Slack Code は Slack 上でオープンな開発を行う手段を提供する機能です。コードチャンネルと呼ばれる特別なチャンネルを作成し、チーム全体でコーディングエージェントとやり取りを行うことができます。この記事では Slack Code を実際に試してみた感想を紹介します。

Cloudflare's new Bot Preference Sync automatically aligns your robots.txt file with your AI bot policies for Search, Agent, and Training. Easily manage which bots access your content without maintaining static files.

Ora on VercelEvery harness expects its own infrastructureOne platform under every harnessTesting eve like any other harnessThe framework behind Ora's own agentsFront end, back end, and agent runtime on one platformEvery major agent tested side by side on live sitesHundreds of commits a day from a 16-person engineering team7% fewer steps to reach the goal2x native success: twice as many tasks finished on the customer's own site instead of falling back to web search9% more valid endpoints: more of

Image hardening tools compared for 2026: Aikido, Chainguard, Docker, RapidFort, Echo, Minimus, and WizCategory: DevSec Tools & Comparisons

Compare the top enterprise AI pentesting tools of 2026: Aikido, XBOW, NodeZero, Pentera, Hadrian, and Cobalt.Category: DevSec Tools & Comparisons

Socket’s PHP and Composer support is now in Beta for all customers, with PHP reachability analysis generally available.

<p><strong>Release:</strong> <a href="https://github.com/simonw/llm/releases/tag/0.32.1">llm 0.32.1</a></p> <p>Fresh installs of LLM stopped working the other day because the OpenAI Python library dropped its usage of <code>httpx</code>, and it turned out LLM depended on that library but only installed it via a transitive <code>openai</code> dependency.</p><p>This dot-release fixes that for the moment by pinning to &l...

<p><strong>Release:</strong> <a href="https://github.com/simonw/llm-openrouter/releases/tag/0.7">llm-openrouter 0.7</a></p> <p>Now that this plugin is compatible with <a href="https://simonwillison.net/2026/Aug/4/new-release-of-llm/">LLM 0.32</a> it can display the reasoning traces for LLMs available through OpenRouter.</p><blockquote><ul><li>Updated for compatibility with <a href="https://llm.datasette.io/en/stabl...

<p><strong><a href="https://sockpuppet.org/blog/2026/08/20/stop-making-tuis/">Stop Making TUIs</a></strong></p>Thomas Ptacek advocates for building real native user interfaces for even the smallest of personal tools, because coding agents have reduced the cost of getting a usable-enough GUI up and running to almost nothing.</p><p>I wrote about my vibe-coded bandwidth and GPU monitoring macOS task bar apps <a href="https://simonwillison.net/2026...

A newly resolved proposal would allow us to select classes that are a prefix for variations with a wildcard, like .prefix-*.Resolved: CSS Class Prefix Selector originally handwritten and published with love on CSS-Tricks. You should really get the newsletter as well.

<blockquote cite="https://interconnected.org/home/2026/08/21/galactic"><p>After I released version 1.0, I figured I would have to do the rotations myself. So I sat down with ChatGPT and I didn’t get it to write the code, but I got it to educate me. With a patient, interactive tutor, I was able to finally do what I hadn’t by reading books and asking mathematician friends – I learnt how to use quaternions just enough to make the app work.</p><p>So learning doesn’t stop jus...

CVE remediation is fixing known flaws in the software you run. Why upgrading often fails, what remediation actually involves, and how backporting fixes it.Category: DevSec Tools & Comparisons

Websites often hardcode keyboard shortcuts for Mac (⌘) while neglecting Windows users, leading to confusion.

Three months ago, I wrote that Bun was the only mainstream package manager that couldn't do surgical CVE remediation. Bun 1.4 ships in-place transitive updates, bun audit fix, and nested overrides. Time to re-run the original reproductions.

