devotd.
Recent developments, checked against their sources.
Cloudflare’s October 12 technical post states that a failing Logpush Transformer does not send untransformed raw logs instead. The transformation boundary holds, but if failures continue, records in the affected batches are eventually dropped and cannot be recovered.
The DNS root began signing with KSK-2024 at 14:00 UTC on October 11. Validating resolvers, down to recovery images and standby systems, need to trust key tag 38696, and ICANN’s guidance is not to assume automatic updates succeeded.
Bun 1.4.3 adds bun check, a type checker ported from typescript-go, and a --check flag that gates running, testing and bundling. File-level --check follows only static imports, so covering workers or preload files still needs a separate whole-project check.
uv 0.13.0 changed the default Python download, when no version is requested or pinned, from 3.14 to 3.15. Handling of --require-hashes and editable entries in constraints files included with -c also became stricter, so installs that used to succeed can fail.
CodeQL 2.27.2, released October 7, rewrites the Go control flow graph on the shared CFG library, which can change what custom Go queries assume. On October 9 GitHub added that autobuild and manual modes for compiled languages are not supported on macOS 27.
On October 7 Microsoft made Microsoft Execution Containers (MXC) generally available to enforce access policy outside AI agents. Learning mode records while keeping denials, but permissive mode actually allows what it records, so the two modes produce different kinds of evidence.
VS Code 1.141 adds a cleanup view for seeing and removing the disk space used by inactive agent session worktrees. Restoring a session recreates its worktree, but the release notes do not say uncommitted local files come back.
On October 2 GitHub began expiring unvalidated npm trusted publishing configurations 48 hours after creation. Only a first successful publish exempts a configuration, and tokens from GitHub Actions issue_comment events are now rejected too.
Cloudflare’s CASB custom finding types, announced October 5, let teams define organization-specific posture rules in Rego. Evaluation happens only when an asset is created or updated, and assets left unchanged since before the rule existed are not scanned retroactively.
On October 5 GitHub added five secret types from Lovable, Pydantic and Supabase to secret scanning. The support table shows no push protection or validity checks for any of the five, and partner alerts do not appear in the repository UI.