<p><strong><a href="https://www.eveonline.com/news/view/the-move-to-python-3-begins">EVE Online: The Move to Python 3 Begins!</a></strong></p>EVE Online has been one of the most interesting case studies in Python at scale for over twenty years now.</p><p>They've been running on <a href="https://github.com/stackless-dev/stackless/wiki/">Stackless Python</a> since their launch in 2003, and their last major upgrade was 16 years ago, to St...

These are the lessons we learned evaluating LLMs for real-world secret scanning.The post How to evaluate LLMs before production appeared first on The GitHub Blog.

Create and manage Asana tasks directly from Socket alerts, with manual task creation, automated ticketing rules, and two-way sync.

SummaryImpact on Vercel deploymentsResolution for self-hosted applicationsCreditReferencesTwo vulnerabilities affecting Next.js were disclosed in the August 2026 Security Release. Next.js applications hosted on Vercel are protected and require no customer action. Next.js disclosed the following critical vulnerabilities: After the AVIF vulnerability was identified, Vercel applied protections to its managed Image Optimization service.Applications hosted on Vercel are protected. No upgrades, config

now has a free tier that gives you a high-level performance overview from your real users. The new free tier: Speed InsightsInstall Speed Insights: Previously, free Speed Insights was limited to a single project on Hobby, and upgrading to Pro meant losing access unless you paid for the add-on. Now your free tier carries over, and you only pay if you upgrade.The paid product, now called Speed Insights Plus, includes deeper diagnostics and historical data. If you were already paying for Speed Insi

A brand new 2 KB client-side syntax highlighter from Dave. Includes a web component for very easy usage. Maybe these web components have legs, eh? The most interesting part about it is that it doesn’t touch the DOM. It uses the Highlight API to colorize text and TextMate grammars (the same as in VS Code) […]

Syntax highlighting for code blocks without the complicated markup, spans, classes, and bloated JavaScript, courtesy of Uncle Dave.MicroLighter: Syntax Highlighter originally handwritten and published with love on CSS-Tricks. You should really get the newsletter as well.

We recreated the viral AI gym hack in a controlled environment. Running Opus 4.6 on OpenClaw, the model exploited the booking flaw in nine of ten runs.Category: News

Every website peaks on launch day and slowly drifts from there, not because it breaks, but because nobody has time to keep it current. Autonomous websites, continuously optimized by agents after launch, aim to change that. Pierre Burgy shares what they learned building for full website autonomy and the deeper design problem they uncovered along the way.

IndexedDB は、構造化されたデータをブラウザへ保存できる非同期・トランザクション型のデータベースです。この記事では素の IndexedDB API で基本的な仕組みを確認した後、React と Dexie.js でタスク管理アプリを実装します。

Agents increasingly write TypeScript programs to coordinate tools and process their results. Once those programs touch real applications, some steps require authentication, while others need human approval.Executing that code with gives it the same access as the application around it, including its secrets and internal services, and leaves no durable way to pause at those boundaries.evalToday, we're releasing the , a package for executing untrusted JavaScript and TypeScript without giving it dir

Every useful agent reaches beyond your codebase. It posts to Slack, opens pull requests, queries Snowflake, or calls an internal API. That reach is what makes it valuable, and it's also where the risk lives, because for years, granting it meant provisioning a long-lived token and hoping it never leaked. replaces long-lived tokens with ones your code requests at runtime, scoped to the task and expiring on their own.Vercel ConnectDuring the , we've grown the ecosystem past 100 connectors, unified

Our Rails AI assistant had read-only SQL access and could still return peer review scores. Learn how we kept open-ended analytics in an in-app AI assistant while making database access honor application permissions.

and are free on AI Gateway via GMI Cloud through Sunday, September 6.MiniMax M3M2.7Use the -free model IDs ( or ), which route to GMI Cloud. When the free period ends, the IDs will error:minimax/minimax-m3-freeminimax/minimax-m2.7-freeOr keep the model ID () and put GMI Cloud as the preferred provider with order:minimax/minimax-m3This will fall back to another provider when it cannot serve. Both options work across every AI Gateway API.To use the MiniMax models in a , see the coding agents guide

is now available on AI Gateway as .Wan 3.0 from Alibabaalibaba/wan-v3.0-videoOne model covers text to video, image to video, first and last frame conditioning, and reference-based generation, and it takes image, video, and audio as references. Clips run up to 30 seconds at 30fps, in 480p, 720p, or 1080p, and the output carries audio by default.That consolidates what took several models before. Wan 2.7 shipped as separate and IDs, each capped at 15 seconds and 24fps.-t2v-r2vTry the new on AI Gate

on AI Gateway can now run asynchronously. Video generationBy default, keeps one HTTP request to AI Gateway open until the result is ready. Because video generation can take seconds or minutes, that request can exceed request timeouts.generateVideoWith asynchronous generation, your application can receive a webhook, poll for completion, or start a generation and retrieve the result in a later request.Choose an option based on whether your process can keep running and whether your application can

is now generally available on all plans and in . Instead of storing long-lived provider secrets, your code requests short-lived, scoped tokens at runtime. Deployments authenticate with their existing Vercel OIDC identity. Each token is scoped to the task, refreshed automatically, and expires on its own.Vercel Connectv0Register a connector . Pass the service name and the CLI pre-populates the brand name, icon, auth type, and MCP or discovery URL, then prompts for any credentials the service requi

