Safari Technology Preview Release 256 is now available for download for macOS Golden Gate and macOS Tahoe.

pnpm 12.18.0 packs, publishes, and installs packages with platform variants on pnpr registries. It also adds per-skill approval of agent skills and pnpm store add for offline installs from downloaded tarballs. Repeat installs and verifyDepsBeforeRun no longer read the package.json of unchanged...

pnpm 11.28.11 fixes frozen installs with excludeLinksFromLockfile, pnpm link in workspaces, pnpm deploy with dangling symlinks, and verifyDepsBeforeRun starting needless installs.

AccessPolicy in NGINX Gateway Fabric lets you allow or block client IP addresses and CIDR ranges on a Gateway or on individual routes. If you already use NGINX Gateway Fabric to manage traffic into your cluster, you can now control which clients reach your apps in the same place, with a policy attached to the […]

After Binance, LiteLLM, PHP2Shell and eMudhra, here are six practices and a checklist to limit what the next compromise can reach before 2027.Category: News

The 's function can now admit a run and claim a hook in one atomic step. Duplicate workflow starts fail safely. The atomic start replaces the previous -then- pattern, whose gap between the lookup and the start left a documented duplicate-start race.Workflow SDKstart()getHookByToken()start()The claimed Hook exists from the moment the run is admitted, so works even before the run begins executing, and early payloads are buffered and delivered in order. Inside the workflow, with the same token bind

and its higher-speed version, , are now available on from more (ZDR) providers. Until today, was the only provider serving either model.Kimi K3.1 ProKimi K3.1 Pro HighspeedAI GatewayZero Data RetentionMoonshot AIK3.1 Pro improves on earlier Kimi models in coding, 3D modeling, and financial analysis, and can carry long agent runs from a small fix to a full project. Both models have a 1M-token context window and accept image input, and Highspeed suits interactive work like coding agents, where res

<p><strong>Release:</strong> <a href="https://github.com/datasette/datasette-llm/releases/tag/0.1a10">datasette-llm 0.1a10</a></p> <p>Fixes a <a href="https://github.com/datasette/datasette-llm/pull/11">bug</a> that affected my <a href="https://agent.datasette.io/">agent.datasette.io</a> demo site, where the set of available LLM models was not correctly restricted to just those in the configuration.</p> <p>Tags: <a...

The AI 2027 Conference is a live online day for designers and engineers on where AI stands today, what to expect in 2027, and where teams are getting it right.Smashing AI Conference originally handwritten and published with love on CSS-Tricks. You should really get the newsletter as well.

StepSecurity Malicious Files finds files planted by Miasma, Shai-Hulud and other supply chain attacks in GitHub repositories and on developer machines.

Personal AI agents have changed how users interact with the web, blurring the lines between automated and human traffic. Learn how Cloudflare gives site owners visibility and control to manage personal agent access.

Testing data access code has always been awkward: unit tests want to be fast and isolated, and a real database is neither. With Docker and @testcontainers you can spin up a throwaway Postgres inside your Vitest suite, push your Drizzle schema into it, and verify that your real insert and query code round-trips correctly.

同じメディアクエリを複数の CSS ファイルに書くと、ブレークポイントを変えるときにすべての箇所を書き換える必要があります。@custom-media はメディアクエリに --md のような名前を付ける at-rule で、入力方式やブレークポイントをプリセットとして 1 か所で管理できます。この記事では、@custom-media の構文と仕様上の挙動について説明します。

<p><strong>Release:</strong> <a href="https://github.com/datasette/datasette-apps/releases/tag/0.3a0">datasette-apps 0.3a0</a></p> <p>Datasette Apps adds support for hosting and editing custom HTML applications inside of Datasette.</p><p>These can be created by hand, but it's easier to create them using LLMs via <a href="https://agent.datasette.io/">Datasette Agent</a>. This release improves that integration:</p><blockqu...

