We dive into these questions and other AI hot takes on the latest episode of the GitHub Podcast.The post Should you read the code, is RAG dead, and did Skills kill MCP? appeared first on The GitHub Blog.

<p><strong><a href="https://blog.cypressf.com/post/828067789747208192/the-creative-spirit-of-who-framed-roger-rabbit">The Creative Spirit of Who Framed Roger Rabbit</a></strong></p>I love <a href="https://en.wikipedia.org/wiki/Who_Framed_Roger_Rabbit">Who Framed Roger Rabbit</a>, the 1988 movie by Robert Zemeckis. I haven't watched it in quite a few years, and Cypress Frankenfeld just pointed out this sequence from early in the movie:</p>&lt...

You’ll miss publishers when they’re goneYet again, the industry has been let down by DigitalOcean and their abandonment of CSS-Tricks. It's time to step up and protect publishers whose goal is simply, to educate and share knowledge.It’s official: Airline websites are slow, but they don’t have to beThe great folks at Calibre just don't miss. Another great deep-dive.Gigs worth leaving the house forNothing sounds good is a great service and they've expanded with this immense resource for finding gi

You can just prove things, apparently.

is now available on AI Gateway.GLM 5.3 FlashXGLM 5.3 FlashX is a high-speed serving option for Z.ai's multimodal coding model, delivering inference at ~200 tokens per second for faster streamed responses.The higher serving speed is useful for coding agents, tool loops, and interactive applications where users wait on generated output.Use across API formats and in coding agents:zai/glm-5.3-flashxTo use it in a coding agent, see the , then run to create a key and configure your supported agents. S

<p><strong><a href="https://blog.rust-lang.org/2026/09/17/targeted-attacks/">Be alert: targeted attacks on prominent Rustaceans</a></strong></p>Important warning from Adam Harvey and the crates security team:</p><blockquote><p>We believe that there is an ongoing campaign targeting rust-lang members and owners of popular crates that is attempting to compromise devices and accounts in order to use them to publish malware.</p><p>A v...

<p><strong><a href="https://sockpuppet.org/blog/2026/09/17/how-to-write-with-an-llm/">How To Write With An LLM</a></strong></p>Thomas Ptacek on using LLMs as copyeditors, not as writing assistants:</p><blockquote><p><strong>Rule Number One: You may not use a single word an LLM suggests to you.</strong></p><p>[...] I think that as a form of intellectual personal protective equipment you should adopt the rule that any s...

Jake has a very nice, clear video about what text-box solves in CSS. It essentially makes even padding on an element (like a button) doable without magic numbers, and that will work across any font (sick). Temani made a tool to help pick the right values.

The best on-prem AI pentesting tools of 2026 for regulated teams, compared on air-gap support, whitebox depth, and application coverageCategory: DevSec Tools & Comparisons

You and your agents can now deploy static artifacts to Vercel in under one second through Vercel CLI. Run to share a prototype, publish an HTML report, or preview a page created by your coding agent. vercel deployVercel automatically detects eligible deployments, and valid artifacts will skip the build step, immediately returning a live URL.Instant deployments support directories with: Supported file extension include , , and .html.htm.md.Update to Vercel CLI version or later to get started, and

<p><strong><a href="https://alignment.openai.com/misalignment-reports/self-generated-prompt-injections-in-compaction-summaries/">Self-generated prompt injections in compaction summaries</a></strong></p>In <a href="https://openai.com/index/model-misalignment-reporting-framework/">Our framework for reporting model misalignment</a> OpenAI provide "six reports on unexpected or concerning model behavior we’ve observed in the last six months". This one ...

