Cilium: una NetworkPolicy con ipBlock abre todo el namespace
CVE-2026-56743. Una NetworkPolicy estándar de Kubernetes que usa reglas ipBlock basadas en CIDR sin pod ni namespace selector generaba erróneamente una regla wildcard de namespace. Pasa cuando Cilium está desplegado con un clusterName custom en lugar del any por defecto: el parser instancia un pod selector sobre peers que no lo tenían, y termina permitiendo tráfico desde cualquier otro workload del mismo namespace que el sujeto de la policy. Afecta >= 1.19.0, < 1.19.5.
Este es de los peores: tu policy parece correcta en el YAML y no lo es en el datapath. Si tenés clusterName custom, auditá.
Phoenix: canales sin límite por conexión y se cae la VM
CVE-2026-56811, CVSS 8.7. Los transports de Phoenix no limitaban la cantidad de canales por conexión, así que un atacante sin autenticar podía spawnear cientos de miles de procesos sobre una sola conexión hasta tocar el límite de max processes de la VM de Erlang. El fix limita canales por transport, obligando al atacante a abrir conexiones nuevas —lo que le da a tu rate limiter y a tu CDN algo con qué intervenir—. Parcheado en 1.5.15, 1.6.17, 1.7.24 y 1.8.9.
stream-json: el filtro estrella es O(profundidad²)
CVE-2026-71429. Los filtros pick, ignore, filter y replace —la feature estrella de «extracción quirúrgica» de la librería— recalculan el path completo desde el stack de anidamiento en cada token chequeable. Como el largo del stack es igual a la profundidad actual y se emite un token en cada nivel, procesar un documento de profundidad D cuesta O(D²), no O(D).
Lo dispara la estructura, no el volumen: un payload chiquito bloquea el event loop de segundos a minutos. Y no es un caso raro — es el ejemplo insignia del README, pick({filter: 'data'}). Parcheado en 3.5.0.
toml-node: prototype pollution por desincronización de key-path
Otro parser de configuración que corrompe Object.prototype vía una key __proto__, esta vez por desincronización del key-path. Viene acompañado de un segundo advisory por recursión no controlada. Dos parsers distintos (toml-node y TOON) cayendo con el mismo bug el mismo día no es coincidencia: si escribís un parser que construye objetos desde input externo, Object.create(null) o un Map, siempre.
Claude Code Templates: RCE sin autenticar en el server --studio
Command injection de OS sin autenticación en el server de Claude Code Studio que levanta el flag --studio. Severidad alta. Es el recordatorio de siempre sobre tooling de desarrollo: un server que arrancás «solo local» para probar algo termina escuchando en una interfaz que no esperabas, y no tiene ninguna capa de auth porque nadie pensó que hacía falta.
LiquidJS: loop infinito en el filtro strip_html
CVSS 8.7. El filtro strip_html entra en loop infinito con input crafteado. Si renderizás templates Liquid con contenido que viene de usuarios —CMS, emails transaccionales, páginas de marketing— tenés un DoS de un solo request. Parcheá.
Aurora MySQL 8.4.8 GA: TLS post-cuántico y transaction timeout
Lo grande es el key exchange PQ-TLS: cifrado resistente a cuántica para los datos en tránsito hacia tu base. Ya no es un tema de papers, está en un motor managed que podés prender.
Lo que te va a salvar el turno de guardia es más terrenal: transaction timeout, que corta operaciones largas antes de que te bloqueen el purge de InnoDB. Si alguna vez perseguiste una transacción zombie mientras el history list length se iba a la luna, sabés exactamente de qué hablo. Upgrade por minor version automático en la ventana de mantenimiento.
Aurora MySQL: replicación multi-source y delayed replication
Multi-source permite consolidar datos de varios orígenes MySQL en una sola réplica — el caso de uso obvio es consolidación de shards y backups centralizados. Delayed replication te deja configurar un lag deliberado: es tu red de seguridad contra el DELETE sin WHERE, porque te da una ventana para frenar la réplica antes de que el error se propague.
Redshift habilita RG.large de un solo nodo
Opción de costo bajo para workloads chicos que no necesitan alta disponibilidad. Sirve para dev, staging y data marts departamentales — no lo pongas en producción crítica, que un solo nodo es un solo punto de falla.