Chat SDK's Slack adapter now supports .Slack Enterprise GridBots installed org-wide work across every workspace, with correct token resolution, tenant-scoped caches, and event retry deduplication.The adapter now stores org-wide installations by enterprise ID. This matches how tokens are resolved for incoming events, slash commands, and interactive payloads. records the new identity fields:SlackInstallationToken resolution behaves the same over HTTP webhooks and Socket Mode. Events route by the i

now includes a managed connector for , so your apps and agents can send and receive messages over iMessage, RCS, and SMS.Vercel ConnectLinqAs a , Vercel can create a Linq account and phone number for you, or link an existing account. You never manage credentials yourself.Vercel Managed ConnectorCreate a connector from the or :dashboardVercel CLIThe connector powers the new in .Linq channeleveRun , choose Vercel Connect, and eve wires up the connector, phone numbers, and webhook for you:eve add c

Your team already works in Notion. Now your agent can too.With the new for Chat SDK, the same agent you run on Slack, Discord, GitHub, Teams, or WhatsApp can join comment discussions on your Notion pages, no separate codebase required.Notion adapterEach Notion page maps to a channel and each comment thread to a thread, so replies stay threaded automatically.The adapter supports mentions, message editing, conversation history, and up to three file attachments. By default, your bot replies when @-

You can now build bots that hold end-to-end encrypted 1:1 and group conversations on XChat with the new for Chat SDK.XChat adapterThe adapter handles all encryption, key management, and signature verification automatically. Bots can also message users first, as long as the user has encrypted chat set up and follows the bot.XChat has no markdown rendering, so the adapter falls back automatically: URLs and @mentions render as tappable links, tables as ASCII code blocks, and cards as text with a li

Hi, I’m a backend engineer working on Bucket ...

はじめに カミナシでSWEをしている osuzu です。 筆者はSaaSと呼ばれる業務ソフトウェア開発を前職含め6年ちょっと経験し、最近ようやく言語化できたことがあります。 それは「SaaSの技術的な難しさは、ホリゾンタルかバーティカルかで種類が異なる」ということ。そしてより重要なのは、この2つの戦いを混ぜてしまうと、どちらの戦い方も難しくなるということです。 前提: ホリゾンタルSaaSとバーティカルSaaS 念のため用語を揃えておきます。 ホリゾンタルSaaS: 業界を問わず横断的に使われるSaaS。チャット、タスク管理、通知、ドキュメントなど。SlackやNotion、Google Do…

We built a plugin for the GitHub Accessibility Scanner to make sure your alt text is actually accessible. Here's how it works.The post Your alt text passes automated checks. That doesn’t mean it’s any good. appeared first on The GitHub Blog.

We migrated the Cloudflare Blog to EmDash to prove our stack at massive scale. Here is how we stress-tested performance, safely routed production traffic, and redesigned the frontend experience.

<p><strong>Release:</strong> <a href="https://github.com/simonw/llm-anthropic/releases/tag/0.27">llm-anthropic 0.27</a></p> <p>This release of the Anthropic plugin for <a href="https://llm.datasette.io/">LLM</a> mainly provides compatibility with the recently released <a href="https://github.com/anthropics/anthropic-sdk-python/releases/tag/v1.0.0">anthropic v1.0.0</a> Python library, which switches from <code>httpx</code...

now consider cache hits when deciding whether to use a smaller build machine. A warm-cache build no longer triggers a downgrade. Elastic build machinesTurborepoA warm-cache build can use less CPU and memory than the same build with a cold cache. Downgrading based on that lower usage could leave a later cold-cache build without enough resources to complete successfully.This change applies automatically to all builds using Elastic build machines. No action is required. Learn more in the .build doc

It isn’t often that new image formats land in browsers. In the early 2000s we had JPEG, GIF, and PNG. The 2010s gave us WebP, which was a modest step up from JPEG. But the 2020s have given us two new image formats that are a big step up from previous formats: AVIF and JPEG […]The post Intent to Ship: JPEG XL appeared first on Mozilla Hacks - the Web developer blog.

