ChainDrop npm worm: 444 packages and 2,212 versions poisoned, starting with [email protected]. Payload analysis, affected package list, IOCs, and remediation steps.

<p><strong><a href="https://github.com/PipeNetwork/minimax-h3-mlx">PipeNetwork/minimax-h3-mlx</a></strong></p>MiniMax released <a href="https://huggingface.co/MiniMaxAI/MiniMax-H3">MiniMax-H3</a> two days ago - they describe it as a "a general-purpose, omni-modal generative system", which in practice means it accepts text, images, audio and video and can use them to generate up to 15 second video clips with audio included.</p><p>This P...

Learn how to build tools to simplify how you work—without writing a single line of code.The post How the GitHub legal team used Copilot CLI to streamline their workflows appeared first on The GitHub Blog.

Socket is now in the AWS Security Hub Extended plan. Adopt it through AWS, apply committed spend, and block malicious open source packages.

I’m just learning that the Web Platform Status website offers email alerts when features of your choosing change in support. For instance, I just signed up to hear exactly when Customizable <select> becomes Baseline Newly Available.

Instead of one huge, un-reviewable pull request, teach coding agents to decompose work into a clean, ordered stack with GitHub stacked pull requests.The post Turn one giant AI-generated pull request to a reviewable stack appeared first on The GitHub Blog.

Agents can write code faster than teams can review, deploy, and maintain it. Today we’re introducing the Agent Development Lifecycle and the Cloudflare primitives that underpin it

Cloudflare Wallets will provide AI agents with native payments and verifiable identity on the web. Using the x402 protocol, agents can autonomously purchase APIs and content within clear safety guardrails.

Learn how to build customizable, sandboxed CI/CD pipelines natively on Cloudflare using Workflows, Artifacts, and the CI SDK. We walk through replacing complex YAML configurations with TypeScript workflow steps and self-healing AI agents.

We created the Cloudflare Codex, a governed body of engineering standards that AI agents consume across the development lifecycle. By pairing structured RFCs with agentic reviews, teams automatically enforce consistency across code, specs, and incident reports.

Cloudflare Agents brings all of your deployed agent sessions into a single experience, surfacing key information and insights into how your agents perform at scale.

wrangler dev now produces structured traces for every local request. Your coding agent can hit a single API to pinpoint exactly what failed and why — no deployment required.

By replacing manual issue verification with isolated AI subagents running in GitHub Actions, the Astro maintainers reduced open issue count by 85%. This post explores the architecture behind automated bug reproduction, patch verification, and preview releases.

How I turned Garmin activity data into self-hosted Grafana dashboards and connected an AI agent through MCP to act as my personal training assistant.

Mini Shai-Hulud malware was injected into keyv and eight related npm packages on August 4, 2026 after an attacker compromised the maintainer's GitHub accountCategory: Vulnerabilities & Threats

Popular npm packages keyv and cacheable compromised.

はじめに はじめまして！LegalOn Technologies でソフトウェアエンジニアをしている島田(@curryisdrink)です。2026年5月に入社し、もうすぐ最初の3ヶ月が終わろうとしています。 私が所属するのはいわゆる Platform Engineering とその周辺領域に取り組むチームで、ProductWide Features チームと呼ばれています。 この記事では当社初の入社エントリとして、私のこれまでの経歴からこの3ヶ月間行ってきた業務を紹介しつつ、ProductWide Features チームが何を担い日々どんなことをやっているのか、今後の展望なども含めて紹介さ…

はじめに こんにちは、同志社大学理工学部情報システムデザイン学科4年生の金谷一輝です。 2026年7 ...

Yesterday the Next.js team announced the release of , with leaner prefetching, immutable static assets, and instant navigations. As part of this release, we worked with the Next.js team to fully support 16.3 on Vercel, including better performance and additional observability. Applications that have upgraded have seen:Next.js 16.3Next.js 16.3 ships leaner prefetching and enables immutable static assets by default. Supporting both meant changing the platform too, in how it caches static assets, r

You can now bundle multiple agent skills into a shareable pack on .skills.shHand anyone a curated set via a single URL, or share it with your GitHub organization to standardize the skills your team's agents use across any project.Create a pack from community skills on , or your own from local folders, zips, or GitHub repositories. Install any pack with one command:skills.shRun to update a pack to its latest version.npx skills updateExplore and create packs at .skills.sh/packsRead more

Deploys are now up to 33% faster for apps using (ISR). The more prerendered pages you have, the more you're likely to save.Incremental Static RegenerationISR combines the speed of static generation with the flexibility of dynamic rendering, letting sites update content without full rebuilds. Every ISR page has routing metadata that ships alongside it. Previously, when that metadata grew too large, it split into a separate upload, adding work to every deploy. Now it always ships in a single uploa

Your eve agent can now navigate the web like a human with .agent-browserThe extension gives any agent a full set of browser tools: navigate pages, read content, click, fill forms, take screenshots, and inspect console and network activity. Everything runs inside the agent's sandbox.@agent-browser/eveeveInstall the extension:Then mount it under :agent/extensions/Your agent gets namespaced tools like , , , , and . Snapshot refs such as become selectors, so the agent can inspect a page, then act on

はじめにLINE Developersから利用できるLIFF（LINE Front-end Framework）を活用すれば、LINEアプリのユーザーを対象に、独自のサービススペースを開設できます。L...

