Skip to content
chornous.dev

Type two or more letters. Esc closes.

Index of sheets
Theme

Sheet 03 · Tags / Tooling

All topics

#Tooling

35 posts · 0 projects

AWriting

  1. Modern Web Guidance 1.0: Chrome's agent skills go stable, add a modernize workflow, and pick up Firefox and EdgeChrome released Modern Web Guidance 1.0 on November 10, 2026. The skill set for coding agents adds a static-analysis modernization workflow, expert-reviewed guides with a public eval dashboard, and Firefox and Edge as contributors.
  2. Rust 1.100: the never type is stable, Infallible becomes !, and Cargo can hold back fresh cratesThe Rust Release Team shipped Rust 1.100.0 on November 12, 2026. The never type is stable after 10 years, older editions now fall back to ! instead of (), the core Allocator API works with Vec and Box, and Cargo gains a min-publish-age setting for dependency cooldowns.
  3. Go 1.27 makes encoding/json/v2 stable: duplicate keys and invalid UTF-8 now fail, nil slices encode as []The Go team announced on November 4, 2026 that encoding/json/v2 and encoding/json/jsontext are stable in Go 1.27. The new packages reject duplicate names and invalid UTF-8, match struct fields case-sensitively, and unmarshal up to 10x faster than v1, which now runs on top of v2.
  4. OpenSSH 10.6p2: sshd on musl without PAM accepted any 257 to 1024 byte password for accounts marked *Portable OpenSSH 10.6p2 shipped on November 5, 2026 with a workaround for a password authentication bypass on Linux systems that use musl libc with PAM disabled. Alpine published fixed packages for 3.16 through edge the same day.
  5. Postman desktop 12.33.4 installed plugins and a SessionStart hook into Claude Code and Codex without asking, then revertedA Postman user reported on October 25, 2026 that the desktop app auto-installed its agent plugins into Claude Code and Codex, added a startup hook, and wrote a hook trust record into ~/.codex/config.toml. On November 5 a Postman team member said the company was reverting the change.
  6. LiteLLM 1.107.0 shipped a credential stealer to PyPI and Docker for two hours: what to delete and what to rotateAttackers published a malicious litellm 1.107.0 on October 21, 2026, through LiteLLM's own release workflow pointed at a lookalike fork. The wheels drop cook.pth, cook.py and sitecustomize.py into site-packages, which run on every Python start. The last clean version is 1.106.2.
  7. Anthropic replaced git for its monorepo with Scion: 30,000 merges a day and checkouts in secondsOn October 13, 2026 Anthropic described Scion, the source control system a seven-person team built in five months after merges grew from 2,500 to more than 30,000 a day. It moves commits, merges and history to the server and fetches the trees and blobs a client asks for.
  8. Gemini 4 Argon on the API: 1M output tokens, thinking levels only, and a price that doubles on December 1Google opened Gemini 4 Argon (gemini-4-argon) to the Gemini API worldwide on October 13, 2026 at $2 input and $10 output per million tokens until November 30. It drops thinking_budget, sampling parameters and explicit caching, adds long decode up to 1,048,576 output tokens, and spends more than twice GPT-6 Astra's output tokens per benchmark task.
  9. GitHub Actions gets lockfiles: gh actions-lock pins every action, including transitive ones, to a commitGitHub put workflow dependency lockfiles into public preview on October 14, 2026. The gh actions-lock CLI extension writes .github/workflows/actions.lock, runners re-check each pin at job start, and a Require lockfile policy lets admins enforce it.
  10. Python 3.15: lazy imports, frozendict, and UTF-8 as the default encodingPython 3.15.0 shipped on October 9, 2026. It adds the lazy import keyword (PEP 810), frozendict and sentinel built-ins, unpacking in comprehensions, and the Tachyon sampling profiler, and it makes UTF-8 the default when you open a file without an encoding.
