vlt 1.5.0 links skills from JavaScript dependencies to coding agents, with lockfile versioning and Socket data to filter out known malicious packages.

Sidekick’s frontier model hands its most token-heavy work to open models that Shopify post-trains and serves itself. Here’s the loop we use to build them, and where NVIDIA’s models, software, and GPUs make each turn faster and cheaper.

Two critical PHP RCE flaws (CVE-2026-109618, CVE-2026-109619) are being patched. Every PHP version is affected. How to patch, a temporary mitigation, and how to check your hosts.Category: Vulnerabilities & Threats

<p><strong><a href="https://emudhra.we-have-a-problem.com">eMudhra Intermediate CA Compromise</a></strong></p>This is very, very bad news:</p><blockquote><p>The private keys of eight eMudhra intermediate CA certificates have been compromised. They chain to roots trusted by the Mozilla, Microsoft, Apple and Chrome root programs and by many downstream trust stores.</p></blockquote><p>Any software that bundles a list of truste...

Following the discovery that eight eMudhra intermediate certificates use weak keys, Cloudflare is deploying mitigations and releasing client updates. We explain the impact, our response, and what customers and developers should do next.

Compare nine phishing simulation tools for realistic email, voice, SMS and deepfake exercises, adaptive training and broader workforce protection.Category: DevSec Tools & Comparisons

support in is now generally available.WebSocketVercel FunctionsSince the , Vercel CDN has served 300 million WebSocket connections, and now serves 15 million per day.public beta launched in late JuneCustomers use WebSockets for AI chat, streaming, and realtime multiplayer apps. WebSockets also power AI Gateway's .realtime modelsWebSocket connections follow the same limits and pricing as other Function invocations. With , CPU is billed only for the time spent processing messages. Active CPU prici

<p>My latest vibe coded game experiment is a Command & Conquer style RTS (Real Time Strategy) game called <a href="https://github.com/simonw/battledrones#readme">Battle Drones</a> (<a href="https://simonw.github.io/battledrones/">play it here</a>). Unlike <a href="https://simonwillison.net/2026/Aug/5/raccoon-heist/">my previous experiments</a>, this one is <em>actually fun to play</em>. I'm somewhat embarrassed to admit that I got th...

Today we’re excited to announce the beta release of TypeScript 7.1! npm install -D typescript@beta Let’s take a look at what’s new in TypeScript 7.1! Support for Import Attributes in Ambient Modules Import attributes are metadata that are attached to import statements. Typically, they’re meant to instruct runtimes and bundlers on how to interpret the […]The post Announcing TypeScript 7.1 Beta appeared first on TypeScript.

Compare eight security awareness training platforms for role-based learning, AI threats, phishing simulations and protection across your workforce.Category: DevSec Tools & Comparisons

Compare eight Mimecast alternatives for email security, AI governance, employee training and archiving, with practical advice for planning your switch.Category: DevSec Tools & Comparisons

Three Java Champions share how they use GitHub Copilot to solve problems, accelerate development, and keep humans responsible for the results.The post How 3 Java Champions are using GitHub Copilot for increased productivity appeared first on The GitHub Blog.

I watched this whole video by Juxtaposed, assuming it was a real redesign of the VLC player, but alas, it is not official. Nevertheless, it should be, and it’s a wonderful example of how much real human brainpower it takes to design something well.

Rust 1.100 will add opt-in dependency cooldowns to Cargo, giving security scanners and maintainers time to catch malicious crate releases.

How we group product listings across millions of stores using tiered matching models, graph partitioning, and learned cluster merge decisions.

Every year, browser vendors collaborate via the Interop project to synchronize their efforts on new HTML/CSS/JS features. This year, there’s a ton of super exciting features being considered! In this blog post, we’ll explore the CSS of the future, to get a glimpse of what we’ll soon be able to do.

Cloudflare is collaborating on tsrs, a Rust port of TypeScript that is up to 8x faster and uses 70% less memory.

Introducing v1.5.0: with this release, vlt now links the agent skills your dependencies ship into the dirs your coding agents read.