こんにちは！PR TIMES 開発本部のエンジニア、トゥ（codyzard）です。 今回は、AWS 上で動くバッチから利用している複数の Google API の認証を、Service Account キーから WIF（ […]

<blockquote cite="https://yegge.ai/essays/the-shape-of-things-to-come/"><p><a href="https://yegge.ai/gastown.html">Gas Town</a> was intended to be reusable, but I only ever wound up using it to build itself. Gas Town fell apart at the seams with Opus 4.7. Up through 4.6 it was working brilliantly. With 4.7 we saw the introduction of the "just two more things" tic, which prevented Opus from ever converging on being ready to do real work—it always wanted to fiddle with Gas...

We designed and shipped a fresh AppSignal homepage in code, then validated it in an A/B test with a 14% lift in activated users.

is 90% off on AI Gateway when you route to Novita. The discount is available to Vercel Pro customers through August 11.DeepSeek v4 FlashTo get the discounted rate, set the to or and put Novita first with the option:modeldeepseek/deepseek-v4-flashdeepseek/deepseek-v4-flash-0731orderIf Novita can't serve the request, it falls back to other providers at the standard rate. After August 11, the model stays available at standard rates with no markup. in the AI Gateway section of your dashboard, or try

<p><strong><a href="https://gruhn.me/blog/2026-08-03/">Don't be a meat proxy</a></strong></p>Niklas Gruhn coins an excellent new term - <strong>meat proxy</strong> - for people who blindly copy and paste the output of AI systems to their peers.</p><blockquote><p>By all means, prompt AI. But don't just relay the output. Read it, understand it, validate it, and then write a response in your own words (a decent certificate ...

Vercel WAF for Blob is now generally available and supported for production use on all plans. If you protected a store , nothing has changed: your rules and setup carry over exactly as they are.during the beta protects a Blob store with , the same kind you use to guard your deployments. Rules that match on properties like IP address, country, and path can deny, challenge, or rate limit requests to your stored objects. This requires no changes to your code, your blob URLs, or how you use .Vercel

<blockquote cite="https://blog.exe.dev/devtools-must-be-open-source"><p><code>Set up a nightly cron job that executes the prompt: fetch upstream changes to the <software> and rebase all local changes on top of upstream. Check that the software works as intended and replace the current version.</code></p></blockquote><p class="cite">— <a href="https://blog.exe.dev/devtools-must-be-open-source">David Crawshaw's promp...

Today, with CSS gap decorations fully supported in Chrome and Edge, starting with version 149, you can now very easily style gaps, and with a lot of control.Gap Decorations Are Now Available, Here’s What’s New originally handwritten and published with love on CSS-Tricks. You should really get the newsletter as well.

<p><a href="https://news.ycombinator.com/item?id=49156111#49156719">My comment</a> on <a href="https://news.ycombinator.com/item?id=49156111">Devtools must be open source (exe.dev)</a> — Hacker News.</p><p>One of the arguments for open source software for end-users has always been the freedom to examine and modify how that software works.</p><p>The reality for most people - even expert programmers - has been that the freedom is mor...

You normally don't think of images as overflowing themselves, nor can you put anything else inside to make it overflow, but actually...

Agents need more than just a container to scale. We're introducing @cloudflare/computer, an agent runtime that dynamically orchestrates between fast, efficient isolates and full Linux containers to give every agent a computer of its own.

Cloudflare Workers now support inbound TCP connections via Spectrum, allowing direct socket forwarding to Durable Objects and Containers. Developers can run full-duplex gRPC applications or leverage automatic gRPC-to-gRPC-web translation directly within Workers.

Cloudflare has launched a new Billable Usage API for accounts, giving developers and FinOps teams single-endpoint programmatic visibility into cost and usage across all self-serve products. Built around the FOCUS specification, track spend seamlessly alongside the rest of your cloud stack.

Serving frontier models like Kimi and GLM means fighting for GPU memory. Here's how we quantize KV caches, compress model weights, and add integrity checks to serve them faster, cheaper, and safely.

One coding agent can write a Python Worker and another can write a JavaScript Worker. At runtime, those Workers can exchange references to live objects and call their methods without defining APIs, schemas, or serialization code

First-hand lessons from integrating CKEditor 5 into Rails, Phoenix LiveView, Livewire, and Blazor. Why MPA architectures are winning for enterprise teams.

An AI agent published a malicious package to PyPI and 15 systems ran it within an hour. What Anthropic's incident means for supply chain security.

本記事は、Aurora MySQLの安全なバックアップ設計についてまとめている記事になります なにか ...

