type: 'css' } {
	const content: CSSStyleSheet;
	export default content;
}

If you leave out the attribute, TypeScript shows an error.

TypeScript 7.1 is also stricter with some conditional types, which can add new errors to code that compiled in 7.0. The release candidate is due in about a month.

New in DevTools

Google published what’s new in DevTools for Chrome 155 and 156 on October 20.

The “Memory” panel now detects a kind of memory leak that comes from closures. In Chrome, closures created in the same scope can share one object that holds the variables they capture. If a function creates a 10 MB buffer that its fetch() callback reads, and also adds an online event listener that never touches the buffer, the listener still keeps the buffer in memory after the fetch is done. DevTools marks variables like that buffer in a heap snapshot (a record of everything the page has in memory at one moment) and sorts them by how much memory they hold.

For coding agents that use DevTools through its MCP server, version 1.11.0 came out on October 15 with a tool that detects those closure variables in a heap snapshot, and with screen recording that doesn’t need a video tool like ffmpeg installed.

Coming to Chrome

Chrome 157 has been in beta since October 15 and comes out on November 3.

text-decoration-inset, which Google listed in the Chrome 154 beta, moved to 157. It moves the start and end of an underline in from the edges of the text, or out past them with a negative value. Firefox already supports it, but Safari doesn’t.

The Language Detector API comes to Chrome for Android in 157, after the desktop version got it in 138. The API detects the language of a piece of text, like a product review you want to translate. It runs on the phone, with the model the browser already uses to translate pages.

The first version of the Decisions API is in 157 too, on desktop behind a flag, chrome://flags/#decisions-api. It answers a yes-or-no or multiple-choice question about a piece of text with a probability for each answer, on the user’s computer, where the text stays and each answer is free. It runs Gemma 4, Google’s open model, on the computer’s processor. To try it, turn on the flag and the “On-device AI” setting, then relaunch Chrome. The flag also switches Chrome’s other built-in AI APIs, like the Prompt API, to Gemma 4.

On October 19, Chrome approved the <install> element and navigator.install() for version 158 on desktop, out on November 17.

Both let a site offer to install a web app (a site that opens in a separate window, like a regular program). You can use the element as a ready-made button or call navigator.install() from JavaScript. Either way, the user confirms in a dialog from the browser.

Today, a site can only offer to install its own app, by handling the beforeinstallprompt event. The element and navigator.install() can install another site’s app too, from the URL of that app’s manifest file.

Without any attributes, the element installs the app of the site it’s on.

<install>
	<a href="/install-help">How to install this app</a>
</install>

The browser draws the button and its text and hides the link.

Mozilla hasn’t taken a position on either one, but the WebKit team behind Safari opposes them.

Decision models

Liquid AI released d1-ultra, a decision model for text and images, on October 15. Like TypeSafe AI’s Jev, it returns a probability for each answer you allow, instead of writing text.

It has the same price as Jev, $0.042 input / $0 output per million tokens. You can use it on Liquid’s API and on AI Gateway, Vercel’s service for calling models from many providers with one API key, but Liquid didn’t publish the weights.

Artificial Analysis gave it 65 on its Decision Index, ahead of Jev 1.13’s 58. It was cheaper to run too, at $32 per million tasks against Jev’s $42.

Liquid says it trained d1-ultra to give more reliable probabilities. On the index’s calibration chart, the answers d1-ultra gave about an 85% probability were right 83% of the time, against 62% for Jev 1.13.

TypeSafe AI released Jev 1.14 on October 14 and says most things got a little better, especially in languages other than English. But Jev 1.14 scored a little lower than 1.13 on the Decision Index, 57.07 to 57.50 before rounding.

Perplexity released Decider v1.2 this month for $0.02 input / $0 output per million tokens, along with Decider Flash v1.2, a smaller model at half that price. Both take text and images. Decider v1.2 scored 56 on the Decision Index and cost $15 per million tasks, less than half as much as d1-ultra. The old pplx-decider-v1.1-27b name now points to v1.2.

Vercel Ship

Vercel made WebSockets generally available on October 20 in Vercel Functions.

A WebSocket keeps a connection open between the browser and your server for messages in both directions, like in a chat app or a multiplayer game. WebSocket connections on Vercel follow the same limits and pricing as other function calls, with CPU time billed only while your function is processing a message. Your page needs code to reconnect, since a connection closes when the function reaches its maximum duration.

Vercel opened early access to Token Pass for Pro teams on October 15, during its Ship conference in San Francisco. For $30 a month, a team gets $80 of monthly credit for GLM-5.3, Kimi K3, and, since October 20, DeepSeek V4.1 Flash. Token Pass works through AI Gateway.

Unused credit doesn’t roll over. Once the credit runs out, Vercel stops Token Pass requests until the next billing period and doesn’t charge you anything extra automatically.

Any team that would spend more than $30 a month on those models anyway pays less with Token Pass.

Python became generally available on Vercel at Ship too. Backends like FastAPI deploy together with your frontend from one project, with previews of the whole app.