LINEヤフーの技術カンファレンス「Tech-Verse 2026」の公式記事です。大規模言語モデル（LLM）が入力トークンの物理的しきい値を百万規模へと拡張するにつれ、ソフトウェア工学の現場は「シリ...

LINEヤフーの技術カンファレンス「Tech-Verse 2026」の公式記事です。はじめにこんにちは。LINEヤフー株式会社のDBaaS DevOpsチームで働いている朴政武（パク・ジョンム）です。...

カミナシでソフトウェアエンジニアをしている furuya です。今回は開催直前！ AWS Summit Japan 2026 の楽しみ方をご紹介します！これを見て、「行ってみようかな」と思っていただけた方がひとりでも増えれば幸いです。 ※2026/06/24 現在公開されている情報や、AWS Summit Japan 2025 のときの情報をもとにしています。最新の情報は AWS Summit Japan 2026 公式サイトでご確認ください。 aws.amazon.com AWS Summit Japan 2026とは 6月25日（木）、26日（金）に幕張メッセで行われる、日本で一番大きな …

<p><strong>Release:</strong> <a href="https://github.com/simonw/datasette/releases/tag/1.0a35">datasette 1.0a35</a></p> <p>I'll write more about this one tomorrow, but it's a big release. Three highlights from the release notes:</p><blockquote><ul><li>New "Create table" interface in the database actions menu, backed by the <code>/<database>/-/create</code> <a href="https://docs.datasette.io/en/latest/...

Adam knows better than anyone, CSS knows about the user, device, variables, layout and more. But there is a little bit of information that CSS doesn’t have. Like what’s the current value of a range input exactly? What are the exact coordinates of the mouse? It’s not hard to pass over that information to CSS […]

<p><strong>Tool:</strong> <a href="https://tools.simonwillison.net/opfs-pyodide">OPFS + Pyodide test harness</a></p> <p>I've been pondering if <a href="https://lite.datasette.io/">Datasette Lite</a> - the Python Datasette application run entirely in the browser using Pyodide and WebAssembly - might be able to edit persistent SQLite files stored on the user's computer.</p><p>That's what <a href="https://developer.mozilla.org/en...

The new post-quantum executive order sets a 2030 migration deadline and establishes a powerful foundation for post-quantum resilience. We look at what it gets right, where it can go further, and our migration playbook for government and industry.

Explore how my day as a senior leader looks now that I use 40 automations to help, and learn more about some of my favorites.The post I automated my job (and it made me a better leader) appeared first on The GitHub Blog.

We’re calling for targeted amendments to resolve conflicts with open source licensing and align with international transparency frameworks while preserving regulatory intent.The post GitHub joins coalition advocating for fixes to California AI Transparency Act to protect open source appeared first on The GitHub Blog.

AI agents are pulling packages into environments no scanner is watching, creating exposure before security teams can see it.

This is the technical companion to our update on Distilled, “Keeping the web open and private in the bot era.” Here we take a deeper look at the problem space, the design we’re proposing, and the problems still left to solve. Bots (and privacy-preserving browsers) not welcome Browse a news site in a private window. Shop […]The post PACT: Anonymous Credentials for the Web appeared first on Mozilla Hacks - the Web developer blog.

2026年6月23日に、GMO Flatt Security主催の「OSS開発者は今何をするべきか？ソフトウェアサプライチェーン侵害対策を考える」で「Hardening npm Publishing」というタイトルで、npmパッケージの公開フローをどう守るかについて話しました。スライド: Hardening npm Publishingローカルのトークン管理やnpm Trusted Publishingについては、以前の記事で書きました。1Passwordを使って、ローカルにファイル(~/.configや.env)として置かれてる生のパスワードなどを削除した | Web Scratchパスワード管理/MFA管理の戦略 | Web Scratchnpm Trusted PublishingでOIDCを使ってトークンレスでCIからnpmパッケージを公開するこの記事ではそれらを前提に、GitHub Environmentsとnpm staged publishingをどこに入れるかの話をスライドベースでかいています。サプライチェーン攻撃をすべての侵害を防ぐのは難しいです。それでも、ローカル、

Aikido partners with Drydock to bring pre-publish package review to npm and PyPI. See exactly what's inside a release before it ships, malware caught before download number one.Category: Product & Company Updates

