Computer Science and Programming

Node.js 24.20.0 'Krypton' LTS ships several SEMVER-MINOR additions: using scopes for AsyncLocalStorage, an end parameter for Buffer, permission.drop and a new --permission-audit flag, package maps support in the loader, a new node:stream/iter module, context.log() in the test runner, and WebAssembly JSPI enabled. It also updates root certificates to NSS 3.125 and bundles numerous dependency upgrades (npm 11.19.0, ngtcp2, nghttp3, c-ares, sqlite, timezone data) plus a long list of bug fixes across crypto, buffer, http, http2, quic, and net modules.

pnpm 12 is now stable, a full Rust rewrite that preserves pnpm 11's commands, flags, settings, and lockfile format without requiring migration. It's installed via the next-12 npm tag since latest still points to pnpm 11. Breaking changes include git dependency specifiers resolving through canonical HTTPS URLs instead of SSH, unrecognized pnpm-workspace.yaml settings now being reported (and failing when a pnpm version is pinned), canonicalized lockfiles for cyclic dependency graphs (2-3x faster peer resolution, ~25% less memory on cycle-heavy workspaces), hardlink-first behavior for packageImportMethod: auto on Linux, and stricter engineStrict edge traversal. New features include project-aware global bins for node/deno/bun, pnpm provisioning other package managers (npm, Yarn, Bun) via pnx and pnpm shim, registry revisions for serving patched artifacts without version bumps, pnpm init pinning the latest pnpm version, batch approval for staged publishing, audit.ignorePrune, sudo restrict

A benchmark sweep of a PostgreSQL instance from 1 to 400 connections shows throughput peaking at 48 connections (18,039 tps) and dropping 37% by 400 connections, while average latency multiplied 13x. The piece explains why connections are OS processes competing for cores rather than free capacity, tests the Universal Scalability Law fit (R²=0.94, predicted optimum 45.1), evaluates the (cores×2)+spindles formula (predicts 9, far off the measured 48), and finds that synchronous_commit=off raises throughput but does not shift the peak. It closes with practical guidance: watch queue depth (cl_waiting in PgBouncer, pending-threads in HikariCP) rather than connection count, account for instances × pool size multiplication, and use transaction pooling or RDS Proxy for Lambda to avoid connection exhaustion.

A deep retrospective revisits years of Crunchy Data's Postgres advice on COPY, TOAST, BRIN indexes, covering indexes, and partitioning, mapping which Postgres versions (14 through the upcoming 19) changed the underlying mechanics while the core recommendations largely held. Highlights for Postgres 19 (currently in beta) include SIMD-accelerated COPY parsing, ON_ERROR SET_NULL, LZ4 becoming the default TOAST compression algorithm, native REPACK CONCURRENTLY, native MERGE/SPLIT PARTITION syntax, COPY TO working directly on partitioned parents, autoscaling async I/O workers, parallel autovacuum workers, and JIT being turned off by default after being on since version 12. The piece closes with a checklist of advice that remains unchanged across all these releases.

VoidZero, the company behind Vite founder Evan You, has launched the beta of Vite+, a unified web toolchain accessible through a single vp command. It bundles Vite, Vitest, Rolldown, tsdown, Oxlint and Oxfmt with a built-in task runner, offering commands like vp dev, vp check, vp test, vp build, vp pack and vp run. Since its alpha, the team has merged over 500 pull requests, expanded vp migrate coverage, and added enterprise features like organisation templates. Over 1,300 public repositories already use it, including Dify, BlockNote and Cloudflare's vinext. Reception on Hacker News was largely positive, though a widely shared GitHub write-up by Jared Wilcurt criticized its vp env Node version manager and warned about ecosystem lock-in and heavy reliance on Rust rewrites of existing tools.

A case study describes how MongoDB adopted GitDailies, a GitHub PR alerting and metrics tool, to help engineering teams meet PR review SLAs. Customizable alerts, Slack integration, and personalized dashboards replaced ineffective existing alerting, reportedly cutting review times by up to 54% for one team and over 28% for nearly half the teams involved.

An engineering leader shares why AI-based code review tools like Cursor's BugBot and custom Claude code review skills became too slow, noisy, and expensive (hitting $1000/day in one case) for a team producing thousands of PRs a quarter. The fix that worked: converting team-specific coding rules from markdown guidelines into custom linters, which run in seconds, are deterministic, can run in-editor and on pre-commit hooks, and stop agents from ever pushing bad code. Several example custom lint rules are shared, covering design system consistency, logging, testing conventions, and prose quality.

Almost every notable managed Postgres provider bundles a connection pooler like PgBouncer, according to a survey of major providers including AWS RDS, Azure, Google Cloud SQL, Supabase, Neon, DigitalOcean, and others. Only IBM Cloud and Oracle OCI lack a managed pooling option, and both are dismissed as unlikely choices outside enterprise sales cycles. The piece argues connection pooling is effectively a mandatory add-on because Postgres itself handles many connections poorly, and contrasts this with MySQL and MongoDB, which don't require a bolted-on pooler. The wasted effort of every provider building homegrown pooling setups and every user having to learn PgBouncer's quirks (like the lack of LISTEN/NOTIFY support) is framed as evidence that native connection pooling in Postgres itself would be a high-impact improvement.