Factory on VercelNon-technical teams were bottlenecked on engineeringDroids hit Vercel's APIs to build and deploy autonomouslyGoing self-serve exposed Factory's backend to a new category of threatObservability and WAF handle protection at the network levelOne billion backend API requests served daily 350ms p95 response timeScaled backend, internal tooling, and security without a dedicated infrastructure teamAPI routes handle the customer-facing API, which launched in its own section of their Nex

こんにちは！2026年新卒エンジニアの小尾（@obizip）と森澤（@ggg_glasspo）です。 2026年7月20日に開催されたPHP Conference Japan 2026に、PR TIMESはゴールドスポン […]

Check out the following CSS animations (touch to play):these are CSS-based graphics and animations, you probably need to visit the website to see If you wanted to implement complex procedural animations (like physics) on the web, you’d probably go for JS-based requestAnimationFrame update-loop and animate each frame. But everyone knows that CSS animations are much smoother than janky frame-based JS animations.Native web animations run outside the main thread, so things like heavy JS computations

pnpm 11.20 fixes a package-substitution risk in projects that install from more than one registry alias, stops empty proxy settings from failing installs, hardens pnpm rebuild against a malicious lockfile, and speeds up dependency resolution.

Learn how to detect hidden network performance problems before they impact your users. This guide explains Microsoft's new Network Efficiency Guardrails, how they use Document Policy and the Reporting API to detect inefficient resource loading, how to enable them in Microsoft Edge, and how to configure them in a Nuxt 4 application.

now lets you share a repository with other Vercel teams to grant read access to its images.Vercel Container RegistrySharing is read-only and covers the whole repository. Recipients can pull and use every image, but cannot push, delete, or re-share. You can also share a repository with your own team. Each repository can be shared with up to 100 teams. Share from the project dashboard under Images → repository → Settings → Repository Sharing, or with the Vercel CLI:# Share a repository with a team

<p><strong>Release:</strong> <a href="https://github.com/simonw/condense-json/releases/tag/1.0">condense-json 1.0</a></p> <p>I'm trying to get braver at releasing 1.0 versions. This little library is a year and a half old now - I've applied some sensible and non-disruptive fixes and shipped the big 1.0 for it.</p><p>Here's an example of what it can do, lifted from the README:</p><div class="highlight highlight-source-json"><pr...

Agents Week explores how cloud infrastructure must evolve to serve autonomous agents rather than human browsers. Join us as we unpack the storage, execution, and security primitives needed for an agent-native web.

記事は ics.media へアクセスしてご覧ください。

<h4>Open letters about AI development</h4><p><em>I wrote this summary of the past few weeks of open letters as a section of <a href="https://simonwillison.net/2026/Aug/2/july-newsletter/">my sponsors-only newsletter</a> but I've decided to share it here as well.</em></p><p><strong><a href="https://www.microsoft.com/en-us/corporate-responsibility/topics/open-weight/">Open Weights and American AI Leadership</a></strong>...

<p>The June edition of my <a href="https://github.com/sponsors/simonw/">sponsors-only monthly newsletter</a> is out. If you are a sponsor (or if you start a sponsorship now) you can <a href="https://github.com/simonw-private/monthly/blob/main/2026-07-july.md">access it here</a>.</p><p>This month:</p><ul><li>Accidental cyberattacks by OpenAl and Anthropic models under test</li><li>GPT-5.6 Sol, Terra, and Luna</li><l...

OpenTelemetry を使用すると、アプリケーションのログをベンダーに依存しない形式で収集し、トレースと関連付けることができます。この記事では Node.js で動作する Hono バックエンドの構造化ログを Pino で出力し、OpenTelemetry Collector を通じて Loki と Tempo に送信する方法を紹介します。

is now available on AI Gateway.Qwen 3.8 MaxQwen 3.8 Max handles text-only and vision-language work in one model, with 2.4 trillion parameters and a context window of up to 1 million tokens. The model is suited for software engineering and office productivity, along with visual work like turning screenshots or design files into working pages, captioning video, and answering questions grounded in an image.To use Qwen 3.8 Max, set to .modelalibaba/qwen3.8-maxTry Qwen 3.8 Max in the .model playgroun

<blockquote cite="https://twitter.com/gdb/status/2083435180392673714"><p>at openai, many people hook their chatgpt up to slack.</p><p>people really don't like when a coworker's chatgpt contacts them asking for help with a task, even when they'd be perfectly happy doing that same work if asked by that coworker.</p><p>reinforces how much people care about human relationships and helping each other, and want AI to give time back — or enhance time together — rath...

<p><strong>Release:</strong> <a href="https://github.com/datasette/datasette-apps/releases/tag/0.2a0">datasette-apps 0.2a0</a></p> <blockquote><p>Changes that improve Datasette Apps when created and edited using <a href="https://agent.datasette.io/">Datasette Agent</a>:</p><ul><li>New <code>app_debug()</code> tool allowing agent to open an app (invisibly) and test it using JavaScript. <a href="https://g...

<p><strong><a href="https://openai.com/index/ten-advances-in-mathematics/">Ten advances in mathematics and theoretical computer science</a></strong></p>A few days ago it was Anthropic <a href="https://simonwillison.net/2026/Jul/28/discovering-cryptographic-weaknesses-with-claude/">discovering cryptographic weaknesses with Claude</a> using Mythos Preview, spending $100,000 on tokens and with prompts that included "again we are not looking for low h...