Lambda SnapStart llega a container images: de segundos a sub-segundo
SnapStart estaba limitado a runtimes managed (Python, .NET, Java). Ahora cubre funciones basadas en container images, que es donde el cold start más dolía: Lambda tiene que bajar layers de hasta 10 GB. El mecanismo es el de siempre — snapshot del entorno de ejecución ya inicializado al deployar, cacheado, y resume en la invocación en vez de arrancar de cero.
Si descartaste container images por el cold start en APIs interactivas o inferencia ML, volvé a medir. Disponible en casi todas las regiones (quedan afuera Asia Pacific New Zealand y Taipei).
ECS: los managed daemons ya pueden marcarse como no críticos
Ahora un daemon puede fallar sin interrumpir las tasks de aplicación críticas. Es una decisión de diseño más importante de lo que parece: tu agente de observabilidad o tu sidecar de logs es infraestructura de soporte, no debería tumbarte el servicio que factura. Separar criticidad de co-ubicación es exactamente lo que uno espera de un scheduler maduro.
workerd v1.20260904.1, el release diario del runtime de Workers
Cloudflare sigue con su cadencia diaria de releases del runtime de Workers. Vale la pena mirar el changelog si operás Durable Objects con conexiones de larga vida: la mayor parte del trabajo reciente viene siendo de correctitud alrededor de hibernación de WebSockets y retries de fetch al actor.
Reviews humanos sostenibles: saltear los PRs de bajo riesgo, profundizar en los que importan
Artie Shevchenko propone una estrategia de review por niveles de riesgo: los PRs de bajo riesgo pasan solo con aprobación de AI, y los cambios complejos reciben escrutinio humano profundo después de que el dev haya hecho un spike de la solución. La cita que ordena todo el argumento: «AI doesn't really understand anything; it generates tokens, creating an illusion of understanding».
El tradeoff está bien identificado y es el que casi nadie menciona: esto solo funciona con equipos chicos y ownership amplio del código. Si el review se concentra en tres personas, no ganaste velocidad — moviste el cuello de botella y le agregaste fatiga. Y ojo con lo que se pierde de verdad: el review humano no es solo control de calidad, es el loop de feedback por el que el conocimiento circula en el equipo. Si lo apagás para los cambios «rutinarios», estás decidiendo que los juniors no aprendan de ellos.
pnpm 12 en Rust: los números reales del rewrite
Ahora tenemos mediciones concretas del rewrite nativo: clean install de 8.2s a 5s, install cacheado de 472ms a 15ms, y en el workspace de Turborepo de Vercel reducciones de mediana del 64.4% al 90.5% en seis escenarios. La resolución de peer dependencies es 2–3x más rápida en workspaces con muchos ciclos, usando ~25% menos memoria.
El tradeoff honesto: el primer arranque sin cache es 11.1% más lento, aunque el cacheado mejora 74.7%. Y hay breaking changes que hay que leer: se va pnpm install --resolution-only (ahora pnpm peers check), las dependencias git resuelven por URL HTTPS canónica, en Linux se priorizan hardlinks antes que reflinks, y las claves desconocidas en pnpm-workspace.yaml ahora tiran error en vez de ignorarse en silencio — que es lo correcto, y probablemente lo que te rompa el CI.
Nx 23.2.0 estable: oxlint y oxfmt de primera clase, y Vitest por todos lados
Sale el estable después de los RCs. Lo relevante: plugin @nx/oxlint propio, soporte built-in de oxfmt junto a prettier, y generación de Vitest ofrecida de forma consistente en todos los generators vía la opción unitTestRunner — incluyendo node, nest y express. La cadena de tooling en Rust ya no es experimento.
Suma también soporte de dependency catalogs de Bun, nx migrate --run-migration para correr una sola migración, confirmación antes de crear commits de migración en la branch default, y la posibilidad de que el daemon y los plugin workers corran dentro de sandboxes de agentes.
pnpm 12.3: flags de supply chain en remove y update, y shims nativos en todas las plataformas
pnpm remove y pnpm update ahora aceptan --trust-lockfile, --trust-policy, --trust-policy-exclude y --trust-policy-ignore-after, los mismos flags que ya tenían install y add. Importante: pnpm remove verifica el lockfile contra las políticas activas igual que install, así que quitar un paquete ya no es un agujero en tu control de supply chain.