BulletedThis is the stuff that's exciting about the AT protocol. Not the "new twitter" bullshit, but the endless possibilities that this technology opens up. It's using the fancy new private data stuff too.The future of CSS: target multiple classes with the class prefix selectorAs Bramus says in the article, we can sort of do this already, but those substring selectors don't perform well. This new method is a very good improvement!Ruminations on notificationsA good write-up on how annoying and h

We tested 10 AI models on 32 fresh CVEs. DeepSeek V4 Pro found 28, and three cheap runs beat one pass of Opus 5 or Grok on total coverage.Category: Technical

Every deployment produces a set of files, including the pages, functions, and assets Vercel serves. Deployment Storage keeps those files available so you can inspect previous deployments and roll back when needed.Instantly roll back to previous deployments in secondsIf a production deploy ships a bug or a change you want to reverse, rolling back restores the previous version in seconds. Open your project, click on the Production Deployment tile, then choose an earlier production deployment. Verc

Electrobun 2.0 introduces Cottontail, Hutch, a polyglot Zig core, and Warren—a new foundation for tiny, fast desktop apps across TypeScript, Zig, Rust, Go, and Odin.

HighlightsNew option checkConditionalExpressions in no-unmodified-loop-conditionThe no-unmodified-loop-condition rule now supports a checkConditionalExpressions option.When enabled, each branch in a ternary expression is checked independently.For example, with { "checkConditionalExpressions": true }, the rule reports the done variable as not modified in the loop:let chunk = getInitialChunk();let done = false;while (chunk ? !done : false) { chunk = nextOrNull();}123456Copy code to clipboard Featu

The Vercel CLI now provides dedicated commands for managing DNS records, domains, and projects. This brings more of the functionality available through the Vercel dashboard and API to the terminal, where it can be used interactively, in scripts, or by agents.Retrieve the complete configuration for a DNS record or update it in place using its record ID. supports changes to the record name, type, value, TTL, MX priority, and comment. SRV records can also be updated using their priority, weight, po

OpenAI lowered list pricing for , and the 50% AI Gateway now applies to the new, lower price through September 18. Input drops 20%, output drops a third. GPT-5.6 SoldiscountThe discount applies on every OpenAI service tier:Rates are per million tokens for requests up to 272K tokens. Cached tokens, cache writes, long-context requests above 272K, and the US regional rates all move by the same proportion. See the for all model rates.pricing pageThe model ID is unchanged, so requests you already sen

is now available on AI Gateway.DeepSeek V4 Flash with visionThis model is an experimental version that accepts images alongside text. You can ask it to describe a picture, read text out of a screenshot, or work through a chart in the same request as your prompt. DeepSeek V4 Flash Vision Experimental now available on AI Gateway. Tool use, reasoning, and caching all work the same as before.Use to get started:deepseek/deepseek-v4-flash-vision-expImages can be JPEG, PNG, GIF, or WebP. The format is

Apps and agents built in v0 can now securely connect to , including Slack, Google, Notion, GitHub, and Salesforce, through .100+ third-party servicesVercel ConnectPrompt v0 to connect your app to a service, and it walks you through setting up a connector for it.Connectors belong to your team, so you set one up once and reuse it across apps. For some connectors like Slack and GitHub, Vercel handles the app registration, so there's nothing to set up on the provider's side. For other services you c

With always-on tracing, you can now debug your real user requests without reproducing them.Always-on tracing continuously collects traces from your production and preview traffic. Unlike , which only captures requests from your own browser, it samples your live traffic. session tracingYou control what's collected with sampling rules. Each rule sets a trace rate for an environment (All, Production, or Preview), optionally scoped to a path prefix like . Nothing is collected until you add a rule, s

<p><strong><a href="https://promptwatch.com/data/chatgpt-site-operator-fanouts">ChatGPT search now uses the site:operator at scale</a></strong></p>Promptwatch is part of the emerging "GEO" space, for Generative Engine Optimization - the chatbot version of SEO, where companies offer tools and consulting to help your site increase its presence in replies to prompts inside tools like ChatGPT.</p><p>The Promptwatch product uses automation to track res...

Use Gmail’s Message-ID to point Codex or Claude at one exact email and retrieve the complete conversation rather than a plausible result.