記事は ics.media へアクセスしてご覧ください。

CKEditor AI now works from your own prompts and files, fits what your editor is set up to do, and understands the images in your document. Table editing and formatting around widgets are also improved.

Seven and half years after blocks arrived in Core, WordPress introduces a way to build blocks without React annd build pipelines. All you need is PHP.WordPress PHP-Only Block Registration originally handwritten and published with love on CSS-Tricks. You should really get the newsletter as well.

My post Thinking Horizontally in CSS @layer got Stuart Robson thinking about how to pull it off at a bigger scale. Stu is right that our components are essentially hand-written, whereas with a more enterprise-scale design system, design tokens are more likely to come from a build pipeline. That got Dave Rupert thinking about how […]

"Let's say you have 4 issues that can be implemented simultaneously..."

<p><strong><a href="https://fzakaria.com/2026/08/23/your-executable-is-a-sqlite-database">Your executable is a SQLite database</a></strong></p>Farid Zakaria describes a neat Linux pattern for creating a SQLite database file that can be directly used as an executable binary.</p><p>The trick sets the SQLite file format's 4-byte application ID (68 bytes into the file) to SELF, standing for Structured Executable & Linkable Format. The various ...

Aikido AI Code Audit found 8 more vulnerabilities than Claude Security with Mythos at less than half the cost. How harness design drives coverage per dollar.Category: News

はじめに こんにちは！2026年7月の1か月間、「CA Tech JOB」に参加した池畑です！ 株式 ...

Open VSX has removed three extension IDs from its malicious-extension list as the legitimate publishers they impersonated move to claim the names for themselves.

now runs globally, starting with four regions: (Washington, D.C.), (San Francisco), (Cleveland), and (Paris). Vercel Sandboxiad1sfo1cle1cdg1 remains the default. Support for all Vercel regions is coming soon.iad1Choose a region close to the databases, object storage, and other services your sandboxes access to reduce latency. Region selection is available on all plans. Pro and Enterprise teams can also configure failover regions. If the primary region is unavailable, new sandboxes start in the c

PR TIMESでCTOをやっている金子 (@catatsuy) です。 2023年に、PR TIMESのログインシステムへJWTを導入したことを開発者ブログで紹介しました。 この記事では、JWTの仕様や移行の進め方など […]

HighlightsThis patch release fixes false positives in the no-loss-of-precision rule that were introduced in v10.9.0.Bug Fixes1e641c9 fix: no-loss-of-precision false positive with trailing decimal point (#21251) (Aleksandr Shoronov)Documentationad74a8d docs: add deprecation steps for EOL package versions (#21248) (Francesco Trotta)Chores3c3ae53 chore: update ecosystem plugins (#21249) (ESLint Bot)

When you add or edit an environment variable in Vercel, you now choose Config or Secret instead of using the Sensitive toggle. Existing variables marked Sensitive are automatically treated as Secrets and continue to work without migration.You can select an environment or Preview branch for each value. The in the dashboard shows each variable’s type and where it applies.environment variable listThe team policy is deprecated with this update. When enabled, it required every environment variable cr

The on Vercel Functions now supports larger package sizes up to 5GB uncompressed and extended max duration for up to 30 minutes, two betas that previously ran on Node.js and Python only.Bun runtimeLarge functions raise the standard 250MB package size limit to 5GB, and extended max duration raises the generally available 800-second ceiling to 1800 seconds for Pro and Enterprise teams. Both features require to be enabled. New projects are enrolled in the large functions beta automatically, while e

Apps and agents built in v0 can now securely connect to , including Slack, Google, Notion, GitHub, and Salesforce, through .more than 100 servicesVercel ConnectAsk v0 to connect your app to a service. It opens the connector setup and guides you through it.You set up each connector once for your team, then reuse it across apps.For managed connectors like Slack and GitHub, Vercel handles app registration, so you don’t need to create or configure an app with the provider. For other services, you ca

はじめに 株式会社AJA でバックエンドエンジニアをしている片山です。 AJA DSP では、Goo ...

今年も AWS re:Invent がラスベガスで開催されますね。私は去年初めて現地参加し、今年も参加する予定です。この記事では、今まで現地参加に消極的だった私が、去年悩んだ末に初参加して感じた「現地参加すべき理由」を紹介します。もし、この記事をきっかけに現地参加を決めた人がいたら X(saramune) で連絡をください。現地でお会いできたら、ぜひ一緒にご飯でも食べながら AWS 談義をしましょう！（私が美味しいお店を探しておきます！） なお、本記事は AWS さんの連載「「ラスベガス5日間で得たもの」── re:Invent に賭けたスタートアップのリアル」にて、弊社 CTO がインタビュ…

StepSecurity threat intelligence tracked 56 open source supply chain attacks from August 2025 to August 2026, roughly one every three days since March. See the data and the defenses.

