New Innovation Graph data shows global developer communities growing faster than ever, with collaboration reaching new highs across many economies.The post Q1 2026 Innovation Graph update: Open source collaboration is accelerating worldwide appeared first on The GitHub Blog.

We recently got the shape() function and corner-shape property. What else could we possibly need as far as making shapes in CSS? Let me tell you: the border-shape property!Get Ready For the Powerful CSS border-shape Property! originally handwritten and published with love on CSS-Tricks. You should really get the newsletter as well.

You might think of the view() function as used in scroll-driven animations, but really it just pairs @keyframes animation with the current position of an element.

Comparing the best Chainguard alternatives in 2026, from Aikido Security to Docker Hardened Images, Minimus, RapidFort, and Echo.Category: DevSec Tools & Comparisons

We’re about to start rolling out a new set of AI capabilities that provide shared context, reusable agentic workflows, organization-level governance, and cost control for software production. Developers use different AI tools depending on the task – from JetBrains IDEs to terminal-based agents such as Claude Code, Codex, and other emerging solutions. That freedom is […]

We have been building websites inside boxes for years on WordPress. Let’s take a closer look at [Kirki](https://kirki.com/), the first freeform visual builder with an infinite canvas, and explore how it redefines the experience with cleaner performance, full design freedom, and zero plugin dependency.

Project Settings now includes its own project-specific A. This view pulls the relevant user events from the Activity Log in Team Settings. Review project-level activity without leaving your project settings. ctivity LogVisit to try it out.your project settingsRead more

Vercel is acquiring , the company behind the open source , which has 4.7M+ weekly npm downloads and more than 850 contributors. Founder Bereket Engida and the core team are joining Vercel to continue their work on Better Auth and agent identity.Better AuthTypeScript authentication libraryLast year, we behind Next.js, AI SDK, and Nuxt: software that's open by default, loosely coupled, and portable to any platform.published our approachBetter Auth applies it to authentication: framework-agnostic,

こんにちは。バックエンドエンジニアの筒井 （@tsuttsun_wind）です。PR TIMESは、PHP Conference Japan 2026 にゴールドスポンサーとして協賛します。 PHP Conference […]

2026年6月29日、LINEヤフーグループ最大の技術カンファレンス「Tech-Verse 2026」が開催されました。ここではKeynoteをアーカイブ動画と書き起こしテキストでご紹介します。アーカ...

本記事は、DevOps Agentの新機能のカスタムエージェントをつかって週次のSREレポートをつく ...

本記事では、この「ネイティブ」なマルチモーダル埋め込みを活用したRAGの構築方法を解説します。

observability now includes detailed resource metrics, giving you deeper visibility into how your sandboxes consume compute and networking.Vercel SandboxFrom the in your dashboard, you can now monitor:Observability tabEach metric can be grouped by Sandbox Name and Sandbox Session ID, so you can drill down from aggregate usage to the individual sandbox responsible.You can also query and visualize metrics via the Vercel CLI:Metrics are available at both the team and project level and align directly

Better Auth is joining Vercel. We're joining to accelerate our work on open-source auth and securing agent workflows.

now ships an toolset through the new subpath. One file in can register every GitHub tool, or use a preset such as , so you can build a complete GitHub agent in nine lines of code.GitHub Toolseve@github-tools/sdk/eveagent/tools/maintainerGet started by following the .knowledge base guideRead more Every write tool, such as , requires approval unless you opt out. Gate individual tools with , , or an input-dependent predicate; pauses survive restarts and deploys.Safe by default:mergePullRequestalway

<p><strong><a href="https://huggingface.co/tencent/Hy3">tencent/Hy3</a></strong></p>New Apache 2.0 licensed model from Tencent in China:</p><blockquote><p>Hy3 is a 295B-parameter Mixture-of-Experts (MoE) model with 21B active parameters and 3.8B MTP layer parameters, developed by the Tencent Hy Team. Following the Hy3 Preview launch in late April, we gathered feedback from 50+ products and scaled up post-training with higher quality data. To...