Most AI SEO advice is unproven. We tested what ChatGPT, Claude, and Perplexity actually read on our own site. Six techniques that make a site agent-friendly and visible to LLMs, eight that don't, and the metrics to tell the difference.

Buildkite runs CI/CD for some of the most demanding engineering teams in the world. Why a team of opinionated developers hired Evil Martians to build a framework-agnostic design system with AI skills that guide coding agents through every component.

Binance’s November 3 findings reveal a path from a malicious coding assignment to wallet signing. Explore developer-machine controls and response guidance.

<p><strong>Release:</strong> <a href="https://github.com/datasette/datasette-agent/releases/tag/0.5a0">datasette-agent 0.5a0</a></p> <p>This is a significant release of <a href="https://agent.datasette.io/">Datasette Agent</a>. The most notable new feature is called the <strong>panel</strong> - it lets the agent chat open and then sit next to pages from Datasette, for example a table or query page.</p><p>When combined...

Stop syncing server data into React state. Learn how writable derived state keeps server defaults current while preserving user edits until they're reset.

<p><strong>Release:</strong> <a href="https://github.com/simonw/llm/releases/tag/0.37.1">llm 0.37.1</a></p> <p>A bugfix release for <a href="https://llm.datasette.io/">LLM</a>, with contributions from <a href="https://github.com/remote-controlled-man">Steven Huang</a>, <a href="https://github.com/tao-hpu">Tao An</a>, <a href="https://github.com/ar-jan">Arjan Mossel</a>, and <a href="https://github.com/X...

Scroll-Driven Animations can step in and make scrolling feel different even if you aren't actually interfering with the actual page scroll.

is now in public beta for Pro and Enterprise teams. Once enabled, every push to a connected GitHub repository is automatically reviewed for vulnerabilities, and findings are reported in the .Vercel Security ReviewVulnerabilities dashboardSecurity Review runs automatically when code is pushed to a connected GitHub repository. Because reviews start from push events rather than pull requests, direct and force pushes to your production branch are reviewed as well. Every project affected by a single

We’re excited to announce Adaptive Dark Mode in Safari 27.3 beta.

Vercel CI can now run on a GitHub repository that has no Vercel project. Until now you had to create an empty project just to connect the repository.To enable it, you need:Then, from a clone of the repository, run:CI is enabled for the team your CLI is set to. Pass to use a different one. From the next push, tasks run as configured in your repository.--scope <team>Private GitHub repositories only. Public repositories and other Git providers are not yet supported.Read the to configure tasks...

A practical guide to securing GitHub Actions against supply chain attacks, covering malicious pull requests, credential theft, dependency risks, and release pipelines.

I rate my NGINX skills as basic. I’ve done the normal things: web serving, reverse proxy and a few upstreams, some TLS. If something went sideways, I’d be learning the ins and outs on the fly. That’s great if you want to learn that, but I’m much more interested in evaluating architectures and building systems […]

<p>Yesterday's hot paper was <a href="https://rikiyat.github.io/blog/weight-space-programming/">Sparks of Weight-Space Programming: LLMs can natively read & write neural network weights</a> by Rikiya Takehi, Jayden Teoh, Alex Zhang, and Omar Khattab. The paper (OK, the authors classify is as a "blog post", but it's paper-shaped) found that frontier models, in particular GPT-6 Astra, can both interpret and modify the raw weights of a machine learning model - literally a...

Louis Erbkamm built the first prototype in his free time. Now GitHub Copilot helps him maintain it alone.The post Arnis turns any place on Earth into a Minecraft world appeared first on The GitHub Blog.

記事は ics.media へアクセスしてご覧ください。

Combining :nth-child with style queries and sibling-index() to conditionally select child elements.Re-Implementing :nth-child() With Modern CSS originally handwritten and published with love on CSS-Tricks. You should really get the newsletter as well.

Zero Wire on Cloudflare Radar pairs plain-language briefings with global attack telemetry and remediation steps. Triage critical CVEs faster and decide how to protect your infrastructure.