Aikido launches Noon, a workforce security business. AI governance, device and email protection, and training against AI-powered phishing and deepfakes.Category: Company Updates

Human-in-the-loop AI for editing: compare suggestions, drafts and locks, with CKEditor 5 configuration.

Design systems thrive on consistency, so where does randomness fit in? Through playful demos of organic typography, bouncing letters, and splayed cards, Brecht De Ruyte shows how the new CSS `random()` function brings a little imperfection to the web without JavaScript libraries or preprocessor loops that generate hundreds of lines of static CSS.

I’ve been mulling this over for about a year now. The developer landscape has shifted to the point where you can’t scroll past the news without seeing someone declare “I never open my IDE anymore” or “I do everything in the terminal.” And those workflows genuinely work for some people. But not for everyone. I […]

Claude Code の Mods は、Claude Code のプロセス内で動く TypeScript/JavaScript の関数でイベントを観察・書き換え・代わりに応答できる仕組みです。settings hooks では難しかった UI の描画や組み込み機能の置き換えもできます。この記事では、危険な Bash コマンドを止めてプロンプトの上に件数を表示する mod を作りながら、Mods の仕組みと設計の背景、セキュリティ上の注意点を紹介します。

はじめに!修正や追加等はコメントまたはGitHubで編集リクエストをお待ちしております。ダイニーで一番若いエンジニアのriya amemiya(21歳)です。(V8の配列系メソッド高速化職人をそろそろ名乗っても怒られないんじゃないか？と最近思い始めました🧐)今回は Array.prototype.fill（以下 fill）をSmiとdouble向けに最大約7倍高速化しました。V8の配列系メソッドのfast path実装に取り組む人は世界で見てもほとんどいないので、この記事から少しでも興味を持っていただけると嬉しいです。パッチはこちらです。https://chromi...

now includes DeepSeek V4.1 Flash, alongside Kimi K3 and GLM 5.3, each accessed through its preferred provider, with more models to come. The DeepSeek model uses the latest weights (1017).Token PassToken Pass is a $30/month subscription on Pro teams that grants $80 in monthly credit and runs through . Use it with any coding agent such as , , , etc. or build your own with the AI SDK, with Zero Data Retention enabled by default.AI GatewayfxPiClineCommand CodeAdd DeepSeek V4.1 Flash from the in your

RTL support covers the UI, the content and every mixed-language passage. See what Arabic and Hebrew users need and test it in CKEditor 5's live demo.

SF Ruby is an engineers' conference: meet the people building Ruby open source, scaling Rails in production, and shaping what agentic Rails looks like next.

<p><strong><a href="https://dumbmatter.com/2026/10/programming-obituary/">My obituary for programming</a></strong></p>Jeremy Scheff poignantly captures the key loss caused by coding agents for career programmers who enjoyed the <em>puzzle</em> of developing code:</p><blockquote><p>Programming turned into one of the greatest jobs you could imagine. You got paid to work on tricky little logic puzzles. The trickier the puzzle, the m...

Our first scanner read config files and missed what was running. We rebuilt it with the cloud inventory, a careful probe, and honest results.

When our AI code reviewer's cost per run doubled, we dug into the token usage to find out why. Learn how we used prompt caching and intelligent model routing to slash our inference bill by 68% while speeding up reviews.

Learn how to move an agent session from the GitHub Copilot app into VS Code without losing the conversation, code changes, or working context.The post How to continue a GitHub Copilot app session in VS Code appeared first on The GitHub Blog.

We are updating the Terms of Service for Hobby and Pro customers, effective October 19, 2026. The updates clarify some existing Vercel practices, expand terms on topics such as managed accounts and credits, and reflect applicable legal requirements, including certain cancellation and service-change rights for eligible consumers in the UK and EU.A new section sets out how credits work: plan-included credits expire at the end of the subscription term and purchased credits expire one year after pur

Apple and WebKit have shipped protections against web tracking for a long time.

Clairic is a new model from Cloudflare that is a System One extraction modeI, capable of extracting, computing, estimating, and forecasting data from unstructured inputs.

