<h2>Must know</h2>
<ul>
<li><strong>TypeScript 6.0 lands as the final bridge to Go-native future</strong>: TypeScript 6.0 has officially released, marking the final version built on a JavaScript codebase before the massive Go-native rewrite in version 7.0. This bridge release introduces TC39 Stage 4 proposals like the Temporal API and Map upsert methods, while significantly cutting build times by up to 50% through new default tsconfig changes. Sources like the official TypeScript blog and multiple dev outlets confirm that a Go-based compiler preview is already available on npm for those ready to ditch JS-based tooling overhead. <a href="https://app.daily.dev/feed-by-ids?id=kynZFJI6r&amp;id=OcEvvfkzR" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Pentagon designates Anthropic a supply chain risk</strong>: The DoD has officially labeled Anthropic an ‘unacceptable risk to national security’ following a dispute over military access to Claude for autonomous weaponry and mass surveillance. This designation effectively bars government contractors from using Anthropic’s models, forcing a massive rework of prompts and retraining of systems for those embedded in federal workflows. According to court filings reported by ProPublica and others, the Pentagon is now actively funding replacements while signing new agreements with OpenAI and xAI. <a href="https://app.daily.dev/feed-by-ids?id=eUVq8byjl&amp;id=oD4f5bOt7" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Malicious litellm package exfiltrates cloud credentials on PyPI</strong>: A sophisticated supply chain attack briefly poisoned the litellm package on PyPI (versions 1.82.7 and 1.82.8), capable of stealing SSH keys and AWS/GCP/Azure credentials. The malware executes automatically on Python startup and attempts to exploit Kubernetes service account tokens for lateral movement. Security researchers at Socket and GitGuardian warn that the attack was discovered when a Cursor MCP plugin pulled the dependency, highlighting the extreme risk of deep dependency trees in AI-assisted workflows. <a href="https://app.daily.dev/feed-by-ids?id=xt7JWjaFB&amp;id=9roAdsa2z&amp;id=FiWEwF4WD" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
<h2>Good to know</h2>
<ul>
<li><strong>NVIDIA Nemotron 3 Super targets agentic coding</strong>: A new 120B parameter open MoE model optimized for reasoning and planning is now available on Bedrock and via NVIDIA’s NIM microservices. <a href="https://app.daily.dev/feed-by-ids?id=kSe4e9XPi&amp;id=SayvyuXbu" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>System76 refreshes Thelio Mira with Ryzen 9000</strong>: The new Linux desktop ships with Pop!_OS 24.04 and the Rust-based COSMIC desktop environment, featuring a 13-degree heat reduction in the chassis. <a href="https://app.daily.dev/posts/rOk7233a3" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Cloudflare Gen 13 servers switch to 192-core Turin</strong>: The new hardware design leverages AMD EPYC Turin CPUs and a Rust-based request layer (FL2) to deliver 2x throughput gains. <a href="https://app.daily.dev/feed-by-ids?id=EaD3ek4GN&amp;id=Fgktk9kvT" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>PostgreSQL 19 adds native REPACK and non-text dumps</strong>: Upcoming features include a built-in command to reclaim bloated disk space and support for directory/tar output formats in pg_dumpall. <a href="https://app.daily.dev/feed-by-ids?id=NAfFQZLbk&amp;id=tBnH1GVb7" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Apple Foundation Models framework gains tool calling</strong>: On-device models can now invoke app-defined tools for real-time data, supported by new context window management APIs in iOS 26.4. <a href="https://app.daily.dev/feed-by-ids?id=3BRn9tA9B&amp;id=CX419bigo" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Vite+ toolchain goes fully open source</strong>: VoidZero has released the all-in-one ‘vp’ binary under MIT, bundling linting, formatting, and type-checking into a single Rust-powered tool. <a href="https://app.daily.dev/feed-by-ids?id=dbyxVvRUE&amp;id=J1Rw9aL2Z" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Netflix open sources Graph Abstraction platform</strong>: A high-throughput system managing 650 TB of graph data with millisecond latency by layering on Key-Value and TimeSeries abstractions. <a href="https://app.daily.dev/posts/dWlT8QdGR" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
<h2>Bullshit police</h2>
<ul>
<li><strong>The Delve compliance theater scandal</strong>: Delve, a YC-backed GRC startup, is accused of running a ‘certification mill’ that generated fake SOC 2 reports with 99.8% identical boilerplate. Leaked databases suggest they used Indian shell firms to rubber-stamp audits without actually verifying security controls, potentially exposing hundreds of NASDAQ-listed clients to massive legal liability. It turns out ‘automating compliance’ was just code for ‘copy-pasting evidence’ while VCs looked the other way. <a href="https://app.daily.dev/feed-by-ids?id=48Uy5BKcM&amp;id=zmPU272WX&amp;id=S4r4Sj7sx" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Cursor’s Composer 2 is just rebranded Kimi</strong>: Cursor faced a transparency backlash after users discovered their ‘GPT-5 tier’ Composer 2 model was actually built on Moonshot AI’s Kimi K2.5 without disclosure. While they claim to have added 3x compute in post-training, hiding the Chinese open-weight base in API URLs is a classic move in the ‘AI wrapper’ playbook. It’s a great technical achievement, but the ‘secret sauce’ narrative tastes a lot like standard rebranding. <a href="https://app.daily.dev/feed-by-ids?id=6IlX0UUsy&amp;id=2O2HmWwMM" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>AI tokens as the new engineer salary</strong>: Jensen Huang’s suggestion that engineers should accept AI tokens as half their base salary is the ultimate peak-bubble hallucination. Unlike cash or equity, these tokens don’t vest, don’t appreciate, and can’t pay your mortgage—they just create a high-pressure loop where you’re forced to produce at ‘superhuman rates’ to justify your own ‘compensation.’ It’s not a bonus; it’s a company store credit for the privilege of generating more technical debt. <a href="https://app.daily.dev/posts/Ryzsn8a9R" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
