# package Published articles for package. This is one page of public article previews, not the complete archive. Follow Next page to continue. Summaries are not the original full articles. ## Reverse Engineering a 1960s Diode-Transistor Logic IC DevFeed: [Reverse Engineering a 1960s Diode-Transistor Logic IC]() Original publisher: [Read original article]() Author: Maya Posch Published: 2026-11-09T16:30:02Z Content type: article Language: en Sources: [Hackaday]() Topics: [Reverse Engineering](), [Chip design]() Tags: [ceramic](), [circuits](), [diode-transistor-logic](), [dtl](), [gate](), [history](), [ken-shirriff](), [logic](), [nand](), [noise](), [package](), [parts](), [power](), [reverse-engineering](), [rtl](), [semiconductor](), [signetics](), [ti](), [transistor](), [transistors](), [ttl]() ### AI overview The Signetics ST680a is a rare 1960s DTL integrated circuit: a quad-NAND gate in an early plastic dual in-line package. Its gates combine multiple diodes to sum inputs and drive transistors. DTL remained a practical, mature alternative while TTL's noise-immunity and fan-in/out issues were being worked out, although TTL was faster and used less power. Reverse-engineering the chip required decapping its plastic package, which the excerpt says takes more extreme methods than opening a ceramic DIP. ### Source excerpt Before transistor-transistor logic (TTL) took over, diode-transistor logic (DTL) was a common sight especially in pre-IC circuits where it was a major improvement over resistor-transistor logic (RTL). That said, it's ...read more ## Announcing Zarf 1.0: Security and Stability for Airgap Software Delivery DevFeed: [Announcing Zarf 1.0: Security and Stability for Airgap Software Delivery]() Original publisher: [Read original article]() Author: OpenSSF Published: 2026-11-09T14:01:14Z Content type: release Language: en Sources: [Open Source Security Foundation]() Topics: [CI/CD](), [code security](), [reliable codebases](), [openssf](), [Release notes]() Tags: [2026](), [air-gapped](), [airgap](), [behavior](), [blog](), [code](), [community](), [compatibility](), [component](), [configuration](), [contribute](), [defense-unicorns](), [delivery](), [environments](), [guest-blog](), [kubernetes](), [openssf](), [package](), [package-signing](), [schema](), [security](), [signing](), [software](), [software-delivery](), [zarf]() ### AI overview Zarf 1.0 introduces the v1beta1 package schema, stronger package signing and verification workflows, and changes intended to make behavior more predictable. The schema adds component publishing for imports and simpler templating, while replacing variables with structured values that support standard Go templates and nested data. Zarf includes migration guidance and tooling for converting existing packages. The release also retires deprecated features and renews commitments to dependency management, documentation, open governance, and community involvement. ### Source excerpt Zarf 1.0 is here, bringing the v1beta1 schema, stronger package signing, and improved stability for air-gapped and constrained software delivery environments. ## PyPI makes release attestations easier to find with new security tab DevFeed: [PyPI makes release attestations easier to find with new security tab]() Original publisher: [Read original article]() Author: Anamarija Pogorelec Published: 2026-11-09T13:23:29Z Content type: news Language: en Sources: [Help Net Security]() Topics: [PyPI](), [Security](), [code security]() Tags: [about](), [added](), [attestation](), [cybersecurity](), [developers](), [digital](), [easier](), [file](), [files](), [full](), [giving](), [index](), [information](), [more](), [news](), [one](), [package](), [pages](), [pypi](), [release](), [security](), [software-development](), [with]() ### AI overview PyPI's new Security tab shows whether each release file has a digital attestation and lets users inspect its details or linked transparency log. PyPI Publish attestations identify the Trusted Publisher; SLSA Build Provenance links files to a source commit, build platform and instructions. Full provenance means every file has at least one attestation. Missing attestations mean origin cannot be cryptographically verified, but do not by themselves show a release is malicious; the source suggests checking maintainer history, release patterns and repository activity. PyPI warns about partial attestations, changes in repository or workflow, and projects that stop attesting. The redesigned page surfaces warnings and release status, while Release Files and Release History expose per-file provenance and version comparisons. For releases predating the July 2026 policy change, files uploaded more than 14 days after the initial release are flagged; PyPI refuses late uploads under the policy. ### Source excerpt The Python Package Index (PyPI) has added a security tab to its project pages, giving developers a place to check where individual release files came from. How PyPI shows where release files came from The Security tab shows whether release files have digital attestations, which provide verifiable information about how a file was published or built. A release has full provenance when every file has at least one attestation. A PyPI Publish attestation identifies the ... More -> The post PyPI makes release attestations easier to find with new security tab appeared first on Help Net Security. ## AutoPYara: Next-Gen YARA Rule Generator for Malware Family Clustering DevFeed: [AutoPYara: Next-Gen YARA Rule Generator for Malware Family Clustering]() Original