こんにちは、井上です。LINEヤフーではこれまで、AI活用スキル向上ワークショップ「Orchestration Development Workshop（ODW）」を通じて、個人がAIを使いながら開発...

There is a famous document from the CSS Working Group that lists the historical mistakes in the design of CSS. It contains stuff like how box-sizing: border-box; should have been the default, which is why a lot of us still put that in starter stylesheets. Declan Chidlow took a step I’ve never seen anyone take […]

<blockquote cite="https://github.blog/changelog/2026-07-14-dependabot-version-updates-introduce-default-package-cooldown/"><p>Dependabot now waits until a new release has been available on its registry for at least three days before opening a version update pull request. This cooldown is now the default and requires no configuration.</p></blockquote><p class="cite">— <a href="https://github.blog/changelog/2026-07-14-dependabot-version-updates-introduce...

<p><strong><a href="https://github.com/simonw/pedalican">simonw/pedalican</a></strong></p>Clearly I wasn't paying attention when these were <a href="https://twitter.com/OpenAIDevs/status/2050301642717950166">first announced</a> back in May, but today I accidentally activated a "pet" in Codex Desktop - a little animated robot, reminiscent of <a href="https://en.wikipedia.org/wiki/Office_Assistant">Clippy</a> - and then learned you can c...

On July 14, 2026 at 07:10 UTC, three packages in the AsyncAPI generator monorepo (@asyncapi/[email protected], @asyncapi/[email protected], and @asyncapi/[email protected]) were published to npm carrying an obfuscated dropper that fires the moment the library is loaded, not on install. The packages were published through the project's own legitimate GitHub Actions release workflow and carry valid npm OIDC provenance attestations, because the attacker didn't steal an npm token: they

11 malicious NuGet tools pose as game cheats to deploy Windows payloads, track hosts, and use Google Sheets for telemetry and control.

<p><strong><a href="https://lobste.rs/s/ko1ji1/lobste_rs_is_now_running_on_sqlite">lobste.rs is now running on SQLite</a></strong></p>Community site <a href="https://lobste.rs">Lobsters</a> has been planning a migration away from MariaDB <a href="https://github.com/lobsters/lobsters/issues/539#issuecomment-4959857588">since August 2018</a> - originally targeting PostgreSQL, but last year they decided to <a href="https://github.com/l...

<blockquote cite="https://lucumr.pocoo.org/2026/7/13/the-tower-keeps-rising/"><p>The shared language of a software project is not English or Python but it is the common understanding of what its concepts mean, where the boundaries are, which invariants matter, who owns what, and why the system has the shape it does. This language is rarely written down in one place. It lives partly in documentation and code, but also in code review, conversations, arguments, and the experience of ha...

<p><strong>Release:</strong> <a href="https://github.com/simonw/datasette/releases/tag/1.0a37">datasette 1.0a37</a></p> <p>A minor release. Performance and <a href="https://docs.datasette.io/en/latest/authentication.html#authentication-permissions-explained">documentation</a> improvements to the permissions system, plus I reverted a cosmetic API change which caused almost every existing plugin test suite to break.</p> <p>Tags: &l...

When a failed DNSSEC key rollover took down the .AL TLD, we deployed a Negative Trust Anchor to restore resolution. This time, though, clients didn't have to take our word for it: 1.1.1.1 returned EDE 33, a new DNS error code that signals directly in the response that DNSSEC validation was bypassed.

We swapped actions/checkout for Blacksmith's cached checkout across our GitHub Actions. Mean checkout time dropped from 69s to 20s, reclaiming ~33 hours of runner time each weekday.

Five package versions, including specs at roughly 2 million weekly downloads, shipped an obfuscated dropper on 2026-07-14. Here is what we have confirmed so far.Category: Vulnerabilities & Threats

4 compromised asyncapi packages deliver miasma botnet loader on macOS, Linux and Windows.

