# dependency Published articles for dependency. This is one page of public article previews, not the complete archive. Follow Next page to continue. Summaries are not the original full articles. ## Untangling our Python Code DevFeed: [Untangling our Python Code]() Original publisher: [Read original article]() Author: Khan Academy Published: 2018-04-16T22:00:00Z Content type: tutorial Language: en Sources: [Khan Academy]() Topics: [Python](), [Code](), [import]() Tags: [code](), [dependencies](), [dependency](), [engineering](), [infrastructure](), [news](), [organization](), [python](), [refactor](), [structure]() ### AI overview This article explains how Khan Academy addressed tangled dependencies in its Python codebase during its 2017 and 2018 refactoring work. It describes why dependency order matters, the problems caused by circular and poorly organized imports, and the use of package-based rules to guide code organization and detect problematic dependencies. ### Source excerpt By Carter Bastian The previous posts about The Great Khan Academy Python Refactor of 2017 and Also 2018 ... Read more ## Laravel Vet: Review Composer Code Before It Installs DevFeed: [Laravel Vet: Review Composer Code Before It Installs]() Original publisher: [Read original article]() Author: Eric L. Barnes Published: 2026-09-15T13:33:11Z Content type: release Language: en Sources: [Laravel]() Topics: [Composer](), [Laravel](), [PHP](), [Security]() Tags: [dependency](), [laravel](), [news](), [php](), [plugin](), [security](), [supply-chain](), [trust]() ### AI overview Laravel Vet is a first-party Composer plugin that displays dependency code changes before installation, records trusted package files in vet.json, and blocks updates containing untrusted changes. It can also send changes to local coding agents for review. ### Source excerpt Laravel Vet is a new first-party Composer plugin that shows you the code in every dependency update and records the packages you trust in vet.json. The post Laravel Vet: Review Composer Code Before It Installs appeared first on Laravel News. Join the Laravel Newsletter to get Laravel articles like this directly in your inbox. ## What a Technical Program Manager actually does DevFeed: [What a Technical Program Manager actually does]() Original publisher: [Read original article]() Author: Dean Hume Published: 2026-09-14T15:54:31Z Content type: opinion Language: en Sources: [Dean Hume]() Topics: [Software Engineering]() Tags: [delivery](), [dependency](), [engineering](), [execution](), [meetings](), [ownership](), [project](), [software-engineering](), [teams](), [technical](), [technical-program-manager]() ### AI overview This article explains the role of a Technical Program Manager, focusing on the gaps between engineering teams, explicit ownership, cross-team dependencies, and proactive identification of release-blocking problems. ### Source excerpt What does a Technical Program Manager actually do? A look at the gaps they fill, the decisions they chase, and the reactive vs proactive split. ## Uptime Kuma 2.5.4 Patches Critical JSONata Code Execution Flaw DevFeed: [Uptime Kuma 2.5.4 Patches Critical JSONata Code Execution Flaw]() Original publisher: [Read original article]() Author: Christian Rakoot Published: 2026-09-14T06:55:25Z Content type: article Language: en Sources: [Self Host Lab]() Topics: [Security](), [vulnerability](), [Monitoring](), [configuration]() Tags: [2026](), [cve](), [dependency](), [monitoring](), [monitoring-news](), [news](), [security](), [update](), [uptime-kuma-2-5-4](), [vulnerability]() ### AI overview Uptime Kuma 2.5.4 fixes a critical JSONata vulnerability that could enable arbitrary code execution on the monitor host, along with a second denial-of-service issue. The release updates jsonata to 2.2.2 and also adds an SFTP monitor type and three notification providers. ### Source excerpt Uptime Kuma 2.5.4 patches a critical-rated code execution flaw in the JSONata library (CVE-2026-77415, CVSS 9.3) plus a second denial-of-service fix, and adds an SFTP monitor type and three new notification providers. Here's what the flaw actually requires to exploit, and how to update. ## How financial services companies can modernize their software supply chain DevFeed: [How financial services companies can modernize their software supply chain]() Original publisher: [Read original article]() Published: 2026-09-04T00:00:00Z Content type: article Language: en Sources: [Chainguard: Unchained]() Topics: [supply-chain-security](), [open-source-security](), [Security](), [Vulnerabilities](), [Business Security]() Tags: [cve](), [dependency](), [financial-services](), [legacy](), [security](), [software-supply-chain-security](), [vulnerabilities]() ### AI overview This article argues that financial services organizations should modernize software supply chain security while preserving business-critical systems. It explains that legacy infrastructure, regulatory obligations, and downtime concerns have encouraged deferred vulnerability remediation, but AI-assisted exploitation is making that risk increasingly dangerous. ### Source excerpt Modernize your financial software supply chain without disrupting critical systems. See how trusted open source reduces risk without major migrations. ## Security advisories: CVE-2026-80212 and CVE-2026-80213 DevFeed: [Security advisories: CVE-2026-80212 and CVE-2026-80213]() Original publisher: [Read original article]() Published: 2026-08-27T00:00:00Z Content type: news Language: en Sources: [Ruby-lang]() Topics: [Ruby](), [Vulnerabilities](), [Security](), [Network]() Tags: [2026](), [cve](), [dependencies](), [dependency](), [dns](), [end-of-life](), [memory](), [network](), [ruby](), [security](), [update](), [vulnerabilities]() ### AI overview Ruby's bundled resolv gem has two vulnerabilities: malicious DNS responses can cause unbounded memory exhaustion, and specially crafted overlong hostnames can bypass hostname validation. The advisory identifies affected versions and recommends updating the gem. ### Source excerpt Two vulnerabilities have been discovered in the resolv gem bundled with Ruby. They have been assigned the CVE identifiers CVE-2026-80212 and CVE-2026-80213. We recommend upgrading the resolv gem. CVE-2026-80212: Memory exhaustion through malicious DNS responses An application that resolves a hostname an attacker can influence, such as a webhook target or a user-supplied URL, can be made to consume memory without bound. The attacker points a domain at a name server they control and returns responses that the library retains permanently. Repeated lookups grow the process until it runs out of memory and the service stops. CVE-2026-80213: Hostname validation bypass An application that checks a hostname against an allow list or an SSRF filter and then resolves it can be made to look up a domain other than the one it checked. The string that passes validation and the name that reaches the network are not the same, so the connection can end up at a host the application never approved. This requires a hostname that exceeds the DNS length limits, so validation that rejects names longer than 255 octets, or labels longer than 63 octets, is not affected. Affected versions resolv gem 0.4.0 through 0.7.1 resolv gem 0.3.1 and earlier The version bundled with Ruby differs per series: Ruby 4.0 ships resolv 0.7.0, Ruby 3.4 ships 0.7.1, and Ruby 3.3 ships 0.3.1. What to check Only code that resolves names through this gem is affected. Ordinary socket connections, including Net::HTTP and anything built on TCPSocket, use the operating system resolver and are not. Net::HTTP does load the gem, but only for its IP address regular expressions, so a loaded gem is not by itself a sign of exposure. An application reaches the affected code by calling Resolv itself, by loading resolv-replace, which routes all socket name resolution through the gem, or through a dependency that resolves names this way. Check your dependencies as well as your own code. Recommended action Update the resolv gem to 0 ## Vercel applications are protected from Next.js August 2026 security vulnerabilities DevFeed: [Vercel applications are protected from Next.js August 2026 security vulnerabilities]() Original publisher: [Read original article]() Author: Karim Rahal Published: 2026-08-25T16:39:17Z Content type: article Language: en Sources: [Vercel News]() Topics: [Next.js](), [Vulnerabilities](), [Security](), [Vercel](), [AVIF Images](), [Cache](), [Linux]() Tags: [avif-images](), [cve](), [dependency](), [linux](), [next-js](), [remote-code-execution](), [security](), [upgrade](), [vercel](), [vulnerabilities]() ### AI overview Vercel reports two critical Next.js vulnerabilities disclosed in the August 2026 Security Release. Vercel-hosted applications are protected without customer action, while self-hosted applications should upgrade to patched versions. ### Source excerpt Summary Two vulnerabilities affecting Next.js were disclosed in the August 2026 Security Release. Next.js applications hosted on Vercel are protected and require no customer action. Next.js August 2026 vulnerabilities Next.js disclosed the following critical vulnerabilities: GHSA-2xp9-vwfh-vxw4 originates in the upstream libheif dependency and can lead to unauthenticated remote code execution when