Socket is bringing experimental protection to Firefox, scanning 97,000+ extensions in Mozilla's official directory for malware and risky updates.

Three Rust crates are compromised: arrayref 0.3.10, internment 0.8.7, and append-only-vec 0.1.9 each added a typosquatted build-time dependency (proc-macro1, proc-macro-en) whose build script downloads and runs a remote binary during cargo build. Full technical analysis: timeline, dropper dissection, runtime detection, IOCs, and remediation.

An update on the August 17 outage and the steps we're taking to improve reliability.The post The August 17 outage, and the work ahead appeared first on The GitHub Blog.

You can now use the to manage comments. covers the full triage loop:Vercel CLIVercel Toolbarvercel commentsStart by listing all of the unresolved comments in the current branch:Dig deeper into a specific thread:Reply, resolve, edit:Update to the latest Vercel CLI version and run . Or just prompt your coding agent: vercel commentsLearn more in the .comments CLI docsRead moreList and filter unresolved comments for the linked project, scoped to your current Git branchInspect a full thread with ever

It’s kinda cool there is Infinity in CSS. You just always need to use it within a calc(), like border-radius: calc(infinity * 1px);. Adam has lots of ideas in that post, and I remember Will was messing with similar ideas a few years ago. I’d say just use it when you’re trying to use an […]

Cloudflare OAuth now supports optional scopes, giving users more control over what an app can access and helping developers build secure consent flows around the task at hand.

You can now emit your own metrics directly from your Vercel Functions and analyze them alongside Vercel's built-in observability data.Use the function from the package to record any value you care about, like request latency or business events, and attach attributes to filter and group by:metric()@vercel/functionsOnce emitted, your custom metrics are available across Observability:• slice and aggregate metrics on the fly.• build and share dashboards.• query using the command.Query builder:Notebo

Three compromised Rust crates pulled in a malicious dependency that downloaded and executed cross-platform malware during Cargo builds.

<p><strong>Research:</strong> <a href="https://github.com/simonw/research/tree/main/bun-webview-json-api#readme">A shot-scraper-style JSON API on Bun 1.4's new Bun.WebView</a></p> <p>Today saw the long awaited <a href="https://bun.com/blog/bun-v1.4">release of Bun 1.4</a>, the first stable version since the infamous Rust rewrite <a href="https://simonwillison.net/2026/Jul/8/rewriting-bun-in-rust/">a few months ago</a>.&l...

Discover SMIL, the often-overlooked way to animate SVGs that works inside `` tags and can fully animate everything in an SVG without JavaScript.

The <geolocation> HTML element does exactly what you might think it does. It’s a dedicated element that gets the user’s location, either once or continuously. The options are set using HTML attributes instead of JavaScript, but JavaScript is still needed. However, <geolocation> requires fewer lines of JavaScript and also offers superior error and permission handling. In fact, the <geolocation> element started off as an all-purpose <permission> element, but is now dedicate...

Unattributed Navigation Overhead exposes the part of Time to First Byte that Navigation Timing cannot explain, including hidden cross-origin redirects.

A supply chain attack compromised popular Rust crates, arrayref, append-only-vec, and internment, injecting a dependency on the malicious proc-macro1 package that downloads and executes a remote payload at build time.Category: Vulnerabilities & Threats

ABEMAのエンジニアの黒崎 ( @kuro_m88 )です。 本日 Go 1.27がリリースされた ...

AI-generated applications often need to authenticate to external services on behalf of their users. That creates a problem: generated code shouldn't have access to the user's credentials.We faced that decision when building the v0 . It lets users connect Snowflake, inspect schemas, query data, and generate applications that run against their warehouses. That generated code has to authenticate to Snowflake, but it is written by a model and runs without human review, and , so the user's OAuth toke

LINEヤフー株式会社では、技術に関するイベントや勉強会の主催・協賛などを行っています。最新情報は各リンク先でご確認ください。タイミングによっては、申し込み開始前や既に満席となっていることがあります。...