こんにちは。LINEヤフー株式会社で認証・認可基盤「Athenz」の開発・運用を担当している金 廷祐（Kim, Jeongwoo）です。前回の記事「AI時代の認証課題を解決する次世代標準候補「ID-J...

<p><strong>TIL:</strong> <a href="https://til.simonwillison.net/github-actions/uvx-github-actions-cache">Using uvx in GitHub Actions in a cache-friendly way</a></p> <p>I finally found a cache-friendly recipe for using <code>uvx tool-name</code> in GitHub Actions workflows that I like.</p><p>The trick is setting a <code>UV_EXCLUDE_NEWER: "2026-07-12"</code> environment variable at the start of the workflow and then usi...

Inertia is Turbolinks with one twist: render JSON instead of HTML on the second visit. We rebuild the whole protocol on a real Rails app with a 50-line client and a 16-line server, then audit what the real gem adds on top.

now supports consistent reads on private storage. Pass to or for a read that reflects the latest write.Vercel BlobuseCache: falseget()presignUrl()A blob written to a fresh pathname has no existing cached entry, so reads reflect the latest write immediately. When you overwrite a blob at an existing pathname, readers might see the cached version for up to 60 seconds. When a read must reflect the latest write, like an agent's memory file, a session transcript, or a scheduled JSON report, pass . The

The is now available in VS Code and the GitHub Copilot CLI.Vercel PluginGitHub Copilot now has Vercel platform knowledge on demand, with skills for Next.js, AI SDK, Vercel Functions, and more. The Vercel plugin also helps Copilot stay up to date with the latest Vercel APIs and recommended patterns.To install it for Copilot Chat, search for in the Extensions panel in VS Code.@agentPlugins vercelTo install it for the GitHub Copilot CLI, run .npx plugins add vercel/vercel-pluginLearn more in the .V

Following the Node.js 20 end of life on April 30, 2026, we are deprecating Node.js 20 for Builds and Functions on October 1, 2026.How can I see which of my projects are affected?You can see which of your projects are affected by this deprecation with:Will my existing deployments be affected?No, existing deployments with Serverless Functions Invocations to already-deployed functions will continue to work normally. Only new deployments will be affected.will not be affected.When will I no longer be

is now available on the . It runs your Playwright tests in parallel, so your suite finishes in the time of your slowest test.EndformVercel MarketplaceKey capabilities:Install Endform on the or with the Vercel CLI: .Vercel Marketplacevc i endformRead moreRun every test on its own isolated machine, so they don't interfereBring your existing Playwright tests with no config changesGet a pass/fail on every production and preview deployment, linked to full traces in the Endform dashboardcheckSpot flak

You can now provision and manage directly from the Vercel Marketplace. AgentMailYour AI agents can send, receive, and respond to email from a real inbox. AgentMail handles the mail servers and deliverability.Key capabilities:Install AgentMail on the or with the Vercel CLI: .Vercel Marketplacevc i agentmailRead moreProvision inboxes and custom domains through the APIHandle threads, attachments, and deliverability out of the boxTrigger agentic workflows using webhooks and WebSockets

Chat SDK now supports X, extending its single-codebase approach to Slack, Discord, GitHub, Teams, Telegram, and WhatsApp with the new .X adapterTeams can build bots that reply to public mentions and hold direct message conversations through the X API v2 and the . The adapter handles CRC verification and webhook signature checks automatically and can manage OAuth token refresh for long-running bots.X Activity APILikes are the only supported reaction, and responses post once on completion since X

We are making the data behind the open under the . You can now download or query the data through the API endpoint and render any chart as a shareable image.AI Gateway leaderboardsCC BY 4.0 licenseleaderboard-exportThe AI Gateway leaderboards show how AI is used in production, ranking traffic for models, labs, apps, and providers. Data is aggregated daily across trillions of tokens, so you can see what gets adopted and how that changes over time. For deeper analysis, see the .July AI Gateway Pro

<p><strong><a href="https://github.com/petergpt/doomql">DOOMQL</a></strong></p>Peter Gostev built this using GPT-5.6 Sol. This is a <em>lot</em> of fun: </p><blockquote><p>DOOMQL started with a deliberately unreasonable question: what if SQLite were the game engine, not merely the place where a game stores data?</p><p>The result is a small, original Doom-like game in which SQL owns movement, collision, enemies, combat...