Replacing JavaScript with a modern CSS feature can simplify a piece of code while making the wider application harder to reason about. Gabriel Shoyombo explores what happens when logic is split between CSS and JavaScript, sharing practical guidance to help you keep complexity in check during migration.

<p><strong><a href="https://www.youtube.com/watch?v=UytYrhYLOKI">I discovered a sound that leaks your exact location (and it's everywhere) - YouTube</a></strong></p>Genius piece of OSINT by Colsto, who demonstrates how you can take almost imperceptible background noise of planes from a video soundtrack, figure out their Doppler curves, then cross reference them against ADS-B data to find the exact location of the video based on their speed, distance,...

<p>I sent out the October edition of my <a href="https://github.com/sponsors/simonw/">sponsors-only monthly newsletter</a>. If you are a sponsor (or start a sponsorship now) you can <a href="https://github.com/simonw-private/monthly/blob/main/2026-10-october.md">access it here</a>. This month:</p><ul><li>The October inflection point for vibe game development</li><li>The vulnerability apocalypse gets hot</li><li>LLM releases...

agent-desktop は Vercel Labs が公開している、AI エージェント向けの Computer Use CLI です。スクリーンショットとピクセル座標ではなく OS のアクセシビリティツリーを読み取り、スナップショットごとに発行される ref を指定してデスクトップアプリを操作します。この記事では agent-desktop の基本的な使い方を確認したうえで、SwiftUI で作った架空の経費アプリの動作確認を Claude Code に任せ、バグの発見から修正までを実行させます。

Composer 2.11 adds dependency cooldowns, joining package managers that delay new releases to reduce supply chain risks while allowing urgent security updates.

Zapier on VercelFrom weeks of prototype work to a demo in under two hoursSharing sensitive internal data securelyInternal apps for marketing and salesModel access and isolated code executionWhat's nextInteractive partner demos in under two hours with v0, replacing a process that could take weeksFirst versions of three internal applications, each built in one dayA shared daily briefing for more than 60 marketers, replacing individual efforts to assemble the same information3.3 million sandboxes c

Mercor on VercelBatch jobs cut from 12 hours to 2 hours18M requests and 63B tokens routed through AI Gateway in 10 daysExpert access provisioned in seconds via Vercel PassportOver 2,000 projects created by hundreds of internal builders connects hundreds of thousands of domain experts with frontier AI labs, helping those labs generate the human data they need to train and evaluate leading models. It also runs large batches of automated grading jobs to evaluate models for labs and enterprises.Merc

A tour of lemans, the open source Ruby harness behind Agents on Rails: eval task anatomy, how it runs and grades coding agents for hours, and how cheaters shaped its guardrails.

OpenEvidence on VercelServes 650,000 doctors with medical searchCompletes production deployments in about five minutesAbsorbs traffic spikes without additional capacity provisioningReduced serverless spend by 90% with Fluid computeUpdates doctor- and patient-facing applications independently helps physicians find medical evidence during care, whether they’re checking a dosage on intensive care rounds or handling a case outside their specialty without a specialist nearby. Answers draw on peer-rev

from is now available on , at 50% off through December 31, 2026.Hy4TencentAI GatewayHy4 supports , , , and image input, and has a 1M-token context window for work across a codebase or many documents.reasoningtool callingstructured outputsHy4 is the first Hy model with vision. It can pick out fine detail in an image and read complex charts. It also supports computer use in both command-line and graphical interfaces. Compared with , it follows instructions more closely and does better with long co

Vercel CLI now includes , which checks your setup and shows the command that fixes each problem it finds.vercel doctorIt checks the CLI version and install, your login and current team, the project link, and your project configuration in . It also reports active incidents from the Vercel status page.vercel.jsonEach check reports OK, Warning, Failed, or Skipped. When vercel upgrade can't update the installed CLI, the install check shows where the CLI runs from and how to reinstall it.Doctor runs

<p><strong>Release:</strong> <a href="https://github.com/simonw/llm/releases/tag/0.37">llm 0.37</a></p> <p>There's a <em>lot</em> of stuff in this new release of my LLM CLI tool and Python library, representing around two months of accumulated features and fixes.</p><p>I added <code>gpt-6.1-sol</code> and <code>gpt-6.1-terra</code>, plus a new <a href="https://llm.datasette.io/en/stable/other-models.htm...

