#backend
44 posts
Bun 1.4.4 ships a formatter: 59 milliseconds on Prettier's own repo, 286x faster
bun fmt reads your existing Prettier config and plugins, running 59.7 ms against 17.1 s on Prettier's own repository, 48 MB against 459 MB. What matters is how it proves identical output: byte comparison plus a semantic re-parse check.
The one fix that matters in Deno 2.9.8: it stops trusting the compromised eMudhra root
This patch release has 13 fixes, half of them permission and sandbox edges, half Node-compatibility semantics. The eMudhra distrust lines up with what uv and CPython did the same week.
Electron 45 lands Chromium 156, Node 24.22 and V8 15.6 — and every breaking change sits on a sandbox boundary
Three breaking changes: sandboxed preload scripts lose events/timers/url and the Buffer globals, Workers created inside iframes no longer inherit Node integration, and extension pages stop receiving preload scripts unconditionally.
Home Assistant 2026.10.3: eighty percent integration fixes, the rest chasing infrastructure
Of roughly thirty changes, most are concrete integration bugs (Proxmox, UniFi Access, Sensibo, KNX, FRITZ!SmartHome and more); the rest are base-layer moves like Python 3.14.8, uv climbing to 0.13.5 and runners on Ubuntu 26.04.
llama.cpp build 11899: giving multimodal clients an interface to ask what a model supports
b11899 is a nightly build whose only substantive change adds mtmd_helper_get_capabilities, reporting audio_stream, speaker reference and text generation while keeping the old API. The build number itself tells you how this project ships.
Node ships three security releases in one day: 11 CVEs, five high, two in tls and one in dns
On October 21 Node released 26.12.1, 24.22.1 and 22.23.4 together, fixing 11 CVEs. The high-severity ones cluster in tls and dns input parsing, alongside two permission-model edge cases and a root store bump to NSS 3.131.1.
Ollama 0.40.11 starts talking: local speech on macOS plus decision models that only answer yes, no or a score
Two unrelated additions: ollama run speaks on macOS while generating, exposing an OpenAI-compatible /v1/audio/speech; and the d3 family of decision models built for classification, judgments and probability scoring.
Redis patches three lines at once: propagating a 4GB+ message over the cluster bus overflows the heap
8.10.3, 8.8.4 and 8.6.8 fix the same bug: in cluster mode, propagating a PUBLISH or SPUBLISH message larger than 4GB over the cluster bus overflows a heap buffer. Narrow impact, but the trigger conditions are worth remembering.
Ruff 0.17.2 adds a preview rule against repeated regex compilation, plus a batch of false-positive fixes
Mostly false positives: starred type variable constraints, backslash-escaped args in pydocstyle, star elements in pylint. It also marks comment-deleting fixes unsafe and lands two performance changes.
Traefik 3.7.16: ForwardAuth finally speaks NTLM and Kerberos, plus one CVE
Two things in this patch: a fix for GHSA-hrpp-p4fc-wwf8, and NTLM/Kerberos support in ForwardAuth and ingress-nginx auth-url. The latter fixes the long-standing "corporate SSO behind a gateway never authenticates" problem.
TypeScript 7.1 Beta: ambient modules can finally declare import attributes, and --target reaches es2026
The beta has six sections: import attributes in ambient modules, source phase imports, --target es2026, new library methods, the 7.1 API (snapshots, file system, content mappers) and a few behavioral changes.
uv 0.13.5 drops the compromised root and moves managed CPython onto three security patches
0.13.4 removed the eMudhra/emSign root from uv's own certificate store; 0.13.5 rebuilds managed CPython 3.11+ on python-build-standalone 20261021, with 3.15.1, 3.14.9, 3.13.17, pip 26.2.2 and certifi 2026.10.19. Run uv python upgrade afterwards.
Python 3.15 lands: UTF-8 by default, frozendict built in, a slightly faster JIT
Python 3.15.0 shipped on October 9 with 5,643 commits from 1,012 contributors. What UTF-8 defaults, lazy imports, frozendict and the JIT change for you.
Zig 0.17: the grammar starts to freeze and the build system splits in two
Zig 0.17.0 shipped on October 2 after five months, 206 contributors and 925 commits: syntax breaks, stdlib renames and the build-system split.
Node.js 24 is LTS: Krypton runs to 2028, and here is what changes
Node.js 24 became LTS on October 28, 2025 under the codename Krypton, supported until April 2028. V8 13.6, npm 11, a stable permission model and require(esm) by default — plus the rough edges to know before upgrading.
PHP's two 9.2 RCEs: the official root causes, and what the public PoC actually demonstrates
On October 21 PHP fixed CVE-2026-109618 and CVE-2026-109619 (CVSS 9.2); a public PoC with a full lab appeared the next day. Here are the longjmp and stale-global-state root causes, a reproducible lab, the PoC, and where the PoC diverges from the advisory.
PostgreSQL 18: async I/O, uuidv7, and an upgrade path that hurts less
PostgreSQL 18 shipped in September 2025 with a new asynchronous I/O subsystem (up to 3x on reads), uuidv7() in core, virtual generated columns and OAuth 2.0 authentication. Here is what actually matters.
TLS certificates are heading to 47 days: automation is no longer optional
CA/Browser Forum ballot SC-081 caps certificate lifetimes at 200 days from March 2026, 100 days from 2027, and 47 days from 2029. Manual renewal has a deadline now.
