Telexed

AI news through a solo-operator lens — only what changes your day30 of 412

FILTER[All][Agents & tools][Models & API][Generative media][Infra & SaaS][ASO & growth][Indie business][Idea signals][Other][★6+ high-signal]

clear filters

Mon, May 186 dispatches

#0412
#0412Other r/MachineLearningyesterday
Hugging Face revives `PapersWithCode` with AI-parsed leaderboards
50radar
PapersWithCodeAI paper tracker — links code and benchmarks
The rebuilt site tracks trending papers, methods, citations, repos, artifacts, and benchmark results. Useful for model scouting, but still manually verified and early-stage.
- Default ranking uses GitHub star velocity, so it surfaces research projects gaining developer attention, not just citation-heavy papers.
- Coverage starts with high-impact items like Qwen 3.5, RF-DETR, DINOv3, MTEB, Open ASR Leaderboard, and coding-agent benchmarks.
- Paper pages auto-link GitHub repos, project URLs, artifacts, PDFs, and external non-Arxiv papers; multiple repos per paper are supported.
- Leaderboards exist by benchmark and domain, including MMTEB, COCO val 2017, and Terminal Bench; handy for fast model/vendor filtering.
- Result extraction uses AI agents, but verification is still manual. Treat it as a shortlist generator, not a source of record yet.
Source: www.reddit.com/r/MachineLearning/comments/1tgmwqr/reviviRead original →
50radar
PHOTO
FIG-4121:1
#0411
#0411Other GeekNewsyesterday
`rkdebian` turns an $80 RK3562 Android tablet into a Debian workstation
40radar
rkdebianDebian image build system — built for Doogee U10
A cheap locked-down device can become a bootable Debian 12 machine. Useful for low-cost Linux experiments, but the device scope is narrow and prerelease status keeps it niche.
- Targets the Rockchip RK3562-based Doogee U10; reuse value depends almost entirely on owning that exact hardware.
- Builds bootable Debian 12 Bookworm images, so the value is hardware repurposing more than a general dev-tool upgrade.
- Public prerelease build is dated May 14, 2026; treat it as an experiment box, not a dependable main workstation.
Source: news.hada.io/topic?id=29622Read original →
FIG-4111:1
40radar
FIG-4111:1
#0410
#0410Other GeekNews2 days ago
Stay Native Until Text Forces Your Hand
40radar
SwiftUI can handle Markdown chat UI until document-wide selection enters scope. Jumping to NSTextView brings TextKit 2 complexity and streaming CPU spikes, so delay it.
- SwiftUI gives acceptable baseline performance for Markdown chat, but full-document text selection is hard to support cleanly.
- Moving to NSTextView and TextKit 2 trades native UI simplicity for lower-level text control and more performance work.
- Streaming input can trigger CPU spikes in the text stack. Chat apps should benchmark incremental rendering before committing.
Source: news.hada.io/topic?id=29602Read original →
FIG-4101:1
40radar
FIG-4101:1
#0409
#0409Other r/ClaudeAI2 days ago
5 repeatable `Claude` prompting patterns for cleaner outputs
50radar
Prompt quality improves most when context becomes explicit: plan first, provide examples, ban bad phrases, and constrain answers to sources. Good enough to turn into reusable product and support workflows.
- Ask Claude to list success criteria before writing. The same request gets better structure when the model plans first.
- Examples beat tone adjectives. Two or three real paragraphs give the model a stronger voice target than words like “friendly.”
- Negative constraints matter: banning phrases like “unlock” or “revolutionize” cuts generic SaaS copy fast.
- Persistent context via Projects, AGENTS.md, or CLAUDE.md saves repeated setup and raises baseline output quality.
- Source-bound prompts reduce hallucinated citations. Paste the material and ask for answers only from that source.
Source: www.reddit.com/r/ClaudeAI/comments/1tg52af/5_claude_pattRead original →
50radar
PHOTO
FIG-4091:1
#0408
#0408Other GeekNews2 days ago
`Erlang/OTP` `29.0` Tightens SSH Daemon Defaults
40radar
Erlang/OTPRuntime platform — standard libraries and tools for Erlang apps
Authenticated SSH users no longer get shell, exec, or SFTP by default. Small but useful hardening if your backend exposes Erlang/OTP SSH services.
- shell and exec are disabled by default, blocking arbitrary Erlang code execution unless explicitly enabled.
- The SFTP subsystem is no longer auto-enabled at SSH daemon startup, reducing exposed surface area.
- This matters only for apps using the built-in Erlang/OTP SSH daemon. Most web SaaS stacks can just note the safer default.
Source: news.hada.io/topic?id=29601Read original →
FIG-4081:1
40radar
FIG-4081:1
#0407
#0407Other yozm_ityesterday
Better AI Planning Starts With Different Questions
40radar
Fast answers can create slower work when the first prompt carries bad assumptions. Use AI to test change, market frames, and premises before asking for tidy summaries.
- The bottleneck is not answer speed; it is the time spent fixing, doubting, and re-asking weak outputs.
- Summary-style prompts can crowd out change-oriented prompts. That mistake is especially costly in new service definition.
- For unfamiliar markets or competitor reframing, the first question sets the direction of every later artifact.
Source: yozm.wishket.com/magazine/detail/3737Read original →
FIG-4071:1
40radar
FIG-4071:1