Image Optimization processes a crafted AVIF input. CVE-2026-75604 (GHSA-p293-qw3h-jr36) can lead to unauthenticated remote code execution on Windows-hosted Next.js servers in applications using the Pages Router and App Router without Cache Components. After the AVIF vulnerability was identified, Vercel applied protections to its managed Image Optimization service. Impact on Vercel deployments Applications hosted on Vercel are protected. No upgrades, configuration changes, or redeploys are required. Once the AVIF vulnerability was identified, Vercel disabled AVIF optimization across its managed Image Optimization service. AVIF inputs are served as-is and do not pass through the affected processing path. The second vulnerability only affects servers using a Windows filesystem. Vercel's Next.js runtime uses Linux and is not affected. Resolution for self-hosted applications Self-hosted Next.js applications should upgrade to the appropriate patched version. For applications running Next.js 15.x or earlier: For applications running Next.js 16.x: In the patched releases, AVIF images are not resized or optimized. They are served as-is until a fixed libheif version is available. There is no workaround for the Windows vulnerability; affected servers should upgrade immediately. Credit Thanks to the Hacktron team for responsibly disclosing the AVIF vulnerability, and to evolutionstorm and B0RI for responsibly disclosing the Windows vulnerability. References Next.js August 2026 security release GHSA-2xp9-vwfh-vxw4 Upstream libheif advisory GHSA-p293-qw3h-jr36 Read more ## Vercel Agent is now available in Slack code channels DevFeed: [Vercel Agent is now available in Slack code channels]() Original publisher: [Read original article]() Author: Shilpa Apte Published: 2026-08-20T00:00:00Z Content type: release Language: en Sources: [Vercel News]() Topics: [Vercel](), [Slack](), [Code](), [Pull Request](), [Authorization]() Tags: [agent](), [bugs](), [code](), [coding](), [dependency](), [docs](), [enterprise](), [errors](), [logs](), [pull-requests](), [review](), [slack](), [vercel]() ### AI overview Vercel Agent is available in Slack code channels, enabling teams to assign coding work, follow deployments and diagnostics, review pull requests, and provide additional instructions in conversation. The feature is in public beta for Pro and Enterprise teams. ### Source excerpt Vercel Agent now works in Slack code channels, a new kind of channel launched today for working with a coding agent. Anyone in the channel can follow the work, give Agent new instructions, and review the code it writes. Choose Create a code channel from the Slack sidebar, select Vercel as the agent, and describe what you need to get started. You can also ask Agent to create one from an existing channel or thread. It brings that context with it to the new channel. Use code channels to investigate incidents, write and review code as a team, or manage ongoing work such as dependency upgrades and migrations. Inside a Vercel Agent code channel: Follow the work: Agent posts relevant deployments, logs, errors, and diffs in the channel as it works. Talk without repeated @Vercel mentions: Agent follows the conversation, recognizes which messages are for it, and continues when the team gives it more work. Review pull requests: Ask Agent for a PR review and it posts its findings in the channel. It can find bugs outside the diff, and explain failing checks and their root causes. Approve every change: Agent is read-only by default and never exceeds the requester's permissions. Before making a change, it drafts a plan and waits for approval. For every action, Vercel records who requested and approved it and what Agent ran. Stop work at any time: The person who created the code channel can cancel an active task. Vercel Agent in Slack code channels is available in public beta for Pro and Enterprise teams. Add Vercel to Slack, learn about Slack Code, or read the docs. Read more ## Use compile-time DI checks without losing runtime tests DevFeed: [Use compile-time DI checks without losing runtime tests]() Original publisher: [Read original article]() Published: 2026-08-18T00:00:00Z Content type: tutorial Language: en Sources: [Koin - Cloud-Inject.io -Kotzilla]() Topics: [test](), [configuration]() Tags: [compiler](), [configuration](), [dependency](), [lifecycle](), [tests](), [validation]() ### AI overview The article explains how compile-time dependency injection validation can catch structural problems such as missing definitions, invalid qualifiers, and broken constructor paths before application startup. It emphasizes that runtime tests remain necessary for