Blog · page 3
Notes on engineering, design, and everything in between.
TypeScript 7.1 Beta: ambient modules can finally declare import attributes, and --target reaches es2026
The beta has six sections: import attributes in ambient modules, source phase imports, --target es2026, new library methods, the 7.1 API (snapshots, file system, content mappers) and a few behavioral changes.
uv 0.13.5 drops the compromised root and moves managed CPython onto three security patches
0.13.4 removed the eMudhra/emSign root from uv's own certificate store; 0.13.5 rebuilds managed CPython 3.11+ on python-build-standalone 20261021, with 3.15.1, 3.14.9, 3.13.17, pip 26.2.2 and certifi 2026.10.19. Run uv python upgrade afterwards.
Half of Vite 8.3.5's fixes live in bundled-dev: bundling during dev is still catching up
Eight of 21 fixes carry the bundled-dev prefix — HMR propagation, error stack mapping, server.origin, import.meta.env injection — plus two chunk import map correctness fixes and a CSS percent-sign build failure.
Vue 3.6's 13th release candidate: seven of eight fixes live in the Vapor compiler
Almost everything in 3.6.0-rc.13 points at compiler-vapor, plus one change that restores the 200ms default delay for async components. The first says Vapor is still catching up on semantics; the second says defaults are API.
BeyondTrust Remote Support auth bypass is exploited in the wild, CISA adds it to KEV
CVE-2026-102764 is an auth bypass in BeyondTrust Remote Support up to 26.2.3, added to CISA KEV on October 16. Blast radius, patch path and what to hunt.
Python 3.15 lands: UTF-8 by default, frozendict built in, a slightly faster JIT
Python 3.15.0 shipped on October 9 with 5,643 commits from 1,012 contributors. What UTF-8 defaults, lazy imports, frozendict and the JIT change for you.