A checklist for scoring AI pentesting vendors on validation, code access, scope control, and reliability, plus the red flags that separate a real platform from a strong demo.Category: Aikido

Bun 1.4 rewrites Bun in Rust, ships built-in headless browser automation (Bun.WebView), Bun.Image, Bun.markdown, JSON5, JSONL, Terminal and cron APIs, Node.js 26.3.0 compatibility with 1,517 newly passing tests, parallel test and run, Windows ARM64, and an opt-in global virtual store for up to 7× faster installs.

Vercel Agent now works in Slack code channels, a new kind of channel launched today for working with a coding agent. Anyone in the channel can follow the work, give Agent new instructions, and review the code it writes.Choose from the Slack sidebar, select Vercel as the agent, and describe what you need to get started. You can also ask Agent to create one from an existing channel or thread. It brings that context with it to the new channel.Create a code channelUse code channels to investigate in

You can now manage with . The new command group lets you:Vercel Container RegistryVercel CLIvercel vcrAuthenticate your container tooling, such as Docker, Podman, or Buildah, with a short-lived token scoped to your project. Then build and push:The credentials go to Docker itself, so your existing tooling can push to VCR with standard commands:Repositories are created automatically the first time you push, or explicitly with . From there, you can list what's stored and inspect individual images a

Vercel Functions now support the new , a rewrite of Bun from Zig to Rust, with over 2,900 issues resolved, more than 1,500 additional Node.js compatibility tests passing, and new features and performance improvements.Bun 1.4 releaseBun on Vercel Functions:To update from the previous Bun version, set to in . bunVersion1.4.xvercel.jsonUpgrading is an explicit opt-in because Bun 1.4 has several . Review the breaking changes and update your application before upgrading.breaking changesLearn more abo

<p><strong>Research:</strong> <a href="https://github.com/simonw/research/tree/main/smolmachines-untrusted-sandbox#readme">smolmachines / smolvm as a sandbox for untrusted Python & JavaScript</a></p> <p>I tasked Claude Fable 5 running in Claude Code for web with the following research task:</p><blockquote><p><code>Put https://smolmachines.com through its paces as a fast secure sandbox. Explore what it would take to use th...

はじめに こんにちは。グループIT推進本部の Roki です。 Claude CodeやOpenAI ...

<blockquote cite="https://jeremymorrell.dev/blog/extensible-software-in-the-age-of-llms/"><p>My hypothesis is that <strong>there is a new opportunity for Extensible Software on the web</strong>. LLMs radically lower the cost of authoring extensions, and modern sandbox primitives lower the deployment cost and provide good security boundaries. We can build our app as a solid, accountable core, and allow users to safely extend it in many directions by having LLMs fill in th...

<p>Last week I recorded <a href="https://talkingpostgres.com/episodes/how-ai-is-changing-software-development-with-simon-willison">an episode of the Talking Postgres podcast</a> with Claire Giordano on the subject of "How AI is changing software development". We had a really great conversation. Here are a couple of my highlights from a lightly edited transcript (prompt to Claude: "very minor edits to remove disfluencies").</p><p>This is the latest version of an arg...

はじめにGitHub Actions で Node 20 を利用していると次のような警告が表示されています。Node.js 20 is deprecated. The following actions target Node.js 20 but are being forced to run on Node.js 24: actions/setup-java@v4. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-action...

If you’re juggling multiple Copilot sessions, use the My work pane to track what's in flight, what's done, and what's next.The post GitHub Copilot app for Beginners: Managing your work appeared first on The GitHub Blog.

Socket uncovered 77 linked Firefox extensions, including 40 that steal wallet secrets or credentials and 37 deceptive sports-score shells.

In 2024 and 2025, we reassessed remote Spectre attacks on our Workers infrastructure. We share details about the new attack primitives like Spectre gadgets, remote timers, achieving co-location and how new defenses further harden Cloudflare Workers.

Apply a style when someone navigates from one specific page to another. The idea being it'd make the sources for cross-document view transitions declarative in CSS rather than managing that stuff in JavaScript.CSS Navigation Matching, Early Days originally handwritten and published with love on CSS-Tricks. You should really get the newsletter as well.