<p><strong><a href="https://www.ft.com/content/5ee49718-c258-4f01-aa32-7e5b76ae5245">Anthropic’s best AI model struggles to attract users as cheaper tools thrive</a></strong></p>A few interesting numbers in this FT story gathered from "people with knowledge of the matter":</p><ul><li>Anthropic's "annualized revenue" for July is up to $65bn - it was $47bn in May, and I collected <a href="https://simonwillison.net/2026/May/29/anthropic/"&gt...

<blockquote cite="https://www.dbreunig.com/2026/08/23/fable-the-end-of-moore-s-law.html"><p>Prior to Fable, it felt silly to waste <em>too</em> much time improving your coding harness or context strategies. A new model would arrive at the same price (or cheaper!) and paper over most of your problems.</p><p>But then Fable landed. It was (and still is!) <em>incredible</em>. But the cost was so high and Opus was <em>good enough</em> (as w...

Vitest で作成したスパイを復元し忘れると、別のテストへモックの状態が漏れるおそれがあります。Vitest 3.2.0 以降では `vi.spyOn()` の戻り値を `using` で宣言すると、スコープを抜けるときに元の実装を自動的に復元できます。この記事では `using` による自動復元の仕組みを紹介します。

pnpm 11.23 gives the registries setting a shape that describes each registry once — its tarball layout, the scopes routed to it, the prefix it answers to — so an Artifactory or GitLab registry can finally keep its tarball URLs out of pnpm-lock.yaml. It adds virtualStoreType, makes undeclared imports resolve under ESM with the global virtual store without a plugin, teaches pnpm config get to report the settings pnpm actually acts on, and warns about settings no pnpm version recognizes.

<blockquote cite="https://github.com/torvalds/linux/commit/818bebeb63dd6bf5f4e07e145f6cdbace520a34c"><p>And this was a debug session from hell, enormously helped by an AI doing much of the grunt-work.</p><p>I'd like to call it my tireless helper, but the AI several times stated flat out that this was impossible and unsolvable and that we should just write a report about it.</p><p>I suspect those things have been trained by people who may not be quite as stubb...

<p><strong>Release:</strong> <a href="https://github.com/simonw/llm/releases/tag/0.33">llm 0.33</a></p> <p>My highlights from this release:</p><blockquote><ul><li>Upgraded to the OpenAI Python library 3.x and switched the HTTP client dependency from <code>httpx</code> to <code>httpx2</code>. <a href="https://github.com/simonw/llm/issues/1608">#1608</a>, <a href="https://github.com/simonw/llm...

<p>The key skill required to make productive use of coding agents is being able to confidently instruct them on how to make changes and then confidently verify that those changes have been applied in the correct way.</p><p>Sometimes this involves reviewing every line of code they have written, but there are other ways to achieve that goal. Eyeballing every line of code has never been the most effective way to validate a change to a piece of software.</p> <p>Tags: &...

Three Rust crates are compromised: arrayref 0.3.10, internment 0.8.7, and append-only-vec 0.1.9 each added a typosquatted build-time dependency (proc-macro1, proc-macro-en) whose build script downloads and runs a remote binary during cargo build. Full technical analysis: timeline, dropper dissection, runtime detection, IOCs, and remediation.

AI が書いた記事は一般論に寄りすぎ、冗長になりやすいと考えていたため、これまでは誤字脱字の確認にだけ AI を使っていました。AI に任せる執筆フローを試したところ、生成稿を批判的に読み、自分の体験を加えて推敲すれば、学習効果は大きく失われないと感じました。この記事では、実際に試した方法について紹介します。

Slack Code は Slack 上でオープンな開発を行う手段を提供する機能です。コードチャンネルと呼ばれる特別なチャンネルを作成し、チーム全体でコーディングエージェントとやり取りを行うことができます。この記事では Slack Code を実際に試してみた感想を紹介します。

In short: Vim has a joke autocmd called UserGettingBored that doesn’t do anything.Vim’s automatic commands feature, usually shortened to “autocmd”, lets you run code when various events occur. For example, you could implement an auto-save feature by binding the TextChanged event to the :w command.Vim has over 100 events, from “buffer was created” to “file was saved”. But one of them sticks out to me: UserGettingBored. Here’s the documentation:UserGettingBored: When the user presses the same key

A new language joins the toolchain, downloads can now be verified with GPG signatures, and

Cloudflare's new Bot Preference Sync automatically aligns your robots.txt file with your AI bot policies for Search, Agent, and Training. Easily manage which bots access your content without maintaining static files.

