`document.startViewTransition()` の遷移はドキュメント全体で 1 つしか実行できず、ページ全体の上に描画されます。`element.startViewTransition()` を使うと、遷移を特定の要素に限定して、複数の遷移を同時に実行できます。この記事では、2 つのリストを同時にアニメーションさせる例を通じて基本的な使い方を紹介します。

Fixes 166 issues, addressing 122 👍. bun check, a TypeScript type checker built into Bun that is 3x to 6.4x faster than tsc 7, --check for bun run, bun build and bun test, 67–89% less idle CPU, Bun.FetchSession, experimental Bun.ModuleGraph, --disallow-code-generation-from-strings, up to 2.7x faster large node:http responses, a JavaScriptCore upgrade with faster JSON.parse, faster rejected-promise handling, CompressionStream compression levels, If-Range support in Bun.serve, bun install skips ta...

<blockquote cite="https://www.nytimes.com/2026/10/09/technology/anthropic-rogue-ai-agents.html"><p>Anthropic detailed the activity of its A.I. agents in <a href="https://www.anthropic.com/research/investigating-unintended-model-actions">a blog post</a> on Friday, without naming the targeted websites. But two sources with knowledge of the incidents said Anthropic’s A.I. agents had submitted 20 visa applications through a form available on the State Department’s website. A...

<p><strong><a href="https://deno.com/blog/cloudflare">Deno is joining Cloudflare</a></strong></p>The Deno team released the first version of <a href="https://github.com/denoland/celld">celld</a> back in August - their open source implementation of the Durable Objects pattern from Cloudflare Workers.</p><p>Today, Cloudflare are acquiring Deno outright, with the goal of building on <code>celld</code> to "make workerd self-hos...

Your agent can now use the to buy a domain. Vercel CLIThe agent discovers candidates with , checks availability and registrar pricing with and , and initiates the purchase with .vercel domains searchvercel domains checkvercel domains pricevercel domains buyThe purchase decision itself stays with you by design. Run non-interactively, returns a structured, machine-readable error and the suggested next commands, so the agent hands the confirmation back to you, prohibiting it from spending money wit

We are expanding the Clef decision model family with Clef-omni, natively processing audio, video, images, and text in a single pipeline. We’ve also lowered Clef-flash pricing and boosted Clef inference speeds by up to 2.0x.

New Pro teams now default to a 30-day deployment retention period.Coding agents have accelerated development, increasing deployment frequency and the amount of stored deployment history. Shorter retention keeps recent history available while limiting older history and its storage costs.You can choose a longer retention period in your team's settings when you need more history for inspection or rollback. Deployment Storage and Functions Storage each cost $0.10 per GB-month. Older deployments may

and Functions Storage billing will begin for all Pro teams at $0.10 per GB-month. Check your email for details about when billing will start for your team. To keep storage costs low, the deployment retention window also changes to 30 days.Deployment StorageDeployments older than 30 days will be deleted starting October 23, unless you opt out in your retention settings before then. Retention settings already at 30 days or shorter are unchanged.Review retention periods for Pre-Production, Producti

Learn how vulnerability remediation works for each type of flaw and what to do when upgrading a dependency breaks your build or isn't an option.Category: DevSec Tools & Comparisons

The barriers to building software have collapsed. Today, anyone can build. Hackathons are a great place to start learning.The post Hack the World: Why hackathons are still the best place to learn to build appeared first on The GitHub Blog.

Divs and spans are fine, but purposefully meaningless. Often the meaning actually matters, so let's look at some of those situations.

<blockquote cite="https://twitter.com/matthew_d_green/status/2108552414978564418"><p>Everyone is very concerned about being respectable, so I’m going to be the goofball who raises worst-case possibilities. I think there is a 1% chance we live in Minicrypt, and a 15% chance we functionally lose confidence in our existing public-key encryption algorithms. [...]</p><p>The problem here is that the speed of AI producing surprises, and the speed of human beings replacing stand...

