<h2>Must know</h2>
<ul>
<li><strong>React server components still a security mess</strong>: React Server Components (RSC) are still plagued by denial-of-service vulnerabilities (CVE-2026-23864) and server-side code execution flaws (React2Shell). These issues, affecting React 19.x and Next.js 13.x-16.x, can lead to server crashes and remote code execution, with active exploitation reported in the wild. While Vercel has implemented WAF mitigations, immediate upgrades are crucial, highlighting ongoing concerns about the security and stability of RSCs, as reported by security bulletins. <a href="https://app.daily.dev/feed-by-ids?id=igYAcLEa7&amp;id=PeVwqMgPR&amp;id=ie5iik7vo" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Open source is getting screwed by AI coding tools</strong>: AI coding tools are causing a crisis for open-source projects. Tailwind CSS, for example, saw an 80% revenue drop and laid off 75% of its staff because developers are using AI instead of documentation, according to Frontend Masters Blog. This ‘vibe coding’ reduces community engagement and threatens the sustainability of open-source development, with researchers suggesting AI companies should share revenue with the projects they rely on. <a href="https://app.daily.dev/feed-by-ids?id=3KjVRqoNX&amp;id=YRC8HFFhU&amp;id=aDodkq3hd" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Kubernetes RBAC vulnerability allows cluster-wide RCE</strong>: A critical authorization bypass in Kubernetes Role-Based Access Control (RBAC) allows remote code execution in any Pod with the commonly granted <code>nodes/proxy GET</code> permission. This vulnerability, affecting 69 Helm charts including Prometheus and Grafana, stems from Kubelet authorizing WebSocket <code>/exec</code> requests based on initial HTTP GET, bypassing proper CREATE permissions. The Kubernetes Security Team considers this ‘working as intended,’ pushing for an architectural solution (KEP-2862) that doesn’t fix the immediate flaw, leaving many clusters at risk. <a href="https://app.daily.dev/feed-by-ids?id=YKjgFzDSZ&amp;id=wlbhCOZ7B" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
<h2>Good to know</h2>
<ul>
<li><strong>Node.js 25.5.0 brings single executable apps and security updates</strong>: Node.js 25.5.0 introduces Single Executable Application (SEA) generation with a new <code>--build-sea</code> flag, updates root certificates, and activates SQLite defensive mode by default for enhanced security. <a href="https://app.daily.dev/posts/BrQRGrBKE" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Laravel Boost v2.0 launches with new skills system</strong>: Laravel Boost v2.0 introduces a ‘Skills’ system for developers to customize workflows, including skill synchronization, overrides, and an Artisan command to fetch skills from GitHub repositories. <a href="https://app.daily.dev/posts/xZZMD5bdo" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Ktor 3.4 enhances HTTP client and documentation</strong>: Ktor 3.4 adds duplex streaming for the OkHttp client, an <code>HttpRequestLifecycle</code> plugin for automatic request cancellation, and a new runtime API for dynamic Swagger documentation generation. <a href="https://app.daily.dev/posts/FLMxxYChP" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Vue.js ecosystem updates: Nuxt 4.3 and testing insights</strong>: The Vue.js ecosystem sees the release of Nuxt 4.3, new insights into Vue testing practices, and a free JavaScript certification opportunity. <a href="https://app.daily.dev/posts/qNLYCkgXb" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Ruby ecosystem updates and tooling releases</strong>: The Ruby ecosystem sees releases like Rails 8.1.2 and Devise 5.0, new tools such as <code>rfmt</code> (Rust-based formatter) and <code>logstruct</code> (JSON logging gem), and a new Ruby learning roadmap from <a href="http://Roadmap.sh" target="_blank" rel="noopener nofollow">Roadmap.sh</a>. <a href="https://app.daily.dev/posts/wvUtFqFs8L" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Godot 4.6 focuses on workflow and quality-of-life improvements</strong>: Godot 4.6, powering over 1,200 Steam releases in 2025, focuses on polishing workflows, fixing ‘papercuts,’ and resolving bugs to enhance the developer experience without major new features. <a href="https://app.daily.dev/posts/D2nU2jVS2" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>DuckDB 1.4.4 LTS focuses on stability and performance</strong>: DuckDB 1.4.4 LTS delivers bugfixes, performance improvements, and security patches, addressing correctness issues in joins, crashes, and segfaults, with a focus on stability over new features. <a href="https://app.daily.dev/posts/4NWUdLPx5" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
<h2>Bullshit police</h2>
<ul>
<li><strong>AI will make you a better engineer, just ignore the ‘slop’</strong>: Apparently, Dropbox engineers are accepting a million lines of AI-suggested code per month, leading to ‘improved pull request throughput.’ Meanwhile, other ‘experts’ are warning that AI-generated code is ‘frequently inconsistent, inefficient, and mainly designed as a throwaway resource.’ So, AI makes you faster, but also makes your codebase a dumpster fire. Pick your poison, I guess. <a href="https://app.daily.dev/feed-by-ids?id=iT5DCqanN&amp;id=FG4y5lmMt&amp;id=MVxk3C8r1&amp;id=NAHzSpYqv&amp;id=W6qwFXBzp&amp;id=dABjwqV7N&amp;id=vz4g5mSDD" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Microsoft’s ‘winapp’ tool: solving developer frustrations, or just adding more layers?</strong>: Microsoft has graced us with ‘winapp,’ a command-line tool to simplify Windows app development outside Visual Studio. It automates SDK management and packaging, supposedly making modern Windows APIs more accessible. Developers, however, remain ‘skeptical’ about it solving core complexity issues, noting persistent frustrations with WinUI. Because nothing says ‘simplicity’ like another abstraction layer on an already complex ecosystem. <a href="https://app.daily.dev/posts/xa7n8KICk" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>npm and yarn: security flaws are ‘intentional design’</strong>: Six zero-day vulnerabilities, dubbed PackageGate, are lurking in npm and yarn, allowing attackers to bypass worm attack defenses. While pnpm, vlt, and Bun have patched these, npm insists these ‘vulnerable behaviors’ are part of its ‘intentional design.’ So, apparently, security holes are features now. Good to know where their priorities lie. <a href="https://app.daily.dev/posts/klUkuFZvK" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