はじめにAgentic AI 全盛期の昨今，コードを書くのも，テストを書くのも，リファクタリングするのも，かなりの部分を AI に任せられるようになりました。ところが，そんな時代においても シークレットや設定値の管理だけは，いまだに手作業でクラウドコンソールをぽちぽちするのが普通 ではないでしょうか？AWS マネジメントコンソールにログインして，SSM Parameter Store の画面を開いて，該当のパラメータを探して，「編集」ボタンを押して，テキストエリアに値を貼り付けて，保存する「あれ，この値いつ誰が変えたんだっけ？前の値なんだったっけ？」となっても，履歴画面は貧弱...

Aikido's AI pentester found this file-access flaw in Rocket.Chat. A closer look at MongoDB's ObjectId() showed the weak randomness that makes it exploitable.Category: Vulnerabilities & Threats

For decades, one of the most notoriously-challenging problems on the web has been sticking one element to another element, for things like tooltips and nested menus. The CSSWG has decided to provide a first-class solution to this problem, and it’s pretty friggin’ cool! In this tutorial, I’ll share the most useful parts I’ve found from this modern CSS feature.

We are launching Workers Cache, a regionally tiered cache that sits directly in front of your Worker entrypoints. Infinitely composable, configured via standard HTTP headers

<p><strong>Release:</strong> <a href="https://github.com/simonw/sqlite-utils/releases/tag/4.0rc3">sqlite-utils 4.0rc3</a></p> <p>I hoped to release <code>sqlite-utils 4.0</code> stable this weekend, but as I worked through the backlog of issues and PRs with a combination of Claude Fable 5 and GPT-5.5 the changelog since rc2 <a href="https://sqlite-utils.datasette.io/en/latest/changelog.html#rc3-2026-07-05">kept getting bigger</a>...

Node.js is debating whether AI-driven security report volume warrants moving more vulnerability reports into public workflows.

はじめに「AIを導入すれば生産性が上がるらしいが、私たちのチームはどこから手をつければいいのだろう？」と悩んだことはありませんか？既存のレガシープロジェクトをAI主導型プロジェクト（AI-driven...

こんにちは。Yahoo! ID連携のiOS SDKの開発・運用を担当している矢倉です。現在、多くのヤフーのiOSアプリでは、ローカル認証を活用した独自のデバイス認証による再認証機能を搭載しています。こ...

Docker Hub outages and 429 Too Many Requests rate limits break CI pipelines. A read-through cache is the fix the infrastructure vendors recommend, and Nx Cloud offers it for your agents.

<p>I wrote about the <a href="https://simonwillison.net/2026/Jun/21/sqlite-utils-40rc1/">sqlite-utils 4.0rc1</a> release a couple of weeks ago. Since we only have Claude Fable on our Max subscriptions for a few more days, I decided to see if it could help me get to a 4.0 stable release that I felt truly comfortable about, since I try to keep to <a href="https://semver.org">SemVer</a> and like my incompatible major versions to be as rare as possible.</p><p&...

<p><strong>Release:</strong> <a href="https://github.com/simonw/sqlite-utils/releases/tag/4.0rc2">sqlite-utils 4.0rc2</a></p> <p>See <a href="https://simonwillison.net/2026/Jul/5/sqlite-utils-fable/">sqlite-utils 4.0rc2, mostly written by Claude Fable (for about $149.25)</a>.</p>

This release is all about control and trust. We're giving tasks a way to gate, skip, and

pnpm 11.10 adds the _auth setting for CI-friendly registry authentication, new pnpm prefix and pnpm issues commands, and the ability for pnpm self-update to install pnpm v12 (the Rust port). It also improves pnpm up accuracy, speeds up resolution against registries that ignore abbreviated metadata, and hardens global package management, pnpm deploy, and pnpm pack-app.

<p><strong><a href="https://www.experimentlog.com/blog/building-a-world-map-with-only-500-bytes">Building a World Map with only 500 bytes</a></strong></p>Iwo Kadziela (assisted by Codex) figured out a way to generate a credible ASCII world map using 445 bytes of data:</p><p><img alt="A map of the world rendered as black asterisk ASCII characters, it looks very good" src="https://static.simonwillison.net/static/2026/world-map-ascii.png" />&lt...