A hands-on benchmark built with a Node harness and a byte-counting TCP proxy measures the real wire cost of WebSocket, SSE, and long polling delivering 1,000 events. WebSocket used 119,692 bytes, SSE 131,596 (10% more), and HTTP/1.1 long polling 884,698 bytes (7.4x), mostly re-sent headers. On HTTP/2, long polling drops to 182,475 bytes (1.56x payload). Latency differences at low event rates were under 0.3ms across all three; long polling only degrades when events arrive faster than a round trip. Server memory for 500 idle connections favored WebSocket (6.2-6.7MB) over SSE (11MB) and long polling (10.3-10.9MB). Practical failure modes covered include idle timeouts, proxy buffering, and the six-connections-per-origin HTTP/1.1 cap on SSE. The recommendation: build SSE first for server-to-client feeds, move to WebSocket only when upstream or binary data is needed.

(Light, Dark, System). The core argument is that users only seek out theme toggles when something is wrong — not to preemptively express intent — making the 'System' state irrelevant at the moment of interaction. Tri-state toggles expose the underlying data model rather than aligning with actual user goals, adding cognitive load and UI friction for an extremely rare use case. A well-implemented two-state toggle can still represent all three underlying states: the first click overrides to the opposite of the current resolved value, and the second click removes the override and returns to system default. Common mistakes include storing a value that matches the system preference (silently pinning the theme) or removing overrides when the OS preference changes. Exceptions where tri-state controls are appropriate include dedicated settings panels and sites that implement meaningfully different color schemes depending on the OS setting.

Dolt and Doltgres were using a secondary index for GROUP BY queries even when a full table scan would be faster. By analyzing EXPLAIN output and flame graphs, the team discovered that when a filter selects more than ~50% of rows, the secondary index lookup overhead outweighs its benefits. They added heuristics to the query coster: secondary indexes are only preferred when they select fewer than 25% of rows, while primary keys and covering indexes are always preferred. Using existing statistics histograms to estimate filter selectivity, this reduced groupby_scan latency by 57% on Dolt (144ms → 62ms) and 44% on Doltgres (147ms → 83ms), making Dolt faster than MySQL on this benchmark.

DuckDuckGo partnered with sunglasses brand Knockaround to release "Normal F**king Sunglasses" — a satirical product mocking AI-powered smart glasses. The glasses have no camera, microphone, AI, battery, or electronics of any kind. They sold out in under a week. The collaboration is a commentary on growing surveillance concerns around AI glasses, particularly following Meta's use of Ray-Ban Meta smart glasses footage to train its AI systems and the June 2026 launch of Meta Glasses.

PHP 8.6, scheduled for release on November 19, 2026, introduces several notable features: partial function application (PFA) for prefilling closure parameters, readonly property defaults (now allowed when implementing interfaces with property hooks), a new low-level Polling API for I/O multiplexing with epoll/WSAPoll backends, a built-in clamp() function, new isReadable/isWriteable reflection methods, function parameter doc comments via ReflectionParameter::getDocComment(), a SortDirection enum, debuggable enums via __debugInfo(), and improved session security defaults (HttpOnly, SameSite=Lax). The release also includes a large set of deprecations covering legacy functions (is_double, is_integer, is_long, doubleval, strcoll, metaphone, spl_classes, spl_object_hash), ArrayIterator methods, SplFileObject CSV methods, returning from finally blocks and constructors/destructors, and reserving keywords like let, is, and namespace for future syntax.

GitHub has retired the Copilot Billing Preview app. Copilot spend can now be managed directly in GitHub billing settings, which offers a more complete view including user-level budgets, cost centers, and usage pool allocation. Users can view AI usage, set spending budgets, access user-level budget controls for organizations and enterprises, and pull raw usage data via usage reports and the billing API.

Writers who rely on Substack as their primary digital home are making a strategic mistake. Substack and similar platforms are distribution tools, not permanent homes — when you build on someone else's platform, you're a tenant, not an owner. The POSSE model (Publish on your Own Site, Syndicate Elsewhere) offers a better approach: publish first to a domain you own and control, then use platforms like Substack purely as distribution channels. John Scalzi's 28-year independent blog is cited as a model of digital sovereignty. Platform algorithms favor dominant narratives, terms can change overnight, and content can be lost — owning your domain protects your long-term visibility and creative independence.

AI is eliminating entry-level developer work, but there's a less-discussed second effect: senior engineers are quietly losing their skills by only approving AI-generated output rather than doing the work themselves. The 'reasoning muscle' atrophies when judgment is never exercised. Meanwhile, no new seniors are being produced because the junior work that used to forge them is gone. Practical countermeasures include deliberately doing one thing the hard way each week, asking AI to defend its choices rather than just accepting answers, keeping a log of AI errors, and giving juniors the 'boring' work instead of offloading it to machines. No systemic fix is coming — individual engineers must maintain their own skills deliberately.

A CVE advisory (CVE-2026-59328) has been published for a Cross-Site Scripting (XSS) vulnerability found in the Eclipse Spring Boot Starter Wizard's dependency tooltips. The advisory is hosted on spring.io and relates to the Eclipse IDE plugin used for Spring Boot project setup.

DuckDB 1.5.5 has been released as the sixth patch in the 1.5 (Variegata) line. The release includes bugfixes, performance improvements, correctness fixes, crash and internal error resolutions, and security patches. Full release notes are available on GitHub, with v2.0.0 expected in the