Putting ourselves in the best place to build the future of the web

GhostAction returns: compromised maintainers push a fake security-audit.yml workflow that steals CI/CD secrets and cloud credentials from GitHub repos.

arXiv now limits authors to two submissions a month as AI slop overwhelms moderators, delays good papers, and sparks debate over applying the limit to everyone.

We compare the top developer security tools for enterprise teams on signal quality, governance, and remediation: Aikido Security, Snyk, GitHub Advanced Security, SonarQube, Checkmarx, and Endor LabsCategory: DevSec Tools & Comparisons

On-demand CPU and memory profiling for Cloudflare Workers and Durable Objects is now available. Now you can generate interactive flamegraphs directly in production to quickly track down memory leaks and performance bottlenecks.

<p>I shipped a new feature for my blog today: the <a href="https://simonwillison.net/newsletters/">Newsletters</a> page, which offers an index of all of the newsletters I've sent out, both my free <a href="https://simonw.substack.com/">weekly Substack</a> and my <a href="https://github.com/sponsors/simonw/">monthly sponsors-only</a> updates. I built the feature almost entirely using my voice, chatting away to my laptop while I cooked dinner.</p>&l...

The Deno team is joining Cloudflare to radically simplify self-hosting Workers and Durable Objects, so developers can use the same primitives in more places.

A new GhostAction wave hits hundreds of GitHub repos, expanding CI/CD secret theft to cloud and AI credentials in source code and git history.

2027 web platform feature rankingThis is the second year we're doing this, and last year's 1900+ rankings not only helped us push the right proposals in the Interop process, it was also used to prioritize web platform feature development in Firefox.Certainly beats thumbs up in GitHub issues! Make your voice heard.This hue shall passA fabulous colour contrast tool from the great folks over at Clearleft.Dark forestryNot only an outstanding and important piece of writing, but the design and effects

Rillet on VercelStandardizing every internal agent on eveRunning customer requests through agents, end to endUsing AI Gateway to give every builder every modelManaging builder access through Enterprise Managed UsersTripled shipping rate in three months with eve agents deployed on VercelTwo-person team closed 800+ Linear tickets in its first 4 monthsBuilder access via Enterprise Managed Users, SSO, and Directory SyncShips customer-requested changes to production in as little as two hoursGives eve

Eric Bailey explains the thinking and research that go into adding just a few custom keyboard shortcuts to a web app. There’s an absolute ton to consider and test, and plenty of challenges can come from your own team.

<p><strong>Release:</strong> <a href="https://github.com/simonw/ttok/releases/tag/1.0">ttok 1.0</a></p> <p>I released <a href="https://simonwillison.net/2026/Oct/8/ttok/">ttok 0.4</a>, ran <code>uv tool upgrade ttok</code>, piped a file into the new version... and realized that it was defaulting to the GPT-4 tokenizer when it should very clearly default to GPT-5/GPT-6 instead!</p><p>I figured switching the default was...

Iframes can now size themselves to their content with CSS. What it replaces, where it helps, and why the embedded page has to say yes.

This release fixes --workspace-concurrency=Infinity, filters set by an updateConfig hook, and store fetches with enable-modules-dir=false.

This release fixes two ways pnpm install could fail, runs tools of any Rust release through pnx, and treats registry.npmjs.com as an alias of the npm registry.

This release adds Rust toolchain management, links the agent skills that dependencies ship, adds the permissions setting, and keeps the colors of streamed script output.

