Upgrading to fix a CVE sounds straightforward. But the patched version often breaks your app, hasn't shipped yet, or doesn't exist. Here's why, and what actually works.Category: News

LINEヤフー株式会社では、技術に関するイベントや勉強会の主催・協賛などを行っています。最新情報は各リンク先でご確認ください。タイミングによっては、申し込み開始前や既に満席となっていることがあります。...

Today we're releasing tsgolint v7, the type-aware linting engine behind Oxlint.This release tracks TypeScript v7.0.2 and brings tsgolint to 59 of typescript-eslint's 61 type-aware rules. Since our alpha release, we have added 16 rules, per-rule timings, improved configuration, and another round of performance work.Getting started ​Install the latest Oxlint and tsgolint, then enable type-aware linting:shpnpm add -D oxlint oxlint-tsgolint@7pnpm oxlint --type-awareTo report TypeScript compiler erro

はじめに はじめまして、CyberAgent group Infrastructure Unit（C ...

Nub looks like an interesting new “toolchain” for Node.js. It’s one of those “it makes everything you already do faster” sort of things, like installing and running scripts. Bytes.dev… … won’t be surprised if it becomes the de facto way to season your Node.js app. You can get some of these advantages by switching runtimes, […]

Tyro CISO Arun Singh on developer trust as a finite resource, and what happens when supply chain attacks force teams to spend itCategory: Guides & Best Practices

Canvases turn AI into interactive workspaces where you can visualize information, explore workflows, and take action across complex tasks.The post How to build interactive experiences with canvases appeared first on The GitHub Blog.

The 2026 update to my real-world device testing recommendations paints a clearer picture than ever…

<p><strong><a href="https://blaizzy.github.io/nativ/">Nativ: Run AI models locally on your Mac</a></strong></p>Prince Canuma is the developer behind the excellent <a href="https://github.com/Blaizzy/mlx-vlm">MLX-VLM</a> Python library for running vision-LLMs using MLX on a Mac.</p><p>I'm really excited about his new project, which wraps MLX in a full macOS desktop application. It's similar in shape to LM Studio, providing both a chat i...

We analyzed global HTTP traffic to explore how kickoff times, streaming habits, and hydration breaks reshaped online activity worldwide. From late-night traffic surges to halftime browsing spikes, here is how the world connected during the global tournament.

<p>Earlier this month I hosted a fireside chat session at the <a href="https://www.ai.engineer/worldsfair/2026">AI Engineer World's Fair</a> with Cat Wu and Thariq Shihipar from Anthropic's Claude Code team. We talked about Claude Code, Claude Tag, Fable, coding agent security, evals, tool design, and how Anthropic use these tools themselves.</p><p>The full video of the session is now available <a href="https://www.youtube.com/watch?v=uU5Gv2h8-9g">on YouTube&...

While React Server Components rely on the custom Flight protocol to stream interactive UIs, this same mechanism introduces powerful deserialization sinks that attackers can exploit. Durgesh Pawar breaks down the mechanics behind the CVSS 10.0 “React2Shell” vulnerability to show how protocol manipulation can lead to remote code execution.

The writing-mode CSS property sets whether lines of text are laid out horizontally or vertically, and the direction in which blocks and lines progress..element { writing-mode: vertical-rl;}This is most useful in languages such as Chinese, Japanese or …writing-mode originally handwritten and published with love on CSS-Tricks. You should really get the newsletter as well.

Supabase Pipelines is now in public alpha with schema change support, a faster initial sync, and a new destination request form for ClickHouse, Snowflake, and DuckLake.

はじめに こんにちは。サイバーエージェント AIオペレーション室の李俊浩（@buddypia）です。 ...

Searchable on Vercel5x increase in development velocity100+ billion tokens processed Customer-requested features shipped in as little as 30 minutesZero model SDK implementation or API key rotation with AI GatewayAI SDK AI GatewayRead more

Today we're expanding . It started by triaging alerts and reviewing your pull requests. Now it has a home in your dashboard, where it can investigate production, answer questions about your projects, and take action once you approve it.Vercel AgentBecause Vercel Agent is built into the platform that deploys and runs your app, when something changes in production, it's your first responder. It autonomously investigates your logs, metrics, and deployments, finds the root cause, and proposes a fix,

We’re writing to share some news about the future of the Bytecode Alliance and the WebAssembly Micro Runtime (WAMR).

