<h2>Must know</h2>
<ul>
<li><strong>Trivy supply chain attack compromises CI/CD secrets</strong>: Hackers compromised the Trivy vulnerability scanner, injecting malicious code into version 0.69.4 and affecting multiple GitHub Actions tags. The malware specifically targets CI/CD pipelines to exfiltrate GitHub tokens, cloud credentials, and Kubernetes secrets to attacker-controlled servers. Aqua Security maintainers advise immediate rotation of all pipeline secrets for anyone who ran the compromised versions. <a href="https://app.daily.dev/posts/2d8XVA28P" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Microsoft rolls back Copilot entry points in Windows 11</strong>: Responding to user feedback and performance concerns, Microsoft is reducing Copilot AI integrations across Photos, Notepad, and Snipping Tool to focus on more intentional experiences. This shift accompanies a new quality-focused roadmap for Windows 11 that prioritizes WinUI3 migration for lower latency and improved memory efficiency. The company also committed to more rigorous validation for Insider builds following a string of buggy Patch Tuesday updates. <a href="https://app.daily.dev/feed-by-ids?id=R3I8JkvR5&amp;id=BqmzCEDV2" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Germany mandates OpenDocument formats for public sector</strong>: The German government’s new Deutschland-Stack framework officially mandates the use of ODF and PDF/UA across all public administrations by 2028. This policy explicitly excludes proprietary Microsoft formats like .doc and .xls to reduce vendor lock-in and bolster European digital sovereignty. The Document Foundation has hailed the move as a fundamental shift toward vendor-neutral digital infrastructure. <a href="https://app.daily.dev/posts/ffG1g9Lse" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
<h2>Good to know</h2>
<ul>
<li><strong>Next.js 16.2 introduces agent native features and 400 percent faster dev startup</strong>: The release adds an <a href="http://agents.md" target="_blank" rel="noopener nofollow">agents.md</a> file for LLM context and experimental tools that expose browser-level data to coding agents via shell commands. <a href="https://app.daily.dev/feed-by-ids?id=pLH5NluEB&amp;id=TgFXANsju" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Vite plus goes fully open source under MIT license</strong>: VoidZero released the Vite-native deployment platform Void and open-sourced the Vite+ alpha, which bundles Vitest, Oxlint, and Rolldown into a single binary. <a href="https://app.daily.dev/posts/dbyxVvRUE" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Sashiko brings AI powered code review to the Linux kernel</strong>: Developed by a Google engineer, this Rust-based tool analyzes mailing list patches and caught 53% of bugs missed by human reviewers in testing. <a href="https://app.daily.dev/posts/j5mdnOwUC" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Wine 11.5 adds Linux syscall user dispatch support</strong>: This update fixes long-standing crashes in titles like Red Dead Redemption 2 by redirecting non-native system calls to user-space. <a href="https://app.daily.dev/posts/1L0pKGR6J" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>SingleStore 9.1 optimizes vector storage with F16 support</strong>: The new data type halves storage requirements and improves kNN query speed by 38% while maintaining statistically equivalent recall to F32. <a href="https://app.daily.dev/posts/xRqtno45x" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Television fuzzy finder challenges FZF with channel architecture</strong>: This Rust-based tool uses a ‘cable library’ to integrate AWS, Docker, and Kubernetes pickers directly into the terminal workflow. <a href="https://app.daily.dev/posts/HAbGCXW9P" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>AWS Neuron DRA driver enables native Trainium scheduling in EKS</strong>: The driver exposes hardware topology to the Kubernetes scheduler, allowing for topology-aware placement of distributed ML workloads. <a href="https://app.daily.dev/posts/9LEsjcMcn" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
<h2>Bullshit police</h2>
<ul>
<li><strong>NVIDIA DLSS 5 and the death of artistic intent</strong>: NVIDIA is touting DLSS 5 as a graphics breakthrough, but developers are already complaining that the AI is ‘hallucinating’ lighting and washing out contrast. Jensen Huang’s response to concerns about distorted character appearances was predictably dismissive, essentially telling artists that the AI knows their vision better than they do. It’s a bold move to market ‘making the game look different than intended’ as a premium feature. <a href="https://app.daily.dev/feed-by-ids?id=BsIJ2t6dP&amp;id=bugYUlRMu" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>The 100 percent AI driven project bottleneck</strong>: Teams are bragging about ‘100% AI-driven’ coding projects while casually mentioning they had to build an ‘AI Business Analyst’ just to feed the beast 600 tasks in three hours. We’ve reached the point where we’re generating massive amounts of ‘triage slop’ and then hiring senior engineers just to sign off on the mess. If your development velocity requires a secondary AI just to explain the first AI’s output, you haven’t solved a bottleneck; you’ve just automated the creation of technical debt. <a href="https://app.daily.dev/feed-by-ids?id=2kHgnIWRN&amp;id=WUU9cqG9n" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Delve and the SOC 2 rubber stamp factory</strong>: YC-backed startup Delve is allegedly ‘automating’ GRC by simply fabricating compliance evidence and using offshore mills to sign identical reports. It turns out ‘AI-powered compliance’ was just a script-generated error away from exposing NASDAQ-traded companies to massive HIPAA liability. It’s the ultimate Silicon Valley dream: replacing actual security audits with a digital ‘Trust Page’ that is 99.8% identical for every single customer. <a href="https://app.daily.dev/posts/zmPU272WX" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