Vercel now supports , which allows you to to configure your project using the . All of the same configuration properties are supported as in , but it supports comments and has a flatter structure. vercel.tomlvercel.jsonTOML configuration formatAll projects can now use . Use only one project configuration file: vercel.toml, vercel.json, or vercel.ts.vercel.tomlFor example, configuring :ServicesRead the . documentationRead more

Any MCP client can now ask to connect to . You still log in and approve each connection, but the client no longer has to be reviewed by Vercel first. Previously, Vercel reviewed and allowlisted each client and its redirect URIs by hand, and anything not on the list was rejected.Vercel MCPTo connect, a client publishes a Client ID Metadata Document (CIMD), a JSON file on its own domain that describes it, and uses that file's HTTPS URL as its OAuth . This follows the MCP authorization spec, which

KubeCon + CloudNativeCon North America comes to Salt Lake City, November 9–12, and the NGINX team is heading up the mountain with it. Our theme this year is the transition to enterprise-grade Kubernetes, and that now includes AI traffic: inference requests competing for GPUs, and AI agents calling tools over the Model Context Protocol (MCP). […]

can now show your deployments as an interactive card inside ChatGPT and other chat clients that support .Vercel MCPMCP AppsThe card shows live deployment status, build logs, and source and commit details, with a Visit button once the deployment URL is ready. You can send logs into the chat to debug with the model, or open the fullscreen view to read them beneath the card. For repositories linked to multiple projects, a project list lets you switch between them.The card is Vercel MCP's first MCP

is a tool in the Vercel Toolbar where you can see which feature flags are active on your end, and share them with your team, either by setting them for the branch or through a URL.Flags ExplorerThe Explorer surface has been redesigned to co-locate overrides, branch recommendations, and any related actions.Whenever a branch has overrides set, they will be recommended to teammates visiting the deployment through a dialog.Flags Explorer is available on all plans. Read the to get started.documentati

Vercel Sandboxes that mount now start faster. Median creation time dropped from 1.7s to 0.7s, and p95 dropped from 2.2s to 1.6s.DrivesThe speedup applies automatically to every sandbox that uses Drives, with no SDK upgrade or configuration changes needed. Pricing stays the same.Learn more in the .Vercel Drives documentationRead more

let applications evaluate flags defined in another Vercel project within the same team, without managing SDK keys.Project ConnectionsPreviously, sharing flags between projects required copying a server SDK key into an environment variable and managing it manually. Connected projects authenticate using their deployment’s identity. For local development, retrieves your project’s OIDC token.vercel env pullManage access from the page under your project's Flags section, or with in the CLI. Connection

This is the final issue of What’s !important on CSS-Tricks.com. The good news is that it’s coming back in an expanded form as the CSS-Tricks newsletter. I had ya there for a second, didn’t I? Sorry, I couldn’t decide whether to trick or treat, so I went for both. Happy HalloweenWhat’s !important #20: GTA 6 Scroll Effects, Scrollspies, random() originally handwritten and published with love on CSS-Tricks. You should really get the newsletter as well.

Zone setting changes used to rebuild entire DNS zones, even ones with tens of millions of records. Here is how we built a planner that picks the smallest safe build, cutting full builds by 40%, peak memory by 85%, and halving build delay.

<p>I was reminded today of <a href="https://www.apolloacademy.com/ai-adoption-rate-trending-down-for-large-companies/">AI Adoption Rate Trending Down for Large Companies</a>, a chart produced by Apollo Global Management in September 2025, which appeared to show a slowdown in U.S. corporate AI adoption based on numbers collected by the U.S. Census Bureau. At the time I used that chart <a href="https://simonwillison.net/2025/Sep/9/apollo-ai-adoption/">to demonstrate GPT-5 ...