We told you to measure. So of course we did it ourselves too: two months of server-side LLM traffic to evilmartians.com. Find out which agents read HTML, which read Markdown, what llms.txt actually does, and the one technique that got zero hits.

Vercel now compiles Python functions to bytecode at build time. In our benchmarks, cold starts for the median-sized function dropped from .2.8s to 1.3sCold starts are already rare in practice. Pre-warmed instances keep at least one function instance active for production deployments on paid plans, and reduces how often new instances start cold. Precompiling to bytecode makes the remaining cold starts much faster.automatic concurrency scalingWhen Python imports a module without cached bytecode, i

Vercel Connect now includes preset connectors for 90+ services, including Shopify, Resend, Sanity, Okta, Workday, and Jira.Preset are predefined configurations for supported services. They reduce manual setup by pre-populating the brand name, icon, auth type, and MCP or discovery URL. Unlike managed connectors, preset connectors don't register your app with the external service for you. connectorsSelect a preset from the in the Vercel dashboard. Review the pre-populated configuration, add any cr

now supports purchasing Vercel products. You can:Vercel MCPVercel MCP quotes the price, explains whether the charge is one-time or recurring, and completes the purchase only after you confirm. When an exact price isn't available, it links to the relevant pricing or billing page. Purchases require a team role with billing access and a valid payment method. to Vercel MCP to get started.Connect your AI assistantRead moreUpgrade your team to the Pro planAdd prepaid credits for (requires a paid v0 pl

is now available on AI Gateway. There are 2 versions of the model available:Laguna S 2.1 from PoolsideLaguna S 2.1 is an open-weight Mixture-of-Experts model that supports a context window of up to 1M tokens and runs in thinking and no-thinking modes.The model specializes in agentic coding and long-running tasks, including writing and debugging code, running tests, building browser-based tooling, and working on MLOps pipelines and AI research. In thinking mode, Laguna S 2.1 reports 70.2% on Term

and are now available on AI Gateway.Gemini 3.6 FlashGemini 3.5 Flash-LiteGemini 3.6 Flash improves quality across coding, agentic tasks, and web development while consuming fewer tokens and making fewer model calls. It produces cleaner web and app development output.Gemini 3.5 Flash Lite upgrades the agentic capabilities of the Flash-Lite tier, making it a good fit for subagents that handle scoped parts of a larger task.To use them, set to or in the :modelgoogle/gemini-3.6-flashgoogle/gemini-3.5

AI Gateway now supports service tiering. Service tiers let you optimize for latency, throughput, and cost per request to match your use case. Pick a faster tier for interactive workloads (less queueing, higher token throughput), or a lower cost tier for background jobs that can tolerate more latency.At launch, service tiering is available for OpenAI and Gemini models. work across every AI Gateway API format: , , , , and . AI Gateway adjusts billing based on the tier each request used.Service tie

こんにちは。株式会社サイバーエージェントの経営推進本部に所属している片岡です。 2005年に中途入社 ...

はじめに はじめまして。CyberAgent group Infrastructure Unit（C ...

Cloudflare Internal DNS brings authoritative and recursive DNS for private networks to the same global network and control plane that runs Cloudflare's Zero Trust, networking, and public DNS.

<p>I keep hearing anecdotes from people who used coding agents to reverse-engineer and automate devices in their homes.</p><p>I think this is an interesting illustration of the impact of the reduced cost of writing code.</p><p>Prior to agents, it was entirely possible to reverse-engineer home devices. The problem was the ROI - was it really worth all of that effort? More importantly, any experienced programmer knows that undocumented, unstable APIs like that may we...

This is a post on one of Cloudflare’s coolest features: Durable Objects. We’ll introduce what they are, how they work, and walk through a reasonably realistic use case for them. Cloudflare Workers Review I’ve written about Cloudflare Workers previously, with an introduction to them and a post about some of the slightly unorthodox things you […]

<p><strong><a href="https://stratechery.com/2026/whos-afraid-of-chinese-models/">Who’s Afraid of Chinese Models?</a></strong></p>Interesting proposal from Ben Thompson that both addresses the hypocrisy of labs outlawing distillation against their models despite training on unlicensed data, and could help US open models compete more effectively with their Chinese counterparts:</p><blockquote><p>The U.S. should pass a law that (1) makes explic...

