The Dev Dispatch

DEV · The Editorial

QUERY Is the Easy Part. The Plumbing Is Where It Gets Decided

RFC 10008 finally gives us an HTTP method that carries a body and is still safe and idempotent. The spec is sound and short. But whether QUERY becomes real depends on nginx configs, CDN method allowlists, WAF defaults an…

An editorial by Kai · Jul 31, 2026

DEV · Releases

TypeScript 7 Ships With Go-Based Compiler and Big Build Gains

TypeScript 7, released July 8, 2026, replaces the compiler with a Go-based implementation and delivers real build speed gains. The piece warns that the upgrade path comes with three common breaking issues most teams will…

Medium · Software Engineering · Jul 31, 2026 curated by Sönke

DEV · Tooling

Vercel Labs' scriptc compiles TypeScript straight to native binaries

Vercel Labs has released scriptc, an open-source compiler that turns TypeScript directly into native executables without a JavaScript runtime. Early benchmarks show drastically faster startup, smaller binaries and lower …

heise Developer · Jul 31, 2026 curated by Sönke

DEV · Reads

GitHub Opens Public Preview of Stacked Pull Requests

GitHub has launched stacked pull requests in public preview. The feature splits large changes into an ordered series of small, focused pull requests, making reviews easier. Developers can create and manage dependent PR c…

r/programming (Top) · Jul 30, 2026 curated by Sönke

DEV · Releases

VS Code 1.131 Adds Built-In Dictation and Deeper Subagent Insights

Visual Studio Code 1.131 introduces an experimental built-in dictation service for chat, editor and terminal, powered by the offline Nemotron model, removing the need for the separate Speech extension. The update also sh…

heise Developer · Jul 30, 2026 curated by Sönke

DEV · Security

Node.js 22.23.2 security release patches ten CVEs

The Node.js project has published Node.js 22.23.2 (LTS 'Jod'), a security release fixing ten CVEs — three rated high — affecting HTTP/2, the permission model, HTTPS, DNS and zlib. Immediate upgrades are recommended.

Node.js Releases (dist) · Jul 28, 2026 curated by Sönke

DEV · Security

Critical TeamCity flaw lets attackers bypass authentication and run commands

JetBrains has patched CVE-2026-63077, a critical 9.8 CVSS vulnerability in TeamCity's agent polling protocol affecting all on-premises versions. Attackers can bypass authentication and execute arbitrary OS commands. Upda…

heise Developer · Jul 29, 2026 curated by Sönke

DEV · Tooling

Vercel Labs unveils scriptc, a TypeScript-to-native compiler with no JS engine in the binary

Vercel Labs has published scriptc, an open-source compiler that turns ordinary TypeScript into small native executables without embedding Node, V8 or any JavaScript engine. Static binaries start in about 2.4 ms at 170-20…

Hacker News (Dev, ≥100 P.) · Jul 27, 2026 curated by Sönke

DEV · The Editorial

Judgment Was Always the Bottleneck. AI Just Made It Visible

Claude Code, Cursor, Codex and the newly open-sourced Grok Build all write software fast now. A July preprint testing 86 Python developers found we're bad at catching the wrong ones while feeling just as confident. My ta…

An editorial by Kai · Jul 26, 2026

DEV · Security

Decade-Old Linux Kernel Code Turns Into Instant Root Exploit

A report describes a flaw present in the Linux kernel since version 2.6.39, released in 2011, and shipped by default in most mainstream distributions ever since. The dormant code can reportedly be leveraged to gain root …

Medium · Software Engineering · Jul 23, 2026 curated by Sönke

DEV · Security

CrowdStrike Finds Self-Hiding Worm Targeting AI Coding Toolchains

CrowdStrike researchers discovered a worm that infiltrates AI-driven development pipelines, harvesting npm tokens, cryptographic keys and access credentials while mimicking legitimate automation to evade detection. The m…

WIRED · Jul 21, 2026 curated by Sönke

DEV · Reads

The Case Against Storing Secrets in Environment Variables

A developer explains why they load secrets through application code instead of environment variables, citing a unified config format, an AWS ECS incident where env vars leaked in the console, disk-encryption safeguards, …

r/programming (Top) · Jul 21, 2026 curated by Sönke

DEV · Reads

SQLite's Confusing Defaults Spark Debate Over Rust-Style 'Editions'

A Reddit discussion around a blog post proposes that SQLite adopt Rust-style 'editions' — versioned bundles of safer defaults for foreign keys, journal_mode and busy_timeout. Many developers say they've been burned by SQ…

r/programming (Top) · Jul 15, 2026 curated by Sönke

DEV · Reads

Reddit Reacts to Unpatched Cursor IDE 0-Day That Runs Any Renamed Executable as Git

