Program

Workshop by Unlearn.dev included in your ticket - AI agents now write a lot of the code teams ship, but most people still review it like code from a colleague. Agents repeat the same mistakes, don’t know your system, and write code that usually looks right even when it isn’t. In this workshop, attendees build a set of review skills for their own AI agent. Each skill checks for one kind of problem. The idea: build a *toolkit* you can use every time you review.

The TypeScript compiler is happy, the interfaces match, the build passes, and the application still fails at runtime, sometimes without throwing an error. This talk skips the lecture on why compile-time types don’t guarantee runtime safety and starts with a quick API contract failure in a Vue 3 and TypeScript demo. The demo is a Node.js-backed app built around realistic financial workflows, where data correctness is critical. We then run the same failure scenarios against four approaches: shared types, runtime validation with Zod, generated API contracts, and contract testing. The scenarios include missing fields, unexpected transaction states, inconsistent monetary values and breaking API changes. For each approach, we measure what it catches, when it catches it, and what it misses. Next, we look at what each approach costs: runtime overhead, developer experience, schema duplication and maintenance. We pay particular attention to frontend and backend systems that are deployed and evolve independently. The talk closes with a decision framework that shows which combinations make sense depending on your application’s risk level, team structure and deployment constraints. All of it runs on a purpose-built, reproducible demo drawn from enterprise financial software. This isn’t an argument against TypeScript. It’s an evidence-based guide to where its guarantees end and which runtime safeguards are worth the investment.

A live Webpack-to-Vite migration on a real production monorepo, with before/after numbers for cold start, HMR and CI time. Covers where Rolldown and Oxc fit into the Vite ecosystem, why Biome's linting is fast enough to change how often you run it, and the honest list of plugins and loaders that don't have a clean equivalent yet.

A decision framework, not a popularity contest. What changes when Bun is backed by a different company than the one you deploy with; where Node's ecosystem compatibility still wins outright; what Deno's permission model buys you that the other two don't. Built around a case study of running all three behind one API gateway and what broke.

Leave with a practical way to assess AI-generated changes, choose where human review matters most, and judge shortcuts by their reversibility, failure impact, and ongoing maintenance cost. AI helped us ship the first ZurichJS meetup website quickly. Maintaining it was another story. As the codebase grew, it gradually became a wreck. The ZurichJS Conf platform was our second attempt, with higher stakes and the same limited evenings and weekends. The event date could not move, and the software handled real users and payments. In under a year, it processed over six figures in transaction value. This technical case study compares the two iterations and the engineering decisions behind them. What could we delegate to AI? Which changes needed careful technical review? When was a shortcut sensible, and when did it create work we could least afford? We’ll examine the minimally viable development lifecycle we built around AI-assisted implementation: enough planning, testing, observability, security, and release discipline to protect users and payments while keeping a side project manageable. Several security incidents, none resulting in a data breach, put those decisions to the test. We’ll also look at where we deliberately did less. Leaving low-risk operations manual and delaying abstractions helped preserve momentum. Other shortcuts weakened reliability and forced us to revisit work at the worst possible time.

In the past year, I implemented harness engineering inside many of my projects. During this journey I discovered several tips that will help you to reduce the costs of your agentic harnesses, get the results you are looking for and streamline the process to build a solid foundation to work solo or in teams. During this talk I'll unveil my journey on how to set up an harness that will work for your javascript projects.

Cloudinary Media is the part of the full-stack AI story most talks skip. A look at how agents are now generating, editing and routing images and video inside a production pipeline: structured transformation requests, agent-driven asset variants at scale, and the governance problem nobody's solved yet, what happens when an agent decides what your brand's imagery looks like.

Next.js team From the team building it: Server Components, Cache Components, Partial Prerendering and server functions, explained as the mental model the Next.js team actually uses internally, not the marketing version. What changed since the App Router shipped, what's still being figured out, and how to reason about a route's caching behavior without guessing.

Compilers have long been seen as one of the most complex topics in computer science. Today, web frameworks are evolving from runtime libraries into optimizing compilers, reshaping how we build user interfaces. Different topics in front-end development—e.g., reactive programming—are now entering this era, fueled by insights from static analysis. This talk will explore how modern UI compilers are redefining performance and developer experience. We’ll discuss how compilers are designed, including various open-source and enterprise solutions, and the growing role of compilers in automating tasks. By the end of the session, you'll likely be optimistic about a future where compilers understand our entire codebase and offload much of our mental burden.

Next.js team Most teams aren't migrated yet, and most migration guides assume a greenfield app. A practical, DX-focused walkthrough of moving a real production app: what to migrate first, where data-fetching patterns break, how to keep a team shipping features mid-migration, and the honest list of things that are still awkward in the App Router today.

Supply chain attacks are no longer a theoretical threat - they are a daily reality. GitHub repositories, npm packages, VS Code extensions, biggest open-source libraries: all have been weaponized to compromise thousands of developers and their users at once. New incidents surface every day, each one larger than the last, and no project is out of reach. Every breach gets its post-mortem. But by the time you read it, the next attack is already being planned. This talk is about getting ahead of it. We'll look at why anyone can fall victim, and, most importantly, what you can do about it. Small changes to how you work can cut your exposure dramatically. Not by becoming a security expert, but by learning to ask one uncomfortable question about everything you depend on: why do I trust this?

AI features break observability's usual assumptions: a single user action can now fan out into multiple model calls with unpredictable latency and cost. This talk covers end-to-end OpenTelemetry tracing across browser, server and LLM calls, setting cost and latency budgets per feature, and catching silent failures (a tool call that returns the wrong shape, a model that "succeeds" with a bad answer).

With agents increasingly producing first drafts, what does seniority mean now judgment calls, architectural taste, review depth, mentoring and how should engineers be deliberately building those skills rather than letting them atrophy. Grounded in interviews with engineering leads making hiring and leveling decisions right now, not speculation.