<h2>Must know</h2>
<ul>
<li><strong>Anthropic leaks Claude Code source and faces supply chain chaos</strong>: Anthropic accidentally exposed 512,000 lines of Claude Code CLI source code via an npm source map, revealing internal orchestration logic and unreleased ‘Ultra’ plans. While Anthropic issued thousands of DMCA takedowns, the leak has already been weaponized by state-sponsored groups and used to distribute the Vidar infostealer through fake ‘leaked’ repositories. Simultaneously, the Axios npm package was hijacked by North Korean actors to deploy a Trojan, highlighting a brutal week for software supply chain security. <a href="https://app.daily.dev/feed-by-ids?id=9nHqJG8ou&amp;id=cJqnnyxUG&amp;id=k6jB0vtTo&amp;id=kXi9WLT2r&amp;id=m7tAKP1Vp&amp;id=NF4kLGa2o&amp;id=5gaMZWR6L&amp;id=YtEQA7dzF" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>React2Shell vulnerability grants unauthenticated RCE in Next.js</strong>: A CVSS 10.0 critical vulnerability, dubbed React2Shell (CVE-2025-55182), allows remote code execution in Next.js apps using the App Router via a single malicious POST request. Threat group UAT-10608 has already automated exploitation, breaching hundreds of hosts to exfiltrate database credentials and cloud secrets within 24 hours of the PoC release. Platform engineers should prioritize updating Next.js and rotating all environment secrets immediately if unpatched. <a href="https://app.daily.dev/feed-by-ids?id=DwxOsTaJk&amp;id=PSaBpOzUl" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Go 1.26 and TypeScript 6.0 overhaul compiler internals</strong>: Go 1.26 introduces a refined type checker that systematically detects cyclic size definitions, resolving long-standing compiler panics and improving AST walking stability. Meanwhile, TypeScript 6.0 has reached general availability, serving as the final bridge before the highly anticipated Go-based rewrite in version 7.0. These updates signal a major shift toward performance-oriented compiler architecture across the primary web languages. <a href="https://app.daily.dev/feed-by-ids?id=TyEpUoMZT&amp;id=3Peuc7cFI" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
<h2>Good to know</h2>
<ul>
<li><strong>Vercel Sandbox snapshots hit sub-second restore times</strong>: Engineering optimizations using parallel S3 range requests and local NVMe caching reduced filesystem restore times from 40 seconds to under 1 second. <a href="https://app.daily.dev/posts/1Xib7hCkG" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>C# 15 introduces native union types for exhaustive matching</strong>: The new <code>union</code> keyword in .NET 11 enables closed type hierarchies with compiler-enforced pattern matching, avoiding the overhead of marker interfaces. <a href="https://app.daily.dev/posts/oYgraaUHF" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Module Federation 2.0 brings dynamic TypeScript hints</strong>: The stable release features a decoupled runtime supporting Rspack and Vite, plus a Side Effect Scanner to detect global variable pollution. <a href="https://app.daily.dev/posts/yHb6Dn8XT" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Jujutsu v0.40.0 adds diff content matching functions</strong>: The Git-compatible CLI tool now supports <code>diff_lines_added()</code> revsets and improved TUI parent/child visualization. <a href="https://app.daily.dev/posts/X2lF2ACF9" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Intel and AMD push cache aware scheduling to Linux kernel</strong>: New patches for the Linux scheduler optimize load balancing for multi-cache CPUs like Xeon and EPYC, showing significant performance gains in NUMA placement. <a href="https://app.daily.dev/feed-by-ids?id=06X3vNF5F&amp;id=3pSf77LUz" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>WordPress 7.0 delayed due to real-time collaboration bugs</strong>: In an unprecedented move, the release is paused until late April to address stability issues, with the trunk branch currently locked for 7.1 work. <a href="https://app.daily.dev/posts/x2whMmIN7" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>View Transitions Toolkit simplifies web animation orchestration</strong>: A new utility collection provides helpers for scrubbing, pausing, and automatically injecting transition types based on navigation patterns. <a href="https://app.daily.dev/posts/UTG40VF0N" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
<h2>Bullshit police</h2>
<ul>
<li><strong>The GitHub Copilot ad-injection feature</strong>: Microsoft managed to ‘accidentally’ inject promotional spam for Raycast into over 11,000 pull request descriptions, calling them ‘product tips.’ It’s a bold move to prioritize ad revenue on a platform currently struggling with 90 incidents in 90 days and crumbling uptime. If you wanted your PRs to look like a late-night infomercial, you’d have stayed on SourceForge. <a href="https://app.daily.dev/posts/uTPvtACi0" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>The $250 a month Gmail AI inbox</strong>: Google is rolling out an ‘AI Inbox’ that summarizes your emails for the low, low price of $3,000 a year via the AI Ultra subscription. Paying a senior engineer’s daily rate every month just to have an LLM hallucinate your meeting invites is the ultimate ‘more money than sense’ play. It’s not a productivity tool; it’s a tax on people who can’t be bothered to read their own mail. <a href="https://app.daily.dev/posts/vaf63Asut" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Vibe coding and the junior death spiral</strong>: The industry is currently obsessed with ‘vibe coding’—accepting unreviewed output—while simultaneously wondering why entry-level hiring has cratered by 20%. Executives are using ‘agentic engineering’ as a euphemism for ‘we fired the juniors and now the seniors are drowning in technical debt review.’ It turns out that replacing your talent pipeline with a probabilistic autocomplete wasn’t the masterstroke McKinsey promised. <a href="https://app.daily.dev/feed-by-ids?id=8JQ00Kftb&amp;id=KVQvWvGP4&amp;id=uIab7G9MK" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
