devtake.dev

#dev-tools

RSS
An Adapteva Parallella development board with an AMD/Xilinx Zynq FPGA SoC, representative of the hobbyist hardware the Vivado free tier targets.
Hardware·

AMD walled off Linux Vivado behind a paid tier. The free FPGA tier is now Windows only.

Vivado 2026.1 introduces a five-tier licensing model. The free BASIC tier supports Windows only; Linux requires the paid CORE tier. FPGA hobbyists are pushing back.

Google Chrome logo on a dark background
Security·

Google's bug tracker auto-published exploit code for an unpatched Chromium flaw. The bug is still live.

Chromium Issue 1396278 went public on May 20 because Google's tracker auto-clears restrictions on stale closed bugs. The flaw, reported in 2022, was never fixed.

Aisle of dense server racks inside the CERN Computer Center
Web·

Cloudflare rebuilt Browser Run on its own Containers. Concurrency went from 30 to 120.

Cloudflare moved Browser Run off shared isolation infrastructure on May 13. The agentic-coding crowd gets four times the headless-Chrome ceiling and half the latency.

C# 15 union types announcement graphic from the Microsoft .NET Blog
Open Source·

C# is getting union types in version 15. The preview shipped in .NET 11 Preview 2.

Mads Torgersen's union proposal landed in .NET 11 Preview 2 on April 2. C# 15 targets November 2026 and replaces the OneOf library hack the .NET community has been living with.

Figure from a forensic document-examination study used here as visual shorthand for verifying authorship of code.
Open Source·

yt-dlp's maintainer says Bun is now 'fully vibe-coded'. Support is officially deprecated.

yt-dlp's maintainer bashonly says Bun's Rust rewrite 'has taken a turn towards being fully vibe-coded.' The supported window narrowed to four versions.

Portrait of Andrej Karpathy, whose January 26 X thread on agentic coding was distilled into the viral CLAUDE.md file.
AI·

Karpathy posted four notes about Claude Code. The CLAUDE.md they spawned has 110K GitHub stars.

Forrest Chang turned Andrej Karpathy's January coding thread into a 70-line CLAUDE.md. It now has 110,000+ stars and has trended on GitHub for 28 weeks.

GitHub security blog header showing the GitHub Octocat logo on a backdrop of black security blocks.
Security·

GitHub's internal repos were breached. The attacker came in through a poisoned VS Code extension.

GitHub detected the intrusion on May 18 after a malicious VS Code extension compromised an employee's device. The attacker claims to have exfiltrated 3,800 internal repositories.

An illustration of the Claude Code deeplink vulnerability, showing a malicious URL handler triggering a shell prompt.
Security·

A bad command-line parser turned every claude-cli:// link into a remote shell

Joernchen of 0day.click found a deeplink RCE in Claude Code. Anthropic shipped the fix in 2.1.118 the same week.

A diagram from Cloudflare's blog post illustrating how a Wasm instance recovers state after a Rust panic.
Open Source·

Cloudflare taught wasm-bindgen to catch a Rust panic. Workers no longer poison the sandbox.

Three Cloudflare engineers shipped panic and abort recovery into wasm-bindgen on April 22. A Rust Worker that panics now reinitialises on the next request.

Vasilios Syrakis at his desk next to a whiteboard diagram of an Open Service Broker: Client → FastAPI → SQS → Worker → DynamoDB, with provisioning tasks to Route53, CloudFront, and API calls.
Web·

Atlassian laid off the engineer who built its edge. He published the blueprints.

Vasilios Syrakis spent eight years building Atlassian's Envoy control plane. After the March cuts, he posted a 40-minute walkthrough that hit 1.1M views.

Anthropic announcement card with node shapes on coral background.
AI·

Anthropic bought Stainless, the startup that builds every official SDK for OpenAI and Google.

Anthropic announced May 18 it acquired SDK generator Stainless, reportedly for over $300M. The same toolchain still powers OpenAI's, Google's, and Cloudflare's official clients.

OpenAI's Codex inside the ChatGPT mobile app, showing a Codex review on a phone screen.
AI·

OpenAI's Codex moved into the ChatGPT mobile app. You can approve a diff from the train now.

OpenAI shipped Codex remote control inside the ChatGPT app for iPhone, iPad, and Android on May 14. Pair via QR; the agent runs on your laptop, the review moves to your phone.

Obsidian application banner showing the note-taking app branding
Open Source·

120 million plugin downloads later, Obsidian moved off GitHub. Paid plugins are now allowed.

Obsidian launched Obsidian Community on May 12. The new directory replaces the GitHub plugin queue with automated reviews, and paid plugins are in for the first time.

Airbnb office building exterior
AI·

Airbnb says AI writes 60% of its new code. Nobody has explained what that means.

Brian Chesky dropped the 60% figure on an earnings call without defining how Airbnb measures it. Google claims 75%. The independent average is 27%.

TanStack website header with logo
Security·

TanStack published its npm supply-chain postmortem. The attack chained three GitHub Actions flaws.

Attackers compromised 42 TanStack packages through a pull_request_target exploit, cache poisoning, and OIDC token theft. An external researcher caught it in 20 minutes.

GitLab Act 2 blog post header graphic
Web·

GitLab is cutting staff and killing its CREDIT values. The CEO calls it 'Act 2.'

CEO Bill Staples announced a restructuring he frames around agentic AI, retiring GitLab's six core values for three new operating principles. Exact layoff numbers come June 2.

The Register's coverage of Bun's experimental Zig-to-Rust port
Open Source·

Jarred Sumner rewrote 960,000 lines of Bun from Zig to Rust in six days. He might throw it all away.

Bun's creator used Claude to port the JavaScript runtime from Zig to Rust, hitting 99.8% test compatibility. He says there's a 'very high chance' it gets scrapped.

Abstract visualization of data exposure through code
Security·

380,000 vibe-coded apps are sitting on the open web. 5,000 of them are leaking real data.

RedAccess found that AI coding tools like Lovable, Base44, and Replit default to public hosting, leaving medical records, bank internals, and corporate secrets indexed by Google.