Además, todos los comandos globales context-aware (node, deno, bun y los shims de pnpm shim add) pasan a ser ejecutables nativos en todas las plataformas — en Windows <name>.exe reemplaza los shims .cmd y .ps1. En 12.3.2 sumaron que pnpm run y pnpm exec ya no reinstalan en filesystems con mtimes sub-milisegundo como NTFS.
TanStack Solid Start llega a 2.0.0-rc.5
Otro RC en la serie 2.0 de Solid Start, junto con @tanstack/solid-start-server. El ciclo de RCs viene largo y estable — si estás evaluando el stack fullstack de TanStack fuera de React, es buen momento para probarlo en una branch, todavía no para producción.
Tendencias Destacadas
Los doce advisories de Orval dicen algo incómodo sobre el codegen: <strong>tratamos los specs de OpenAPI como datos de configuración cuando en realidad son entrada a un compilador</strong>. Un backtick en un path se convierte en ejecución de código porque el generador construye strings en vez de construir AST. Si tu build corre codegen sobre un spec que no auditás vos, esa es una superficie de ataque con permisos de tu CI.
TOON y toml-node cayeron con prototype pollution el mismo día, y stream-json con un filtro cuadrático. Los tres son <strong>parsers</strong>. La conclusión práctica: cuando escribís un parser, las dos preguntas obligatorias son «¿qué pasa si la key se llama <code>__proto__</code>?» y «¿cuánto cuesta esto en función de la profundidad, no del tamaño?». Casi nadie hace la segunda.
Vitest 5, Nx 23.2 con oxlint/oxfmt y pnpm 12 en Rust apuntan todos al mismo lugar: <strong>la cadena de tooling de JavaScript se está reescribiendo en lenguajes nativos y ya no es experimental</strong>. Los números de pnpm (install cacheado de 472ms a 15ms) explican por qué. El costo es que estos saltos traen breaking changes de verdad — Node 22 mínimo en Vitest, claves desconocidas que ahora tiran error en pnpm. Planificá la migración, no la improvises.
El bug de Cilium y el de amqp091-go comparten un patrón que vale internalizar: <strong>la garantía la rompe algo que vos considerabas confiable</strong>. En Cilium, tu YAML es correcto y el datapath no lo respeta por una config de clusterName. En amqp091-go, el atacante es el broker con el que ya negociaste. Threat modeling que solo mira «input del usuario» se pierde estas dos categorías enteras.
Cilium: a NetworkPolicy with ipBlock opens the whole namespace
CVE-2026-56743. A standard Kubernetes NetworkPolicy using CIDR-based ipBlock rules without pod or namespace selectors erroneously generated a wildcard namespace allow rule. It triggers when Cilium is deployed with a custom clusterName instead of the default any: the parser instantiates a pod selector on selectorless peers and ends up allowing traffic from any other workload in the same namespace as the policy subject. Affects >= 1.19.0, < 1.19.5.
This is the nasty kind: your policy looks correct in the YAML and is not correct in the datapath. If you run a custom clusterName, audit now.
Phoenix: unbounded channels per connection take down the VM
CVE-2026-56811, CVSS 8.7. Phoenix transports did not limit the number of channels per connection, so an unauthenticated attacker could spawn hundreds of thousands of processes over a single connection until hitting the Erlang VM max-process limit. The fix caps channels per transport, forcing the attacker to open new connections — which finally gives your rate limiter and CDN something to act on. Fixed in 1.5.15, 1.6.17, 1.7.24, and 1.8.9.
stream-json: the flagship filter is O(depth²)
CVE-2026-71429. The pick, ignore, filter, and replace filters — the library's headline «surgical extraction» feature — recompute the full path string from the nesting stack on every checkable token. Since stack length equals current depth and a token is emitted at every level, processing a document of depth D costs O(D²), not O(D).