CVE-2026-52813 | An Aikido pentesting agent flagged a path traversal in Gogs. We escalated it to full RCE and reported two more bugs, all fixed in 0.14.3.Category: Vulnerabilities & Threats

LUX Sidecar adds context to RUM, while browser-tool fixes show why measurement conditions and small debugging details matter.

As someone who teaches beginning web development, I find that building a WordPress site makes for a great final project. Hosting those projects has always been a roadblock though.WordPress.com Student Plan originally handwritten and published with love on CSS-Tricks. You should really get the newsletter as well.

You can now provision and manage directly from the Vercel Marketplace.AlgoliaAlgolia is a hosted search platform. You send it your content, it builds an index, and your app queries that index instead of your database. Results come back in milliseconds, with typo tolerance, synonyms, and facet counts built in.Key capabilities:Installing adds your Algolia credentials to your project's environment variables; redeploy to pick them up. Algolia's agent skills install too, so your coding agent knows ho

本記事は、Tech-Verse 2026で発表したセッション「AIを入れても、なぜ業務量は思ったほど減らないのか――Human-in-the-loopの限界とAI-Readyな業務設計」の内容を、LI...

Rails boot time is a DX metric in the AI age: meet require-profiler, learn to actually read sampling profilers, and see the pit stop that cut a 200-component monolith's boot by 40%.

Learn what the Server-Timing header is and how to track server-side performance metrics.

now works in Slack. Mention it the way you'd pull a teammate into a thread, and it reads the discussion, answers with the context of the platform running your app, and turns the team's decisions into changes you approve. Vercel for Slack is available today in Public Beta for Pro and Enterprise teams.Vercel Agent. An alert gets noticed in a channel, a fix gets agreed on in a thread, and then someone leaves Slack to do the work. With Vercel Agent, you can tag it in for answers about your infrastru

A new Compliance section in Team settings lets you preview and download Vercel's compliance documents directly in the dashboard. These include attestations like SOC 2 Type 2, security policies, and other security documents that are available through the Trust Center.You can select a single document, an entire attestation, or multiple documents, and download them together as a single zip archive. Every download and preview is watermarked with your user and team information. Some entries link out

's audio models are now available on AI Gateway. To celebrate the launch, every model is free on AI Gateway for the next 30 days, through September 18.Fish AudioFish AudioFour models from Fish Audio are available, including their latest text-to-speech model:How to use models during the offer periodSpeech and transcription ship in the current 7 release.AI SDKGenerate spoken audio from text with and write the result:generateSpeechTranscribe recordings into text with . The audio can be a buffer, a

Vercel Agent is now available in Slack. Mention in any channel or thread, and Agent joins the conversation with relevant context from your Vercel projects, including deployments, builds, logs, metrics, configuration, and connected repos.@VercelFor example, use it to:Vercel Agent acts through its own identity. It's read-only by default, never exceeds the requester’s permissions, and makes no changes without approval. Every action is attributed to Agent, the requester, and the approver.Vercel for

now includes a managed connector for , so your apps and agents can access all Microsoft products such as Teams, OneDrive and more.Vercel ConnectMicrosoftAs a , Vercel registers the Entra application and configures federated credentials for it, so you don't have to create an app registration or manage client secrets yourself. Authorize the app for your Microsoft tenant once, then attach the connector to the projects and environments it needs.Vercel Managed ConnectorCreate a connector from the or

You can now build bots for Instagram with the new for Chat SDK.Instagram adapterBots can send and receive DMs and media, render cards as quick replies and link buttons, show typing indicators, receive reactions, and handle story replies.The adapter connects through Meta's Instagram Messaging API and requires a professional Business or Creator account.Messages are buffered, so streamed responses send as one message when the stream completes. Meta enforces a 24-hour messaging window, so bots can o

Polypane 30 introduces Playgrounds so you can open directories as real HTTPS URLs in seconds, adds support for the Side Panel extension API…

UC Berkeley で開催された Agentic AI Summit 2026 の参加レポート。現地約 5,000 人・登壇者 150 名超のカンファレンスから、harness・評価基盤・セキュリティ・coding agent など Agentic AI の最前線を紹介します。

<p><strong><a href="https://www.modular.com/blog/mojo-open-source">Mojo🔥 is now open source</a></strong></p>The Mojo programming language has been promising an open source release <a href="https://simonwillison.net/2023/May/4/mojo/">since May 2023</a>. Last week they <a href="https://www.modular.com/blog/modular-26-5-mojo-1-0-is-here">shipped their 1.0</a> and today they have followed through on that original promise, releasing the co...

