malicious code detected in tensorlake 0.5.144Category: Vulnerabilities & Threats

The malicious release was built from the project's own main branch and published with an npm provenance attestation.

こんにちは！LINEヤフー 分析ユニット LINE Service Analytics Divisionの柳です。8月20日にデータサイエンス関連の事例を共有するイベントを開催しました。本記事では、イ...

Tensorlake npm SDK version 0.5.144 was compromised in a ChainDrop / Shai-Hulud attack, delivering credential-stealing malware.

This Astro tutorial shows how to build an interactive blog using file-based routing, build-time and live content collections, and the islands architecture.

<blockquote cite="https://www.youtube.com/watch?v=HzraLR2VkNM&t=2259s"><p>I've always been kind of into computers since I was young. And then when film started to move from analog film to digital, I became more interested in that aspect of it. And the visual effects workflow for many years has included machine learning.</p><p>So I can write like pretty shitty Python scripts and stuff like that because with convolutional neural networks, which were the sort of pre...

<p>As previously <a href="https://simonwillison.net/2026/Sep/28/claude-sonnet-5-5/">promised</a>, here's Anthropic's new fast, low cost model: <a href="https://www.anthropic.com/claude-haiku-5-5">Introducing Claude Haiku 5.5</a>.</p><p>The previous Haiku, 4.5, was very much showing its age. It came out <a href="https://simonwillison.net/2025/Oct/15/claude-haiku-45/">almost a year ago</a>, and was priced at $1/million input and $5/million out...

Developers aren’t becoming more careless; they’re being outpaced. The tools that let developers create more software should also take on more of the work of protecting it.The post Secret protection must scale with software appeared first on The GitHub Blog.

Cloudflare Managed Defense uses a team of specialized AI agents built on Workers and global network telemetry to analyze security alerts. By separating deterministic evidence collection from model inference, the system delivers grounded recommendations to Managed Defense Analysts.

Socket found 16 malicious Firefox extensions designed to steal crypto wallet recovery phrases and private keys using cloned Rabby and OKX interfaces.

There are some real complexities using iframes and the postMessage API for communication between a widget and its parent. Security vulnerabilities like cross-origin scripting risks being one.

<p><strong><a href="https://refactoringenglish.com/blog/anti-patterns-software-blogging/#summary">Anti-Patterns in Software Blogging</a></strong></p>Some excellent writing advice from Michael Lynch. Michael warns against "meandering intros", misjudging your reader's existing knowledge, assuming they'll read your previous posts, and excessive formality.</p><p>He also warns against <a href="https://refactoringenglish.com/blog/anti-patterns-softwa...

<blockquote cite="https://news.ycombinator.com/item?id=49984923#49987367"><p>I was a graph theory junkie long ago and even moved to Budapest for awhile to study among the greats. While I was there I started working on Barnette's Conjecture which came to occupy my thoughts over the next 24 years of my life, on and off as I worked in many different fields. Last summer I even thought for a few days that I had actually solved it.</p><p>But it's supposedly proven here - <a...

こんにちは、エンジニアの中山です。以前 Google の AI Overview で、ピザに接着剤を使うアドバイス が掲出されて話題になりましたが、皆さんは生成 AI の出力品質にどのように向き合って...

<p><strong><a href="https://wikimediafoundation.org/news/2026/10/05/openai-rogue-agent-activities-found-on-wikimedia-projects/">OpenAI “rogue” agent activities found on Wikimedia projects</a></strong></p>Given how tempting a target wikis are for rogue agent swarms, it's not a huge surprise that Wikipedia found evidence of that activity once they went looking:</p><blockquote><p>The Wikimedia Foundation conducted its own investigation to see w...

PostgreSQL does not guarantee row order without ORDER BY. Use Rails 8.2 or pg_disorder to shuffle unordered SELECT results and expose hidden order dependencies, flaky tests, and application bugs. This is chaos engineering directed at your database.