It is triggered by structure, not byte volume: a tiny payload blocks the event loop for seconds to minutes. And this is not an exotic path — it is the README's flagship example, pick({filter: 'data'}). Fixed in 3.5.0.
toml-node: prototype pollution via key-path desynchronization
Another config parser corrupting Object.prototype through a __proto__ key, this time via key-path desynchronization, alongside a second advisory for uncontrolled recursion. Two different parsers (toml-node and TOON) falling to the same bug on the same day is not coincidence: if you write a parser that builds objects from external input, use Object.create(null) or a Map, always.
Claude Code Templates: unauthenticated RCE in the --studio server
Unauthenticated OS command injection in the Claude Code Studio server started by the --studio flag. High severity. It is the standing reminder about developer tooling: a server you start «just locally» to try something ends up listening on an interface you did not expect, with no auth layer because nobody thought it needed one.
LiquidJS: infinite loop in the strip_html filter
CVSS 8.7. The strip_html filter spins into an infinite loop on crafted input. If you render Liquid templates over user-supplied content — CMS, transactional email, marketing pages — that is a single-request DoS. Patch it.
Aurora MySQL 8.4.8 GA: post-quantum TLS and transaction timeout
The headline is PQ-TLS key exchange: quantum-resistant encryption for data in transit to your database. No longer a paper topic — it is a toggle on a managed engine.
What will actually save your on-call shift is more down-to-earth: transaction timeout, which stops long-running operations before they block InnoDB purge. If you have ever chased a zombie transaction while the history list length climbed to the moon, you know exactly what this is worth. Upgrade via automatic minor version during the maintenance window.
Aurora MySQL: multi-source and delayed replication
Multi-source lets you consolidate data from several MySQL origins into a single replica — the obvious use case is shard consolidation and centralized backups. Delayed replication lets you configure deliberate lag: it is your safety net against the DELETE with no WHERE, because it gives you a window to stop the replica before the mistake propagates.
Redshift enables single-node RG.large
A low-cost option for smaller workloads that do not need high availability. Good for dev, staging, and departmental data marts — do not put it under critical production, since a single node is a single point of failure.
Lambda SnapStart reaches container images: seconds to sub-second
SnapStart was limited to managed runtimes (Python, .NET, Java). It now covers container image functions, which is exactly where cold start hurt most: Lambda has to pull layers up to 10 GB. Same mechanism as always — snapshot the initialized execution environment at deploy, cache it, and resume on invocation instead of initializing from scratch.
If you ruled out container images over cold start for interactive APIs or ML inference, go measure again. Available in most regions (Asia Pacific New Zealand and Taipei excluded).
ECS: managed daemons can now be marked non-critical
A daemon can now fail without interrupting mission-critical application tasks. That is a more important design decision than it looks: your observability agent or log sidecar is supporting infrastructure and should not take down the service that makes money. Decoupling criticality from co-location is exactly what you want from a mature scheduler.
workerd v1.20260904.1, the daily Workers runtime release
Cloudflare keeps its daily release cadence for the Workers runtime. Worth reading the changelog if you run Durable Objects with long-lived connections: most of the recent work has been correctness around WebSocket hibernation and actor fetch retries.
Sustainable human reviews: skip the low-risk PRs, go deep on the ones that matter
Artie Shevchenko proposes a review strategy tiered by risk level: low-risk PRs pass on AI approval alone, while complex changes get deep human scrutiny after the developer has spiked the solution. The quote that anchors the argument: «AI doesn't really understand anything; it generates tokens, creating an illusion of understanding».
The tradeoff is correctly identified and it is the one almost nobody mentions: this only works with small teams and broad code ownership. If review concentrates on three people, you did not gain velocity — you moved the bottleneck and added fatigue. And mind what is genuinely lost: human review is not only quality control, it is the feedback loop through which knowledge circulates in a team. Switch it off for «routine» changes and you are deciding that juniors will not learn from them.
pnpm 12 in Rust: the real numbers behind the rewrite
We now have concrete measurements for the native rewrite: clean install from 8.2s to 5s, cached install from 472ms to 15ms, and on Vercel's Turborepo workspace median reductions of 64.4% to 90.5% across six scenarios. Peer dependency resolution is 2–3x faster in cycle-heavy workspaces using about 25% less memory.
The honest tradeoff: the first uncached startup is 11.1% slower, though cached startup improves 74.7%. And there are breaking changes worth reading: pnpm install --resolution-only is gone (now pnpm peers check), git dependencies resolve through canonical HTTPS URLs, Linux prioritizes hardlinks before reflinks, and unknown keys in pnpm-workspace.yaml now throw instead of being silently ignored — which is correct, and probably what breaks your CI.