NGINX 1.31.4 is an incremental release focused on the protocols we all depend on. Backends behind a stream or mail proxy can now see a client’s TLS details alongside its address thanks to PROXY protocol v2, HTTP/2 and gRPC requests to your upstreams follow the standards more closely, and NGINX has stricter checks on malformed […]

Teams building on can now create deployments directly from their users' GitHub repositories, without requiring them to install the Vercel GitHub App. When , pass a alongside . Vercel uses the token to retrieve the source and build the deployment.Vercel for Platformscreating a deploymentgitAccessTokengitSourceTokens should be read-only, scoped to the requested repository, and valid for 24 hours or less. Vercel temporarily stores the token in encrypted form so source retrieval can complete. The to

RFC 9234 lets routers reject route leaks on their own, using BGP Roles and the Only to Customer attribute. We measured who has deployed it, and found two Tier 1 networks unexpectedly stripping OTC.

Toolbox App 3.7 enables JVM memory optimization by default, improves the reliability of updates and session expiration recovery, and ensures compatibility with Windows Smart App Control. Action required: Update Toolbox App on Windows If you’re using an older version of the Toolbox App (3.4 or earlier) for Windows, update to v3.7 or later to keep […]

Matt Pocock's skills offers a suite of impactful skills to streamline AI integration in software development. These skills facilitate prompt refinement, project setup, and task management.

Agents need to run untrusted code, and the microVM has become the standard way to do it: a dedicated guest kernel per workload, isolated from the host and from every other workload on the same machine. But recent security research and real-world incidents have revealed that agents running untrusted code do not need to cross a VM boundary to escape containment; they only need one network path the security model failed to account for, which we explained in our post .A sandbox without a network bou

大量の要素を一度に DOM へ追加すると、初期描画や更新のコストが増加します。TanStack Virtual はスクロール位置に応じて必要な要素だけを描画するヘッドレスな仮想化ライブラリです。この記事では React 向けの @tanstack/react-virtual を使い、リストを仮想化して描画する方法を紹介します。

LUX Sidecar is a small SpeedCurve RUM plugin that adds browser and navigation context to your real-user performance data.

Tree View は階層構造を効率よく操作できる一方、ARIA ロールを付けるだけではアクセシブルになりません。WAI-ARIA APG を参考に、roving tabindex、矢印キー、選択、文字検索を備えた単一選択の Tree View を React で実装する方法を紹介します

こんにちは。自然言語処理エンジニアの石原です。Yahoo!ショッピングでは、ユーザーが目的の商品にたどり着きやすくなるよう、検索機能の改善を継続的に進めています。本記事では、その中から、直前の検索クエ...

We are excited to announce React Compiler support in Oxlint and Oxc Transform.Oxlint now includes 22 React Compiler-powered rules that use the compiler's validation passes to catch violations of the Rules of React.The package oxc-transform-react applies React Compiler's automatic memoization. It is more than 10 times faster than Babel in our preliminary benchmark.Vite integration is available in @vitejs/plugin-react v6.1.0.Getting started ​Oxlint ​Enable the React plugin and its correctness rule

pnpm 11.21 and 11.22 teach pnpm install to update the lockfile in place for most everyday changes instead of re-resolving the whole dependency graph, stop recording SSH URLs that break installs on CI, make global installs switch over atomically and global interactive updates select whole install groups, add pnpm cache path, and take away a project's ability to relocate pnpm's machine-level state through pnpm-workspace.yaml.

