<h2>Must know</h2>
<ul>
<li><strong>Cloudflare challenges Vercel with AI built Next.js clone</strong>: Cloudflare released VNext, a from-scratch reimplementation of the Next.js API built on Vite and the Rust-based Rolldown bundler. Developed in just one week using Claude Code for approximately $1,100 in tokens, it claims 94% API coverage and up to 4.4x faster production builds than standard Next.js. While Fireship and other sources note Vercel leadership has already dismissed it as a ‘slop fork,’ the project demonstrates the potential for AI to commoditize complex framework runtimes. <a href="https://app.daily.dev/feed-by-ids?id=zaBGmltYg&amp;id=he1DQDQSY" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Passive prompt injection enables GitHub repository takeovers</strong>: Security researchers at Orca Security disclosed RoguePilot, a critical vulnerability in GitHub Codespaces where hidden HTML comments in issues could hijack repositories. The attack tricks GitHub Copilot into checking out a PR with a malicious symlink to the GITHUB_TOKEN, which is then exfiltrated via VS Code’s automatic schema downloader. InfoSec Write-ups emphasizes that this bypasses traditional user interaction, requiring architectural shifts toward treating all AI context as untrusted input. <a href="https://app.daily.dev/posts/LAZy65aYK" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Cursor and Claude launch autonomous cloud agents</strong>: Cursor and Anthropic have both moved beyond simple chat to autonomous agents that operate in isolated virtual machines. These agents can build, test, and reproduce vulnerabilities independently, with Cursor reporting that 35% of its own internal pull requests are now agent-generated. This shift, supported by new integrations with Graphite and AWS, moves the developer role further toward high-level orchestration and governance of remote ‘digital workers.’ <a href="https://app.daily.dev/feed-by-ids?id=BbESdM4Ct&amp;id=YvAalh68B&amp;id=LBItm9B4M" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
<h2>Good to know</h2>
<ul>
<li><strong>React Foundation officially launches under the Linux Foundation</strong>: Meta has transferred governance of React, React Native, and JSX to a new foundation with founding members including Amazon, Microsoft, and Vercel. <a href="https://app.daily.dev/feed-by-ids?id=gtqWYzNzt&amp;id=7oOsPWKdE" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Cypress adds natural language test creation with cy.prompt</strong>: The new command allows developers to generate test steps using natural language while automatically stripping sensitive DOM values before sending context to AI models. <a href="https://app.daily.dev/feed-by-ids?id=0cqa7DEe2&amp;id=7wWHWaYQl" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Oxfmt beta claims 30x faster formatting than Prettier</strong>: A new Rust-powered JavaScript formatter has reached beta, promising 100% Prettier compatibility with significantly higher throughput. <a href="https://app.daily.dev/feed-by-ids?id=8i6IuWF7s&amp;id=7oOsPWKdE" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>npm introduces release age gating for improved security</strong>: Version 11.10.0 adds a minimumReleaseAge setting, allowing teams to enforce a cooldown period before installing newly published packages to mitigate zero-day supply chain attacks. <a href="https://app.daily.dev/posts/Tw6GntfNF" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>WebGPU delivers 8x speedup for browser based AI inference</strong>: Benchmarks show WebGPU drastically outperforms WebGL for large matrix operations, reducing Phi-3-mini latency from 320ms to 85ms on modern hardware. <a href="https://app.daily.dev/posts/bxfAW5Zzt" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Drizzle ORM and Shadcn UI become top picks for AI agents</strong>: Analysis of thousands of Claude Code sessions shows the agent decisively prefers Drizzle over Prisma and Shadcn over other UI kits when scaffolding new projects. <a href="https://app.daily.dev/posts/S8O8N5GRe" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Java 26 arrives with HTTP 3 support and UUIDv7</strong>: The latest release includes native HTTP/3 in the JDK client and formalizes UUIDv7 support, though most major features remain in preview. <a href="https://app.daily.dev/posts/VZeYyuIwk" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
<h2>Bullshit police</h2>
<ul>
<li><strong>Anthropic claims Chinese labs are launching distillation attacks</strong>: Anthropic is clutching its pearls over Chinese labs using ‘distillation’ to learn from Claude, which is rich considering they built their own empire by scraping the entire public internet without asking. Critics like those on T3 Chat point out that the ‘16 million exchanges’ Anthropic cited is a rounding error in modern traffic, making this look more like a political play for military contracts than a technical security report. <a href="https://app.daily.dev/feed-by-ids?id=n4TR5sqqd&amp;id=sw4iOpjCV" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>OpenAI principles have a 24 hour expiration date</strong>: Sam Altman spent Friday publicly agreeing with Anthropic’s ‘red lines’ against autonomous weapons, only to sign a massive Pentagon deal on Saturday that conveniently left those exact protections out. As noted by various industry observers, it turns out ‘safety’ is a great marketing slogan until it gets in the way of a $50 billion check from the Department of War. <a href="https://app.daily.dev/feed-by-ids?id=lOO0OBKve&amp;id=d0F5aH7Ci" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>The SaaS pocalypse is the new Y2K for investors</strong>: Venture capitalists are currently hyperventilating over a ‘SaaS-pocalypse’ where AI agents supposedly make all software free and destroy the industry by 2028. Analysts at Snowflake and elsewhere are rightly rolling their eyes, pointing out that enterprise inertia, data gravity, and the sheer complexity of things like Docusign’s 7,000-person operation aren’t going to vanish just because a chatbot can write a Todo list app. <a href="https://app.daily.dev/feed-by-ids?id=ZrqAcCr0p&amp;id=XhuxCGmpU" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