CVE-2026-88771 lets attackers run commands on NetScaler Gateway before anyone signs in. Patching takes time most teams don't have, so the sign-in decision has to move in front of the vulnerable code.

Developers are familiar with running coding agents locally through harnesses like Pi, Claude Code, and others. They are reliable daily drivers for generating code, but keeping agents running around the clock requires your computer to be on and awake, which led to the laptop lid memes and Mac mini demand spike. Harness workloads are moving to the cloud. Individual developers are deploying always-on coding agent workflows, projects like OpenWork and HanaAgent use open-source harnesses as the engin

Part 2 of this intro to TanStack AI covers structured output: constraining the model's response to a Zod schema, then streaming that JSON in and rendering it while it's still incomplete.

Drata and Aikido bring AI pentesting into your compliance workflow. Get verified findings, auditor-ready reports, and up to $4,000 in free pentest credits.Category: Compliance

AI pentesting lets security teams test more often without raising the budget. Learn how upfront pricing and forecasts keep costs predictable.Category: News

環境の変化に伴い、過去に下した合理的な判断がもはや有効でなくなることはよくあります。この記事では、LINEアプリの成長に伴い、動的設定配信システムである「サービス設定」のiOSクライアントがどのような...

はじめにはじめまして、高知大学人文社会科学部人文社会科学科4年の坂下康信です。2026年8月3日から9月11日まで、LINEヤフー株式会社のLINEギフトのSRE業務を担当するチームでインターンに参加...

AI data security and governance for embedded editors: follow one AI edit through every hop and see who receives your content, where and for how long.

Today we are excited to release React Native 0.88!

is now available on AI Gateway with 50% off launch pricing. Inception reports strong results across a range of benchmarks, with generation speeds above 1,000 tokens per second.Mercury 3 from InceptionMercury 3 uses diffusion to generate text through parallel refinement. It brings improved reasoning to latency-sensitive workloads such as browser agents, real-time search, interactive education, and customer support. A 1M-token context window gives those applications room for long documents and ext

from is now available on for free until Oct 22.MiniMax M3.1 FlashMiniMaxAI GatewayMiniMax M3.1 Flash is an open-weight multimodal model for coding and agentic work, with a 1M-token context window for long documents and multi-step agent sessions.Compared with earlier MiniMax models, M3.1 Flash improves on complex agentic tasks, coding, and cybersecurity. On the agent side, that covers multi-step business processes and computer use that carries a task from one application to the next. For coding,

<p><strong>Release:</strong> <a href="https://github.com/simonw/llm-tools-datasette/releases/tag/0.1.1">llm-tools-datasette 0.1.1</a></p> <p>When I switched LLM over to <a href="https://github.com/pydantic/httpx2">httpx2</a> in <a href="https://llm.datasette.io/en/stable/changelog.html#v0-33">LLM 0.33</a> I forget that this would break any plugins which used <code>httpx</code> without directly depending on it. <cod...

<p><strong>Release:</strong> <a href="https://github.com/simonw/llm-echo/releases/tag/0.5">llm-echo 0.5</a></p> <p>I'm working towards a new <a href="https://llm.datasette.io/">LLM</a> release, and testing PRs caused me to revisit the <code>llm-echo</code> debug plugin. This plugin provides a "model" which doesn't involve an LLM at all - it just repeats back the prompts that have been fed to it. The new release now updates the si...

OpenCode reported a breach affecting Console users with linked AI providers. Here is what the vendor has said, and how to find OpenCode on your developer machines.

now have a that groups requests into sessions and shows how session affinity routed each one. Each row shows the or app that ran the session, such as Claude Code, Codex, or Cursor, along with its cost, models, providers, and how much of its input was cached across every turn.AI Gateway logsSessions viewcoding agentOpen a session to see its cache hit rate, duration, and path. The path lists each turn with its model and timing, and names the provider serving the session along with any earlier ones

Reachable CVEs can still be safe in your app. See how reachability vs exploitability analysis helps you decide which dependency vulnerabilities to fix first.Category: News

<p><strong><a href="https://leanrada.com/notes/inline-rendering-currentscript/">Inline rendering with document​.currentScript</a></strong></p>Lean Rada describes a neat trick that takes advantage of the <a href="https://developer.mozilla.org/en-US/docs/Web/API/Document/currentScript">document.currentScript</a> property. You can use that to drop in a tiny inline <code><script></code> element that replaces itself when the p...