Discover how JetBrains products are recognized for enterprise leadership, developer experience, and ease of adoption, and why this matters for engineering teams looking to improve productivity and scale with confidence. In fall 2026, JetBrains earned 180 G2 badges across multiple award categories, including Enterprise Leadership, Best Usability, Best Relationship, Easiest Setup, and Easiest Admin. These […]

The new headingoffset HTML attribute lets you bump a heading’s level up by adding to it, which is handy when a component’s h1 needs to be an h2 somewhere else. Here’s how the math works, how to reset it, how to style the result with :heading(), and where aria-level fits in.

Today, we are launching in public beta.Vercel Security ReviewSecurity Review is a new capability in , alongside Code Review and Investigation. Once enabled, it scans for vulnerabilities on every push to a team's connected GitHub repositories.Vercel AgentFindings appear as comments on pull requests, are listed in the Security dashboard, and are available via CLI. With your permission, Vercel Agent can also validate and push fixes for findings.Security reviews are triggered by GitHub push events,

CVE-2026-98432 is a critical Linux kernel TCP flaw rated 9.8 that can allow remote code execution. See who is affected, how to patch and what to do now.Category: Vulnerabilities & Threats

Babel 8.1.0 is out!

is now available on AI Gateway. This model combines native visual understanding with coding and multi-step tool use for agents working across complex codebases and full-project builds.LongCat 2.5 from Meituan improvements in visual programming, creative design, and 3D tasks, alongside longer agent workflows that carry engineering work from planning through execution. The model supports text and image inputs with a 1M-token context window for code, documents, and extended task histories.Meituan h

Vercel now checks for blocked npm packages before and during dependency installation in , helping prevent malicious install scripts from running.buildsThe checks use a blocklist of specific package versions selected for blocking because of malware or security vulnerabilities, with new rules typically reaching new builds within minutes.Existing checks of installed dependencies and function outputs continue before deployment.These protections apply automatically to new builds on all plans, with no

<p>I've been getting the occasional confusing Python dependency error since switching over to Python 3.15 and the rule I'm having to remember is:</p><p><strong>If in doubt, delete the uv.lock file</strong></p><p>Most of my projects are libraries which don't include a <code>uv.lock</code> file, since it's rude for a library dependency to lock versions for anything else that uses it.</p><p>Running <code>uv run pytest</code...

GitHub’s annual month-long game jam is back for its 14th year! This November, make a game inspired by the theme SHIFT. Change gears, swap perspectives, bend reality, or just press a certain key.The post Game Off 2026: The theme is SHIFT appeared first on The GitHub Blog.

<blockquote cite="https://jepsen.io/analyses/particledb-1.1.4#llm-tradeoffs"><p>More broadly, the use of LLMs erodes trust in documentation, in software, and in the organizations which produce them. Perhaps engineers will begin to treat any new software project with suspicion—the signals we used to rely on as markers of a mature system are now easier to counterfeit. [...]</p><p>In the age of LLMs, what can maintainers do to ensure correct software and accurate documentat...

On October 29, 2026, trojanized builds (2.1.312 and 2.1.313) of the official Claude Code VS Code extension were published to Cursor's VS Code Extension Marketplace for macOS and Windows.

<p><strong><a href="https://www.parameter.ai/labs/we-found-a-gap-at-openai">How We Took Over ChatGPT Accounts</a></strong></p>Parameter Labs describe an exploit they found against ChatGPT's implementation of the artifacts pattern (OpenAI used to call this "Canvas" but it looks like the latest revision is called <a href="https://help.openai.com/en/articles/20001246-working-with-writing-blocks-and-code-blocks-in-chatgpt">HTML previews</a>), where in...

