Blog · page 2
Notes on engineering, design, and everything in between.
Node.js ships security releases on November 11: HIGH on all three lines, and no CVE IDs yet
The project pre-announced HIGH-severity fixes for 26.x, 24.x and 22.x on Wednesday, November 11. No details, no identifiers. That is exactly when ops work pays off.
Ollama 0.40.15 brings a 9B coding model from Xiaomi, plus AutoTrust decision models that only answer yes, no, or a score
mimo-v2.6 is a 9B model aimed at code and agent workflows, one command away. The same release adds AutoTrust decision models that return choices and probabilities.
pnpm 12.18 starts managing agent skill links: install a package, get a directory in .claude/skills
Dependency-shipped agent skills become first-class: links named after the skill, prefixed on conflict, approved per skill. Plus offline installs from downloaded tarballs.
Prometheus 3.16 makes queries report their cost, and promotes anchored and smoothed selectors
3.16 adds opt-in query cost estimation and configurable limits, promotes anchored and smoothed selectors to stable, and clamps the search API's batch_size to 1000.
Tailwind 4.3.5 fixes only the problems you hit after months of use: color-mix crashes, WASM hangs, slow canonicalization
No new features, but every entry is specific: color-mix without an interpolation method no longer crashes, the WASI build no longer hangs, canonicalization stops slowing down.
Traefik 3.7.17 fixes a CVSS 7.5 bug: an unauthenticated Negotiate/NTLM header is enough to exhaust backend transports
GHSA-xv5x-242w-7hf7: since 3.7.14 an NTLM or Negotiate header makes Traefik dedicate a backend transport up front and never release it, draining memory and file descriptors.