<p><strong>Release:</strong> <a href="https://github.com/simonw/web-edit/releases/tag/0.1a2">web-edit 0.1a2</a></p> <p>web-edit (<a href="https://simonwillison.net/2026/Oct/12/web-edit/">previously</a>) is my tiny web app for browsing and editing files in a folder. I mainly built it for editing files on different machines via Tailscale.</p><p>I added a "copy to clipboard" option for both text and image data. I needed this because...

Void は VoidZero が開発した、Vite でフルスタックアプリを構築して Cloudflare にデプロイするためのツールキットです。void/db などの import から必要なリソースを推論し、void deploy コマンド 1 つでD1 データベースの作成、ビルド、マイグレーション、公開までを行います。この記事では、D1 を使ったメモアプリを React で構築し、Cloudflare にデプロイするまでの手順を紹介します。

is now available on .DeepSeek V4.1 Flash 1017AI GatewayDeepSeek V4.1 Flash 1017 is a minor update to that improves reasoning, coding, agentic tasks, and image understanding.DeepSeek V4.1 FlashThe coding gains show up in terminal work and in building and editing whole repositories, and the agentic gains in multi-step automation. With images, the model reads charts and handles visual reasoning more accurately when it can call tools.DeepSeek V4.1 Flash 1017 also finishes tasks faster and with short

<blockquote cite="https://claude.dev/blog/solving-code-review-at-anthropic/"><p>We think "did a human read the code?" is an imprecise proxy for "what could go wrong with this change, and which check—automated or human—is the right one to catch it?"</p><p>Asking that question also changed <em>when</em> review happens. Before, review was a gate at the end of the road: write the code, open a PR, wait for your colleague.</p><p>Now, review runs continu...

We compare the top Escape.tech alternatives for offensive security in 2026: Aikido Security, XBOW, RunSybil, Terra, Burp Suite Professional, Invicti, StackHawk, Hadrian, and PenteraCategory: DevSec Tools & Comparisons

We compare the top Horizon3 alternatives for AI pentesting in 2026: Aikido Security, Pentera, RidgeBot, XBOW, Hadrian, RunSybil, and Terra Category: DevSec Tools & Comparisons

Cloudflare is acquiring Deno’s team, which will provide another year of bug fixes and security updates before ending support for the runtime.

NGINX Gateway Fabric 2.8 adds AccessPolicy, which allows or denies traffic to a Gateway or route by client IP address. Passive health checks in UpstreamSettingsPolicy let you decide how many failed attempts take an upstream server out of rotation and for how long, and cookie-based session persistence now works on NGINX Open Source. NGINX Gateway […]

Identity alone doesn't guarantee a bot will behave responsibly. We are introducing a system to continuously evaluate whether Verified bots honor site preferences, like robots.txt and HTTP 429s, ensuring they remain accountable over time.

TanStack AI is a strongly typed set of libraries for adding AI features to your apps. Part 1 of this intro covers basic setup and prompting, streaming responses, persisting threads to your database, and resuming a response after a mid-stream refresh.

Tiny Little OfficeThis is really smart. It's a word processor, along with other common office software like spreadsheets, but it's completely URL powered.Introducing the Accessible Components LibraryYou could not be in better hands than with TetraLogical and they've produced a really good collection of common components, all with thorough documentation, accessibility requirements and testing scenarios.we were onlineSomething we've certainly noticed about this particular morale-draining era is th

What can digital transformation teach us about AI adoption? Paul Boag revisits his book Digital Adaptation to show how lessons from the past can help organizations navigate the challenges of AI today.

Agents already shop on the web, but they often use pages and tools originally built for people and search engines. Building a better shopping experience for agents means treating them as first-class shoppers, with product information they can read directly and tools designed for agents to shop.Today, , our open source storefront template for , is generally available. Teams can launch storefronts optimized for how people, search engines, and agents interact with them.Vercel ShopNext.jsShopifyVerc

Maybe we can get back to an img-based icon system?

