Blog
Insights on software development, security, and technology from our team.
Google Play's API 36 grace period is over, and the 2027 permission deadlines are already lined up
Since August 31, every new Android app and every update on Google Play has to target Android 16 (API level 36), and the extension to November 1 has now run out. Google has also scheduled new rules for contacts, local network access, precise location, AppFunctions and student-style subscription discounts through 2027. Here's how we'd plan for all of it.
DuckDB 2.0 can now run as a server. Here's when that changes your stack, and when it doesn't.
DuckDB 2.0.0 landed on October 21 as a long-term support release, and for the first time it can run as a networked server, not just an embedded engine. We break down when that server mode actually earns its place, why most teams should stay embedded, and the storage-format change that can break a mixed-version fleet on the first write.
AI pried a 20-year bug out of core PHP. Now it runs code on your server. Patch today.
AI agents helped Wiz Research dig two decades-old memory bugs out of core PHP, and the result is unauthenticated remote code execution on almost any server running it. The PHP team shipped emergency patches on October 21. Here is who is exposed, and what we would patch and restart first.
Bun 1.4.3 ships a type checker that beats tsc. Here's where it wins, and where it doesn't.
Bun 1.4.3 added bun check, a TypeScript type checker built into the binary that runs 3x to 6.4x faster than tsc 7.0.2 and reports nearly identical errors. It's a real win for CI, but it has no incremental mode, so warm tsc still beats it on your laptop. Here's how we'd decide.
The folding iPhone ships October 23. Here's what breaks in your app, and how to fix it.
Apple's first folding iPhone, the iPhone Duo, goes on sale October 23, and Xcode 27.1 brings a new set of adaptive-layout APIs to match. We break down what actually breaks in your app, the two patterns to grep for first, and why this is really a lesson about sizing against a container instead of a screen.
Vite+ 1.0 folds seven JS tools into one command. Here's when that trade pays off.
VoidZero shipped Vite+ 1.0 on September 28, putting Vite, Vitest, Oxlint, Oxfmt and a task runner behind a single `vp` command. It's a genuine win for new projects and a real decision for settled ones. Here's our read on when to adopt it and when to wait.
A Next.js OG-image bug can run code on your server. Patch to 16.3.6.
Vercel shipped an out-of-band Next.js update on September 22 to fix CVE-2026-94545, a critical remote code execution bug in the Node.js `ImageResponse` from `next/og`, scored CVSS 9.5. It only bites apps that feed visitor-controlled values into dynamic Open Graph images, but that describes most share-card setups. Here is who is exposed, why patching the framework alone may not be enough, and what to check today.
Shopify is leaving React Native for Swift and Kotlin. The reason isn't what you think.
Shopify is rebuilding its mobile apps in Swift and Kotlin, not because React Native was slow, but because AI agents changed the cost of two codebases. Here's what mobile teams should actually take from it, and the headless-logic trick that works whatever stack you're on.
React 19.3 makes View Transitions stable. Turn on Trusted Types while you're there.
React 19.3 shipped on September 9, 2026, promoting View Transitions and Fragment Refs to stable and adding Trusted Types support and a use(browser()) escape hatch. Here's what web, security, and mobile teams should actually do with it.
A PostgreSQL backup account can now run code on your server. Patch CVE-2026-6471.
PostgreSQL patched CVE-2026-6471, a flaw present since 2014 that lets a low-privilege REPLICATION account load arbitrary code and take over the database host. The official severity is 7.2, not critical, because it needs an account that backup tools, replicas and CDC pipelines all use. Here is how to patch, what the new output_plugin_libraries allowlist changes, and which service accounts to audit first.
React Native 0.87 makes the Strict TypeScript API the default. Here's your upgrade order.
React Native 0.87 landed on August 11, and it makes the Strict TypeScript API the default for every project. That turns deep imports into type errors and reshapes ref types, on top of experimental Swift Package Manager support, AGP 9, and a higher toolchain floor. Here is the upgrade order we would actually use, and the one grep that tells you how much work you are in for.
SQLite carried a corruption bug for 16 years. Here's why yours is probably fine, and what to check anyway.
Tailscale spent six months chasing database corruption that turned out to be a 16-year-old data race in SQLite's WAL mode. The fix landed in SQLite 3.51.3, but the real work for most teams is finding out which SQLite version they actually run and proving their backups restore clean. Here's what we'd do about it.