Learn how Aikido maps to SOC 2 Type 1 and Type 2 audits, with SLA tracking, CI/CD gates, and cloud checks that produce exportable audit evidence.Category: Compliance

is now free for requests that the (WAF) denies, challenges, or rate limits. CDN Requests and Fast Data Transfer are for this traffic.Microfrontends RoutingWeb Application Firewallalready freeThe change applies automatically to every project using microfrontends. Learn how to in the Firewall documentation.set up WAF rulesRead more

is now available on through an OpenAI-compatible endpoint. Use it with or any other decision model on AI Gateway.OpenAI's Decisions APIAI GatewayGPT-6 Luna Decisions/v1/decisionsDecision models answer typed questions about a shared input and return probabilities, choices, and scores instead of generated text, which suits routing, triage, guardrails, and rubric scoring. You can ask predicate (yes/no), choice, and score questions against the same input in one request. See for examples of each ques

from is now available on .Claude Haiku 5.5AnthropicAI GatewayIt is built for high-volume, cost-sensitive tasks such as summaries, context compaction, database queries, and classification, and works as a subagent alongside larger Claude models on coding work. It is also the fastest Claude model at standard speed, which suits live customer support and browser use. Test it as a direct upgrade wherever you use today.Claude Haiku 4.5Haiku 5.5 is the first Haiku model with effort levels. It uses adapt

is now available on as a stealth model for teams on with purchased AI Gateway credits. It is free to use during the stealth period.Glyph ClusterAI GatewayPro and Enterprise plansGlyph Cluster is a reasoning model for coding and long-context analysis, and handles multi-step work such as planning, synthesis, quantitative reasoning, and comparing material across large inputs.For coding, Glyph Cluster can review code, explain failures, debug issues, propose changes, and reason through implementation

now supports timestamp attributes, so you can target by date and time.Vercel FlagsentitiesUse timestamp attributes to show a campaign page only between two dates, run a Black Friday promotion, or target users who registered before a cutoff.You can configure timestamp attributes in the dashboard or via the CLI. In the Vercel dashboard, open , select , and create or select an entity. Add an attribute and set its data type to .FlagsEntitiestimestampOr define the attribute with the CLI:Whether you c

<blockquote cite="https://www.nytimes.com/live/2026/10/05/world/openai-australia-hearing/94c8067e-4098-5c00-9673-c78cb58a9d8a"><p>Since the Medicare breach, OpenAI has put in place additional monitoring to allow “immediate intervention” by staff to stop training if the company’s models access the internet in ways they’re not supposed to, Mr. Kwon [chief strategy officer at OpenAI] said.</p></blockquote><p class="cite">— <a href="https://www.nytimes.com...

<p><strong>Release:</strong> <a href="https://github.com/simonw/llm-openai-decisions/releases/tag/0.1a0">llm-openai-decisions 0.1a0</a></p> <p>OpenAI released their new Jev-style <a href="https://developers.openai.com/api/docs/guides/decisions">Decisions API</a>, as previously announced at last week's DevDay.</p><p>Since I already have an <a href="https://github.com/simonw/llm-typesafe">llm-typesafe</a> plugin for tal...

I should have noted this sooner (sorry!), but it’s that time of year when Interop is planning for next year. Submissions are closed, and now they spend time refining and culling the proposals. We’ll hear on February 4th, 2027 what the focus will be on. I believe there is still time to “vote” (meaning basically […]

<p><strong>Release:</strong> <a href="https://github.com/simonw/llm-mistral/releases/tag/0.16">llm-mistral 0.16</a></p> <p>Adds support for reasoning models, such as the newly released <a href="https://simonwillison.net/2026/Oct/6/le-chonk/">Mistral Large 4</a>.</p> <p>Tags: <a href="https://simonwillison.net/tags/llm">llm</a>, <a href="https://simonwillison.net/tags/mistral">mistral</a>, <a href="https...

We're rebuilding GitHub's Git infrastructure while GitHub keeps running, creating a foundation for agent-scale software development.The post Building Git infrastructure for agent-scale development appeared first on The GitHub Blog.