#tpac_study- https://web-study.connpass.com/event/378948/X- https://twitter.com/sajikix

You can now deploy a to Vercel with zero configuration.Node.js serverVercel detects a file at the project root or at and deploys it as a Node.js application, in addition to existing zero-configuration backends like Express, Koa, and NestJS:server.tssrc/server.tsVercel CLI can handle local development and deployment:Backends on Vercel are powered by with .Fluid computeActive CPU pricingLearn more about the .Node.js runtime on VercelRead more

LINEヤフーの技術カンファレンス「Tech-Verse 2026」の公式記事です。こんにちは。LINEヤフー株式会社の中野です。Yahoo!検索のAI回答サービスで大規模言語モデル（LLM）の最適化...

LINEヤフーの技術カンファレンス「Tech-Verse 2026」の公式記事です。はじめにこんにちは。LINEヤフーで大規模データ基盤の運用を担当している平山、沼田、小笠原、小川です。LINEヤフー...

Val Town is a sort of Third Space for non-prod code

Learn how WebMCP enables AI agents to interact with websites through structured tools instead of traditional browser automation. This guide explains how WebMCP works, how it compares to DOM-based approaches, and how to validate your WebMCP implementation using Lighthouse and DebugBear.

Vercel's OIDC issuer () now supports custom audiences. Deployments can request OIDC tokens with a specific audience claim, enabling secure service-to-service authentication with third-party providers.oidc.vercel.comVercel OIDC tokens are issued with a fixed audience (). While most cloud providers don't require a specific audience value, using a unique audience per provider is a security best practice. If a provider is compromised, an attacker cannot replay the token against a different provider

Vercel is now a send-to destination in . When you finish a design, you can send it to Vercel and get a live URL back without leaving your canvas.Claude DesignClaude Design deploys the design as a new project in your connected Vercel account and returns a URL you can open and share.When you're ready to share a design, add Vercel as your destination in the 'Share' menu and connect the to get started.Vercel MCP server about using Claude Design and Vercel together.Learn moreRead more

The trace viewer for and has been redesigned to better support inspecting runs from start to finish. Search across spans, zoom into any section of the timeline, and step through with the keyboard to find what you're looking for fast, then click into any step to see its inputs, outputs, and run metadata.Vercel WorkflowsWorkflow SDKThe trace viewer is also available locally through with to inspect runs during development.Workflow SDKnpx workflow@beta webLearn more about .Vercel WorkflowsRead more

<p><strong><a href="https://role-confusion.github.io">Prompt Injection as Role Confusion</a></strong></p>First, I absolutely love this:</p><blockquote><p>This is a blog-style writeup of the paper.</p></blockquote><p>I wish <em>every paper</em> would come with one of these. Academic writing is pretty dry - the impact of a paper can be so much higher if you publish a readable version to accompany the formal one.&l...

<p>This morning <a href="https://news.ycombinator.com/item?id=48630171">on Hacker News</a> I saw <a href="https://hustvl.github.io/Moebius/">Moebius: 0.2B Lightweight Image Inpainting Framework with 10B-Level Performance</a>, describing a small but effective inpainting model - a model where you can mark regions of an image to remove and the model imagines what should fill the space. The released model <a href="https://github.com/hustvl/Moebius/blob/9310b76e368f5...

目次 はじめに Databricks Data + AI Summit とは Keynote 全体感 ...

はじめに カミナシでエンジニアリングマネージャーをしている、すずけん（@szk3）です。自チームのプロダクト「カミナシ 設備保全」には 2 つの AI 機能があり（プレスリリース）、どちらも Amazon Bedrock AgentCore 上のエージェントから同じ LLM モデルを呼び出しています。 リリースからしばらく経つと、「で、それぞれのAI機能でLLMの呼び出しいくらかかってるの？」という当然の疑問が出てきました。ところがこの２つのAI機能は同じLLMモデルを呼び出しており、請求上は合算されるため、機能ごとのコストを切り分けられていませんでした。 この記事では、Amazon Bedr…

By rearchitecting the Images binding, we accidentally uncovered a bug that existed in the open-source hyper library across multiple major versions.

