Developer Tools

npm v12 Is Here, and It Turns Off a Default That Has Run Arbitrary Code for a Decade

npm v12 went generally available on 8 July, flipping install scripts, Git dependencies and remote-URL packages from automatic to opt-in. The default is softer than the headlines suggest — but native builds are where teams will feel it.

11 Jul 2026 · 6 min read

Developer Tools

Apple Loses Its EU Gatekeeper Fight — What the DMA Ruling Actually Changes for Developers

On 8 July 2026, the EU General Court dismissed Apple's challenges to its Digital Markets Act gatekeeper designation for the App Store and iOS, confirming the designation and rejecting Apple's argument that its five app stores should count as separate services. But the ruling is narrower than the 'Europe forces the App Store open' headlines suggest: it confirms who the rules apply to and limits Apple's ability to challenge DMA obligations in the abstract before the Commission issues a specific enforcement decision — a procedural win, not a fresh order to open anything. For developers, it reinforces the framework behind alternative app marketplaces, anti-steering and interoperability without, on its own, delivering new access on day one.

11 Jul 2026 · 9 min read

Developer Tools

DuneSlide: Two Cursor Flaws Turn a Zero-Click Prompt Injection Into Code Execution

Cato AI Labs has disclosed DuneSlide — two critical remote-code-execution flaws in Cursor (CVE-2026-50548 and CVE-2026-50549, CVSS 9.8) that let a zero-click indirect prompt injection escape the AI editor's terminal sandbox and take over a developer's machine. The flaws are patched in Cursor 3.0, released 2 April 2026, and there is no evidence of exploitation in the wild — but they show that prompt injection can reach past the model layer into classical code paths, and that a sandbox alone cannot contain an autonomous coding agent when the untrusted content it reads can steer it.

7 Jul 2026 · 8 min read

Developer Tools

Cloudflare Splits AI Crawlers Into Search, Agent and Training — With New Ad-Page Defaults Coming in September

On 1 July 2026, Cloudflare split AI bot traffic into Search, Agent and Training categories for all customers, including the free tier. From 15 September, new defaults will block Training and Agent crawlers on ad-supported pages for new domains, new sites and unchanged Free-tier accounts, while mixed Search-and-Training crawlers may also be affected where Training is blocked.

6 Jul 2026 · 8 min read

Developer Tools

npm v12 Flips Three Install Defaults From Automatic to Opt-In — Prepare Your Pipelines Now

GitHub's npm v12, due July 2026, turns three things npm install does automatically today into choices you have to opt into: install scripts, Git dependencies and remote tarballs are all blocked by default. The behaviour is already available behind warnings in npm 11.16.0.

19 Jun 2026 · 5 min read

Developer Tools

WWDC 2026 for Developers: An Expanded Foundation Models Framework and an Agentic Xcode 27

Beyond the new Siri, WWDC 2026 gave developers an expanded Foundation Models framework — multimodal prompts and access to on-device, private-cloud and third-party models through one Swift API — plus App Intents wiring into Siri AI and an agentic Xcode 27. Here's what's new and what to do before iOS 27 ships.

9 Jun 2026 · 6 min read

Developer Tools

Miasma: How a Hijacked CI Pipeline Shipped Malicious npm Packages With Valid Provenance

The Miasma supply-chain attack didn't typosquat or steal an npm token — it hijacked a maintainer's CI pipeline and published malware with valid SLSA provenance. For developers, that changes which defences actually matter.

8 Jun 2026 · 7 min read

Developer Tools

NEXTDC Opens Peninsular Malaysia's First Tier IV Data Centre with RM2.8 Billion KL1 Launch in Petaling Jaya

NEXTDC officially opened KL1 in Petaling Jaya on 14 May 2026 — an AUD$1 billion facility that holds Peninsular Malaysia's first Uptime Institute Tier IV certification and delivers 65MW of AI-grade IT capacity.

1 Jun 2026 · 5 min read

Developer Tools

Indonesia's INA Locks In 30% Annual Allocation for AI and Data Centre Infrastructure

Indonesia's sovereign wealth fund INA has formalised a 30% annual cap on digital sector deployment, anchored by a joint venture with Singapore-headquartered DayOne — the GDS Holdings-founded operator now IPO-bound — and a record rupiah loan closed in mid-2025 that structured the 72 MW Batam campus now open.

1 Jun 2026 · 5 min read

Developer Tools

Microsoft Build 2026: Project Polaris Cuts Copilot's OpenAI Dependency, Copilot Workspace Ships to GA

Microsoft confirmed at Build 2026 in San Francisco that GitHub Copilot will run on Project Polaris — its own mixture-of-experts coding model — by August 2026, replacing GPT-4 Turbo as the default engine across all subscribers. Copilot Workspace went generally available the same day.

1 Jun 2026 · 5 min read