Corbin Crutchley

Corbin Crutchley

@crutchcorn.dev

Engineering Leader | @GitHub.com Star | Microsoft MVP | @playfulprogramming.com Founder | @TanStack.com Maintainer

5K followers365 following1.2K posts

Pinned

Announcing my new book about A11Y! ♿ When I first started as a web developer I didn't know anything about best practices for UX Only after guidance from many wonderful people have I improved; I want to share that ☺️ A11Y is a basic right and improves products for us all 🚀

Playful Programming@playfulprogramming.com

🌐 Introducing: The Art of Accessibility! Our brand-new book teaches you everything to do with accessibility! With a vast array of technologies and methods of providing valuable experiences to all users, it's easier than ever to design better, more inclusive products.

To be fair to OAI here (GPT-6 is very good): It transferred code from another non-React system and didn't add deps from elsewhere to make it better. IMO there should've been more gaurdrail following, but this is not exactly "generate from scratch" output

ICYMI, Nvidia bought Hugging Face today. I have concerns. Nvidia is doing better than anyone else to build out a wholesale ecosystem around AI. But they've historically been a poor host to open ecosystems. See: Linux support. I suspect HF Cloud to be Nvidia locked in 6 months.

Earlier this year I had the opportunity to help teach a bootcamp based on curriculum from my book and broader Playful content. Just a dream come true; a full-circle moment for me. I'm so grateful for everyone who helped out, and to our students for being part of our journey.

Playful Programming@playfulprogramming.com

This year marked our first ever programming bootcamp. We decided to celebrate our student's graduation with a recap reel: www.youtube.com/watch?v=reSA... We are so incredibly inspired by our students and we can’t wait to bring this program back in 2027.

This is technically the second post in the thread but I do not care; I am so so so excited that we're finally putting our color scheme back in the oven to bake this out further We've strived for excellent A11Y from day one, but there's always room for growth and this one excites me. Fonts too WIP!

Playful Programming@playfulprogramming.com

For example, this is far from finished, but this is the very start of our high-contrast mode. Powered by the same changes to our color system as the tweaks you saw above. More flexibility means more opportunities for others. More fun. More you. We're eager to keep building! 🚀

TanStack Form v2 is now in alpha! 📝 It brings drastically improved performance, far more flexible validators, even stronger type safety, and more! We're excited to get it into your hands and to start testing it. Try it out & let us know your thoughts: tanstack.com/blog/announc...

tanstack.comForm v2 is here: All you need to know about the alpha | TanStack BlogThe TanStack Form v2 alpha is here with more flexible validators, schema-oriented forms, safer form composition, and simpler SSR.

This week I joined Stord as the Senior Engineering Manager of their AI team! I wrote a "Working with Me" for my team & thought it'd be fun to share with the rest of you as well: playfulprogramming.com/posts/workin... I'm excited to join the team and scale us to the next level! To the future! 🥂

playfulprogramming.comWorking with MeA working-with-me guide for new teammates, covering how I communicate, lead, give feedback, and build trust on engineering teams.

@dashlane.com, I was one of the customers who received a "someone attempted a login" email. Frankly, I find the lack of official comms deeply upsetting and will likely be the reason I change password managers after the incident resolves. No site banner, no socials. Unacceptable.

I'm not saying that you need to have answers immediately. But you absolutely MUST disclose that an incident is occurring if people have their entire livelyhoods entrusted to you. Hiding an announcement behind a hard-to-find status page is not sufficient public comms.

In many of my comms about the TanStack attack, I mentioned a list we published to keep us accountable. But I only realized that this was removed between the draft I saw and the public publication. We'll have this all in a blog post very soon, but 🧵 on what we're fixing

View full thread

- [ ] Will replace the PNPM setup cache with `actions/cache/restore`, w/ more secure defaults - [ ] Will replace the PNPM setup cache to be isolated between release and PR envs - [ ] May close the ability to make a TanStack PR as an external contributor (But we're absolutely not going closed source)

Hopefully this shows that we're taking this incident very seriously and are working hard on adding resilience measures to fix our processes. Please don't hesitate to let us know if there's more you think we can be doing. We're listening.

In many of my comms about the TanStack attack, I mentioned a list we published to keep us accountable. But I only realized that this was removed between the draft I saw and the public publication. We'll have this all in a blog post very soon, but 🧵 on what we're fixing

- [x] Enforced non-SMS GitHub 2FA (NPM & GitHub 2FA was already enforced, but SMS was previously allowed) - [x] Removed all usage of `pull_request_target` from our CI pipeline (already wasn't in our CD) - [x] Upgraded all repos to use PNPM 11 to ensure ecosystem install cooldown

- [ ] Are introducing `zizmor` as action linting to every repo via a PR check - [ ] Are likely introducing `CODEOWNERS` on `.github` folders to restrict merging to only the 7 core maintainers

Corbin Crutchley reposted

We at TanStack just had a major attack against our Router packages. We have a postmortem out now explaining what happened and how we mitigated the response: tanstack.com/blog/npm-sup... No other TanStack packages outside of the Router monorepo were impacted

tanstack.comPostmortem: TanStack npm supply-chain compromise | TanStack BlogOn 2026-05-11, an attacker chained a pull_request_target Pwn Request, GitHub Actions cache poisoning across the fork↔base trust boundary, and OIDC token extraction from runner memory to publish 84 mal...

Corbin Crutchley reposted

I wrote about everything I've felt, feared, and experienced about using AI for code over the last few years, and my opinions on where we stand. It's the most personal thing I've ever written. And I'm putting it out there to share with all of you. blog.isquaredsoftware.com/2026/05/ai-t...

blog.isquaredsoftware.comMy Thoughts on AI, Part 1: Fears, Opinions, and Mental JourneyMy own personal thoughts and opinions on AI effects and usage, and how those have evolved over time

I wanted to give you all a sneak peak of TanStack Form v2. Luca, one of our maintainers, has been working hard on a complete rewrite of the package using new architecture patterns. Minimal breaking changes in userland, insane performance gains. Here's v2 rendering 10,000 fields with validation.

This has no virtual scrolling and the FPS on the recording itself is low, BTW. We've validated against the production version of v1 and at this stage can confirm that v2 rendering 10,000 nodes is MUCH faster than v1 rendering 1,000 nodes. And that's even with validation!