Traditional DSPM finds where sensitive data lives. Code-based DSPM finds how it gets exposed, and points to the fix in your code. Category: Guides & Best Practices

Celebrating $100 million contributed by the community to the people who build and sustain open source every day.The post $100 million for open source: A milestone built by the community appeared first on The GitHub Blog.

We’re proud to share that JetBrains was recognized in the 2026 Gartner® Magic Quadrant™ for DevOps Platforms for Ability to Execute and Completeness of Vision. JetBrains solutions for DevOps include Qodana for code quality, TeamCity for CI/CD, and YouTrack for planning and project management. The DevOps landscape is crowded, and a lot of vendors compete […]

<blockquote cite="https://twitter.com/techemails/status/2078854346683678927"><p>We have been having extensive discussions around open source strategy. We will discuss it more at our next board meeting, but one thing we’d like to do soon is to create a language model with the approximate capability of GPT-3 that can run locally on consumer hardware and release that. We’d like to do it soon, before Stability or someone else does. In general, we think this helps discourage others from ...

The Wasm GC and exceptions proposals are both enabled by default in today’s Wasmtime 47 release! We are excited to help bring more languages to WebAssembly and everywhere that Wasmtime runs. Getting to this point involved large Wasmtime changes and represents the culmination of years of engineering effort.

now keeps each run's state, queue dispatch, and output streams in a single home region: the region where the run starts by default, or any target region you choose.Vercel WorkflowsA run keeps its home region for its lifetime, so for agents built on Workflows, the whole loop stays near the user: an agent serving someone in Sydney executes, checkpoints its progress, and streams output from Sydney. During a regional incident, workflow traffic fails over to the next closest region.To get started, up

Team Owners can now clear the team's Remote Cache of all artifacts in one click. This is useful when you believe there are poisoned artifacts in your cache.In your team's Build and Deployment settings, and clear the Remote Cache.visit the Remote Caching section to learn more.Visit the docsRead more

Malicious git_credential_manager, Dendreo, and fastlane RubyGems fetch a second stage from a Forgejo C2, skip CI to target developer machines, and install a persistent daemon. StepSecurity analysis with Harden-Runner.

SleeperGem: two dormant RubyGems maintainer accounts were hijacked to inject malware into trusted gems, one with over 500,000 total downloadsCategory: Vulnerabilities & Threats

<p><strong><a href="https://ludic.mataroa.blog/blog/ai-mania-is-eviscerating-global-decision-making/">AI Mania Is Eviscerating Global Decision-Making</a></strong></p>Here's an entertaining perspective from Nik Suresh on the AI mania that is overwhelming the large companies that he consults with. It's crammed with spicy anecdotes from anonymous sources.</p><blockquote><p>In one extreme case, I have seen an executive confess that they had neve...

<p>In <a href="https://bun.com/blog/bun-in-rust">Rewriting Bun in Rust</a> Jarred Sumner made the following claim:</p><blockquote><p>Claude Code v2.1.181 (released June 17th) and later use the Rust port of Bun. Startup got 10% faster on Linux but otherwise, barely anyone noticed. Boring is good.</p></blockquote><p>I decided to have a poke at my own Claude Code installation to see if I could find evidence that it was using Bun written in Rust...

Cheaper paper gave Renaissance artists more room to experiment. AI agents could do the same for software, if developers preserve enough mechanical and software sympathy to judge what agents produce.

<p><strong>Tool:</strong> <a href="https://tools.simonwillison.net/sqlite-query-explainer">SQLite Query Explainer</a></p> <p>Julia Evan's, in <a href="https://jvns.ca/blog/2026/07/17/learning-about-running-sqlite/">Learning a few things about running SQLite</a>:</p><blockquote><p>Maybe one day I’ll learn to read a query plan.</p></blockquote><p>Big same.... which inspired me to <a href="https://github.c...