Better Markdown, better search, better performance.

is now available on . It answers typed questions about text with probabilities, choices, and scores. It can be used to classify support requests, select the next step in a workflow, or assess an AI response against a rubric.Decision-1 from MicrosoftAI GatewayThe model can answer yes/no questions, choose among named categories, or score an input against an ordered set of criteria. Multiple questions can share the same input in one request. Choice and score answers include probabilities for each o

is now available on .Liquid d1AI Gatewayd1 is a that evaluates shared state against typed questions for classification, routing, and scoring. It returns structured answers with probabilities without generating text tokens. decision modeld1 also has vision support: the model can answer typed questions about images for visual classification, inspection, and scoring.Use through the , the , or the . These examples ask whether a support agent issued a refund:liquid/d1AI SDK decision APIOpenAI-compati

<p><strong>Release:</strong> <a href="https://github.com/simonw/ttok/releases/tag/0.4">ttok 0.4</a></p> <p><code>ttok</code> is my CLI tool for counting tokens, using OpenAI's open source <a href="https://github.com/openai/tiktoken">tiktoken</a> library.</p><p>It hasn't been in updated in a couple of years, but I finally fixed a Click warning, updated CI, and added a <code>--list-models</code> command to l...

Safari Technology Preview Release 254 is now available for download for macOS Golden Gate and macOS Tahoe.

<blockquote cite="https://htmx.org/essays/yes-and/"><p>Computer programming is, fundamentally, about two things:</p><ul><li>Problem-solving using computers</li><li>Learning to control complexity while solving these problems</li></ul><p>I have a hard time imagining a future where knowing how to solve problems with computers and how to control the complexity of those solutions is <em>less</em> valuable than it is today, so I ...

Inventory the AI agent skills on developer machines and in your GitHub repositories: which agent loads them, what they can execute, and where they came from.

We compare the top FedRAMP-compliant security tools in 2026: Aikido for Government, Checkmarx One for Government, Qualys, Rapid7 InsightGovCloud, Snyk for Government, Tenable, Wiz for GovernmentCategory: DevSec Tools & Comparisons

As we kick off Cybersecurity Awareness Month, the GitHub Bug Bounty team spotlights @vaib25vicky, exploring their methodology, techniques, and experiences hacking on GitHub.The post How one bug bounty researcher chooses the features they investigate appeared first on The GitHub Blog.

You can now skip sending client request bodies to with . This reduces incoming usage for middleware invocations and can improve time to first byte, especially for requests with large bodies.Routing MiddlewareFast Origin TransferskipMiddlewareRequestBodyEnable this option only if your Routing Middleware doesn’t read request bodies. Vercel Functions and rewrite targets still receive the body, so you can read and process it there.Set to in your project’s JSON configuration file, :skipMiddlewareRequ

We redesigned Cloudflare Radar to make real-time global traffic and outage data accessible to a wider audience — including journalists, less technical researchers, and everyday users. By introducing an interactive map and standardized components, we simplified navigation while preserving technical depth.

A new Vercel Sandbox is now ready to run commands and read or write files when creation completes. now resolves only after snapshot restoration completes, so the first command or file operation no longer waits for it. Startup errors also reject instead of surfacing during that operation.Sandbox.create()Sandbox.create()Snapshot restoration time now counts toward creation instead of the first operation. Creation is about 50 ms longer at p50, with a larger increase possible for uncached snapshots.

malicious code detected in tensorlake 0.5.144Category: Vulnerabilities & Threats

The malicious release was built from the project's own main branch and published with an npm provenance attestation.

こんにちは！LINEヤフー 分析ユニット LINE Service Analytics Divisionの柳です。8月20日にデータサイエンス関連の事例を共有するイベントを開催しました。本記事では、イ...

Tensorlake npm SDK version 0.5.144 was compromised in a ChainDrop / Shai-Hulud attack, delivering credential-stealing malware.

