kumareshsomi

Dependabot now delays version update PRs until new releases have been available for at least three days by default. • Security update PRs open immediately without delay. github.blog/changelog/2026…

🎉 npm v12 is here! Install scripts are now off by default, git and remote-URL deps no longer resolve unless you allow them, and 2FA-bypass tokens are starting to be phased out. Details → socket.dev/blog/npm-12 #nodejs

Malicious packages steal credentials, exfiltrate data, open backdoors. And the Python CLI tools installed on your machine are as susceptible as anything. uv is starting to fix that.0 pydevtools.com/blog/uv-wants-…

The Copilot usage metrics API now includes review cycle counts and review latency for each AI adoption phase. • Metrics show median time to first review and median review cycles for merged PRs. github.blog/changelog/2026…

pnpm 11.10 adds a new _auth setting that ties each registry credential to its host, so a malicious or compromised repo file can't redirect your token to a different server. The release also hardens pnpm deploy, pack-app, and more. socket.dev/blog/pnpm-11-1…

NEW POST Birgitta Böckeler recently spent some time trying out running local LLMs for some programming tasks. In this memo she outlines the factors that influence how viable they are for the job. martinfowler.com/articles/explo…

It hasn't changed in over a decade, so I've just given my captive portal buster a new look! 😎 httpforever.com

"This paper catalogued five recurring MCP server architecture patterns (Resource Gateway, Tool Orchestrator, Stateful Session Server, Proxy Aggregator, and Domain-Specific Adapter) along with four anti-patterns and a set of crosscutting concerns ..." arxiv.org/abs/2606.30317

Stashing a payload in a `.git/` folder is enough to slip past every scanner an AI coding agent marketplace runs. New research on "SkillCloak" shows self-extracting packing evaded all 8 tested scanners 90-99% of the time on ClawHub's real-world malicious skills — the code only reconstructs itself once it's already running. That "verified" badge on a Claude Code, Codex, or Cursor skill listing isn't a safety signal. Treat skill installs like supply chain risk: sandbox and monitor at runtime, don't trust the scan. labs.cloudsecurityalliance.org/research/csa-r… #AgenticAI

I have noted down some common "Spring Boot Best Practices" I follow here: github.com/sivaprasadredd… Next week, I will update "progen" (Spring Boot Generator CLI) to follow these guidelines. github.com/sivaprasadredd…

We gave GPT-5.5-Cyber a single /goal: find a specific class of bugs in zlib, the compression library used by Linux, macOS, iOS, and Git. It built a fuzzing lab in less than a day, a task that takes a skilled researcher weeks. Patch the Planet field report by Benjamin Samuels: blog.trailofbits.com/2026/07/02/fie…

10 years ago, I started analysing the security of the Top 1 Million websites. Here’s the state of web cryptography after a decade of observation! scotthelme.co.uk/top-1-million-…

“We asked a bunch of LLMs how to synthesize cocaine, inserting fake reasoning that says it's fine because we're wearing a green shirt," A green shirt. Not a black one. A green one. theregister.com/ai-and-ml/2026…

Pull requests can now be blocked from merging if test coverage falls below set thresholds. • Set minimum coverage % or max drop from default branch • Start in evaluate mode before enforcing merge protection github.blog/changelog/2026…

Dependabot no longer infers.npmrc for npm private registries and now uses a scope property in dependabot.yml to generate the correct config. github.blog/changelog/2026…

Study of LLM API Credential Leakage in iOS Apps arxiv.org/pdf/2606.12212

npm adds a 72-hour read-only safeguard for high-impact accounts after sensitive changes to boost security against account takeovers. • Publishing, token management, and security-related changes pause during the safeguard period github.blog/changelog/2026…

Call for Papers for Open Source Summit + Embedded Linux Conference Europe 2026 is still open on Sessionize, 2 hours befoe close sessionize.com/open-source-su…

Benchmarking LLMs for malware triage and static unpacking with Malcat - Renaud Tabary malcat.fr/blog/benchmark…