configuration, parameters, lifecycle behavior, and ownership, and recommends using layered validation. ### Source excerpt Compile-time dependency validation can catch a missing definition, an invalid qualifier, or a broken constructor path before an application starts. That is valuable. It does not prove that runtime configuration, parameters, or lifecycle behavior are correct. Divide the evidence Let compiler validation answer structural questions: Can the graph resolve this constructor path? Does a binding exist for the requested type and qualifier? Is generated wiring compatible with the declaration? Let tests answer behavioral questions: ## Build a dependency-graph inventory before changing the container DevFeed: [Build a dependency-graph inventory before changing the container]() Original publisher: [Read original article]() Published: 2026-08-18T00:00:00Z Content type: tutorial Language: en Sources: [Koin - Cloud-Inject.io -Kotzilla]() Topics: [Dependency injection](), [Android](), [test](), [Gradle]() Tags: [android](), [build](), [configuration](), [dependency](), [graph](), [process](), [test]() ### AI overview This tutorial recommends creating a framework-independent dependency-graph inventory before migrating dependency injection. It explains how to document entry points, ownership, implementations, lifetimes, qualifiers, modules, replacement values for tests, and architectural constraints, then validate the design through smaller executable test slices. ### Source excerpt A dependency-injection migration often starts with framework syntax. That is too late. First describe the graph without using the framework's vocabulary. The inventory should show which objects exist, who owns them, and which runtime fact selects one implementation over another. Start from entry points List application entry points: the Android application, a worker, a navigation destination, a command-line process, and each test fixture. Trace the objects requested at each entry point. Stop the trace at explicit boundaries such as a database driver, HTTP transport, clock, file system, or platform service. ## Solving Gradle metadata and Renovate integration DevFeed: [Solving Gradle metadata and Renovate integration]() Original publisher: [Read original article]() Author: Nicolas Fränkel Published: 2026-08-16T00:00:00Z Content type: tutorial Language: en Sources: [Nicolas Fränkel]() Topics: [Gradle](), [renovate](), [Kotlin](), [Groovy]() Tags: [ci](), [dependencies](), [dependency](), [development](), [gradle](), [renovate](), [software-supply-chain](), [supply-chain-attacks](), [supply-chain-security]() ### AI overview The article describes setting up Renovate for a Gradle project and investigating why merges of updated dependency versions caused build failures. It also discusses dependency verification and software supply chain risks. ### Source excerpt My current company has settled on using Gradle. It doesn't make me very happy, but you need to learn to work with constraints. Plus, I must admit that the developers who actually implemented the build files did a pretty good job overall: they used Kotlin instead of Groovy, they moved code to regular plugins, etc. This week, I worked on improvements to a new project and set up Renovate. ## Where I'm Writing Now: The Complete 14-Part BlocSignal Series on DEV.to DevFeed: [Where I'm Writing Now: The Complete 14-Part BlocSignal Series on DEV.to]() Original publisher: [Read original article]() Author: Randal L. Schwartz Published: 2026-08-10T16:00:59Z Content type: opinion Language: en Sources: [Flutter Community - Medium]() Topics: [Flutter](), [Dart](), [reactive](), [Dependency injection](), [OpenTelemetry](), [Web Development]() Tags: [bloc](), [blocsignal](), [dart](), [dependency](), [dev](), [developer-community](), [development](), [flutter](), [series](), [signal](), [state-management](), [tracing](), [writing]() ### AI overview The author announces that DEV.to and the Google Developer Experts organization on DEV.to are now the primary publishing hubs for new technical writing. The article presents a 14-part BlocSignal series covering Dart and Flutter state management, architecture, interoperability, dependency injection, tracing, and web development. ### Source excerpt If you've been following my articles here on Medium over the years, thank you! I wanted to share a quick update on where I'm primarily publishing my new technical deep dives, architectural guides, and Flutter/Dart tutorials. Going forward, my primary writing hub is DEV.to (@randalschwartz) and the official Google Developer Experts (GDE) organization on DEV.to. DEV.to provides a vibrant developer community, native Dart syntax highlighting, and a built-in Series feature that links connected articles into structured, multi-part curricula. 