Nx 23.3 selects affected tasks instead of whole projects, builds the project graph faster on large repos, and gets ready for Nx 24.

from xAI is now available on AI Gateway. This lightweight model turns text prompts and images into video with native audio.Grok Imagine Video 1.5 LiteThe model produces clips from 1 to 15 seconds long in 480p, 720p, and 1080p. Seven aspect ratios cover widescreen, square, and portrait formats, so you can create horizontal scenes or vertical videos from the same generation workflow.To start generating videos, set the model to in the or in the . Chain an image model with Grok Imagine Video 1.5 Lit

, StepFun's flagship model, is now available on . It's built for agentic coding, professional knowledge work, and financial analysis, from building apps and debugging code to research and analytical reports.Step 5 PreviewAI GatewayStep 5 Preview supports text and image input with a 1M-token context window, allowing you to work with large codebases, a stack of documents, or screenshots and charts in a single request.Use as the model name:stepfun/step-5-previewFor other coding agents such as Claud

now supports OpenAI's Ultrafast service tier, providing faster output for interactive applications and rapid coding iterations.AI GatewayCurrently, GPT 6 Astra and GPT 6.1 Sol are supported. To use Ultrafast, request it for or through AI SDK, the Chat Completions API, or Responses API:openai/gpt-6-astraopenai/gpt-6.1-solFor workflows with frequent tool calls, OpenAI recommends the Responses API over a persistent WebSocket connection to reduce overhead between turns. See the for persistent connec

from Black Forest Labs is now available on AI Gateway. Generate images from text or edit existing images using the same model, with one API key and no Black Forest Labs account required.FLUX 3 ImageFLUX 3 Image supports up to ten reference images for editing, combining subjects, or changing the composition. It supports five resolution tiers from 768 × 768 to 4K, with square, portrait, and landscape aspect ratios.Set , then use as the model ID in AI SDK 7 or later. To generate an image, call with

This Astro tutorial shows how to build an interactive blog using file-based routing, build-time and live content collections, and the islands architecture.

<blockquote cite="https://www.youtube.com/watch?v=HzraLR2VkNM&t=2259s"><p>I've always been kind of into computers since I was young. And then when film started to move from analog film to digital, I became more interested in that aspect of it. And the visual effects workflow for many years has included machine learning.</p><p>So I can write like pretty shitty Python scripts and stuff like that because with convolutional neural networks, which were the sort of pre...

<p>As previously <a href="https://simonwillison.net/2026/Sep/28/claude-sonnet-5-5/">promised</a>, here's Anthropic's new fast, low cost model: <a href="https://www.anthropic.com/claude-haiku-5-5">Introducing Claude Haiku 5.5</a>.</p><p>The previous Haiku, 4.5, was very much showing its age. It came out <a href="https://simonwillison.net/2025/Oct/15/claude-haiku-45/">almost a year ago</a>, and was priced at $1/million input and $5/million out...

Developers aren’t becoming more careless; they’re being outpaced. The tools that let developers create more software should also take on more of the work of protecting it.The post Secret protection must scale with software appeared first on The GitHub Blog.

Cloudflare Managed Defense uses a team of specialized AI agents built on Workers and global network telemetry to analyze security alerts. By separating deterministic evidence collection from model inference, the system delivers grounded recommendations to Managed Defense Analysts.

Socket found 16 malicious Firefox extensions designed to steal crypto wallet recovery phrases and private keys using cloned Rabby and OKX interfaces.

There are some real complexities using iframes and the postMessage API for communication between a widget and its parent. Security vulnerabilities like cross-origin scripting risks being one.

<p><strong><a href="https://refactoringenglish.com/blog/anti-patterns-software-blogging/#summary">Anti-Patterns in Software Blogging</a></strong></p>Some excellent writing advice from Michael Lynch. Michael warns against "meandering intros", misjudging your reader's existing knowledge, assuming they'll read your previous posts, and excessive formality.</p><p>He also warns against <a href="https://refactoringenglish.com/blog/anti-patterns-softwa...

<blockquote cite="https://news.ycombinator.com/item?id=49984923#49987367"><p>I was a graph theory junkie long ago and even moved to Budapest for awhile to study among the greats. While I was there I started working on Barnette's Conjecture which came to occupy my thoughts over the next 24 years of my life, on and off as I worked in many different fields. Last summer I even thought for a few days that I had actually solved it.</p><p>But it's supposedly proven here - <a...

