P.01PostgreSQL 19 Beta 1 shipped with a REPACK command that finally makes VACUUM FULL and CLUSTER safe to run without a maintenance window, plus parallel autovacuum and smarter async I/O. Here's what changed and what to test now.
P.02Three maximum-severity UniFi OS flaws chain into unauthenticated root code execution and are being exploited in the wild by a Mirai-derived botnet. Here's what's affected, how the chain works, and how to patch it today.
P.03Astro 6.4 ships a pluggable markdown pipeline and Sätteri, a Rust-based processor that measurably speeds up builds on content-heavy sites. It also can't run your remark or rehype plugins yet. Here's when the trade is worth it.
P.04A circuit breaker stops your application from hammering a failing dependency until it recovers. Here's how the pattern works, the three states that make it up, and how to implement one without over-engineering a simple retry.
P.05OpenAI's GPT-5.6 preview splits into three tiers instead of one model: Sol for frontier work, Terra at half the cost of GPT-5.5, and Luna for high-volume calls. Here's what changed, what it costs, and which tier actually fits your workload.
P.06A command injection flaw in LiteLLM's MCP test endpoints, chained with a Starlette host-header bypass, lets an unauthenticated attacker run arbitrary commands on your AI gateway and steal every provider key behind it. Here's what's affected and how to patch.
P.07TC39 is standardizing signals as a native JavaScript primitive, the same reactive pattern already inside Vue, Solid, Angular, and Preact. It won't ship in browsers for years, but it changes what's worth building a library around today.
P.08FastAPI merged a significant router internals refactor on June 14, 2026, followed by app.frontend() for serving SPAs a week later. Routes are now preserved instead of cloned, dynamic route registration works, and serving a React or Vue frontend from FastAPI no longer requires a workaround.
P.09GitHub Copilot switched from Premium Request Units to AI Credits on June 1, 2026. Code completions remain unlimited. Everything else — chat, code review, pull request summaries — now draws from a monthly credit pool. Here's what you're actually paying for.
P.10In May and June 2026, two separate supply chain attacks hit the npm ecosystem — TanStack (42 packages) and React Native Aria (17 packages). They used different entry points, had different payloads, and should change how every team handles third-party dependencies.
P.11The State of JavaScript 2025 survey results landed in March 2026. 25,000+ responses, and the picture it draws is less 'everything is changing' and more 'the things that work are consolidating.' Vite at 98% satisfaction. TypeScript exclusive for 40% of developers. React dominant but contested.
P.12TC39 finalized ECMAScript 2026 with eight proposals at the March 2026 plenary. Temporal gets the headlines, but the rest of the spec (Iterator Helpers, new Set methods, Promise.try, RegExp.escape, and Float16Array) is worth understanding too. Here's what ships and when you can use it.