Sun, May 172 dispatches

#0406
#0406Other GeekNews2 days ago
Choose `HTML` Lists by Semantics, Not Appearance
40radar
List elements are interaction contracts, not styling shortcuts. Picking select, datalist, ordered, descriptive, or menu markup correctly cuts accessibility debt early.
- Fixed choices belong in select/option; suggested free input belongs in datalist. Similar UI, different interaction model.
- Ordered, unordered, description, menu, and control lists express different user intent. CSS should change visuals, not semantics.
- Small markup decisions affect keyboard behavior, screen readers, and form UX. Cheap to fix during build, annoying after launch.
Source: news.hada.io/topic?id=29588Read original →
FIG-4061:1
40radar
FIG-4061:1
#0405
#0405Other r/LocalLLaMA2 days ago
`llama.cpp` fork enables quantized KV cache with tensor split
50radar
llama.cppLocal LLM inference engine — supports GGUF and CUDA backends
Tensor parallelism becomes usable with quantized KV cache on dual GPUs. Still a fork with MoE caveats, so it is a test-only local inference tweak.
- Benchmarked Qwen3.5 27B Q4_K_M at 30.05 tok/s with -sm tensor vs 21.22 tok/s without it for generation.
- The command uses -ctk q8_0 -ctv q8_0, removing the old tensor-split tradeoff of falling back to non-quantized KV cache.
- Author reports real use rising from about 25 tok/s to 40 tok/s on 3060 12GB + 4070 Super 12GB.
- MoE models currently break with -sm tensor; dense models like Qwen 27B/9B are the safer test target.
Source: www.reddit.com/r/LocalLLaMA/comments/1tflngz/dual_gpu_llRead original →
50radar
PHOTO
FIG-4051:1

Sat, May 161 dispatches

#0404
#0404Other GeekNews4 days ago
Leaving `Tailwind`, Rebuilding a Structured CSS System
40radar
The practical move is not ditching utility discipline but re-encoding only the parts that aged well. Keep preflight, palette, and type scale, then move them into CSS variables and split files for a saner long-term base.
- The migration keeps Tailwind's useful defaults like preflight reset, color tokens, and font scale instead of starting raw; that cuts regressions while dropping class-heavy markup.
- Semantic HTML plus vanilla CSS shifts structure back into markup and design rules back into stylesheets; easier to scan, but only if naming and file boundaries stay strict.
- Rebuilding the system with CSS variables turns ad-hoc utilities into shared tokens; better fit for theming and incremental edits than copy-pasting utility clusters.
Source: news.hada.io/topic?id=29553Read original →
FIG-4041:1
40radar
FIG-4041:1

