TLDR Dev 2026-11-05

Your users want to connect GitHub. Oh, and Slack. Salesforce of course. And Stripe. And Gmail...

Each integration adds OAuth flows, tokens to store, and refresh logic to maintain. And with coding agents spinning up new integrations in minutes, it gets messy, fast.

WorkOS Pipes handles the connection flow, encrypted credential storage, and token refresh. Add the prebuilt widget so users can connect their accounts, then fetch an access token to call the provider's API.

You build what your app does with the connection. Pipes handles the credentials behind it.

Start building with Pipes →

OpenAI's autonomous security pipeline reproduced 1,724 Linux kernel vulnerabilities and generated exploits for 948 distinct local privilege escalation flaws at an API cost of $1.2 million. Agents handled discovery, runtime validation, exploit development, and candidate patches before human review and maintainer reporting. The research highlights why validation must check how an exploit succeeds, after some agents gained root through a different vulnerability than the one assigned.

Microsoft reduced clarity.js by 1,257 gzip bytes through more than 50 automated change, build, measure, and test experiments. Named imports and minifier settings delivered savings, while extracting small helpers sometimes increased compressed size. A larger saving from modern JavaScript output could not ship because native async functions would break Angular sites that depend on Zone.js.

Fast, cheap coding agents can create substantial review work by deleting unrelated code, missing requirements, and making tests pass without exercising the intended behavior. More than 100 hours with Cursor's Composer 2.5 exposed failures ranging from unsolicited edits to disabled schema validation and tests that bypassed API routes. Explicit rules and reference implementations did not reliably prevent repeated mistakes.

Agent systems accumulate debt when prompts and agent loops take responsibility for approvals, side-effect retries, and audit trails. A supplier invoice dispute illustrates how to divide ownership among the model, harness, durable execution, and an orchestration control plane. A single agent inside one application may need only its harness, while processes crossing systems need explicit ownership of recovery and approval.

An account of adopting coding agents at Intento traces the shift from small experiments to a team that delegates code generation and reviews the output. The key change was making documentation, architectural decisions, tasks, and production logs accessible to models. Earlier failures on an established codebase were attributed to missing context that lived in people's heads, rather than the age of the code itself.

Growing Postgres databases eventually hit a wall: queries slow, dashboards lag, and adding another database starts to feel inevitable. Tiger Data keeps Postgres fast as your data grows with time-series primitives, columnar storage, and automatic partitioning. No pipelines or second system needed. Get $1,000 in credits when you sign up for free.

Graphify turns code and supporting material into a queryable knowledge graph with paths between concepts and an interactive browser view. Code parsing uses local tree-sitter analysis without an LLM or vector store, while document and media interpretation can use a model. Edges distinguish explicit source relationships from inferred connections, making the graph's evidence easier to inspect.

This agent skill and dependency-free Node CLI control Chrome directly through the Chrome DevTools Protocol. It supports accessibility snapshots, tab management, screenshots, and raw protocol calls without requiring a separate browser MCP server. Screenshots are written to files so agents can choose when to load them into context.

Go 1.27 makes encoding/json/v2 and encoding/json/jsontext generally available, addressing behavior and performance constraints that could not be fixed within the old API. The new defaults reject invalid UTF-8 and duplicate object names, while the packages separate Go value conversion from lower-level JSON syntax processing.

This interactive study compares the original DOOM source with 43 descendants to explore what survives copying, porting, and translation. Structural fingerprints and call relationships can reveal ancestry even when names or source text change. In a blind test, a Go translation's functions were assigned to the correct game subsystem 60% of the time, compared with 20% for shuffled labels.

AI-assisted researchers turned a PHP crash bug reported in 2024 into a critical vulnerability capable of running arbitrary code on a server. Finding the exploit took two weeks, while four engineers spent two months developing a patch, illustrating the growing gap between discovering flaws and safely fixing them. Better funding for open-source maintainers, defensive AI tools, and formal verification could help close that gap.

OpenAI's Images 2.6 brings 50% faster image generation, GIF creation, and better consistency across edits.

Ricursive released Ripple-65B Preview, a dense open-weight model with up to 1M tokens of context that reports an 80.52 score on TerminalBench 2.1 and a total development and training cost of $32 million.

Parcel 3 rewrites the bundler in Rust and reports cold builds up to 100 times faster than v2.

Anthropic's public-beta message threads let active agents send only new messages each turn, reducing median time to first token by about 35% for requests with 500k to 1M tokens while leaving token usage unchanged.