  11. Claude Haiku 5.5: a tenth of Haiku 4.5's price under 100K tokens, and a tokenizer that counts 30% moreAnthropic released Claude Haiku 5.5 on October 7, 2026 at $0.10 input and $0.50 output per million tokens for prompts up to 100K. It adds effort levels, rejects thinking budgets, sampling parameters and prefill, and counts about 30% more tokens than Haiku 4.5 for the same text.
  12. Gleam 1.19 stops writing Erlang source: abstract forms, real line numbers and faster BEAM buildsLouis Pilfold announced Gleam v1.19.0 on October 5, 2026. The compiler now emits Erlang abstract forms instead of .erl source, which fixes line numbers in BEAM stack traces and cut a 10,000-function compile benchmark from 0.434 to 0.342.
  13. mold 3.0: the linker moved from C++ to Rust, and the build moved from CMake to CargoRui Ueyama released mold 3.0.0 on October 5, 2026, the first version written in Rust. It keeps 2.42.1's options, targets and linking speed, replaces CMake with Cargo, needs Rust 1.95 to build, and panics on corrupted input instead of reading out of bounds.
  14. Polars 2.0: lazy queries run on the streaming engine, and row order is no longer a givenThe Polars team tagged Python Polars 2.0.0 on October 6, 2026. LazyFrame.collect() now defaults to the streaming engine with out-of-core spilling at 80% of RAM, read_csv dispatches to scan_csv, and mixed signed and UInt64 math returns Int128.
  15. Claude Sonnet 5.5: same price as Sonnet 5, and five request settings that now return a 400Anthropic released Claude Sonnet 5.5 on September 28, 2026 at $2 input and $10 output per million tokens, with 70.6% on Terminal-Bench 4.0. The model rejects forced tool choice and disabled thinking, so Sonnet 5 code needs changes before you swap the ID.
  16. A bad Firebase server payload crashed iOS apps at launch for six hours: issue 16728From 00:41 UTC on September 29, 2026, Google Analytics for Firebase on iOS crashed apps that fetched a malformed sdk-exp experiment payload. Google fixed the payload by 23:52 PDT on September 28 and released GoogleUtilities 8.1.4 to harden the SDK.
  17. Pi 1.0: the minimal coding agent goes stable, two days after it added MCPEarendil tagged Pi 1.0.0 on October 1, 2026. The terminal coding agent runs fullscreen by default, cuts codemode prompt tokens by about 40%, hardens MCP OAuth, and ships an experimental durable harness, pi-durable.
  18. SvelteKit 3: config moves into vite.config, $lib becomes #lib, and Svelte 4 support endsThe Svelte team shipped SvelteKit 3.0 on October 1, 2026. It drops svelte.config.js, replaces $lib with a Node subpath import, requires Node 22.17, TypeScript 6, Svelte 5.57.1 and Vite 8, and removes $app/stores and $service-worker.
  19. F-Droid 2.0: a Kotlin and Compose rewrite, automatic updates, and no more Android 6F-Droid announced 2.0 on September 24, 2026, its largest client update in ten years. The app moved to Kotlin and Jetpack Compose, installs through Android's session installer with pre-approval, updates apps by default, and dropped Android 6 and the Privileged Extension.
  20. GitHub Actions runners dropped Node 20: JavaScript actions run on Node 24 nowOn September 23, 2026 GitHub removed Node 20 from Actions runners and the ACTIONS_ALLOW_USE_UNSECURE_NODE_VERSION opt-out. JavaScript actions run on Node 24, and self-hosted runners on macOS 13.4 or older and ARM32 lost support.
  21. GitHub drops SHA-1 RSA signatures over SSH and adds a post-quantum key exchangeGitHub's September 22, 2026 changelog removes the ssh-rsa signature type and diffie-hellman-group-exchange-sha256, requires 3072-bit RSA keys from October 14, and turns on mlkem768x25519-sha256. Brownouts land on November 4 and December 9.
  22. A web page could run code through OpenCode's local server: GHSA-632h-h47v-g4x4Datadog Security Labs disclosed a remote code execution bug in OpenCode 1.14.30 to 1.18.21 on September 24, 2026. A text/plain form post to the local /global/upgrade endpoint made npm install an attacker's tarball. OpenCode 1.18.22 fixes it.
