# dependencies Published articles for dependencies. This is one page of public article previews, not the complete archive. Follow Next page to continue. Summaries are not the original full articles. ## Worker Backpressure (Part 1) DevFeed: [Worker Backpressure (Part 1)]() Original publisher: [Read original article]() Author: Mikalai Barysau Published: 2026-09-17T00:00:00Z Content type: article Language: en Sources: [Canva Engineering]() Topics: [backpressure](), [Back end](), [reliability]() Tags: [backend](), [backpressure](), [dependencies](), [outage](), [queue](), [reliability](), [worker]() ### AI overview Canva describes Worker Backpressure, a reliability mechanism for queue workers that slows processing when dependencies fail and speeds it back up after recovery. During a cloud-provider outage, the mechanism helped prevent failed messages from accumulating on the Dead Letter Queue and avoided an on-call page. ### Source excerpt How we taught Canva's queue workers to slow down when dependencies fail, then speed back up on their own. ## Untangling our Python Code DevFeed: [Untangling our Python Code]() Original publisher: [Read original article]() Author: Khan Academy Published: 2018-04-16T22:00:00Z Content type: tutorial Language: en Sources: [Khan Academy]() Topics: [Python](), [Code](), [import]() Tags: [code](), [dependencies](), [dependency](), [engineering](), [infrastructure](), [news](), [organization](), [python](), [refactor](), [structure]() ### AI overview This article explains how Khan Academy addressed tangled dependencies in its Python codebase during its 2017 and 2018 refactoring work. It describes why dependency order matters, the problems caused by circular and poorly organized imports, and the use of package-based rules to guide code organization and detect problematic dependencies. ### Source excerpt By Carter Bastian The previous posts about The Great Khan Academy Python Refactor of 2017 and Also 2018 ... Read more ## Vercel Sandbox now provides 64 GB of storage DevFeed: [Vercel Sandbox now provides 64 GB of storage]() Original publisher: [Read original article]() Author: Luke Phillips-Sheard Published: 2026-09-11T06:00:00Z Content type: release Language: en Sources: [Vercel News]() Topics: [Vercel]() Tags: [agent](), [dependencies](), [documentation](), [sandbox](), [sandboxes](), [storage](), [vercel]() ### AI overview Vercel Sandbox storage has increased from 32 GB to 64 GB for all sandboxes, including those created from managed or custom images and those using the deprecated runtime property. ### Source excerpt Every Vercel Sandbox now includes 64 GB of storage, up from 32 GB. This includes sandboxes created from a Vercel Managed Image or custom image, as well as those configured with the deprecated runtime property. The additional space provides more room for large repositories, dependencies, build artifacts, data workloads that spill to disk, and storage-intensive agent tasks. Learn more about Sandbox images in the documentation. Read more ## Koin Compiler 1.2: Compile-Time Safety for ALL Koin DSL DevFeed: [Koin Compiler 1.2: Compile-Time Safety for ALL Koin DSL]() Original publisher: [Read original article]() Author: Arnaud Giuliani Published: 2026-09-10T12:01:01Z Content type: release Language: en Sources: [Koin developers - Medium]() Topics: [Compiler](), [Kotlin](), [Gradle]() Tags: [compiler](), [dependencies](), [dependency-injection](), [gradle](), [implementation](), [koin](), [kotlin](), [kotlin-multiplatform]() ### AI overview Koin Compiler Plugin 1.2, with 1.2.1 as the latest patch, extends compile-time validation to Koin's reified, constructor, and classic lambda DSLs. It also adds visibility across Gradle modules, supports additional entry points, and provides one artifact for Kotlin 2.3.20 through 2.4.20 without requiring a DSL migration. ### Source excerpt Hello, dear Koin community 👋 I'm happy to share that Koin Compiler Plugin 1.2 is out, with 1.2.1 already available as the latest patch. Developer mascott unboxing new Koin Features!TL;DR Compile-time validation now works on the Koin application you already have, where before 1.2 it only covered code written specifically for the compiler plugin. Koin DSL -- All now covered! All Koin DSL: the plugin's reified DSL, Koin's constructor DSL (singleOf(::T)), and the classic lambda DSL (single { Foo(get()) }). Across Gradle modules: definitions are now visible two or more implementation hops away. More entry points: Ktor's install(Koin) and KoinApplication.withConfiguration(). One artifact for Kotlin 2.3.20 through 2.4.20. You get there with no migration to a new