Frameworks
Vite 8.3.6 fixes plugin close races, CSS deps of queried imports and unstable chunk hashes
The 5 November patch release also lets bundled dev mode import named exports from Node built-ins and reload when HMR cannot rerun an entry.
Dev News Daily — Software news, read and annotated by a working engineer
SANS ISC explains how to spot Multipath TCP on a network after a new Linux MPTCP flaw
Johannes Ullrich's diary walks through the MPTCP option, its subtypes and where it shows up in practice, mainly iOS connections to Apple's 17.0.0.0/8 range.
Cloudflare halves DNS build delay with targeted zone builds and cuts peak memory by 85%
Cloudflare's Zone Builder now rebuilds only what a zone setting change provably touches, instead of whole zones that can hold more than 20 million records.
OpenAI raises bug bounties: critical flaws in ChatGPT, Codex and the API pay up to $30,000
OpenAI says it is more than quadrupling the midpoint of its medium, high and critical reward ranges and adds quality, loyalty and campaign bonuses.
pgAdmin 4 v9.19 fixes 15 vulnerabilities, most of them in server mode
The 31 October release patches CVE-2026-116238 to CVE-2026-116252, replaces free-text password exec commands with an allowlist and adds an extended-statistics node.
Hono 4.13.16 fixes five ways a request could slip past middleware
The 1 November release patches path handling in mount(), wildcard gaps in RegExpRouter, a form validator bypass, HTML injection through the css helper and a csrf() gap for hyperlink pings.
Linux 7.2.15 is the last 7.2 release; the branch reaches end of life early
Greg Kroah-Hartman told users to move to 7.3.y, saying keeping 7.2 alive would have meant maintaining eight stable branches at once.
An email address gave code execution on GNU Savannah, home of Bash
Hacktron's write-up shows how a backtick payload in the account email reached a shell, then superuser, maintainer impersonation, root and a backup server; the FSF fixed 26 reported flaws.
CloudFront can now tell an origin the viewer's ISP and whether TLS used PQC
Two new optional headers, CloudFront-Viewer-ISP and CloudFront-Viewer-TLS-Details, are forwarded to the origin through an origin request policy.
Twelve frameworks, one app: agent build cost ran from $2.67 to $4.97
Nolan Lawson had a coding agent build the same Pokémon app five times per framework; Lighthouse scores barely moved, while build cost and shipped JavaScript differed widely.
Trigger.dev says an attacker read environment variables of some customers
The company disclosed on 1 November that the exploit is blocked, a subset of organisations had their environment variables exposed and affected owners were emailed.