<h2>Must know</h2>
<ul>
<li><strong>npm security gets a much-needed overhaul</strong>: GitHub is cracking down on npm supply chain attacks by mandating phishing-resistant WebAuthn/FIDO 2FA for all maintainers with write access. They’re also pushing Trusted Publishing with OIDC to ditch long-lived CI/CD tokens, and enforcing short-lived, granular credentials. This is a big deal for anyone relying on npm, as these changes aim to significantly reduce the blast radius of compromised accounts, as reported by GitHub and Threat Wire. It’s about time we got serious about package security.</li>
<li><strong>Enterprise AI agents are here, but it’s complicated</strong>: The enterprise is diving headfirst into AI agents, with a focus on context engineering over prompt engineering for production-ready systems. Companies like Anthropic and OpenAI are pushing agentic coding capabilities, but real-world adoption for complex, long-duration tasks is still aspirational. Key challenges include managing non-determinism, ensuring trust through governance, and integrating with legacy systems, according to a panel of enterprise AI specialists. It seems we’re still figuring out how to make these things play nice with actual business processes.</li>
<li><strong>IBM’s Granite 4.0: a new hybrid LLM for the enterprise</strong>: IBM just dropped Granite 4.0, an open-source family of small language models designed for speed and efficiency. These models use a hybrid architecture combining Mamba-2’s linear scaling with Transformer precision and Mixture-of-Experts routing. IBM claims a 70% reduction in memory usage for long contexts, making them suitable for RAG systems and AI agents, as highlighted by IBM and Replicate. They’re Apache 2.0 licensed and ISO/IEC 42001 certified, so go wild, enterprises.</li>
</ul>
<h2>Good to know</h2>
<ul>
<li><strong>Browsers are getting good enough to ditch frameworks</strong>: Modern browsers now natively handle routing, state management, and component isolation, making frameworks less of a technical necessity and more of a developer preference.</li>
<li><strong>DigitalOcean rolls out new organization and storage features</strong>: DigitalOcean launched ‘Organizations’ for unified billing and user management, plus storage autoscaling for Managed Databases and new NFS, Spaces cold storage, and usage-based backups.</li>
<li><strong>PHP 8.5 is coming with new features and JetBrains support</strong>: PHP 8.5 is slated for November 2025, bringing a pipe operator, #[NoDiscard] attribute, and improved debugging, while JetBrains is sponsoring key PHP open-source projects like Mago and PHPStan.</li>
<li><strong>AI-assisted security analysis finds real bugs in curl</strong>: Security researcher Joshua Rogers used five AI tools to find dozens of credible, previously undetected bugs in the curl codebase, proving AI can be effective when guided by human experts.</li>
<li><strong>Snowflake and Couchbase push AI-driven data platforms</strong>: Snowflake introduced Snowpark Python APIs for AI-based unstructured data processing, while Couchbase is marketing its database as an AI-ready solution for media and entertainment firms.</li>
<li><strong>OpenTelemetry Android nears stable release, KubeCon features</strong>: OpenTelemetry Android is prepping its 1.0.0 release candidate for October 2025 with a modular Kotlin-first approach, and KubeCon NA 2025 will host over 30 OpenTelemetry talks and a maintainer summit.</li>
<li><strong>Amazon adds ‘add to delivery’ feature for prime members</strong>: Amazon launched ‘Add to Delivery’ for U.S. Prime members, letting them append items to unshipped orders without extra shipping fees, targeting same-day or next-day deliveries.</li>
</ul>
<h2>Bullshit police</h2>
<ul>
<li><strong>Broadcom-VMware acquisition: the gift that keeps on taking</strong>: Broadcom’s acquisition of VMware has apparently triggered widespread discontent, with 74% of organizations reconsidering their VMware use due to increased pricing and altered software. Turns out, when you buy a company and immediately start squeezing customers, they tend to look for alternatives. Who knew? Now everyone’s scrambling to ‘modernize’ their infrastructure, which mostly means figuring out how to escape the Broadcom tax.</li>
<li><strong>SaaS spending: the CIO’s uncontrollable beast</strong>: Boston Consulting Group is here to tell us that SaaS spending has ballooned to 21% of IT budgets, and CIOs are struggling to control it. Apparently, consumption-based pricing and a fragmented vendor landscape make cost control ‘difficult.’ It’s almost like giving every department a credit card and telling them to buy whatever ‘AI-powered synergy solution’ they want leads to runaway spending. Shocking, I know.</li>
<li><strong>AI-powered music playlists: because your workout needs more ‘flow’</strong>: A fitness coach is sharing how AI-powered music tools can ‘optimize workout performance’ by matching BPM to movement cadence, leveraging ‘neuroscience research’ to reduce perceived effort and trigger ‘flow states.’ Because nothing says peak performance like an algorithm deciding your pump-up jams. Soon, we’ll have AI telling us when to breathe and how to tie our shoes, all in the name of ‘flow.’</li>
</ul>