<p><strong><a href="https://twitter.com/claudeai/status/2078302415804379218">Claude make Fable 5 permanent</a></strong></p>An update from the <code>@claudeai</code> account on Twitter:</p><blockquote><p>Beginning July 20, Claude Fable 5 will be included in all Max and Team Premium plans, at 50% of limits.</p><p>Pro and Team Standard users will continue to have access to Fable via usage credits, and will receive a one-...

<p><strong><a href="https://github.com/nascheme/quixote">nascheme/quixote</a></strong></p>A certain vintage of Python web nerd might be delighted to learn that the most recent commit to the Quixote web framework was <a href="(https://github.com/nascheme/quixote/commit/7f775cf9d1e7e80fcbb2706b4a1d971e55ca74a3)">six hours ago</a>.</p><p>The <a href="https://github.com/nascheme/quixote/commit/d6b73c5768c2d041b68b54cc71863604249abc18"&g...

AI コーディングエージェントの自律性が向上し、複数のエージェントを並行して動かすことが日常になったことで、開発の中で最も時間を使う工程が実装から設計へ移りつつあります。この記事では、設計セッション、Git worktree を使った並列実行、自律的な検証、AI によるコードレビューなど、最近の私が実践している開発の進め方を紹介します。

Nuxt 4.5 is our biggest release in a while. Vite 8, Rspack 2 powered by Rsbuild, experimental SSR streaming, a stable error code system, a new useLayout composable, named views, and a lot of groundwork for Nuxt 5.

pnpm 11.11 through 11.14 add native workspace release management (pnpm change, pnpm lane, and a bare pnpm version -r), a pnpm doctor command that diagnoses your installation end to end, the pnpm access and pnpm team commands for managing packages and organizations on the registry, convergence overrides, and scheme-carrying peerDependencies specifiers. They also fix a path-traversal vulnerability, cut peak memory during cold-cache resolution by roughly 30%, and resolve a peer dependency deadlock.

Cloudflare has deployed two WAF rules in response to high-severity vulnerabilities disclosed to us by the WordPress security team. The new rules protect all Cloudflare customers using affected WordPress versions, but customers should still update immediately to a patched release

WordPress core has an unauthenticated RCE (wp2shell), confirmed as SQL injection. Update to 7.0.2 or 6.9.5 now, with mitigations if you can't patch yet. Block the attack class at runtime with Aikido Zen.Category: Vulnerabilities & Threats

Masonry.js was famous for creating, uh, Masonry layouts. But it did something else, too: animate fluid grids. Here's a way to get that in native CSS as well as the layout.

The cost of writing code dropped; the cost of owning it didn't. A framework for deciding which changes are actually cheap in the AI era.The post The cost of saying yes has changed appeared first on The GitHub Blog.

Compare the top Pentera alternatives for automated pentesting in 2026. See where Aikido Security, XBOW, Horizon3, Hadrian, RunSybil, Terra, and Astra fit best.Category: DevSec Tools & Comparisons

<blockquote cite="https://news.ycombinator.com/item?id=48935342#48936515"><p>Is there something I can actually help you with today?</p></blockquote><p class="cite">— <a href="https://news.ycombinator.com/item?id=48935342#48936515">Kimi K3</a>, after refusing to leak its system prompt</p> <p>Tags: <a href="https://simonwillison.net/tags/kimi">kimi</a>, <a href="https://simonwillison.net/tags/ai-personality">ai-pers...

<p><strong>Tool:</strong> <a href="https://tools.simonwillison.net/llm-cliche-highlighter">LLM cliché highlighter</a></p> <p>I got frustrated reading <em>yet another</em> article that was crammed with the clichés of LLM-generated writing - "no fluff, no filler, no jargon" type stuff - so I had Fable 5 vibe code up this app for highlighting ten common patterns that show up in that sort of writing.</p><p><img alt="Screenshot of ...

Howdy! Before we get into the links, we're going to take a break next week, so we'll see you on July 31 🌴Art as resistenceMore of this please!Mildliner referenceIf you've ever thought "I wish I could use Midliner marker colours on the web" then this link is specifically for you. Very nice stuff.The AI hype reckoning is upon usNot long now, friends. Increasingly — and more urgently — we need to be talking about how to make sure these hype cycles never happen again.You can just print an air purif...

