A supply chain attack on a Rust crate has reignited debate about dependency culture. A widely discussed Reddit post argues that Rust shares the npm mindset of pulling in many small packages, and that languages with large…
Microsoft has published TypeScript 7.0.2, a patch release in the new 7.x major version line. The tag was originally created in the typescript-go repository and points to the TypeScript 7.0 announcement for details on the…
Bun 1.4 completes the runtime's rewrite from Zig to Rust, adds 1,517 newly passing Node.js test-suite tests, and cuts idle CPU usage by a factor of five. New built-ins include Bun.Image, Bun.WebView, Bun.cron and a nativ…
Attack attempts against CVE-2026-19478, a critical GitLab vulnerability patched in an out-of-band release on Monday, have been observed by security firm watchTowr. The flaw lets unauthenticated attackers delete projects …
GitLab has patched two vulnerabilities, one rated critical, that allow attackers to manipulate or delete public projects and user data via the GraphQL API. Fixed versions are 18.11.11, 19.0.8, 19.1.6 and 19.2.4. Self-hos…
A community piece previews the next major version of DuckDB, the in-process analytical database popular with data engineers. Worth a read for anyone running DuckDB in production or evaluating it, since a major version bu…
PostgreSQL's team released versions 14.24, 15.19, 16.15, 17.11 and 18.6, fixing 28 vulnerabilities. Most let attackers run arbitrary code after a successful attack and gain full control of instances. Two high-severity CV…
Buf has released LSP support for Protocol Buffers, bringing IDE features like completion, navigation and diagnostics to .proto files. The announcement, discussed on r/programming, also drew comments on Buf's pricing: 36 …
GitLab has published patch releases 19.2.2, 19.1.4 and 19.0.6 with important security fixes. Among the addressed issues are cross-site scripting vulnerabilities whose CVSS scores classify them as severe risks.
Ryan Dahl has released Durable Objects as open-source technology, decoupling them from Cloudflare's platform. This move enables developers to deploy stateful, globally-distributed computing workloads independently, expan…
A compromised AI development tool exposed terabytes of credentials from over 2,500 organizations including Microsoft, Amazon, Nvidia, and Salesforce. The attack affected 434,000 CI/CD pipelines during a 40-minute window …
PostgreSQL released four maintenance versions and one beta addressing 33 security vulnerabilities and numerous functional bugs. Key fixes include restrictions on logical decoding plugins, detection of unsupported ciphers…
Tailscale's investigation into data corruption issues led to the discovery of a long-dormant bug in SQLite's write-ahead log (WAL) checkpoint mechanism. A race condition during WAL reset under specific concurrent conditi…
Researchers at A Security used public AI models with fewer than 20 prompts to find Zoom vulnerabilities in the screen-sharing annotation protocol. The flaws, now patched, let any call participant silently hijack another …
A recent Medium piece walks through a classic Postgres outage: a trivial column addition stalls behind a long read and takes the whole table hostage. The fix is known, cheap, and almost nobody's default. I think that's o…
At Black Hat, runZero founder HD Moore presented over a dozen new vulnerabilities in baseboard management controllers from HPE, Supermicro, Dell, Lenovo, Huawei and others. Scans found more than half of 86,000 internet-e…
Node.js v26.7.0 is now available from the project's distribution channels. The release continues the v26 line of the JavaScript runtime, shipping the usual batch of fixes and dependency updates. Details on included commi…
Vercel has released Next.js 16.3, cutting Turbopack's RAM consumption in dev mode by up to 90 percent through disk caching and memory eviction. The release also adds Instant Navigations and an experimental Rust-based Rea…
Project Valhalla's JEP 401, covering value objects, is heading into JDK integration as a preview feature. Value objects aim to let Java developers declare identity-free, immutable class instances that the JVM can optimiz…
A worm spread an identical credential stealer through nine unrelated npm organisations within roughly 30 minutes, hitting keyv and cacheable packages among others. Affected packages include authentication libraries, and …
Node.js has published two new releases: v26.6.0 in the current release line and v24.19.0, the latest update to the LTS Krypton branch. Both versions are available via the official Node.js release channels and distributio…
RFC 10008 finally gives us an HTTP method that carries a body and is still safe and idempotent. The spec is sound and short. But whether QUERY becomes real depends on nginx configs, CDN method allowlists, WAF defaults an…
TypeScript 7, released July 8, 2026, replaces the compiler with a Go-based implementation and delivers real build speed gains. The piece warns that the upgrade path comes with three common breaking issues most teams will…
Vercel Labs has released scriptc, an open-source compiler that turns TypeScript directly into native executables without a JavaScript runtime. Early benchmarks show drastically faster startup, smaller binaries and lower …
GitHub has launched stacked pull requests in public preview. The feature splits large changes into an ordered series of small, focused pull requests, making reviews easier. Developers can create and manage dependent PR c…
Visual Studio Code 1.131 introduces an experimental built-in dictation service for chat, editor and terminal, powered by the offline Nemotron model, removing the need for the separate Speech extension. The update also sh…
The Node.js project has published Node.js 22.23.2 (LTS 'Jod'), a security release fixing ten CVEs — three rated high — affecting HTTP/2, the permission model, HTTPS, DNS and zlib. Immediate upgrades are recommended.
JetBrains has patched CVE-2026-63077, a critical 9.8 CVSS vulnerability in TeamCity's agent polling protocol affecting all on-premises versions. Attackers can bypass authentication and execute arbitrary OS commands. Upda…
Vercel Labs has published scriptc, an open-source compiler that turns ordinary TypeScript into small native executables without embedding Node, V8 or any JavaScript engine. Static binaries start in about 2.4 ms at 170-20…
Claude Code, Cursor, Codex and the newly open-sourced Grok Build all write software fast now. A July preprint testing 86 Python developers found we're bad at catching the wrong ones while feeling just as confident. My ta…