You can now opt into Turbo build machines on any individual deployment. This is useful when you need to increase resources temporarily without changing project settings. You can do this in three ways:Learn more in the .managing builds documentationRead moreInclude in your Git commit message before pushing to GitHub#VERCEL_BUILD_MACHINE=TURBOUse (Vercel CLI 59.20.0 or later)vc deploy --turboSet to when creating a deployment with buildMachineturbothe REST API

You can now run Harbor evals on Vercel Sandbox. is the open-source harness behind , whose registry includes many other benchmarks such as SWE-bench, tau3-bench and OSWorld. Pass to and each trial executes in its own isolated Firecracker microVM, so you can parallelize far beyond what your local machine is capable of. HarborTerminal-Bench--env vercelharbor runA task's network policy is enforced at the sandbox firewall, outside the VM. Optional credential injection attaches secrets to matching out

adds as an install source for agent skills [email protected] skills databasesNotion skills are reusable agent skills written as Notion pages. Teams author, review, and update them in the workspace they already use, then install them into any agent the skills CLI supports. No Git repository required.To browse your Notion workspace's skills, run:The CLI lists the skill packs shared with you and installs every skill in the packs you select.To install a single skill, pass its Notion page URL:Both

Operators behind PolinRider used a compromised GitHub account to plant malware in four development versions of a Packagist package with 700,000+ downloads.

AWS has recognized Aikido with its Security Competency for Application Security, validating how Aikido secures applications from code to cloud to runtime.Category: Product & Company Updates

Now that we can better customise <select> elements, it's only natural to side-eye other form <input> types that have caused us visual headaches.Sure, we should be applying the lightest of touches to form elements, especially, but even with a bit of visual-massaging, checkboxes are limited, aside from a bit of accent-color.See the Pen Standard checkbox with accent colour by Andy Bell (@piccalilli) on CodePen.There is a brighter future incoming, if you're to read the spec:The ::checkma...

Our Safari release notes have never been as long as they are for this version.

AI Gateway Production Index — September 2026Every month, routes tens of trillions of tokens between production applications and AI labs. That traffic gives us a view of what AI usage actually looks like in today's enterprise, and we publish it here monthly. See the Production Index reports from , , and .AI GatewayJuneJulyAugustThe September index reports on AI Gateway data collected through August 2026.Special report: on September 3OpenAI launches AstraIn August, open-weight models ran 56% of al

A rewrite this size wasn't affordable before agents. Here's what porting the Copilot agent runtime to 800,000 lines of production Rust actually took.The post Migrating the GitHub Copilot runtime to Rust, using Copilot appeared first on The GitHub Blog.

Agents re-derive your project structure every time they scaffold a library. Encode it once as a local Nx generator and let the agent invoke it instead.

is now available on AI Gateway. GPT-Live 1 from OpenAIGPT-Live 1 is a full-duplex voice model and can listen and speak at the same time. Many voice models use turn detection to respond. Full duplex removes that boundary, so a user can pause, interrupt, or add detail while GPT-Live is speaking.GPT-Live 1 also supports client delegation. Client delegation lets you choose the background model independently from GPT-Live 1. A basic session runs only the voice model. When deeper work is needed, your

You can now connect native Marketplace resources to . Previously, resource connections could only target production, preview, and development environments.custom environmentsChoose custom environments when connecting a resource from the Vercel dashboard, Vercel CLI, or REST API. Vercel scopes the environment variables created by the connection to the selected environments.For example, from the CLI:Existing deployments do not change. Create a new deployment after connecting a resource or changing

<p><strong>Release:</strong> <a href="https://github.com/simonw/datasette/releases/tag/1.0a40">datasette 1.0a40</a></p> <p>Same security fix as <a href="https://simonwillison.net/2026/Sep/16/datasette-2/">0.65.5</a>, plus some neat new features and bug fixes:</p><ul><li>Plugins can now launch and manage <strong>background tasks</strong> using the new <a href="https://docs.datasette.io/en/latest/internals.html...

<p><strong>Release:</strong> <a href="https://github.com/simonw/datasette/releases/tag/0.65.5">datasette 0.65.5</a></p> <p>Security fix for an issue where a trailing newline in a requested table name could bypass table permissions and expose private rows, reported by <a href="https://github.com/dpfkdlemtp">dpfkdlemtp</a> in <a href="https://github.com/simonw/datasette/security/advisories/GHSA-h547-rmjf-5m2m">GHSA-h547-rmjf-5m2m</a&g...

The best Qodo alternatives for AI code review in 2026, compared across noise, security, and cost, so you can pick the tool that fits your team.Category: DevSec Tools & Comparisons

A modern storefront can look healthy while malicious JavaScript quietly siphons revenue, hijacks clicks, or rewrites analytics. See how Cloudflare's machine learning models surface evasive client-side attacks for analyst investigation.