Flue 2.0 では従来の静的なエージェントの定義方法から、Agent Hooks と呼ばれる hook ベースのエージェントフレームワークへと進化しました。Agent Hooks では React の hooks と同様の API を用いて、エージェントの状態やライフサイクルを管理することができます。このブログ記事では Agent Hooks を使用してエージェントを構築する方法を紹介します。

The biggest news this month is the first @next releases of SvelteKit 3. Thirteen preview versions shipped in July: previewing new $app/manifest and $app/service-worker modules, improved API availability and type checking in service workers, tracing out of the experimental namespace, shallow routing baked into goto and a lot more. It's a prerelease, but it's worth trying out to see what's coming to SvelteKit!Alongside the preview releases, the stable line kept moving with submitted on remote form

<p><strong><a href="https://huggingface.co/deepseek-ai/DeepSeek-V4-Flash-0731">deepseek-ai/DeepSeek-V4-Flash-0731</a></strong></p>The latest release in DeepSeek's V4 family, "with substantially enhanced agentic capabilities". It's 304 billion parameters - 167GB on Hugging Face - but it appears to punch <em>well</em> above its weight.</p><p>Artificial Analysis <a href="https://artificialanalysis.ai/models/deepseek-v4-flash">rank i...

<p>Tuesday was <a href="https://x.com/ade_oshineye/status/2082129440943866149">Stateless MCP day</a> - the rollout of MCP 2.0, or <a href="https://blog.modelcontextprotocol.io/posts/2026-07-28/">the 2026-07-28 Model Context Protocol specification</a> to use the more formal but less memorable name. This is the most significant change to the MCP spec since it first launched, and has also served to reignite my personal interest in the protocol.</p><p>For b...

<p><strong>Release:</strong> <a href="https://github.com/simonw/llm-mcp-client/releases/tag/0.1a0">llm-mcp-client 0.1a0</a></p> <p>See <a href="https://simonwillison.net/2026/Jul/31/stateless-mcp/#llm-mcp-client">this blog entry</a>.</p> <p>Tags: <a href="https://simonwillison.net/tags/llm">llm</a>, <a href="https://simonwillison.net/tags/model-context-protocol">model-context-protocol</a></p>

English version: A Quine in Piet 難解プログラミング言語 Piet で Quine を作りました。 Piet は画像をプログラムとみなす難解言語（esolang）です。画像の中のピクセルを上下左右にカーソルが駆け回り、その際の明度や色相の変化を命令とみなして実行します。詳しくは公式サイトを見てください。 なので、この GIF ファイルがプログラムです。実行すると、この GIF ファイル自身を出力します。 動画 実行の様子を可視化した動画です。いまどのセルを実行しているか、出力がどこまで進んだかが見えます。 実行方法 npiet に画像を食わせてください。 $ n…

A misconfiguration gave three Anthropic models internet access, and one, believing it was in a simulation, shipped a credential-stealing package to PyPI.

<p><strong><a href="https://oxide-and-friends.transistor.fm/episodes/the-open-weight-revolution-with-simon-willison">Oxide and Friends: The Open Weight Revolution with Simon Willison</a></strong></p>On Monday Bryan Cantrill and Adam Leventhal invited me to join their podcast to talk about the <em>wild</em> week we've had - with Kimi K3 showing open weight models can stand toe-to-toe with proprietary frontier ones, <a href="https://simonwillison...

<p><strong><a href="https://primeradiant.com/blog/2026/smevals.html">smevals - a small eval suite for evaluating models, prompts, and harnesses</a></strong></p>I've been working with Jesse Vincent's <a href="https://primeradiant.com">Prime Radiant</a> applied AI research lab building out this evals framework to help answer questions about the capabilities of different models.</p><p>The result is <strong><a href="https://github...

The sizes attribute for <img> was maybe the hardest part. It had complicated syntax that always had to be in sync with whatever your CSS was doing. But sizes="auto" support is almost ready for prime time. Jason Grigsby says we can go a step further an remove srcset too, which is nearly just as complex, […]

<p><strong>Tool:</strong> <a href="https://tools.simonwillison.net/slack-emoji-maker">Slack Emoji Maker</a></p> <p>I wanted to create a new Slack emoji, and their tool recommends a square that's 128x128 and has a transparent background... so I <a href="https://github.com/simonw/tools/pull/305">had Fable build me</a> this simple image editor against those requirements.</p> <p>Tags: <a href="https://simonwillison.net/tags/tools"...

Comparing the best enterprise SAST tools on noise reduction, AI remediation, governance, compliance, and costCategory: DevSec Tools & Comparisons

AI Gateway spend budgets can now be scoped to a team or a project, in addition to individual API keys. Set a dollar limit on a scope, and the gateway meters spend against it and stops further requests once the limit is reached, until the budget resets or you raise it.A budget attaches to one of three scopes. A request can fall under multiple budgets and has to pass all of them: if any one is over its limit, the request is rejected, even when the others have room left.BYOK spend is not counted ag

Anthropic disclosed an agent that pushed real malware to PyPI. We think we found the package, and every mistake in it points back to the AI.Category: Vulnerabilities & Threats

How a branch-free loop and byte-space arithmetic let GitHub case-fold every byte of code search at >45 GiB/s on a single core.The post Don’t stop early: Case-folding source code at memory speed appeared first on The GitHub Blog.