<p><a href="https://news.ycombinator.com/item?id=49980487#49983751">My comment</a> on <a href="https://news.ycombinator.com/item?id=49980487">EmbeddingGemma 2</a> — Hacker News.</p><p>I really appreciate that <a href="https://blog.google/innovation-and-ai/technology/developers-tools/embeddinggemma-2/">EmbeddingGemma 2</a> is under the Apache 2.0 license.</p><p>For embedding models in particular, I don't think it makes s...

<p><strong><a href="https://mistral.ai/news/mistral-large-4/">Introducing Mistral Large 4: Le chonk</a></strong></p>Mistral are back in the game. Today they're releasing a preview of Mistral Large 4, a 1 trillion parameter, 49 billion active parameter model trained on their own cluster of 3,800 NVIDIA Grace Blackwell GPUs.</p><p>The preview is available via their API. They promise to release the open weights model at the "end of this month".</p...

<p><strong>TIL:</strong> <a href="https://til.simonwillison.net/datasette/datasette-parseable-opentelemetry">Using Parseable with Datasette for OpenTelemetry traces</a></p> <p>I <a href="https://news.ycombinator.com/item?id=49978171">saw Parseable in a Show HN</a> today - it's a new observability platform with both an <a href="https://github.com/parseablehq/parseable">open source (AGPL)</a> Rust implementation (a single ~180MB bi...

Socket now scans VS Code extensions, giving teams early detection of risky behaviors, hidden capabilities, and supply chain threats in developer tools.

<p><a href="https://news.ycombinator.com/item?id=49977979#49982139">My comment</a> on <a href="https://news.ycombinator.com/item?id=49977979">Mistral Large 4</a> — Hacker News.</p><blockquote><p><a href="https://news.ycombinator.com/item?id=49977979#49979658">wren6991</a>: The benchmark is saturated. Frontier models are tested with an armadillo in fishnet tights jaywalking on Mars.</p></blockquote><p>OK well...

On October 11, 2026, the DNS root switches to a new key-signing key (KSK-2024). Learn what this means for you, and how RFC 8509 trust anchor sentinels allow you to test whether your DNS resolver is ready for the rollover.

<p><strong>Release:</strong> <a href="https://github.com/simonw/datasette-atom/releases/tag/0.11a0">datasette-atom 0.11a0</a></p> <p>A minor fix for compatibility with the latest Datasette alphas. This meant we could upgrade the <a href="https://datasette.io/">datasette.io</a> site to Datasette 1.0a41.</p> <p>Tags: <a href="https://simonwillison.net/tags/atom">atom</a>, <a href="https://simonwillison.net/tags/datas...

can now escalate a decision request to a fallback model when the primary model's answer trips a .AI Gatewayconfidence condition you setConditions can be combined, so an escalation can depend on more than one signal. The plain model names you already list in keep catching outright errors, so existing fallbacks are unaffected. Confidence conditions cover Choice and Score questions. Boolean questions escalate on a probability range instead.modelsSet the fallback by adding one conditional object to

Package managers download megabytes of package metadata on every clean install. Here is how vlt.io serves the same installs at a fraction of the size.

<p><strong>Tool:</strong> <a href="https://tools.simonwillison.net/scrimshaw-jukebox">Scrimshaw Jukebox</a></p> <p>I wanted to see if Claude Opus 5.5 could compose music, so <a href="https://claude.ai/share/1f721c20-2499-4d23-b368-3ab57146d956">I tried this</a>:</p><blockquote><p><code>I want you to write some computer game music for me. First design simple text based format for the music and build an artifact that ca...

Aikido has achieved FedRAMP Moderate authorization, bringing AI-native, automated vulnerability remediation to U.S. federal agencies.Category: Company Updates

A practical guide to naming UI components, with useful resources, naming conventions, and structures. You’ll find more [useful guides](https://www.smashingmagazine.com/category/guides/) and [online workshops](https://smashingconf.com/online-workshops) here on Smashing Magazine, so make sure to browse and explore.

