All
463 posts
Reports this week describe coding agents being hijacked through malicious AGENTS.md files. What the attack class looks like, and a practical hardening checklist for teams using Claude Code, Codex, and similar tools.
Three GitHub Actions changes land within weeks of each other: workflow dependency lockfiles in preview, retention now covering checks and runs, and the macOS 14 runner retiring on November 2. An audit checklist for CI owners.
Python 3.15.0 shipped on October 9. A practical look at explicit lazy imports, the built-in frozendict and sentinel, and the UTF-8 default that can change behavior in existing code.
Third-party trackers count about 25 Claude Code releases in 30 days, touching default models, plugins, subagents and hooks. A practical policy for pinning versions, vetting plugins and keeping your guardrails stable.
Node.js 20 receives no fixes in the October security releases, and Vercel deprecates it on October 1. A step-by-step runbook for finding every place Node 20 hides and moving to a supported line.
Node.js shipped ten fixes on October 21. Four are rated high, and three of those share a theme: one component reads a hostname or IP differently from another. Here is what to patch and what to audit in your own code.
Atlassian's latest survey reports near-universal AI use but little reduction in friction. What that implies for team policy, review load, and how to measure whether AI tooling is helping.
PHP shipped emergency releases for two critical unauthenticated RCE flaws. How to find every PHP runtime you operate, patch in the right order, and what interim mitigations actually do.
A compromised release of an AI infrastructure SDK shipped through a legitimate release workflow. Lessons on install scripts, provenance limits, and the order in which to respond.
Claude Code 2.1.302 turns on fork subagents for claude -p, the Agent SDK, and the desktop and VS Code apps. What changes when a subagent inherits the full conversation, and how to review your automation before upgrading.
Go 1.27 promotes encoding/json/v2 out of experiment. Upgrading the toolchain is safe; changing the import is where behavior shifts. A test-first migration approach for duplicate keys, invalid UTF-8, nil collections, and field matching.
PgBouncer 1.26.1 fixes three CVEs, including an authentication bypass between SCRAM users. How to find affected instances, what the behavior change means for search_path, and how to reduce exposure beyond upgrading.