The Bytecode Alliance is pleased to invite you to the next installment in our ongoing Plumbers Summits event series, each designed to bring our members and community together to collectively contribute to the strategic planning for the upcoming year. Our next event will be held Wednesday October 28, 2026. This will be an all online event, supporting full remote participation for anyone anywhere, with sessions recorded so they can be watched anytime afterward via our YouTube channel

HighlightsSeveral core rules have been updated to report more linting problems.no-use-before-defineThe no-use-before-define rule has been updated to account for the fact that IIFEs execute immediately by treating them as part of the execution context where they are defined and called.This change can produce more linting errors in cases such as the following:/* eslint no-use-before-define: ["error", { variables: false }] */(() => { console.log(foo); // 'foo' was used before it was defined.})()...

is now available on AI Gateway. The visual reasoning model accepts images and video to follow objects through motion, interpret spatial relationships, and connect an action to its physical consequences.Glimpse from ElorianGlimpse can return to visual evidence as it works: zooming into a detail, revisiting a short interval of video, or tracking the same feature across frames. This allows the model to support use cases like scientific chart analysis, video captioning, visual counting, and robotics

and are now available on . Both are multimodal for classifying content, routing requests, and scoring text, structured records, and images.Perplexity Decider V1.2 27BDecider Flash V1.2 4BAI Gatewaydecision modelsThe models answer typed questions with probabilities. Boolean questions return the likelihood of yes, Choice questions select from categories you define, and Score questions assess content against an ordered rubric. Your application can use those results to route a support ticket, flag a

, previously available in stealth as , is now available on . Beam is free to use for a limited time during the launch period when serviced by Reflection AI.Beam from Reflection AIAI Gatewaystealth/cat-jamBeam is an low latency US open-weight reasoning model for coding and agentic tasks, with . Beam supports and , with a 1M-token context window for code, documents, and conversation history. Reasoning effort is adjustable. Beam is designed for speed, activating only 23B of its 501B parameters per

NGINX Ingress Controller 5.7 speaks HTTP/2 to your upstream services, set per upstream or picked up from a Service’s appProtocol. An Opaque Secret now works anywhere a TLS, CA, htpasswd, or API key Secret does, so you can use a Secret created by other tooling as it is. HTTP-01 challenges from cert-manager complete on hosts […]

<p><strong>Tool:</strong> <a href="https://tools.simonwillison.net/chirp-pong">Chirp Pong</a></p> <p>Another game experiment - I wanted to see if it was feasible to have a two player game on two separate phones running in static HTML where the networking code uses chirps sent via the microphone. It seems to work!</p><blockquote><p><code>Build a two player competitive pong like game where two players use their phones close to each...

AI, agents, voice, and physical controls are shifting software development from operating tools to expressing intent—and helping developers stay focused on building.The post The next developer interface is ambient intelligence appeared first on The GitHub Blog.

Put native GitHub features to work to review outside collaborator access and archive stale repositories.The post Staying Evergreen: How we automated secure access and repo hygiene in a shared org appeared first on The GitHub Blog.

Cloudflare Gateway and Data Loss Prevention have inherited the flexibility and power of Cloudflare Workers through our full-stack integration with the Cloudflare Developer platform.

For a decade, Vercel has shaped how the web is built. Now, we’re doing the same for agents. The companies that win the next decade will build on infrastructure designed for agents from the start, and thousands of people gathered across London, Berlin, New York, Sydney, and San Francisco to do just that at Vercel Ship 2026.Guillermo Rauch (CEO, Vercel) opened Ship SF with a vision for the next era of software and agentic infrastructure: interfaces generated for any task in front of you, agents th

記事は ics.media へアクセスしてご覧ください。

Anthropic’s free OSS Scanner uses Mythos and other Claude models to find open source vulnerabilities and send maintainers reports with proposed fixes.

Introducing Void: an open-source SDK, CLI, and self-hosted platform for building full-stack Vite apps and deploying them to Cloudflare.