GitHub Actions now supports cache-mode, a least-privilege control on the Actions cache aimed at the cache poisoning technique behind recent compromises.

It's an interesting and potentially useful trick to have an element know where it is on a grid. That's tricky enough when the items are in one row/column, but what about when they span?

<p><strong><a href="https://claude.com/blog/cowork-is-now-claude">Claude Cowork and chat are now one Claude</a></strong></p>In hopefully good news for anyone who, like me, was increasingly confused at Cowork v.s. Claude v.s. Claude Code:</p><blockquote><p>Starting today, Claude Cowork and chat are merging into one Claude. Bring a quick question, or hand over a report due at noon, and Claude takes it from there, even after you’ve closed your ...

Hobby projects now retain fewer deployments past the 30-day retention window. Hobby teams get 10GB of . Every deployment you keep uses some of it, and going over the limit can block you from deploying until you free some up. for Hobby teams now deletes old deployments sooner, so dormant projects stop holding storage that your active projects need.Deployment StorageDeployment RetentionEach Hobby project now keeps its 3 most recent production deployments, plus its 3 most recent deployments of any

Builds using or now start 64% faster, with the average time from deployment creation to build start dropping from 6.7 seconds to 2.4 seconds.Secure ComputeStatic IPsPreviously, each build waited for a new build container to boot with its network configuration. These builds now use prewarmed build containers, with your network configuration attached when the build starts.The improvement is applied automatically to builds using Secure Compute or Static IPs, with no configuration changes required.L

is now available as a native integration on the , giving your AI agents and apps long-term memory. Mem0 remembers user preferences, facts, and context across sessions, so your app stops starting from scratch.Mem0Vercel MarketplaceTo see it end to end, deploy the , an eve agent with long-term memory powered by Mem0.eve Memory Agent templateGet started with on the Vercel Marketplace or through the , available to customers on all plans.Mem0Vercel CLIRead moreInstall from the Marketplace with integr

<blockquote cite="https://mustafa-suleyman.ai/a-warning-about-model-welfare"><p>We should not treat models as though they have feelings, preferences, rights, or any entitlement to our welfare. Consciousness is the foundation of our ethical, legal, and political systems. To invite another entity to share any flavor of these rights isn’t justified by the evidence and will make the AI containment and alignment challenge even harder.</p></blockquote><p class="cite">&am...

記事は ics.media へアクセスしてご覧ください。

Compare the best Aqua Security alternatives in 2026: Aikido, Wiz, Prisma Cloud, Sysdig, Orca, and CrowdStrike, on coverage, deployment, pricing, and fit.Category: DevSec Tools & Comparisons

Last month, I was at long last granted ✨ permanent residency ✨ in Japan. This is something I've been working towards for a long time, so I'd like to share the whys and the wherefores behind it all.I pursued permanent residency in Japan because, simply, I'd lived in Tokyo for a year before (as an English teacher, straight out of university) and really liked it, so wanted to come back and set up roots there properly. I felt it had great access to healthcare, dependable public transport, and reason

Despite broad browser support, container queries remain surprisingly underused and frequently misunderstood. Let’s look at how they differ from media queries, when to reach for each, and how container queries help reusable components respond naturally to the contexts in which they appear. - CSS - Tools - Techniques

Two XSS vulnerabilities are now resolved in v48.5.1 and LTS Edition v47.7.4. Updating highly recommended.

From Nobody Wants to Die - a detective replaying a reconstruction of what actually happened. The machine rebuilds the evidence; deciding what it means is still his problem. Yesterday I spent most of an afternoon chasing the wrong root cause, with total, semi-earned confidence, straight past the evidence pointing at the right one. The bug came in looking like pollution of a global namespace. And my brain took one look at it and said: I know this one. It had a shape I recognised - something is ove

Google has been working on new metrics to measure how ads impact performance. Learn how you can view this data for real visitors and how to check it yourself in Chrome DevTools.

