Flux
Couleur d'accent
Toutes les catégories

Programmation

2090 articles

pnpm 11.5 Adds Support for Recognizing npm Staged Publishes

pnpm 11.5 Adds Support for Recognizing npm Staged Publishes

pnpm 11.5 now treats npm staged publishing approvals as strong trust evidence, fixing a false-positive downgrade warning that could appear when packages used npm’s newer 2FA-backed release flow. The change lands as npm continues tightening package publishing controls after a series of credential theft and token abuse incidents. In the Mini Shai-Hulud campaign, attackers used stolen npm tokens to publish malicious package versions, prompting npm to invalidate granular access tokens and…

Socket
Uber Caps Usage of AI Tools Like Claude Code to Manage Costs

Uber Caps Usage of AI Tools Like Claude Code to Manage Costs

Uber Caps Usage of AI Tools Like Claude Code to Manage Costs I wrote the other day about Uber blowing its 2026 AI budget in four months, and how that wasn't particularly surprising given they would have set that budget in 2025, before anyone could have predicted how popular token-burning coding agents were about to become. Natalie Lung for Bloomberg: The rideshare giant is limiting all employees to $1,500 in monthly token spending per AI coding tool, an Uber spokesperson said in response to a…

Simon Willison's Weblog
Federal Audit Finds NIST Wasted Funds With No Plan to Clear NVD Backlog

Federal Audit Finds NIST Wasted Funds With No Plan to Clear NVD Backlog

A newly released federal audit now documents NIST’s long-running NVD backlog, with findings that are hard to square with two years of public assurances that the database was being brought back under control. The U.S. Department of Commerce Office of Inspector General found that NIST had no strategic plan for the National Vulnerability Database, set a public deadline it did not have the capacity to meet, delayed use of CISA enrichment data, and spent taxpayer funds on duplicated vulnerability…

Socket
Microsoft's new MAI models

Microsoft's new MAI models

Microsoft announced two new text LLMs this morning - MAI-Thinking-1 (reasoning, 1T parameters, 35B active, available to "select early partners") and MAI-Code-1-Flash (137B Parameters, 5B active, "purpose-built for GitHub Copilot and VS Code to deliver high performance and lower cost [...] rolling out to GitHub Copilot individual users in Visual Studio Code"). I've not been able to try either of them just yet. It's very interesting to see Microsoft releasing models with such low parameter…

Simon Willison's Weblog
Esc