JetBrains has joined the Open Source Security Foundation (OpenSSF) as a general member. OpenSSF is a cross-industry initiative of the Linux Foundation that works to secure the software supply chain on which the industry depends. The foundation announced our membership today, together with other new members, at OpenSSF Community Day Europe in Prague, co-located with […]

こんにちは。LINEでAndroidアプリの開発を担当しているMoriです。この記事では、DroidKaigi 2026で発表した「デバイス操作はAIエージェントの時代へ。mobile-mcpを活用し...

こんにちは、フロントエンドエンジニアのやなぎ（@apple_yagi）です。 PR TIMESでは、2023年頃からプレスリリース掲載ページやトップページなどをNext.jsへ移行してきましたが、今回、そのNext.js […]

This release is all about trust. Configuration files now have to earn it before they can touch your

This release fixes pnpm install failures after an overrides change and on a filtered frozen install with catalogPrune. It also fixes several bugs in the experimental nodeLinker.type: loaded, which now keeps its generated files in node_modules.

This release adds an experimental loaded node linker, lets pnpm-lock.yaml record resolution settings, and reads cached registry metadata faster. It also carries several security fixes, including one that stops a dependency version from writing files outside the global virtual store.

This release reads cached registry metadata faster and makes pnpm config get --global ignore project settings. It also carries several security fixes for package archives, git dependencies, and config dependencies.

from is now available on . It improves image generation and editing over earlier Nano Banana models.Nano Banana 2.1GoogleAI GatewayThis release targets product recontextualization, mask- and ink-based editing, and factuality. Product recontextualization places an existing product in a new scene. Mask- and ink-based edits change only the region marked by a mask or by strokes drawn on the image. Factuality is how accurately images depict real-world subjects.The model renders photorealistic skin to

is now available on AI Gateway. The open-weight, natively multimodal model combines reasoning with text and image understanding. It is useful for cyber defense, manufacturing, and finance workflows.Mistral Large 4You can access the model through AI Gateway with one API key, without creating a separate Mistral account.Use Mistral Large 4 ( ) with the , , , or . You can also select it in a connected to AI Gateway.mistral/mistral-large-4AI SDKOpenAI-compatible Chat Completions APIResponses APIAnthr

<blockquote cite="https://twitter.com/felixrieseberg/status/2107206431376334975"><p>The "old" version of Cowork runs model inference in the cloud, executing tool calls in an Anthropic-provided VM we shipped to your computer. We added the VM for capability, safety, and security reasons - mapping in just the data you explicitly added to your session. People loved what they were able to do with Claude but didn't love the disk, battery, and performance cost of running the VM locally. Al...

Nuxt 4.6 makes Nuxt server-agnostic with nuxt/server, rebuilds typed $fetch, adds sessions, Vue Vapor support and new dev error pages, and ships alongside Nuxt CLI v4.

I've been part of open source for most of my life. This year, the projects I love started closing their doors to outside contributors, and I don't blame them one bit, but it makes me sad.A personal look at how AI is changing open source as I've known it.

We’re launching ReviewBench, a benchmark for code review agents built on representative GitHub pull requests, multi-source ground truth, calibrated evaluation, and production-aligned metrics.The post ReviewBench: An open benchmark for AI code review appeared first on The GitHub Blog.

On October 5, 2026, StepSecurity analyzed @subql/[email protected] on npm and identified a hidden payload that collects credentials and supports remote shell access. It starts during installation and when the package is imported. The code targets developer workstations and CI environments, including GitHub Actions runners and accessible cloud services.

You can tell a parent element how many children it has with... scroll-driven animations??

We celebrated our 16th birthday with 46 announcements across open source, post-quantum security, AI agents, and developer platform upgrades. Here’s a day-by-day roundup of everything we shipped.

A year after announcing our goal to hire 1,111 interns, more than 750 early-career builders have shipped real products across 48 teams at Cloudflare. From Birthday Week launches to post-quantum security, our interns prove that AI amplifies human potential instead of replacing it.