The common rule of thumb is to never “block” the browser’s main thread when running JavaScript tasks. But is this a hard rule? Victor Ayomipo describes a use case he encountered involving a screenshot extension where he made an exception to the rule and decided that blocking the main thread was absolutely the right thing to do.

no longer bills for data it downloads from the internet. Installing packages, cloning a Git repository, or pulling artifacts and datasets from an external source does not count toward Sandbox Data Transfer usage.Vercel SandboxTraffic received on a Sandbox's exposed ports is still billable, as is outbound traffic the Sandbox sends to the internet. Pricing for Active CPU, Provisioned Memory, Snapshot Storage, and Sandbox Creations is unchanged.See the for the full breakdown.pricing documentationRe

The White House’s Gold Eagle Initiative aims to coordinate AI-discovered vulnerabilities, validate findings, and accelerate patching across critical software.

はじめにGitHub Actions からパッケージを公開するとき，こんなワークフローを組んでいないでしょうか？GitHub 上で Release を作成する→ on: release: types: [published] でワークフローが起動する→ npm publish が走る操作する側から見ると，非常に分かりやすいですよね。Release を作れば NPM にも公開される。GitHub Release を起点として，その後ろにパッケージレジストリへの publish をぶら下げる構成です。ところが，2025 年に GitHub の Immutable Rele...

<p>Suggestion for hyperscalers feeling pressure over data center water use:</p><p>Buy up a few exclusive country clubs, convert the golf courses into public parks, pay for guides and binoculars to get the previous members into birdwatching - help them embrace a more sustainable hobby!</p><p>Google <a href="https://sustainability.google/reports/google-2026-environmental-report/">used 10.9 billion gallons in 2025</a>, so about 30 million gallons per day.&...

Runtime logs now show a Cache Reason explaining why a request wasn't a fresh cache hit, for example a time-based or tag-based revalidation. Use cache reasons to debug misses and improve your hit rate.Cache reasons appear for any response the CDN can cache, including ISR, Partial Prerendering, and functions that set a header with directives like . Responses rendered dynamically on every request don't have a cache reason.Cache-Controlstale-while-revalidateOpen the Logs tab and select a request to

is 35% off on AI Gateway through July 24 when routed through Novita.GLM 5.2To get the discounted rate, set the model to in the and route requests through Novita:zai/glm-5.2AI SDKAfter July 24, the model stays available at standard provider rates with no markup.Try GLM 5.2 in the .model playgroundRead more

Vercel now reuses static files across deployments for frameworks that output content-addressed assets. It's zero-config: Vercel uses to manage these immutable files alongside your code changes, handling the hard parts like hash collisions, file lifecycles, and efficient routing.Framework-defined infrastructureThis brings several benefits:Vercel's supported frameworks will automatically take advantage of this optimization, even for projects without enabled. Next.js 16.3 preview and later already

The is now available in the .Vercel PluginKimi Code CLIKimi Code can now draw on Vercel platform knowledge on demand, with skills for Next.js, AI SDK, Vercel Functions, and more. The Vercel Plugin also helps Kimi Code stay up to date with the latest Vercel APIs and recommended patterns.To install it, upgrade to the latest Kimi Code CLI and select the Vercel Plugin from the Third-party section of the menu./pluginLearn more in the .Vercel Plugin documentationRead more

You can now build native Slack agents with Chat SDK's .Slack adapterThe adapter supports the full , from agent conversations in the Messages tab to suggested prompts, rotating status messages, token-by-token streamed replies, and native feedback buttons.Slack agent messaging experienceHere's what the adapter gives you:One thing to know: under , Slack threads each user message individually, so channel history only returns the user's side of a DM. Use to build AI conversation history instead.agent

Lumis looks like a pretty sweet new syntax highlighter tool. Powered by Tree-sitter, of which I can vouch for its speed and power. I like how many runtimes it supports, almost encouraging server-side use, which is the best place for the job when you can pull it off.

<p><strong><a href="https://developer.puter.com/labs/firefox-wasm/">Firefox in WebAssembly</a></strong></p>This is absurdly cool: Puter compiled Firefox to WebAssembly such that the whole browser runs in another browser.</p><p>Here's my blog, running in Firefox, running in WebAssembly, running in Chrome:</p><p><img alt="A Chrome window. The tab has the Firefox UI and has loaded my blog. On the right is the Chrome network panel showi...