The Sandbox CLI version ships four output and error improvements:4.0.1Each of these messages now carries the action to take next instead of leaving you to work it out. and output now ends with a connect hint, so a fresh sandbox never leaves you wondering what to type next.createforkWhen a command references a sandbox that does not exist, the error is quiet and actionable instead of a raw API dump. Setting restores the request detail for debugging.DEBUG=sandbox:errors opens a plain interactive sh

The lets you run established coding-agent runtimes through one unified interface, so you can switch runtimes without changing your application code. Today we are adding Cline, which runs through the same interface as other supported harness.AI SDK harness layerHarnessAgent is the official harness adapter for Cline, implemented in collaboration with the Cline team.@ai-sdk/harness-clineCline runs fully in the host process and uses the sandbox as a remote filesystem and shell, so only its tools ope

is now available on AI Gateway.GLM 5.3 from Z.aiGLM 5.3 has improvements vs. GLM 5.2 at complex software engineering and at agent tasks that run across many steps, and it reaches those results while producing fewer output tokens than GLM 5.2 did at the same effort level.Z.ai also reports stronger vulnerability discovery, including reasoning across the successive stages of an exploitation chain. measures that work directly, scoring how reliably a model finds security vulnerabilities in applicatio

Vercel KMS lets you sign JWTs and arbitrary messages from your Vercel Functions using managed asymmetric signing keys, so private keys never live in your code or environment variables. Your function authenticates with its token, and the private key stays inside Vercel's key management service while verifiers use only the public key.Vercel OIDCWith Vercel KMS you can:Sign a token inside a function:Verify a token anywhere with a standard JOSE library, using the issuer's public JWKS:Set up an issue

<p><strong><a href="https://artificialanalysis.ai/models/qwen3-8-27b">Qwen 3.8 27B scores 52 on the Artificial Analysis Intelligence Index</a></strong></p>That's the same score as GPT-5.6 Luna (max), and just one point behind GLM-5.2 (max) and DeepSeek V4 Pro 0813 (max) - that GLM is <a href="https://huggingface.co/zai-org/GLM-5.2">753B</a> and that DeepSeek is <a href="https://huggingface.co/deepseek-ai/DeepSeek-V4-Pro-0813">1.7T parameters...

Update! This is a re-written version of this recently-published post about linting code bound for the React Compiler with Oxlint. Oxlint just published a new guide to this, so this post reflects that new information. The React team made a big splash recently when it announced the release of the Rust rewrite of React Compiler and said […]

Safari Technology Preview 250 fixed a subtle Web Inspector bug that overwrote page-authored Cache-Control request headers when the resource cache was disabled.

Chat is great for intent, but agent work gets lost in the scroll. Here is how I use canvases with my agentic workflows—and why your workflow also deserves a canvas.The post How canvases make agentic workflows visible, steerable, and cost-efficient appeared first on The GitHub Blog.

<p><strong><a href="https://www.404media.co/we-tracked-a-shipment-of-rare-books-it-ended-at-an-amazon-ai-training-facility/">We Tracked a Shipment of Rare Books. It Ended at an Amazon AI Training Facility</a></strong></p>Excellent piece of reporting from 404 Media. For a while now there have been stories of book dealers receiving orders for large volumes of books from apparently price-insensitive anonymous customers, widely suspected to be companies looking t...

Lea's pushing back on light/dark mode implementations that display three state options for visitors: light, dark, and system.Dark mode toggles: two states are enough originally handwritten and published with love on CSS-Tricks. You should really get the newsletter as well.

NIST disclosed an unreleased AI tool called V-etalon and opened a broad inquiry into NVD modernization after years of automation plans produced no public enrichment system.

株式会社タップルで内定者アルバイトをしている及川寛太 (@kanta_cky) です。 本記事では、 ...

A major OAuth and OpenID Connect expansion, updated MCP authorization, SCIM Groups and role projections, unified identity, device authorization, and more.

