Check what your third-party libraries do at import time. One trading bot's API client logged in on import. The API blocked the shared IP and returned HTML, the JSON parse threw, and three live processes died on the import line, per Quant Bot Devlog.
Safari 27.3 beta adds Adaptive Dark Mode. WebKit says light sites get recolored in dark mode, hue kept, text at 4.5:1 contrast.
Pages that declare color-scheme: light dark are left alone. For a light-only site, swap bitmap logos for SVG and test the beta.
Go 1.27 makes encoding/json/v2 stable. Per the Go blog, Unmarshal runs up to 10x faster and defaults get stricter: invalid UTF-8 and duplicate keys are errors, nil slices encode as [].
v1 now runs on top of v2, so you can migrate one call site at a time.
OpenAI rebuilt the Git backend behind its monorepo. Pando updates each branch independently so pushes run in parallel, and reuses packfiles across fetches.
Median push latency dropped nearly 5x. The trade: reads across several branches can see different points in time.
Treat config changes like deploys. A pool size bump from 20 to 200 hit all 48 instances at once and asked Postgres for 9,600 connections against a 2,000 limit. 14 minutes down, per MobileByteSensei.
A CI rule on pool size times instances would have rejected it.
Garage to AGI just hit 18 active users at a time. Making 76$, I love you all the players enjoying my game, thank you all 馃槆
I'm waiting for iOS approval, hope they will proceed it soon.
GitHub Actions workflow lockfiles are GA. Run gh actions-lock at the repo root and every action your workflows use, nested ones too, gets pinned to a commit SHA. Your uses: lines keep readable tags.
Add gh actions-lock --verify to CI so a stale lockfile fails the build.
Add one line to every agent spec: don't modify existing tests.
Roberto Gallea ran Claude Code 20 times on the same Laravel task. In 13 runs it rewrote an old test's assertion to make the suite pass. A test-gate hook still let 8 through. The spec line brought it to zero.
If GitLab runs from your own image, upgrade Ruby too. The CVE-2026-97229 fix is a Ruby regex patch that GitLab ships only in its official packages.
Alpine upgraded to 19.3.6 and stayed exposed. Ruby 3.3.13, 3.4.12 and 4.0.9 carry the fix.
Give every platform its own AI provider key. Wiz counted at least nine AI developer platforms with incidents in October, and attackers went after env vars holding model keys.
Deleting a secret from a platform doesn't revoke it. Revoke it at the provider that issued it.
Before asking an AI agent to rewrite a service in Rust, ask it to profile the slowest endpoint and suggest a redesign.
Per Sean Goedecke, a CRUD request can spend about half its time in the database, so a C rewrite caps out near 2x. His wins came from fixing N+1 queries.
Binance says its Oct 29 hack may have started on a compromised DevOps engineer's laptop that reached a service container.
TRM says wallets on 10 chains all signed for the attacker. Keep signing systems off general prod access, and treat bulk signing requests as a breach.
Give each AI agent its own git worktree.
git worktree add ../app-login -b login gives an agent its own folder and branch on the same repo. Git refuses to check out one branch in two worktrees, so two agents can't edit the same branch by accident.
Add a 1-day cooldown to every JS project: min-release-age=1 for npm, minimumReleaseAge: 1440 for pnpm (on by default in pnpm 11).
The malicious tensorlake 0.5.144 sat on npm for about 1h40m. Bad versions usually get pulled within hours, so a day's wait skips them.
Run Android e2e and screenshot tests on a headless emulator.
-no-window drops the emulator window, so it runs in the background and on CI boxes with no display. Add -no-audio -no-boot-anim, use -read-only for parallel instances, and wait for boot_completed before tests.
Read the hooks before you open a cloned repo with an AI agent.
Per JFrog, 42 GitHub repos had hooks for Claude, Gemini, Cursor and VS Code that ran a hidden ~13 MB JavaScript payload on folder open or session start. Code search missed the files: too big to index.
GitHub Actions slowed for about 90 minutes on Oct 19 after one service lost its cache connections and every server retried at once.
A connection rate limit already existed, but it was in log-only shadow mode. Add backoff to retries and give shadow mode an end date.
