# .env file security Published articles for .env file security. This is one page of public article previews, not the complete archive. Follow Next page to continue. Summaries are not the original full articles. ## Google plans Gemini 4 release before year-end DevFeed: [Google plans Gemini 4 release before year-end]() Original publisher: [Read original article]() Author: Maxwell Cooter Published: 2026-09-25T12:09:09Z Content type: news Language: en Sources: [Computerworld]() Topics: [Gemini](), [Artificial Intelligence](), [Google](), [Frontier AI](), [post-training]() Tags: [2026](), [ai](), [ai-model](), [anthropic](), [artificial-intelligence](), [artificial-intelligence-google-vendors-and-providers](), [claude](), [code](), [env-file-security](), [flash](), [frontier-ai](), [gemini](), [google](), [google-deepmind](), [model](), [models](), [news-brief](), [openai](), [post-training](), [release](), [training](), [updates](), [updating](), [vendors-and-providers]() ### AI overview Google's Gemini 4 is in early post-training and is expected to be released much earlier than the end of the year. The report places the possible launch in the context of delays to Gemini 3.5 Pro and more frequent updates from OpenAI and Anthropic. ### Source excerpt Google's Gemini 4 AI model is in the early days of post-training, the phase in which a base AI model is refined to behave reliably, and should be released "much earlier" than the end of this year, Google DeepMind head Koray Kavukcuoglu told The Information at its AI Agenda Live Summit. Some Google observers have speculated that this could be as early as October. Kavukcuoglu recently replaced DeepMind founder Demis Hassabis as head of the Google business unit. The launch of Gemini 4 may lay to rest concerns about the delayed release of Gemini 3.5 Pro, which Google was originally expected to announce at its May 2026 developer conference. While less capable models in the Gemini 3 family have been frequently updated, Gemini 3 Pro has only been updated once since its November 2025 released. In contrast, OpenAI -- spurred on by Sam Altman's "Code Red" memo -- has released three updates to its frontier AI model since then: GPT 5.5 Pro, GPT 5.6 Astro, and GPT 6 Astro. Anthropic, too, has updated its most powerful Claude model several times. Google has not been entirely idle in the AI arena, concentrating its efforts on updating less powerful, more affordable Gemini versions. In July, it announced three Gemini Flash models, aimed at more routine AI tasks, but the company remained silent about its high-end alternative. ## SQL Manager for PostgreSQL 7.0: meet the AI Assistant DevFeed: [SQL Manager for PostgreSQL 7.0: meet the AI Assistant]() Original publisher: [Read original article]() Author: EMS Software Development Published: 2026-09-22T00:00:00Z Content type: release Language: en Sources: [PostgreSQL news]() Topics: [Artificial Intelligence](), [PostgreSQL](), [SQL](), [Database](), [API keys](), [migration](), [Ollama]() Tags: [ai](), [database](), [env-file-security](), [migration](), [ollama](), [postgresql](), [sql]() ### AI overview SQL Manager for PostgreSQL 7.0 introduces an AI Assistant for writing, explaining, fixing, and optimizing SQL. It can compare schemas, generate migration scripts, use selected model context, connect to multiple providers, and run with Ollama locally. ### Source excerpt This is a major release, and the headline feature is our new AI Assistant. We're starting to roll out AI capabilities across our database tools, and SQL Manager for PostgreSQL is the first to get them. It's also available in SQL Management Studio for PostgreSQL, which ships with SQL Manager. You'll find all the AI Assistant features you'd expect: write a query from a plain-language description, explain existing SQL, fix errors, optimize, make sense of an EXPLAIN plan. But you can also take on bigger jobs: Give it two database schemas and get a list of the differences along with a ready-to-run migration script. Hand it your current schema along with new business requirements and get a script that makes the changes. Attach someone else's SQL as a file, have it explained, then ask for