🚀 The New Series: BlocSignal Architecture & Practice Over the last month, my team and I launched BlocSignal -- a production-grade state management framework for Dart and Flutter that bridges BLoC's enterprise discipline with Signals' 0ms synchronous reactivity. We've published a comprehensive 14-part series on DEV.to covering everything from core state machine philosophy and Riverpod/Provider interop to dependency injection, OpenTelemetry tracing, and Jaspr web development. Here is the complete roadmap of all 14 articles available to read right now on DEV.to: 🏛 1. Core Architecture & Philosophy Introducing BlocSignal: Unidirectional Data Flow Meets Reactive Signals The origin story: bridging BLoC semantics with Rody Davis's signals v7 primitives for 0ms microtask queue latency. BLoC meets Signals: How to Pitch BlocSignal to Your Dev Leads How to navigate technical team reviews and explain the enterprise value of synchronous signal graphs. How We Achieved Full BLoC API & Protocol Parity in BlocSignal 0.2.0 A deep dive into BlocProvider, BlocBuilder, BlocListener, BlocConsumer, and context.select parity. Beyond ProviderNotFound: How BlocSignal Rethinks State Location and Synchronous Propagation Solving scope lookups and understanding why synchronous signal updates prevent frame tearing. From Raw Signals to BlocSignal: Taming Reactivity for Enterprise Scale How encapsulating signals inside Cubit/Bloc containers stops global signal "spagh ## What your AI SRE can't see (and what you can do about it) DevFeed: [What your AI SRE can't see (and what you can do about it)]() Original publisher: [Read original article]() Author: Ryan Detwiller Published: 2026-08-06T00:00:00Z Content type: opinion Language: en Sources: [Gremlin Blog]() Topics: [Artificial Intelligence](), [SRE](), [incident](), [Availability](), [telemetry](), [Latency](), [Memory Leaks](), [Deployment]() Tags: [ai](), [availability](), [config](), [dependency](), [deployment](), [latency](), [load-balancer](), [memory](), [outage](), [outages](), [sre]() ### AI overview The article argues that AI SRE tools can speed up triage, reduce alert fatigue, and automate frontline incident response, but they do not solve all reliability problems. It identifies gaps including acting only after failures begin and being unable to predict sudden failures without detectable warning signals. ### Source excerpt AI SRE is having a moment. And let's be honest: faster triage, less alert fatigue, and automated frontline response are wins for understaffed teams. But there are still five gaps in their capabilities, and if you don't understand those gaps before you deploy, you'll find out during an outage. ## Why Appsec Teams Need Internal Developer Portals DevFeed: [Why Appsec Teams Need Internal Developer Portals]() Original publisher: [Read original article]() Author: Yonatan Boguslavski Published: 2026-07-30T10:09:05Z Content type: article Language: en Sources: [Developer Experience & Platform Engineering Blog | Port]() Topics: [internal developer portal](), [Application Security](), [Platform Engineering](), [sdlc](), [Vulnerabilities](), [Security]() Tags: [application-security](), [cognitive-load](), [dependency](), [developer-portal](), [internal-developer-portal](), [open-source-security](), [platform-engineering](), [security](), [vulnerabilities](), [vulnerability]() ### AI overview The article explains how internal developer portals can help AppSec teams support self-sufficient developers by consolidating vulnerability and misconfiguration data from multiple security tools and software development stages. By providing security information in context through catalogs, self-service remediation actions, and scorecards, portals can reduce cognitive load and dependency on AppSec teams. ### Source excerpt If you want self-sufficient developers working in a "you build it you own it" world, you need an internal developer portal. ## Tame Dependabot: Group your updates, slow the cadence, keep security fast DevFeed: [Tame Dependabot: Group your updates, slow the cadence, keep security fast]() Original publisher: [Read original article]() Author: Bruno Borges Published: 2026-07-29T16:00:00Z Content type: tutorial Language: en Sources: [GitHub]() Topics: [GitHub](), [pull-requests](), [configuration](), [Open Source]() Tags: [batch](), [build](), [ci](), [configuration](), [dependabot](), [dependencies](), [dependency](), [ecosystem](), [engineering](), [github](), [github-actions](), [logs](), [maintenance](), [open-source](), [pull-request](), [pull-requests](), [review](), [security](), [supply-chain-security]() ### AI