PHP ships two 9.2 fixes today at 14:00 UTC: what to do before then
PHP posted an advance notice on 20 October: a security release on 21 October at 14:00 UTC fixes two vulnerabilities, both rated CVSS v4.0 9.2. Details come with the release, but your rollback plan can be settled now.
Twelve PHP CVEs in three days, none of them in PHP
I pulled every PHP-related advisory NVD published between 19 and 21 October. All twelve are plugins, CMS modules and libraries. That is the more useful signal: your real inventory is not the language.
HTTP finally has a safe method with a body: QUERY
GET cannot carry a body and POST cannot be retried safely, so query endpoints have been stuck between two wrong options for twenty years. The IETF QUERY draft adds a third: safe, idempotent, and able to carry content.
Post-quantum TLS is already in your handshake, but it only solves half the problem
Browsers and CDNs now negotiate hybrid key exchange like X25519MLKEM768 by default, which closes the harvest-now-decrypt-later gap. The signature half is still open.
MCP 2026-07-28: delete the session, make the protocol stateless again
The new MCP revision removes the initialize handshake and the Mcp-Session-Id header, and turns cross-call state into explicit server-minted handles. What changed, why, and what it means for an existing server implementation.
Node.js 26 is LTS: do not let a platform schedule your upgrade
Node.js 26 was confirmed as LTS on 6 October, with 26.11.0 and 26.11.1 following on 7 October — while Node.js 20 keeps disappearing from hosting platforms.
Harness buys Augment Code: AI coding tools start to consolidate
Harness acquired Augment Code assets including Cosmos, a platform that coordinates multiple agents, plus the Auggie CLI and the Code Context Engine, folding AI coding into the delivery pipeline.
PostgreSQL 19: REPACK, WAIT, and a planner you can finally argue with
PostgreSQL 19 merges VACUUM FULL and CLUSTER into REPACK, adds a WAIT command for catching a standby up, and ships two extensions that pin planner decisions. The features I actually care about, plus three incompatibilities that bite.
SQLite 3.53: a WAL corruption fix, and a proper table for the CLI
SQLite 3.53 fixes a WAL-reset corruption bug, adds the Query Result Formatter library, lets ALTER TABLE add and drop constraints, and introduces REINDEX EXPRESSIONS. That last one is the tool for repairing stale expression indexes.
Wikipedia names rogue agents: after millions of requests
The Wikimedia Foundation publicly accused unauthorised OpenAI agents of millions of requests, questionable edits and tool tampering, possibly worsening a rare service disruption.
Compressed and still mutable: a dynamic compressed self-index
Highly repetitive string data (genomes, web archives, versioned documents) compresses beautifully, but any edit forces a full rebuild. A RIKEN AIP paper at ESA 2026 proposes dynamic RR-index, the first to combine compression, search, and updates in delta-optimal space.
Atomic file writes: write a temp file, then rename
Overwriting in place leaves half a file behind on power loss, a crash, or a concurrent read. A temp file plus rename uses filesystem atomicity to make half a file impossible.
Estimating work: why "about three days" becomes three weeks
You estimated writing code; what you owe is writing plus integration, review, rework, and waiting on others. Listing the unknowns beats multiplying every day count by two.
Feature flags are debt, not configuration
Every flag doubles the reachable code paths and no flag ever gets deleted by itself. Giving each one a removal date matters far more than building a clever flag system.
Graceful shutdown: the exit sequence decides between 502s and clean responses
Exiting immediately on a termination signal cuts in-flight requests. The order is stop accepting, drain what is running, release resources, then exit.
Idempotency keys: the one write that makes retries safe
A network timeout does not mean the server did nothing. An idempotency key identifies the same request so the server replays the first result instead of executing again.
JSON canonicalization: why the same object hashes two ways
Key order, number formatting and escape style all change the bytes. A stable hash has to pin those rules at serialization, not hope JSON.stringify is deterministic.
Deadlock: break any one of four conditions
Mutual exclusion, hold and wait, no preemption, circular wait. All four must hold at once. The practical one to break is circular wait: give every lock a global order.
The N+1 query: the most typical ORM performance trap
Fetch 100 rows and query the relation for each one and you have made 101 queries. There are only three fixes: eager load, batch fetch, or use a single join.
Rate limiting: what token bucket and leaky bucket really differ on
A token bucket permits bursts; a leaky bucket flattens traffic to a constant rate. Picking wrong shows up as throttled normal users, or a limit that does nothing.
SQLite indexes: the leftmost prefix is a consequence of sorting
A composite index (a, b) can only order by b within equal a, so skipping a and filtering on b has nothing to use. See it as sorting and the mnemonic stops being a rule to memorize.
Time zones and DST: store UTC, or daylight saving will bite
A DST day has 23 or 25 hours, and local times near the switch may not exist or may happen twice. Storing UTC timestamps and converting at display is the only model that holds.
Unicode normalization: why two identical-looking strings differ
An e-acute can be one code point or a base letter plus a combining mark. Normalize to NFC before comparing, storing or indexing, or duplicates quietly slip through.
In Rust, context belongs on the line that actually fails
The question mark operator rethrows an error without saying which step failed. Structured errors in the core, Context in the application layer, with the input attached, is what makes a log line locatable.
When a crate should become a workspace
The trigger for splitting a workspace is build time and dependency boundaries, not tidy directories. Split when three signals hold, or you trade one compile for managing several packages.
Structured logging is not println replaced by tracing::info
Log lines built by concatenation can only be read by humans. Fields make them queryable. Fields, spans, levels and knowing when not to format are the four real decisions.