Developer Tools

npm v12 Is Here, and It Turns Off a Default That Has Run Arbitrary Code for a Decade

npm v12 went generally available on 8 July, flipping install scripts, Git dependencies and remote-URL packages from automatic to opt-in. The default is softer than the headlines suggest — but native builds are where teams will feel it.

11 Jul 2026 · 6 min read

Developer Tools

Apple Loses Its EU Gatekeeper Fight — What the DMA Ruling Actually Changes for Developers

On 8 July 2026, the EU General Court dismissed Apple's challenges to its Digital Markets Act gatekeeper designation for the App Store and iOS, confirming the designation and rejecting Apple's argument that its five app stores should count as separate services. But the ruling is narrower than the 'Europe forces the App Store open' headlines suggest: it confirms who the rules apply to and limits Apple's ability to challenge DMA obligations in the abstract before the Commission issues a specific enforcement decision — a procedural win, not a fresh order to open anything. For developers, it reinforces the framework behind alternative app marketplaces, anti-steering and interoperability without, on its own, delivering new access on day one.

11 Jul 2026 · 9 min read

Cloud & Infra

Wafr's $100M Cooling Raise Is Small — the AI Data-Centre Water Problem It Targets Is Not

Vancouver startup Wafr Technologies has raised $100 million from undisclosed private investors — toward a $300 million goal — for a thermal-battery cooling system it says can cut AI data-centre water use by up to 95% and cooling energy by up to 80%, the company announced on 3 July 2026. Those efficiency figures are Wafr's own and have not been independently validated, and the company has not announced a commercial deployment. But the problem it is chasing is real and increasingly urgent: cooling and water have become a genuine constraint on AI data-centre expansion, with a typical 100-megawatt US hyperscale facility consuming around two million litres of water a day.

9 Jul 2026 · 8 min read

Developer Tools

DuneSlide: Two Cursor Flaws Turn a Zero-Click Prompt Injection Into Code Execution

Cato AI Labs has disclosed DuneSlide — two critical remote-code-execution flaws in Cursor (CVE-2026-50548 and CVE-2026-50549, CVSS 9.8) that let a zero-click indirect prompt injection escape the AI editor's terminal sandbox and take over a developer's machine. The flaws are patched in Cursor 3.0, released 2 April 2026, and there is no evidence of exploitation in the wild — but they show that prompt injection can reach past the model layer into classical code paths, and that a sandbox alone cannot contain an autonomous coding agent when the untrusted content it reads can steer it.

7 Jul 2026 · 8 min read

Cloud & Infra

Meta Compute: Meta Is Reportedly Exploring a Cloud Business for Excess AI Capacity

Bloomberg reports that Meta is building a cloud business, internally called Meta Compute, to sell access to excess AI infrastructure to outside customers. Reuters says Meta declined to comment, so this remains a reported plan rather than a launched product; the clearer confirmed facts are Meta's rising AI capex and CoreWeave's $21 billion AI-capacity agreement with Meta through December 2032.

6 Jul 2026 · 7 min read

Developer Tools

Cloudflare Splits AI Crawlers Into Search, Agent and Training — With New Ad-Page Defaults Coming in September

On 1 July 2026, Cloudflare split AI bot traffic into Search, Agent and Training categories for all customers, including the free tier. From 15 September, new defaults will block Training and Agent crawlers on ad-supported pages for new domains, new sites and unchanged Free-tier accounts, while mixed Search-and-Training crawlers may also be affected where Training is blocked.

6 Jul 2026 · 8 min read

Developer Tools

npm v12 Flips Three Install Defaults From Automatic to Opt-In — Prepare Your Pipelines Now

GitHub's npm v12, due July 2026, turns three things npm install does automatically today into choices you have to opt into: install scripts, Git dependencies and remote tarballs are all blocked by default. The behaviour is already available behind warnings in npm 11.16.0.

19 Jun 2026 · 5 min read

Cloud & Infra

Three Singapore-Based Operators Moved Into South Korea's Data-Centre Market in Two Weeks

STT GDC opened its first South Korea data centre this month, days after Keppel and Digital Edge each moved on Greater Seoul. Singapore-based operators are expanding into a market where vacancy is around 1.4% and power, not demand, is the binding constraint.

19 Jun 2026 · 6 min read

Cloud & Infra

Dallas Tops the World's Data-Centre Ranking — but Northern Virginia Still Has the Most Capacity

Cushman & Wakefield ranked Dallas the world's top primary data-centre market for the first time in May 2026. But Northern Virginia, at 11.3 GW operational, is still the largest by installed capacity — the shift is about pipeline and power, not inventory.

19 Jun 2026 · 6 min read

Cloud & Infra

Who Pays for the Grid: The US Push to Make Data Centres Cover Their Own Power

US regulators and a voluntary federal pledge are shifting data-centre grid costs onto operators rather than households. In APAC the same demand pressure is rationed at the approval gate, not the meter.

19 Jun 2026 · 8 min read