overview This tutorial explains how to reduce Dependabot pull request noise by grouping dependency updates into a monthly batch while keeping security updates fast. It uses Microsoft's open source GCToolkit project as an example and describes the relevant configuration changes. ### Source excerpt Dependabot keeps your dependencies current, but its defaults can flood your repository with pull requests. Here's how grouping updates, slowing the cadence, and keeping security fixes fast cut the noise on a Microsoft open source project. The post Tame Dependabot: Group your updates, slow the cadence, keep security fast appeared first on The GitHub Blog. ## Your Architecture Doesn't Rot Overnight DevFeed: [Your Architecture Doesn't Rot Overnight]() Original publisher: [Read original article]() Author: Valentina Jemuović Published: 2026-07-07T06:00:37Z Content type: opinion Language: en Sources: [Optivem Journal]() Topics: [legacy](), [systems](), [Software](), [Test-driven development]() Tags: [architecture](), [business-logic](), [code](), [dependency](), [legacy](), [refactor](), [requirements]() ### AI overview The article explains how repeated convenience-driven decisions gradually weaken boundaries between business logic and infrastructure. It argues that architectural decay often remains hidden while the application works and tests pass, eventually making seemingly simple changes difficult to locate and implement. ### Source excerpt As deadlines become tighter, convenience starts winning. ## How the Usage app uses Sentry to detect crashes, silent errors, and build regressions DevFeed: [How the Usage app uses Sentry to detect crashes, silent errors, and build regressions]() Original publisher: [Read original article]() Author: Dan Mindru; Oleh Stasula Published: 2026-07-02T09:00:00Z Content type: article Language: en Sources: [Sentry Blog]() Topics: [App](), [monitor](), [Processes](), [iphone](), [data]() Tags: [app](), [apple](), [dependency](), [errors](), [guest-post](), [iphone](), [mac](), [memory](), [monitor](), [network](), [process](), [sentry]() ### AI overview This guest post explains how the Usage system activity monitor uses Sentry to detect crashes, silent errors, build issues, and user feedback problems. The app runs across iPhone, iPad, and Mac and depends partly on undocumented APIs, so OS updates can change data structures without notice. Separate Sentry projects track the app's cooperating components and their failure modes. ### Source excerpt How the Usage app uses Sentry to catch crashes, silent errors, and build regressions before 1.6 million users notice. ## ESP-BSP Generator helps create custom-board BSP components from Espressif development kits DevFeed: [ESP-BSP Generator helps create custom-board BSP components from Espressif development kits]() Original publisher: [Read original article]() Author: John Lee Published: 2026-06-30T00:00:00Z Content type: tutorial Language: en Sources: [Blog on Developer Portal]() Topics: [Espressif](), [ESP-IDF](), [Hardware](), [Web](), [Development](), [ESP32-C3](), [ESP32-S3](), [m5stack]() Tags: [apis](), [blog](), [bsp](), [configuration](), [dependency](), [devkit](), [drivers](), [esp-bsp](), [esp-idf](), [esp32](), [esp32-c3](), [espressif](), [hardware](), [m5stack](), [web]() ### AI overview The ESP-BSP Generator is a web tool that helps developers create an ESP-IDF BSP component for a custom board. Users can start from an esp-bsp development kit, customize hardware details such as pins and features, and download a reusable BSP component. ### Source excerpt Start from an esp-bsp dev kit, customize pins and features in a web form, and download a production-style BSP component for your custom PCB - same APIs, less manual work. ## The State of Trusted Open Source: June 2026 DevFeed: [The State of Trusted Open Source: June 2026]() Original publisher: [Read original article]() Published: 2026-06-30T00:00:00Z Content type: article Language: en Sources: [Chainguard: Unchained]() Topics: [Open Source](), [supply-chain-security](), [vulnerability](), [Artificial Intelligence](), [Security]() Tags: [2026](), [ai](), [chainguard](), [chainguard-containers](), [chainguard-libraries](), [cve](), [cve-data](), [cves](), [data](), [dependency](), [java](), [javascript](), [nginx](), [node](), [open-source](), [python](), [report](), [security](), [software](), [software-supply-chain](), [software-supply-chain-security](), [state-of-trusted-open-source](), [trends](), [vulnerability]() ### AI overview Chainguard's June 2026 report analyzes vulnerability