DSL, and nothing to rewrite. Let's go through what shipped. Covering now all Koin DSL Until now, compile-time safety only covered the plugin's own reified DSL, which means the two DSL styles you have most likely already written were invisible to it. val appModule = module { single() // checked singleOf(::UserRepository) // not checked before 1.2 single { AnalyticsHelper(get()) } // not checked before 1.2 } Three ways to declare a definition, and only the first was validated. If your UserRepository needed a Database that no module provided, your build passed and Koin threw at runtime. In 1.2, all three are validated. The two DSL styles get there differently. For the constructor DSL, the referenced constructor's parameters become real requirements, exactly like single(), and any named() qualifier you put on the registration is matched against the consumers that ask for it. The classic lambda DSL works differently. The plugin doesn't try to work out dependencies from free-form lambda code. What it validates instead are the get() calls you wrote inside the lambda, treated as ordinary resolution call sites. Before 1.2 those calls were skipped on purpose, because a hand-written get() is difficult to dis ## Quiz: An Effective Python Environment: Making Yourself at Home DevFeed: [Quiz: An Effective Python Environment: Making Yourself at Home]() Original publisher: [Read original article]() Author: Real Python Published: 2026-09-10T12:00:00Z Content type: article Language: en Sources: [Real Python]() Topics: [Python](), [Terminal](), [Command-line interface](), [pip](), [Poetry](), [coding]() Tags: [coding](), [dependencies](), [developers](), [poetry](), [python](), [terminal]() ### AI overview An interactive 13-question quiz tests understanding of effective Python development environments, covering shells and terminals, managing multiple Python versions, virtual environments, and dependency management with pip and Poetry. ### Source excerpt Test your understanding of Python environments, including shells, terminals, pyenv, virtual environments, and package managers like pip and poetry. ## Setting Up Koin in a Real Kotlin Multiplatform Project: A Step-by-Step Guide DevFeed: [Setting Up Koin in a Real Kotlin Multiplatform Project: A Step-by-Step Guide]() Original publisher: [Read original article]() Author: Gabriel Bronzatti Moro Published: 2026-09-07T12:01:03Z Content type: tutorial Language: en Sources: [Koin developers - Medium]() Topics: [Kotlin Multiplatform](), [compose-multiplatform](), [Kotlin](), [Android](), [iOS](), [ui]() Tags: [android](), [compose-multiplatform](), [dependencies](), [guide](), [implementation](), [ios](), [kmp](), [koin](), [kotlin](), [kotlin-multiplatform](), [mobile-app-development](), [module](), [viewmodel]() ### AI overview A step-by-step tutorial for setting up Koin in a Kotlin Multiplatform project targeting Android and iOS. It covers dependencies, data, domain, and UI modules, a platform bridge, platform entry points, and dependency injection in Composables. ### Source excerpt Hi everyone! 👋 In this article, we'll take a practical, step-by-step approach to setting up Koin in a real-world Kotlin Multiplatform (KMP) project. Instead of starting with an isolated example or a simple Hello World, we'll work with a project created by the CodandoTV community: the World Cup Best Team Simulator. The app allows users to browse football players by country and build their own dream team. It runs on both Android and iOS, using Kotlin Multiplatform for sharing business and data logic, and Compose Multiplatform to share the UI across platforms. Step 1: Add Koin Dependencies Add the Koin libraries to your version catalog: # gradle/libs.versions.toml [versions] koin = "4.2.2" [libraries] koin_core = { group = "io.insert-koin", name = "koin-core", version.ref = "koin" } koin_android = { group = "io.insert-koin", name = "koin-android", version.ref = "koin" } koin_compose = { module = "io.insert-koin:koin-compose", version.ref = "koin" } koin_compose_viewmodel = { module = "io.insert-koin:koin-compose-viewmodel", version.ref = "koin" } In the shared module shared/build.gradle.kts, split the dependencies by source set -- commonMain gets the shared Koin libraries, androidMain gets the Android-specific one: // shared/build.gradle.kts sourceSets { commonMain.dependencies { implementation(libs.koin.core) implementation(libs.koin.compose) implementation(libs.koin.compose.viewmodel) } androidMain.dependencies { implementation(libs.koin.android) } } In the Android app module androidApp/build.gradle.kts , add the Android Koin dependency: // androidApp/build.gradle.kts dependencies { implementation(libs.koin.android) implementation(libs.koin.core) }Step 2: Create the Data Module Create shared/src/commonMain/.../data/DataModule.kt . This module provides singleton instances -- repositories, and data sources that live for the entire app lifecycle. val dataModule = module { single { WorldCupRepositoryImpl(ioDispatcher = Dispatchers.IO) } }Step 3: Create ## Secretspec 0.20 DevFeed: [Secretspec 0.20]() Original publisher: [Read original article]() Author: domenkozar Published: 2026-08-31T19:28:39Z Content type: release Language: en Sources: [Announcements - NixOS Discourse]() Topics: [Nix](), [Git](), [Docker]() Tags: [announcements](), [dependencies](), [docker](), [git](), [refactoring](), [security](), [split]() ### AI overview SecretSpec 0.20 was released with five new providers, Git and Docker credential helpers, planned resolver IPC for Nix without introducing new dependencies, and separated secrets-handling refactoring in Nix. ### Source excerpt We've released secretspec 0.20, which includes 5 new providers, git and Docker credential helpers. Most importantly we're working towards releasing resolver IPC that Nix will be able to use without introducing new dependencies, which was the main review objection to existing PR. We've also split out secrets handling refactoring in Nix (PR). Disclaimer: LLMs have been used 5 posts - 2 participants Read full topic ## Security advisories: CVE-2026-80212 and CVE-2026-80213 DevFeed: [Security advisories: CVE-2026-80212 and CVE-2026-80213]() Original publisher: [Read original article]() Published: 2026-08-27T00:00:00Z Content type: news Language: en Sources: [Ruby-lang]() Topics: [Ruby](), [Vulnerabilities](), [Security](), [Network]() Tags: [2026](), [cve](), [dependencies](), [dependency](), [dns](), [end-of-life](), [memory](), [network](), [ruby](), [security](), [update](), [vulnerabilities]() ### AI overview Ruby's bundled resolv gem has two vulnerabilities: malicious DNS responses can cause unbounded memory exhaustion, and specially crafted overlong hostnames can bypass hostname validation. The advisory identifies affected versions and recommends updating the gem. ### Source excerpt Two vulnerabilities have been discovered in the resolv gem bundled with Ruby. They have been assigned the CVE identifiers CVE-2026-80212 and CVE-2026-80213. We recommend upgrading the resolv gem. CVE-2026-80212: Memory exhaustion through malicious DNS responses An application that resolves a hostname an attacker can influence, such as a webhook target or a user-supplied URL, can be made to consume memory without bound. The attacker points a domain at a name server they control and returns responses that the library retains permanently. Repeated lookups grow the process until it runs out of memory and the service stops. CVE-2026-80213: Hostname validation bypass An application that checks a hostname against an allow list or an SSRF filter and then resolves it can be made to look up a domain other than the one it checked. The string that passes validation and the name that reaches the network are not the same, so the connection can end up at a host the application never approved. This requires a hostname that exceeds the DNS length limits, so validation that rejects names longer than 255 octets, or labels longer than 63 octets, is not affected. Affected versions resolv gem 0.4.0 through 0.7.1 resolv gem 0.3.1 and earlier The version bundled with Ruby differs per series: Ruby 4.0 ships resolv 0.7.0, Ruby 3.4 ships 0.7.1, and Ruby 3.3 ships 0.3.1. What to check Only code that resolves names through this gem is affected. Ordinary socket connections, including Net::HTTP and anything built on TCPSocket, use the operating system resolver and are not. Net::HTTP does load the gem, but only for its IP address regular expressions, so a loaded gem is not by itself a sign of exposure. An application reaches the affected code by calling Resolv itself, by loading resolv-replace, which routes all socket name resolution through the gem, or through a dependency that resolves names this way. Check your dependencies as well as your own code. Recommended action Update the resolv gem to 0 ## Solving Gradle metadata and Renovate integration DevFeed: [Solving Gradle metadata and Renovate integration]() Original publisher: [Read original article]() Author: Nicolas Fränkel Published: 2026-08-16T00:00:00Z Content type: tutorial Language: en Sources: [Nicolas Fränkel]() Topics: [Gradle](), [renovate](), [Kotlin](), [Groovy]() Tags: [ci](), [dependencies](), [dependency](), [development](), [gradle](), [renovate](), [software-supply-chain](), [supply-chain-attacks](), [supply-chain-security]() ### AI overview The article describes setting up Renovate for a Gradle project and investigating why merges of updated dependency versions caused build failures. It also discusses dependency verification and software supply chain risks. ### Source excerpt My current company has settled on using Gradle. It doesn't make me very happy, but you need to learn to work with constraints. Plus, I must admit that the developers who actually implemented the build files did a pretty good job overall: they used Kotlin instead of Groovy, they moved code to regular plugins, etc. This week, I worked on improvements to a new project and set up Renovate. ## Super-comma-nix: A Rust helper for Nix shell and run commands with sandboxing DevFeed: [Super-comma-nix: A Rust helper for Nix shell and run commands with sandboxing]() Original publisher: [Read original article]() Author: ksvivek Published: 2026-08-14T08:01:27Z Content type: article Language: en Sources: [Announcements - NixOS Discourse]() Topics: [Nix](), [Rust](), [Command-line interface](), [Shell](), [ci]() Tags: [announcements](), [ci](), [code](), [command](), [commands](), [config](), [dependencies](), [developer-experience](), [environments](), [integrations](), [runner](), [rust](), [shell]() ### AI overview Super-comma-nix is a Rust command-runner helper for Nix that shortens common nix shell, nix run, and version-checking commands. It integrates with nix-output-monitor and landrun, supports configurable environment variables, and can produce commands without running them. ### Source excerpt Hi All super-comma is an ultra-fast, zero-dependency Nix command runner helper written in Rust and powered directly by nixpkgs-multiverse. It is inspired by the project comma nix. But my project is loaded with batteries and much more DX(Developer eXperience). You'll love it. This project makes the consumption easier for nix shell, nix run commands and versions list all with simple handy commands like ,(nix run) ,s(nix shell) ,v(versions checking) . The project have some cool flags and also integrations like nix-output-monitor and landrun for sandboxing all with just few flags. Dont want to type these nom and sandboxing flags verbose? U can add it to env variable for session or globally as like config. Go read the README, you'll love it. Though plenty of features, I sticked to this principle: Simple by default and powerful when needed So learn as u go. Want more integrations? Please feel free to raise an issue Sandboxing is pretty cool, u want to try a software but dont want it to connect to inernet? This project enables some real adhoc shell environments and with the sandboxing etc figure out the possibilities for everyday usage, CI etc The project has zero dependencies for rust. Coz this project just makes u type short commands and the program just does some splitting and joining of strings. So please feel free to unslop some logic written by the LLM there if u think it can be simplified. Skeptic coz LLM(though it'll change in future)? just use the program with -o flag and u can just use the program to give you the final command without running. The Github README is carefully crafted to explain all the features, so take your time there. I'm a nix and nixos user since 2024, so I know some nix and the project design and integration of nom and landrun etc purely my design and idea and instructed the llm with my knowledge. But i'm not having good rust knowledge, so that part is covered by LLM. I wanted to write it with PF languages like haskell etc, but I wanted to qui ## Inside Appwrite's new build cache: 4x faster dependency installs DevFeed: [Inside Appwrite's new build cache: 4x faster dependency installs]() Original publisher: [Read original article]() Author: Torsten Dittmann Published: 2026-08-13T00:00:00Z Content type: article Language: en Sources: [Appwrite Blog]() Topics: [Appwrite](), [Caching](), [Cache](), [Deployment](), [Next.js](), [Package manager](), [Compression](), [cloud-infrastructure]() Tags: [cache](), [compression](), [dependencies](), [deployment](), [engineering](), [filesystem](), [next-js](), [object-storage](), [pnpm](), [production]() ### AI overview Appwrite's build network caches dependencies between builds for sites and functions. The cache is restored before installation and saved after successful builds, with snapshots isolated per resource. The article explains how Appwrite uses SquashFS images to efficiently store and unpack package-manager data, reporting faster installs for example Next.js