<p><strong><a href="https://www.ft.com/content/11632d03-358c-454b-af95-d06d4072932b?syn-25a6b1a6=1">Anthropic tells investors quarterly revenue up nearly 50% to $16.8bn ahead of IPO</a></strong></p>The phrase "told investors" appears four times in this FT article, which reports on Anthropic's day of hosting investors on Wednesday. Lots of details in here from "<a href="https://simonwillison.net/2023/Nov/22/deciphering-clues/#hints-to-look-out-for">peopl...

How Cloudflare and OpenAI are working together to help AI find useful content, keep up with changes, and make fewer wasted requests — making the experience better for users and website owners alike.

AI Gateway Production Index — October 2026Every month, routes tens of trillions of tokens between production applications and AI labs. That traffic gives us a view of what AI usage actually looks like in today's enterprise, and we publish it here monthly. See the Production Index reports from , , and .AI GatewayJulyAugustSeptemberIn August, open-weight models processed the majority of AI Gateway token volume for the first time. The money is now following. Open weight’s share of spend has more th

AI adoption in the enterprise is growing rapidly, and expanding beyond engineering users. In the last three months, token usage by enterprise companies on AI Gateway has quadrupled, and that from August 2025 to June 2026, non-developer Codex users grew 189x. OpenAI recently reportedOur customers call these builders citizen developers. They know their part of the business better than anyone else, and with AI they can create the software they need to ship work faster and deliver better customer ex

Agents often handle complex work that continues across runs. As that work evolves, they may need a new environment with different tools, runtimes, or compute. They should be able to continue working with the same files when they change environments.We built to keep an agent’s files independent of its execution environment. It is now generally available for . Agents can mount the same drive in a new environment configured for the next task and continue where they left off.Vercel DrivesVercel Sand

Last year, we expanded for Python and TypeScript backend frameworks. By this summer, developers could deploy their frontend and backend together with and coordinate background work with and .zero-config supportVercel Servicesqueuesdurable workflowsToday at , we are expanding the backend workloads you can run on Vercel. Python on Vercel is now generally available, enables custom runtimes and system libraries, and we are introducing in Public Beta for background workers that pull work and stay run

Python on Vercel is now generally available. Build and run Python applications with the frameworks, libraries, and tools you already use.Vercel automatically detects supported frameworks and configures the build and deployment. Your applications run on Fluid compute, which manages concurrent requests and scales with traffic. Idiomatic Python SDKs let you work with storage, queues, durable workflows, and AI models directly from Python. For full-stack projects, the Python backend and frontend shar

Vercel Token Pass is now in early access for Pro teams. For $30 per month, your team gets $80 in monthly credit for GLM 5.3 and Kimi K3, with more models to come.Use Token Pass with coding agents such as fx, Command Code, and Pi, or build your own personal agent with the AI SDK. Token Pass runs through , so you can choose your tools and switch between included models using your team’s shared credit.AI GatewayToken Pass has enabled by default. Requests run through selected providers with inferenc

is now in public beta, allowing you to run long-running processes that pull and execute work from , databases, or third-party systems without requiring an HTTP server:Vercel DaemonsVercel QueuesDaemons run containers on Fluid compute and deploy alongside your app in the same project. Vercel builds your image and maintains the instance count you configure in each region, restarting instances that exit or crash.Get started by packaging your application and dependencies in a Dockerfile or Container

<p><strong>Tool:</strong> <a href="https://tools.simonwillison.net/latex">LaTeX renderer</a></p> <p>Inspired by Paul Ford and Aboard Foundary's new web app <a href="https://tinylittleoffice.com/">Tiny Little Office</a>, which provides a suite of web app content editors (a Word Processor, Outliner, Presentation Builder, Spreadsheet, Calculator, Drawing Tool, Diagram Maker, Animator, Calendar, and Trip Planner).</p><p>Tiny Little O...

こんにちは。社内のセキュリティ業務にAIを取り入れる業務を担当している、Security Development Division（LINE Plus Security R&D）チームです。この記事は...

こんにちは。私たちはLINEヤフー株式会社で言語処理モデルを開発しているプロジェクトチームです。LINEヤフーでは、さまざまなサービス（例：Yahoo!ショッピング、Yahoo!検索、Yahoo!知恵...