changes. Here's the key part: you decide how much of the schema the model sees, down to a single table. You stay in full control of exactly what context goes to the model. Connect as many providers as you like -- all it takes is an API key (stored encrypted), and you can switch models right in the chat. Need to stay completely self-contained? It works with Ollama, so your data never leaves your machine. How the AI Assistant works in SQL Manager for PostgreSQL Download SQL Manager for PostgreSQL ## GitLab joins rush to slow AI coders with rate limits DevFeed: [GitLab joins rush to slow AI coders with rate limits]() Original publisher: [Read original article]() Author: Maxwell Cooter Published: 2026-09-18T17:26:21Z Content type: news Language: en Sources: [InfoWorld]() Topics: [GitLab](), [API](), [GitHub](), [anthropic]() Tags: [ai](), [anthropic](), [api](), [artificial-intelligence](), [artificial-intelligence-code-security-development-tools-security-software-development](), [code-security](), [development-tools](), [devops](), [env-file-security](), [github](), [gitlab](), [news-brief](), [security](), [software-development]() ### AI overview GitLab is tightening rate limits for API, web, and authenticated Git over HTTPS requests on its hosted service. Free-tier and unauthenticated users will be affected first, while most enterprise users will see changes later; Anthropic and GitHub have introduced similar limits. ### Source excerpt Devops platform GitLab already rate-limits some functionality on its hosted service, but will tighten those-limits for some functions and for some users beginning next month. The new limits will affect API requests, web requests, and authenticated Git over HTTPS requests. Users on the lowest payment tiers will be the first to be affected, as will those making unauthenticated requests, including those running automations running against a paid account without credentials. GitLab will give unauthenticated users and users of its free tier a taste of the new restrictions during two "preview" windows between 3pm and 7pm UTC on October 7 and October 14. The changes will definitively take effect for those users from October 19. Users with higher rate limits -- which will include most enterprise users -- will not see any changes until January. The organization is keen to stress that most users will be unaffected by any of these changes, as it recognizes that almost all users are already inside the new limits. GitLab is not alone in making these changes. Companies including Anthropic and GitHub have introduced similar rate limits. ## v0 now reads npm credentials from shared environment variables DevFeed: [v0 now reads npm credentials from shared environment variables]() Original publisher: [Read original article]() Author: Sahaj Jain Published: 2026-09-18T17:00:00Z Content type: release Language: en Sources: [Vercel News]() Topics: [npm](), [Environment Variables](), [software-development](), [Design system](), [GitHub](), [jfrog artifactory](), [Jfrog](), [Vercel]() Tags: [credentials](), [dependencies](), [design-systems](), [development](), [env-file-security](), [environment-variables](), [github](), [jfrog](), [jfrog-artifactory](), [npm](), [vercel]() ### AI overview Vercel's v0 can now install private npm packages and packages from custom registries using credentials stored in shared environment variables. The release supports NPM_TOKEN and NPM_RC, including scoped registries such as GitHub Packages and private JFrog Artifactory registries, while keeping credentials out of the model and sandbox filesystem. ### Source excerpt v0 now installs private packages from npm and custom registries using credentials stored as shared environment variables on Vercel. This makes it easier for teams to build with their existing design systems, component libraries, and internal packages directly in v0. To get started, add one of the following as a shared environment variable on Vercel, scoped to Development and/or Preview: Use NPM_TOKEN for private packages hosted on registry.npmjs.org. Use NPM_RC to configure custom or multiple registries. NPM_RC supports scoped registries and references to other environment