Nx 23.2.0 stable: first-class oxlint and oxfmt, and Vitest everywhere
Stable after the RCs. What matters: a dedicated @nx/oxlint plugin, built-in support for oxfmt alongside prettier, and Vitest generation offered consistently across generators through the unitTestRunner option — including node, nest, and express. The Rust tooling chain is no longer an experiment.
It also adds Bun dependency catalog support, nx migrate --run-migration to run a single migration, confirmation before creating migration commits on the default branch, and the ability to run the daemon and plugin workers inside agent sandboxes.
pnpm 12.3: supply-chain flags on remove and update, native shims everywhere
pnpm remove and pnpm update now accept --trust-lockfile, --trust-policy, --trust-policy-exclude, and --trust-policy-ignore-after, the same flags install and add already took. Important: pnpm remove verifies the lockfile against active policies the way install does, so removing a package is no longer a hole in your supply-chain control.
Also, every context-aware global command (node, deno, bun, and shims from pnpm shim add) becomes a native executable on every platform — on Windows <name>.exe replaces the .cmd and .ps1 shims. 12.3.2 adds that pnpm run and pnpm exec no longer reinstall on filesystems with sub-millisecond mtimes such as NTFS.
TanStack Solid Start reaches 2.0.0-rc.5
Another RC in the Solid Start 2.0 series, alongside @tanstack/solid-start-server. The RC cycle has been long and steady — if you are evaluating TanStack's fullstack story outside React, this is a good moment to try it on a branch, not yet in production.
Notable Trends
Orval's twelve advisories say something uncomfortable about codegen: <strong>we treat OpenAPI specs as configuration data when they are really compiler input</strong>. A backtick in a path becomes code execution because the generator builds strings instead of building an AST. If your build runs codegen over a spec you do not audit yourself, that is an attack surface holding your CI's permissions.
TOON and toml-node fell to prototype pollution on the same day, and stream-json to a quadratic filter. All three are <strong>parsers</strong>. The practical takeaway: when you write a parser, the two mandatory questions are «what happens if the key is named <code>__proto__</code>?» and «what does this cost as a function of depth, not size?». Almost nobody asks the second one.
Vitest 5, Nx 23.2 with oxlint/oxfmt, and pnpm 12 in Rust all point the same way: <strong>the JavaScript tooling chain is being rewritten in native languages and it is no longer experimental</strong>. pnpm's numbers (cached install from 472ms to 15ms) explain why. The cost is that these jumps carry real breaking changes — Node 22 minimum in Vitest, unknown keys now throwing in pnpm. Plan the migration, do not improvise it.
The Cilium bug and the amqp091-go bug share a pattern worth internalizing: <strong>the guarantee is broken by something you considered trusted</strong>. In Cilium, your YAML is correct and the datapath does not honor it because of a clusterName setting. In amqp091-go, the attacker is the broker you already negotiated with. Threat modeling that only looks at «user input» misses both of these categories entirely.
Cilium : une NetworkPolicy avec ipBlock ouvre tout le namespace
CVE-2026-56743. A standard Kubernetes NetworkPolicy using CIDR-based ipBlock rules without pod or namespace selectors erroneously generated a wildcard namespace allow rule. It triggers when Cilium is deployed with a custom clusterName instead of the default any: the parser instantiates a pod selector on selectorless peers and ends up allowing traffic from any other workload in the same namespace as the policy subject. Affects >= 1.19.0, < 1.19.5.
This is the nasty kind: your policy looks correct in the YAML and is not correct in the datapath. If you run a custom clusterName, audit now.
Phoenix : des canaux sans limite par connexion font tomber la VM
CVE-2026-56811, CVSS 8.7. Phoenix transports did not limit the number of channels per connection, so an unauthenticated attacker could spawn hundreds of thousands of processes over a single connection until hitting the Erlang VM max-process limit. The fix caps channels per transport, forcing the attacker to open new connections — which finally gives your rate limiter and CDN something to act on. Fixed in 1.5.15, 1.6.17, 1.7.24, and 1.8.9.
stream-json : le filtre phare est en O(profondeur²)
CVE-2026-71429. The pick, ignore, filter, and replace filters — the library's headline «surgical extraction» feature — recompute the full path string from the nesting stack on every checkable token. Since stack length equals current depth and a token is emitted at every level, processing a document of depth D costs O(D²), not O(D).
