DevHunt Daily
Sunday, October 25, 2026
- 1SecurityHacker News
Brotli decoder flaw (CVE-2026-111497) impacts Node, Python, Bun and other HTTP libraries
A critical out‑of‑bounds write in Brotli versions 1.0.3‑1.2.0 allows remote code execution. The vulnerability affects Node.js, Python packages, Bun and several other runtimes that decode Brotli. Developers should upgrade to patched Brotli versions or disable Brotli decoding until updates are available.
- 2Dev toolsHacker News
Roku moves all developer repositories from GitHub to GitLab
Roku has transferred its developer documentation, sample apps, and SDK tooling repositories from GitHub to GitLab, keeping repository names unchanged. Developers need to update any bookmarked URLs, submodule references, CI pipelines, or AI indexing to the new GitLab paths. The migration aims to centralize Roku's open‑source resources in one location.
- 3Open sourceHacker News
bbtree claims to be the fastest Rust B-tree map implementation
bbtree is a no‑std, zero‑dependency B‑tree map that the author says is up to five times faster than the standard library's BTreeMap on a single thread and scales to 12× faster than crossbeam‑skiplist on 96 threads, while using less memory. Developers may consider it as a drop‑in replacement for ordered maps in performance‑critical code.
- 4AIHacker News
Cerebras details how it runs trillion‑parameter models across multiple wafers
Cerebras explains its method for fitting and executing a 3‑trillion‑parameter model on its WSE‑3T wafer‑scale chips, using layer partitioning, 4‑bit quantization and RDMA token passing. Developers interested in large‑scale AI hardware deployment can see the required wafer count and pipeline approach.
- 5AIGitHub Trending
Google Gemini CLI offers terminal AI access but is being replaced by Antigravity CLI
The open‑source Gemini CLI lets developers run Gemini models from the command line, with installation via npm, Homebrew, or other package managers. As of June 18 2026 it is superseded for unpaid and Google One users by Antigravity CLI and isn’t optimized for Gemini 4 Argon, so developers should consider switching for the latest model support.
github.com44 stars today - 6AIGitHub Trending
NVIDIA releases OpenShell 0.1 with sandboxed AI agent runtime
OpenShell 0.1 adds stable releases, new isolation primitives, and policy APIs for running autonomous AI agents safely. It enforces file, system call, and network policies via kernel sandboxing and formal verification, supporting Linux, macOS, and Windows (WSL). Developers can use Docker, Podman, or Kubernetes to deploy it.
github.com896 stars today - 7CloudGitHub Trending
Hallmark adds anti‑AI design skill for Claude Code, Cursor and OpenCode
Hallmark is a design skill that generates web pages while avoiding typical AI‑generated patterns. It supports 48 themes, custom prompts, and can redesign or audit existing pages, useful for developers using AI coding tools.
github.com455 stars today - 8AIGitHub Trending
Cindy launches as an open-source AI agent that runs locally
Cindy is a new open-source AI agent that works out of the box on a developer's machine, integrating models like Claude Code and Codex. It can automate tasks across desktop, mobile and browsers, and supports local or cloud‑based operation, which may interest developers looking for customizable AI assistance.
github.com477 stars today - 9Dev toolsGitHub Changelog
Copilot usage metrics API now includes usage from tools like OpenCode
The Copilot usage metrics API adds a new totals_by_client field that reports model requests and token usage from external tools such as OpenCode. This lets enterprise and organization owners see how non‑IDE tools consume Copilot, aiding governance and support decisions.
github.blog - 10SecurityVercel
Vercel Agent uses scoped plans to request permissions for production fixes
Vercel Agent first investigates a deployment issue with read‑only access, then presents a plan that details required actions and scopes before any changes are made. Developers can review and approve each plan, ensuring the agent only uses permissions the user already possesses.
vercel.com - 11EngineeringLobsters
Docker is weird: author highlights oddities in container runtime
The author built a simple container runtime and observed several surprising aspects of Docker, such as containers being just processes, images being simple directories, and the reliance on root privileges. The post also critiques Go’s suitability for low‑level container tasks. Developers may find the insights useful for understanding Docker’s internals.
- 12LanguagesLobsters
Wild 0.11.0 released with enhanced linker script support and Mac port progress
Wild 0.11.0 adds default Wasm linking, expanded GNU linker script features, and improved Mac support, allowing Rust linking on macOS. It also introduces performance tweaks, thread limits, and new command‑line options. Developers using Wild as a linker will benefit from broader script capabilities and better cross‑platform builds.
- 13Dev toolsLobsters
Emacs adds unified folding interface with kirigami.el
The author configures Emacs 32.0.50 to use kirigami.el, which consolidates multiple folding engines (Tree‑sitter, Hideshow, Outline, Org) under a single set of keybindings. This provides consistent behavior and performance across programming and markup modes, simplifying navigation for developers.
