[Dev Weekly #122] Open Frontier Intelligence is Here | Rails Under Attack | GitHub’s Game-Changing PR Stack
Table of Contents
HELLO EVERYONE!!! It’s July 31st, 2026, and you are reading the 122nd edition of Codeminer42’s tech news report. Let’s check out what the tech world showed us this week!
The Miners’ post of the week 🧑🏻💻👩🏽💻
From Tickets to Conversations: Upgrading Customer Support with Gladly — by Lucas Assis
One of our colleagues shares how he migrated an e-commerce client to Gladly, empowering their support team with live chat, seamless data integration, and a self-service Help Center. The result? Smoother workflows and better customer conversations!
A new way to bring native Windows APIs to JavaScript – introducing dynamic API projections for Node.js — by Leilei Zhang
Microsoft’s new dynamic Windows Runtime API projection for Node.js lets you call Windows APIs directly from JavaScript or TypeScript without C++ bridges or native addons. The tooling generates JavaScript wrappers and TypeScript declarations from Windows metadata, so you can access on-device AI, notifications, file pickers, and system APIs straight from Electron or Node.js with just an npm package.
npm publish-time malware scanning and dual-use metadata
npm now automatically scans packages before they’re installable, introducing a typical 5-minute delay with potential holds or blocks for suspicious content. If you maintain packages with security-relevant capabilities, you’ll need to declare dual-use metadata and enforce 2FA publishing to avoid getting blocked by default.
Node.js — Wednesday, July 29, 2026 Security Releases — by The Node.js Project
Node.js released critical security patches across the 26.x, 24.x, and 22.x release lines addressing 11 vulnerabilities, including three high-severity issues in HTTP/2 handling and the Permission Model. If you’re running Node.js in production, you’ll want to understand which CVEs affect your setup and prioritize the HTTP/2 memory exhaustion and permission bypass fixes that could impact most users.
Stacked pull requests are now in public preview
GitHub’s stacked pull requests break large changes into small, independently reviewable PRs that merge together in one click. If you’re tired of massive pull requests blocking reviews or managing manual rebases across branches, this native GitHub feature lets you review layers in parallel while keeping your existing branch protections and checks intact.
Critical Rails Flaw Could Let Unauthenticated Attackers Read Server Files via Image Uploads — by Swati Khandelwal
A critical vulnerability (CVE-2026-66066) in Rails Active Storage with libvips lets unauthenticated attackers read arbitrary server files through crafted image uploads, potentially exposing secrets like database passwords and API tokens. If you’re running Rails 7.0+, accepting image uploads, and using the default Vips processor, you need to upgrade immediately and rotate your secrets to prevent RCE and lateral movement attacks.
Kimi K3 Tech Blog: Open Frontier Intelligence
Kimi released K3, the first open 2.8T-parameter model with native vision, a 1M-token context window, and demonstrated frontier-level performance on long-horizon coding, chip design, and scientific research workflows. You’ll see concrete benchmarks against proprietary models plus detailed case studies showing how K3 handles everything from GPU kernel optimization to building compilers from scratch.
Maybe we should revisit microkernels
A deep dive into why microkernels faded in the 80s and 90s due to performance overhead, and why modern hardware like IOMMUs make them viable again today. You’ll learn how shared memory, atomic operations, and virtualization can eliminate context switches entirely, plus a practical roadmap for actually building one using existing components like Xen and FreeBSD.
Languages, Tools & Framework releases
RBS 4.1.0 — by soutaro
RBS 4.1 brings JRuby support by compiling the parser to WebAssembly, plus new inline syntax features like singleton method definitions and instance variable annotations. The release also introduces RBS::Rewriter for programmatically editing type signatures while preserving formatting, and includes significant performance improvements through type name interning.
Octane
Octane brings React’s familiar programming model to a compiled framework that eliminates virtual DOM overhead and the rules of hooks entirely. The compiler infers your dependencies and hook slots, letting you write cleaner component code while seeing 2-3x performance gains over React 19 across most benchmarks, with an incremental migration path through OctaneCompat for existing apps.
Argo — by Shreyas Karnik
Argo turns Playwright test scripts into polished product demo videos with AI voiceover and customizable overlays, all generated locally in one command. Write a demo in TypeScript, define scenes with narration and overlays in JSON, and get a production-ready MP4 with synchronized audio and visuals without leaving your terminal.
—
And that’s all for this week! Wish you all a great weekend and happy coding!
We want to work with you. Check out our Services page!
Gabriel Quaresma 