<p>Chinese AI lab Moonshot AI <a href="https://www.kimi.com/blog/kimi-k3">announced Kimi K3</a> this morning, describing it as their "most capable model to date, with 2.8 trillion parameters". It's currently available via their website and API, but an open weight release is promised "by July 27, 2026".</p><p>Moonshot are calling this the first "open 3T-class model" (I guess they're rounding 2.8 trillion up to 3 trillion), taking the crown from <a href="https://h...

<blockquote cite="https://twitter.com/thsottiaux/status/2077630111499882637"><p>On file deletions. We’ve investigated a handful of reports where GPT-5.6 unexpectedly deleted files. </p><p>What we have found is that this most commonly occurs when:</p><ul><li>Full access mode is enabled and codex is run without sandboxing protections, including without auto review being enabled</li><li>The model attempts to override the $HOME env var to define...

<p><strong><a href="https://thinkingmachines.ai/news/introducing-inkling/">Inkling: Our open-weights model</a></strong></p>Mira Murati's Thinking Machines Lab just released their first open-weights model. Inkling is "a Mixture-of-Experts transformer with 975B total parameters, 41B active" - an Apache-2.0 licensed multimodal model trained on 45 trillion tokens of text, images, audio and video.</p><p>They're also promising Inkling-Small, a 276B (12B...

A Shai-Hulud infection exposed Suno's source code, which shows the AI music startup stream-ripped tracks to train its models.

<p><strong>Tool:</strong> <a href="https://tools.simonwillison.net/mermaid-ascii">Mermaid to ASCII art (mermaid-ascii)</a></p> <p>After building the <a href="https://simonwillison.net/2026/Jul/16/grok-mermaid/">Mermaid to ASCII tool based on Grok Build's Rust code</a> I learned that there's an older, more fully-featured Go library called <a href="https://github.com/AlexanderGrooff/mermaid-ascii">AlexanderGrooff/mermaid-ascii</a> ...

<blockquote cite="https://lore.kernel.org/linux-media/CAHk-=wi4zC+Ze8e+p3tMv8TtG_80KzsZ1syL9anBtmEh5Z40vg@mail.gmail.com/"><p>I realize that some people really dislike AI, but this is an area where I'm willing to absolutely put my foot down as the top-level maintainer.</p><p>Linux is not one of those anti-AI projects, and if somebody has issues with that, they can do the open-source thing and fork it.</p><p>Or just walk away.</p><p>AI is a tool, j...

Communication can be difficult. Not only when we humans try to communicate with one another, but also in web development.While it is easy for sighted people with full mental and motor abilities to click a button with a mouse to display more information, users of Assistive Technology (AT) may have a completely different experience with the same action.The information an expandable button conveys to AT depends heavily on the context. This context also dictates which ARIA attributes should (or shou

We tested 13 AI models against 26 known CVEs to see which finds the most vulnerabilities — and whether the priciest model is worth the cost.Category: Technical

One searchable view for logs across every Supabase service, with live tail, filtering, and a timeline.

はじめに LegalOn Technologies でCRE 兼 カスタマーリレーショングループリーダーの長内(@Nick)です。 現在私は、CREとして業務を行いながら、ユーザーサポートメンバーのマネジメントを担当しています。今回のブログでは、非エンジニアのユーザーサポートチームが、Codexを利用したログ調査を自ら行うようになり、一次対応のスピード向上と開発部門の負担軽減を両立できた話をお伝えします。 非エンジニアメンバーを率いるマネージャーの方や、社内のAI活用を推進したいエンジニアの方の参考になれば幸いです。 （久しぶりのEngineering Blogになりますが、以前公開したこちら…

Vercel is formalizing a monthly release program for Next.js. The change follows React2Shell and a sharp rise in AI-assisted vulnerability discovery.