Aikido Intel is a real-time feed that catches malware and undisclosed vulnerabilities across open-source ecosystems, often within 8 minutes of release.Category: Product & Company Updates

<p><strong><a href="https://github.com/simonw/datasette/graphs/code-frequency">datasette code-frequency chart on GitHub</a></strong></p>Out of curiosity I decided to see if I could find a useful illustration of the impact of coding agents and Opus 4.5 class models on my own output. The best I've found so far is this GitHub chart of frequency of code changes to my <a href="https://datasette.io/">Datasette</a> open source project:</p><p>...

Temani mimics a View Transition by placing items using their index and translations. The placement calculation change when the index changes, which is an animation opportunity!

A dependency firewall blocks malicious open-source packages before they install. Learn how they work and how Aikido Safe Chain stops supply chain attacks. Category: Guides & Best Practices

Precursor, our new continuous behavioral validation engine for bot management, offers visibility into how humans and bots actually interact across the full user journey. By turning session-level behavior into bot detection signals, it identifies advanced automation with higher precision — while reducing friction for legitimate users.

StepSecurity now blocks and detects secret exfiltration in GitHub Actions, stopping attacks that plant malicious workflows to steal your repository secrets.

AI Gateway Production Index — July 2026 Every month, routes tens of trillions of tokens between production applications and AI labs, giving us a view of what AI usage actually looks like in today’s enterprise. We publish that view here. See the Production Index reports published in and .AI GatewayMayJuneThe July index reports on AI Gateway data collected in June 2026. In June, token volume and spend grew at nearly the same rate, 29% and 27%, while the price per token remained steady. The month b

LINE アプリ開発に携わっている Hiraki と申します。普段は、LINE アプリにおけるアーキテクチャの統一を推進するプロジェクトのリードや、AI ネイティブな開発スタイルを業務に組み込むための...

Vibe coding ships features fast and leaves review debt behind. See how benchmarked, per-rule code quality checks give teams one consistent answer across PRs and repos.Category: News

You can now inspect subagent activity for eve projects in . Agent RunsThe new Subagents tab shows every subagent, organized by which turn started it. Each row shows the prompt, duration, and any failures, all on a shared timeline.Click any subagent to open its run. The tab shows the same details as a parent run: turns, tool calls, metadata, cost, and token usage.Open to try it, or read the to learn more.Agent RunsdocumentationRead more

You can now manage targeting rules for through the . With the command, you and your agents can add new rules, move existing ones, and inspect the current ordering without leaving your terminal.Vercel FlagsVercel CLIvercel flags rulesRules you create from the CLI use the same model as the dashboard. Conditions can target or reusable , outcomes can serve a single variant, a weighted split, or a progressive rollout, and rules evaluate top to bottom. For scripts and agents, prints the full rule set.

Deployment Policies are now available and enable teams to restrict which mechanisms, organizations, and repositories are allowed to create deployments.Each policy can be configured per environment at the team and project level, allowing flexible combinations of rules.Learn more about .Deployment PoliciesRead more

and are now almost 10% more cost-efficient for all Pro and Enterprise teams.Web AnalyticsSpeed InsightsInfrastructure and event-processing improvements reduced cost across both products, so page views, referrers, top routes, and Core Web Vitals are now processed more efficiently, and savings scale with your event volume.The change applies automatically, with no configuration, plan changes, or code to update. You'll see the change reflected on your next bill.Learn more in the and documentation.We

<p><strong><a href="https://handbook.gitlab.com/handbook/people-group/directly-responsible-individuals/">Directly Responsible Individuals (DRI)</a></strong></p>I went looking for a definition of "Directly Responsible Individuals" and the best I found was in the GitLab handbook. Apparently the term originated at Apple, where it's used to describe the person who is "ultimately accountable for the success or failure of a specific project, initiative, or activity...

