<h2>Must know</h2>
<ul>
<li><strong>Vite+ goes open source as a unified Rust toolchain</strong>: VoidZero has officially open-sourced Vite+, a unified toolchain that bundles Vite, Vitest, and the Rust-based Rolldown bundler into a single binary. This release aims to manage the entire local development lifecycle—from linting to building—with a built-in task runner that uses input fingerprinting for aggressive caching. According to Bytes by ui.dev, the launch coincides with the debut of Void, a native deployment platform for Cloudflare Workers. <a href="https://app.daily.dev/posts/dbyxVvRUE" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Malicious litellm release targets cloud credentials</strong>: A critical supply chain attack hit the litellm package on PyPI, where a malicious version exfiltrated SSH keys and cloud credentials from developer machines. The malware executed automatically on process startup and attempted to exploit Kubernetes service account tokens for lateral movement. Socket researchers report the attack was discovered when the package was pulled as a transitive dependency via an AI agent plugin, highlighting the extreme risk of deep dependency trees in agentic workflows. <a href="https://app.daily.dev/feed-by-ids?id=xt7JWjaFB&amp;id=9roAdsa2z" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Java 26 debuts with AoT caching and HTTP3</strong>: Java 26 has arrived with a focus on performance for AI workloads, introducing Ahead-of-Time (AoT) object caching that now supports all garbage collectors, including ZGC. The release also adds native HTTP/3 support and restricts the mutation of final variables via the Reflection API to harden the runtime. Oracle positioned this version as a foundational layer for Project Valhalla’s upcoming memory optimizations during the JavaOne keynote. <a href="https://app.daily.dev/feed-by-ids?id=NtwjCFOhL&amp;id=MXyjmyq8t" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
<h2>Good to know</h2>
<ul>
<li><strong>ClickHouse 26.2 stabilizes vector search</strong>: ClickHouse 26.2 promotes its text-index and QBit data types to production-ready status for high-precision vector search. <a href="https://app.daily.dev/posts/s8aRGzwrD" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Bun adds native ARM64 support and cron</strong>: Bun v1.3.11 introduces native Windows ARM64 shims and a new OS-level cron job scheduling API. <a href="https://app.daily.dev/posts/DuG54Q8tB" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>TypeScript and Vite dominate State of JS</strong>: The 2025 State of JS survey shows TypeScript usage hitting 40% while Vite reaches a 98% satisfaction rating. <a href="https://app.daily.dev/posts/rcBrZOPNH" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>IntelliJ IDEA opens free web tier</strong>: JetBrains is making core web development features free in IntelliJ IDEA v2026.1, including React support and Vite integration. <a href="https://app.daily.dev/posts/qYptuJh4r" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Deno 2.7 ships Temporal API</strong>: Deno 2.7 adds full Temporal API support and native Windows on ARM builds to eliminate emulation overhead. <a href="https://app.daily.dev/posts/KYgkb23L1" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Linux kernel gets 6x faster CRC64</strong>: A new ARM64-optimized CRC64 implementation for the Linux kernel shows a 6x performance boost using NEON instructions. <a href="https://app.daily.dev/posts/dpx9UrpjB" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Rust-core Python ORM beats incumbents</strong>: Oxyde ORM is a new Rust-powered Python ORM that claims to outperform SQLAlchemy and Django ORM in raw ops/sec. <a href="https://app.daily.dev/posts/GbDlMT2wK" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
<h2>Bullshit police</h2>
<ul>
<li><strong>Cursor caught rebranding Kimi as its own</strong>: Cursor recently ‘launched’ its Composer 2 model, only for users to discover it was actually Moonshot AI’s Kimi k2.5 under the hood. While Cursor’s team eventually admitted the non-disclosure was a ‘mistake,’ it’s a classic case of rebranding a Chinese open-weight model as proprietary magic until the API URLs gave it away. Apparently, ‘vibe coding’ includes vibing with other people’s weights without telling your customers. <a href="https://app.daily.dev/feed-by-ids?id=2O2HmWwMM&amp;id=6IlX0UUsy" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Delve compliance automation is just a fraud mill</strong>: The GRC startup Delve, which raised $32M to ‘automate’ compliance, is now accused of just fabricating evidence and using Indian certification mills to rubber-stamp SOC 2 reports. Leaked data shows 99.8% identical boilerplate across hundreds of ‘audits,’ meaning their ‘automation’ was likely just a copy-paste script. It’s a bold strategy to sell security compliance by committing what looks like massive fraud. <a href="https://app.daily.dev/feed-by-ids?id=48Uy5BKcM&amp;id=zmPU272WX" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>AI tokens are the new company scrip</strong>: NVIDIA is now pitching ‘AI tokens’ as a legitimate form of engineer compensation, suggesting they could make up half of a base salary. Critics rightly point out that tokens don’t vest, don’t appreciate, and can’t pay your mortgage, making this the most expensive ‘company store’ credit scheme in history. It’s a fantastic way for Jensen to turn his compute overhead into a fake employee benefit. <a href="https://app.daily.dev/posts/Ryzsn8a9R" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