data from more than 2,400 container image projects and 18,016 vulnerability instances observed from March through May 2026. It reports 886 distinct CVEs, with 63.1% of observed instances classified as high severity, and examines how AI-assisted development and security research are affecting software supply-chain risk. ### Source excerpt AI is accelerating vulnerability discovery. Explore the latest trusted open source trends, dependency risks, and CVE insights from Chainguard's report. ## Custom Scopes in Koin: A Practical Example DevFeed: [Custom Scopes in Koin: A Practical Example]() Original publisher: [Read original article]() Author: Gabriel Bronzatti Moro Published: 2026-06-19T12:01:01Z Content type: tutorial Language: en Sources: [Koin developers - Medium]() Topics: [App](), [Open Source](), [Mobile]() Tags: [app](), [components](), [compose-multiplatform](), [data](), [dependency](), [implementation](), [koin](), [kotlin](), [lifecycle](), [open-source](), [project](), [scopes](), [state](), [stateless](), [user-experience]() ### AI overview A practical tutorial on using custom scopes in Koin to keep a selected user profile image available across an application. It demonstrates a session scope, session data, and a stateless session manager using StreamPlayerApp as the example. ### Source excerpt Hey friends 👋 Today, we are going to explore how we can create a custom scope, one of the powerful features provided by Koin. To make things practical 🔨, we'll walk through a real-world use case from the open-source project StreamPlayerApp (created by CodandoTV). Wireframes of a mobile app -- Unsplash by @alvarordesignWhat is the problem? StreamPlayerApp is an open-source project that aims to recreate the core experience of Netflix. One of its features allows users to select a profile, similar to the profile selection screen found in streaming platforms. The selected profile image needs to be accessible across the entire application, ensuring a consistent user experience on every screen. Whenever a user changes their profile, the updated image should be immediately reflected throughout the app, allowing all screens to stay synchronized with the current profile selection. Screenshots demonstrating the user profile selection feature.How we solve this problem using Custom Scopes? First, we create a class that represents the scope of a user session: class SessionScope Next, we create a lightweight data class containing only the information that needs to be kept in memory throughout the user session: data class UserSessionInfo( // represents the time user changed the profile val userTimestamp: Instant, // represents the selected picture url val profileImageUrl: String ) We then created a dedicated class responsible for managing the user's session lifecycle and state. class SessionManager { private val scopeId: String = "user_session" /** * Create custom scope and hold the user's session data */ fun openSession(imageUrl: String) { closeSession() val koin = KoinPlatform.getKoin() val scope = koin.createScope( scopeId = scopeId, ) scope.declare( UserSessionInfo( userTimestamp = Clock.System.now(), profileImageUrl = imageUrl ) ) } /** * Retrieve the current user session */ fun userSessionInfo(): UserSessionInfo? { return KoinPlatform.getKoin() .getScopeOrNull(sc ## Koin Compiler 1.0: DSL and Annotations, Koin now Compile-Safe DevFeed: [Koin Compiler 1.0: DSL and Annotations, Koin now Compile-Safe]() Original publisher: [Read original article]() Author: Arnaud Giuliani Published: 2026-06-03T12:01:01Z Content type: release Language: en Sources: [Koin developers - Medium]() Topics: [Compiler](), [Kotlin](), [Kotlin Multiplatform](), [Gradle]() Tags: [android](), [build](), [compiler](), [dependency](), [dependency-injection](), [gradle](), [koin](), [kotlin](), [kotlin-compiler](), [kotlin-multiplatform](), [plugin]() ### AI overview Koin Compiler 1.0 introduces a native Kotlin compiler plugin that verifies Koin dependency graphs at build time. The release supports both DSL and annotation-based wiring, requires no KSP or generated files, and supports Kotlin Multiplatform. ### Source excerpt Koin Compiler 1.0: DSL and Annotations, Now Compile-Safe Hello, dear Koin Community 👋 Koin Compiler 1.0 is out. Koin's DSL and annotations now sit on a native Kotlin compiler plugin that verifies your dependency graph at build time: the missing-definition error that used to wait for a get() call no longer makes it past gradlew build: e: [Koin] Missing dependency: UserRepository (required by UserService) No KSP, no generated files, full Kotlin Multiplatform support out of the box. It's the biggest ergonomic shift we've made