Flux
The Zig project's rationale for their firm anti-AI contribution policy

The Zig project's rationale for their firm anti-AI contribution policy

Zig has one of the most stringent anti-LLM policies of any major open source project: No LLMs for issues. No LLMs for pull requests. No LLMs for comments on the bug tracker, including translation. English is encouraged, but not required. You are welcome to post in your native language and rely on others to have their own translation tools of choice to interpret your words. The most prominent project written in Zig may be the Bun JavaScript runtime, which was acquired by Anthropic in December…

Simon Willison's Weblog
Malicious npm Package Brand-Squats TanStack to Exfiltrate Environment Variables

Malicious npm Package Brand-Squats TanStack to Exfiltrate Environment Variables

The Socket Research Team has detected an active supply-chain attack targeting the unscoped tanstack package on npm, a brand-squatted impersonation of the legitimate @tanstack/* organization. Beginning today, the package's maintainer (sh20raj) began pushing malicious versions that silently steal environment variable files, including .env, .env.local, and .env.production, from developers' machines at install time, exfiltrating them to an attacker-controlled endpoint. Versions 2.0.4 through 2.0.7…

Socket
LLM 0.32a0 is a major backwards-compatible refactor

LLM 0.32a0 is a major backwards-compatible refactor

I just released LLM 0.32a0, an alpha release of my LLM Python library and CLI tool for accessing LLMs, with some consequential changes that I've been working towards for quite a while. Previous versions of LLM modeled the world in terms of prompts and responses. Send the model a text prompt, get back a text response. import llm model = llm.get_model("gpt-5.5") response = model.prompt("Capital of France?") print(response.text()) This made sense when I started working on the library back in April…

Simon Willison's Weblog
Community Corner: Storyblok with Daniel Mendoza

Community Corner: Storyblok with Daniel Mendoza

In this episode, Scott talks Storyblok with Daniel Mendoza and his talk on using AI to help developers learn new technology that he will be presenting at JStek 2026. Links: Our Discord – https://discord.gg/aMTxunVx Buy our shirts – https://store.phparch.com/products/community-corner-podcast-t-shirt Daniel’s Links: LinkedIn – https://www.linkedin.com/in/daniel-mendoza-503396152/ Personal Site – https://danieljmendoza.com/ Scott’s Links: Website – https://scott.keck-warren.com/ Bluesky […] The…

PHP Architect
★ Announcing laravel-sluggable v4 with self-healing URLs

★ Announcing laravel-sluggable v4 with self-healing URLs

The spatie/laravel-sluggable package has been around for close to a decade. A slug is the readable part of a URL that identifies a record, like announcing-laravel-sluggable-v4-with-self-healing-urls in this post's URL. The package generates one for any Eloquent model when you save it, derived from a title or another text field, and most of the time you don't have to think about it. We just released v4, which adds a few things worth talking about. Let me walk you through them. Generating slugs…

Freek Van der Herten
TeamPCP-Linked Supply Chain Attack Hits SAP CAP and Cloud MTA npm Packages

TeamPCP-Linked Supply Chain Attack Hits SAP CAP and Cloud MTA npm Packages

Socket is investigating a suspected supply chain attack affecting multiple npm packages associated with SAP’s JavaScript and cloud application development ecosystem. At the time of publication, Socket has identified the following affected package versions: mbt@1.2.48 @cap-js/db-service@2.10.1 @cap-js/postgres@2.2.2 @cap-js/sqlite@2.2.2 Socket’s analysis indicates that the affected versions introduced new installation-time behavior that was not previously part of these packages’ expected…

Socket
Don’t Automate Your Moat: Matching AI Autonomy to Risk and Competitive Stakes

Don’t Automate Your Moat: Matching AI Autonomy to Risk and Competitive Stakes

I was talking to a senior engineer at a well-funded company not long ago. I asked him to walk me through a critical algorithm at the heart of their product, something that ran hundreds of times a second and directly affected customer outcomes. He paused and said, “Honestly, I’m not totally sure how it works. […]

O'Reilly Radar — AI/ML