<p><strong>Release:</strong> <a href="https://github.com/datasette/datasette-llm/releases/tag/0.1a9">datasette-llm 0.1a9</a></p> <p>I have some big upgrades to <a href="https://agent.datasette.io/">Datasette Agent</a> in the pipeline, but in the meantime here's a tiny user experience improvement to the underlying <code>datasette-llm</code> plugin. </p><p>It now picks up the default model used by <a href="https://ll...

Framer's journey to automated PR reviews, agentic pair-engineering, and how you can leverage AI to drive a promotion

Let’s kick of November with a new collection of desktop wallpapers! Designed by creatives from across the globe, the wallpapers come in a variety of screen resolutions and can be downloaded for free. Enjoy!

LLM の回答を逐次描画するとき、届いた文字列全体を毎回パースして DOM を置き換える実装では、要素が作り直され続けてテキストの選択状態が失われたりします。streamAppendHTML() は WritableStream を返し、届いた HTML を要素の末尾へ順にパースします。この記事では streamAppendHTML() の使い方とサニタイズの挙動について紹介します。

October 2026 - Astro 7.4, conference talks, and more!

<p><strong><a href="https://github.com/dbreunig/nesformer">dbreunig/nesformer</a></strong></p>Inspired by <a href="https://divagr.com/blog/qwenputer">qwenputer</a> by Divyansh Agrawal, Drew Breunig baked a working emulator for a Nintendo Entertainment System 6502 CPU into the weights of Qwen3.5-4B. You can now play NES ROMs such as Super Mario Bros (very slowly) running inside Qwen!</p><p>In <a href="https://news.ycombinator.com/ite...

Abdel Sghiouar, Google engineer and senior cloud developer advocate, thinks prompt injection should be called prompt poisoningCategory: Guides & Best Practices

Four, just four: that’s the key to break into any unpatched connection on the Internet that is using eMudhra certificates. Here’s how we quickly patched Cloudflare, what evidence we can see of attempted exploitation, and how much of the rest of the Internet remains exposed.

Public traffic to private origins, with WAF, bot management, caching, and Workers, is now available to every customer with Cloudflare One connectivity.

Swapping the clip-path arrow from the previous article for border-shape and shape(), we can connect two draggable circles with fancy curved lines that stay perfectly aligned.

The Binance hack may have started with a compromised developer laptop, Binance says. See how that can lead to stolen funds and how to protect against it.Category: News

Geist started as a monospace typeface for developers, built for the editors and terminals where they spend their day doing their work. From there it grew into Geist Sans for product interfaces, and then into Geist Pixel, which was inspired by the grids of early computer screens.Today, we're adding a new member to the family: .Geist SerifGeist Serif is a high-contrast display serif built on the same foundations as Geist Sans, Geist Mono, and Geist Pixel. It has fine, saw-toothed serifs and sharp

vlt v1.6.1 is out with a handful of bug fixes.

CSS-Tricks has a new owner!This really is a big win for the web and it should fill you with hope. We're not done yet!The Serotonium — Music shared with friendsThis does exactly what is says on the tin and the volume of extremely good recommendations is mind-blowing.Anthropic files its ‘IPO’ — but all the key numbers are missingIf the immediate glazing of Anthropic's IPO documents on social media was getting you down, then have a read to get yourself back level again.Digital recipe management for

Cursor removed a malicious Claude Code 2.1.313 extension from its marketplace. Socket examines registry records and the initial claims about its distribution.

Today, we’re bringing Data Cache into Runtime Cache, giving developers one product for data caching across frameworks and APIs. If you use Next.js caching or , you won’t need to change your code. Pro and Enterprise projects will get larger storage allocations.fetchunstable_cacheRuntime Cache lets your code reuse fetched or computed data across requests without operating a separate caching service. Over the past year, we’ve improved read performance during traffic bursts, increased storage budget

Data Cache is exiting beta and moving to . Next.js caching and will switch over on every version without code changes. On Pro, each project and environment gets its own Runtime Cache storage allocation, with 8x the space of Data Cache’s previous team-wide pool. Enterprise projects get 10x their previous Data Cache storage.Runtime Cachefetchunstable_cacheOnce your team migrates, Data Cache reads and writes that were previously unbilled are charged at . Rates start at $0.40 per million read units

Better Auth v1.7.16 and v1.8.0-beta.5 fix 12 security issues. Upgrade to the latest release of your line.