We recently got the shape() function and corner-shape property. What else could we possibly need as far as making shapes in CSS? Let me tell you: the border-shape property!Get Ready For the Powerful CSS border-shape Property! originally handwritten and published with love on CSS-Tricks. You should really get the newsletter as well.

Compare Astra Security alternatives for AI pentesting in 2026 on depth, white-box testing, compliance output, and platform breadthCategory: DevSec Tools & Comparisons

<p><strong>Release:</strong> <a href="https://github.com/datasette/datasette-agent/releases/tag/0.4a0">datasette-agent 0.4a0</a></p> <blockquote><ul><li>New <code>await context.browser_task()</code> mechanism allowing agent tools to run code directly in the user's browser. <a href="https://github.com/datasette/datasette-agent/pull/33">#33</a></li></ul></blockquote><p>This is an exciting new cap...

The soon-Baseline sibling-index() function for animations, CSS and the 2026 FIFA World Cup, use cases for the infinity keyword, container "stuck" queries, and more.What’s !important #16: sibling-index() Animations, Use Cases for the infinity Keyword, Container Stuck Queries, and More originally handwritten and published with love on CSS-Tricks. You should really get the newsletter as well.

Last year we made every Cloudflare server a Media over QUIC (MoQ) relay. Now the new provisioning API lets you create your own isolated relay and control who can publish and who can only watch.

CodePen 2.0 is hereHats off to the CodePen team for getting their huge 2.0 release over the line. The possibilities really are endless and that's a great achievement for a team of 5!95 reasons for having your own websiteDoes exactly what it says on the tin.Cheatsheets for flex, grid, anchor positioning and invoker commandsThese cheatsheets are excellent work from the purveyors of excellent work, over at Polypane.Welcome to the resistance: meet the workers dodging (and sabotaging) their employer'

Whether you’re enjoying some well-earned time off this August or are jumping headfirst into a new project, how about some new desktop wallpapers to accompany you on all those big and small adventures the month might bring? Well, we’ve got you covered!

Socket has joined the new Composer and Packagist sponsorship program as a launch sponsor, supporting the team that keeps PHP's package ecosystem secure.

Our open-source benchmark for how well AI coding agents build with Supabase.

now runs on updated weights by default on AI Gateway, with notably stronger agentic capabilities. On Terminal-Bench, it scores 82.7, up 25.8 points from 56.9 in the April preview.DeepSeek V4 FlashRequests to pick up the new weights automatically, with no change to the model ID or your code.deepseek/deepseek-v4-flashFor now, DeepSeek is the only provider serving the updated weights. Other providers, including ones with Zero Data Retention, are coming next week.To use the updated DeepSeek V4 Flash

July! What a month!Things I did this JulyGave a talk, for ClimateAction.tech’s “Responsible AI Series”, “What I know about local language models”. “Responsible AI” can feel like a bit of an oxymoron at times, but I hope I shared something useful.Participated in the Zelda Dungeon Marathon. My first time playing a video game (The Legend of Zelda: Oracle of Seasons) on stream!Released a new version of Helmet, my Node security headers package. Most notably, it sped up the Content-Security-Policy cod

はじめまして。2026年1月に、カナダの公立カレッジから同じ都市にあるSFU（Simon Fraser University）という4年制大学に編入し、Computer Scienceを専攻しているMioです。編入後、最初の学期を終えたタイミングで一度日本に戻り、6月から7月末までの2か月間、プレイドのDeveloper Experience（DX）チームでインターンをさせていただきました。これまでインターンをした経験はなく、今回初めて組織に所属してエンジニアリングに取り組みました。

July 2026 - CodeTV GSAP Webflow contest, Astro Germany, and more!

pnpm 11.15 through 11.19 teach pnpm update and pnpm outdated to update GitHub Actions, let pnpm update write changesets for the bumps it makes, introduce cleaner update and audit settings sections, add publishConfig.name for publishing a package under a different name, harden pnpm self-update against project-supplied configuration, make web-based login work without a TTY, and accept = as a save-prefix. They also cut peak resolution memory by several times on large workspaces and speed up repeat

Servo 0.4.0 contains all of the changes we landed in June, which came out to yet another record 558 commits (April: 534, May: 391).For security fixes, see § Security.We’ve shipped several new web platform features:‘attr()’, in experimental mode (@Loirooriol, #45041)‘image(<color>)’, ‘closest-corner’, and ‘farthest-corner’ in ‘ellipse()’ and ‘circle()’ (@Loirooriol, #45421)‘calc()’ and other mathematical expressions can now be resolved later than parse time, e.g. sign(1em - 32px) (@Loiroori...