Learn about the progress we’ve made toward our accessibility goals and how you can help make open source more inclusive. The post From pledge to practice: Building a more inclusive open source ecosystem appeared first on The GitHub Blog.

NGINX Ingress Controller 5.5.0 introduced the ExternalAuth Policy. This is the second blog post in a two part series that covers the ExternalAuth Policy, and is focused on a real world use...

A tour through Read Committed, Repeatable Read, and Serializable, and why the same three words guarantee completely different things depending on which database you ask.

Cloudflare の Temporary Cloudflare Accounts を使用すると、人間が介入することなく AI エージェントが即座に Cloudflare Workers にデプロイできるようになります。この記事では、Temporary Cloudflare Accounts を使用して実際に Cloudflare Workers にデプロイする方法を試してみます。

At Vercel, feature flags are how we ship. From new features to model updates in v0, and even infrastructure changes like a production database migration where a flag was the cutover. The team alone runs hundreds at any given moment.v0Merging code sends a build to production, but the feature flags control whether users can see what changed. Flags let you ship on your own schedule, release to segments when you're ready, and roll back immediately by toggling a flag, without touching source files or

コーポレートエンジニアの@sion_cojpです。 コーポレートエンジニアをやってると、コード化できないものも多く、その場合は手順書を残す必要があります。 手順書は 「作業者が、上からなぞって実施していけば誰でも同じ作業になる」ために、見やすく書くノウハウをこの記事では紹介します。 1. 全体の文字数・1文の文字数・画像数をなるべく少なくする 2. インデントは2つまで。最悪3つ目まで 3. 危ない作業は赤文字 + 太文字で 4. 画像を使わず、なるべく文字だけで表現する 5. プロセス図に沿った手順を書く 6. 作業の流れだけを書く。ベストはコピペだけでできるように完結させる 7. 注意点は…

LY Corporationの技術カンファレンス Tech-Verse 2026 の公式記事です。はじめにこんにちは。社内クラウドサービス Verda および社内モニタリングツール IMON に In...

LINEヤフーの技術カンファレンス「Tech-Verse 2026」の公式記事です。こんにちは。AIエージェントで分析を「ひとつなぎ」にするプロジェクト「PJ One Piece」のプロダクトマネージ...

開発者が手作業によるコンテキストスイッチから解放され、Issue ドリブンな開発フローをより滑らかに ...

本記事では、その検証結果を共有します。

Astro 7.0 brings faster builds with Vite 8, a new Rust compiler, Advanced Routing, background dev server support, and structured logging.

Loin des discours habituels sur la productivité, les conférenciers ont abordé la disruption, l'IA fatigue, et la nécessité de repenser nos produits pour un monde où les agents deviennent des utilisateurs à part entière.

Organizations are discovering that AI agent costs are invisible by design. The fix starts earlier in the stack than most teams realize.

You can now generate signed URLs for Vercel Blob directly from the Vercel CLI. A signed URL is a scoped URL with a set expiration time that lets you perform a single operation on a specific object. Each URL is scoped to one operation (, , , or ), one pathname, and a custom expiry of up to 7 days. Update the Vercel CLI to version to get started.getheadputdelete5.14.5Use the new command to sign a URL for a single operation, for example to provide short-lived access to a private file or to allow yo

Hobby users can now connect up to 25 projects per repository, up from 10. This makes it easier for users to onboard monorepos and use cases where one codebase maps to many deployable apps.Learn more about .repository connection limitsRead more

Vercel Functions can now serve WebSocket connections, enabling bidirectional communication between clients and server-side code on Vercel.Use WebSockets for realtime features such as interactive AI streaming, chat, and collaborative apps.WebSocket connections run on and follow the same and as other Function invocations. With , billing only applies to the time your Function spends processing messages, not idle connection time.Fluid computelimitspricingActive CPU pricingYou can serve WebSocket con

Sakana Fugu Ultra from Sakana AI is now available on .AI GatewayFugu Ultra is built on a pool of publicly accessible frontier models, rather than running as a single model. It coordinates several models, routing work to 1-3 agents depending on the problem and combining their results into a single answer.Based on reasoning and scientific benchmarks, Fugu Ultra has capabilities similar to those of Claude Mythos Preview and Fable 5.To use Fugu Ultra, set to in :modelsakana/fugu-ultraAI SDKAI Gatewa

<p><a href="https://sqlite-utils.datasette.io/en/latest/">sqlite-utils</a> is my combined Python library and CLI tool for working with SQLite databases. It provides an extensive set of higher-level operations on top of Python's default <a href="https://docs.python.org/3/library/sqlite3.html">sqlite3 package</a>, including support for <a href="https://sqlite-utils.datasette.io/en/latest/cli.html#transforming-tables">complex table transformations</a>, aut...