HighlightsIn ESLint v10.14.0, the following rules have been updated to avoid incorrect or unexpected behavior in some edge cases:func-name-matchingno-invalid-thisno-restricted-globalsobject-shorthandyodaFeaturesd23a7f9 feat: fix property descriptor handling in func-name-matching (#21400) (xbinaryx)Bug Fixes4a12580 fix: require minimatch 10.2.6 to avoid vulnerable brace-expansion (#21460) (lumir)827a8f3 fix: no-restricted-globals crash on global objects as property values (#21449) (xbinaryx)16155

pnpm 12.17.0 adds pnpm peers check --global, dependency-group selectors and wildcards in overrides, and runtime, package manager, Cargo, and Python updates in pnpm outdated and pnpm update. It also fixes files that other users could not read in Docker images, and repeat installs that missed...

pnpm 11.28.10 stops pnpm store prune from deleting other stores when cacheDir points to their parent directory. It also fixes globally installed commands that load hoisted dependencies, and repeat installs that missed changes to local dependencies.

can now call the in their deployment through .Vercel Daemonsservicesservice bindingsDeclare the binding on the daemon. It names the target service and the environment variable that receives the service's URL:The daemon calls that URL like any other HTTP endpoint. Vercel handles the internal routing, authentication, and TLS, and the service stays private:Bindings point one way: services can't bind to daemons. Each instance keeps calling the deployment that started it, even after a promotion or ro

is now available on , free until November 3, 2026.Ling 3.1 Flash 1019 from InclusionAIAI GatewayThe updated model is designed for coding, multi-step reasoning, and agents that use tools. Its 1M-token context window supports workflows involving long documents, code, and extended task histories.Use as the model name:inclusionai/ling-3.1-flash-1019Free requests still appear in your spend dashboard with a full request trace, they just cost nothing. On November 3, requests will begin charging at the

now support configuring HTTP liveness checks.Vercel DaemonsStart with an HTTP endpoint in your daemon that reports its health. Keep it lightweight so it responds quickly, and have it return an error status when the daemon is no longer healthy:The daemon configuration now accepts a value pointing at that endpoint:livenessProbeVercel periodically requests the endpoint and restarts the daemon's container when the check fails, catching a daemon that is still running but no longer healthy. for more i

<p><strong><a href="https://help.openai.com/en/articles/20001626-api-credits-benefit-for-eligible-chatgpt-subscriptions">API credits benefit for eligible ChatGPT subscriptions</a></strong></p>Earlier this month Anthropic <a href="https://simonwillison.net/2026/Oct/7/claude-haiku-5-5/#api-credits">announced a generous new benefit</a> for their Max and Team subscriptions: $100, $200, and $500 per month subscribers would get the equivalent quantity o...

We explain what shell vulnerabilities are and how to manage them: PHP2Shell, Node2Shell (HTTP2Shell), React2Shell and Log4ShellCategory: Guides & Best Practices

, the open-source AI penetration testing tool, can now run on any of the 400+ models on Vercel .StrixAI GatewayStrix can reach models from Anthropic, OpenAI, Kimi, GLM, Deepseek, and others through a single API with no markup, removing the need to sign up for multiple providers. Usage and cost are tracked across all models in AI Gateway. Strix selects the Gateway through , where the model is the standard AI Gateway ID behind a prefix:STRIX_LLM<provider>/<model>vercel_ai_gateway/See t...