<p><strong>Release:</strong> <a href="https://github.com/simonw/shot-scraper/releases/tag/1.11">shot-scraper 1.11</a></p> <p>Some minor improvements, mainly around command option consistency and making the <code>server:</code> mechanism <a href="https://shot-scraper.datasette.io/en/stable/multi.html#running-a-server-for-the-duration-of-the-session">used by</a> both <code>shot-scraper video</code> and <code>shot-...

<p>One of the consequences of GPT-5.6 Sol being clearly a Fable/Mythos class model is that Anthropic have, once again, <a href="https://x.com/claudeai/status/2076351399999557669">bumped the date</a> that Fable stops being available in their Claude Max plans:</p><blockquote><p>We're extending Claude Fable 5 access on all paid plans, as well as keeping Claude Code’s weekly rate limits 50% higher, through July 19.</p><p>As before, you can use up to h...

<p><strong>Release:</strong> <a href="https://github.com/simonw/sqlite-utils/releases/tag/4.1.1">sqlite-utils 4.1.1</a></p> <p>Mainly a fix for an edge case that regular Claude chat spotted while <a href="https://claude.ai/share/564b187d-d126-47ea-9b59-07c16ade0b70">experimenting with the 4.1 release</a> to answer a question about ON DELETE.</p><blockquote><ul><li><code>table.transform()</code> now raises ...

On July 11, 2026, version 8.14.0 of jscrambler was published to npm carrying a malicious preinstall hook that drops and executes a platform-specific native binary on Linux, Windows, and macOS. jscrambler is the official CLI client for the Jscrambler Code Integrity API, a commercial JavaScript obfuscation and web-app protection service, with a clean version history dating back to 0.1.0. The compromised release was flagged by StepSecurity's AI Release Analyzer with a suspicion score of 0 (the maxi

<p><strong>Release:</strong> <a href="https://github.com/simonw/sqlite-utils/releases/tag/4.1">sqlite-utils 4.1</a></p> <p>The first dot-release since <a href="https://simonwillison.net/2026/Jul/7/sqlite-utils-4/">4.0 a few days ago</a>, introducing a number of minor new features.</p><blockquote><ul><li><code>sqlite-utils insert</code> and <code>sqlite-utils upsert</code> now accept a <code&...

A compromised jscrambler npm release added a malicious preinstall hook that runs hidden native binaries on Linux, macOS, and Windows.

Mat Marquis details the good-and-dangerous of a new method which we can just make a screenreader say something. There’s a brand new ariaNotify() method — defined by the Accessible Rich Internet Applications (WAI-ARIA) 1.3 Specification — that provides you with a means of programmatically triggering narration in a screen reader. It accepts a string as its first argument, and […]

Next.js 16.3 Preview では、Instant Navigations という新機能が導入されました。画面遷移で即時表示できない箇所を開発時に検出し、修正を促すための機能です。この記事では Instant Navigations を実際に試してみた様子を紹介します。

In short: I prefer strict tables in SQLite because they avoid some datatype problems, such as putting text in number columns.SQLite has a feature that I think is underrated: strict tables. Strict tables help enforce rigid typing, preventing mistakes like putting text into integer columns. I like them, and wrote this post to promote their use!To make a strict table, add STRICT to the end of its definition. Like this:-CREATE TABLE people (name TEXT);+CREATE TABLE people (name TEXT) STRICT;That’s i