It is triggered by structure, not byte volume: a tiny payload blocks the event loop for seconds to minutes. And this is not an exotic path — it is the README's flagship example, pick({filter: 'data'}). Fixed in 3.5.0.
toml-node : prototype pollution par désynchronisation de key-path
Another config parser corrupting Object.prototype through a __proto__ key, this time via key-path desynchronization, alongside a second advisory for uncontrolled recursion. Two different parsers (toml-node and TOON) falling to the same bug on the same day is not coincidence: if you write a parser that builds objects from external input, use Object.create(null) or a Map, always.
Claude Code Templates : RCE non authentifiée dans le serveur --studio
Unauthenticated OS command injection in the Claude Code Studio server started by the --studio flag. High severity. It is the standing reminder about developer tooling: a server you start «just locally» to try something ends up listening on an interface you did not expect, with no auth layer because nobody thought it needed one.
LiquidJS : boucle infinie dans le filtre strip_html
CVSS 8.7. The strip_html filter spins into an infinite loop on crafted input. If you render Liquid templates over user-supplied content — CMS, transactional email, marketing pages — that is a single-request DoS. Patch it.
Aurora MySQL 8.4.8 GA : TLS post-quantique et transaction timeout
The headline is PQ-TLS key exchange: quantum-resistant encryption for data in transit to your database. No longer a paper topic — it is a toggle on a managed engine.
What will actually save your on-call shift is more down-to-earth: transaction timeout, which stops long-running operations before they block InnoDB purge. If you have ever chased a zombie transaction while the history list length climbed to the moon, you know exactly what this is worth. Upgrade via automatic minor version during the maintenance window.
Aurora MySQL : réplication multi-source et delayed replication
Multi-source lets you consolidate data from several MySQL origins into a single replica — the obvious use case is shard consolidation and centralized backups. Delayed replication lets you configure deliberate lag: it is your safety net against the DELETE with no WHERE, because it gives you a window to stop the replica before the mistake propagates.
Redshift active RG.large en nœud unique
A low-cost option for smaller workloads that do not need high availability. Good for dev, staging, and departmental data marts — do not put it under critical production, since a single node is a single point of failure.
Lambda SnapStart arrive sur les container images : de secondes à sous-seconde
SnapStart was limited to managed runtimes (Python, .NET, Java). It now covers container image functions, which is exactly where cold start hurt most: Lambda has to pull layers up to 10 GB. Same mechanism as always — snapshot the initialized execution environment at deploy, cache it, and resume on invocation instead of initializing from scratch.
If you ruled out container images over cold start for interactive APIs or ML inference, go measure again. Available in most regions (Asia Pacific New Zealand and Taipei excluded).
ECS : les managed daemons peuvent être marqués non critiques
A daemon can now fail without interrupting mission-critical application tasks. That is a more important design decision than it looks: your observability agent or log sidecar is supporting infrastructure and should not take down the service that makes money. Decoupling criticality from co-location is exactly what you want from a mature scheduler.
workerd v1.20260904.1, la release quotidienne du runtime Workers
Cloudflare keeps its daily release cadence for the Workers runtime. Worth reading the changelog if you run Durable Objects with long-lived connections: most of the recent work has been correctness around WebSocket hibernation and actor fetch retries.
Des revues humaines soutenables : sauter les PR à faible risque, approfondir celles qui comptent
Artie Shevchenko proposes a review strategy tiered by risk level: low-risk PRs pass on AI approval alone, while complex changes get deep human scrutiny after the developer has spiked the solution. The quote that anchors the argument: «AI doesn't really understand anything; it generates tokens, creating an illusion of understanding».