Fri, May 154 dispatches

#0403
#0403Other GitHub Changelog4 days ago
`GitHub Projects` adds built-in timestamp fields
50radar
Project views can now sort and filter by Created, Updated, and Closed without manual columns. Small change, but it removes admin work and makes backlog aging and closure tracking much easier.
- Three built-in fields are now available: Created, Updated, Closed. No custom date-property setup needed.
- These fields can be added to any project view, so stale items and recently touched work become easier to spot.
- Closed is useful for measuring cycle endings and reviewing what actually shipped in a given window.
Source: github.blog/changelog/2026-05-15-timestamp-fields-in-gitRead original →
FIG-4031:1
50radar
FIG-4031:1
#0402
#0402Other Simon Willison5 days ago
`datasette-llm-limits` `0.1a0` adds per-user LLM spend caps
40radar
DatasetteOpen-source data publishing tool — strong plugin extensibility
LLM usage inside Datasette can now be hard-capped by user or globally with rolling windows and USD limits. Useful if you expose prompts to users; otherwise the impact is narrow but the cost-control pattern is worth copying.
- Works with datasette-llm and datasette-llm-accountant, so enforcement sits on top of existing usage tracking.
- Config supports per-user or global limits, with windows like rolling-24h and explicit amount_usd caps.
- Example policy sets $1.00 per actor over 24 hours, which is a clean template for metered AI features.
- Best fit is multi-user internal tools or lightweight SaaS surfaces where prompt access needs a hard budget guardrail.
Source: simonwillison.net/2026/May/15/datasette-llm-limits/#atomRead original →
40radar
PHOTO
FIG-4021:1
#0401
#0401Other r/LocalLLaMA5 days ago
Self-Training With Verifiable Rewards Pushes `Qwen 2.5` 7B to **112/164** on HumanEval
50radar
A self-generated code-and-tests loop produced a large jump without human-written training pairs. Cheap enough to replicate, but still a one-off experiment rather than a product-ready recipe.
- The loop is simple: generate problems, sample multiple solutions, keep (failed attempt, fixed attempt) pairs, and let a Python interpreter score them.
- After fixing a grading bug, Qwen 2.5 7B moved from 25 to 112/164 on HumanEval; that is a big enough jump to treat as a real benchmark signal.
- A Qwen 2.5 14B run used 100 mined pairs, took 95 minutes on an H100, and cost $3.50; the barrier here is much lower than typical RL folklore.
- Control training on fake pairs gave 25/164, identical to base, which suggests the lift came from correction data rather than format imitation.
Source: www.reddit.com/r/LocalLLaMA/comments/1tde3m1/i_let_a_smaRead original →
50radar
PHOTO
FIG-4011:1
#0400
#0400Other GeekNews5 days ago
`scrcpy` `4.0` adds flexible virtual display resizing
50radar
scrcpyAndroid mirroring tool — low-latency control over USB or Wi-Fi
Virtual displays can now resize to match the client window with --flex-display. The SDL3 migration should reduce resize-related friction, so it's a solid quality-of-life update for Android testing setups.
- --flex-display or -x lets the virtual display track the client window size dynamically, which cuts friction when testing multiple Android layouts.
- The move from SDL2 to SDL3 shifts the app onto an actively maintained graphics layer, improving upstream support and bug-fix velocity.
- Window resizing gets safer operationally because display and client size stay aligned instead of drifting during interactive mirroring.
- This is not a workflow reset, but teams using scrcpy daily for QA, demos, or device debugging will feel the upgrade immediately.
Source: news.hada.io/topic?id=29505Read original →
FIG-4001:1
50radar
FIG-4001:1

