Tooling
GitHub adds three webhook delivery IP ranges to its Meta API
Teams with a hand-maintained allowlist need to add 9.234.98.160/28, 9.234.98.176/28 and 9.234.106.48/28 or risk rejecting deliveries; allowlists fed from the API need nothing.
Dev News Daily — Software news, read and annotated by a working engineer
Canonical offers 15 years of Zephyr security maintenance, upstream gives 5
An enterprise Zephyr distribution sold through Ubuntu Pro for Devices, aimed at the Cyber Resilience Act's five-year minimum — announced without a release date or a price.
Python Workers go GA on a packaging standard, not a private build farm
Cloudflare has made Python a supported language on Workers, with framework connectors for FastAPI, Django and Flask and native bindings — and the wheel problem solved in PEP 783 rather than in-house.
A Spring AI client answers typed questions and never generates a token
Spring AI TypeSafe wires the hosted Jev API into Spring: three question primitives, a confidence on every answer, and no prompt template, JSON schema or parser in between.
Your dependency list does not contain the code most likely to be attacked
Package manifests describe what you chose. Native decoders, fonts and archive readers arrive underneath that, selected by file content rather than by you.
jj absorbs the aliases its users wrote: tug, bisect run, run and fix
A JJ Con 2026 talk surveys what moved from community config into the tool itself, and where the version-control gap against git finally closed.
w64devkit locks its releases so even the maintainer cannot edit them
A year of supply-chain work on a Windows C toolchain: code signing, builds triggered only by a tag push, immutable artefacts, and a multilib x64 release.
One image parser sits under Slack, Discourse, Next.js and GitHub
Hacktron's HEIF Heist traces attacks on libheif and libde265 through ImageMagick, libvips and Sharp into applications that never chose to decode HEIC.
Data-mix weights extrapolate badly: the effect reverses with model size
Jane Street measured how much a sequence's training weight changes what a model learns, and found the relationship is not monotonic across scales.
Passing a hash test suite says nothing about chosen-input collisions
A study of the popular fast hashes shows attacker-selected inputs can collide far above the average rate, without the attacker ever learning the seed.
Notion replaced last-write-wins inside a block with an RGA CRDT
Separate database records per block hid the problem for years. Offline mode would have turned it into data loss, so the text itself became a merge-safe structure.