<p><strong>Release:</strong> <a href="https://github.com/simonw/sqlite-utils/releases/tag/4.0rc1">sqlite-utils 4.0rc1</a></p> <p>See <a href="https://simonwillison.net/2026/Jun/21/sqlite-utils-40rc1/">sqlite-utils 4.0rc1 adds migrations and nested transactions</a>.</p> <p>Tags: <a href="https://simonwillison.net/tags/sqlite-utils">sqlite-utils</a></p>

<p><strong><a href="https://blog.cloudflare.com/temporary-accounts/">Temporary Cloudflare Accounts for AI agents</a></strong></p>The announcement says this is "for AI agents" but (as is pretty common these days) the AI hook isn't really necessary, this is an interesting feature for everyone else as well.</p><p>Short version: you can now create a Cloudflare Workers project and run this, without even creating a Cloudflare account:</p><pre&g...

Codex の Record & Replay は macOS 上でのユーザーの操作を実演することで再利用可能なスキルに変換する機能です。例えば経費精算の提出や勤怠アプリへの打刻や工数入力、定期的なレポートの作成などをスキルとして記録し、煩雑な定型業務を AI に任せることが期待できます。この記事では、Record & Replay を実際に試してみた様子を紹介します。

A coordinated 8-month supply chain attack planted credential-stealing code inside fake AI coding assistants on the JetBrains Marketplace, quietly exfiltrating OpenAI, DeepSeek, and SiliconFlow API keys to an attacker-controlled server in Beijing -- which our investigation found still operational today.

GitHub Actions checkout now blocks risky pull_request_target checkouts by default to help prevent pwn request supply chain attacks.

Vercel が新しい AI エージェントフレームワーク eve を発表しました。Next.js の設計思想に基づいて構築された eve は、AI エージェントの開発に必要な機能がすべて揃ったフレームワークです。この記事では、eve を使って簡単なエージェントを作成し、実行する方法を紹介します。

<blockquote cite="https://news.ycombinator.com/item?id=48592163#48593190"><p>The real valuable capability MCP offers over skills/CLI is isolating the auth flow outside of the agent’s context window, and potentially out of the harness completely. [...]</p><p>Maybe the idealized form of MCP is just an auth gateway for the API and nothing else. That’d still be a win.</p></blockquote><p class="cite">— <a href="https://news.ycombinator.com/item?...

Socket now supports Custom Roles and Repository Access Permissions so organizations can control who can access specific repositories and actions.

Qubot, our internal Copilot-powered analytics agent, allows any GitHub employee to ask questions about our data in plain language. Here's what we learned as we built it.The post How we built an internal data analytics agent appeared first on The GitHub Blog.

View Transitions are of unique help in applying an animation to an element even when you are literally removing it from the DOM.

The moment an agent needs to deploy something, it slams face-first into a wall built for humans. Today we're rolling out Temporary Accounts on Cloudflare Workers. Any agent can now run wrangler deploy — temporary and get a live Worker in seconds.

HyperblamHeydon Pickering has been very busy building out a declarative, web component-based system for making music with HTML, along with a stunning companion site.Web browsers on video game consolesA thoroughly fascinating read.Standard ReaderThis is a really nice RSS reader-like standard.site reader.How building an HTML-first site doubled our users overnightWe challenged Alistair to write this and boy, did they deliver!An in-depth guide to customising lists with CSSHere's one from the Piccali

2026年6月29日（月）、技術カンファレンス「Tech-Verse 2026」（以下、本カンファレンス）を、オンラインにて開催いたします。本カンファレンスは、LINEヤフーおよび海外法人を含むグルー...

The framework wars taught us that the winning layer often does less. The same pattern is emerging for AI agents, where narrow agents need meta harnesses above them.