is now available on .Jev from TypeSafe AIAI GatewayJev is a probabilistic decision model for software: state goes in, typed Choice, Score, and Boolean answers come out.Regular language models generate text one token at a time, which the application then parses and validates. Jev evaluates all declared questions in parallel and returns typed answers plus probabilities directly. That removes unnecessary text generation and makes it straightforward to automate clear cases while routing uncertain on

reports now let you view your checks through one of four site types: Docs & content, Business, App, or Commerce.Is AgenticFor example, the Commerce view highlights payment and checkout standards like x402, UCP, and ACP, while the App view highlights API discovery, authentication, error handling, and SDK support.Your score stays the same in every view, and you can change views on an existing report without rescanning. Only the highlighted checks change, so you can focus on what matters for yo...

<p><strong>Tool:</strong> <a href="https://tools.simonwillison.net/gemini-live">Gemini Live audio</a></p> <p>Google released <a href="https://blog.google/innovation-and-ai/models-and-research/gemini-models/gemini-3-8-live-gemini-3-8-live-extended-thinking/">Gemini 3.8 Live and 3.8 Live Extended Thinking</a> today - two new speech-to-speech models that are a similar shape to OpenAI's <a href="https://openai.com/index/introducing-gpt-live/"...

Note: Written by a human. In blog diagram graphic made by AI. NGINX processes HTTP requests in phases. Each phase is designed for specific actions and decisions on the qualities of the request. However, reading of various parts of the request is spread out through multiple phases. A HTTP request consists of several distinct parts. […]

Love these little animations (“code snacks”) from Lauren Basser that illustrate basic technological concepts. Check out the ones for Working Directory and Shadow DOM — not the easiest concepts to illustrate as simply as this!

TanStack Redact は、React のコンポーネントや Hooks の書き方を引き継ぐ軽量ランタイムです。同期描画を採用しており、React と同じ API があっても動作が異なる部分があります。この記事では基本的な導入方法と設計思想を説明し、同じ商品一覧を React と Redact で動かし、startTransition の動作の違いを確かめます。

Cloudflare is giving site owners a way to stay discoverable while disallowing AI training. New controls and an Accountable designation establish a shared model with Apple, Google, and Microsoft.

You can now scope access to individual Workers and assign narrower Developer Platform roles, so teammates, CI tokens, and agents get only the access they need to debug, deploy, or monitor safely.

Since 1.0, vlt has shipped install-speed wins, security hardening, and quality-of-life CLI fixes.

Delphi on VercelThe backend slowed every changePreview deployments are how agents check their work10 engineers with no dedicated infrastructure roleEveryone ships code, including product and design100+ production deploys a day behind feature flags builds digital minds. They capture what someone has written, recorded, and taught, so anyone can tap that expertise on demand. Delphi is “a destination where you can find and interact with interesting minds,” says founding engineer Spencer Schoeben.Del

こんにちは。Yahoo!検索のフロントエンドエンジニアの山本です。普段は Yahoo!検索の開発と運用を行っています。そのかたわら、Coding Agent を使った開発自動化と AI 活用、チームへ...

Introducing Rails Hyperdrive: a development-only Rails engine that gives AI coding agents live answers from your booted app and lets any gem in your bundle ship guidance gated to your Gemfile. Convention over configuration, applied to agent knowledge.

Last September, the Servo project announced that long-time maintainer Josh Bowman-Matthews (@jdm) would work part-time on improving the Servo contributor experience, entirely funded by the monthly donations on OpenCollective and GitHub.In his own words, here is a look back over the past year!First of all, I am enormously grateful to everyone who financially supports Servo, as those donations have enabled me to devote significant time to a project that I care a lot about.Some highlights from that

and from Google are now available on AI Gateway.Gemini 3.8 LiveGemini 3.8 Live Extended ThinkingBoth models support real-time spoken interactions for voice assistants, conversational experiences, and applications that respond through audio.Use either model through the AI SDK's realtime API. Install the Gateway provider and a WebSocket client:Mint a short-lived token, open the WebSocket, and use the model adapter to serialize and parse realtime events:See the for more details on realtime events a