applications. ### Source excerpt A deep dive into how Appwrite now caches your dependencies between builds, and what it means for your deployment times. ## The Appwrite CLI is now written in Go DevFeed: [The Appwrite CLI is now written in Go]() Original publisher: [Read original article]() Author: Chirag Aggarwal Published: 2026-08-11T00:00:00Z Content type: article Language: en Sources: [Appwrite Blog]() Topics: [Appwrite](), [Command-line interface](), [Go Language](), [npm](), [TypeScript](), [JSON]() Tags: [announcements](), [cli](), [dependencies](), [go](), [json](), [npm](), [packages](), [typescript]() ### AI overview Appwrite rewrote its CLI from TypeScript and Node to Go while preserving the command surface, flags, exit codes, and JSON output. Measurements reported in the article show lower startup time, installation size, memory use during push, and binary size. ### Source excerpt The Appwrite CLI moves from TypeScript to Go. It starts 17 times faster and installs two packages in place of 330. Every flag, exit code, and byte of JSON output stays the same. ## Simplified onboarding for deepsec DevFeed: [Simplified onboarding for deepsec]() Original publisher: [Read original article]() Author: Malte Ubl Published: 2026-08-10T00:00:00Z Content type: release Language: en Sources: [Vercel News]() Topics: [Open Source](), [Security](), [Vercel](), [Artificial Intelligence]() Tags: [ai](), [dependencies](), [model](), [onboarding](), [open-source](), [security](), [vercel]() ### AI overview Vercel's open-source deepsec security review harness now provides simplified repository onboarding through a single command. It sets up an isolated workspace, configures model access, analyzes the codebase and attack surface, scans for patterns, and starts an AI review, with checkpointed resumption after interruptions or limits. ### Source excerpt deepsec, the open-source security review harness from Vercel, now lets you set up a repository and run its first security review with a single command. The init command now automates the standard setup process: creates the isolated .deepsec/ workspace, the only thing added to your repository, and installs its dependencies configures model access, through Vercel AI Gateway or your own provider keys generates a description of the codebase and its attack surface that every later review depends on runs a pattern scan, generating extra scan patterns where the built-in set leaves coverage gaps starts the AI review of the flagged files Setup is checkpointed after each step. If a run stops, whether from closing the process, a failed step, or a hit cost or duration limit, re-running init resumes from the last completed step. Run npx deepsec init to start your first scan, or read the docs to learn more. Read more ## Chainguard Libraries now available on AWS Security Hub Extended DevFeed: [Chainguard Libraries now available on AWS Security Hub Extended]() Original publisher: [Read original article]() Published: 2026-08-04T00:00:00Z Content type: article Language: en Sources: [Chainguard: Unchained]() Topics: [chainguard libraries](), [AWS Security Hub](), [Security](), [software supply-chain attack](), [Malware](), [Open Source](), [Amazon Web Services]() Tags: [ai-coding](), [aws-security-hub](), [axios](), [chainguard-libraries](), [dependencies](), [java](), [javascript](), [litellm](), [malware](), [mini-shai-hulud](), [npm](), [open-source](), [python](), [redhat](), [redhat-cloud-services](), [security](), [shai-hulud](), [software-supply-chain](), [software-supply-chain-attack](), [telnyx]() ### AI overview Chainguard Libraries is now available through AWS Security Hub Extended's Supply Chain category. The article presents it as a malware-free catalog of Python, Java, and JavaScript dependencies intended to reduce reliance on public registries and help protect AWS workloads from software supply-chain attacks. ### Source excerpt Chainguard Libraries is now available in AWS Security Hub Extended, delivering malware-resistant open source dependencies for AWS workloads. ## GitHub agentic workflows and Renovate DevFeed: [GitHub agentic workflows and Renovate]() Original publisher: [Read original article]() Author: Nicolas Fränkel Published: 2026-08-02T00:00:00Z Content type: tutorial Language: en Sources: [Nicolas Fränkel]() Topics: [GitHub](), [GitHub Actions]() Tags: [agentic-workflow](), [dependencies](), [github](), [github-actions](), [github-agentic-workflows](), [pull-requests](), [renovate](), [rollback](), [technical]() ### AI overview This article explains how Renovate dependency updates can break GitHub agentic workflows by