<p><strong><a href="https://lucumr.pocoo.org/2026/7/4/better-models-worse-tools/">Better Models: Worse Tools</a></strong></p>Armin reports on a weird problem he ran into while hacking on Pi:</p><blockquote><p>The short version is that newer Claude models sometimes call Pi’s edit tool with extra, invented fields in the nested <code>edits[]</code> array. And not Haiku or some small model: Opus 4.8. The edit itself is usually correc...

Web アプリケーションの開発には実ブラウザでの動作確認が必要不可欠です。Playwright CLI や chrome-devtools-mcp などエージェント向けのブラウザ操作ツールは多くが Chromium に依存しています。Safari Technology Preview 247 の MCP サーバーは、エージェントを Safari に接続し操作できるようにします。

AI SDK の v7 では MCP Apps 対応が追加されました。AI モデルはツールを呼び出す際に `ui://` リソースが紐付けられていれば、アプリケーション側でその UI をサンドボックス化された環境でレンダリングすることができます。この記事では AI SDK の MCP Apps 対応を試してみた内容を紹介します。

Our AI pentest agents found a critical phpBB auth bypass (CVE-2026-48611): one unauthenticated request logs you into any account. See the exploit and the fix.Category: Vulnerabilities & Threats

<p><strong><a href="https://map.currentai.org">Open Source AI Gap Map</a></strong></p><a href="https://www.currentai.org">Current AI</a> is "a global partnership building a public option for AI", founded as a non-profit at the AI Action Summit in Paris in February 2025 and backed by serious capital ($400m already committed).</p><p>They <a href="https://www.currentai.org/blogs/introducing-the-gap-map-v0-1">launched their Gap Map&l...

<blockquote cite="https://bsky.app/profile/joshwcomeau.com/post/3mkxyqgrp2d2t"><p>I just launched my third course, Whimsical Animations, and so far, it’s on track to sell roughly ⅓ as many copies as a typical course launch.</p><p>It’s a similar story with my two existing courses. Sales are down significantly from last year.</p><p>There are likely a lot of reasons for this, but I think the biggest is AI. There’s sort of a double whammy with AI:</p><ol...

<p>One of the most interesting tips I got from <a href="https://www.ai.engineer/worldsfair/schedule?session=asn_slot_2026_06_30_main_stage_1230_2026_06_08t09_35_43_039z">the Fireside Chat</a> I hosted with Cat Wu and Thariq Shihipar from the Claude Code team at AIE on Wednesday was to let Fable (and to a certain extent Opus) use their own judgement rather than dictating how they should work.</p><p>The example they gave was testing. You can tell Fable "only use auto...

<p>The June edition of my <a href="https://github.com/sponsors/simonw/">sponsors-only monthly newsletter</a> is out. If you are a sponsor (or if you start a sponsorship now) you can <a href="https://github.com/simonw-private/monthly/blob/main/2026-06-june.md">access it here</a>.</p><p>This month:</p><ul><li>Claude Fable 5, GPT-5.6, and US export restrictions</li><li>GLM-5.2 is the new best open weights model</li><l...

The WebKit gang did a good job with The Field Guide to Grid Lanes showcasing what kind of layouts are now achievable with display: grid-lanes;. Basically: Masonry layout, with arbitrary column widths, and proper tabbing order, is now progressive-enhanceable and HTML/CSS only.

A closer look at why users don’t need more tools in their daily lives. What they need are seamless integrations of useful features to match already existing, established mental models. Brought to you by Design Patterns For AI Interfaces, **friendly video course on UX** and design patterns by Vitaly.

