Archive

2026

• 0, 2026PCL2 Killed Its Minecraft Downloader. Here Is What It Means
• , 2026Grafana 13.3 fixes ten CVEs, then quietly makes panel subtitles and the auto grid the default
• , 2026Home Assistant 2026.11: HACS becomes a built-in Marketplace, 38 new integrations, biggest release yet
• , 2026Immich 3.3.6 is an apology: onnxruntime enabled telemetry by default and the ML container reported to Microsoft
• , 2026Loki 4.0 hits RC: the Go module path moves to /v4, the V2 query engine is unplugged, BoltDB shipper retires
• , 2026Node.js 26 becomes LTS 'Lithium': the release that changed almost nothing, and that is the point
• , 2026Node.js ships security releases on November 11: HIGH on all three lines, and no CVE IDs yet
• , 2026Ollama 0.40.15 brings a 9B coding model from Xiaomi, plus AutoTrust decision models that only answer yes, no, or a score
• , 2026pnpm 12.18 starts managing agent skill links: install a package, get a directory in .claude/skills
• , 2026Prometheus 3.16 makes queries report their cost, and promotes anchored and smoothed selectors
• , 2026Tailwind 4.3.5 fixes only the problems you hit after months of use: color-mix crashes, WASM hangs, slow canonicalization
• , 2026Traefik 3.7.17 fixes a CVSS 7.5 bug: an unauthenticated Negotiate/NTLM header is enough to exhaust backend transports
• , 2026Mistral Large 4 'Le Chonk' lands in Transformers: 1T parameters, 1M context, 3,800 Blackwell GPUs
• , 2026Vite 8.3.6 fixes hash drift: chunk import map signatures now use stable module ids
• , 2026VS Code 1.145 mixes Claude and Copilot in one session, and previews remote agent dev servers in the window
• , 2026Zed 1.27 teaches AI commit messages your repo's style and stops the agent panel eating memory on open
• 6, 2026Astro 7.4.2 turns a 60-second content sync into under a second by counting bytes differently
• 6, 2026Bun 1.4.4 ships a formatter: 59 milliseconds on Prettier's own repo, 286x faster
• 6, 2026The one fix that matters in Deno 2.9.8: it stops trusting the compromised eMudhra root
• 6, 2026Electron 45 lands Chromium 156, Node 24.22 and V8 15.6 — and every breaking change sits on a sandbox boundary
• 6, 2026Home Assistant 2026.10.3: eighty percent integration fixes, the rest chasing infrastructure
• 6, 2026llama.cpp build 11899: giving multimodal clients an interface to ask what a model supports
• 6, 2026Node ships three security releases in one day: 11 CVEs, five high, two in tls and one in dns
• 6, 2026Ollama 0.40.11 starts talking: local speech on macOS plus decision models that only answer yes, no or a score
• 6, 2026Redis patches three lines at once: propagating a 4GB+ message over the cluster bus overflows the heap
• 6, 2026Ruff 0.17.2 adds a preview rule against repeated regex compilation, plus a batch of false-positive fixes
• 6, 2026Traefik 3.7.16: ForwardAuth finally speaks NTLM and Kerberos, plus one CVE
• 6, 2026TypeScript 7.1 Beta: ambient modules can finally declare import attributes, and --target reaches es2026
• 6, 2026uv 0.13.5 drops the compromised root and moves managed CPython onto three security patches
• 6, 2026Half of Vite 8.3.5's fixes live in bundled-dev: bundling during dev is still catching up
• 6, 2026Vue 3.6's 13th release candidate: seven of eight fixes live in the Vapor compiler
• 3, 2026BeyondTrust Remote Support auth bypass is exploited in the wild, CISA adds it to KEV
• 3, 2026Python 3.15 lands: UTF-8 by default, frozendict built in, a slightly faster JIT
• 3, 2026Safari TP 254 brings calc-size(), size shorthands and live pinch-to-zoom
• 3, 2026Servo 0.6 turns CSS Grid on by default, and a lot of sites finally line up
• 3, 2026Zig 0.17: the grammar starts to freeze and the build system splits in two
• 2, 2026Three hours of Cloudflare 5xx: how one config change took down half the web
• 2, 2026CSS has if() now: conditional styles without stacking media queries
• 2, 2026MCP Inspector's 9.4: a dev tool that runs commands should not listen on 0.0.0.0
• 2, 2026Node.js 24 is LTS: Krypton runs to 2028, and here is what changes
• 2, 2026PHP's two 9.2 RCEs: the official root causes, and what the public PoC actually demonstrates
• 2, 2026PostgreSQL 18: async I/O, uuidv7, and an upgrade path that hurts less
• 2, 2026The CVSS 10.0 React bug: one request, code execution on your server
• 2, 2026A retargeted tag: twenty thousand repos leaked secrets into build logs
• 2, 2026TLS certificates are heading to 47 days: automation is no longer optional
• 1, 2026What a CVSS 4.0 score of 9.2 says, and the three things it does not
• 1, 2026Eight intermediate CA private keys that were all integers below 256
• 1, 2026PHP ships two 9.2 fixes today at 14:00 UTC: what to do before then
• 1, 2026Twelve PHP CVEs in three days, none of them in PHP