Seedream 5.0 Pro is now available on .AI GatewaySeedream 5.0 Pro is an image generation and editing model. It generates images from text, rendering text without spelling errors and following typographic rules, and produces dense infographics with charts, timelines, and layouts alongside realistic imagery.To use Seedream 5.0 Pro, set to in the :modelbytedance/seedream-5.0-proAI SDKAI Gateway provides a unified API for calling models, tracking usage and cost, and configuring retries, failover, and

<blockquote cite="https://youtu.be/v4vkwUf4AMw?t=2427"><p>The reality is to make augmented reality glasses, you need to put a camera next to your eyes that is continuously recording everything you see and processing that to put information over it.</p><p>There is not another way around it. And there's certainly not a chip that can fit in the stem of a glasses that is both powerful enough and power miserly enough to do that in real time.</p><p>You have to send...

How migrating Copilot code review to shared Unix-style code exploration tools reduced review cost by reshaping agent workflows around pull request evidence.The post Better tools made Copilot code review worse. Here’s how we actually improved it. appeared first on The GitHub Blog.

now support Tree and Waterfall views. See span hierarchy, critical path, and timing without leaving the log entry.Traces in Vercel LogsThe Tree view groups spans by parent and child. On load, spans are sorted by duration so the slowest appear first.The Waterfall view places every span on one chronological axis, showing what ran in parallel and where time was lost.Read the to learn more.Tracing documentationRead more

Smart Tiered Cache allows for precise upper tier selection for origins hosted on AWS, GCP, Azure, and Oracle Cloud with customer-provided cloud region hints.

The strongest visual concepts don’t start in Figma. They start with the right questions. Explore the pre-concept phase of brand identity design, where teams research brand context, uncover hidden assumptions with stakeholders, and turn shared direction into a visual foundation before a single concept is created.

Code TV: The best landing page everWe very rarely share video content, but this episode was an absolute delight to watch. They're running a hackathon too which is well worth checking out.New Game+Mat has not given up and nor should you!Kyroh fontDan Cederholm has brought out yet another affordable, and very nice font.Time-based background colour transitions with Temporal and CSS color-mixThere's been so much dry content about Temporal so far but Sophie Koonin has written about a nice creative us

<blockquote cite="https://help.openai.com/en/articles/20001275-chatgpt-work-and-codex"><p>[...] Work on web and mobile runs in the cloud. Work in the desktop app can also use local files and desktop apps with your permission. At launch, cloud Work conversations do not appear in desktop Work; desktop Work threads and local files remain on that computer.</p></blockquote><p class="cite">— <a href="https://help.openai.com/en/articles/20001275-chatgpt-work-...

はじめに こんにちは！同志社大学大学院 修士 1年の近藤 大輔です。 2026年6月3日 〜 6月3 ...

はじめに 2026年6月に約3週間、CA Tech Jobに参加しました、早稲田大学基幹理工学部情報 ...

There's a game you play as a kid - music plays, a potato gets passed around the circle (ours was a beanbag, I think, or somebody's shoe - the potato was always theoretical), and the only rule anyone actually remembers is that you do not want to be the one holding it when the music stops. That's it. Fifteen years of shipping software - startups, banks, tax systems, and now a large government data platform - and the most useful delivery framework I've found is a children's party game. Never be the

HighlightsThis release backports a fix originally released in v10.3.0 that prevents ESLint from crashing in host environments where require.cache is unavailable, such as Yarn Plug’n’Play.Bug Fixes253be16 fix: handle unavailable require cache (backport of #20812 to v9.x) (#21065) (Eric)Documentation74930ed docs: switch build to Node.js 24 (#20894) (Milos Djermanovic)eaec8bb docs: Add ESLint v9.x EOL notice (#20828) (Milos Djermanovic)Chores458205f chore: update @eslint/eslintrc and @eslint/js for

HighlightsNew option checkConstructorCallCallbacks in max-nested-callbacksThe max-nested-callbacks rule now supports a checkConstructorCallCallbacks option.When enabled, the rule also counts callback functions passed to constructor calls with new, such as new Promise((resolve) => {}), when calculating nesting depth.For example, with { "max": 1, "checkConstructorCallCallbacks": true }, the rule reports the following code as exceeding the allowed callback nesting depth:run(() => { new Promis...