Ora on VercelEvery harness expects its own infrastructureOne platform under every harnessTesting eve like any other harnessThe framework behind Ora's own agentsFront end, back end, and agent runtime on one platformEvery major agent tested side by side on live sitesHundreds of commits a day from a 16-person engineering team7% fewer steps to reach the goal2x native success: twice as many tasks finished on the customer's own site instead of falling back to web search9% more valid endpoints: more of

Image hardening tools compared for 2026: Aikido, Chainguard, Docker, RapidFort, Echo, Minimus, and WizCategory: DevSec Tools & Comparisons

Compare the top enterprise AI pentesting tools of 2026: Aikido, XBOW, NodeZero, Pentera, Hadrian, and Cobalt.Category: DevSec Tools & Comparisons

Socket’s PHP and Composer support is now in Beta for all customers, with PHP reachability analysis generally available.

<p><strong>Release:</strong> <a href="https://github.com/simonw/llm/releases/tag/0.32.1">llm 0.32.1</a></p> <p>Fresh installs of LLM stopped working the other day because the OpenAI Python library dropped its usage of <code>httpx</code>, and it turned out LLM depended on that library but only installed it via a transitive <code>openai</code> dependency.</p><p>This dot-release fixes that for the moment by pinning to &l...

<p><strong>Release:</strong> <a href="https://github.com/simonw/llm-openrouter/releases/tag/0.7">llm-openrouter 0.7</a></p> <p>Now that this plugin is compatible with <a href="https://simonwillison.net/2026/Aug/4/new-release-of-llm/">LLM 0.32</a> it can display the reasoning traces for LLMs available through OpenRouter.</p><blockquote><ul><li>Updated for compatibility with <a href="https://llm.datasette.io/en/stabl...

<p><strong><a href="https://sockpuppet.org/blog/2026/08/20/stop-making-tuis/">Stop Making TUIs</a></strong></p>Thomas Ptacek advocates for building real native user interfaces for even the smallest of personal tools, because coding agents have reduced the cost of getting a usable-enough GUI up and running to almost nothing.</p><p>I wrote about my vibe-coded bandwidth and GPU monitoring macOS task bar apps <a href="https://simonwillison.net/2026...

A newly resolved proposal would allow us to select classes that are a prefix for variations with a wildcard, like .prefix-*.Resolved: CSS Class Prefix Selector originally handwritten and published with love on CSS-Tricks. You should really get the newsletter as well.

<blockquote cite="https://interconnected.org/home/2026/08/21/galactic"><p>After I released version 1.0, I figured I would have to do the rotations myself. So I sat down with ChatGPT and I didn’t get it to write the code, but I got it to educate me. With a patient, interactive tutor, I was able to finally do what I hadn’t by reading books and asking mathematician friends – I learnt how to use quaternions just enough to make the app work.</p><p>So learning doesn’t stop jus...

CVE remediation is fixing known flaws in the software you run. Why upgrading often fails, what remediation actually involves, and how backporting fixes it.Category: DevSec Tools & Comparisons

Websites often hardcode keyboard shortcuts for Mac (⌘) while neglecting Windows users, leading to confusion.

Three months ago, I wrote that Bun was the only mainstream package manager that couldn't do surgical CVE remediation. Bun 1.4 ships in-place transitive updates, bun audit fix, and nested overrides. Time to re-run the original reproductions.

BulletedThis is the stuff that's exciting about the AT protocol. Not the "new twitter" bullshit, but the endless possibilities that this technology opens up. It's using the fancy new private data stuff too.The future of CSS: target multiple classes with the class prefix selectorAs Bramus says in the article, we can sort of do this already, but those substring selectors don't perform well. This new method is a very good improvement!Ruminations on notificationsA good write-up on how annoying and h

We tested 10 AI models on 32 fresh CVEs. DeepSeek V4 Pro found 28, and three cheap runs beat one pass of Opus 5 or Grok on total coverage.Category: News

Every deployment produces a set of files, including the pages, functions, and assets Vercel serves. Deployment Storage keeps those files available so you can inspect previous deployments and roll back when needed.Instantly roll back to previous deployments in secondsIf a production deploy ships a bug or a change you want to reverse, rolling back restores the previous version in seconds. Open your project, click on the Production Deployment tile, then choose an earlier production deployment. Verc

Electrobun 2.0 introduces Cottontail, Hutch, a polyglot Zig core, and Warren—a new foundation for tiny, fast desktop apps across TypeScript, Zig, Rust, Go, and Odin.

