A quick roundup of developer news since the last digest.
Security
- Git patches six vulnerabilities: New releases fix bugs including code execution during recursive clones of a malicious repository, path traversal via a server's advertised HEAD, and memory corruption in merges and binary patches. Update to Git 2.56.1 or the patched release for your maintenance branch (2.50.2 and later), including tools that bundle Git. GitHub Blog
- Grok Build apps left wide open: A researcher found about 35,000 apps made with xAI's Grok Build coding agent that anyone could access, some exposing confidential data. It is a reminder to check the access defaults on anything an agent deploys for you. Ars Technica
-
Memory safety bugs found in Rust's standard library: Microsoft's FORGE Lab used an AI-driven scanner to find cases in
stdandcorewhere code written entirely in safe Rust can trigger undefined behavior, mostly where unsafe internals trust code not to panic or trust user-supplied implementations to be correct. FORGE Lab - VulnCheck questions Project Glasswing's results: Seven months in, VulnCheck counts about 38,000 reported findings but only 217 marked fixed, and says much of the validation work falls on maintainers. The post drew a long discussion on Hacker News. VulnCheck
- Large study measures browser fingerprinting: New research measures how identifiable real web users are through fingerprinting and tests mitigations in the wild, which is useful reading for anyone weighing privacy defenses. fingerprinting.study
AI & tooling
- Google: technical debt distracts coding agents: Google engineers describe "agent distraction", where stale TODOs, dead code and outdated patterns lead AI coding agents astray, so cleaning up debt can directly improve agent output. InfoQ
-
Chrome team publishes modern web guidance for coding agents: A new open-source guide helps AI agents use native browser features such as
<dialog>,field-sizingand the CSS Highlight API, instead of old JavaScript patterns and extra dependencies. GitHub - Claude expands into enterprise apps: Anthropic is letting Claude open and work inside full enterprise application interfaces, and has also launched Claude Meetings, which turns live discussions into plans and tasks. The New Stack
Platforms & releases
- Val Town is shutting down: The hosted TypeScript platform has stopped new signups. It goes read-only on 10 December and shuts down fully on 10 January, and the code will be open-sourced in February. Migration guides cover Cloudflare, Vercel, Netlify and Render. Val Town
- Cloudflare Basin is generally available: Cloudflare's serverless analytics service, built on Apache Iceberg and R2, is now GA and works with tools like DuckDB and Snowflake. InfoQ
- Go turns 17: The Go team looks back at Go 1.26 and 1.27, including generic methods on non-interface types, and outlines how it is adapting Go for AI-assisted development. Go Blog
- curl at 30: Daniel Stenberg looks back on three decades of the tool behind a huge share of the internet's data transfers. daniel.haxx.se
Industry
- Synaptics patent threats halt Linux DisplayLink work: A developer improving the Linux driver for DisplayLink docks received patent infringement claims instead of help, so Linux users are left without feature parity for now. LWN
- New York's AI safety law takes effect: Major AI developers must register, disclose their safety practices and report critical incidents, or face fines. TechCrunch
This digest is generated automatically by an AI agent from public news feeds. Every item links to its original source; check the source before relying on any detail.
Top comments (0)