
Security News
Open Source CAI Framework Handles Pen Testing Tasks up to 3,600× Faster Than Humans
CAI is a new open source AI framework that automates penetration testing tasks like scanning and exploitation up to 3,600× faster than humans.
Security News
Sarah Gooding
July 4, 2025
The Rust implementation of Browserslist, the browser compatibility engine that powers much of the modern frontend toolchain, just received a major internal refactor. A newly merged pull request restructures how browser and feature data is stored in browserslist-rs
, replacing most dynamic runtime data with statically embedded structures.
The result is a significant reduction in memory usage and binary size, including over 1MB saved in WebAssembly builds, with performance improvements that benefit tools like SWC, Rspack, Turbopack, and LightningCSS.
While you may not interact with it directly, your frontend stack almost certainly does. Browserslist sees over 60 million weekly downloads on npm and is embedded into most modern frameworks. Browserslist defines which browsers your code should support, using a simple query language like:
> 0.5%, last 2 versions, not dead
This config influences a huge swath of the frontend ecosystem:
Browserslist is one of the most widely embedded tools in modern JavaScript development, and like many core infrastructure projects, it's now being reimagined in Rust for better performance and efficiency.
browserslist-rs
#To support Rust-based build tools, the community maintains browserslist-rs
, a native port of the JavaScript version. It replicates the core query evaluation logic but with much better performance and memory handling.
It’s already in wide use, with over 3.8 million downloads on crates.io across 30 published versions. The crate powers tools like SWC, Rspack, Turbopack, and LightningCSS, and is used in both native and WebAssembly builds.
The recently merged PR #32 overhauls how compatibility data is stored with goal of eliminating runtime overhead by embedding vendor and feature data directly into the compiled binary.
Key changes include:
LazyLock
structuresPooledStr
to reduce string duplicationWhile two small legacy LazyLock
structures remain, the vast majority of the data is now statically compiled.
The refactor delivers measurable benefits across native and WASM targets:
These savings are especially impactful for tools shipping to constrained environments like CI containers, edge runtimes, or WebAssembly.
Browserslist' Rust implementation is part of a broader trend in the frontend ecosystem: moving performance-critical tooling out of JavaScript and into Rust.
Notable examples:
Rust’s memory safety, predictable performance, and excellent compile-to-WASM story make it an increasingly attractive foundation for frontend infrastructure.
This refactor of browserslist-rs
is a clear example of how deep, foundational engineering can ripple across the frontend toolchain. By eliminating most runtime data and switching to static, compile-time structures, the project has dramatically reduced its binary size and improved runtime efficiency, all while preserving compatibility with the widely used Browserslist query language.
As Rust-based tools continue to gain traction, optimizations like this will help make them not just faster, but leaner and more scalable as well.
Subscribe to our newsletter
Get notified when we publish new security blog posts!
Try it now
Security News
CAI is a new open source AI framework that automates penetration testing tasks like scanning and exploitation up to 3,600× faster than humans.
Security News
Deno 2.4 brings back bundling, improves dependency updates and telemetry, and makes the runtime more practical for real-world JavaScript projects.
Security News
CVEForecast.org uses machine learning to project a record-breaking surge in vulnerability disclosures in 2025.