MyGo は Go でデスクトップアプリを作るフレームワークです。OS の WebView に Web の画面を表示し、Go のメソッドから生成した TypeScript クライアントでネイティブ機能を呼び出せます。この記事ではテキストをファイルに保存するメモアプリを作り、macOS で起動・保存・ビルドを試します。

The Ember project is excited to announce the release of Ember v7.3. This is a standard minor release as part of the Ember Release Train process.This release brings a new way to create reactive state that doesn't need a class, makes a serious dent in the size of the JavaScript bundle for apps that are on the modern build system, and fixes a handful of long-standing bugs in the router and elsewhere! 🎉😃Ember.js 7.3Ember.js 7.3 introduces one new feature per RFC #1071: tracked can now be used outs...

This release is all about what happens around your tasks. Dependencies can now run after a task to

now supports OpenAI's Ultrafast service tier for GPT-6 Astra, providing faster output for interactive applications and rapid coding iterations.AI GatewayTo use Ultrafast, request it for through AI SDK, the Chat Completions API, or Responses API:openai/gpt-6-astraFor workflows with frequent tool calls, OpenAI recommends the Responses API over a persistent WebSocket connection to reduce overhead between turns. See the for persistent connections, including AI SDK over WebSocket.Ultrafast service-ti

from Black Forest Labs is now available on AI Gateway. Generate images from text or edit existing images using the same model, with one API key and no Black Forest Labs account required.FLUX 3 ImageFLUX 3 Image supports up to ten reference images for editing, combining subjects, or changing the composition. It supports five resolution tiers from 768 × 768 to 4K, with square, portrait, and landscape aspect ratios.Set , then use as the model ID in AI SDK 7 or later. To generate an image, call with

<p><strong>Research:</strong> <a href="https://github.com/simonw/research/tree/main/qwen38-addition-in-words#readme">Qwen3.8 27B addition in words</a></p> <p>Colin Frasier <a href="https://bsky.app/profile/colin-fraser.net/post/3mwopbyznhs2k">posted on Bluesky</a> about an experiment he ran over two years ago using GPT-4o to see how well it could "compute the sum but return the answer in words" across increasingly large numbers. Here's the c...

<p>Here's a product feature which the world is going to need a whole lot more of over the coming months and years: <strong>default hard budget caps</strong>. I'm talking about the feature of pay-by-usage services and APIs that lets you say "after $X/month, cut this thing off and return errors". These need to be <strong>hard</strong> limits. Soft caps, "after $X/month, send me a warning email", will not cut it.</p><p>Coding agents, and personal agents (c...

<p>I just sent the September edition of my <a href="https://github.com/sponsors/simonw/">sponsors-only monthly newsletter</a>. If you are a sponsor (or start a sponsorship now) you can <a href="https://github.com/simonw-private/monthly/blob/main/2026-09-september.md">access it here</a>.</p><p>This month:</p><ul><li>More Fable class models</li><li>A pricing war</li><li>3D graphics, Blender, and pixel art</li&g...

MSW v3 で公式の Vite プラグインが追加されました。Worker ファイルのコピーや更新が不要になり、virtual:msw からモックを設定できます。この記事では、Vite と TypeScript の小さなアプリケーションにプラグインを導入する方法を試してみます。

前提: ESLint の設定方法と共有設定 ESLint での共有設定の主な役割は, プラグインの設定とルールの設定の二つです. ESLint 本体には JavaScript に関する基本的なルールしか組み込まれていません. そのため TypeScript など異なる言語に対するルールや, Node.js, React などの特定の環境やライブラリ固有のルール, その他発展的なルールを使うためには, 追加でプラグインをインストールして設定を記述する必要があります. この設定はそれなりに (プロジェクトごとに毎回記述するにしては) 複雑になることもあり (例: TypeScript で impo…

This release moves the WebContainer build into a separate @pnpm/wasm package, shrinks the pnpm package back to about 4 MB, and fixes pnpm publish with provenance from GitLab CI.

pnpm 11.28.4 fixes two ways credentials could leak, makes pnpm install --frozen-lockfile accept several lockfiles it rejected, warns when an optional dependency cannot be fetched, and stops pnpm self-update from installing a second pnpm next to a Homebrew one.