variables. For example, configure an organization scope such as @acme for GitHub Packages, or direct package requests through a private JFrog Artifactory registry. Credentials can be marked sensitive, and v0 never exposes them to the model or writes them to the sandbox filesystem. You can view the integration status from Settings -> Integrations in v0. Learn more in the private dependencies docs. Read more ## JDK 27 Runtime Updates Release Notes DevFeed: [JDK 27 Runtime Updates Release Notes]() Original publisher: [Read original article]() Author: Billy Korando Published: 2026-09-12T00:00:00Z Content type: release Language: en Sources: [Inside Java]() Topics: [Java](), [Release notes](), [releases]() Tags: [env-file-security](), [gc](), [jdk-27](), [memory](), [net-conf](), [passwords](), [performance](), [release](), [release-notes]() ### AI overview This article reviews runtime updates in JDK 27, including G1GC becoming the default garbage collector in all cases, Compact Object Headers being enabled by default, and improved JFR redaction and filtering for sensitive information such as passwords and API keys. ### Source excerpt Let's review the performance updates, new runtime features, and other changes to existing features that are in the JDK 27 release! ## Build an AI Voice Assistant with Twilio Voice and Media Streams, OpenAI's GPT-Live API, and Node.js DevFeed: [Build an AI Voice Assistant with Twilio Voice and Media Streams, OpenAI's GPT-Live API, and Node.js]() Original publisher: [Read original article]() Author: Paul Kamp Published: 2026-09-10T00:00:00Z Content type: tutorial Language: en Sources: [Twilio]() Topics: [Artificial Intelligence](), [Node.js](), [OpenAI](), [Streams](), [API](), [WebSocket](), [Fastify](), [API keys](), [.env]() Tags: [ai](), [api](), [audio](), [developer-insights](), [env-file-security](), [js](), [ngrok](), [node-js](), [openai](), [sign-up](), [streams]() ### AI overview This tutorial explains how to build an AI voice assistant that answers phone calls using Twilio Programmable Voice and Media Streams, OpenAI's GPT-Live-1 API, and a Node.js server. It also covers web search and custom function tool calls. ### Source excerpt Build an AI voice assistant that answers a phone call with Twilio Programmable Voice and Media Streams, powered by OpenAI's GPT-Live-1. ## \[Crypto\] Time-based one-time password (TOTP) for 2FA, part I DevFeed: [\[Crypto\] Time-based one-time password (TOTP) for 2FA, part I]() Original publisher: [Read original article]() Published: 2026-09-09T22:00:00Z Content type: tutorial Language: en Sources: [Dennis Yurichev]() Topics: [passwords](), [QR Code](), [Google](), [Python](), [Unix](), [App](), [email](), [Code]() Tags: [account](), [app](), [argument](), [backup](), [code](), [crypto](), [env-file-security](), [github](), [google](), [password](), [protection](), [python](), [run](), [server](), [smartphone](), [unix]() ### AI overview This tutorial explains how time-based one-time passwords work for two-factor authentication. It covers importing a base32-encoded secret from a QR code into Google Authenticator, generating 6-digit login codes, and calculating them with HMAC-SHA-1 from the secret and Unix time. It also discusses backup codes and securely storing TOTP secrets separately from passwords. ### Source excerpt [Crypto] Time-based one-time password (TOTP) for 2FA, part I ## Build a Video API with Twilio Programmable Video, Node.js, TypeScript, and Express DevFeed: [Build a Video API with Twilio Programmable Video, Node.js, TypeScript, and Express]() Original publisher: [Read original article]() Author: Mia Adjei Published: 2026-08-31T00:00:00Z Content type: tutorial Language: en Sources: [Twilio]() Topics: [API](), [Node.js](), [Express](), [TypeScript](), [SDK]() Tags: [api](), [api-js](), [api-keys](), [api-node](), [api-nodejs](), [api-twilio](), [build](), [build-api](), [developer-insights](), [env-file-security](), [express](), [how-to](), [javascript-api](), [node](), [node-js](), [nodejs](), [nodejs-api](), [tutorial](), [twilio-api](), [twilio-programmable-video](), [typescript](), [use-api-with-javascript](), [video](), [video-api](), [video-javascript](), [video-js]() ### AI