Like RSS and Google Reader.

How SAML attribute mapping works, how to configure it in Okta and Microsoft Entra ID, and how to map user roles, groups, and custom claims to your application.

<p>Today we launched a new plugin for Datasette, <a href="https://github.com/datasette/datasette-apps">datasette-apps</a>, with <a href="https://datasette.io/blog/2026/datasette-apps/">this launch announcement post</a> on the Datasette project blog. That post has the <em>what</em>, but I'm going to expand on that a little bit here to provide the <em>why</em>.</p><h4 id="the-tl-dr">The TL;DR</h4><p>Datasette Apps are s...

Socket MCP now lets AI assistants review org alerts, investigate threats using the Socket threat feed, and inspect package files in addition to dependency scoring.

<p><strong>Release:</strong> <a href="https://github.com/datasette/datasette-acl/releases/tag/0.6a0">datasette-acl 0.6a0</a></p> <blockquote><p>This release expands <code>datasette-acl</code> from table-only permissions toward a general resource-sharing system.</p></blockquote><p>Alex Garcia did most of the work for this release - we're fleshing out the plugin that will allow multi-user Datasette instances finely grai...

We break down the technical architecture behind our multi-stage vulnerability discovery harness and automated triage loop. Learn how we manage state controls, squash false positives through adversarial review, and route around LLM context limits.

Learn how pull request limits can help manage contribution volume in your repositories, and see what’s next on the roadmap.The post How pull request limits are cutting down the noise appeared first on The GitHub Blog.

Today we are excited to announce the Release Candidate of TypeScript 7.0! If you haven’t been following TypeScript 7.0’s development, this release is significant in that it is built on a completely new foundation. Over the past year, we have been porting the existing TypeScript codebase from TypeScript (as a bootstrapped codebase that compiles to […]The post Announcing TypeScript 7.0 RC appeared first on TypeScript.

To mark the 12th anniversary of Project Galileo, Cloudflare has released its first comprehensive report analyzing cyberattacks against civil society.

OWASP individual members get 200 free Aikido credits to run Code Audit. Here is who qualifies and how to claim yours in two steps.Category: Aikido

On June 17, 2026, an attacker compromised the @mastra npm organization and quietly added easy-day-js as a dependency across 140+ packages in the Mastra AI framework ecosystem. easy-day-js is a typosquat of the popular dayjs date library, and its latest version contained an obfuscated postinstall dropper that downloaded and ran a second-stage payload from attacker-controlled servers, then deleted itself to remove any trace. Packages with a combined weekly download count exceeding 1.1 million were

npm and Python supply chain attacks run on developer machines and steal secrets. See how Package Configs audits registry, cooldown, and auth across your fleet

On June 11th 2026, security researchers and the Arch Linux community disclosed a large-scale supply-chain attack against the Arch User Repository (AUR). Attackers hijacked more than 400 community packages and turned them into a malware delivery network. While the immediate blast radius is limited to Arch Linux systems, the campaign is a textbook example of how modern attackers compromise developers and CI infrastructure by abusing trust in open-source ecosystems.

Miasma and Hades worms are spreading across npm and PyPI, running on import and project open. See how Dev Machine Guard's Suspicious Files detects them.

はじめに LegalOn Technologiesで2025年12月から2026年6月までの約7ヶ月間、SWE（Software Engineer）としてインターンをしていた tsukune です。 本記事では、インターンで取り組んだ技術課題とその体験から得ることができた学びについてまとめます。 インターン開始時の自分のスペック 情報専攻のB2（今はB3です） インターン経験はあったが簡単なAPI・DB設計ができる程度 Pythonの業務経験やインフラ知識は皆無

こんにちは、LINEヤフー株式会社の花谷拓磨（@potato4d）です。普段はフロントエンド領域を中心とした開発組織のマネジメントや、AI Agent のプロダクト開発などを担当しています。本記事では...

LINEヤフー株式会社では、技術に関するイベントや勉強会の主催・協賛などを行っています。最新情報は各リンク先でご確認ください。タイミングによっては、申し込み開始前や既に満席となっていることがあります。...

作者Boris Cherny氏とのQ&Aから見えた、大規模組織でのAIエージェント活用 Q& ...