HighlightsNew option checkConditionalExpressions in no-unmodified-loop-conditionThe no-unmodified-loop-condition rule now supports a checkConditionalExpressions option.When enabled, each branch in a ternary expression is checked independently.For example, with { "checkConditionalExpressions": true }, the rule reports the done variable as not modified in the loop:let chunk = getInitialChunk();let done = false;while (chunk ? !done : false) { chunk = nextOrNull();}123456Copy code to clipboard Featu

OpenAI lowered list pricing for , and the 50% AI Gateway now applies to the new, lower price through September 18. Input drops 20%, output drops a third. GPT-5.6 SoldiscountThe discount applies on every OpenAI service tier:Rates are per million tokens for requests up to 272K tokens. Cached tokens, cache writes, long-context requests above 272K, and the US regional rates all move by the same proportion. See the for all model rates.pricing pageThe model ID is unchanged, so requests you already sen

is now available on AI Gateway.DeepSeek V4 Flash with visionThis model is an experimental version that accepts images alongside text. You can ask it to describe a picture, read text out of a screenshot, or work through a chart in the same request as your prompt. DeepSeek V4 Flash Vision Experimental now available on AI Gateway. Tool use, reasoning, and caching all work the same as before.Use to get started:deepseek/deepseek-v4-flash-vision-expImages can be JPEG, PNG, GIF, or WebP. The format is

With always-on tracing, you can now debug your real user requests without reproducing them.Always-on tracing continuously collects traces from your production and preview traffic. Unlike , which only captures requests from your own browser, it samples your live traffic. session tracingYou control what's collected with sampling rules. Each rule sets a trace rate for an environment (All, Production, or Preview), optionally scoped to a path prefix like . Nothing is collected until you add a rule, s

<p><strong><a href="https://promptwatch.com/data/chatgpt-site-operator-fanouts">ChatGPT search now uses the site:operator at scale</a></strong></p>Promptwatch is part of the emerging "GEO" space, for Generative Engine Optimization - the chatbot version of SEO, where companies offer tools and consulting to help your site increase its presence in replies to prompts inside tools like ChatGPT.</p><p>The Promptwatch product uses automation to track res...

Socket is bringing experimental protection to Firefox, scanning 97,000+ extensions in Mozilla's official directory for malware and risky updates.

An update on the August 17 outage and the steps we're taking to improve reliability.The post The August 17 outage, and the work ahead appeared first on The GitHub Blog.

You can now use the to manage comments. covers the full triage loop:Vercel CLIVercel Toolbarvercel commentsStart by listing all of the unresolved comments in the current branch:Dig deeper into a specific thread:Reply, resolve, edit:Update to the latest Vercel CLI version and run . Or just prompt your coding agent: vercel commentsLearn more in the .comments CLI docsRead moreList and filter unresolved comments for the linked project, scoped to your current Git branchInspect a full thread with ever

It’s kinda cool there is Infinity in CSS. You just always need to use it within a calc(), like border-radius: calc(infinity * 1px);. Adam has lots of ideas in that post, and I remember Will was messing with similar ideas a few years ago. I’d say just use it when you’re trying to use an […]

Cloudflare OAuth now supports optional scopes, giving users more control over what an app can access and helping developers build secure consent flows around the task at hand.

You can now emit your own metrics directly from your Vercel Functions and analyze them alongside Vercel's built-in observability data.Use the function from the package to record any value you care about, like request latency or business events, and attach attributes to filter and group by:metric()@vercel/functionsOnce emitted, your custom metrics are available across Observability:• slice and aggregate metrics on the fly.• build and share dashboards.• query using the command.Query builder:Notebo

Three compromised Rust crates pulled in a malicious dependency that downloaded and executed cross-platform malware during Cargo builds.

<p><strong>Research:</strong> <a href="https://github.com/simonw/research/tree/main/bun-webview-json-api#readme">A shot-scraper-style JSON API on Bun 1.4's new Bun.WebView</a></p> <p>Today saw the long awaited <a href="https://bun.com/blog/bun-v1.4">release of Bun 1.4</a>, the first stable version since the infamous Rust rewrite <a href="https://simonwillison.net/2026/Jul/8/rewriting-bun-in-rust/">a few months ago</a>.&l...

Discover SMIL, the often-overlooked way to animate SVGs that works inside `` tags and can fully animate everything in an SVG without JavaScript.

The <geolocation> HTML element does exactly what you might think it does. It’s a dedicated element that gets the user’s location, either once or continuously. The options are set using HTML attributes instead of JavaScript, but JavaScript is still needed. However, <geolocation> requires fewer lines of JavaScript and also offers superior error and permission handling. In fact, the <geolocation> element started off as an all-purpose <permission> element, but is now dedicate...

A supply chain attack compromised popular Rust crates, arrayref, append-only-vec, and internment, injecting a dependency on the malicious proc-macro1 package that downloads and executes a remote payload at build time.Category: Vulnerabilities & Threats

ABEMAのエンジニアの黒崎 ( @kuro_m88 )です。 本日 Go 1.27がリリースされた ...