overview A tutorial showing how to build an API that creates and manages video rooms programmatically using Twilio Programmable Video, Node.js, TypeScript, and Express. ### Source excerpt Learn how to create and manage video chat rooms programmatically using Twilio Programmable Video and Node.js. ## How to Use Svelte and Go to Build a Video Chat App DevFeed: [How to Use Svelte and Go to Build a Video Chat App]() Original publisher: [Read original article]() Author: Donal Toomey Published: 2026-08-28T00:00:00Z Content type: tutorial Language: en Sources: [Twilio]() Topics: [Svelte](), [Go Language](), [Vite](), [REST API](), [Single-page application (SPA)](), [Back end](), [Front end]() Tags: [api](), [build-video-app](), [build-video-chat-app](), [cors](), [developer-insights](), [env-file-security](), [environment-variables](), [git](), [go](), [how-can-i-build-a-video-app](), [how-to](), [how-to-create-video-chat-app](), [how-to-make-video-chat-app](), [live-video-chat-app](), [node-js](), [npm](), [real-time](), [svelte](), [twilio-golang](), [twilio-programmable-video](), [twilio-video](), [twilio-video-tutorial](), [video-api](), [video-app](), [video-chat-app](), [vite]() ### AI overview This tutorial explains how to build a real-time video chat app using Svelte for the frontend, Go for the backend, and the Twilio Video API. It covers the application flow, project setup, dependencies, environment configuration, and credential handling. ### Source excerpt Build a real-time video chat app with Svelte 5, Vite, and Go using the Twilio Video API. ## How to Install Omnissa App Volumes In-Guest VHD: Part 2 DevFeed: [How to Install Omnissa App Volumes In-Guest VHD: Part 2]() Original publisher: [Read original article]() Author: Paolo Valsecchi Published: 2026-08-18T13:26:42Z Content type: tutorial Language: en Sources: [StarWind]() Topics: [enterprise deployment](), [active directory](), [configuration](), [Server](), [Template]() Tags: [active-directory](), [env-file-security](), [install](), [omnissa-app-volumes](), [omnissa-app-volumes-in-guest-vhd](), [smb](), [software](), [writable-volumes]() ### AI overview Part 2 of a guide to configuring Omnissa App Volumes In-Guest VHD. It covers licensing the instance, registering Active Directory, assigning administrator access, adding an SMB file share, uploading package templates, and enabling Writable Volumes. ### Source excerpt Part 1, How [...] ## Session lifetime is a security control, not a UX setting DevFeed: [Session lifetime is a security control, not a UX setting]() Original publisher: [Read original article]() Author: WorkOS Published: 2026-08-18T00:00:00Z Content type: opinion Language: en Sources: [WorkOS]() Topics: [zoom](), [Security](), [Exploit](), [bug](), [configuration]() Tags: [bug](), [configuration](), [env-file-security](), [exploit](), [rce](), [security](), [zoom]() ### AI overview This commentary argues that session lifetime should be treated as a security control rather than a user-experience setting. It uses a reported Zoom annotation vulnerability, which allegedly progressed from discovery to a zero-click remote code execution exploit in under 24 hours with fewer than 20 prompts to publicly available AI models, to emphasize the risk of long-lived stolen sessions. It also notes Zoom's fixes, server-side filtering, and the stated limitation involving end-to-end encrypted meetings. ### Source excerpt A Zoom zero-click RCE went from discovery to working exploit in a day. The exploit took one day; your sessions last longer than that. ## Debezium 3.6.1.Final Released DevFeed: [Debezium 3.6.1.Final Released]() Original publisher: [Read original article]() Author: Chris Cranford Published: 2026-08-04T00:00:00Z Content type: release Language: en Sources: [Debezium]() Topics: [data](), [integrity](), [Security](), [MySQL](), [PostgreSQL](), [Logging]() Tags: [credential-leakage](), [debezium](), [env-file-security](), [integrity](), [logging](), [mysql](), [postgresql](), [release](), [security]() ### AI overview Debezium 3.6.1.Final is a maintenance release focused on data integrity and security across multiple