changing an action SHA without updating the matching generated scripts. It also describes a failed recompilation workflow that rolled back an unrelated Node.js update, then identifies the need to keep the generated lock file synchronized with its release. ### Source excerpt I've been a big fan of Renovate for a couple of years already. Renovate scans your repositories, detects outdated package versions, and opens pull requests to automatically bump them. It's similar to Dependabot in that it keeps your dependencies up to date. If I had to compare them in one sentence, I'd say Renovate is less integrated in the GitHub ecosystem, but handles more ecosystems and, more importantly, is extensible. ## Tame Dependabot: Group your updates, slow the cadence, keep security fast DevFeed: [Tame Dependabot: Group your updates, slow the cadence, keep security fast]() Original publisher: [Read original article]() Author: Bruno Borges Published: 2026-07-29T16:00:00Z Content type: tutorial Language: en Sources: [GitHub]() Topics: [GitHub](), [pull-requests](), [configuration](), [Open Source]() Tags: [batch](), [build](), [ci](), [configuration](), [dependabot](), [dependencies](), [dependency](), [ecosystem](), [engineering](), [github](), [github-actions](), [logs](), [maintenance](), [open-source](), [pull-request](), [pull-requests](), [review](), [security](), [supply-chain-security]() ### AI overview This tutorial explains how to reduce Dependabot pull request noise by grouping dependency updates into a monthly batch while keeping security updates fast. It uses Microsoft's open source GCToolkit project as an example and describes the relevant configuration changes. ### Source excerpt Dependabot keeps your dependencies current, but its defaults can flood your repository with pull requests. Here's how grouping updates, slowing the cadence, and keeping security fixes fast cut the noise on a Microsoft open source project. The post Tame Dependabot: Group your updates, slow the cadence, keep security fast appeared first on The GitHub Blog. ## The challenge of adding a Web target to DroidconKotlin - Kevin Schildhorn DevFeed: [The challenge of adding a Web target to DroidconKotlin - Kevin Schildhorn]() Original publisher: [Read original article]() Published: 2026-07-22T18:00:00Z Content type: tutorial Language: en Sources: [Touchlab | Enterprise Mobile Innovation & Development]() Topics: [Web](), [multiplatform](), [Kotlin](), [compose-multiplatform](), [wasm](), [browser](), [Firebase]() Tags: [browser](), [browsers](), [compose-multiplatform](), [crashlytics](), [dependencies](), [droidcon](), [firebase](), [kotlin](), [kotlin-multiplatform](), [project](), [wasm](), [web]() ### AI overview This post explains how Touchlab added browser Web support to the DroidconKotlin multiplatform app. It covers dependency limitations, the decision to use Web instead of Kotlin WASM, SQLDelight support, Coil and Okio filesystem issues, the lack of Firebase Crashlytics Web support, and localization and resource handling with Compose Multiplatform. ### Source excerpt We recently added support for Web to our DroidconKotlin app. In this post we'll go over our process and the difficulties of adding a Web target to an existing project. ## Python function bundles now include precompiled bytecode DevFeed: [Python function bundles now include precompiled bytecode]() Original publisher: [Read original article]() Author: Elvis Pranskevichus Published: 2026-07-21T00:00:00Z Content type: release Language: en Sources: [Vercel News]() Topics: [Python](), [Vercel]() Tags: [benchmarks](), [dependencies](), [production](), [python](), [vercel]() ### AI overview Vercel now precompiles Python application code and dependencies to bytecode during builds and includes the compiled files in function bundles. This reduces median cold-start time from 2.8 seconds to 1.3 seconds, with smaller gains for functions near the bundle size limit. No code changes are required. ### Source excerpt Vercel now compiles Python functions to bytecode at build time. In our benchmarks, cold starts for the median-sized function dropped from 2.8s to 1.3s. Cold starts are already rare in practice. Pre-warmed instances keep at least one function instance active for production deployments on paid plans, and automatic concurrency scaling reduces how often new instances start cold. Precompiling to bytecode makes starts faster across the board, so proactive initialization finishes sooner and fewer requests ever hit a cold start. When Python imports a module without cached bytecode, it parses and compiles the source before executing