14 articles tagged
Attackers force-pushed 75 of 76 trivy-action tags in March 2026 and stole secrets from every pipeline that ran a scan. Here is the credential isolation architecture that survives a poisoned action, with the exact GitHub
GitHub Enterprise Importer reached general availability for GitLab sources on 3 August 2026, with a gh gl2gh CLI extension. It moves repositories, issues and merge requests. It does not move your pipelines.
Valid provenance signed keyv 6.0.0 on 4 August 2026, and eight malicious releases were still tagged latest 101 minutes later. What attestations prove, and the cooldown config for npm, pnpm, Yarn and Bun.
Between 31 August 2026 and 17 August 2027, seven upstream deadlines land on the same engineering team. A release platform that absorbs them beats a quarterly scramble, and the difference is mostly plumbing.
GitHub resumes minimum version enforcement for self-hosted runners on 25 September 2026, with brownouts from 24 August. How to inventory a fleet, fix each runner type, and avoid the 30-day trap.
Next.js 16.3 brings Turbopack's persistent file-system cache to next build and adds an experimental Rust React Compiler. Here is how to wire both into CI, the real numbers from Vercel, and where they break.
OpenAI's Codex Security CLI is Apache-2.0 open source, but it calls a gated, metered engine. How to install it, wire it into CI with exit codes and SARIF, and where it fits next to Semgrep, CodeQL and Snyk.
Docker Compose 5.3.0 (2 July 2026) adds pre_start init containers that run migrations, fix permissions, and generate config before a service boots, gating startup on exit 0. Four copy-paste patterns inside.
TypeScript 7.0 is generally available and 8-12x faster, but typescript-eslint, ts-jest and Vue, Svelte and Astro template checks cannot run on it until 7.1. Here is a phased plan to get the speed now without breaking
In July 2026 attackers poisoned jscrambler and AsyncAPI npm packages; the AsyncAPI payload ran at import time, past install-script defenses. How to secure your software supply chain, with a checklist and comparison
TanStack's release pipeline authenticated 84 malicious npm versions in six minutes using a valid OIDC token. No token was stolen. Here is the chain, and the controls that close it as of July 2026.
LangChain's June 2026 survey of 1,340 practitioners found 89% run observability but only 52.4% run offline evals. Here is the four-gate CI setup that closes the gap.
GitHub reduced hosted runner prices by up to 39% on 1 January 2026, yet a macOS minute still costs $0.062 against $0.006 for Linux. Google found 84% of pass-to-fail transitions were flaky tests. Seven rules for a suite
npm 12 is generally available and tagged latest. Lifecycle scripts, git dependencies and remote tarballs are now opt-in, node-gyp builds are blocked, and the failure shows up in CI first. Here is the migration.