connectors. It fixes PostgreSQL date parsing, MySQL unsigned integer schema mapping, Oracle RowId corruption, JDBC sink handling of PostgreSQL tsvector values, and sensitive-value leakage in logs and configuration output. ### Source excerpt We're pleased to announce the release of Debezium 3.6.1.Final, a maintenance release that delivers important data integrity and security improvements across multiple connectors. This release fixes several issues that could affect change event accuracy, including correct parsing of BC-era dates in PostgreSQL, proper mapping of MySQL INTEGER UNSIGNED columns, and resolution of Oracle RowId corruption in change events. The JDBC sink connector also receives a fix for tsvector data handling, and credential leakage has been addressed in log output and configuration serialization. Read on for the full details! Read more... ## Managing Environment Variables and Secrets in DevOps DevFeed: [Managing Environment Variables and Secrets in DevOps]() Original publisher: [Read original article]() Author: Pramodh Kumar M Published: 2026-08-01T13:00:47Z Content type: tutorial Language: en Sources: [KodeKloud]() Topics: [DevOps](), [configuration](), [GitGuardian](), [GitHub](), [Terraform](), [Kubernetes]() Tags: [ci-cd-secrets-management](), [cloud](), [collaboration](), [collaboration-tools](), [configuration](), [container](), [crash](), [devops](), [devsecops](), [dynamic-secrets](), [env-file-security](), [environment-variables](), [gitguardian](), [github](), [hardcoded-credentials](), [hashicorp-vault](), [jira](), [kubernetes](), [kubernetes-secrets](), [leak](), [managing-environment-variables-and-secrets](), [rotation](), [safety](), [sealed-secrets](), [secret-rotation](), [secret-scanning](), [secrets](), [secrets-management-best-practices](), [security](), [storage](), [terraform](), [vault]() ### AI overview A guide to managing environment variables and secrets in DevOps. It explains how secrets escape through repositories, processes, crash reports, containers, collaboration tools, Kubernetes Secrets, and Terraform state, and discusses storage, access controls, lifecycles, and rotation. ### Source excerpt Nearly 29 million secrets were pushed to public GitHub in a single year, and most teams still discover their own leaks by accident. Here is how environment variables actually escape, and what to use instead at each stage. ## Hyper-V Machines for Unprivileged Users DevFeed: [Hyper-V Machines for Unprivileged Users]() Original publisher: [Read original article]() Author: Mario Loriedo Published: 2026-07-10T09:55:21Z Content type: article Language: en Sources: [Podman]() Topics: [podman](), [Windows](), [Authorization](), [Provisioning](), [configuration](), [Usability]() Tags: [announcement](), [enterprise](), [env-file-security](), [new-feature](), [podman](), [podman-machine](), [provisioning](), [release](), [terminal](), [windows](), [workflow]() ### AI overview The article describes upcoming Podman 6 improvements for managing Hyper-V-based Podman machines on Windows without full administrator access. After one-time administrative host setup, developers can create, start, stop, remove, and query machines from a standard terminal, including on locked-down corporate laptops. The changes include reuse of Hyper-V socket registry configuration and host pre-provisioning for permissions and required registry entries. ### Source excerpt For Windows users on Hyper-V, certain common tasks, such as machine creation and removal, required a trip to the IT help desk for administrative approval. With the upcoming release of Podman 6, we are breaking down this barrier. After an initial setup performed by an admin, it will be possible to manage Hyper-V-based Podman machines as a non-administrator, even on locked-down corporate laptops. ## A 1Password Runtime for Local Agents and Desktop Apps DevFeed: [A 1Password Runtime for Local Agents and Desktop Apps]() Original publisher: [Read original article]() Published: 2026-06-24T08:00:00Z Content type: opinion Language: en Sources: [Antonio Leiva]() Topics: [API keys](), [Automation](), [App](), [Command-line interface]() Tags: [agents](), [ai](), [desktop](), [development](), [env-file-security](), [secrets](), [security](), [shell](), [vault]() ### AI overview The author describes using 1Password as a runtime for local agents and desktop apps. The proposed setup stores references rather than secret values in an environment file, resolves credentials through a wrapper, and limits the service account's access so child processes receive only the variables they need. ### Source excerpt Everything Android, Kotlin and other random topics ## Why pnpm no longer expands environment variables in a repository's .npmrc DevFeed: [Why pnpm no longer expands environment variables in a repository's .npmrc]() Original publisher: [Read original article]() Author: Zoltan Kochan Published: 2026-06-11T00:00:00Z Content type: article Language: en Sources: [pnpm]() Topics: [pnpm](), [Security](), [Environment Variables](), [configuration](), [Authentication]() Tags: [authentication](), [configuration](), [env-file-security](), [environment-variables](), [pnpm](), [secret](), [security]() ### AI overview pnpm changed how environment variables are expanded in repository-controlled registry and credential settings after a vulnerability allowed malicious repositories to exfiltrate secrets during dependency resolution. The post explains the trust boundary, affected configuration locations, and how to move authentication tokens into trusted user or global configuration. ### Source excerpt pnpm used to expand $ placeholders everywhere it found them -- including in the .npmrc and pnpm-workspace.yaml files that live inside the repository you just cloned. That turned out to be a way for a malicious repository to steal the secrets in your environment. As of v10.34.2 and v11.5.3, pnpm stops expanding environment variables in repository-controlled registry and credential settings. ## PM Skills 2.0: Red-Team Your Roadmap, Then Check the Code Before You Ship DevFeed: [PM Skills 2.0: Red-Team Your Roadmap, Then Check the Code Before You Ship]() Original publisher: [Read original article]() Author: Paweł Huryn Published: 2026-06-05T17:55:04Z Content type: release Language: en Sources: [The Product Compass]() Topics: [Claude](), [Artificial Intelligence](), [GitHub](), [test](), [execution]() Tags: [ai](), [claude](), [command](), [env-file-security](), [github](), [plugins](), [release](), [review]() ### AI overview PM Skills 2.0 is a free, MIT-licensed Claude marketplace release with 68 skills, 42 commands, and 9 plugins. It adds the /red-team-prd command and an AI Shipping Kit for documenting, auditing, and shipping AI-built applications with human sign-off. ### Source excerpt 68 free Claude skills, 42 commands, 9 plugins. This release adds a new /red-team-prd command and the AI Shipping Kit: a way to document, audit, and ship AI-built apps with human sign-off. ## Huntress Finds Signed Adware That Disables Antivirus and Enables Supply Chain Hijacking DevFeed: [Huntress Finds Signed Adware That Disables Antivirus and Enables Supply Chain Hijacking]() Original publisher: [Read original article]() Author: James Northey; Ryan Dowd Published: 2026-04-14T13:00:00Z Content type: article Language: en Sources: [Huntress Blog]() Topics: [Malware](), [Security](), [Risk](), [Cybercrime](), [Persistence](), [configuration](), [payload](), [PowerShell](), [Deployment]() Tags: [antivirus](), [env-file-security](), [infrastructure](), [malware](), [payload](), [persistence](), [powershell](), [risk](), [security](), [supply-chain]() ### AI overview Huntress investigated signed adware that uses an update mechanism to deploy MSI and PowerShell payloads, establish WMI persistence, and disable antivirus software. An unregistered update domain allowed Huntress to sinkhole tens of thousands of compromised endpoints and exposed the operation to potential supply chain hijacking. ### Source excerpt Huntress uncovered a malware operation using signed PUP to deploy AV killers with SYSTEM privileges. Learn how this adware crosses the line into malware territory and how anyone could have hijacked their update mechanism. ## SmartShots AI generates and localizes App Store screenshots in ScreenshotWhale DevFeed: [SmartShots AI