The now supports authenticating harnesses through their native subscriptions, where the underlying harness supports them. The harness layer runs different coding agents through the same interface, so you can switch agents without changing your application code.AI SDK harness layerHarnessAgentNo code changes or new settings are required. The authentication mode uses explicit provider environment credentials when they are present, and otherwise a native subscription found on the host. The default

<p><strong><a href="https://bcantrill.dtrace.org/2026/09/13/the-contagion-of-fear/">The contagion of fear</a></strong></p>Bryan Cantrill responds to the <a href="https://x.com/hilbertspaess/status/2097476203863224394">tweet by former Anthropic employee Jacob Coxon</a> confirming that many Anthropic researchers believe AI "could kill us all by the end of the decade".</p><p>Bryan shares a story of his own youthful mistakes causing unjust...

<p><a href="https://lobste.rs/s/lbavmm/what_blog_posts_influenced_your_thinking#c_4fxnwn">My comment</a> on <a href="https://lobste.rs/s/lbavmm/what_blog_posts_influenced_your_thinking">What blog posts influenced your thinking the most?</a> — Lobste.rs.</p><p>An early Joel Spolsky one for me was <a href="https://www.joelonsoftware.com/2002/11/11/the-law-of-leaky-abstractions/">The Law of Leaky Abstractions</a>. I read that near the...

Allow myself to introduce... myself.

The new CSS progress() function maps a given value to a range. Super useful for responsive layouts, responsive typography, and fun tricks.

Version 3.8 of the Toolbox App restores keyboard navigation in project and tool lists. On macOS, manual IDE updates stay available even when the system reports the installation directory as protected. IDE updates remain available on macOS macOS was sometimes incorrectly reporting an IDE installation directory as non-writable, causing the Toolbox App to needlessly disable […]

Dependabot vs Renovate compared on setup, monorepos, platforms, and security, plus why auto-updating misses what's actually exploitableCategory: DevSec Tools & Comparisons

<blockquote cite="https://seldo.com/posts/we-are-all-product-engineers-now/"><p>The cost of writing code collapsed, and the cost of reviewing, fixing and operating it is following, and I'm assuming it gets there. What's left of making software is finding out what people actually want, defining it precisely, and making it pleasant to use. That cost is per piece of software and doesn't transfer, so as the amount of software goes to infinity, which it will because there's no ceiling on...

こんにちは、フロントエンドエンジニアのやなぎ（@apple_yagi）です。 2026年6月25日にGitHub Actionsに追加されたparallelを利用してPHPUnitを並列実行するようにした結果、CIのte […]

こんにちは。LINEアプリ開発SBU AIディベロッパーエクスペリエンスユニットの Nagase Takuya です。私のチームは、AndroidとiOSの開発者が混在する体制で、LINEアプリの機能...

<p><strong>Release:</strong> <a href="https://github.com/simonw/commit-rewriter/releases/tag/0.1">commit-rewriter 0.1</a></p> <p>I built this little web app the other day to help edit the commit messages for the <a href="https://datasette.io/blog/2026/september-security-releases/">Datasette security releases</a>. The initial commits were full of coding agent cruft and references to issue IDs from our private repository, so they weren't fit f...

Webpack 5.111

<p><strong>Release:</strong> <a href="https://github.com/simonw/shot-scraper/releases/tag/1.12">shot-scraper 1.12</a></p> <p>I've added WebP support to my <a href="https://shot-scraper.datasette.io/">shot-scraper</a> screenshot automation tool. You can now take a WebP screenshot of a web page like this:</p><pre><code>shot-scraper https://simonwillison.net -o screenshot.webp --quality 80</code></pre><p>The ...

カミナシでソフトウェアエンジニアをしている osuzu です。 「フロントエンドエンジニアとしてのキャリアは終わりなのではないか」という話を、最近よく見かけるようになりました。AIが画面実装を担えるようになった今、フロントエンドを主戦場にし続ける意味があるのか、という問いです。 正直に言うと、私も同じ方向に舵を切っています。ここ1、2年で最も時間を使っているのはデータモデリングやバックエンド、非同期のワークフローなどインフラ構成を含めたシステム全体の設計で、フロントエンドエンジニアというアイデンティティは薄れてきています。 「フロントエンドなんてバイブコーディングで良い」も、AI以降よく耳にす…