GitHub Actions でタグやブランチを参照すると、ワークフローを変更しなくても実行するコードが変わる可能性があります。Workflow dependency lockfiles を使うと、読みやすいタグ表記を残しながら依存先をコミット SHA に固定できます。この記事では GitHub Actions の依存関係を lockfile で固定する方法を紹介します。

Astro 7.4 adds a --timings flag that shows where your build spends its time, separate build and runtime image services, a notFound() handler for custom entrypoints, and experimental parallel prerendering and custom redirect pages.

This release adds the sideEffectsCache.exclude setting, stops pnpm install from waiting on the daily update check, and keeps pnpm from aborting with a core dump when the reader of its output exits.

This release stops pnpm publish from sending a CI identity token to a registry it was not issued for. It also fixes installs that dropped a dependency also declared as an optional peer, and accepts empty httpProxy and httpsProxy settings again.

is now available on AI Gateway. It is a multimodal decision model for classification, routing, and scoring across text and images, including visual defect inspection and checking damage claims against customer photos.d1-ultra from Liquid AIRather than generating text, d1-ultra returns structured answers with probabilities. Ask a Boolean question to get the probability of a yes/no answer, use Choice to select among named categories, or use Score to rate an ordered scale. You can ask multiple ques

is now available on AI Gateway. The open-weight reasoning model is designed for coding and agentic workflows, including multi-file refactoring, debugging, and understanding large codebases.Muse Spark Open from MetaMuse Spark Open supports text and image input with a 1M-token context window, allowing agents to work with code and screenshots in the same request. It is available with and no training, without creating separate provider accounts.ZDRUse as the model name across all API formats and cod

now supports , allowing connectors to reach providers with IP allowlists, such as Salesforce and Snowflake.Vercel ConnectSecure ComputeWith Secure Compute routing enabled, Connect’s provider requests use the selected network’s dedicated static IP addresses instead of Connect’s shared IPs. Requests to obtain and refresh access tokens follow that route; your app’s direct API routing is unchanged by this setting. Credential management stays the same, so you don’t need to store long-lived provider s

is now available on as a stealth model, free to use during the stealth period.Cat JamAI GatewayCat Jam is a reasoning model for coding and agentic tasks, with low-latency inference. It supports , so agents can connect it to your own tools, and that follow a JSON schema you supply. Responses include the model's reasoning text alongside the answer. Cat Jam takes text input only. Cat Jam supports , , , , and reasoning efforts.function callingstructured outputslowmediumhighxhighmax (ZDR) is not avai

is now generally available for on Hobby, Pro, and Enterprise.Vercel DrivesVercel SandboxA Drive is persistent storage that you mount as a directory in a Vercel Sandbox. Its files remain available after the sandbox stops, so later runs and other sandboxes can access them by mounting the same Drive.Use Drives to preserve an agent’s workspace or file-based memory across runs, or to make datasets, models, dependencies, and build artifacts available across sandboxes.You can also fork a Drive into ind

Enterprise teams can now run Vercel Functions in their own AWS account with (BYOC). With BYOC, your function code and execution stay inside your security and compliance boundary. Vercel continues to handle deployments, environments, routing, and static assets.Bring Your Own CloudDuring deployment, you provision functions in your AWS account and Vercel serves everything else. You keep control over function execution with your own IAM permissions, network access, and resource lifecycle policies.Wi

now supports in public beta. Your apps and agents can access supported services on behalf of signed-in users without separate consent prompts for each service.Vercel ConnectEnterprise-Managed Authorization (EMA)Here's how access works:If your app uses , you can request a token for with the signed-in user’s identity:Vercel PassportSlack’s Model Context Protocol (MCP) servertype: embedded-entry-inline id: 1T9cFkjaRDDmRFQ5bWVmD6Connect supports , including its use for MCP authorization through EMA.