Pro customers can now connect repositories to Vercel. OriginOnce connected, pull requests on Origin will automatically generate Preview deployments on Vercel, and merging will trigger a Production deployment.You can connect Origin through , , or by clicking "Continue with Origin" when . Team settingsProject settingscreating a new projectYou can also connect Vercel to a repository from within Origin by adding Vercel in the repo's Apps tab. Vercel's integration is in public beta and Origin is in e

, the flagship of OpenAI's GPT-5.6 series, is 50% off on AI Gateway through September 18. The discount applies on the OpenAI provider to all token types, tiers, regions, and modes, and it is available only on requests running directly through AI Gateway (not BYOK).GPT-5.6 SolThe discount applies on the same terms everywhere else the model is priced: across every service tier, including fast mode, and to cached tokens, cache writes, long-context requests, and different regions.It covers requests

<p>I started building my <a href="https://tools.simonwillison.net/markdown-svg-renderer">markdown-svg-renderer</a> tool <a href="https://tools.simonwillison.net/colophon#markdown-svg-renderer.html">in May</a>, but I've since added enough features to it that it's worth talking about here again.</p><p>It's evolved into my ideal tool for sharing Markdown transcripts that include SVG documents. Given my <a href="https://simonwillison.net/tags/pelican-rid...

<p>Friday's big release was <a href="https://huggingface.co/Qwen/Qwen3.8-27B">Qwen 3.8 27B</a>, an Apache 2 licensed 27B parameter vision-capable LLM from Alibaba's Qwen research lab. I've been looking forward to this one: 27B is an excellent size for running a model on a reasonably specced laptop, and its predecessor <a href="https://simonwillison.net/2026/Apr/22/qwen36-27b/">Qwen 3.6 27B</a> was impressive.</p><p>Qwen's <a href="https://huggingface...

In his AI Council 2026 talk, Feross Aboukhadijeh covers recent package compromises, vulnerability discovery, and a more automated security model.

<blockquote cite="https://twitter.com/darioamodei/status/2088758819304443967"><p>I do agree that the public has a negative view of AI (and that this is a big problem), but I don’t think it is primarily caused by me or any other AI leader warning about AI’s risks. I think it is fundamentally a crisis of trust. I think that ordinary people don’t trust companies, governments, or the tech industry and always suspect that we are cooking up some new way to screw them over. The causes of t...

Chrome 151 で `` 要素が使えるようになりました。従来の `getUserMedia()` の問題を解決するために提案された新しい HTML 要素です。この記事では、仕様の概要と、実際に動かしてみた様子を紹介します。

ChainDrop npm worm: 444 packages and 2,212 versions poisoned, starting with [email protected]. Payload analysis, affected package list, IOCs, and remediation steps.

!主に Oracle がターゲットの記事ですが，「なぜ PostgreSQL や MySQL では問題にならないのか」を実測付きで掘り下げています。 Oracle ユーザ以外の方も是非ご一読ください。 はじめにある案件で，静的 SQL ジェネレータ（SQL ファイルを書くと型付きのアクセサコードを生成してくれるタイプのツール）を採用していたバックエンドを，SQL テンプレート方式に載せ替えました。きっかけは「条件分岐の多い検索クエリが，どう頑張っても Oracle でまともな実行計画にならない」という， EXPLAIN を適用して初めて顕在化した性能問題です。 調べていくう...

How to deny Google Antigravity's agent access to your .env in the IDE and the CLI, how to verify it worked, and the settings around it that matter.

Team PCP exfiltrated 78,330 secrets from 2,186 organizations via CI/CD pipelines. Analysis of the CloudSEK disclosure, why attackers target CI/CD, and how to defend.

<p><strong>Tool:</strong> <a href="https://tools.simonwillison.net/cors-chat">CORS Chat</a></p> <p>I built this today (<a href="https://gist.github.com/simonw/92a1d97773744b45bf259e003013cf36">with GPT-5.6-Sol xhigh</a>) to help test Qwen 3.8 27B running in LM Studio on both my M5 MacBook Pro and an NVIDIA DGX Spark.</p><p>It provides a web UI for exercising an OpenAI-Responses-compatible chat endpoint. I've tried it against LM S...