Software news, read and annotated by a working engineer
Amazon's CEO said committed capacity is largely allocated through 2027 with headroom kept for on-demand, EC2 and Bedrock; engineers report tighter ordinary instances already.
Nolan Lawson had a coding agent build the same Pokémon app five times per framework; Lighthouse scores barely moved, while build cost and shipped JavaScript differed widely.
Robert Haas counts back-patched commits up more than 60% on last year and late reverts of three large features; the cause, he argues, is that bugs became much easier to find than to fix.
Docker's account of a code review bot that rejected a routine PostgreSQL bump with a fake CVE shows where agent safety stops: the agent obeyed its limits, and the risk moved to the person reading its output.
Project Zero counts 45 BigSleep bugs against 37 from Fuzzilli with 25–60% overlap; a Red Hat survey finds only 32.9% of EMEA CIOs have a complete view of their open source supply chain.
AWS sells the model on price and agent benchmarks against GPT-6.1 Sol; GitHub sells it on terminal and C# tasks — and both say little about what changes for teams that already pay.
Cloudflare's Auto Router scores each request from the most recent turns, capped at 8 KiB. The sharpest critique of the launch is about what that compact view misses.
The release candidate arrived on 15 October; a second one follows on 12 November. A core committer explains why eight to ten features were pulled and what still ships.
This week's patch releases repeat that no Helm 3 minor will follow; security fixes end on 10 February 2027. The project's own notes say charts carry over, and name the flags and workflows that do not.
The Go blog explains why skipping resp.Body cost a new TCP and TLS handshake per request, and how net/http now drains up to 256 KB for up to 50 ms in the background so connections are reused.
