#tools
40 posts
- Pinned
PCL2 Killed Its Minecraft Downloader. Here Is What It Means
On October 20, PCL and HMCL both shut down Minecraft downloads in mainland China. The confirmed timeline, the official wording, the rumor, and what it signals.
Bun 1.4.4 ships a formatter: 59 milliseconds on Prettier's own repo, 286x faster
bun fmt reads your existing Prettier config and plugins, running 59.7 ms against 17.1 s on Prettier's own repository, 48 MB against 459 MB. What matters is how it proves identical output: byte comparison plus a semantic re-parse check.
The one fix that matters in Deno 2.9.8: it stops trusting the compromised eMudhra root
This patch release has 13 fixes, half of them permission and sandbox edges, half Node-compatibility semantics. The eMudhra distrust lines up with what uv and CPython did the same week.
Electron 45 lands Chromium 156, Node 24.22 and V8 15.6 — and every breaking change sits on a sandbox boundary
Three breaking changes: sandboxed preload scripts lose events/timers/url and the Buffer globals, Workers created inside iframes no longer inherit Node integration, and extension pages stop receiving preload scripts unconditionally.
Home Assistant 2026.10.3: eighty percent integration fixes, the rest chasing infrastructure
Of roughly thirty changes, most are concrete integration bugs (Proxmox, UniFi Access, Sensibo, KNX, FRITZ!SmartHome and more); the rest are base-layer moves like Python 3.14.8, uv climbing to 0.13.5 and runners on Ubuntu 26.04.
llama.cpp build 11899: giving multimodal clients an interface to ask what a model supports
b11899 is a nightly build whose only substantive change adds mtmd_helper_get_capabilities, reporting audio_stream, speaker reference and text generation while keeping the old API. The build number itself tells you how this project ships.
Ollama 0.40.11 starts talking: local speech on macOS plus decision models that only answer yes, no or a score
Two unrelated additions: ollama run speaks on macOS while generating, exposing an OpenAI-compatible /v1/audio/speech; and the d3 family of decision models built for classification, judgments and probability scoring.
Ruff 0.17.2 adds a preview rule against repeated regex compilation, plus a batch of false-positive fixes
Mostly false positives: starred type variable constraints, backslash-escaped args in pydocstyle, star elements in pylint. It also marks comment-deleting fixes unsafe and lands two performance changes.
Traefik 3.7.16: ForwardAuth finally speaks NTLM and Kerberos, plus one CVE
Two things in this patch: a fix for GHSA-hrpp-p4fc-wwf8, and NTLM/Kerberos support in ForwardAuth and ingress-nginx auth-url. The latter fixes the long-standing "corporate SSO behind a gateway never authenticates" problem.
TypeScript 7.1 Beta: ambient modules can finally declare import attributes, and --target reaches es2026
The beta has six sections: import attributes in ambient modules, source phase imports, --target es2026, new library methods, the 7.1 API (snapshots, file system, content mappers) and a few behavioral changes.
uv 0.13.5 drops the compromised root and moves managed CPython onto three security patches
0.13.4 removed the eMudhra/emSign root from uv's own certificate store; 0.13.5 rebuilds managed CPython 3.11+ on python-build-standalone 20261021, with 3.15.1, 3.14.9, 3.13.17, pip 26.2.2 and certifi 2026.10.19. Run uv python upgrade afterwards.
Half of Vite 8.3.5's fixes live in bundled-dev: bundling during dev is still catching up
Eight of 21 fixes carry the bundled-dev prefix — HMR propagation, error stack mapping, server.origin, import.meta.env injection — plus two chunk import map correctness fixes and a CSS percent-sign build failure.
Python 3.15 lands: UTF-8 by default, frozendict built in, a slightly faster JIT
Python 3.15.0 shipped on October 9 with 5,643 commits from 1,012 contributors. What UTF-8 defaults, lazy imports, frozendict and the JIT change for you.
Zig 0.17: the grammar starts to freeze and the build system splits in two
Zig 0.17.0 shipped on October 2 after five months, 206 contributors and 925 commits: syntax breaks, stdlib renames and the build-system split.
Node.js 24 is LTS: Krypton runs to 2028, and here is what changes
Node.js 24 became LTS on October 28, 2025 under the codename Krypton, supported until April 2028. V8 13.6, npm 11, a stable permission model and require(esm) by default — plus the rough edges to know before upgrading.
Three ways classical cipher tools go quietly wrong
Caesar, Vigenere and Atbash all look like table lookups, but case handling, non-letter characters and key alignment each fail silently when done wrong.
Ninth Circuit: AI-generated code is not a "copy" under the DMCA
On 16 September 2026 the Ninth Circuit affirmed dismissal of the Section 1202 DMCA claims in Doe v. GitHub, holding that generative AI outputs are not copies under that section.