• 1, 2026Ten open-source games, 48 MB: what self-hosting third-party games actually costs
• 0, 2026When a 3D scene should actually start loading
• 9, 2026CVE-2026-99999: the IPv4 checksum bug that can escape a VM
• 9, 2026Reading DeepSeek official charts: what V4.1 Flash-1017 actually improves
• 9, 2026Klotski: write the rules before the animation
• 8, 2026873 bugs, 54 models: notes on the 2026 LLM security report
• 8, 2026Next.js October patch: three holes, two of them remote code execution
• 8, 2026Pipe puzzles: guarantee the map is solvable
• 7, 2026An agent identity is more dangerous than its capability
• 7, 2026Halftone dots and misregistration in CSS
• 7, 2026Prompt injection is still number one, because we still treat data as instructions
• 6, 2026PwnEscape and agent sandboxes: a microVM is not an absolute boundary
• 6, 2026239 model keys behind one hardcoded variable
• 6, 2026Search on a bilingual static site: the Pagefind trade-offs
• 5, 2026How a CDN puts your content next door
• 5, 2026Three ways classical cipher tools go quietly wrong
• 5, 2026Where a data center's power comes from
• 5, 2026Debian DSA-6045: a poisoned resolver can also break DNSSEC
• 5, 2026NTP and time sync: the internet's heartbeat
• 5, 2026Photolithography: printing circuits onto silicon
• 5, 2026HTTP/3 and QUIC: routing around TCP
• 5, 2026Undersea Cables: The Physical Backbone of the Internet
• 4, 2026Cooling Data Centers: From Blowing Air to Taking a Bath
• 4, 2026GEO manipulation: when model answers are decided by search ranking
• 3, 2026Low-Earth-Orbit Satellite Internet: Moving the Base Station Into the Sky
• 2, 2026Upgrading to Astro 7: the Rust compiler is fast, the cold cache is what bit me
• 2, 2026CSS is getting functions and conditionals: @function and if()
• 2, 2026HTTP finally has a safe method with a body: QUERY
• 2, 2026Internet Exchange Points: Where Traffic Changes Hands
• 2, 2026No-guess Minesweeper: making every board solvable by reasoning alone
• 2, 2026Post-quantum TLS is already in your handshake, but it only solves half the problem
• 2, 2026text-box-trim is usable now: cut the dead space around headings
• 1, 2026Ninth Circuit: AI-generated code is not a "copy" under the DMCA
• 1, 2026MCP 2026-07-28: delete the session, make the protocol stateless again
• 1, 2026Node.js 26 is LTS: do not let a platform schedule your upgrade
• 0, 2026Artex goes closed source: what an author can do when a security tool is abused
• 0, 2026GhostAction: pushing a malicious workflow into tens of thousands of repos
• 0, 2026Harness buys Augment Code: AI coding tools start to consolidate
• 0, 2026PostgreSQL 19: REPACK, WAIT, and a planner you can finally argue with
• , 2026Jensen Huang dancing like Michael Jackson: when a hit video needs no truth
• , 2026Chrome 155: JPEG XL is back, and post-quantum lands in Web Crypto
• , 2026A poisoned npm release: what one postinstall can carry away
• , 2026Rust 1.96's Range types: taking Copy back from Iterator
• , 2026An AI agent chained two zero-days: the seconds that took down DIVD
• , 2026SQLite 3.53: a WAL corruption fix, and a proper table for the CLI
• , 2026Wikipedia names rogue agents: after millions of requests
• , 2026Putting a Three.js island inside a static site
• , 2026GLPI template-injection RCE: why admin rights should not equal root
• , 2026Morse code: one table, two ambiguities, three details
• , 2026An opponent that predicts the bounce, but not too well
• , 2026Volume without a modelling tool: triangulating an island by hand
• , 2026Twelve hundred instances: squeezing a garden into a few draw calls
• , 2026Lighting one scene: three lamps and a shadow map computed once
• , 2026Water from two shaders: a pool, a stream and a waterfall
• , 2026The loading budget for 3D: split the chunk, load on visibility, know when to stop
• , 2026sibling-index() and sibling-count(): CSS finally knows which one it is
• , 2026The autocorrect attribute: giving the page a say in auto-correction
• , 2026Compressed and still mutable: a dynamic compressed self-index
• , 2026<template for>: letting HTML declare which region gets replaced
• , 2026The source shown on the page and the file served to curl must be one string
• 0, 2026Atomic file writes: write a temp file, then rename
• 0, 2026Base64: it is neither encryption nor compression
• 0, 2026Misusing big O: constants and preconditions decide more than the order
• 0, 2026Using @layer to make CSS precedence a declared order, not a specificity fight
• 0, 2026Debounce vs throttle: the difference is who decides when to run
• 0, 2026Estimating work: why "about three days" becomes three weeks
• 0, 2026Feature flags are debt, not configuration
• 0, 2026The game loop: why delta time is not optional