Fixing full-bleed CSSA rather deep dive into how some of the newer CSS can make this age old pattern even better.Where’s the holistic AI productivity data?It’s hard to find anything other than anecdata from individuals telling us how AI has made them individually more productive. If AI really was creating measurable improvements in productivity across entire organisations, wouldn’t we be seeing that data?[nods]The Goldilocks customizable select heightEven the new custom <select> capabiliti...

now supports FUSE, letting you mount remote storage and custom filesystems inside a running Sandbox. Use it to attach S3 buckets, network filesystems, or any other FUSE-compatible driver as a regular path.Vercel SandboxThis makes it possible to stream large datasets directly from object storage, share state across Sandboxes through a common filesystem, or run tools that expect POSIX paths against remote sources without copying data into the Sandbox first.Learn more about in the documentation.rem

segments can now be managed from the with the new command.Vercel FlagsVercel CLIvercel flags segmentsA segment is the targeting primitive a flag uses to decide who sees what. Membership composes from three repeatable tokens: , , and . Pass them to or for incremental edits. For full replacement, takes the entire segment definition as raw JSON.include:exclude:rule:--add--remove--dataAll segment commands support output, making them scriptable from CI, local workflows, and agent-driven pipelines tha

Your agent can now inspect via the Vercel MCP and CLI for , the open-source agent framework.Agent Runseveeve traces are automatically ingested when deployed to Vercel and available as Agent Runs. The new and let you find projects with runs, list recent runs, and retrieve full traces, including reasoning, tool calls, and token usage.Vercel MCP toolsVercel CLI commandsVercel MCP tools:Vercel CLI commands:Every CLI subcommand supports for machine-readable output, and traces render as markdown when

Join the 0xInsider.com Discord community — talk markets, odds, and predictions with fellow prediction market traders in real time.

はじめに ABEMA の Data Platform チームに所属している河野です。 ...

StepSecurity Maintained Actions are now free for public repos. Secure, drop-in replacements for risky third-party GitHub Actions, reviewed and actively maintained.

TeamPCP weaponized 76 Trivy version tags overnight. The KICS attack followed the same playbook days later. One security control is not enough. Here is how the StepSecurity platform's ten independent security layers work together to prevent credential exfiltration, detect compromised actions at runtime, and respond to incidents across your entire organization before attackers can succeed.

<p><strong>Release:</strong> <a href="https://github.com/simonw/llm-coding-agent/releases/tag/0.1a0">llm-coding-agent 0.1a0</a></p> <p>Another Fable 5 experiment. Now that my <a href="https://llm.datasette.io/">LLM library</a> has evolved into more of an agent framework it's time to see what a simple coding agent would look like built on it.</p><p>I started a <a href="https://github.com/simonw/llm-coding-agent/tree/2466fa03ba8...

<p><strong>Research:</strong> <a href="https://github.com/simonw/research/tree/main/dspy-datasette-agent-prompts#readme">Using DSPy to evaluate and improve Datasette Agent's SQL system prompts</a></p> <p>One of this morning's AIE keynotes covered <a href="https://github.com/stanfordnlp/dspy">dspy</a>, which reminded me I've been meaning to see if it could help me improve the system prompt used by <a href="https://agent.datasette....

In Part 2 of the series on using Cloudflare with Web Apps, the focus is on setting up a database and addressing key issues like performance and connection management.

<p>I saw Geoffrey Litt speak at <a href="https://www.ai.engineer/worldsfair/2026">AIE</a> yesterday, and one framing he used particularly resonated with me:</p><p><strong>Understand to participate</strong></p><p>Geoffrey was talking about the challenge of collaborating with coding agents as they construct increasingly large and sophisticated changes, and the need to avoid taking on <a href="https://simonwillison.net/tags/cognitive-debt/"&...

Toolbox App 3.6 gives you better control over local storage and makes Windows installation failures easier to diagnose. Clean up removable Toolbox App data from Settings The Toolbox App now shows how much removable data it can safely clean up, providing a breakdown for the download cache, previous versions, temporary leftovers, and leftover tool directories. […]

GitHub had 20,000+ secret scanning alerts across 15,000 repositories. Here's how we separated signal from noise, built remediation workflows, and reached inbox zero in nine months.The post How GitHub used secret scanning to reach inbox zero appeared first on The GitHub Blog.

Learn which compliance frameworks accept AI pentesting Category: Compliance

I'm again, going to be doing a lot of the same sort of work I did for the WordPress integration, but as this is the first iteration of the AT protocol, it's going to be a lot simpler than that.Just like with the WordPress integration, I used Astro's pagination capabilities to build a paginated "feed" of posts, to satisfy the "Basic rendering of my AT protocol posts" part of the core features I outlined at the beginning of this series.Let's get stuck into that bit first. I created a pages/feed/[.