A malicious .NET package is typosquatting the Braintree SDK to steal live payment card data, merchant API keys, and host secrets from production apps.

<p>OpenAI's latest flagship model <a href="https://openai.com/index/gpt-5-6/">hit general availability this morning</a>, and comes in three sizes: Luna, Terra, and Sol (from smallest to largest).</p><p>The new models are priced per 1M input/output tokens as Luna $1/$6, Terra $2.50/$15, Sol $5/$30. For comparison, the Claude Opus series are $5/$25 and the Claude Fable 5 is $10/$50, but price-per-million tokens doesn't tell us much now that the number of reasoning to...

On July 8, 2026, attackers used access to a trusted developer's account to slip a backdoor into a widely used software development kit for the Injective blockchain. Disguised as harmless analytics, the code quietly captured wallet recovery phrases and private keys and sent them to an attacker-controlled server the moment a wallet was created or loaded. Automatic publishing pushed the tainted code out to 18 related packages within minutes, and it stayed live for less than an hour before being pul

GitHub had over 14,000 repositories. Fewer than half had clear ownership. Here's how we gave every active repository a validated owner in under 45 days, archived the rest, and made ownership the foundation for everything that followed.The post How GitHub gave every repository a durable owner appeared first on The GitHub Blog.

<p><strong><a href="https://ai.meta.com/blog/introducing-muse-spark-meta-model-api/">Introducing Muse Spark 1.1</a></strong></p>Following <a href="https://simonwillison.net/2026/Apr/8/muse-spark/">Muse Spark in April</a>, here's Muse Spark 1.1 - the first Spark model to offer an API. Meta claim significant improvements in agentic tool calling and computer use.</p><p>There are a lot more details are in the <a href="https://ai.meta.co...

<p><strong>Release:</strong> <a href="https://github.com/simonw/llm-meta-ai/releases/tag/0.1">llm-meta-ai 0.1</a></p> <p>Let's LLM run prompts against the new <a href="https://ai.meta.com/blog/introducing-muse-spark-meta-model-api/">muse-spark-1.1</a> model.</p> <p>Tags: <a href="https://simonwillison.net/tags/llm">llm</a>, <a href="https://simonwillison.net/tags/meta">meta</a></p>

<p><strong>Release:</strong> <a href="https://github.com/simonw/llm/releases/tag/0.31.1">llm 0.31.1</a></p> <blockquote><ul><li>Fix for a bug with OpenAI Chat Completion endpoints where a tool call with empty arguments could result in a JSON error from some providers. <a href="https://github.com/simonw/llm/issues/1521">#1521</a></li></ul></blockquote><p>This bug came up when I was testing <a href="https...

If you put your custom properties (tokens) for every component in an @layer, then overriding them is never a fight.

A malicious release of @injectivelabs/sdk-ts hid a wallet-key stealer inside code labeled as usage telemetry, then spread it across 17 more npm packages. Here's how it worked and how to check your projects.Category: Vulnerabilities & Threats

Many UI trends are designed to capture attention and signal innovation, but those goals often conflict with the needs of mental health apps: reducing cognitive strain, fostering trust, and providing a sense of refuge. Kat Homan introduces an evaluation framework that helps designers assess whether trendy visual and interaction patterns support or undermine the unique goals of mental health experiences.

NIST is advancing nine new post-quantum signature algorithms as potential candidates for future standardization. We take a closer look at all of them, and argue that while they are in the works and show great potential, we should use ML-DSA for now — the best one currently available.

Compromised Injective SDK npm version 1.20.21 exfiltrates wallet private keys and mnemonics through fake telemetry functionality.