generates and localizes App Store screenshots in ScreenshotWhale]() Original publisher: [Read original article]() Author: Jorge Castillo Published: 2026-01-12T12:27:37Z Content type: release Language: en Sources: [Effective Android]() Topics: [App](), [Mobile](), [Artificial Intelligence](), [software-development]() Tags: [ai](), [app](), [app-development](), [env-file-security](), [generate](), [mobile](), [mobile-apps](), [screenshot]() ### AI overview The article announces SmartShots AI for ScreenshotWhale, a feature that generates App Store screenshots from uploaded images and adds them to an editable project. It also describes automatic localization during export and says the feature is included with the monthly subscription. ### Source excerpt Removing the final bottleneck for vibe coders building mobile apps 🚀 ## Validate Environment Variables with Pydantic DevFeed: [Validate Environment Variables with Pydantic]() Original publisher: [Read original article]() Author: Rick Donato Published: 2025-12-02T08:00:19Z Content type: tutorial Language: en Sources: [Packet Coders - Learn Network Automation]() Topics: [Pydantic](), [Environment Variables](), [.env](), [Python]() Tags: [env-file-security](), [environment-variables](), [python](), [settings](), [tips]() ### AI overview A brief tutorial tip showing how to validate environment variables from .env files with Pydantic before they reach an application. It also notes that this can remove the need to manually call python-dotenv. ### Source excerpt Tip! Validate your env vars from your .env files before they hit your application by using Pydantic. This also eliminates the need to call python-dotenv manually. Here's an example: # uv add pydantic pydantic-settings python-dotenv from pydantic import Field, AnyHttpUrl, ValidationError from pydantic_settings import BaseSettings, ## Quarkus 3.27.1 released - LTS maintenance release DevFeed: [Quarkus 3.27.1 released - LTS maintenance release]() Original publisher: [Read original article]() Author: Jan Martiška (https://twitter.com/janmartiska) Published: 2025-11-19T00:00:00Z Content type: release Language: en Sources: [Quarkus - Supersonic Subatomic Java]() Topics: [Quarkus](), [maintenance](), [bugfixes](), [upgrade](), [Documentation]() Tags: [bugfixes](), [changelog](), [env-file-security](), [lts](), [maintenance](), [quarkus](), [release](), [upgrade](), [version]() ### AI overview Quarkus 3.27.1 is the first maintenance release in the 3.27 LTS stream. It includes bug fixes, documentation updates, and a fix for CVE-2025-59250 in the Microsoft SQL JDBC driver. The release notes recommend upgrading existing Quarkus 3.27 applications with the Quarkus CLI and state that applications can be updated from Quarkus 2.x. ### Source excerpt Today, we released Quarkus 3.27.1, our first maintenance release for the 3.27 LTS stream. This release contains bugfixes, documentation updates and fixes a CVE in the Microsoft SQL JDBC driver: CVE-2025-59250 It should be a safe upgrade for anyone already using 3.27. Update To update to Quarkus 3.27, we recommend updating to the latest version of the Quarkus CLI and run: quarkus update --stream=3.27 Note that quarkus update can update your applications from any version of Quarkus (including 2.x) to Quarkus 3.27. Full changelog You can get the full changelog of 3.27.1 on GitHub. Come Join Us We value your feedback a lot so please report bugs, ask for improvements... Let's build something great together! If you are a Quarkus user or just curious, don't be shy and join our welcoming community: provide feedback on GitHub; craft some code and push a PR; discuss with us on Zulip and on the mailing list; ask your questions on Stack Overflow. ## Defense in Depth for MCP Servers DevFeed: [Defense in Depth for MCP Servers]() Original publisher: [Read original article]() Author: Bil Harmer Published: 2025-09-16T07:00:00Z Content type: article Language: en Sources: [Supabase]() Topics: [Model Context Protocol](), [Security](), [prompt injection](), [Database](), [AI Agent](), [Supabase](), [Open Source]() Tags: [ai-agents](), [databases](), [env-file-security](), [mcp](), [open-source](), [prompt-injection](), [security]() ### AI