<p><strong>Museum:</strong> <a href="https://www.niche-museums.com/119">Rex's Dino Store</a></p> <p>Located just before the turnstiles in the Grand Army Plaza subway station at the north end of Brooklyn's Prospect Park is this former newsstand which is now operated by a dinosaur.</p><p>The density of dinosaur puns is <em>exceptional</em>.</p> <p>Tags: <a href="https://simonwillison.net/tags/art">art<...

Cloudflare is launching eight major updates that bring logs, traces, analytics, alerts, dashboards, querying, and telemetry export into one observability platform, with simpler and more predictable pricing.

Streamline demonstrates how to build long-running, continuous video processing pipelines by pairing Cloudflare Workers and Durable Objects with a containerized media engine.

Learn to direct AI agents, critically review their output, and keep technical judgment at the center of your workflow.The post AI is changing developer work. Here are three skills to strengthen. appeared first on The GitHub Blog.

The new CSS progress() function calculates a value between 0 and 1, representing its position within a defined range. While awaiting broader browser support, users can manually implement this using other methods.

Cloudflare AI Gateway now supports native web search API integration in partnership with Ceramic.ai, Exa, and Linkup. Developers can now inject real-time web context into model inference calls via AI Gateway, REST APIs, or Workers bindings.

Cloudflare Traces shows how a request moves through security rules, transformations, cache, routing, Workers, and your origin, then follows it across services running anywhere in your stack.

A year after pledging to eliminate two-tier product access, Cloudflare has expanded Logpush, multi-account governance, and higher platform limits to all accounts. Here is an update on our progress, how we dogfood these tools internally, and what is coming next.

We’re announcing the closed beta of a self-serve Cloudflare OHTTP Gateway. We’re also renaming our Privacy Gateway to Cloudflare OHTTP Relay to better distinguish the two products.

Fraudsters are increasingly using AI to bypass stateless security checks. Cloudflare's new Account Abuse Protection dashboard uses stateful analysis and edge-generated Hashed User IDs to help teams investigate and block account abuse.

Quick Tunnels now support email authentication. Add --allowed-mail to one cloudflared command, and only the addresses or domains you list can reach your local app. No Cloudflare account required on either side.

Some of the world's leading organizations are building the future of non-profit work with Cloudflare.

Cloudflare now ranks as the fastest provider across 74% of the top 1,000 global networks. By incorporating background telemetry from Cloudflare Challenge Pages, we have expanded our real-user measurement scale while maintaining user privacy.

We compare the top vulnerability remediation tools in 2026: Aikido Security, Snyk, GitHub Advanced Security, Tenable, Qualys, and WizCategory: DevSec Tools & Comparisons

It's issue #200 of The Index! A real milestone that we should celebrate with a dedicated CSS links issue. Let's get stuck in to the good links.Multiple-column layout, rows, rules, and floatsThe Boss™ is here with some fantastic news on layout capabilities that we can use. They should really open the door to more creative layouts, which is great.Our CSS isn’t opinionated enoughThis really resonates as Craig is describing issues that inspired CUBE CSS. Semantic state changes are a really good way

It's simply impossible to not hear about Jev. Seemingly everyone is tinkering with it in some way, from using it to to . make trading decisionsgenerating UIs with it(what could possibly go wrong?)(maybe we're onto something here!) is a new kind of AI model. You feed it data and ask it a set of multiple-choice questions, and it responds with its answers and how confident it is in each. Just like with any other model, Jev can and will make mistakes, but it will make them fast. ​Jev​The bottom line

Rogo on Vercel73,000+ deployments in a single monthAgent-written code shipped to production in 5 minutes6 production AI agents automating work from churn analysis to deal deskZero manual triage during production incidents with agent swarms on AI SDK builds Felix, an AI agent that generates decks, financial models, and reports for a majority of the world's largest financial institutions. The Rogo team is rearchitecting its internal applications on Vercel, where agent-written code ships in 5 minut

e2e は自然言語による操作と、要素を指定した操作・アサーションを組み合わせられるテストフレームワークです。この記事では Todo アプリを対象に、AI に操作を任せて結果をコードで検証するテストを作成します。

Socket uncovered two malicious VS Code themes in a GlassWorm-linked cluster with thousands of installs across VS Code Marketplace and Open VSX.