  23. Claude Opus 5.5 from a front-end desk: price, speed and the agent partsAnthropic's September model claims Fable-level work at 40% lower cost than Opus 5. Notes on long codebase migrations, prompt caching and agents that read untrusted pages.
  24. Node.js 26 goes LTS in October, with Temporal switched onNode.js 26 enables the Temporal API by default, adds Map.getOrInsert and Iterator.concat, and removes a batch of long-deprecated APIs. Test these before it becomes the LTS line next month.
  25. OpenAI's API this quarter: GPT-6 arrived, the Assistants API leftBetween July and September 2026 OpenAI shipped GPT-5.6, then GPT-6 Astra, Sol and Luna, retired the Assistants API and changed its error codes. Notes from the changelog for teams with OpenAI calls in production.
  26. TypeScript 7: the compiler moved to Go, and 6.0's warnings became errorsTypeScript 7.0 ships the native Go port with builds up to twelve times faster. It keeps the defaults 6.0 introduced, turns 6.0's deprecations into hard errors, and has no programmatic API yet, which matters if you use MDX, Vue, Svelte or Astro.
  27. Vite 8 runs on one bundler now: what the build numbers sayVite 8 replaced the esbuild-plus-Rollup pair with Rolldown, a single Rust bundler, and kept most plugins working. Build times from Linear, Ramp, Beehiiv and Mercedes-Benz.io, and a two-step migration path.
  28. Grok 4.6 and 4.7 on the API: two frontier models in two monthsxAI shipped Grok 4.6 in August and Grok 4.7 in September 2026, with the same 500k context window and the same price. The release notes for developers, with a cost check and a deprecation to schedule.
  29. React Native 0.85: a shared animation backend, layout props on the native driver and a new Jest presetReact Native 0.85 shipped on April 7, 2026 with an experimental animation backend that Animated and Reanimated share, native-driver support for width and height, Metro TLS, a separate @react-native/jest-preset package and the removal of StyleSheet.absoluteFillObject.
  30. Next.js adapters make the platform contract publicOn March 25, 2026, the Next.js team explained the stable Adapter API from 16.2: two build hooks, a public test suite that Vercel's own adapter must pass, verified adapters under the Next.js GitHub org, and a working group with OpenNext, Netlify, Cloudflare, AWS Amplify and Google Cloud.
  31. Building Next.js for agents starts with debugging for peopleOn February 12, 2026, Jiachi Liu described how the Next.js team built and shut down an in-browser agent called Vector, then moved the useful parts into the framework: an MCP endpoint in next dev, browser logs in the terminal and version-matched docs.
  32. Next.js 16.1: a disk cache for next dev, a bundle analyzer and next dev --inspectNext.js 16.1 shipped on December 18, 2025. Turbopack's file system cache for next dev is stable and on by default, cutting a large Vercel app's first route compile from 15 s to 1.1 s. It also adds an experimental bundle analyzer, next dev --inspect and transitive serverExternalPackages.
  33. React Native 0.83: React 19.2, a DevTools desktop app and no breaking changesReact Native 0.83 shipped on December 10, 2025 as the first release with no user-facing breaking changes. It brings React 19.2, network and performance panels in a new DevTools desktop app, stable Web Performance APIs and a flag that cut a test app's iOS build from 73 to 58 seconds.
  34. React Compiler 1.0: roll it out like a migrationReact Compiler 1.0 went stable on October 7, 2025, after Meta measured up to 12% faster loads and interactions over 2.5x faster on the Quest Store. Lint first, compile one directory, gate it behind a flag, and pin the version.
  35. React Native 0.81: Android 16 forces edge-to-edge, and iOS builds compile up to 10x fasterReact Native 0.81 shipped on August 12, 2025. It targets Android 16 by default, which removes the edge-to-edge opt-out and turns on predictive back, deprecates SafeAreaView, drops built-in JavaScriptCore and adds experimental precompiled iOS builds.