DevHunt Daily
Wednesday, November 4, 2026
- 1SecurityHacker News
Postman desktop auto-installs Codex and Claude Code plugins without user consent
Postman version 12.33.4 logs show it automatically installed Codex and Claude Code plugins and approved a startup hook that routes API tasks to Postman. The installer modifies user configurations, raising concerns about consent and trust for developers using the client.
- 2Dev toolsGitHub Trending
Worktrunk CLI simplifies git worktree management for parallel AI agents
Worktrunk is a command‑line tool that streamlines creating, switching, and removing git worktrees, targeting workflows that run multiple AI agents concurrently. It adds shortcuts, hooks, and copy‑on‑write caches to reduce repetitive git commands, helping developers manage parallel changes more efficiently.
github.com438 stars today - 3AIGitHub Trending
Colibri launches a C engine for running large MoE models on consumer hardware
Colibri is an open‑source inference engine written in C that runs mixture‑of‑experts models with hundreds of billions of parameters using CPU, Vulkan or CUDA. It streams model parts from disk and fits on machines with as little as 8 GB RAM, simplifying local deployment for developers.
github.com802 stars today - 4Dev toolsGitHub Trending
Scrapling releases Python web‑scraping framework with built‑in concurrency and AI integration
Scrapling is a new Python library that combines fast HTTP requests, stealth browsers, parsing, and concurrent crawling. It supports JavaScript rendering, proxy rotation, automatic retries and can be accessed via CLI, Python code, or an AI‑agent MCP server, which may interest developers building scrapers or automation pipelines.
github.com1,658 stars today - 5Dev toolsLobsters
kitty 0.50.0 adds custom shaders, vertical tabs and performance upgrades
The terminal emulator kitty 0.50.0 introduces official custom shader support, vertical tab layout, drag‑and‑drop between terminal and GUI apps, and several SIMD‑based performance improvements that can boost text throughput by up to 35%. Developers benefit from faster rendering and new UI features for more efficient workflows.
- 6DatabasesLobsters
Postgres 19 adds built‑in REPACK CONCURRENTLY for online table bloat cleanup
PostgreSQL 19 introduces REPACK CONCURRENTLY, a native command that removes table bloat while the table remains readable and writable, requiring only a brief final lock. This replaces external extensions like pg_repack and pg_squeeze, reducing operational complexity for production databases.
- 7SecurityLobsters
Ubuntu 26.04 Rust sudo ignores /etc/sudoers.d wildcards
Canonical's Rust implementation of sudo in Ubuntu 26.04 does not honor wildcard patterns in sudoers files, breaking configurations that rely on them. The issue prevents password‑less commands defined in /etc/sudoers.d from working, prompting administrators to revert to the traditional C sudo.
- 8OSLobsters
NetBSD 11.1 released with security fixes and hardware updates
The NetBSD project announced the 11.1 point release, focusing on security patches and bug fixes. It includes updated installation images for multiple architectures and detailed upgrade instructions. Developers using NetBSD will benefit from resolved kernel panics, improved hardware support, and updated libraries.
- 9SecurityGitHub Changelog
CodeQL 2.27.3 adds Python 3.15 support, JSON data extensions and query improvements
GitHub released CodeQL 2.27.3, which adds full Python 3.15 syntax support, JSON‑based data extensions, and new language features for C/C++, C#, and Ruby. The update also refines several security queries and changes the GitHub Actions control‑flow graph, requiring adjustments for custom queries. Developers using CodeQL or GitHub Actions should review the changes.
github.blog - 10SecurityVercel
Vercel Security Review enters public beta for Pro and Enterprise teams
Vercel now offers Security Review in public beta, automatically scanning code on every GitHub push for vulnerabilities and reporting findings in a dashboard. Developers can view AI‑generated severity, get suggested fixes, and apply fixes via Vercel Agent or CLI. The feature is free until November 2026 and billed per token thereafter.
vercel.com - 11SecurityCloudflare
Cloudflare launches Zero Wire, a vulnerability briefing feed on Radar
Zero Wire is a new public feed on Cloudflare Radar that provides plain-language briefings on critical Internet‑facing CVEs, including impact, remediation steps and links to vendor guidance. Security teams can use it to triage vulnerabilities faster and assess exposure to their infrastructure.
blog.cloudflare.com - 12AIHugging Face
StateBench benchmark evaluates long‑context state tracking in language models
AllenAI released StateBench, a benchmark that measures how well language models track entity states across long documents. It defines four difficulty levels and shows that recurrent and hybrid architectures outperform standard transformers on harder tracking tasks, which matters for code analysis and narrative understanding.
huggingface.co - 13AIHugging Face
Hugging Face proposes Model Integration Contracts to catch bugs early
Hugging Face introduced Model Integration Contracts (MICs), a standard that bundles a tiny fixture model, a usage example, and expected output baselines. MICs run fast CPU tests to detect regressions before code reaches main, helping developers avoid hidden bugs like the July 2026 UMT5 issue.
huggingface.co - 14AIGitHub Changelog
Dependabot adds version‑update support for Agent Package Manager
Dependabot can now open pull requests to update dependencies defined in apm.yml and regenerate apm.lock.yaml. The feature provides version‑update automation for AI agent skills and prompts, available on all GitHub plans and soon in GitHub Enterprise Server 3.24.
github.blog
