When security teams scan their container environments for the first time, they often discover hundreds of known vulnerabilities, and almost none of them trace back to application code. The overwhelming majority come from packages that shipped with the base image: shells, compilers, debug utilities, and libraries the application never calls. In a software supply chain...
<p>The Dev channel has been updated to 151.0.7872.0 for Windows, Mac and Linux.</p><p>A partial list of changes is available in the <a href="https://chromium.googlesource.com/chromium/src/+log/150.0.7865.2..151.0.7872.0?pretty=fuller&n=10000">Git log</a>. Interested in <a href="https://www.chromium.org/getting-involved/dev-channel/">switching</a> release channels? Find out <a href="https://www.chromium.org/getting-involved/dev-channel/">how</a>. If you find a new issue, please let us know by <a href="https://crbug.com/">filing a bug</a>. The <a href="https://productforums.google.com/forum/#!forum/chrome">community help forum</a> is also a great place to reach out for help or learn about common issues.</p><p>Chrome Release Team<br /><a href="https://www.google.com/chrome"></a><a href="https://www.google.com/chrome">Google Chrome</a></p>
<p> Simple file sharing on your iPad or iPhone </p> <p> <a href="https://www.producthunt.com/products/smmall-cloud?utm_campaign=producthunt-atom-posts-feed&utm_medium=rss-feed&utm_source=producthunt-atom-posts-feed">Discussion</a> | <a href="https://www.producthunt.com/r/p/1163550?app_id=339">Link</a> </p>
<p>Hi everyone! We've just released Chrome Dev 151 (151.0.7872.3) for Android. It's now available on <a href="https://play.google.com/store/apps/details?id=com.chrome.dev">Google Play</a>.</p><p>You can see a partial list of the changes in the <a href="https://chromium.googlesource.com/chromium/src/+log/150.0.7863.2..151.0.7872.3?pretty=fuller&n=10000">Git log</a>. For details on new features, check out the <a href="https://blog.chromium.org">Chromium blog</a>, and for details on web platform updates, check <a href="https://www.chromestatus.com/features#milestone%3D151">here</a>.</p><p>If you find a new issue, please let us know by <a href="https://code.google.com/p/chromium/issues/entry?template=Android%20Issue">filing a bug</a>.</p><p>Chrome Release Team<br /><a href="https://www.google.com/chrome"></a><a href="https://www.google.com/chrome">Google Chrome</a></p>
<p> Build and manage Shopify stores from one chat </p> <p> <a href="https://www.producthunt.com/products/manus-shopify-connector?utm_campaign=producthunt-atom-posts-feed&utm_medium=rss-feed&utm_source=producthunt-atom-posts-feed">Discussion</a> | <a href="https://www.producthunt.com/r/p/1163513?app_id=339">Link</a> </p>
Score your deck, meet investors who fit, and raise more Discussion | Link
TechCrunch Startups published: Is Silicon Valley ready to put robots in people’s homes? Hello Robot is.
Subscription tracker built by someone who forgot 11 of them Discussion | Link
JetBrains Blog published: IntelliJ IDEA 2026.1.3 Is Out!
VoidZero, the team behind Vite, Vitest, Rolldown, Oxc, and Vite+, is joining Cloudflare. Vite stays open source, vendor-agnostic, and built for everyone.
Hugging Face Blog published: EVA-Bench Data 2.0: 3 Domains, 121 Tools, 213 Scenarios
Learn how Endava is using AI agents, ChatGPT Enterprise, and Codex to accelerate software delivery, automate workflows, and build an AI-native culture across the enterprise.
Your Claude AI Video Editor for Premiere Pro Discussion | Link
Part one The last twelve months have been rough on the open source supply chain. Axios was compromised on npm and shipped a remote access trojan inside otherwise normal-looking releases. LiteLLM’s PyPI package was hijacked to...
Most days in her chambers, Judge Maritza Braswell, a federal magistrate judge in Colorado, sifts through stacks of documents written by people without a lawyer. Many of them can’t afford to hire a lawyer, and others have cases too weak or too small to interest one. She reads each one carefully, mindful of how daunting…
An interview with Microsoft CEO Satya Nadella about figuring out Microsoft's role in AI, the relationship with OpenAI, Capex, Software, and a potential new agentic platform.