Chat SDK's now supports reactions and ephemeral messages through the same API as other adapters.Microsoft Teams adapterBots can add and remove reactions on Teams messages, and call or to send native, targeted messages that only the intended user sees, like permission prompts.thread.postEphemeral()channel.postEphemeral()This release also adds:Read the to get started, or learn more about and .Teams adapter documentationephemeral messagesreactionsSpecial thanks to for their contributions to this re

AI Gateway now has a dedicated listing every request your team sends through the gateway, newest first, with cost, token counts, duration, and the model, provider, and region that served it. Open any request to see how it was routed. It's available at the team scope and per project.Logs pageFilter by provider, model, modality, credentials, or status, or search by model, provider, or request ID to jump straight to one request. Every filter is stored in the URL, so you can share a filtered view by

now supports the 2026-07-28 MCP specification, giving newer clients a stateless request model and updated authorization behavior without any change on the client side.Vercel MCPClients built for the 2025 protocol keep working exactly as before, and clients that understand the new specification pick it up automatically.Both protocol versions are served from the same endpoint through the official MCP SDK v2 and 2.x, which , so a single connection handles either protocol.mcp-handleradded support fo

The runs list for in Observability now has structured search, giving you more ways to find and investigate runs.Vercel WorkflowsFor example, pulls up preview runs of one workflow in one region, since the list otherwise shows production runs.workflow:sendEmail environment:preview region:iad1Search your runs from the Workflows tab in .Vercel ObservabilityRead more Filter runs by workflow, environment, deployment ID, , or any custom run attribute. Paste a run ID to pull up that exact run.Structured

from Poolside now has 10x more capacity on AI Gateway. The increase applies to the paid version, , and the free version, , so you can send far more requests, good for high-volume agentic coding and long-running tasks.Laguna S 2.1poolside/laguna-s-2.1poolside/laguna-s-2.1-freeTo use Laguna S 2.1, set to or in the : modelpoolside/laguna-s-2.1-freepoolside/laguna-s-2.1AI SDKTo run it in a coding agent, use to connect your agents to AI Gateway, then select or in the agent's model configuration. See

is now generally available.Vercel PassportPassport allows you to protect your Vercel deployments with your own identity provider. Visitors authenticate through Okta, Microsoft Entra ID, or any OIDC provider before viewing a protected deployment, and Vercel forwards a signed identity token to the deployment so application code can build on who the visitor is.The helper in reads the Vercel request context and returns the authenticated visitor. Vercel strips client-supplied values for the header an

AI Gateway has a unified fast mode abstraction, now in beta.You can now request the same way for every model on AI Gateway. Set speed to , and the gateway serves the fast tier when it's available and falls back to standard speed when it isn't.fast modefastFast mode trades a higher per-token cost for lower latency or higher throughput. You get it wherever it is available, without pinning a provider or wiring anything up yourself.Set to under to upgrade the model to its fast serving path when one

<p><strong><a href="https://openai.com/index/advancing-the-price-performance-frontier-with-gpt-5-6/">Advancing the price-performance frontier with GPT‑5.6</a></strong></p>Huge price drop from OpenAI today: GPT-5.6 Terra got a 20% reduction, and GPT-5.6 Luna got a massive 80% drop.</p><p>OpenAI credit 5.6 Sol with enabling this: in <a href="https://openai.com/index/gpt-5-6-frontier-intelligence-efficiency/">How GPT‑5.6 fuses frontier intellig...

<p><strong><a href="https://www.anthropic.com/news/investigating-incidents-cybersecurity-evals">Investigating three real-world incidents in our cybersecurity evaluations</a></strong></p>It happened again! This is turning into something of a pattern.</p><p>Last week <a href="https://simonwillison.net/2026/Jul/22/openai-cyberattack/">OpenAI accidentally exploited Hugging Face</a> when one of their frontier models broke out of a sandboxed...

<p><strong>Release:</strong> <a href="https://github.com/simonw/llm/releases/tag/0.32rc2">llm 0.32rc2</a></p> <p>Hot on the heels of <a href="https://simonwillison.net/2026/Jul/30/llm-rc1/">RC1</a>, this fixes a dependency issue and also adds two neat new features:</p><blockquote><ul><li>The default model for users who have not set their own default is now <a href="https://developers.openai.com/api/docs/models/gpt-...

Dev Machine Guard now inventories AI agent skills across your developer fleet. See every skill installed for Claude Code, Codex, GitHub Copilot, and other agents, flag skills with executable code, hooks, or shell commands, trace provenance, and detect version drift.

Malicious beta versions of the Joyfill npm packages @joyfill/components and @joyfill/layouts hide an obfuscated remote access trojan and credential stealer. Full analysis, IOCs, and remediation from StepSecurity.

<blockquote cite="https://www.schneier.com/blog/archives/2026/07/should-you-use-ai-for-a-task-heres-a-simple-way-to-decide.html"><p>The writing assignments I give my students are gym tasks, not work tasks. I ask them to write policy memos not because the world needs more policy memos. I assign them because the very act of writing, which includes thinking and outlining and drafting and editing, making and criticizing and revising arguments, will help develop the critical thinking ski...