HighlightsSupport for tokens and comments in SourceCodeRule authors often work with ESLint’s SourceCode object, which represents the JavaScript source code being linted. Its getText(), getLoc(), and getRange() methods have always accepted a node, token, or comment, but the documentation didn’t describe every argument type, and the type definitions rejected some valid calls, such as passing a comment.This release updates the documentation and type definitions to match the actual behavior. This al

This release runs pnpm in StackBlitz WebContainers, adds a per-registry networkConcurrency setting, and records every installed project in the store. It also carries a security fix for pnpm login.

A personal reflection on giving up handwritten code, the guardrails making AI useful, and the possibility of a more visual way to build software.

We compare the top threat intelligence feeds in 2026: Aikido Intel, Socket Threat Feed, Snyk Security Database, OSV.dev, and Spectra Intelligence (ReversingLabs)Category: DevSec Tools & Comparisons

<p><strong>Release:</strong> <a href="https://github.com/simonw/pwasm/releases/tag/0.2a0">pwasm 0.2a0</a></p> <p>pwasm is one of my folly projects - an entirely vibe-coded pure Python WebAssembly engine that I built in January during my first bout of <a href="https://simonwillison.net/2026/Sep/27/2026-in-llms-so-far/#simon-willison-2026-in-llms.012.webp">AI mania</a>.</p><p>I hadn't touched it since January, so I decided to let C...

ShopGym creates realistic online stores and generates shopping tasks based on each store’s products and features. Developers can then repeatedly test shopping agents under consistent conditions.

We are introducing Clef and Clef-flash, open-source decision models hosted on Workers AI for high-speed classification and agentic workflows. Also launching: a new reinforcement learning platform that allows developers to fine-tune decision models using their own data.

From verifying AI-written code to securing npm dependencies, these are the sessions I’m building my Universe agenda around.The post 10 technical talks I’m excited about at GitHub Universe 2026 appeared first on The GitHub Blog.

David Dias has been working on “Front-End Checklist” stuff for a decade, and it looks like this latest version of it a little over a year. There is loads of good general advice in it that can be easy to forget: Now it’s all AI’d up, which makes sense, having a skill and MCP so […]

AI sovereignty is not a zero-sum game, but many governments now believe it is. Cloudflare's answer: more local open-source models, model-agnostic security tools, and a commitment to giving nations genuine choice.

Workers KV Instant delivers sub-2ms p99 read latencies and 250ms global replication across Cloudflare’s 300+ edge locations. KV Instant eliminates cold-read penalties and uses the familiar Workers KV API.

Cloudflare OS gives everyone in your organization an agent workspace that knows how your company works and connects to its data and systems. We’re opening the waitlist for fully managed deployments that you’ll be able to launch in a few clicks.

Cloudflare K2 is a serverless event streaming service built directly on top of R2 object storage for high-scale data movement and long-term retention. By decoupling producers and consumers at the edge, K2 enables durable, ordered log streams without the operational overhead of traditional broker clusters.

Cloudflare is hosting a competition to see who will build the next Git platform for an era of AI agents. Artifacts is in open beta, with Workers bindings, data jurisdiction controls, and event subscriptions for repository changes.

Capital One is partnering with Socket to proactively secure its open source supply chain.

Comparing the top endpoint security tools for developers in 2026. We look at Aikido Security, GitGuardian Developer Endpoint Protection, Koi Security, Socket, and CrowdStrike FalconCategory: DevSec Tools & Comparisons

is deprecating First Input Delay (FID) and will stop recording new measurements on November 1st.Speed InsightsSpeed Insights already uses , the Core Web Vital that replaced FID, as the responsiveness metric in your . The deprecation won’t require changes on your side, affect your score, or prevent you from viewing existing FID data.Interaction to Next Paint (INP)Real Experience ScoreLearn more in the .Speed Insights metrics documentationRead more

Agents write most of our code now, and they respond to checks far more reliably than to documents. I turned a best practice written in plain English into a lint rule with Jev and Oxlint, annotated inline in GitHub pull requests.