publisher: [Read original article]() Author: Mabon Ninan, Nhat Nguyen, Soumyajyoti Dutta, Sidharth Anil, Marcus Botacin Published: 2026-11-09T05:00:00Z Content type: article Language: en Sources: [arXiv: Cryptography and Security](), [arXiv: Machine Learning]() Topics: [clustering](), [Tool](), [rule-engine](), [pip]() Tags: [abstract](), [automatic](), [cluster](), [clustering](), [coverage](), [cs-cr](), [cs-lg](), [data](), [datasets](), [diversity](), [effective](), [generation](), [generator](), [hashing](), [implement](), [incident-response](), [malware](), [next](), [open-source](), [package](), [pip-install](), [yara]() ### AI overview AutoPYara targets degraded YARA rule quality caused by diverse malware within a family and noisy clustering. It selects cluster centroids using similarity hashing and estimates family subclusters with a heuristic based on historical VirusTotal data. The authors report 14 percentage points higher rule coverage, 7.1 percentage points lower average variance than AutoYara, and 10% better threat-hunting accuracy. They provide it as an open-source Python package installable with `pip install autopyara`. These are abstract-level reported results; the supplied excerpt gives no evaluation details. ### Source excerpt arXiv:2611.08608v1 Announce Type: new Abstract: Millions of malware variants threaten users daily, such that clustering these samples is key for fast incident response. AutoYara is the current state-of-the-art for automatic YARA rule generation, but the task remains challenging on realistic datasets, where intra-family diversity and noisy clustering can degrade rule quality. We present AutoPYara, a solution armored with: (1) precise cluster centroid selection based on similarity hashing, and (2) an improved heuristic for estimating subclusters within a malware family using historical VirusTotal data. We implement AutoPYara as an open-source Python package (pip install autopyara) to support reproducibility and practical use. We show that AutoPYara, (1) increases rule coverage by 14 percentage points; (2) reduces variance by 7.1 percentage points, comparing the average variance AutoPYara exhibits to that of AutoYara; and (3) improves threat-hunting accuracy by 10%. AutoPYara produces robust and effective YARA rules than prior automatic approaches in practical settings. ## Concordance-Optimal Continuous Music Emotion Estimation: Variance Decomposition, Dual-Branch Temporal Fusion, and Conformal Prediction Intervals DevFeed: [Concordance-Optimal Continuous Music Emotion Estimation: Variance Decomposition, Dual-Branch Temporal Fusion, and Conformal Prediction Intervals]() Original publisher: [Read original article]() Author: Mohammad Faraz Akhtar, Aditya Parashar, Ayush Jain, Madhur Gupta, Ritesh Kumar, Soubhik Chakraborty Published: 2026-11-09T05:00:00Z Content type: article Language: en Sources: [arXiv: Machine Learning]() Topics: [model architecture](), [Time Series]() Tags: [attention](), [audio](), [conformal-prediction](), [continuous](), [coverage](), [cross-validation](), [cs-lg](), [cs-sd](), [embeddings](), [emotion](), [features](), [fusion](), [model](), [multimodal](), [music](), [network](), [open](), [open-source](), [package](), [prediction](), [temporal](), [variance]() ### AI overview Pooled frame-level correlation can reward ranking songs by average emotion without measuring how well a model tracks changes within each song. The study separates between-song and within-song annotation variance and uses windowed Lin's concordance correlation coefficient (CCC) to penalize variance compression. On 1,764 DEAM songs, increasing the CCC trade-off weight improves mean within-song Arousal correlation from 0.204 to 0.368, while pooled correlation falls from 0.843 to 0.810. The authors' MMAS predicts Arousal and Valence every 0.5 seconds, combining frozen MERT-v1-95M audio embeddings and ten transcription-derived symbolic features in a dual-branch temporal convolutional network with cross-modal attention. In song-grouped five-fold validation, it outperforms a ridge baseline on within-song Arousal correlation; complete transcription failure reduces pooled correlation by at most 0.04. Split-conformal intervals fall short of their 95% marginal coverage target, reaching 93.7% for Arousal and 90.0% for Valence, which the authors attribute to within-song dependence. ### Source excerpt arXiv:2611.08966v1 Announce Type: cross Abstract: Continuous music emotion recognition (MER) estimates how Arousal and Valence evolve within a song, yet the field's standard metric, pooled frame-level correlation, is dominated by between-song differences and cannot distinguish a model that tracks emotional dynamics from one that only ranks songs by their average level. We decompose annotation variance into between- and within-song components and show that mean squared error (MSE) targets the former, while windowed Lin's concordance correlation coefficient (CCC = $r \cdot C_b$) targets the latter by penalising the variance compression MSE induces. A single weight $\lambda$ controls the trade-off: on 1,764 DEAM songs, raising $\lambda$ from 0 to 1 lowers pooled Arousal $r$ from 0.843 to 0.810 while raising mean within-song $r$ from 0.204 to 0.368. Building on this objective, we present MMAS (Multimodal Music Analysis System), an open-source model that predicts Arousal and Valence every 0.5 s from raw audio. It fuses frozen MERT-v1-95M embeddings with ten symbolic features from automatic transcription through a dual-branch temporal convolutional network with cross-modal