こんにちは、エンジニアの中山です。以前 Google の AI Overview で、ピザに接着剤を使うアドバイス が掲出されて話題になりましたが、皆さんは生成 AI の出力品質にどのように向き合って...

<p><strong><a href="https://wikimediafoundation.org/news/2026/10/05/openai-rogue-agent-activities-found-on-wikimedia-projects/">OpenAI “rogue” agent activities found on Wikimedia projects</a></strong></p>Given how tempting a target wikis are for rogue agent swarms, it's not a huge surprise that Wikipedia found evidence of that activity once they went looking:</p><blockquote><p>The Wikimedia Foundation conducted its own investigation to see w...

PostgreSQL does not guarantee row order without ORDER BY. Use Rails 8.2 or pg_disorder to shuffle unordered SELECT results and expose hidden order dependencies, flaky tests, and application bugs. This is chaos engineering directed at your database.

Learn how Aikido maps to SOC 2 Type 1 and Type 2 audits, with SLA tracking, CI/CD gates, and cloud checks that produce exportable audit evidence.Category: Compliance

is now free for requests that the (WAF) denies, challenges, or rate limits. CDN Requests and Fast Data Transfer are for this traffic.Microfrontends RoutingWeb Application Firewallalready freeThe change applies automatically to every project using microfrontends. Learn how to in the Firewall documentation.set up WAF rulesRead more

is now available through at . It uses the same request and response format as OpenAI, so existing OpenAI SDK integrations can switch by changing the base URL, credentials, and model ID. OpenAI’s Decisions APIAI Gateway/v1/decisionsDecision models answer typed questions about shared input and return structured answers rather than generated text. In one request, you can ask a model to:Use these answers for such as classification, routing, triage, and rubric-based scoring. tasksThe endpoint works w

from is now available on .Claude Haiku 5.5AnthropicAI GatewayIt is built for high-volume, cost-sensitive tasks such as summaries, context compaction, database queries, and classification, and works as a subagent alongside larger Claude models on coding work. It is also the fastest Claude model at standard speed, which suits live customer support and browser use. Test it as a direct upgrade wherever you use today.Claude Haiku 4.5Haiku 5.5 is the first Haiku model with effort levels. It uses adapt

is now available on as a stealth model for teams on with purchased AI Gateway credits. It is free to use during the stealth period.Glyph ClusterAI GatewayPro and Enterprise plansGlyph Cluster is a reasoning model for coding and long-context analysis, and handles multi-step work such as planning, synthesis, quantitative reasoning, and comparing material across large inputs.For coding, Glyph Cluster can review code, explain failures, debug issues, propose changes, and reason through implementation

now supports timestamp attributes, so you can target by date and time.Vercel FlagsentitiesUse timestamp attributes to show a campaign page only between two dates, run a Black Friday promotion, or target users who registered before a cutoff.You can configure timestamp attributes in the dashboard or via the CLI. In the Vercel dashboard, open , select , and create or select an entity. Add an attribute and set its data type to .FlagsEntitiestimestampOr define the attribute with the CLI:Whether you c

<blockquote cite="https://www.nytimes.com/live/2026/10/05/world/openai-australia-hearing/94c8067e-4098-5c00-9673-c78cb58a9d8a"><p>Since the Medicare breach, OpenAI has put in place additional monitoring to allow “immediate intervention” by staff to stop training if the company’s models access the internet in ways they’re not supposed to, Mr. Kwon [chief strategy officer at OpenAI] said.</p></blockquote><p class="cite">— <a href="https://www.nytimes.com...

