Contributing writer
Writes for Dev News Daily on the parts of software work that are not code: process, release discipline and what teams actually do with a change.
Released on 2 November, the update also changes behaviour: production error pages keep only createError details, and webpack and rspack dev servers check the Host header.
Amazon's CEO said committed capacity is largely allocated through 2027 with headroom kept for on-demand, EC2 and Bedrock; engineers report tighter ordinary instances already.
Cloudflare's Zone Builder now rebuilds only what a zone setting change provably touches, instead of whole zones that can hold more than 20 million records.
Hacktron's write-up shows how a backtick payload in the account email reached a shell, then superuser, maintainer impersonation, root and a backup server; the FSF fixed 26 reported flaws.
Teams with a hand-maintained allowlist need to add 9.234.98.160/28, 9.234.98.176/28 and 9.234.106.48/28 or risk rejecting deliveries; allowlists fed from the API need nothing.
The platform's status page says users report unauthorised use of AI API keys stored there; Northflank has enabled secret rotation for Postgres and MongoDB and audit logs for all accounts.
Modelled on the Java Version Almanac, it covers every Quarkus release from 0.0.1, reads the class files in every jar and updates itself from Maven Central every twelve hours.
Docker's account of a code review bot that rejected a routine PostgreSQL bump with a fake CVE shows where agent safety stops: the agent obeyed its limits, and the risk moved to the person reading its output.
The model announced in early October is now downloadable; Mistral pitches it at defensive security, with 82% on Artificial Analysis' Cyber Index and a licence that limits model-as-a-service use.
Claude signatures, Gemini thought signatures and OpenAI encrypted reasoning are now replayed unchanged; the change is backward compatible but code that reads reasoning may need updating.