it. That compilation step adds startup time for functions with large dependency trees. Vercel now compiles both application code and dependencies and includes the resulting .pyc files in the function bundle, so the interpreter skips compilation at startup. Vercel automatically adds as much precompiled bytecode as fits in the function bundle. Functions near the size limit have little room left, so they see smaller gains. No code changes are required. See the Python documentation to learn more about Python support on Vercel. Read more ## Codename One Settings Is Now a Standalone Tool DevFeed: [Codename One Settings Is Now a Standalone Tool]() Original publisher: [Read original article]() Author: Shai Almog Published: 2026-07-18T00:00:00Z Content type: release Language: en Sources: [CodeName One]() Topics: [configuration](), [Spring Boot](), [Extension](), [App]() Tags: [build](), [dependencies](), [desktop](), [extensions](), [install](), [legacy](), [project](), [tests](), [themes](), [ui]() ### AI overview Codename One Settings has been replaced by a standalone desktop application distributed through a Codename One Maven project. It focuses on project properties, build hints, themes, and extensions while keeping project files as the source of truth. ### Source excerpt Codename One Settings is now a focused Maven-distributed desktop tool for project identity, build hints, themes, and extensions. ## Vercel Sandbox now support Custom Images DevFeed: [Vercel Sandbox now support Custom Images]() Original publisher: [Read original article]() Author: Tom Lienard Published: 2026-06-30T00:00:00Z Content type: release Language: en Sources: [Vercel News]() Topics: [Vercel](), [toolchain](), [Docker](), [boot]() Tags: [boot](), [compute](), [container-registry](), [dependencies](), [docker](), [documentation](), [filesystem](), [images](), [os](), [performance](), [registry](), [sandbox](), [sandboxes](), [snapshots](), [toolchain](), [vercel]() ### AI overview Vercel Sandboxes now support custom images in public beta. Users can provide a custom root filesystem with their own operating system, toolchain, and dependencies. Images are pulled from Vercel Container Registry, and the feature is designed to preserve cold start performance through precompiled snapshots. ### Source excerpt Vercel Sandboxes now supports custom images. Launching in public beta today, images allow Sandboxes to start with your own custom root filesystem. Images are pulled from Vercel Container Registry, so anything you docker push is immediately available. Bring your own OS, toolchain and dependencies into the Sandbox without needing to spin up compute and create Snapshots. Images in the background for Fluid Compute and boot from a precompiled snapshot in the same format as our Sandbox Snapshots - so you get the convenience of a custom filesystem without sacrificing cold start performance. Read more about running images with Sandbox in the documentation. Read more ## 3 Resilience Patterns That Keep a Backend Service Up When Its Dependencies Aren't DevFeed: [3 Resilience Patterns That Keep a Backend Service Up When Its Dependencies Aren't]() Original publisher: [Read original article]() Author: The T-Shaped Dev Published: 2026-06-27T10:19:01Z Content type: tutorial Language: en Sources: [The T-Shaped Dev]() Topics: [Resilience](), [Back end](), [API]() Tags: [backend](), [circuit](), [dependencies](), [patterns](), [resilience](), [retry](), [timeout]() ### AI overview A tutorial on using timeouts, retries with backoff, and circuit breakers to limit cascading failures in backend services when dependencies become slow or unreliable. It explains how unbounded waiting can exhaust server resources and describes how to layer these resilience patterns. ### Source excerpt Timeout, retry with backoff, and circuit breaker -- what each one actually does, and the order to stack them. ## Fewer CVEs, more accurate findings: Wiz now scans Chainguard Libraries for Python and Java DevFeed: [Fewer CVEs, more accurate findings: Wiz now scans Chainguard Libraries for Python and Java]() Original publisher: [Read original article]() Published: 2026-06-25T00:00:00Z Content type: release Language: en Sources: [Chainguard: Unchained]() Topics: [chainguard](), [chainguard libraries](), [chainguard libraries for python](), [Java](), [supply-chain-security](), [Security]() Tags: [chainguard](), [chainguard-libraries](), [chainguard-libraries-for-java](), [chainguard-libraries-for-python](), [cves](), [dependencies](), [java](), [provenance](), [python](), [security](), [software-supply-chain](), [supply-chain](), [wiz](), [wiz-chainguard-libraries](), [wiz-chainguard-scanner]() ### AI