Learn how I modernized an old codebase of mine using stacked sessions and pull requests in the GitHub Copilot app.The post Stacked sessions and pull requests in the GitHub Copilot app appeared first on The GitHub Blog.

<p><strong>Release:</strong> <a href="https://github.com/simonw/llm-chat-completions-server/releases/tag/0.1a0">llm-chat-completions-server 0.1a0</a></p> <p>A key goal of the new content-addressable logs <a href="https://simonwillison.net/2026/Jul/30/llm-rc1/">in LLM 0.32rc1</a> was being able to support OpenAI Chat Completion style requests where each incoming message extends the previous conversation, like this:</p><pre><cod...

<p><strong>Release:</strong> <a href="https://github.com/simonw/llm/releases/tag/0.32rc1">llm 0.32rc1</a></p> <p>This RC for LLM 0.32 finishes the work that <a href="https://simonwillison.net/2026/Apr/29/llm/">started in LLM 0.32a0</a> - it adds a <a href="https://llm.datasette.io/en/latest/logging.html#the-message-store">new schema design</a> that does a much better job of capturing the details of the prompts and responses retur...

Chrome 146 introduced a scoped custom element registry, allowing different versions of custom elements to share the same tag name without using the global namespace.

We moved cdnjs, serving 9 billion requests a day, entirely onto Cloudflare's Developer Platform. That means we’re running one of the Internet's busiest open-source CDNs on our own building blocks, and we pushed Workflows and Workers limits higher for everyone.

On August 10, 2026, Vercel's CDN will stop stripping the response header and begin passing it through to the client.Server-TimingUse to report backend metrics like database query time and cache hits. These values appear in the browser's network panel and as entries through the Performance API.Server-TimingPerformanceServerTimingIf you want to keep the current behavior, where the header is stripped from every response, you can add a in :transformvercel.jsonLearn more about the .Performance API an

We're getting close to the last part of iteration one — the skeletal build of the site. Good! I'm getting eager to get on with the design work now. For some reason, doing this series (along with being busy in general) has stifled my ability to think creatively about my site. I guess I need to get all the non-technical stuff published to let my brain fully switch. Brains are weird, man.Anyway, we've got one more bit of content plumbing to do and in my eyes, this is the most important part of the

Add custom items to the CKEditor menu bar three ways: extendMenuBar, addItems, or full definition. All with a working plugin example.

Shopify and Vercel Open source and runtime agnostic, runs anywhere JavaScript doesSkills let agents extend any storefront with a single command Feature development cut from months to a week for retailers like Paige powers commerce for millions of merchants worldwide, and Hydrogen is its framework for building headless storefronts. The Shopify team is partnering with Vercel to rebuild Hydrogen from the ground up. The new version is open source and runtime agnostic so developers can build with Nex

The SDK now supports multiple Linux users and groups, so you can run agents side by side in a single Sandbox.@vercel/sandboxEach agent runs as its own user with a private home directory. A group opens a shared workspace when they need to collaborate. This makes multi-agent systems easier to build.Call for each agent; its commands and file operations run as that user, and users can't read, write, or list each other's files. To set up a shared directory, call and add users to it.createUsercreateGr

こんにちは。東京科学大学 修士一年の一瀬達矢です。 AI事業本部 極TD事業部で202 ...

is now available on AI Gateway.MiniMax H3H3 generates 2K video from a text prompt, a starting image, a pair of first and last frames, or reference material.Alongside text-to-video and first-frame image-to-video, the model supports first-to-last keyframe transitions and multimodal reference-to-video, conditioning a generation on reference images, video, or audio in a single request. Reference and keyframe modes are mutually exclusive. Output is mp4 at 2K resolution, from 5 to 15 seconds, in aspec

from Thinking Machines is now available on AI Gateway.Inkling SmallInkling Small reaches performance comparable to the larger Inkling model at about a quarter of the size, using much less compute per task. It is a broad generalist with native reasoning over audio and images, and it holds up well on reasoning, agentic coding, and tool use. Controllable thinking effort lets you trade quality against cost and latency, from minimal to maximum reasoning.For visual tasks, it can crop, zoom, and inspec

You can now exchange OIDC tokens from CI/CD workflows, including , for short-lived access tokens.GitHub workflowsTurborepoThese tokens grant access to , and are a more secure alternative to long-lived Personal Access Tokens (PATs). OIDC tokens are short-lived, only grant access to Vercel Remote Cache, and are associated with your Vercel team, rather than a specific team member. Vercel's Remote CacheWe recommend all customers migrate their CI/CD workflows from PATs to OIDC. Get started by adding

On , and are now cheaper and is faster.AI GatewayGPT-5.6 LunaGPT-5.6 TerraGPT-5.6 SolAI Gateway adds no markup on token pricing, so these changes reach you at the upstream rate.The changes apply to both short and long context pricing.GPT-5.6 Sol keeps the same price; its fast mode now runs 2.5x faster, up from 1.5x. Model IDs are unchanged, so existing requests get the new rates and speed with no code change.See full pricing detail on .AI GatewayRead moreModelChangeInput: Short context (per 1M t