<p><strong>Release:</strong> <a href="https://github.com/simonw/llm-openai-decisions/releases/tag/0.1a0">llm-openai-decisions 0.1a0</a></p> <p>OpenAI released their new Jev-style <a href="https://developers.openai.com/api/docs/guides/decisions">Decisions API</a>, as previously announced at last week's DevDay.</p><p>Since I already have an <a href="https://github.com/simonw/llm-typesafe">llm-typesafe</a> plugin for tal...

I should have noted this sooner (sorry!), but it’s that time of year when Interop is planning for next year. Submissions are closed, and now they spend time refining and culling the proposals. We’ll hear on February 4th, 2027 what the focus will be on. I believe there is still time to “vote” (meaning basically […]

<p><strong>Release:</strong> <a href="https://github.com/simonw/llm-mistral/releases/tag/0.16">llm-mistral 0.16</a></p> <p>Adds support for reasoning models, such as the newly released <a href="https://simonwillison.net/2026/Oct/6/le-chonk/">Mistral Large 4</a>.</p> <p>Tags: <a href="https://simonwillison.net/tags/llm">llm</a>, <a href="https://simonwillison.net/tags/mistral">mistral</a>, <a href="https...

We're rebuilding GitHub's Git infrastructure while GitHub keeps running, creating a foundation for agent-scale software development.The post Building Git infrastructure for agent-scale development appeared first on The GitHub Blog.

<p><a href="https://news.ycombinator.com/item?id=49980487#49983751">My comment</a> on <a href="https://news.ycombinator.com/item?id=49980487">EmbeddingGemma 2</a> — Hacker News.</p><p>I really appreciate that <a href="https://blog.google/innovation-and-ai/technology/developers-tools/embeddinggemma-2/">EmbeddingGemma 2</a> is under the Apache 2.0 license.</p><p>For embedding models in particular, I don't think it makes s...

<p><strong><a href="https://mistral.ai/news/mistral-large-4/">Introducing Mistral Large 4: Le chonk</a></strong></p>Mistral are back in the game. Today they're releasing a preview of Mistral Large 4, a 1 trillion parameter, 49 billion active parameter model trained on their own cluster of 3,800 NVIDIA Grace Blackwell GPUs.</p><p>The preview is available via their API. They promise to release the open weights model at the "end of this month".</p...

<p><strong>TIL:</strong> <a href="https://til.simonwillison.net/datasette/datasette-parseable-opentelemetry">Using Parseable with Datasette for OpenTelemetry traces</a></p> <p>I <a href="https://news.ycombinator.com/item?id=49978171">saw Parseable in a Show HN</a> today - it's a new observability platform with both an <a href="https://github.com/parseablehq/parseable">open source (AGPL)</a> Rust implementation (a single ~180MB bi...

Socket now scans VS Code extensions, giving teams early detection of risky behaviors, hidden capabilities, and supply chain threats in developer tools.

<p><a href="https://news.ycombinator.com/item?id=49977979#49982139">My comment</a> on <a href="https://news.ycombinator.com/item?id=49977979">Mistral Large 4</a> — Hacker News.</p><blockquote><p><a href="https://news.ycombinator.com/item?id=49977979#49979658">wren6991</a>: The benchmark is saturated. Frontier models are tested with an armadillo in fishnet tights jaywalking on Mars.</p></blockquote><p>OK well...

On October 11, 2026, the DNS root switches to a new key-signing key (KSK-2024). Learn what this means for you, and how RFC 8509 trust anchor sentinels allow you to test whether your DNS resolver is ready for the rollover.

