Issue 763

14^th August 2026

Written by Juan Marin

Comment

I’m back for another issue. I’ve spent most of this week reading with a beta on my main phone, which I know better than to do and do anyway, every single year.

Beta 5 landed on Monday. That points at a release somewhere around the middle of September, so we’re into the stretch where everyone reshuffles a roadmap they were perfectly happy with in June. I don’t especially enjoy this part of the year. I do like what it does to the writing, though. People stop posting opinions and start posting findings, and for about six weeks the ratio of genuinely useful blog posts goes up.

That’s most of what’s below. Less “here’s what I think about the future of the platform” and more “here’s the thing that broke and what I found when I went looking.” I’ll take that trade.

One thing before you get on with it. If you’re planning to file feedback on a beta, do it now rather than in a month. Past a certain point the reports stop being fixes and start being notes for next year.

See you next week.

– Juan Marin

Sponsored Link

The swiftCon agenda is live. You can now browse the full programme by stage, time slot and speaker, or filter it down to the swiftCon track on its own, ahead of three days in Berlin from 7 to 9 October. To mark it, we’re continuing the exclusive 25% discount for iOS Dev Weekly readers. Enter voucher code IOSDEVWEEKLY25 on the next.app devCon home page or use this registration link.

News

This started with one person filing a bug report against a small browser. What came out of it is three separate ways WebKit traffic escapes a configured proxy. Talal Haj Bakry and Tommy Mysk, who publish as Mysk, traced DNS prefetch hints, WebAuthn related-origin lookups and WebTransport each leaking the device’s real IP, which takes iCloud Private Relay and the Tor browsers down with it.

The practical lesson is that a proxy configuration on a WKWebView isn’t the boundary you’d assume it is. The WebAuthn case is the sharpest of the three, because the request never belongs to WebKit at all: the system credential service makes it directly, somewhere no browser-level setting can reach. VPNs come out of this fine, since they tunnel at system level. If you ship anything that promises network privacy, gate prefetch hints, WebAuthn and WebTransport off by default.

A new set of App Store marketing assets arrives this autumn, and the work is design work rather than engineering, which means it probably isn’t on anyone’s board yet. The short version: brand and seasonal artwork that goes beyond in-use screenshots, showing up in the product page header, in search results and in In-App Events.

Templates come in Figma, Photoshop and Pixelmator flavours, the last of which is Apple quietly listing its own acquisition alongside the incumbents. The specifics live in a separate asset best practices guide rather than in the announcement, so that’s the one to read before you brief a designer.

Code

An orphan is a single word stranded on the last line of a paragraph, and SwiftUI has had a modifier for controlling them since iOS 16. You just can’t call it. avoidsOrphans sits in SwiftUICore’s exported symbol table, fully formed and entirely undocumented, and Fatbobman has worked out how to reach it.

The route in is a hand-written .swiftinterface with -module-abi-name SwiftUI, which gets the linker to resolve the real symbol at build time instead of the usual runtime string-building. It’s still a 2.5.1 violation, and the post says so plainly rather than leaving it to the last line. Read it for what it shows about how much finished, undocumented surface area SwiftUI is quietly carrying around, not as something to ship.

Every app that talks to a model is a streaming app now, which is how a lot of us ended up pulling in a Server-Sent Events dependency over the last couple of years without thinking about it terribly hard. Khoa Pham doesn’t argue against that, and instead just shows the built-in path, building up from a plain URLSession.bytes(for:) loop to a proper multi-field parser handling event:, id: and data:. It stays small enough to read in one sitting.

The detail worth the click on its own is the warning that URLSessionStreamTask is the wrong tool here, because it works at the TCP and TLS level and never sees HTTP. There’s a small Express server in the post too, so you can run the whole thing locally before you point it at anything that bills you per token.

Vision looks at one image at a time. Media Intelligence is the layer above it, connecting observations across a whole library so the same face in two hundred photos resolves to one person, persistently and on device. Anton Gubarenko has the clearest write-up of it I’ve seen, from FaceGroupAnalyzer through to VideoAnalyzer pulling representative moments out of video.

What lifts it above a framework tour is that Anton is straight about the limits. Confidence scores aren’t exposed, the groups aren’t verified identities, and one person can quite happily come back as three of them, so the naming and correction layer is still yours to build. The post also argues you want a reason to be analysing people beyond Apple having shipped an API for it, which is the right instinct and worth more than the code.

Tools

There’s a particular kind of accessibility bug that’s almost impossible to write down. You can describe what VoiceOver said, and in what order, and how wrong it was, and the person reading it still has to take your word for it. Bas Broek has the fix, which is to record the thing and send that instead.

On iOS you get it free, since a Control Centre screen recording picks up VoiceOver on its own, and the Caption Panel will put the spoken text on screen alongside it. macOS takes more work, because Screenshot.app won’t capture VoiceOver output at all, so the post routes it through Loopback as a virtual device and points the recorder’s microphone at that. Remember to put your microphone back afterwards, or your next presentation will be a silent film.

Most of us open Instruments, look at the call tree, and quietly close it again. The hierarchy is honest but it buries the answer. Mark Szymczyk has a short post on Top Functions mode in Xcode 26.4, which sorts by self weight instead, so the function actually burning the cycles is the one at the top.

Self weight is the time a function spends itself rather than the time it spends waiting on whatever it called, which is why sorting on it puts the real cost where you can see it. It’s the rightmost of the three buttons above the detail view, and double-clicking something you wrote lands you on the lines.

And finally...

Somewhere a product manager shouted ship it, nobody asked a follow-up question, and CarPlay is now in a pontoon boat while some automakers are still workshopping their objections.