Automated support that learns from docs + past conversations Discussion | Link
ChatGPT introduces a new memory system to better remember preferences, keeping context fresh and relevant across conversations.
<p> Generate and edit images with precise scene control </p> <p> <a href="https://www.producthunt.com/products/mai-image-2-5?utm_campaign=producthunt-atom-posts-feed&utm_medium=rss-feed&utm_source=producthunt-atom-posts-feed">Discussion</a> | <a href="https://www.producthunt.com/r/p/1162954?app_id=339">Link</a> </p>
TechCrunch Startups published: Quick-commerce FirstClub doubles valuation to $255M in 9 months
<h3>Misc Changes</h3> <ul> <li>docs: add GitHub SSH authentication guidance: <a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="4573982486" data-permission-text="Title is private" data-url="https://github.com/vercel/next.js/issues/94360" data-hovercard-type="pull_request" data-hovercard-url="/vercel/next.js/pull/94360/hovercard" href="https://github.com/vercel/next.js/pull/94360">#94360</a></li> <li>Deprecate undocumented custom server methods: <a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="4572099142" data-permission-text="Title is private" data-url="https://github.com/vercel/next.js/issues/94348" data-hovercard-type="pull_request" data-hovercard-url="/vercel/next.js/pull/94348/hovercard" href="https://github.com/vercel/next.js/pull/94348">#94348</a></li> <li>Trace cacheHandler and cacheHandlers when using adapters: <a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="4540608221" data-permission-text="Title is private" data-url="https://github.com/vercel/next.js/issues/94197" data-hovercard-type="pull_request" data-hovercard-url="/vercel/next.js/pull/94197/hovercard" href="https://github.com/vercel/next.js/pull/94197">#94197</a></li> <li>refactor: make stage advancing logic more generic: <a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="4572151453" data-permission-text="Title is private" data-url="https://github.com/vercel/next.js/issues/94349" data-hovercard-type="pull_request" data-hovercard-url="/vercel/next.js/pull/94349/hovercard" href="https://github.com/vercel/next.js/pull/94349">#94349</a></li> <li>docs: document Cache Components behavior for navigation hooks: <a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="4578898583" data-permission-text="Title is private" data-url="https://github.com/vercel/next.js/issues/94387" data-hovercard-type="pull_request" data-hovercard-url="/vercel/next.js/pull/94387/hovercard" href="https://github.com/vercel/next.js/pull/94387">#94387</a></li> <li>fix: build hangs if sync IO aborts before root chunk is flushed: <a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="4575395816" data-permission-text="Title is private" data-url="https://github.com/vercel/next.js/issues/94365" data-hovercard-type="pull_request" data-hovercard-url="/vercel/next.js/pull/94365/hovercard" href="https://github.com/vercel/next.js/pull/94365">#94365</a></li> <li>refactor: make early/late checks stricter: <a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="4573461186" data-permission-text="Title is private" data-url="https://github.com/vercel/next.js/issues/94358" data-hovercard-type="pull_request" data-hovercard-url="/vercel/next.js/pull/94358/hovercard" href="https://github.com/vercel/next.js/pull/94358">#94358</a></li> <li>refactor: remove delayUntilRuntimeStage: <a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="4572631509" data-permission-text="Title is private" data-url="https://github.com/vercel/next.js/issues/94350" data-hovercard-type="pull_request" data-hovercard-url="/vercel/next.js/pull/94350/hovercard" href="https://github.com/vercel/next.js/pull/94350">#94350</a></li> <li>DiskFileSystem: store Effect full_path as Arc: <a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="4569915490" data-permission-text="Title is private" data-url="https://github.com/vercel/next.js/issues/94332" data-hovercard-type="pull_request" data-hovercard-url="/vercel/next.js/pull/94332/hovercard" href="https://github.com/vercel/next.js/pull/94332">#94332</a></li> <li>refactor: indicate which stage is the last stage in staged prerenders: <a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="4580718167" data-permission-text="Title is private" data-url="https://github.com/vercel/next.js/issues/94430" data-hovercard-type="pull_request" data-hovercard-url="/vercel/next.js/pull/94430/hovercard" href="https://github.com/vercel/next.js/pull/94430">#94430</a></li> <li>[CC] add shell stages: <a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="4582302697" data-permission-text="Title is private" data-url="https://github.com/vercel/next.js/issues/94438" data-hovercard-type="pull_request" data-hovercard-url="/vercel/next.js/pull/94438/hovercard" href="https://github.com/vercel/next.js/pull/94438">#94438</a></li> <li>instant: prompts on all fix cards, [group]-tagged CLI bullets, new docs slugs: <a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="4494261488" data-permission-text="Title is private" data-url="https://github.com/vercel/next.js/issues/94017" data-hovercard-type="pull_request" data-hovercard-url="/vercel/next.js/pull/94017/hovercard" href="https://github.com/vercel/next.js/pull/94017">#94017</a></li> <li>[turbopack] Add <code>BumpVec</code> (vector implementation that takes a <code>Bump</code>): <a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="4562324178" data-permission-text="Title is private" data-url="https://github.com/vercel/next.js/issues/94296" data-hovercard-type="pull_request" data-hovercard-url="/vercel/next.js/pull/94296/hovercard" href="https://github.com/vercel/next.js/pull/94296">#94296</a></li> <li>Ensure aborting has the same inputs as render: <a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="4581857672" data-permission-text="Title is private" data-url="https://github.com/vercel/next.js/issues/94436" data-hovercard-type="pull_request" data-hovercard-url="/vercel/next.js/pull/94436/hovercard" href="https://github.com/vercel/next.js/pull/94436">#94436</a></li> <li>[App Shells] App shells in runtime prefetches: <a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="4432024514" data-permission-text="Title is private" data-url="https://github.com/vercel/next.js/issues/93801" data-hovercard-type="pull_request" data-hovercard-url="/vercel/next.js/pull/93801/hovercard" href="https://github.com/vercel/next.js/pull/93801">#93801</a></li> <li>[turbopack] Optimize TaskInput implementations: <a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="4541906113" data-permission-text="Title is private" data-url="https://github.com/vercel/next.js/issues/94202" data-hovercard-type="pull_request" data-hovercard-url="/vercel/next.js/pull/94202/hovercard" href="https://github.com/vercel/next.js/pull/94202">#94202</a></li> </ul> <h3>Credits</h3> <p>Huge thanks to <a class="user-mention notranslate" data-hovercard-type="user" data-hovercard-url="/users/timneutkens/hovercard" data-octo-click="hovercard-link-click" data-octo-dimensions="link_type:self" href="https://github.com/timneutkens">@timneutkens</a>, <a class="user-mention notranslate" data-hovercard-type="user" data-hovercard-url="/users/lubieowoce/hovercard" data-octo-click="hovercard-link-click" data-octo-dimensions="link_type:self" href="https://github.com/lubieowoce">@lubieowoce</a>, <a class="user-mention notranslate" data-hovercard-type="user" data-hovercard-url="/users/aurorascharff/hovercard" data-octo-click="hovercard-link-click" data-octo-dimensions="link_type:self" href="https://github.com/aurorascharff">@aurorascharff</a>, <a class="user-mention notranslate" data-hovercard-type="user" data-hovercard-url="/users/sokra/hovercard" data-octo-click="hovercard-link-click" data-octo-dimensions="link_type:self" href="https://github.com/sokra">@sokra</a>, <a class="user-mention notranslate" data-hovercard-type="user" data-hovercard-url="/users/sampoder/hovercard" data-octo-click="hovercard-link-click" data-octo-dimensions="link_type:self" href="https://github.com/sampoder">@sampoder</a>, <a class="user-mention notranslate" data-hovercard-type="user" data-hovercard-url="/users/eps1lon/hovercard" data-octo-click="hovercard-link-click" data-octo-dimensions="link_type:self" href="https://github.com/eps1lon">@eps1lon</a>, and <a class="user-mention notranslate" data-hovercard-type="user" data-hovercard-url="/users/lukesandberg/hovercard" data-octo-click="hovercard-link-click" data-octo-dimensions="link_type:self" href="https://github.com/lukesandberg">@lukesandberg</a> for helping!</p>
A new npm worm is abusing binding.gyp to trigger node-gyp during install, letting malicious packages run code without lifecycle scripts. It steals credentials, persists in GitHub, and self-propagates across maintainers.
Secure-by-design types can turn common bugs into compile-time errors. This post explores how type-level security could help prevent entire classes of AI-generated vulnerabilities.
An AI security budget should fund more than visibility. The real priority is unified governance and enforcement across agentic development and production apps.