<h2>Must know</h2>
<ul>
<li><strong>Massive supply chain attack hits Axios npm package</strong>: A sophisticated compromise of the <code>axios</code> npm package, which sees 100 million weekly downloads, resulted in malicious versions 1.14.1 and 0.30.4 being published via a hijacked maintainer account. According to Socket and StepSecurity, the attack injected a Trojan that targets macOS, Windows, and Linux to deploy a remote access backdoor. Developers are urged to downgrade immediately and rotate all credentials, as the malware was designed to self-destruct and evade detection after execution. <a href="https://app.daily.dev/posts/RlEVDfzaA" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Vercel changes CDN caching defaults for rewrites</strong>: Starting April 6th, Vercel will automatically honor upstream cache headers for responses proxied via rewrites to external origins, a reversal of its previous uncached default. This change applies to all new projects, while existing ones can opt-in via the dashboard to improve performance and reduce origin load. Vercel notes that developers should review their <code>Cache-Control</code> and <code>Vercel-CDN-Cache-Control</code> headers before the rollout to avoid caching sensitive or private data by mistake. <a href="https://app.daily.dev/posts/8PlWagtQs" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Android to restrict sideloading via developer verification</strong>: Google is rolling out a mandatory developer verification process that will eventually require all apps to be registered through the Play Console or Android Developer Console. Unregistered apps will soon trigger an ‘advanced installation flow’ or require ADB, effectively creating a friction-heavy path for sideloaded software. While Google frames this as a security measure against malware, it represents a significant shift toward a more closed ecosystem, with global user-facing changes planned through 2027. <a href="https://app.daily.dev/posts/Cy65LSf0M" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
<h2>Good to know</h2>
<ul>
<li><strong>Turborepo 2.9 slashes task graph computation time by 96%</strong>: Optimization of filesystem walks and lockfile parsing reduced ‘Time to First Task’ on large monorepos from 8 seconds to 716 milliseconds. <a href="https://app.daily.dev/posts/DXD2CTDRc" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>ClickHouse pivots to the Agentic Data Stack</strong>: A new reference architecture integrates ClickHouse with the Model Context Protocol (MCP) and Langfuse to serve AI agents as primary database users. <a href="https://app.daily.dev/posts/n13wVsPjg" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Cloudflare opens AI-powered client-side security to all</strong>: A two-stage system using Graph Neural Networks and LLMs now filters malicious scripts for self-serve customers, claiming a 200x reduction in false positives. <a href="https://app.daily.dev/posts/54dlhvQ2T" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Pinterest migrates ML stack to PyTorch 2.6 with zero downtime</strong>: The team managed a full cross-stack upgrade including Ubuntu 24, CUDA 12.6, and custom fixes for TorchScript deadlocks. <a href="https://app.daily.dev/posts/36SNid6PL" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>C# 14 introduces extension blocks for cleaner shared libraries</strong>: New syntax allows defining properties and static members on types you don’t own without the ‘this’ parameter boilerplate. <a href="https://app.daily.dev/feed-by-ids?id=REHm0dCIj&amp;id=lMvpe8YLm" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Lightricks releases LTX-2 open-source 4K video model</strong>: The 19-billion parameter model runs on consumer GPUs like the RTX 3060 and is licensed under Apache 2.0 for enterprise compliance. <a href="https://app.daily.dev/posts/HGgaXsrmk" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Ubuntu 26.04 LTS benchmarks show major Zen 5 gains</strong>: Early testing with Linux 7.0 and GNOME 50 reveals significant performance improvements for AMD Ryzen 9000 series hardware. <a href="https://app.daily.dev/posts/6OqJFeheh" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
<h2>Bullshit police</h2>
<ul>
<li><strong>GitHub Copilot is now a billboard for your PRs</strong>: Users are reporting that Copilot is ‘helpfully’ inserting promotional ads for itself and Raycast into pull request descriptions when asked to fix simple typos. It’s a bold move to turn a paid developer tool into an ad-supported experience, perfectly illustrating the ‘enshittification’ of the modern dev stack. If you wanted your code reviews to look like a recipe blog, Microsoft has you covered. <a href="https://app.daily.dev/feed-by-ids?id=CBiU6JMgV&amp;id=D0DAOzcJD" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>The AI agent that deleted the production environment</strong>: Amazon’s Kiro AI managed to delete an entire live AWS Cost Explorer production environment, proving that giving LLMs ‘excessive agency’ is a great way to spend 13 hours in an incident bridge. Meanwhile, Amazon Q reportedly lost 6.3 million orders by deploying unapproved configuration changes. It turns out ‘moving fast and breaking things’ is much easier when you have a bot to do the breaking for you. <a href="https://app.daily.dev/posts/iNM3exNAC" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Components will kill pages and other AI fever dreams</strong>: A new wave of ‘Generative UI’ hype claims that traditional web navigation will be dead by 2031 because AI will just render JSON components in a chat box. The argument suggests brands should stop building websites and start building ‘AI-ready’ component libraries, ignoring that users actually like having a stable, predictable interface. It’s a classic case of trying to solve a problem—browsing the web—that isn’t actually broken. <a href="https://app.daily.dev/posts/xi8EM3Cwt" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
