A CVE advisory (CVE-2026-59328) has been published for a Cross-Site Scripting (XSS) vulnerability found in the Eclipse Spring Boot Starter Wizard's dependency tooltips. The advisory is hosted on spring.io and relates to the Eclipse IDE plugin used for Spring Boot project setup.

AI is eliminating entry-level developer work, but there's a less-discussed second effect: senior engineers are quietly losing their skills by only approving AI-generated output rather than doing the work themselves. The 'reasoning muscle' atrophies when judgment is never exercised. Meanwhile, no new seniors are being produced because the junior work that used to forge them is gone. Practical countermeasures include deliberately doing one thing the hard way each week, asking AI to defend its choices rather than just accepting answers, keeping a log of AI errors, and giving juniors the 'boring' work instead of offloading it to machines. No systemic fix is coming — individual engineers must maintain their own skills deliberately.

Writers who rely on Substack as their primary digital home are making a strategic mistake. Substack and similar platforms are distribution tools, not permanent homes — when you build on someone else's platform, you're a tenant, not an owner. The POSSE model (Publish on your Own Site, Syndicate Elsewhere) offers a better approach: publish first to a domain you own and control, then use platforms like Substack purely as distribution channels. John Scalzi's 28-year independent blog is cited as a model of digital sovereignty. Platform algorithms favor dominant narratives, terms can change overnight, and content can be lost — owning your domain protects your long-term visibility and creative independence.

GitHub has retired the Copilot Billing Preview app. Copilot spend can now be managed directly in GitHub billing settings, which offers a more complete view including user-level budgets, cost centers, and usage pool allocation. Users can view AI usage, set spending budgets, access user-level budget controls for organizations and enterprises, and pull raw usage data via usage reports and the billing API.

PHP 8.6, scheduled for release on November 19, 2026, introduces several notable features: partial function application (PFA) for prefilling closure parameters, readonly property defaults (now allowed when implementing interfaces with property hooks), a new low-level Polling API for I/O multiplexing with epoll/WSAPoll backends, a built-in clamp() function, new isReadable/isWriteable reflection methods, function parameter doc comments via ReflectionParameter::getDocComment(), a SortDirection enum, debuggable enums via __debugInfo(), and improved session security defaults (HttpOnly, SameSite=Lax). The release also includes a large set of deprecations covering legacy functions (is_double, is_integer, is_long, doubleval, strcoll, metaphone, spl_classes, spl_object_hash), ArrayIterator methods, SplFileObject CSV methods, returning from finally blocks and constructors/destructors, and reserving keywords like let, is, and namespace for future syntax.

DuckDuckGo partnered with sunglasses brand Knockaround to release "Normal F**king Sunglasses" — a satirical product mocking AI-powered smart glasses. The glasses have no camera, microphone, AI, battery, or electronics of any kind. They sold out in under a week. The collaboration is a commentary on growing surveillance concerns around AI glasses, particularly following Meta's use of Ray-Ban Meta smart glasses footage to train its AI systems and the June 2026 launch of Meta Glasses.

Dolt and Doltgres were using a secondary index for GROUP BY queries even when a full table scan would be faster. By analyzing EXPLAIN output and flame graphs, the team discovered that when a filter selects more than ~50% of rows, the secondary index lookup overhead outweighs its benefits. They added heuristics to the query coster: secondary indexes are only preferred when they select fewer than 25% of rows, while primary keys and covering indexes are always preferred. Using existing statistics histograms to estimate filter selectivity, this reduced groupby_scan latency by 57% on Dolt (144ms → 62ms) and 44% on Doltgres (147ms → 83ms), making Dolt faster than MySQL on this benchmark.

(Light, Dark, System). The core argument is that users only seek out theme toggles when something is wrong — not to preemptively express intent — making the 'System' state irrelevant at the moment of interaction. Tri-state toggles expose the underlying data model rather than aligning with actual user goals, adding cognitive load and UI friction for an extremely rare use case. A well-implemented two-state toggle can still represent all three underlying states: the first click overrides to the opposite of the current resolved value, and the second click removes the override and returns to system default. Common mistakes include storing a value that matches the system preference (silently pinning the theme) or removing overrides when the OS preference changes. Exceptions where tri-state controls are appropriate include dedicated settings panels and sites that implement meaningfully different color schemes depending on the OS setting.

A hands-on benchmark built with a Node harness and a byte-counting TCP proxy measures the real wire cost of WebSocket, SSE, and long polling delivering 1,000 events. WebSocket used 119,692 bytes, SSE 131,596 (10% more), and HTTP/1.1 long polling 884,698 bytes (7.4x), mostly re-sent headers. On HTTP/2, long polling drops to 182,475 bytes (1.56x payload). Latency differences at low event rates were under 0.3ms across all three; long polling only degrades when events arrive faster than a round trip. Server memory for 500 idle connections favored WebSocket (6.2-6.7MB) over SSE (11MB) and long polling (10.3-10.9MB). Practical failure modes covered include idle timeouts, proxy buffering, and the six-connections-per-origin HTTP/1.1 cap on SSE. The recommendation: build SSE first for server-to-client feeds, move to WebSocket only when upstream or binary data is needed.

Almost every notable managed Postgres provider bundles a connection pooler like PgBouncer, according to a survey of major providers including AWS RDS, Azure, Google Cloud SQL, Supabase, Neon, DigitalOcean, and others. Only IBM Cloud and Oracle OCI lack a managed pooling option, and both are dismissed as unlikely choices outside enterprise sales cycles. The piece argues connection pooling is effectively a mandatory add-on because Postgres itself handles many connections poorly, and contrasts this with MySQL and MongoDB, which don't require a bolted-on pooler. The wasted effort of every provider building homegrown pooling setups and every user having to learn PgBouncer's quirks (like the lack of LISTEN/NOTIFY support) is framed as evidence that native connection pooling in Postgres itself would be a high-impact improvement.

An engineering leader shares why AI-based code review tools like Cursor's BugBot and custom Claude code review skills became too slow, noisy, and expensive (hitting $1000/day in one case) for a team producing thousands of PRs a quarter. The fix that worked: converting team-specific coding rules from markdown guidelines into custom linters, which run in seconds, are deterministic, can run in-editor and on pre-commit hooks, and stop agents from ever pushing bad code. Several example custom lint rules are shared, covering design system consistency, logging, testing conventions, and prose quality.

A case study describes how MongoDB adopted GitDailies, a GitHub PR alerting and metrics tool, to help engineering teams meet PR review SLAs. Customizable alerts, Slack integration, and personalized dashboards replaced ineffective existing alerting, reportedly cutting review times by up to 54% for one team and over 28% for nearly half the teams involved.

VoidZero, the company behind Vite founder Evan You, has launched the beta of Vite+, a unified web toolchain accessible through a single vp command. It bundles Vite, Vitest, Rolldown, tsdown, Oxlint and Oxfmt with a built-in task runner, offering commands like vp dev, vp check, vp test, vp build, vp pack and vp run. Since its alpha, the team has merged over 500 pull requests, expanded vp migrate coverage, and added enterprise features like organisation templates. Over 1,300 public repositories already use it, including Dify, BlockNote and Cloudflare's vinext. Reception on Hacker News was largely positive, though a widely shared GitHub write-up by Jared Wilcurt criticized its vp env Node version manager and warned about ecosystem lock-in and heavy reliance on Rust rewrites of existing tools.