TLDR Dev 2025-12-12

Overprovisioning Kubernetes? If you're spending more than 30% of your cloud resources on inefficient, overly complex Kubernetes deployments, this Qovery guide is for you.

Read Kubernetes Best Practices for Production in 2026to learn:

1️⃣ How to implement specific resource management configurations and AI-powered operations to cut cloud costs.

2️⃣ What Pod Disruption Budgets (PDBs) and liveness/readiness probes can do to prevent downtime.

3️⃣ Which HPA, VPA, and Cluster Autoscaler configs will help you adapt to any traffic spike.

Get the guide ↗️

This article debunks widespread misinformation about the React2Shell vulnerability, explaining how React's 700-line obfuscated patch led researchers and AI tools to chase false leads like the $F primitive and property traversal gadgets that couldn't actually be exploited. The real vulnerability occurs much earlier in the RSC request lifecycle than expected, affecting any server processing RSC requests through multipart/form-data payloads with specific Flight protocol operators.

The React team has disclosed new high-severity Denial of Service (DoS) and medium-severity Source Code Exposure vulnerabilities in React Server Components. The DoS allows malicious requests to hang servers, while the exposure can leak hardcoded secrets from server functions, though neither enables Remote Code Execution. These issues are follow-ups to the recent React2Shell vulnerability. Previous patches (19.0.2, 19.1.3, and 19.2.2) were incomplete.

This dev paused his development on Boo, a personal code editor they built solely for themselves, to work on a new programming language. Boo was never intended for mainstream use or open-sourcing, and the repetitive work of it ruined their joy and ability to create inspiring software.

Modern software development increasingly uses obscure or "fun" names for tools and libraries, rather than descriptive ones, causing a cognitive burden for developers. This is different from other engineering fields and earlier programming practices, which prioritize clarity and function in their naming.

Shopify's developer platform is now AI-native. Your AI agents can create dev stores, scaffold apps, run GraphQL operations, and generate validated code across Shopify. The shopify.dev docs now render for LLM access on the server side - allowing agents to deliver more accurate code and answers. See all the new developer features

OpenAI has launched GPT-5.2, its most advanced frontier model, designed for professional knowledge work and long-running agents. This new model sets state-of-the-art benchmarks across various areas, including coding, long-context understanding, vision, tool-calling, and factuality, performing at or above human expert levels in knowledge tasks.

A new upvote system has been launched across web platforms like web.dev and caniuse.com for devs to directly vote for which web features are most important to them for browser vendors to prioritize.

SVG files can be used to create interactive, permanent, and shareable environments for scientific papers. They are powerful vector graphics that can embed data, be processed client-side to generate visualizations, and have interactive controls without server-side support. This makes them durable and easily shareable.

Modern software products are assembled from various third-party components, creating a complex "software supply chain" that is an easy target for attacks due to historically implicit trust. This vulnerability leads to risks like credential theft and widespread compromise, negatively impacting product outcomes, customer trust, and business revenue. The solution is to make trust explicit and verifiable using cryptographic attestations and frameworks to prove the origin and integrity of dependencies.

bidicalc is a bidirectional calculator that can change variable cells so that formula results match changes made.

If something matters, you have to encode it as a test, not just write a comment about it.

Traditional deprecation warnings are ineffective, so a funny way to force migration to newer versions is to make deprecated functions progressively return incorrect results.

Gemini Deep Research is now available to developers via the new Interactions API.