問題 将棋の編入試験の受験資格に、「いいところ取りで 10 勝以上、勝率 65% 以上」という基準があります。 プロ棋士でない人が（任意の）プロ棋士と対戦した履歴の中で、勝利が 10 個以上、かつ、勝率が 65% 以上であるような「連続範囲」を切り出すことができれば（＝いいとこ取り）、編入試験を受ける資格が得られるというものです 1 。 この「いいとこ取り」、どうやっていいところを取ればいいでしょうか。 非常に長い連続範囲を切り出すことで条件を満たせる可能性を考えると、どこまで計算すればいいのか自明でないと思います。 つまり、「苦節 20 年、ついに 65 勝 35 敗で編入試験の受験資格を獲…

Harden-Runner secures third-party GitHub Actions runners. Bitrise macOS runners join Blacksmith, Depot, Namespace, and Warp Build with v2.20.0

Harden-Runner v2.20.0 extends egress block mode to macOS and Windows GitHub-hosted runners, so you can stop secret exfiltration on every OS your pipelines run on, not just observe it.

Device Policy lets security teams allow-list VS Code extensions and enforce it fleet-wide through Intune, Jamf, Kandji, or the DMG agent. No MDM required.

On July 14, 2026 at 07:10 UTC, three packages in the AsyncAPI generator monorepo (@asyncapi/[email protected], @asyncapi/[email protected], and @asyncapi/[email protected]) were published to npm carrying an obfuscated dropper that fires the moment the library is loaded, not on install. The packages were published through the project's own legitimate GitHub Actions release workflow and carry valid npm OIDC provenance attestations, because the attacker didn't steal an npm token: they

StepSecurity now blocks and detects secret exfiltration in GitHub Actions, stopping attacks that plant malicious workflows to steal your repository secrets.

<p><strong>Tool:</strong> <a href="https://tools.simonwillison.net/grok-mermaid">Mermaid to Unicode box art (grok-mermaid)</a></p> <p>While <a href="https://simonwillison.net/2026/Jul/15/grok-build/">exploring the codebase</a> for the newly open-sourced Grok CLI coding agent I came across <a href="https://github.com/xai-org/grok-build/blob/b189869b7755d2b482969acf6c92da3ecfeffd36/crates/codegen/xai-grok-markdown/src/mermaid.rs">xai-gro...

Astro 7.1 is about more control: CSP, pagination, dev server, and content collections.

The now shows subscribers a write utilization metric, helping identify routes that regenerate often but receive few requests. Write utilization is the ratio of cached requests to ISR writes. For routes with low write utilization, consider increasing the revalidation interval or switching to on-demand revalidation to reduce costs.ISR Observability pageObservability PlusYou can also compute write utilization using the Vercel CLI, or use agents with the skill to investigate.cdn-cachingLearn more ab

is now available on AI Gateway.Kimi K3 from Moonshot AIK3 is an open-source model with a 1M-token context window and native visual understanding, accepting text, image, and video inputs.Built for long-horizon software engineering, knowledge work, and deep reasoning, K3 is especially strong where code meets visual and spatial reasoning, which suits frontend, game development, and CAD workflows. Thinking mode is always on.To use Kimi K3, set to in the :modelmoonshotai/kimi-k3AI SDKAI Gateway provi

We are excited to announce a partnership between ESLint and Codemod to create a better migration experience for ESLint users, starting with the ESLint v8 to v9 and v9 to v10 migrations. All official ESLint codemods live in eslint/codemods and on the Codemod Registry. Community members are encouraged to open issues for missing codemods or contribute new ones through pull requests. Once reviewed and merged by maintainers, codemods are automatically published to the Codemod Registry through GitHub

<p><strong><a href="https://github.com/xai-org/grok-build">xai-org/grok-build, now open source</a></strong></p>xAI's <code>grok</code> CLI tool faced severe community backlash yesterday when it became apparent that running the command in a directory could upload that <em>entire directory</em> to xAI's Google Cloud buckets. One user <a href="https://x.com/a_green_being/status/2076598897779020159">reported</a> running it in t...

A dozen years go by, it turns out we can do things a lot differently and a lot better. Here a `scroll` event is entirely replaced by HTML and CSS features and much better performance.

The pointer-events property controls whether an element can become the target of pointer events like clicks, hover states, and other pointer-based events. In other words, it lets you decide whether the browser should treat an element as interactive when the …pointer-events originally handwritten and published with love on CSS-Tricks. You should really get the newsletter as well.

New to GitHub? This beginner's guide explains version control, repositories, and pull requests—plus everything else you need to start working confidently on GitHub.The post GitHub for Beginners: Your roadmap to mastering the GitHub essentials appeared first on The GitHub Blog.