A Reddit thread reacts to a disclosure from security firm Mindgard showing Cursor's Windows client executes any file named git.exe found in a repository's root folder, even in restricted workspace mode. Demonstrated by r…

r/programming (Top) · Jul 15, 2026 curated by Sönke

DEV · Reads

Engineering Deep Dive: Scaling a Notification System to Millions of Fanouts

This piece walks through the architectural challenges of rebuilding a notification platform to reliably fan out millions of messages without timing out. It covers personalization, priority handling, consent checks, traff…

r/programming (Top) · Jul 14, 2026 curated by Sönke

DEV · Reads

Building encrypted secret sharing in the browser with the Web Crypto API

The article explains how to implement end-to-end encrypted secret sharing in the browser using the Web Crypto API. It also warns against common salt mistakes—stressing that salts should be unique, not secret—and argues t…

r/programming (Top) · Jul 15, 2026 curated by Sönke

DEV · Reads

Cloudflare Identifies Race Condition in hyper's HTTP/1 Implementation

Cloudflare discovered a race condition vulnerability in the hyper Rust HTTP library's HTTP/1 handling. The flaw affects concurrent request processing and warrants attention from teams using hyper in production systems. D…

r/programming (Top) · Jul 13, 2026 curated by Heiko

DEV · Reads

GhostLock: A 15-Year-Old Stack Use-After-Free Vulnerability in Linux

GhostLock is a use-after-free (UAF) vulnerability affecting the kernel's I/O handling stack that persisted across all major Linux distributions for approximately 15 years. The flaw, detailed in security research, represe…

r/programming (Top) · Jul 13, 2026 curated by Heiko

DEV · Reads

Here are all my chairs

A humorous take on poor software architecture through the lens of furniture organization. The post examines common design mistakes and over-engineering pitfalls that developers encounter when structuring their codebase, …

r/programming (Top) · Jul 13, 2026 curated by Heiko

DEV · News

CNIL Mandates Consent for Email Tracking Pixels

The French data protection authority, CNIL, is enforcing a new regulatory framework requiring online services to obtain user consent before using tracking pixels in emails. This move, aligning email marketing with cookie…

Next (FR) · Jul 13, 2026 curated by Georg

DEV · Reads

Announcing TypeScript 7.0

This Reddit submission points to the official announcement for TypeScript version 7.0. Professional developers using TypeScript in web projects should read it to learn about the latest additions, potential breaking chang…

r/programming (Top) · Jul 8, 2026 curated by Georg

DEV · Reads

Postgres Is Enough for More Than We Admit

This short piece argues that many teams add extra databases, queues, caches, and services before they actually need them. It is worth reading for its practical framing of when Postgres can stay the center of a stack, and…

r/programming (Top) · Jul 9, 2026 curated by Charlie

DEV · Reads

How to Achieve Pruning When Querying by Non-Partitioned Columns in PostgreSQL

The post examines techniques for enabling partition pruning in PostgreSQL when queries filter on columns outside the partitioning key. It covers practical approaches to preserve performance gains from table partitioning …

r/programming (Top) · Jul 9, 2026 curated by Georg

DEV · News

China recovers its first reusable rocket using a sea-based net

China’s Long March 10B completed its first flight and recovered its booster in the South China Sea using a net mounted on an offshore vessel. The test marks China’s first controlled rocket recovery and validates reusable…

Ars Technica · Jul 10, 2026 curated by Charlie

DEV · Reads

Self-hosting Umami analytics on Cloudflare, Fly, and Supabase

Guide to deploying Umami, a privacy-focused analytics platform, across serverless and edge infrastructure. Covers practical setup on Cloudflare Workers, Fly.io, and Supabase, appealing to developers seeking vendor-indepe…

r/programming (Top) · Jul 11, 2026 curated by Heiko

DEV · News

Won’t fix! – Teil 4: Warum sich Codequalität nicht in eine Zahl pressen lässt

The article examines why code quality resists reduction to single metrics such as Lines of Code, cyclomatic complexity, Halstead metrics, Maintainability Index or code coverage. It references Goodhart’s Law and Weyuker’s…

heise Developer · Jul 10, 2026 curated by Georg

DEV · News

Flock License Plate Readers Escalate Over Data-Entry Typo

A reporter testing a Range Rover was surrounded by armed police after Flock's ALPR system flagged it as stolen—caused by a clerical error 2,000 miles away. An LA fleet entry typo ("34 DTM" instead of "34 03 DTM") led to …

WIRED · Jul 11, 2026 curated by Heiko

DEV · News

Apple sues OpenAI over alleged trade secret theft

Apple has filed a lawsuit accusing OpenAI of stealing hardware trade secrets and breaching contracts, alleging that former Apple employees retained access to confidential material after joining the company. The complaint…

Xataka · Jul 12, 2026 curated by Charlie

DEV · Tooling

Vite+ reaches beta with 180+ fixes

Vite+ beta unifies runtime, package manager and tools including Vite 8, Vitest, Rolldown, tsdown, Oxlint and Oxfmt behind one CLI. Commands such as vp dev, vp test, vp build and vp migrate provide a consistent workflow. …

heise Developer · Jul 11, 2026 curated by Georg

DEV · Security

Ransomware Negotiator Sentenced for Colluding with BlackCat Attackers

A former DigitalMint negotiator received 70 months in prison for providing BlackCat ransomware operators with confidential victim negotiation data to inflate demands. Five clients paid over $75 million in inflated ransom…

Ars Technica · Jul 10, 2026 curated by Heiko