overview Wiz now scans Chainguard Libraries for Python and Java. The partnership combines source-built dependencies and backported fixes with Wiz's risk context and visibility, helping organizations assess vulnerabilities, prioritize remediation, and verify artifact provenance. ### Source excerpt Wiz now scans Chainguard Libraries for Python and Java, combining trusted, source-built dependencies with risk-based visibility and remediation. ## Chainguard Libraries for Java is now GA; CVE remediation beta available for sign up DevFeed: [Chainguard Libraries for Java is now GA; CVE remediation beta available for sign up]() Original publisher: [Read original article]() Published: 2026-06-23T00:00:00Z Content type: release Language: en Sources: [Chainguard: Unchained]() Topics: [chainguard libraries](), [Java](), [Spring Boot](), [Security](), [Back end]() Tags: [chainguard](), [chainguard-libraries](), [chainguard-libraries-for-java](), [cve](), [cve-remediation](), [dependencies](), [java](), [java-packages](), [java-spring](), [open-source](), [provenance](), [sboms](), [scanner](), [security](), [zero-cve-packages]() ### AI overview Chainguard Libraries for Java is generally available, and its CVE remediation capability is available in beta. The article describes backported fixes for critical and high-severity CVEs across the Spring Boot ecosystem, helping teams manage risks in pinned or legacy Java dependencies while planning upgrades. ### Source excerpt Chainguard Libraries for Java is now GA, delivering CVE-remediated dependencies with SBOMs, provenance, and scanner-recognized fixes. ## CEL repositories move to the dedicated cel-expr GitHub organization DevFeed: [CEL repositories move to the dedicated cel-expr GitHub organization]() Original publisher: [Read original article]() Author: Google Open Source (noreply@blogger.com) Published: 2026-06-16T18:30:00Z Content type: release Language: en Sources: [Google Open Source Blog]() Topics: [GitHub](), [Git]() Tags: [announce](), [brand-identity](), [c-plus-plus](), [cel](), [common-expression-language](), [consistency](), [dependencies](), [dependency-management](), [development](), [discoverability](), [github](), [go](), [java](), [pull-requests](), [python]() ### AI overview The official Common Expression Language (CEL) repositories have moved from the Google organization to the dedicated cel-expr GitHub organization. The move centralizes the language specification and implementations, while redirects preserve existing links and repository history. ### Source excerpt by Olena Huang, CEL (Common Expression Language) team We're excited to announce that the official Common Expression Language (CEL) repositories have moved to a dedicated GitHub organization. Visit the new cel-expr repository now! Why the move? This move is a key step in strengthening the CEL ecosystem. By centralizing our projects, including the language specification, Go, C++, C, Java, and Python implementations, under the cel-expr organization, we aim to: Enhance Branding: Create a clear and unified brand identity for CEL. Improve Discoverability: Make it easier for users and contributors to find all official CEL resources in one place. Ensure Consistency: Foster consistency across all CEL projects. Streamline Development: Simplify our development and release processes. What's Changing? The following repositories now reside in the cel-expr organization: google/cel-spec is now cel-expr/cel-spec google/cel-cpp is now cel-expr/cel-cpp google/cel-go is now cel-expr/cel-go google/cel-java is now cel-expr/cel-java cel-expr/cel-python and cel-expr/cel-c have already been in the cel-expr namespace All future development, issues, and pull requests for these projects will take place in their new homes within the cel-expr organization. This is a non-breaking change, due to automatic redirects, but you should update your URLs where possible. What Stays the Same? We've worked to make this transition as seamless as possible: Automatic Redirects: GitHub will automatically redirect all web traffic and git operations from the old google/cel-* URLs to the new cel-expr/cel-* locations. Your existing links and git remote configurations pointing to the old URLs should continue to work for cloning and fetching. Preserved History: The full commit history, issues, and pull requests for each repository have been migrated and are available in the new locations. Action Required: Update Your Dependencies While existing links and git remote configurations pointing to the old URLs should conti [Next page]()