Thu, May 142 dispatches

#0399
#0399Other GeekNews6 days ago
`Quack`: Client-Server Protocol for `DuckDB`
50radar
QuackProtocol — adds multi-process shared writes to DuckDB
It adds remote state sync so multiple processes can write to the same DuckDB file without abandoning the in-process model. That opens a practical middle ground between embedded analytics and a full database server, worth tracking early.
- Remote protocol handles state synchronization needed when multiple processes modify one database file, not a separate heavyweight server core.
- The design keeps DuckDB's in-process architecture while enabling client-server style access and concurrent writers in the same database.
- This lowers the jump from local analytics to multi-process apps; teams using DuckDB may get shared-write workflows without moving to Postgres immediately.
Source: news.hada.io/topic?id=29477Read original →
FIG-3991:1
50radar
FIG-3991:1
#0398
#0398Other GitHub Trending Weekly6 days ago
`easy-vibe`: beginner course for shipping AI apps with SaaS and payments
50radar
easy-vibeCourse — from AI app building to SaaS and payments
Starts from plain-language prompting, then walks into full-stack shipping with Stripe, SaaS UI, and RAG visuals. Useful as a fast onboarding map; advanced builders will mostly mine it for teaching flow and idea-validation sections.
- The curriculum goes beyond prompting into a SaaS capstone, payment integration, multi-product UI, and WeChat Mini Program backend flows.
- Visual tutorials, simulated IDE guidance, and clickable RAG/terminal demos lower early friction better than text-only docs.
- A new appendix adds idea sourcing, JTBD, Double Diamond, and The Mom Test, so it covers validation as well as building.
- Best fit is onboarding non-engineers or juniors into AI product building; experienced builders will not get much technical depth.
Source: github.com/datawhalechina/easy-vibeRead original →
FIG-3981:1
50radar
FIG-3981:1

Wed, May 135 dispatches

#0397
#0397Other refactoring_fm6 days ago
Pure AI vs Deterministic Software in Workflow Orchestration
40radar
Useful framing for deciding where LLM calls belong in a workflow. Keep judgment-heavy steps probabilistic, but make routing, validation, and state deterministic.
- Pure AI flows trade control for flexibility. Good for fuzzy judgment, weak for repeatable production behavior.
- Deterministic software handles routing, retries, validation, and persistence better. That is where reliability compounds.
- A practical LLM workflow should separate model judgment from execution rules. This reduces cost, drift, and debugging pain.
Source: refactoring.fm/p/how-to-orchestrate-ai-workflowsRead original →
FIG-3971:1
40radar
FIG-3971:1
#0396
#0396Other Simon Willison6 days ago
`CSP Allow-list Experiment`: Interactive `fetch()` Recovery Inside Sandboxed `iframe`s
40radar
A sandboxed iframe can catch blocked fetch() attempts, ask the parent to whitelist the origin, then reload with updated connect-src. Useful pattern for shipping safer user-script sandboxes without hardcoding every API upfront.
- Runs apps under default-src 'none' in a sandboxed iframe, then escalates blocked network origins to the parent for approval.
- Blocked fetch() calls surface the exact failed origin, so users can add only that domain to connect-src instead of loosening CSP broadly.
- The flow includes prompt, allow-list update, and refresh, turning CSP failures into a usable permission UX rather than a dead end.
- Good fit for code playgrounds, HTML preview tools, and user-generated app builders where external API access is needed but must stay constrained.
Source: simonwillison.net/2026/May/13/csp-allow/#atom-everythingRead original →
FIG-3961:1
40radar
FIG-3961:1
#0395
#0395Other GeekNews7 days ago
`goshs`, a multi-protocol single-binary file server for developers
50radar
goshsFile server tool — multi-protocol sharing in one binary
Goes well beyond python3 -m http.server: one binary can serve files over HTTP/S, WebDAV, SFTP, SMB, and LDAP/S with auth included. Useful when you need secure ad-hoc sharing or device-to-device transfer without dragging in Apache-style setup.
- Replaces the usual throwaway local server with a single binary that handles multiple protocols from one command.
- Supports HTTPS and authentication out of the box, so quick file sharing does not require a reverse proxy or extra server config.
- WebDAV, SFTP, and SMB in one tool makes it practical for mixed workflows across macOS, iOS, Linux, and network drives.
- Best fit is ops-lite utility work: demos, internal asset delivery, test-device transfer, and temporary private sharing.
Source: news.hada.io/topic?id=29445Read original →
FIG-3951:1
50radar
FIG-3951:1
#0394
#0394Other OpenAI7 days ago
OpenAI details fallout from TanStack npm supply-chain attack
40radar
TanStackFrontend toolkit — suite behind Query, Table, and more
A compromised dependency chain reached OpenAI apps, forcing macOS users to update by June 12, 2026. The practical takeaway is simple: audit signing paths and third-party packages now, not after the alert lands.
- The incident is tied to the TanStack Mini Shai-Hulud attack, so this was not an isolated app bug but a broader npm supply-chain breach.
- OpenAI says it secured internal systems and signing certificates; that puts code-signing infrastructure, not just package locks, on the threat model.
- macOS users must update OpenAI apps by 2026-06-12. If a dev tool touches local files or credentials, delayed updates are a real risk.
- The useful lesson is operational: dependency monitoring, certificate hygiene, and forced-update paths need to exist before the next package compromise.
Source: openai.com/index/our-response-to-the-tanstack-npm-supplyRead original →
40radar
PHOTO
FIG-3941:1
#0393
#0393Other Simon Willison7 days ago
`datasette` `1.0a29` fixes a nasty test race and smooths zero-row/mobile UX
40radar
DatasetteData tool — web app for exploring and publishing SQLite
A thread-safety bug that could segfault tests is now fixed, alongside small but practical UI cleanup for empty tables and Mobile Safari. Useful if you embed datasette in admin tools or data products, but not a broad market-moving release.
- Datasette.close() had a race with in-flight threaded queries and could trigger a segfault in tests; that class of bug is expensive to debug once it hits CI.
- Empty tables now still show headers and column options, so schema-first browsing works even with 0 rows.
- Mobile Safari column action dialog rendering was fixed, removing one of the more annoying iPhone/iPad admin UI papercuts.
- A new TokenRestrictions.abbreviated(datasette) helper generates "_r" dictionaries, which matters mainly for plugin and internal API users.
Source: simonwillison.net/2026/May/12/datasette/#atom-everythingRead original →
40radar
PHOTO
FIG-3931:1

