<h2>Must know</h2>
<ul>
<li><strong>Massive supply chain attack hits Axios npm package</strong>: A sophisticated compromise of the lead maintainer’s credentials led to the release of malicious Axios versions 1.14.1 and 0.30.4, which were downloaded millions of times. The attack injected a Trojan targeting macOS, Windows, and Linux to establish a remote backdoor. Security researchers at Socket and StepSecurity recommend immediate downgrades and credential rotation for anyone who updated in the last 48 hours. <a href="https://app.daily.dev/posts/RlEVDfzaA" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Vercel flips the switch on default CDN caching</strong>: Starting April 6th, Vercel will automatically honor upstream cache headers for all new projects using rewrites to external origins. This is a major shift from the previous ‘uncached by default’ behavior and could lead to stale data if your origin headers aren’t strictly configured. Existing projects are safe for now but can opt-in via the dashboard to simplify their edge caching logic. <a href="https://app.daily.dev/posts/8PlWagtQs" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Cloudflare opens AI-powered script protection to everyone</strong>: Cloudflare is making its domain-based threat intelligence free and expanding its ‘Client-Side Security’ to self-serve customers. The system uses a Graph Neural Network to analyze JavaScript ASTs in real-time, claiming a 200x reduction in false positives. This move aims to block zero-day supply chain attacks, like those targeting home routers via browser extensions, directly at the edge. <a href="https://app.daily.dev/posts/54dlhvQ2T" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
<h2>Good to know</h2>
<ul>
<li><strong>PHP 8.5 and beyond showcased in new haPHPiness gallery</strong>: A curated deep dive explores 67 modern PHP features from property hooks to asymmetric visibility, proving the language’s evolution into a type-safe powerhouse. <a href="https://app.daily.dev/posts/pI0jhMY9m" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Jane PHP v7.11 adds native OpenAPI 3.1 support</strong>: The update brings JSON Schema 2020-12 compatibility and more accurate PHP model generation that respects nullable types and schema constraints. <a href="https://app.daily.dev/posts/AJF01NE0h" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Laravel Debugbar v4.2 introduces Boost integration</strong>: The new release allows developers to inspect query backtraces, EXPLAIN results, and duplicate queries directly within the Laravel Boost skill. <a href="https://app.daily.dev/posts/nEwyAylwK" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Pinterest completes zero-downtime PyTorch 2.6 migration</strong>: The ML team detailed their cross-stack upgrade from Ubuntu 20 to 24, resolving TorchScript deadlocks and Caffe2 deprecation issues along the way. <a href="https://app.daily.dev/posts/36SNid6PL" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>QuickBEAM brings JS runtimes to the Erlang VM</strong>: This new runtime allows JavaScript contexts to run as GenServers within OTP supervision trees, supporting native DOM and TypeScript without Node.js. <a href="https://app.daily.dev/posts/kcgZ3hVcU" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Turborepo 2.9 slashes task computation time by 96%</strong>: By parallelizing filesystem walks and replacing git subprocesses with gix-index, the ‘Time to First Task’ on large monorepos dropped from 8s to 716ms. <a href="https://app.daily.dev/posts/DXD2CTDRc" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Chrome 148 fixes the sticky header and column nightmare</strong>: A CSS update allows ‘position: sticky’ to track axes independently, finally enabling simultaneous sticky headers and first columns in data tables. <a href="https://app.daily.dev/posts/XurEtHI42" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
<h2>Bullshit police</h2>
<ul>
<li><strong>GitHub Copilot is now literally an ad-supported IDE</strong>: Users are reporting that Copilot is ‘helpfully’ inserting promotional ads for itself and Raycast directly into their PR descriptions. It’s a bold move to take a paid tool and turn it into a billboard for other paid tools under the guise of ‘fixing a typo.’ We’ve officially reached the ‘pop-up ad’ era of software development. <a href="https://app.daily.dev/feed-by-ids?id=CBiU6JMgV&amp;id=D0DAOzcJD" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>The ‘Components Will Kill Pages’ prophecy is back</strong>: Visionaries are claiming that by 2031, websites will be replaced by JSON blobs rendered directly in AI chat interfaces. While ‘generative UI’ sounds futuristic, it’s mostly just a rebranding of APIs that we’ve had for decades, now wrapped in the hope that users will never want to leave a chat bubble. It’s a great way to sell a new component library, but a terrible way to browse the actual internet. <a href="https://app.daily.dev/posts/xi8EM3Cwt" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Elon Musk thinks compilers are going the way of the dodo</strong>: Musk claims LLMs will make programming languages and compilers obsolete, apparently forgetting that computers still don’t speak ‘vague English.’ If anything, the rise of AI slop makes rigorous, type-safe languages like Rust more vital for providing the feedback loops agents need to not hallucinate a segfault. Betting on the death of the compiler is a classic ‘I just discovered ChatGPT’ take. <a href="https://app.daily.dev/posts/4uc7pjBZI" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