We’ve fallen into conversational tunnel vision, defaulting every AI capability into a chat-based interface simply because LLMs are trained on dialogue data. But great UX is about matching modality to users’ context, intent, and cognitive load, so the interface adapts to the user, not the other way around.

2026年5月某日、生成AI利活用を推進する有志による「Hacking Fest 2026 Spring」が開催されました。Hacking Festとは？Hacking Festは、ゴールデンウィーク...

レコメンドや最適化の仕事は、モデルの精度を上げることだと思われがちです。しかし、実サービスではそれだけで価値になるとは限りません。ユーザー体験を良くしたい。セッション数を伸ばしたい。広告収益も維持した...

Townie 5x cheaper, HTTP analytics, scoped blob, agent plugin, ...

TL;DR: Vite+ is now in beta. It unifies the runtime, package manager, and frontend tools every web project needs behind one fast, consistent workflow. Start a new project with vp create, or adopt it in an existing project with vp migrate.

Electron 43 has been released! It includes upgrades to Chromium 150.0.7871.46, V8 15.0, and Node v24.17.0.

now supports .Vercel AI Gatewayrouting rulesRouting rules are firewall-style rules that control which models your team can use, applied at the gateway level instead of in your application code.When a model goes down or gets retired, you usually have to ship a code change to move off it. With routing rules, you push one rule and every request reroutes instantly. There are two types:Rules apply to every request made with your team's AI Gateway credentials. You manage them with the .Vercel CLICreat

In Safari Technology Preview 247, we’re introducing the Safari MCP server — a Model Context Protocol server for web developers that makes your web development and debugging workflow faster and more powerful.

Safari Technology Preview Release 247 is now available for download for macOS Golden Gate and macOS Tahoe.

Lydia Hallie from Anthropic spends a couple of hours with us, helping us level up what we’re doing with Claude Code. Learn to customize Claude Code for your codebase, using CLAUDE.md, plan mode, and permissions that adhere to your team’s standards. Build reusable skills tailored to your processes and wire up hooks so Claude behaves […]

Frontier AI models corrupt around 25% of content in long edits. See how an enterprise AI governance layer makes every AI change reviewable.

Service Bindings make it easy for one Vercel service to securely call another within the same deployment.When a service declares a binding for another service, Vercel automatically injects the configured environment variable. That means user code can fetch that URL normally, while Vercel handles the internal rewrite, routing, authentication, and TLS behind the scenes.This enables multi-service applications on Vercel, like a Next.js frontend calling a FastAPI backend, while preserving service iso

Secure Registry now traces every npm and PyPI install back to the developer machine or CI pipeline behind it, so you can scope a compromised package in minutes.

Compromised versions run a malicious payload at npm install time through a binding.gyp node-gyp hook, harvesting credentials from sources like GitHub Actions secrets, cloud provider keys, and package registry tokens, while trying to persist in AI coding assistant configs. Static analysis of version 2.1.2 against the clean 2.1.1 release revealed a new 5 MB index.js and an added binding.gyp, both absent from earlier releases.

StepSecurity now supports Maven in GitHub Checks and OSS Package Search, blocking compromised and freshly published Java dependencies in your pull requests.

On June 24, 2026, an attacker published malicious versions of 20 npm packages belonging to the Leo Platform ecosystem in a coordinated burst spanning less than three seconds. All 20 packages carry an identical CI/CD attack toolkit that steals secrets from GitHub Actions runners, cloud credential stores, package registries, and password managers, then exfiltrates them via the victim's own GitHub token. Together these packages receive approximately 13,600 downloads per week.

On June 24, 2026, an attacker compromised the simonecorsi/mawesome GitHub repository. They force-pushed malicious commits and repointed several version tags to that commit. As a result, any workflow running against those tags after that time executed the attacker's code inside its GitHub Actions runner.

On June 24, 2026, an attacker compromised the codfish/semantic-release-action GitHub repository. At 15:39:06 UTC they force-pushed a malicious commit and repointed several version tags to that commit. As a result, any workflow running against those tags after that time executed the attacker's code inside its GitHub Actions runner.