Tue, May 122 dispatches

#0392
#0392Other GeekNewslast week
`Mini Shai-Hulud` returns: self-propagating npm supply-chain attack hits CI/CD
80radar
This worm hijacks CI/CD flows, steals secrets, and spreads through legitimate npm packages. If your pipeline publishes packages or injects tokens broadly, tighten secret scope and rotate exposed credentials now.
- StepSecurity first detected it in an official @tanstack package, which means trusted package names are no longer a safe shortcut.
- The blast radius is bigger than a single repo: CI tokens, registry credentials, and publish pipelines can become propagation paths.
- Teams using long-lived secrets in GitHub Actions or package release jobs should assume lateral movement, not isolated package compromise.
- The practical response is boring but urgent: rotate tokens, narrow CI permissions, pin releases carefully, and review package publish automation.
Source: news.hada.io/topic?id=29427Read original →
FIG-3921:1
80radar
FIG-3921:1
#0391
#0391Other GeekNewslast week
Postmortem: `TanStack` npm Supply-Chain Breach
60radar
TanStackOSS package suite — frontend state and data tools
A six-minute CI-to-publish compromise turned pull_request_target, cache poisoning, and stolen OIDC credentials into malicious npm releases. If your stack pulls @tanstack/*, treat GitHub Actions hardening and dependency pinning as urgent hygiene, not optional.
- The blast radius was 42 @tanstack/ packages and 84 malicious versions published within 6 minutes; short windows still break CI fast.
- The chain combined pull_request_target, GitHub Actions cache poisoning, and OIDC token extraction from runner memory; one weak workflow can reach package publishing.
- Stolen npm publish access means trusted frontend dependencies become an attack path; lockfiles alone do not save you after a poisoned release.
- This pushes routine defenses up the priority list: tighter GitHub Actions permissions, cache isolation, and faster dependency incident response.
Source: news.hada.io/topic?id=29413Read original →
FIG-3911:1
60radar
FIG-3911:1