<p><strong><a href="https://twitter.com/jsnnsa/status/2115623382721126826">How I Built the Most AI-Pilled Company in the World</a></strong></p>Don't be put off by the clickbait headline, this piece by Jacob Sansbury describing how they are building <a href="https://spawn.co">Spawn</a> is a fascinating exploration of the bleeding edge of what's possible with agentic engineering against frontier models.</p><p>Spawn is a massively multipl...

on Vercel now resolves visitor locations with finer network granularity, delivering city-level data for nearly all requests and postal-code data for 90% of traffic.IP geolocationGeolocation data is now refreshed more often, so locations keep up as IP ranges are reassigned and routing changes. This is enabled for all projects with no code or configuration changes required. Existing geolocation headers along with the in , return the same fields for and . helpergeolocation()Vercel FunctionsRouting

An OpenCode user faced harassment after reporting a free AI usage loophole, drawing a bitter backlash in a GitHub thread that has since been deleted.

記事は ics.media へアクセスしてご覧ください。

<blockquote cite="https://twitter.com/benhylak/status/2115172657910120740"><p>every product i use should just be a headless mcp, that feeds into an agent, where i never have to think about anything underneath.</p><p>except for our product, of course. </p><p>in our product, customers love the ui and love us very much.</p><p>we're special that way.</p></blockquote><p class="cite">— <a href="https://twitter.com/benhylak...

Rspack 2.3 brings SWC Next, faster builds, lower memory usage, smaller bundles, a new experimental cache, loader caching, and built-in CSS improvements.

A super scary way to go about tables using other layout techniques, like CSS Grid.The Frankenstein Table originally handwritten and published with love on CSS-Tricks. You should really get the newsletter as well.

PHP2Shell and Brocolli2Shell may be harbingers of many vulnerabilities to come. But we can be readyCategory: News

The most fragile code in bilan guessed whether a sync was still alive. Agents replaced it with a small domain model built on Alchemy Domain and Effect, specified by stories that play hours of a sync's life in milliseconds. Here are the principles I took away from it.

Cloudflare mitigated over 8,200 DDoS attacks per hour in Q3 2026 as attackers shifted to shorter, high-frequency strikes. Explore the latest threat data, including the collapse of CLDAP vectors and the impact of recent botnet takedowns.

Agents moved bilan from a Wrangler config to Alchemy in a day. Every pull request now gets its own copy of the app, production never went down, and the whole system lives in one typed file. Here are the principles that made it worth it.

It's been a rather morale draining era in the making websites industry since the wider tech industry decided to gamble everything on LLMs. We at Piccalilli see it amongst the community and feel it ourselves.You'll also have noticed the velocity of posts has slowed down somewhat on this website with no new courses announced either. There's a couple of reasons for that. First, the numbers have taken a dramatic tumble — industry-wide — but also, aside from being very busy in the studio, we've been

PHP2Shell showed how fast AI turns a bug into an exploit. Here’s why the disclosure should never happen this way again, and why it will anyway.Category: News

On Vercel, the SDK now initializes faster on cold starts, and usage reporting no longer keeps functions running after the response.Vercel FlagsTwo changes speed up SDK initialization on cold starts:In internal testing, eliminating the network wait reduced p75 cold-start SDK initialization time from over 70 ms to 10 ms, roughly 7x faster.After initialization, flag reads are effectively instant. Across cold and warm invocations, p99 flag-read latency is under 1 ms.The SDK previously used for usage

The fx adapter for the AI SDK’s now uses , the TypeScript library for fx. The harness and model requests run in your application’s process, while built-in filesystem and shell operations remain isolated in the sandbox.HarnessAgentlibfxThis simplifies sandbox setup: you no longer need to install fx inside the sandbox, run a sandbox bridge, or expose a sandbox port. Model credentials stay on the host, outside the environment where the agent runs commands.The rewrite also adds:Sessions can be saved

こんにちは。@potato4dです。今回は2026年10月12日に開催された フロントエンドカンファレンス関西2026 の参加・協賛レポートをお届けします。本記事では、スポンサーブースの様子や、当日参...