Node.js 26 is LTS: do not let a platform schedule your upgrade
Node.js 26 was confirmed as LTS on 6 October, with 26.11.0 and 26.11.1 following on 7 October — while Node.js 20 keeps disappearing from hosting platforms.
GhostAction: pushing a malicious workflow into tens of thousands of repos
Attackers hijacked maintainer accounts and injected GitHub Actions workflows disguised as security audits that scrape credentials out of the entire git history. By 9 October, 500+ accounts and tens of thousands of repos were involved.
Harness buys Augment Code: AI coding tools start to consolidate
Harness acquired Augment Code assets including Cosmos, a platform that coordinates multiple agents, plus the Auggie CLI and the Code Context Engine, folding AI coding into the delivery pipeline.
Jensen Huang dancing like Michael Jackson: when a hit video needs no truth
An 86-second AI edit of "Jensen Huang world tour" went viral at home and abroad, and Musk joined in. It is funny, and it makes "is this video real" an everyday question.
A poisoned npm release: what one postinstall can carry away
In October 2026, tensorlake 0.5.144 shipped a Shai-Hulud credential-stealing worm aimed at npm, GitHub, cloud and AI credentials. The bar for a supply-chain attack is now one compromised account.
SQLite 3.53: a WAL corruption fix, and a proper table for the CLI
SQLite 3.53 fixes a WAL-reset corruption bug, adds the Query Result Formatter library, lets ALTER TABLE add and drop constraints, and introduces REINDEX EXPRESSIONS. That last one is the tool for repairing stale expression indexes.
Morse code: one table, two ambiguities, three details
Morse itself is trivial; the trouble is in the details — who owns the space, how to normalise full-width dots, and how long one unit actually is.
The source shown on the page and the file served to curl must be one string
A scripts section has to display its source and also serve the identical file at /scripts/x.sh. Two copies drift. Why inlining with import.meta.glob and ?raw beats reading the filesystem at build time or copying into public.
Atomic file writes: write a temp file, then rename
Overwriting in place leaves half a file behind on power loss, a crash, or a concurrent read. A temp file plus rename uses filesystem atomicity to make half a file impossible.
Base64: it is neither encryption nor compression
Base64 turns 3 bytes into 4 printable characters, growing the payload by a third. It solves carrying binary through a text channel, not keeping anything secret.
Debounce vs throttle: the difference is who decides when to run
Both limit how often a function runs. Debounce lets the last call decide the moment; throttle uses a fixed window. The wrong pick shows up as a laggy drag or a request every 200ms.
Estimating work: why "about three days" becomes three weeks
You estimated writing code; what you owe is writing plus integration, review, rework, and waiting on others. Listing the unknowns beats multiplying every day count by two.
Feature flags are debt, not configuration
Every flag doubles the reachable code paths and no flag ever gets deleted by itself. Giving each one a removal date matters far more than building a clever flag system.
git bisect: turn which commit broke it into one command
The hard part of regression hunting is not the binary search, it is defining what counts as broken. Write a script that answers that, and bisect compresses n builds into log n.
Semantic versioning: a major bump promises no silent behavior change
MAJOR does not mean big. It means breaking. Using it for refactors and hiding breaks in minor releases turns your downstream automatic upgrades into outages.
What technical debt interest actually looks like
Debt is not ugly code; it is the extra cost every future change pays. The test is measurable: files touched per edit, test runtime, places that must change together.
Writing a cron parser: five fields, the union rule, and February 30th
The syntax takes half an hour. The semantics are the work: day-of-month and day-of-week unite rather than intersect, impossible dates need a stopping condition, and 7 and 0 are both Sunday.
CSV is not split on commas: quoting and newlines from RFC 4180
The moment a field is quoted, split stops working: quotes hold delimiters and newlines, and a quote inside a field is doubled. A thirty-line state machine beats any regex.
Base and unit conversion: temperature is the only non-linear one
Converting between bases 2 and 36 needs BigInt to avoid silent precision loss. Across ten unit categories nine are linear ratios, while temperature is affine, and a single multiplier is always wrong.
Color and contrast: relative luminance is not an average
Converting between notations is just the entry point. The real trap is WCAG contrast, which needs gamma decoding before weighting, and deciding between black and white text, which is not a brightness threshold.
Hash and checksum: why CRC32 and MD5 have to be written by hand
The browser only offers the SHA family, and only in a secure context. CRC32 and MD5 are not in Web Crypto. Along the way: large files should not be read into memory whole, and checksums should not be compared by eye.
Regex Lab: hits, groups, replacement preview, and the zero-width trap
A regex tester has to do three things well: show where matches land and what each group captured, preview the replacement, and never hang on a zero-width match.
JSON Studio: format, validate and diff in one page
Built from the habit of writing throwaway commands to clean up JSON. It formats, minifies, sorts, pinpoints parse errors by line and column, and diffs two documents — all in the browser.