Blog
Insights on software development, security, and technology from our team.
React Native 0.87 makes the Strict TypeScript API the default. Here's your upgrade order.
React Native 0.87 landed on August 11, and it makes the Strict TypeScript API the default for every project. That turns deep imports into type errors and reshapes ref types, on top of experimental Swift Package Manager support, AGP 9, and a higher toolchain floor. Here is the upgrade order we would actually use, and the one grep that tells you how much work you are in for.
SQLite carried a corruption bug for 16 years. Here's why yours is probably fine, and what to check anyway.
Tailscale spent six months chasing database corruption that turned out to be a 16-year-old data race in SQLite's WAL mode. The fix landed in SQLite 3.51.3, but the real work for most teams is finding out which SQLite version they actually run and proving their backups restore clean. Here's what we'd do about it.
A polluted prototype can hijack your axios traffic. Upgrade to 1.18.0.
axios just disclosed CVE-2026-67320, a prototype pollution flaw in its Node.js HTTP adapter that can reroute your server's outbound requests through an attacker-controlled proxy and leak credentials over plaintext HTTP. It's a sharp reminder that a dependency you barely configure is still attack surface. Here's what to patch, and what to change beyond the patch.
React Compiler goes Rust, and Next.js 16.3 can already use it
The React team rewrote the React Compiler in Rust, and Vercel wired it into Turbopack. Next.js 16.3 reports 20 to 50% faster route compilation on the native path. We break down whether the experimental flag is worth flipping, and how to test it without risking production.
One POST request now owns a default WordPress site. Patch to 7.0.2 today.
WordPress just patched wp2shell, an unauthenticated remote-code-execution chain in core that turns one crafted request into a full site takeover on a default install. It affects versions 6.8 through 7.0.1, and public exploit code is already circulating. Here's what web and security teams should do this week, and how to check if you were already hit.
SwiftUI's @State just became a macro, and Xcode 27 will break some of your builds
WWDC 2026 turned SwiftUI's @State from a property wrapper into a macro. In Xcode 27 a common init pattern now fails to compile. The App Store floor is still iOS 26, so this is a chore you can schedule, not an emergency, if you start now.
A critical PhpSpreadsheet bug walked straight through its own patch
PhpSpreadsheet's fix for a phar deserialization bug got bypassed with a path carrying one extra slash. The new flaw, CVE-2026-45034, is a 9.2 critical: full remote code execution on PHP 7.x and a file-read primitive on PHP 8.x. Here is how the bypass works and what your team should do this week.
TypeScript 7.0 is 10x faster and written in Go. Here's how to adopt it without breaking CI.
Microsoft shipped the TypeScript 7.0 Release Candidate on June 18, 2026, and the big change is the compiler itself, now written in Go and roughly 10x faster than 6.0. It's a port rather than a rewrite, so the type rules stay the same. The smart move is to run it as a shadow CI job now and adopt it on your own schedule.
Node.js is dropping odd-versus-even. Here's how to plan your upgrades now.
Node.js is retiring the odd-versus-even release model that backend teams have leaned on for a decade. Starting with version 27, there's one major a year, every release becomes LTS, and a new six-month Alpha channel opens this October. Here's what that changes if you run Node in production, and the one CI job to add now.
Redis 8.8 finally has native arrays and a built-in rate limiter. Here's what to do with them.
Redis 8.8 just shipped with a native array data type and INCREX, a built-in rate-limiting command that replaces the hand-rolled Lua most teams run today. The features are genuinely useful, but the smart move isn't to upgrade on Friday. Here's how we'd approach it for a client, and the one audit worth doing this week regardless.
Android is officially Compose-first. Your View-based app is now legacy code.
At Google I/O 2026, Google made Jetpack Compose the official way to build Android UI and moved the View toolkit into maintenance mode. For the many production apps still built on Views, that turns a long-running question into a real decision. Here is how mobile teams should respond, without rewriting everything at once.
Apple and Google just made phones less sticky. Mobile teams need a new playbook.
iOS 26.5 shipped this week with wireless Transfer to Android, RCS end-to-end encryption, and a new App Store subscription tier. Hours later, Google's Android Show I/O Edition 2026 confirmed the cooperation runs both ways. Platform lock-in just got weaker, and that changes how mobile teams should think about retention and pricing.