Over the past few months, we've made deployments up to 7 seconds faster end to end. We removed up to 5 seconds of fixed platform overhead from every build, and deploys from the latest Vercel CLI save up to 2 seconds more. The improvements are most noticeable on smaller builds, where orchestration represents a larger share of the total build time.The largest platform gains:These apply automatically to builds triggered through Git, the dashboard, or Vercel CLI. Deployments from the latest CLI fini

is now available with support for the and [email protected] Model Context Protocol specificationMCP TypeScript SDK v2We originally built to make it easier to spin up MCP servers on popular web frameworks including Next, Nuxt, Svelte, and more.mcp-handlerWith the new 2.0 release, the handler now supports:Existing stateless Streamable HTTP clients can continue connecting to the same endpoint while servers adopt the latest protocol./mcpInstall the new packages:Create a Next.js route hand

Enterprise customers can now apply a portion of their Flexible Commitment toward eligible resources purchased through the Vercel Marketplace.With Flex Commit support, eligible Marketplace cost can draw directly from your existing commitment making it easier to provision the infrastructure and services your applications need.We're rolling this out with an initial set of Marketplace partners, including , , and , with support for more providers coming.NeonSupabaseRedisEligible integrations are mark

You can now create that are limited to a project to authenticate and use the .Vercel Access TokensVercel APIA project-scoped token can only read and write resources belonging to a project that the token is scoped to. Requests to any other project, a user-level resource, or a team-level resource will be denied. This ensures jobs, tools, or workflows only ever access the projects they are scoped to.Navigate to the , found under the area of your Account.Account Tokens pageSettingsRead moreCreating

こんにちは。ABEMA の CloudPlatform チームに所属しているエンジニアの koda ...

Perhaps this theoretical button wasn't a button at all, but 50 links in a trenchcoat.

Safari Technology Preview Release 249 is now available for download for macOS Golden Gate and macOS Tahoe.

Recon, stolen credentials, hidden C2, and rebuild-or-patch. Four Hugging Face breach decisions that show whether you can catch an attack in progress.Category: News

<blockquote cite="https://www.youtube.com/watch?v=R57nUGzo7CA&t=848s"><p>Years ago, we didn’t have SQL. There were people whose job was to generate software that would query large data sets. Their job title was COBOL programmer.</p><p>Then SQL comes along—I’m simplifying this only a little bit—and it gives you this convenient way so people could just specify. With a very simple specification, you can generate all of that code that you had to pay the expensive COB...

<p><strong><a href="https://enklypesalt.com/posts/context-collapse-part3-ai-worming-through-word/">AI Worming through Word</a></strong></p>Neat new prompt injection variant by Håkon Måløy, who found a way to upgrade prompt injection attacks against Microsoft Word to full self-replicating worms:</p><blockquote><p>An attacker places hidden instructions in a document that is later used as source material in Copilot for Word. Copilot may interpr...

<blockquote cite="https://blog.cryptographyengineering.com/2026/07/29/some-notes-about-anthropics-new-results/"><p>Right now we’re in the midst of a historic transition from traditional public-key algorithms based on EC-based cryptography and RSA, moving over to new <em>post-quantum</em> algorithms based on novel problems. This is why there are so many standards like HAWK being considered. If there was ever a perfect time for a massive new public cryptanalysis capability...

Dependabot keeps your dependencies current, but its defaults can flood your repository with pull requests. Here's how grouping updates, slowing the cadence, and keeping security fixes fast cut the noise on a Microsoft open source project.The post Tame Dependabot: Group your updates, slow the cadence, keep security fast appeared first on The GitHub Blog.

Compare the top SAST tools of 2026 across detection depth, noise, remediation, and enterprise fit Category: DevSec Tools & Comparisons

Cloudflare now supports post-quantum (PQ) authentication when connecting to customer origin servers via Authenticated Origin Pulls and Custom Origin Trust Store. This is the first step towards providing PQ authentication for all Cloudflare products.

As AI reshapes product design, it could give designers greater autonomy or expose the gaps that autonomy makes harder to hide. Exploring both the bull and bear cases, Andy Budd examines what happens when designers need less permission to act.

Use your ChatGPT account to sign in to Supabase, and connect Supabase inside ChatGPT and Codex.

はじめに：なぜKafkaのエンドツーエンド暗号化なのか？LINEメッセンジャーでは、毎日数十億件のメッセージがやり取りされています。この膨大なデータはさまざまなシステムに送信されますが、その中には個人...

<p><strong>TIL:</strong> <a href="https://til.simonwillison.net/llms/mcp-in-claude-and-chatgpt">Adding a custom MCP server to Claude and ChatGPT</a></p> <p>Connecting a custom MCP server to Claude and ChatGPT's standard chat interfaces is possible, but can take quite a few steps.</p> <p>Tags: <a href="https://simonwillison.net/tags/ai">ai</a>, <a href="https://simonwillison.net/tags/generative-ai">generative-ai</a>, &...