The tradeoff is correctly identified and it is the one almost nobody mentions: this only works with small teams and broad code ownership. If review concentrates on three people, you did not gain velocity — you moved the bottleneck and added fatigue. And mind what is genuinely lost: human review is not only quality control, it is the feedback loop through which knowledge circulates in a team. Switch it off for «routine» changes and you are deciding that juniors will not learn from them.
pnpm 12 en Rust : les vrais chiffres de la réécriture
We now have concrete measurements for the native rewrite: clean install from 8.2s to 5s, cached install from 472ms to 15ms, and on Vercel's Turborepo workspace median reductions of 64.4% to 90.5% across six scenarios. Peer dependency resolution is 2–3x faster in cycle-heavy workspaces using about 25% less memory.
The honest tradeoff: the first uncached startup is 11.1% slower, though cached startup improves 74.7%. And there are breaking changes worth reading: pnpm install --resolution-only is gone (now pnpm peers check), git dependencies resolve through canonical HTTPS URLs, Linux prioritizes hardlinks before reflinks, and unknown keys in pnpm-workspace.yaml now throw instead of being silently ignored — which is correct, and probably what breaks your CI.
Nx 23.2.0 stable : oxlint et oxfmt de première classe, et Vitest partout
Stable after the RCs. What matters: a dedicated @nx/oxlint plugin, built-in support for oxfmt alongside prettier, and Vitest generation offered consistently across generators through the unitTestRunner option — including node, nest, and express. The Rust tooling chain is no longer an experiment.
It also adds Bun dependency catalog support, nx migrate --run-migration to run a single migration, confirmation before creating migration commits on the default branch, and the ability to run the daemon and plugin workers inside agent sandboxes.
pnpm 12.3 : flags supply-chain sur remove et update, shims natifs partout
pnpm remove and pnpm update now accept --trust-lockfile, --trust-policy, --trust-policy-exclude, and --trust-policy-ignore-after, the same flags install and add already took. Important: pnpm remove verifies the lockfile against active policies the way install does, so removing a package is no longer a hole in your supply-chain control.
Also, every context-aware global command (node, deno, bun, and shims from pnpm shim add) becomes a native executable on every platform — on Windows <name>.exe replaces the .cmd and .ps1 shims. 12.3.2 adds that pnpm run and pnpm exec no longer reinstall on filesystems with sub-millisecond mtimes such as NTFS.
TanStack Solid Start atteint 2.0.0-rc.5
Another RC in the Solid Start 2.0 series, alongside @tanstack/solid-start-server. The RC cycle has been long and steady — if you are evaluating TanStack's fullstack story outside React, this is a good moment to try it on a branch, not yet in production.
Tendances Notables
Les douze advisories d'Orval disent quelque chose de gênant sur le codegen : <strong>nous traitons les specs OpenAPI comme des données de configuration alors qu'ils sont une entrée de compilateur</strong>. Un backtick dans un path devient de l'exécution de code parce que le générateur construit des chaînes au lieu d'un AST. Si votre build lance du codegen sur un spec que vous n'auditez pas, c'est une surface d'attaque dotée des permissions de votre CI.
TOON et toml-node sont tombés le même jour pour prototype pollution, et stream-json pour un filtre quadratique. Les trois sont des <strong>parsers</strong>. La conclusion pratique : en écrivant un parser, les deux questions obligatoires sont «que se passe-t-il si la clé s'appelle <code>__proto__</code> ?» et «combien cela coûte-t-il en fonction de la profondeur, pas de la taille ?». Presque personne ne pose la seconde.
Vitest 5, Nx 23.2 avec oxlint/oxfmt et pnpm 12 en Rust pointent tous dans la même direction : <strong>la chaîne d'outillage JavaScript est réécrite en langages natifs et ce n'est plus expérimental</strong>. Les chiffres de pnpm (install caché de 472ms à 15ms) expliquent pourquoi. Le coût : ces sauts portent de vrais breaking changes — Node 22 minimum dans Vitest, clés inconnues qui lèvent une erreur dans pnpm. Planifiez la migration.
Le bug Cilium et celui d'amqp091-go partagent un motif à intérioriser : <strong>la garantie est brisée par quelque chose que vous jugiez fiable</strong>. Dans Cilium, votre YAML est correct et le datapath ne le respecte pas à cause d'un réglage clusterName. Dans amqp091-go, l'attaquant est le broker avec lequel vous avez déjà négocié. Un threat modeling limité à «l'entrée utilisateur» rate entièrement ces deux catégories.