AI-generated applications often need to authenticate to external services on behalf of their users. That creates a problem: generated code shouldn't have access to the user's credentials.We faced that decision when building the v0 . It lets users connect Snowflake, inspect schemas, query data, and generate applications that run against their warehouses. That generated code has to authenticate to Snowflake, but it is written by a model and runs without human review, and , so the user's OAuth toke

LINEヤフー株式会社では、技術に関するイベントや勉強会の主催・協賛などを行っています。最新情報は各リンク先でご確認ください。タイミングによっては、申し込み開始前や既に満席となっていることがあります。...

A checklist for scoring AI pentesting vendors on validation, code access, scope control, and reliability, plus the red flags that separate a real platform from a strong demo.Category: Aikido

Bun 1.4 rewrites Bun in Rust, ships built-in headless browser automation (Bun.WebView), Bun.Image, Bun.markdown, JSON5, JSONL, Terminal and cron APIs, Node.js 26.3.0 compatibility with 1,517 newly passing tests, parallel test and run, Windows ARM64, and an opt-in global virtual store for up to 7× faster installs.

Vercel Agent now works in Slack code channels, a new kind of channel launched today for working with a coding agent. Anyone in the channel can follow the work, give Agent new instructions, and review the code it writes.Choose from the Slack sidebar, select Vercel as the agent, and describe what you need to get started. You can also ask Agent to create one from an existing channel or thread. It brings that context with it to the new channel.Create a code channelUse code channels to investigate in

You can now manage with . The new command group lets you:Vercel Container RegistryVercel CLIvercel vcrAuthenticate your container tooling, such as Docker, Podman, or Buildah, with a short-lived token scoped to your project. Then build and push:The credentials go to Docker itself, so your existing tooling can push to VCR with standard commands:Repositories are created automatically the first time you push, or explicitly with . From there, you can list what's stored and inspect individual images a

Vercel Functions now support the new , a rewrite of Bun from Zig to Rust, with over 2,900 issues resolved, more than 1,500 additional Node.js compatibility tests passing, and new features and performance improvements.Bun 1.4 releaseBun on Vercel Functions:To update from the previous Bun version, set to in . bunVersion1.4.xvercel.jsonUpgrading is an explicit opt-in because Bun 1.4 has several . Review the breaking changes and update your application before upgrading.breaking changesLearn more abo

<p><strong>Research:</strong> <a href="https://github.com/simonw/research/tree/main/smolmachines-untrusted-sandbox#readme">smolmachines / smolvm as a sandbox for untrusted Python & JavaScript</a></p> <p>I tasked Claude Fable 5 running in Claude Code for web with the following research task:</p><blockquote><p><code>Put https://smolmachines.com through its paces as a fast secure sandbox. Explore what it would take to use th...

はじめに こんにちは。グループIT推進本部の Roki です。 Claude CodeやOpenAI ...

<blockquote cite="https://jeremymorrell.dev/blog/extensible-software-in-the-age-of-llms/"><p>My hypothesis is that <strong>there is a new opportunity for Extensible Software on the web</strong>. LLMs radically lower the cost of authoring extensions, and modern sandbox primitives lower the deployment cost and provide good security boundaries. We can build our app as a solid, accountable core, and allow users to safely extend it in many directions by having LLMs fill in th...

<p>Last week I recorded <a href="https://talkingpostgres.com/episodes/how-ai-is-changing-software-development-with-simon-willison">an episode of the Talking Postgres podcast</a> with Claire Giordano on the subject of "How AI is changing software development". We had a really great conversation. Here are a couple of my highlights from a lightly edited transcript (prompt to Claude: "very minor edits to remove disfluencies").</p><p>This is the latest version of an arg...

はじめにGitHub Actions で Node 20 を利用していると次のような警告が表示されています。Node.js 20 is deprecated. The following actions target Node.js 20 but are being forced to run on Node.js 24: actions/setup-java@v4. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-action...

If you’re juggling multiple Copilot sessions, use the My work pane to track what's in flight, what's done, and what's next.The post GitHub Copilot app for Beginners: Managing your work appeared first on The GitHub Blog.

Socket uncovered 77 linked Firefox extensions, including 40 that steal wallet secrets or credentials and 37 deceptive sports-score shells.

In 2024 and 2025, we reassessed remote Spectre attacks on our Workers infrastructure. We share details about the new attack primitives like Spectre gadgets, remote timers, achieving co-location and how new defenses further harden Cloudflare Workers.