<p><strong>Release:</strong> <a href="https://github.com/simonw/datasette-atom/releases/tag/0.11a0">datasette-atom 0.11a0</a></p> <p>A minor fix for compatibility with the latest Datasette alphas. This meant we could upgrade the <a href="https://datasette.io/">datasette.io</a> site to Datasette 1.0a41.</p> <p>Tags: <a href="https://simonwillison.net/tags/atom">atom</a>, <a href="https://simonwillison.net/tags/datas...

can now escalate a decision request to a fallback model when the primary model's answer trips a .AI Gatewayconfidence condition you setConditions can be combined, so an escalation can depend on more than one signal. The plain model names you already list in keep catching outright errors, so existing fallbacks are unaffected. Confidence conditions cover Choice and Score questions. Boolean questions escalate on a probability range instead.modelsSet the fallback by adding one conditional object to

Package managers download megabytes of package metadata on every clean install. Here is how vlt.io serves the same installs at a fraction of the size.

<p><strong>Tool:</strong> <a href="https://tools.simonwillison.net/scrimshaw-jukebox">Scrimshaw Jukebox</a></p> <p>I wanted to see if Claude Opus 5.5 could compose music, so <a href="https://claude.ai/share/1f721c20-2499-4d23-b368-3ab57146d956">I tried this</a>:</p><blockquote><p><code>I want you to write some computer game music for me. First design simple text based format for the music and build an artifact that ca...

Aikido has achieved FedRAMP Moderate authorization, bringing AI-native, automated vulnerability remediation to U.S. federal agencies.Category: Company Updates

A practical guide to naming UI components, with useful resources, naming conventions, and structures. You’ll find more [useful guides](https://www.smashingmagazine.com/category/guides/) and [online workshops](https://smashingconf.com/online-workshops) here on Smashing Magazine, so make sure to browse and explore.

JetBrains has joined the Open Source Security Foundation (OpenSSF) as a general member. OpenSSF is a cross-industry initiative of the Linux Foundation that works to secure the software supply chain on which the industry depends. The foundation announced our membership today, together with other new members, at OpenSSF Community Day Europe in Prague, co-located with […]

こんにちは。LINEでAndroidアプリの開発を担当しているMoriです。この記事では、DroidKaigi 2026で発表した「デバイス操作はAIエージェントの時代へ。mobile-mcpを活用し...

こんにちは、フロントエンドエンジニアのやなぎ（@apple_yagi）です。 PR TIMESでは、2023年頃からプレスリリース掲載ページやトップページなどをNext.jsへ移行してきましたが、今回、そのNext.js […]

This release is all about trust. Configuration files now have to earn it before they can touch your

This release fixes pnpm install failures after an overrides change and on a filtered frozen install with catalogPrune. It also fixes several bugs in the experimental nodeLinker.type: loaded, which now keeps its generated files in node_modules.

This release adds an experimental loaded node linker, lets pnpm-lock.yaml record resolution settings, and reads cached registry metadata faster. It also carries several security fixes, including one that stops a dependency version from writing files outside the global virtual store.

This release reads cached registry metadata faster and makes pnpm config get --global ignore project settings. It also carries several security fixes for package archives, git dependencies, and config dependencies.

from Google is now available on as .Nano Banana 2.1AI Gatewaygoogle/gemini-nano-banana-2.1Compared with earlier Nano Banana models, it improves image generation and editing, including product recontextualization, mask- and ink-based editing, and factuality. In practice, that means placing products in new scenes, limiting edits to masked or marked regions, and depicting real-world subjects more accurately.It also renders photorealistic skin tones, detailed materials, sharp lighting, and coherent

is now available on AI Gateway. The open-weight, natively multimodal model combines reasoning with text and image understanding. It is useful for cyber defense, manufacturing, and finance workflows.Mistral Large 4You can access the model through AI Gateway with one API key, without creating a separate Mistral account.Use Mistral Large 4 ( ) with the , , , or . You can also select it in a connected to AI Gateway.mistral/mistral-large-4AI SDKOpenAI-compatible Chat Completions APIResponses APIAnthr

<blockquote cite="https://twitter.com/felixrieseberg/status/2107206431376334975"><p>The "old" version of Cowork runs model inference in the cloud, executing tool calls in an Anthropic-provided VM we shipped to your computer. We added the VM for capability, safety, and security reasons - mapping in just the data you explicitly added to your session. People loved what they were able to do with Claude but didn't love the disk, battery, and performance cost of running the VM locally. Al...