overview The article explains how connecting MCP servers and AI agents to live databases can enable prompt injection attacks and expose private data. It advocates defense-in-depth safeguards, especially for solo developers deploying directly against production data, and clarifies that Supabase's MCP implementation is open source and intended for self-hosting or third-party hosting. ### Source excerpt Learn about the security risks of connecting AI agents to databases and how to implement defense in depth strategies to protect your data from prompt injection attacks. ## Sort Lines in Source Code DevFeed: [Sort Lines in Source Code]() Original publisher: [Read original article]() Author: Google Testing Bloggers (noreply@blogger.com) Published: 2025-09-15T13:45:00Z Content type: tutorial Language: en Sources: [Google Testing Blog]() Topics: [Sorting](), [Code](), [bug](), [configuration]() Tags: [bug](), [code](), [config](), [configuration](), [env-file-security](), [git](), [kyle-freeman](), [sorting](), [tott]() ### AI overview This Google Tech on the Toilet article explains how duplicate configuration flags can cause bugs and shows how the keep-sorted tool can sort source code, configuration, and text files to make such errors easier to spot and maintain. ### Source excerpt This article was adapted from a Google Tech on the Toilet (TotT) episode. You can download a printer-friendly version of this TotT episode and post it in your office. By Kyle Freeman Imagine you're adding a two-player mode to a game. When testing the feature, you launch the game but don't see the option to add a second player. The configuration looks correct; you enabled two-player mode on the last line! So what happened? Can you spot the bug in the following example? allow_warping: false enable_two_players: false show_end_credits: true enable_frost_band: false enable_two_players: true Using keep-sorted (github.com/google/keep-sorted) to sort lines makes the error easy to spot: the flag enable_two_players is set twice, with different values: # keep-sorted start allow_warping: false enable_frost_band: false enable_two_players: false enable_two_players: true show_end_credits: true # keep-sorted end Sorted lists and lines of code are easier to read and maintain, and can help prevent bugs. To use keep-sorted in your source code, config, and text files, install keep-sorted and then follow these instructions: Add keep-sorted start and keep-sorted end comments in your file, surrounding the lines you want to sort. Run keep-sorted: keep-sorted [file1] [file2] ... (Optional) Add keep-sorted to your pre-commit so it runs automatically on git commit You can add options to override default behavior. For example, you can ignore case, sort numerically, order by prefixes, and even sort by regular expressions: bosses := []int{ // keep-sorted start by_regex=//.* 111213, // Aethon Annie 52816, // Blazing Benny 711, // Daisy Dragon 1003, // Kenzie Kraken // keep-sorted end } Remember: before sorting, ensure the original order isn't intentional. For example, order can be critical when loading dependencies. ## LLM chat UIs that support MCP DevFeed: [LLM chat UIs that support MCP]() Original publisher: [Read original article]() Author: Mark Needham Published: 2025-08-12T00:00:00Z Content type: tutorial Language: en Sources: [ClickHouse Blog]() Topics: [Model Context Protocol](), [Large Language Model](), [Open Source](), [clickhouse](), [Docker Compose](), [Docker](), [API keys](), [YAML](), [Retrieval Augmented Generation (RAG)](), [MongoDB](), [Kubernetes]() Tags: [clickhouse](), [compose](), [docker](), [env-file-security](), [llm](), [mcp](), [mongodb](), [open-source](), [rag](), [yaml]() ### AI overview This guide examines MCP compatibility in four open-source ChatGPT-style applications: LibreChat, AnythingLLM, Open WebUI, and Chainlit. It focuses on LibreChat's MCP support and explains deployment and setup using Docker, YAML configuration, API keys, and related services. ### Source excerpt We explore four popular open-source ChatGPT-style apps - LibreChat, AnythingLLM, Open WebUI, and Chainlit - through MCP compatibility. [Next page]()