• 0, 2026git bisect: turn which commit broke it into one command
• 0, 2026Gomoku AI: splitting threat detection from search
• 0, 2026Graceful shutdown: the exit sequence decides between 502s and clean responses
• 0, 2026HTTP caching: Cache-Control and ETag each own half
• 0, 2026Idempotency keys: the one write that makes retries safe
• 0, 2026JSON canonicalization: why the same object hashes two ways
• 0, 2026Memory layout: the same algorithm, ten times slower, is usually cache
• 0, 2026Deadlock: break any one of four conditions
• 0, 2026The N+1 query: the most typical ORM performance trap
• 0, 2026Rate limiting: what token bucket and leaky bucket really differ on
• 0, 2026Catastrophic backtracking: why a regex can pin a CPU
• 0, 2026iframe sandbox: it narrows capability, it does not harden
• 0, 2026Semantic versioning: a major bump promises no silent behavior change
• 0, 2026SQLite indexes: the leftmost prefix is a consequence of sorting
• 0, 2026What technical debt interest actually looks like
• 0, 2026Time zones and DST: store UTC, or daylight saving will bite
• 0, 2026Turning an AI search into a tree you can page through
• 0, 2026Unicode normalization: why two identical-looking strings differ
• 0, 2026URL encoding: spaces, plus signs and double encoding
• 0, 2026Four places Chinese chess rules go wrong
• 9, 2026Writing a cron parser: five fields, the union rule, and February 30th
• 9, 2026CSV is not split on commas: quoting and newlines from RFC 4180
• 9, 2026Legal moves in Reversi: eight directions, one scan
• 9, 2026A sudoku generator: digging holes, unique solutions, and the bug that froze the page
• 8, 2026Consistent hashing: why adding a machine does not reshuffle every key
• 8, 2026Winning at Gomoku: checking the last stone is enough
• 8, 2026Sliding windows: decide what the window tracks before writing the loop
• 7, 2026Monotonic stacks: next greater element in O(n), not O(n squared)
• 7, 2026Counting the ones in a binary number: from loops to SWAR
• 7, 2026Union-find: two lines of optimisation make every operation near constant
• 6, 2026In Rust, context belongs on the line that actually fails
• 6, 2026When a crate should become a workspace
• 6, 2026Structured logging is not println replaced by tracing::info
• 5, 2026Islands are not Web Components: two different kinds of on-demand loading
• 5, 2026Cache headers for a static site: hashed files forever, HTML never
• 5, 2026When WebAssembly earns its place: less often than the pitch suggests
• 4, 2026Anchors hidden behind a sticky header: one scroll-padding-top for the whole site
• 4, 2026Use the native dialog element: you get more than you think
• 4, 2026Dark mode forms stay white: color-scheme is the switch
• 4, 2026Stop guessing the header height: measure it with ResizeObserver
• 3, 2026Design tokens: one file that runs the whole site
• 2, 2026Manual i18n: what hand-rolling two languages costs
• 1, 20262048: collapsing four directions into one operation
• 9, 2026Minesweeper: deferring mine placement until the first click
• 8, 2026Turning screen-printing limits into design tokens
• 7, 2026Base and unit conversion: temperature is the only non-linear one
• 5, 2026Color and contrast: relative luminance is not an average
• 4, 2026Full-text search on a static site: index at build time, no backend at runtime
• 3, 2026Hash and checksum: why CRC32 and MD5 have to be written by hand
• 1, 2026Regex Lab: hits, groups, replacement preview, and the zero-width trap
• , 2026JSON Studio: format, validate and diff in one page
• , 20261059 assertions, no test framework: why pure logic must import nothing
• , 2026SharePoint deserialisation RCE: CVE-2026-45659
• , 2026n8n unauthenticated RCE (Ni8mare): CVE-2026-21858
• , 2026Cisco FMC unauthenticated Java deserialisation RCE: CVE-2026-20131
• , 2026Pushing first-load JS to zero with Astro islands
• 0, 2026Next.js incremental cache path traversal to RCE: CVE-2026-75604
• 8, 2026React Router prototype pollution chained into RCE: CVE-2026-42211
• 7, 2026One source for head: SiteHead, JSON-LD escaping and hreflang
• 4, 2026Shipping a static site is not "upload the folder": caching, compression, honest 404s
• 2, 2026A theme-switch ripple with the View Transitions API
• 9, 2026Pagination at build time: why a static site should not page with a query string
• 6, 2026The @/ alias lives in three configs, and all three are required
• 3, 2026zod as a frontmatter contract: bad articles fail the build
• 1, 2026Why I built yet another personal site
• , 2026A zero-config registry: adding a game means adding a directory
• , 2026No client:only for app pages: a static shell plus an explicit mount
• , 2026Views hold no logic: all data assembly lives in src/server