React 19.3 の Fragment Refs は、ラッパー要素を追加せずに複数の DOM 要素を操作する機能です。この記事では配送先フォームを例に、Fragment Refs の使い方を紹介します。

In short: from my experience, people like map and filter, but not reduce.I use functions like map and filter all the time. When I put that code up for review, my peers rarely complain. I get plenty of feedback about other decisions, but not about my use of map and filter.I cannot say the same for reduce. Often, when I’ve submitted a patch with reduce inside, I get a comment like, “this part is hard to read.” And I see reduce way less than map, filter, some, and so on.Anecdotally, I have come to

<p>Here's a neat thing I had <a href="https://simonwillison.net/2026/Aug/30/understanding-chatgpt-work/">ChatGPT Work</a> with GPT-6 Astra (Max) do this morning:</p><blockquote><p><code>I live at <my address>. Figure out 5K and 10K running routes from me that loop from my house. Use OSM data.</code></p></blockquote><p>It worked for 27 minutes and produced exactly what I'd asked for, as both an embedded visualization...

<p><img src="https://static.inaturalist.org/photos/733368932/large.jpg" alt="California Brown Pelican"></p><p><img src="https://static.inaturalist.org/photos/733368989/large.jpg" alt="California Brown Pelican"></p><p>California Brown Pelican, in San Mateo County, CA, US</p><p>The <a href="https://en.wikipedia.org/wiki/Pacifica_Pier">Pacifica Pier</a> shut down at the start of June after a crack in the concrete walkway made access...

<blockquote cite="https://www.nytimes.com/2026/09/12/opinion/ai-software-coding-apps.html"><p>For a while, I must admit, it looked as if software developer roles like mine were done for. How could we fight against tireless robots? But our industry is slowly realizing that making truly cutting-edge software still requires humans to think and work together, to maximize their skill sets and to practice their respective crafts. A.I. can write very good software, but it also makes it eas...

AI エージェントを業務に使うには、社内の知識やシステムへのアクセスと、成果物を共有する仕組みが必要です。Cloudflare OS は、エージェントと小さなアプリを動かすワークスペースを提供します。この記事ではローカルでの利用手順と、アプリの実行環境や Gatekeepers による権限管理の仕組みを紹介します。

<p><a href="https://www.rubyhack.ai/">OpenAI agents carried out an undisclosed attack on RubyGems</a> is a new bombshell report from Spencer Kitts, Thomas Larsen, and Sydney Von Arx - three of the four authors of the <a href="https://collusion.wiki/">report on the agent attack on disused wikis</a> (<a href="https://simonwillison.net/2026/Sep/4/rogue-agent-wikis/">previously</a>) last week.</p><p>This time they're noting that it looks very li...

<p><strong><a href="https://mmoustafa.com/blog/so-you-want-to-use-openrouter/">So you want to use OpenRouter?</a></strong></p>One of OpenRouter's selling points is that it "handles fallbacks automatically and picks the most cost-effective option for each request", so you can call a single API endpoint for a model and get routed to the best available backend provider.</p><p>Mohamed Moustafa points out a whole set of ways that this can cause you pro...

If you can write down how you do your work, you can automate it. Here's what I did to support GitHub's APAC marketing team.The post Marketing ops as code: Automating events from planning to follow-up on GitHub appeared first on The GitHub Blog.

<blockquote cite="https://twitter.com/bcherny/status/2098217573276131577"><p>Production code written by Claude should have a higher bar than if it was written by a human. At Anthropic, we have many guardrails in place to make sure this is happening: lots of lint rules, lots of tests, Claude-driven end to end tests, Claude-powered fuzzers running daily, automated code reviews and security reviews, automated code refactoring, and so on. Without these, you can end up with a mess that i...

<p><a href="https://news.ycombinator.com/item?id=49661506#49662090">My comment</a> on <a href="https://news.ycombinator.com/item?id=49661506">Feeling sad about AI</a> — Hacker News.</p><p>I'm not sure how useful it is to say this, but I think a lot of people (myself included, a few years ago now) have been through this moment of existential crisis and come out the other side.</p><p>The initial reaction, when some coding agent does ...