now supports MCP Events in public beta, allowing your apps and agents to subscribe to webhook events from compatible MCP servers. Build agents for tasks like summarizing new messages, reviewing newly created issues, or responding to document feedback.Vercel ConnectConnect creates subscriptions on the MCP server and renews them automatically as needed, verifying the server’s webhooks and forwarding events to your application using authenticated delivery.You can use the Connect SDK to subscribe to

is now a first-class language and runtime on Vercel. Build APIs, full-stack applications, and AI agents with native Python SDKs and a shared development and deployment workflow for your Python backend and JavaScript frontend.PythonVercel handles the infrastructure so you can focus on your application:Within your application, Python SDKs let you build agents, run untrusted code, and orchestrate durable workflows.Use the SDKs individually or combine them in the same Python application.For full-sta

is now available on .Jev 1.14 from TypeSafe AIAI GatewayJev is a for software. You pass it state and a set of questions, and it returns typed Choice, Score, and Boolean answers with probabilities instead of free-form text. It answers every question in one request, in parallel, for classification, routing, scoring, and automated verification.decision modelJev 1.14 accepts images as part of the state, and has an experimental long-context mode for documents, logs, or conversation histories that are

Knowing where traffic comes from can help you decide where it goes. NGINX Open Source 1.31.7 brings GeoIP2 and GeoLite2 database support to the existing native GeoIP modules, giving users a straightforward path to current geolocation data. This release also adds modern HTTP/2 prioritization, improves reloads and binary upgrades for BPF-enabled QUIC deployments, and includes […]

<p><strong>Tool:</strong> <a href="https://tools.simonwillison.net/tree-appreciator">Tree Appreciator</a></p> <p>Another game experiment with Claude. This one used the default Claude iPhone app (chat mode, not Claude Code mode), where I prompted Claude Opus 5.5 Max with:</p><blockquote><p><code>Build a three js game called "Tree appreciator" - it shows you two algorithmically generated trees and the game mechanics is about apprec...

When strikes hit Yandex data centers, many assumed Russian bot operations went dark. Cloudflare data reveals that while search crawling stopped, malicious bots simply migrated to other networks.

In September, we experienced two incidents that resulted in degraded performance across GitHub services. The post GitHub availability report: September 2026 appeared first on The GitHub Blog.

Our new repo star history API now provides trends without returning individual identities or requiring unbounded database work. These are the engineering tradeoffs we made.The post From 2,500 requests to 24: Rebuilding star history without the stargazers appeared first on The GitHub Blog.

Deno is joining Cloudflare & winding down its investment in the runtime. We're all better off because of its existence.

On Front Lines’ Early Adopters: CISO podcast, Andrew Becherer shares lessons from Datadog, weighs the long-term costs of AI-built tools, and explains how founders can actually gain a CISO’s trust.

<p><strong><a href="https://popcar.bearblog.dev/ai-is-mass-decompiling-games-thats-both-awesome-and-scary/">AI is mass decompiling games. That's both awesome and scary.</a></strong></p>Indie game developer Popcar talks about the recent wave of AI-powered decompilation of existing games, enabling weird mashups between existing games, and producing a boom in game preservation projects to get old games working on new hardware (often in a browser using W...

Scrollspy navigation used to mean IntersectionObserver and a pile of JavaScript. With scroll-target-group, :target-current, and a little anchor positioning, a plain list of anchor links can highlight the current section all on its own.

Yoav Weiss makes a good point: “WebMCP is Agentic WebPerf”. I’ve seen both pushback to WebMCP in the form of “websites should just be better, or agents should be smarter, there shouldn’t be alternative paths to using them built.” And I’ve seen plenty of excitement for WebMCP in the form of “ooooo AI droolface”. But […]

Socket for Origin scans dependency changes in pull requests and flags security risks based on your team’s policies. Now available in Cursor’s App Marketplace.

While adding MySQL support to Hyperdrive, we found a subtle protocol bug when caching query results. Here is how we tracked down a 0.001% rate error and made Hyperdrive MySQL generally available.

vlt v1.4.0 brings the global store to macOS for up to 3x faster installs on Node 26, plus a new --save-types flag.

This major release brings Shadow DOM support, a refreshed theme built on design tokens, a unified AI experience, Trusted Types support, and simpler error handling.