Mon, May 114 dispatches

#0390
#0390Other GitHub Changeloglast week
`GitHub Mobile` adds on-the-go repository creation
40radar
GitHub MobileMobile app — create new repositories on iPhone
This shortens the gap between an idea and a fresh repo. On iOS, creation starts from Home or Profile via +, so quick experiment repos and name-claim drafts become much easier.
- Creation now happens directly inside GitHub Mobile, removing the desktop detour for starting a new codebase.
- iOS flow is explicit: Home or Profile -> + -> Create repository. Low friction matters when you want to capture an idea fast.
- Best fit is lightweight starts: scratch repos, landing-page stubs, or placeholder names before the context disappears.
Source: github.blog/changelog/2026-05-11-create-repositories-on-Read original →
FIG-3901:1
40radar
FIG-3901:1
#0389
#0389Other GeekNewslast week
Replacing a `3GB` `SQLite` dictionary with a `10MB` `FST` binary
50radar
FSTStatic search format — compresses huge indexes into tiny binaries
When autocomplete data explodes into tens of millions of forms, static FST indexing beats SQLite FTS on distribution cost. For read-heavy search, this is a strong pattern for mobile and edge delivery.
- A Finnish-English dictionary grew to 40M-60M entries after inflection expansion, pushing trie-based search past practical limits.
- A temporary SQLite FTS approach was fast enough at query time, but shipping an initial 3GB download broke usability.
- A compiled FST binary cut the payload to about 10MB, turning a search structure into something app-bundle-sized.
- This pattern fits datasets that are mostly static and prefix-search-heavy, where update flexibility matters less than footprint.
Source: news.hada.io/topic?id=29379Read original →
FIG-3891:1
50radar
FIG-3891:1
#0388
#0388Other GeekNewslast week
`CVE-2024-YIKES`: dependency hijack leaked cross-ecosystem registry creds
60radar
vulpine-lz4Package — install-time code stole CI secrets
A JavaScript package hijack spilled into Rust and Python supply chains by stealing registry credentials like .npmrc, .pypirc, and Cargo tokens. If CI can read publish secrets during builds, one compromised package can jump ecosystems fast; tighten token scope and isolate release jobs now.
- The blast radius was not just npm; stolen creds also covered .pypirc, Cargo, and RubyGems, so one weak link can poison multiple release pipelines.
- A malicious build.rs in vulpine-lz4 reportedly executed on CI hosts, which turns dependency install time into a credential exfiltration path.
- left-justify-style phishing shows package names and maintainer trust are still enough to trigger supply-chain compromise without an infra breach.
- Build jobs that both install third-party code and hold publish tokens are the obvious failure mode. Split test and release environments before this pattern repeats.
Source: news.hada.io/topic?id=29374Read original →
FIG-3881:1
60radar
FIG-3881:1
#0387
#0387Other GeekNewslast week
`Bifrost`: ultra-fast enterprise AI gateway
50radar
BifrostAI gateway — OpenAI-compatible ultra-low-latency proxy
One OpenAI-compatible API can sit in front of multiple model vendors with sub-100µs proxy overhead. Worth checking if multi-provider routing matters more than keeping the stack minimal.
- It fronts OpenAI, Anthropic, AWS Bedrock, and Google Vertex through one API, covering 15+ providers and simplifying app integration.
- The pitch is 50x faster than LiteLLM, with under 100µs overhead at 5k RPS; that matters only if proxy latency is already a bottleneck.
- Adaptive load balancing, cluster mode, guardrails, and support for 1,000+ models push routing and policy into one layer, at the cost of another ops surface.
Source: news.hada.io/topic?id=29373Read original →
FIG-3871:1
50radar
FIG-3871:1

Sun, May 101 dispatches

#0386
#0386Other GeekNewslast week
`NixOS` Secrets: Plaintext in `Nix store` Is Readable
40radar
NixOSLinux distro — declarative, reproducible system config
Putting secrets in Nix config, private Git, or git-crypt plaintext still leaks them through Nix store. sops-nix is the practical baseline if you deploy with NixOS; otherwise your server access model is already broken.
- Secrets embedded in Nix config can end up in Nix store, which is world-readable on the machine; repo privacy does not help after deploy.
- Keeping values in a private repo or decrypting with git-crypt before build still leaves plaintext artifacts in the store, so the leak point moves to runtime.
- sops-nix uses .sops.yaml rules and encrypted-file editing flow, giving a cleaner path than ad hoc secret injection for NixOS setups.
Source: news.hada.io/topic?id=29328Read original →
FIG-3861:1
40radar
FIG-3861:1