Nuxt 4.6 makes Nuxt server-agnostic with nuxt/server, rebuilds typed $fetch, adds sessions, Vue Vapor support and new dev error pages, and ships alongside Nuxt CLI v4.

I've been part of open source for most of my life. This year, the projects I love started closing their doors to outside contributors, and I don't blame them one bit, but it makes me sad.A personal look at how AI is changing open source as I've known it.

We’re launching ReviewBench, a benchmark for code review agents built on representative GitHub pull requests, multi-source ground truth, calibrated evaluation, and production-aligned metrics.The post ReviewBench: An open benchmark for AI code review appeared first on The GitHub Blog.

On October 5, 2026, StepSecurity analyzed @subql/[email protected] on npm and identified a hidden payload that collects credentials and supports remote shell access. It starts during installation and when the package is imported. The code targets developer workstations and CI environments, including GitHub Actions runners and accessible cloud services.

You can tell a parent element how many children it has with... scroll-driven animations??

We celebrated our 16th birthday with 46 announcements across open source, post-quantum security, AI agents, and developer platform upgrades. Here’s a day-by-day roundup of everything we shipped.

A year after announcing our goal to hire 1,111 interns, more than 750 early-career builders have shipped real products across 48 teams at Cloudflare. From Birthday Week launches to post-quantum security, our interns prove that AI amplifies human potential instead of replacing it.

MyGo は Go でデスクトップアプリを作るフレームワークです。OS の WebView に Web の画面を表示し、Go のメソッドから生成した TypeScript クライアントでネイティブ機能を呼び出せます。この記事ではテキストをファイルに保存するメモアプリを作り、macOS で起動・保存・ビルドを試します。

The Ember project is excited to announce the release of Ember v7.3. This is a standard minor release as part of the Ember Release Train process.This release brings a new way to create reactive state that doesn't need a class, makes a serious dent in the size of the JavaScript bundle for apps that are on the modern build system, and fixes a handful of long-standing bugs in the router and elsewhere! 🎉😃Ember.js 7.3Ember.js 7.3 introduces one new feature per RFC #1071: tracked can now be used outs...

This release is all about what happens around your tasks. Dependencies can now run after a task to

<p><strong>Research:</strong> <a href="https://github.com/simonw/research/tree/main/qwen38-addition-in-words#readme">Qwen3.8 27B addition in words</a></p> <p>Colin Frasier <a href="https://bsky.app/profile/colin-fraser.net/post/3mwopbyznhs2k">posted on Bluesky</a> about an experiment he ran over two years ago using GPT-4o to see how well it could "compute the sum but return the answer in words" across increasingly large numbers. Here's the c...

<p>Here's a product feature which the world is going to need a whole lot more of over the coming months and years: <strong>default hard budget caps</strong>. I'm talking about the feature of pay-by-usage services and APIs that lets you say "after $X/month, cut this thing off and return errors". These need to be <strong>hard</strong> limits. Soft caps, "after $X/month, send me a warning email", will not cut it.</p><p>Coding agents, and personal agents (c...

<p>I just sent the September edition of my <a href="https://github.com/sponsors/simonw/">sponsors-only monthly newsletter</a>. If you are a sponsor (or start a sponsorship now) you can <a href="https://github.com/simonw-private/monthly/blob/main/2026-09-september.md">access it here</a>.</p><p>This month:</p><ul><li>More Fable class models</li><li>A pricing war</li><li>3D graphics, Blender, and pixel art</li&g...

MSW v3 で公式の Vite プラグインが追加されました。Worker ファイルのコピーや更新が不要になり、virtual:msw からモックを設定できます。この記事では、Vite と TypeScript の小さなアプリケーションにプラグインを導入する方法を試してみます。