How declarative partial updates stream HTML out of order with markers and templates, preserve app state without a framework, and lets us move to a native component model.

In this release, we're focusing on observability, and making proto easier to consume from automated

We've all been there. A test fails in CI. You open the logs, and all you get is:

AI agents are completing real purchases with real money. The fraud model, the liability model, and the authentication model all need to change.

On June 3, 2026, Cloudflare's CEO posted that bots had passed human web traffic for the first time. Here's what that actually means for your app, your API, and your analytics.

The MCP 2026-07-28 release candidate rewrites the protocol's foundation. Here's what's changing, what's breaking, and what your team needs to do before the final spec lands.

<p>Chinese AI lab <a href="https://z.ai/">Z.ai</a> released GLM-5.2 <a href="https://x.com/Zai_org/status/2065704919299235870">to their coding plan subscribers</a> on June 13th, and then yesterday (June 16th) released the full open weights under an MIT license. Similar in size to their previous GLM-5 and GLM-5.1 releases this is a 753B parameter, <a href="https://huggingface.co/zai-org/GLM-5.2">1.51TB</a> monster - with 40 active parameters (Mixture of ...

Safari Technology Preview Release 246 is now available for download for macOS Golden Gate and macOS Tahoe.

If you’re on Bluesky (like this site is!), you’re using atproto. Standard.site is, as best I understand it, a userland agreed-upon schema for what certain stuff looks like on the protocol, like a “publication” and a “document”. Mat is cautiously optimistic in trying to understand it: The most obvious use case is allowing users on […]

Socket Firewall blocks malicious VS Code and Open VSX extensions before install, protecting developers from compromised editor marketplaces.

How GitHub Copilot is making more of each session go toward useful work, so your credits go further.The post Getting more from each token: How Copilot improves context handling and model routing appeared first on The GitHub Blog.

The Agents SDK is now a runtime any agent framework can build on. Today we're opening up the Agents SDK primitives, with Flue as a first framework targeting Agents SDK, and rolling out agents in the dashboard.

<blockquote cite="https://charitydotwtf.substack.com/p/ai-demands-more-engineering-discipline#footnote-2"><p>What happened in 2025 was this: <strong>the economics of code production were turned upside down</strong>. Instead of being very hard, time-consuming, and expensive to generate code, it became effectively free and instant. Lines of code went from being treasured, reused, cared for and carefully curated, to being disposable and regenerable, practically overnight.&l...

Learn how CKEditor AI brought MCP into a real SaaS environment, turning external tools and customer data into secure, scalable agent capabilities.

For a decade, Vercel has shaped how the web is built. Now, we’re doing the same for agents. The companies that win the next decade will build on infrastructure designed for agents from the start, and over 2,500 people gathered in London this week to do just that at Vercel Ship 2026.Guillermo kicked off Ship by sharing his vision for Vercel: a true full-stack platform where you can deploy anything, including software that can think. has three parts: Agentic infrastructureIn the next keynote, Tom

記事は ics.media へアクセスしてご覧ください。

本記事では、内製OLAP DB「mila」における、Bigtable Authorized Viewを用いたスケーラブルなテナント分離についてお話しします。

Every developer has tools they rely on daily. The workflows they’ve built around them, the ways they’ve learned to move faster, debug smarter, and write better code – that kind of hands-on experience can be hard to put into words. We’re collaborating with LinkedIn to make it easier for you to showcase your expertise with […]

The Cloudflare One stack is a library of agent skills that gives any AI agent the knowledge it needs to plan, deploy, and manage a Zero Trust environment — no migration calls required.

141 Mastra npm packages were compromised in a supply chain attack that injected a malicious dependency to silently download and execute a payload at install time.Category: Vulnerabilities & Threats

More than 140 Mastra npm packages were compromised in a supply chain attack that used a typosquatted dependency to deliver a cross-platform infostealer during installation.

Agents are designed to do almost any kind of work, from answering support tickets to writing code. No matter how complex the workload, how long it runs, or how many turns it takes to complete, every agent needs three core capabilities to operate: Implementing these capabilities to build a complete agent forces developers to choose between vendor lock-in with a single provider API, stitching together solutions, or building abstractions themselves.The Agent Stack gives you all the building blocks