A coordinated 8-month supply chain attack planted credential-stealing code inside fake AI coding assistants on the JetBrains Marketplace, quietly exfiltrating OpenAI, DeepSeek, and SiliconFlow API keys to an attacker-controlled server in Beijing -- which our investigation found still operational today.

PolinRider expands across npm, Packagist, Go modules, and Chrome extensions, using hidden loaders to target developer environments.

These six free settings will not make your project unhackable. Nothing will. What they will do is close the easy doors. Turn these on, and your project will be meaningfully harder to attack than it was before.The post 6 security settings every GitHub maintainer should enable this week appeared first on The GitHub Blog.

記事は ics.media へアクセスしてご覧ください。

CKEditor and Carahsoft’s partnership helps public sector teams access secure, accessible rich text editing built for modern content workflows, collaboration, and AI-enabled applications.

We're opening the waitlist for our Monetization Gateway, which will allow you to charge for any web page, dataset, API, or MCP tool behind Cloudflare. The charges will settle in stablecoins over the x402 open protocol, with no payments stack of your own to build.

One year after declaring Content Independence Day, a dynamic market for monetized content has officially emerged. In this report, we examine how the rise of autonomous AI agents is upending traditional search referrals and detail the new infrastructure required to support a sustainable web economy.

Search is how we find nearly everything on the web — creators, merchants, answers. AI is rewriting the rules, leaving creators caught between staying discoverable in an agentic era and getting paid for their work. Today we're launching two initiatives to help.

For our second Content Independence Day, we’re giving website owners finer options to manage AI traffic. Instead of a one-size-fits-all block, all customers can now easily distinguish and manage Search, Agent, and Training bots, alongside the new ability to protect ad-monetized pages.

We're picking up some good momentum, so let's keep the flow going. After integrating WordPress to power the blog section, it's now time to integrate a new feature of this website: AT Protocol posts.I could go all in at this point and integrate posts, comments, interactions and comments on blog posts, but I'm not in the business of doing that until I fully understand what I'm doing. Throwing code at the wall to see what sticks is a one way high speed train to technical debt city.If there ever is

Access to Claude Fable 5, the Mythos-class model, has now been on AI Gateway following the to lift the export controls.restoredUS Government's decision is the same model that was available between June 9 and June 12. What has changed is the safety classifiers, which are now updated and more robust.Fable 5In the near term, some routine tasks such as coding and debugging may trigger safety classifiers. To ensure requests are still serviced when the safety classifiers are triggered, use . AI Gatewa

Cloudflare’s new Attribution Business Insights dashboard helps website owners understand crawler behavior, appetite, and potential value, fueling business-level conversations around crawl compensation.

Break-glass credential revocation is live on GitHub Enterprise. The Trivy and Microsoft durabletask repeats show why fast, complete revocation was needed..Category: News

こんにちは。LINEアプリ開発SBU AIディベロッパーエクスペリエンスチームの onevcat（王 巍）です。最近は、AI エージェントを開発・検証のループに組み込むためのツールづくりに取り組んでい...

We are happy to share that CodeRabbit has become an ESLint gold sponsor, donating $1,000 each month for the ongoing maintenance and development of ESLint! CodeRabbit is an AI-powered code review platform that provides fast, context-aware feedback on pull requests. It helps development teams automate and accelerate the code review process, catch bugs and logic errors early, and improve code quality and velocity.Here’s what Santosh Yadav, Principal Developer Advocate at CodeRabbit, had to say abou

Evil Martians went from attempting to one-shot AI illustrations to a human-in-the-loop workflow with a dedicated illustrator. When a human owns first and last mile of this process, illustrations are crisp, high-quality and fun. Go BTS of our illustration production.