Apply a style when someone navigates from one specific page to another. The idea being it'd make the sources for cross-document view transitions declarative in CSS rather than managing that stuff in JavaScript.CSS Navigation Matching, Early Days originally handwritten and published with love on CSS-Tricks. You should really get the newsletter as well.

CVE-2026-52813 | An Aikido pentesting agent flagged a path traversal in Gogs. We escalated it to full RCE and reported two more bugs, all fixed in 0.14.3.Category: Vulnerabilities & Threats

As someone who teaches beginning web development, I find that building a WordPress site makes for a great final project. Hosting those projects has always been a roadblock though.WordPress.com Student Plan originally handwritten and published with love on CSS-Tricks. You should really get the newsletter as well.

You can now provision and manage directly from the Vercel Marketplace.AlgoliaAlgolia is a hosted search platform. You send it your content, it builds an index, and your app queries that index instead of your database. Results come back in milliseconds, with typo tolerance, synonyms, and facet counts built in.Key capabilities:Installing adds your Algolia credentials to your project's environment variables; redeploy to pick them up. Algolia's agent skills install too, so your coding agent knows ho

本記事は、Tech-Verse 2026で発表したセッション「AIを入れても、なぜ業務量は思ったほど減らないのか――Human-in-the-loopの限界とAI-Readyな業務設計」の内容を、LI...

Rails boot time is a DX metric in the AI age: meet require-profiler, learn to actually read sampling profilers, and see the pit stop that cut a 200-component monolith's boot by 40%.

now works in Slack. Mention it the way you'd pull a teammate into a thread, and it reads the discussion, answers with the context of the platform running your app, and turns the team's decisions into changes you approve. Vercel for Slack is available today in Public Beta for Pro and Enterprise teams.Vercel Agent. An alert gets noticed in a channel, a fix gets agreed on in a thread, and then someone leaves Slack to do the work. With Vercel Agent, you can tag it in for answers about your infrastru

The Python SDK for Vercel Queues is now available in beta, bringing first-class Python support for running background workloads on Vercel. You publish messages to topics, and independent consumer groups process them in parallel with automatic retries, sharding, and delivery guarantees. Messages can be enqueued or consumed from either JavaScript or Python, meaning a Next.js producer can fan out to both Next.js and Python queue consumers. Publish a message from your Python API:Publish a message fr

A new Compliance section in Team settings lets you preview and download Vercel's compliance documents directly in the dashboard. These include attestations like SOC 2 Type 2, security policies, and other security documents that are available through the Trust Center.You can select a single document, an entire attestation, or multiple documents, and download them together as a single zip archive. Every download and preview is watermarked with your user and team information. Some entries link out

's audio models are now available on AI Gateway. To celebrate the launch, every model is free on AI Gateway for the next 30 days, through September 18.Fish AudioFish AudioFour models from Fish Audio are available, including their latest text-to-speech model:How to use models during the offer periodSpeech and transcription ship in the current 7 release.AI SDKGenerate spoken audio from text with and write the result:generateSpeechTranscribe recordings into text with . The audio can be a buffer, a

Vercel Agent is now available in Slack. Mention in any channel or thread, and Agent joins the conversation with relevant context from your Vercel projects, including deployments, builds, logs, metrics, configuration, and connected repos.@VercelFor example, use it to:Vercel Agent acts through its own identity. It's read-only by default, never exceeds the requester’s permissions, and makes no changes without approval. Every action is attributed to Agent, the requester, and the approver.Vercel for

now includes a managed connector for , so your apps and agents can access all Microsoft products such as Teams, OneDrive and more.Vercel ConnectMicrosoftAs a , Vercel registers the Entra application and configures federated credentials for it, so you don't have to create an app registration or manage client secrets yourself. Authorize the app for your Microsoft tenant once, then attach the connector to the projects and environments it needs.Vercel Managed ConnectorCreate a connector from the or

You can now build bots for Instagram with the new for Chat SDK.Instagram adapterBots can send and receive DMs and media, render cards as quick replies and link buttons, show typing indicators, receive reactions, and handle story replies.The adapter connects through Meta's Instagram Messaging API and requires a professional Business or Creator account.Messages are buffered, so streamed responses send as one message when the stream completes. Meta enforces a 24-hour messaging window, so bots can o

is now available on the and as a native integration. Exa's neural search engine grounds models in current information.ExaVercel AI GatewayAgent MarketplaceEvery model on AI Gateway can search with Exa through a , with no Exa account or key of your own required. Pass alongside your prompt and the gateway runs the search, hands the results back to the model, and keeps going until the model stops searching. You get one finished response with a synthesized answer rather than raw results to stream ba

Learn what the Server-Timing header is and how to track server-side performance metrics.

Polypane 30 introduces Playgrounds so you can open directories as real HTTPS URLs in seconds, adds support for the Side Panel extension API…