Fri, May 82 dispatches

#0385
#0385Other GitHub Changelog2 weeks ago
`GitHub` adds user-level default for commit comments
40radar
You can now set commit comments on or off once for repos under your personal account. It trims one more per-repo setting and matters mostly if you use commits as a feedback surface; useful, but not urgent.
- The new control applies at the personal-account level for repositories you own, not one repo at a time.
- This is a default-behavior setting for commit comments, so new repo setup and preference management get lighter.
- Teams building in public may leave it on for line-level feedback on commits; solo repos can shut it off to cut noise.
- Impact is operational rather than strategic: no pricing, workflow, or platform-policy change attached.
Source: github.blog/changelog/2026-05-08-disable-commit-commentsRead original →
FIG-3851:1
40radar
FIG-3851:1
#0384
#0384Other GitHub Changelog2 weeks ago
`CodeQL` `2.25.3` adds `Swift` `6.3` support
40radar
CodeQLCode analysis engine — powers GitHub code scanning
GitHub code scanning can now parse newer Swift projects without lagging toolchains. Useful if your iOS repo depends on CodeQL; otherwise the impact is limited.
- CodeQL powers GitHub code scanning, so Swift 6.3 support lands directly in existing security analysis workflows.
- This is a compatibility update, not a new analysis capability; teams already using CodeQL get smoother upgrades.
- Worth noting for iOS CI pipelines pinned to latest Swift; if you do not run CodeQL, there is little immediate payoff.
Source: github.blog/changelog/2026-05-08-codeql-2-25-3-adds-swifRead original →
FIG-3841:1
40radar
FIG-3841:1

Thu, May 71 dispatches

#0383
#0383Other GitHub Changelog2 weeks ago
`GitHub` adds search and filters to repository security advisories
40radar
Advisories in the repo Security tab are now easier to triage without scrolling. Small change, but it cuts friction when checking older disclosures or narrowing by status.
- A new search bar and filter controls now sit at the top of the advisory list in the repository Security tab.
- Finding past disclosures gets faster when a repo has multiple advisories; less list-scanning, quicker triage.
- Useful mainly for projects that already publish advisories regularly. For small repos, impact is modest.
Source: github.blog/changelog/2026-05-06-search-and-filter-bar-fRead original →
FIG-3831:1
40radar
FIG-3831:1

↻ Load earlier issues

Hugging Face revives `PapersWithCode` with AI-parsed leaderboards

`rkdebian` turns an $80 RK3562 Android tablet into a Debian workstation

Stay Native Until Text Forces Your Hand

5 repeatable `Claude` prompting patterns for cleaner outputs

`Erlang/OTP` `29.0` Tightens SSH Daemon Defaults

Better AI Planning Starts With Different Questions

Choose `HTML` Lists by Semantics, Not Appearance

`llama.cpp` fork enables quantized KV cache with tensor split

Leaving `Tailwind`, Rebuilding a Structured CSS System

`GitHub Projects` adds built-in timestamp fields

`datasette-llm-limits` `0.1a0` adds per-user LLM spend caps

Self-Training With Verifiable Rewards Pushes `Qwen 2.5` 7B to **112/164** on HumanEval

`scrcpy` `4.0` adds flexible virtual display resizing

`Quack`: Client-Server Protocol for `DuckDB`

`easy-vibe`: beginner course for shipping AI apps with SaaS and payments

Pure AI vs Deterministic Software in Workflow Orchestration

`CSP Allow-list Experiment`: Interactive `fetch()` Recovery Inside Sandboxed `iframe`s

`goshs`, a multi-protocol single-binary file server for developers

OpenAI details fallout from TanStack npm supply-chain attack

`datasette` `1.0a29` fixes a nasty test race and smooths zero-row/mobile UX

`Mini Shai-Hulud` returns: self-propagating npm supply-chain attack hits CI/CD

Postmortem: `TanStack` npm Supply-Chain Breach

`GitHub Mobile` adds on-the-go repository creation

Replacing a `3GB` `SQLite` dictionary with a `10MB` `FST` binary

`CVE-2024-YIKES`: dependency hijack leaked cross-ecosystem registry creds

`Bifrost`: ultra-fast enterprise AI gateway

`NixOS` Secrets: Plaintext in `Nix store` Is Readable

`GitHub` adds user-level default for commit comments

`CodeQL` `2.25.3` adds `Swift` `6.3` support

`GitHub` adds search and filters to repository security advisories

Self-Training With Verifiable Rewards Pushes `Qwen 2.5` 7B to 112/164 on HumanEval