This month brought a real shift in how SvelteKit projects are configured. You can now define your SvelteKit config directly inside vite.config.js and skip svelte.config.js entirely. We also got the first preview of explicit environment variables, which will eventually replace $env/* modules in SvelteKit 3.On top of that, the language tools and the sv CLI both caught up with Svelte's new {const ...} declaration tags, so the whole toolchain is now in sync.Let's dive in!What's new in SvelteKitYou c

is now open source.konsistent is a CLI linter for TypeScript codebases that enforces structural conventions, giving agents and humans the consistent context they need to implement features correctly. Deterministic, fast, and covers structural patterns that TypeScript and ESLint don't model.konsistentConfigure conventions in a project-level file for concerns like:konsistent.json is used in and to enforce structural code conventions.konsistentAI SDKChat SDKUse the konsistent skill to help your age

You can now preview the framework preset and files that Vercel CLI includes in a deployment before creating one.Run from a linked project:vercel deploy --dryFor automation or further inspection, return the complete file manifest as JSON:JSON output includes the detected framework, included and ignored paths, directory size distribution, largest files, file modes, and content hashes. Piped and other non-TTY output automatically uses JSON.Agents can use this manifest as a pre-deployment check, ver

The Vercel Security Dashboard is now in private beta. It aggregates the security posture of every account and project on Vercel. As teams grow and coding agents make it easy to spin up new projects, small misconfigurations can add up quietly and quickly. Team members without 2FA, publicly accessible preview environments, or long-lived credentials where short-lived ones would do. Each of these can lead to a security incident or breach. The security dashboard flags these findings across Vercel env

is now available on the , allowing Vercel teams to send emails from their applications without managing any infrastructure.ResendVercel MarketplaceThis integration helps developers start sending messages within minutes, build emails as React components, and track delivery events in real time.Key capabilities include:Get started with on the Vercel Marketplace or install using Vercel CLI:ResendRead moreSend transactional and marketing emails through an API or SMTP relayBuild email templates as Rea

<blockquote cite="https://twitter.com/anthropicai/status/2072106151890809341"><p>We’ve received notice that the Department of Commerce has lifted export controls on Claude Fable 5 and Mythos 5.</p><p>We'll begin restoring access tomorrow, and will share an update soon.</p></blockquote><p class="cite">— <a href="https://twitter.com/anthropicai/status/2072106151890809341">Anthropic</a>, on Twitter</p> <p>Tags: <a href=...

<p><strong><a href="https://deepmind.google/models/gemini-image/flash-lite/">Nano Banana 2 Lite</a></strong></p>Also known as Gemini 3.1 Flash Lite Image (<code>gemini-3.1-flash-lite-image</code> <a href="https://ai.google.dev/gemini-api/docs/image-generation">in their API</a>), this is the "fastest and cheapest Gemini image model, engineered for velocity and scale".</p><p>I <a href="https://aistudio.google.com/app/promp...

Open source attacks are accelerating as AI coding agents pull in dependencies faster, with less human review.

<p><strong><a href="https://platform.claude.com/docs/en/about-claude/models/whats-new-sonnet-5">What's new in Claude Sonnet 5</a></strong></p>Claude Sonnet 5 came out <a href="https://www.anthropic.com/news/claude-sonnet-5">this morning</a>. I always head straight for the "what's new" developer docs because they tend to have more actionable information than the official announcement post.</p><p>Anthropic say of Sonnet 5 that "...

The Problem At HubSpot, we have a fundamental tension built into our culture: we want to help customers succeed, which often means giving employees access to customer portals: Engineers to fix bugs, sales engineers assisting with account setup, or customer support troubleshooting issues during live support calls. But we also need to completely lock down customer data — because a breach or misuse doesn't just violate customer trust, it can expose sensitive business data, create legal liability, a

<p><strong><a href="https://bambamramfan.github.io/ai-compass/">The AI Compass</a></strong></p>This political compass style quiz <a href="https://bambamramfan.tumblr.com/post/820505178072580096/the-ai-compass">by bambamramfan</a> is pretty neat - answer 29 questions about AI and AI ethics to see which of the 30 archetypes you best fit.</p><p>I'm impressed that my answers on my first time through the quiz categorized me as "The Garage T...

Explore how the Open Source Program Office uses GitHub’s new license compliance product to manage open source dependencies at scale.The post How GitHub maintains compliance for open source dependencies appeared first on The GitHub Blog.