FYIIn this specific instance, I'm here to teach you about using the Proxy constructor and Reflect object. These are features of the language worth having in your toolbox, naturally — but just as importantly they allow us to graze up against some of JavaScript's innermost workings, and in doing so, better learn the shape of the mechanisms that power the language. That's the kind of know-how that makes a senior developer.Now, the keen-eyed among you may notice that this article is shaped conspicuo

Learn how to evaluate AI pentesting vendors with practical buying criteria, research from 1,000+ AI pentests, and a downloadable evaluation checklist.Category: Guides & Best Practices

Add field-level encryption to your Supabase project with CipherStash. Searchable ciphertext, zero-knowledge key management, and no schema changes required.

大規模なネイティブアプリ開発では、実装力だけでは解けない課題があります。iOSとAndroidが並走し、WebやBFF（Backend for Frontend）とも連携しながら機能を届ける。その一方...

こんにちは。メディア統括本部 Data Science Center（DSC）の山田(@___rya ...

はじめに はじめまして！慶應義塾大学環境情報学部3年の上野 大和です！2026年の4月の1ヶ月間、C ...

スクラムよ！ 私は帰ってきたぞ！ スクラムをやめたけど戻したチームの経験談 こんにちは。アニメ『日本三国』を見終わって、横山光輝さんの『三国志』を読んだときの興奮を思い出した daipresents です。天命をまっとうするぞー。 少し前に、Slackを眺めていると、エンジニアリングマネージャ友達のなかしょーさんが「スクラムをぶっ壊す」とフンフンされていたのをみつけて、そう思った理由を伺ってみるとなかなか面白かったので、今日はその話を書いてみたいと思います。 スクラムじゃないかもと思った理由 なかしょーさんチームでは、スクラムが導入されていました。社内でも古株プロダクトでもあることから、比較的…

Vercel now supports applications with zero configuration.LovableTo get started, , then to Vercel. Vercel automatically detects the framework () and deploys your app. Once connected, every change you make in Lovable syncs to GitHub and triggers a new deployment on Vercel.sync your Lovable project to GitHubimport the repositoryTanStack StartLovable projects now use under the hood. Nitro is the universal server toolkit that powers zero-config deployments for and many other frameworks on Vercel, so

When an Environment Variable is marked Sensitive and has a value 32 characters or longer, Vercel now replaces it with in the deployment's build logs.[REDACTED]The Build Logs view also indicates when redaction happened, giving teams visibility into why output was masked without ever exposing the underlying value. When a value is redacted, Vercel logs the Environment Variable key, project, and deployment in the Activity Log, but never the value.Vercel also redacts selected system Environment Varia

Muse Spark 1.1 from Meta is now available on .AI GatewayIt is a multimodal reasoning model with a 1M token context window built for agentic tasks, accepting text, image, video, PDF, and audio inputs.Muse Spark 1.1 plans and orchestrates work across tools and services, operating as a main agent or as a subagent, and it works with new tools, MCP servers, and custom skills without examples. The model supports parallel tool calling, structured output, and built-in search with citations.To use Muse S

GPT 5.6 is now available on in three models: Sol, Terra, and Luna.AI GatewayGPT 5.6 from OpenAI is now available on AI Gateway in a limited preview, across three models: Sol, Terra, and Luna. All three are stronger at agentic work across coding, biology, and cybersecurity, and are more token-efficient than the previous generation.To use GPT 5.6, set to one of the above slugs in the :modelAI SDKYou can also set to switch to GPT 5.6 from other gateway models without touching your code.routing rule

<p><strong><a href="https://bun.com/blog/bun-in-rust">Rewriting Bun in Rust</a></strong></p>Jarred Sumner has been promising this blog post (<a href="https://x.com/jarredsumner/status/2053063524826620129">since May 9th</a>) about his Zig to Rust rewrite of Bun for significantly longer than it took him to finish the rewrite.</p><p>Honestly, it was worth the wait. This is a detailed description of an extremely sophisticated piece of agen...