in Koin's nine-year history. Koin Logo with KotlinConf '26 LogoSetup 👀 If you use a Gradle version catalog (the modern default): [versions] koin = "4.2.1" koin-plugin = "1.0.0" [libraries] koin-core = { module = "io.insert-koin:koin-core", version.ref = "koin" } koin-annotations = { module = "io.insert-koin:koin-annotations", version.ref = "koin" } [plugins] koin-compiler = { id = "io.insert-koin.compiler.plugin", version.ref = "koin-plugin" } Or the equivalent inline in build.gradle.kts: plugins { id("io.insert-koin.compiler.plugin") version "1.0.0" } dependencies { implementation("io.insert-koin:koin-core:4.2.1") implementation("io.insert-koin:koin-annotations:4.2.1") } koin-annotations is only needed if you use the annotations on your classes for the constructor, or use the annotations flow. On the DSL flow, the plugin works against koin-core alone. The DSL flow -- Safer DSL ✨ Take two classes: class MyDatabase() class MyRepository(val db: MyDatabase) Wiring them up with Koin has progressively required less typing: // 1. Manual -- the wiring is explicit module { single { MyDatabase() } single { MyRepository(get()) } } // 2. Reflection-free constructor binding module { singleOf(::MyDatabase) singleOf(::MyRepository) } // 3. Compiler-intercepted - same DSL, new mechanism module { single() single() } The third form looks like nothing is happening. That's the point: the compiler plugin sees single(), walks the ## incident.io launches PagerDuty Rescue Program DevFeed: [incident.io launches PagerDuty Rescue Program]() Original publisher: [Read original article]() Author: Tom Wentworth Published: 2026-05-13T13:30:00Z Content type: release Language: en Sources: [The incident.io Blog]() Topics: [incident](), [Tooling](), [migration](), [Availability](), [Artificial Intelligence]() Tags: [ai](), [availability](), [dependency](), [engineering](), [incident](), [incident-channel](), [incident-management](), [incident-response](), [migration](), [on-call](), [outage](), [post-mortem](), [report](), [slack-incident](), [switching](), [tooling](), [uptime]() ### AI overview incident.io announced the PagerDuty Rescue Program for companies switching their on-call tooling. The program offers contract buyouts, AI-powered migration assistance, built-in migration tooling, a 99.99% uptime guarantee, and AI-first alert investigation. ### Source excerpt incident.io just launched the PagerDuty Rescue Program, making it easier than ever for engineering teams to ditch their decade-old on-call tooling. The program includes a contract buyout (up to a year free), AI-powered white glove migration, a 99.99% uptime SLA, and AI-first on-call that investigates alerts autonomously the moment they fire. ## Humans aren't fast enough for 4 9's DevFeed: [Humans aren't fast enough for 4 9's]() Original publisher: [Read original article]() Author: Norberto Lopes Published: 2026-05-11T17:19:46Z Content type: opinion Language: en Sources: [The incident.io Blog]() Topics: [Availability](), [Resilience](), [incident](), [systems]() Tags: [autonomous](), [availability](), [dependency](), [incident](), [incident-channel](), [incident-management](), [incident-response](), [on-call](), [outage](), [post-mortem](), [recovery](), [resilience](), [slack-incident](), [systems]() ### AI overview The article argues that achieving 99.99% availability is fundamentally different from achieving 99.95%. Because the available recovery window is only 4 minutes and 23 seconds per month, human responders are generally too slow, so systems must provide autonomous recovery, redundancy, and enough resilience to survive critical failures before human intervention is needed. ### Source excerpt Hitting 99.99% isn't a faster version of what you already do. It's a different problem to be solved: autonomous recovery, dependency ceilings, redundancies, and the discipline to build systems that buy you 15-30 minutes before you're needed at all. ## What is distributed tracing? DevFeed: [What is distributed tracing?]() Original publisher: [Read original article]() Author: Ivan Cernja Published: 2026-05-04T00:00:00Z Content type: tutorial Language: en Sources: [Encore Updates]() Topics: [tracing](), [Back end](), [debug](), [telemetry]() Tags: [auth](), [database](), [debugging](), [dependency](), [distributed](), [guide](), [instrumentation](), [latency](), [tracing]() ### AI overview An interactive guide explains how distributed traces help debug backend issues by showing request operations, timings, dependencies, database queries, asynchronous message paths, and user-specific failures. ### Source excerpt An interactive guide to debugging real backend issues [Next page]()