<p><strong><a href="https://openai.com/index/introducing-gpt-live/">Introducing GPT‑Live</a></strong></p>OpenAI <em>finally</em> upgraded the model used by ChatGPT voice mode!</p><p>I've had preview access for a few weeks in the iPhone app, and the new model is very impressive. It also has the ability to spin off harder tasks to GPT-5.5:</p><blockquote><p>For questions that require web search, deeper reasoning, or mor...

npm v12 is generally available, turning install scripts off by default and beginning the deprecation of 2FA-bypass publishing tokens.

Explore how the Aspire team turns merged product changes into SME-reviewed docs pull requests, closing the gap between release and documentation.The post Automating cross-repo documentation with GitHub Agentic Workflows appeared first on The GitHub Blog.

Socket tracks the activity as Operation “Muck and Load”: a threat actor uses commit-farming workflows, public dead drops, and protected archives to stage Windows RAT and infostealer malware.

<blockquote cite="https://twitter.com/kentonvarda/status/2074924213983740233"><p>I just declared a moratorium against AI-written change descriptions (e.g. PR and commit messages, also issues/tickets) from my team.</p><p>AI was writing change descriptions that were worse than useless to me as I tried to review PRs: outlining details of the code that could easily be seen by looking at the code, but omitting the higher-level framing needed to understand broadly what the cod...

In June, we experienced six incidents that resulted in degraded performance across GitHub services.The post GitHub availability report: June 2026 appeared first on The GitHub Blog.

Why & how we rewrote Bun from Zig to Rust

Go from an empty repository to a live custom domain with HTTPS in about 14 minutes, without manually editing a single DNS record.The post How GitHub Copilot enables zero DNS configuration for GitHub Pages appeared first on The GitHub Blog.

Today we are proud to announce the availability of TypeScript 7, a 10x faster native port of TypeScript! Since its early days, TypeScript has promised to deliver on JavaScript that scales. By bringing strong type-checking and rich tooling to the world of JavaScript, TypeScript made it possible to build non-trivial high-quality apps across platforms. Last […]The post Announcing TypeScript 7.0 appeared first on TypeScript.

記事は ics.media へアクセスしてご覧ください。

流れを自由自在に操りアジリティを高める「かんばん」方法論 こんにちは。健康診断の肺活量診断で看護師さんに「もっといける！もっといけるぞ！そうだ、どんどんだせ！いけー！」と応援されたけど、前回の記録を更新できなかった daipresents です。次も同じとこで受けよう。 カミナシの開発プロセスは、プロダクトごとのチーム（サービスチームと呼んでいます）ごとに自分たちで考えて定義しています。そして、技術スタックもプロダクトごとにだいたい揃っていて、開発するプロダクトも「ノンデスクワーカー向けSaaS」ですので、それほど大きく違いが生まれてない現状があります。 この数年、社内のプロセスをなんとなく遠…

The attribute `hidden="until-found" can be quite useful in HTML, but we'll need another unexpected bit of CSS to ensure space is reserved.

Cloudflare Research is building a global consensus service called Meerkat that uses a new consensus algorithm called QuePaxa. We plan to use Meerkat to build a strongly consistent, fault-tolerant key-value store, and other applications.

Today we're expanding . It started by triaging alerts and reviewing your pull requests. Now it has a home in your dashboard, where it can investigate production, answer questions about your projects, and take action once you approve it.Vercel AgentBecause Vercel Agent is built into the platform that deploys and runs your app, when something changes in production, it's your first responder. It autonomously investigates your logs, metrics, and deployments, finds the root cause, and proposes a fix,

pnpm 11.10 hardens registry auth to block token redirection, tightens pack-app and deploy, and makes the Rust port (v12) installable.