attention. Because both branches are audio-derived, one model trains jointly on DEAM and PMEmo without domain conditioning. Under song-grouped 5-fold cross-validation (2,531 songs), pooled $r$ reaches 0.801/0.685 (Arousal/Valence) on DEAM and 0.742/0.746 on PMEmo. Against a ridge baseline on identical features, within-song Arousal $r$ roughly triples (0.344 vs. 0.125; $n = 353$ songs, Wilcoxon $p = 1.7 \times 10^{-21}$, $d = 0.56$). Complete transcription failure costs at most 0.04 pooled $r$. Split-conformal intervals attain 93.7% (Arousal) and 90.0% (Valence) marginal coverage at a 95% target, with the shortfall traced to within-song dependence. MMAS is released as a pip-installable package. ## PINNeval: A Comprehensive Evaluation Standard for Physics-Informed Neural Networks DevFeed: [PINNeval: A Comprehensive Evaluation Standard for Physics-Informed Neural Networks]() Original publisher: [Read original article]() Author: Kevin von Bargen, Hamid Ebrahimy, Tim R\\"omer Published: 2026-11-09T05:00:00Z Content type: article Language: en Sources: [arXiv: Artificial Intelligence](), [arXiv: Machine Learning]() Topics: [Artificial Intelligence](), [Neural Network](), [LLM evaluation / benchmarking](), [reproducibility]() Tags: [architecture](), [balancing](), [benchmark](), [cs-ai](), [cs-lg](), [documentation](), [evaluation](), [jax](), [metrics](), [neural-networks](), [optimization](), [package](), [physics-informed](), [pipeline](), [protocol](), [reporting](), [system](), [traceability]() ### AI overview PINNeval proposes evaluating physics-informed neural networks as integrated training pipelines, arguing that benchmarks which vary one component while holding the others at minimal defaults may produce conclusions that do not transfer to competitive setups. Its protocol covers domain-importance adaptation, loss balancing, network architecture, and optimization; it requires competitive implementations for components outside the study, specifies metrics and reporting, and includes documentation to improve traceability. The authors provide PINNpipe, a JAX package with 18 methods and nine benchmark problems, and use it to illustrate the protocol against established studies, reporting results that challenge common assumptions. The abstract does not specify those results. ### Source excerpt arXiv:2611.08559v1 Announce Type: new Abstract: The Physics-Informed Neural Network (PINN) literature has produced a rapidly expanding catalogue of methods. We divide a PINN training pipeline systematically into four components and observe that many existing benchmarks study these components in isolation. These components are domain-importance adaptation, loss balancing, neural network architecture, and optimization scheme. Moreover, the studies set the surrounding and not considered components of the pipeline to a minimal default that is no longer representative of current best practice approaches. Conclusions drawn under such conditions may not transfer to competitive pipelines. In this work, we propose a new evaluation protocol that (1) treats the four components as an integrated system; (2) crucially requires competitive implementations of the components not under investigation; (3) specifies the metrics and reporting format; and (4) is accompanied by structured documentation that ensures the traceability of evaluations across studies. Based on this comprehensive protocol, we release PINNpipe, an innovative JAX package containing 18 different methods from the current literature as well as nine efficiently implemented benchmark problems. Using PINNpipe, we illustrate our evaluation protocol in relation to established benchmark studies and report results that challenge common assumptions. ## OpenIndiana 2026.10 Released With Updated Tools & Compilers, New Apps DevFeed: [OpenIndiana 2026.10 Released With Updated Tools & Compilers, New Apps]() Original publisher: [Read original article]() Author: Michael Larabel Published: 2026-11-07T22:50:46Z Content type: release Language: en Sources: [Phoronix]() Topics: [Compilers and Linkers](), [Tool]() Tags: [2026](), [apps](), [compilers](), [desktop](), [desktop-linux](), [driver](), [ebook](), [firefox](), [gcc](), [intel](), [linux-benchmarking](), [linux-hardware-benchmarks](), [linux-hardware-reviews](), [linux-how-to](), [linux-performance](), [linux-server-benchmarks](), [llvm](), [navigation](), [open-source](), [open-source-graphics](), [open-source-software](), [operating-system](), [package](), [packages](), [perl](), [phoronix](), [phoronix-test-suite](), [python](), [tools](), [ubuntu-benchmarks](), [ubuntu-hardware](), [updated]() ### AI overview OpenIndiana Hipster 2026.10 is primarily a package refresh, with updates including Firefox and Thunderbird 159, GCC 15.3, LLVM Clang 23.1.4, Perl 5.44, and Python 3.15.2. It also adds UEFI framebuffer support through the illumosfb X.Org driver on the live image, newer QEMU and VirtualBox releases, TeX Live 2026, Foliate, and zoxide. In the author's test on an Intel Panther Lake Framework Laptop 13 Pro, the live system booted to MATE, but support for most device drivers was missing. The excerpt does not provide the complete package change list. ### Source excerpt OpenIndiana Hipster 2026.10 is out today as the newest six-month update to this operating system based on Illumos and with the lineage tracing back to the fruitful Sun OpenSolaris days... ## Japan Announces Emergency Cybersecurity Package Following a Wave of Attacks DevFeed: [Japan Announces Emergency Cybersecurity Package Following a Wave of Attacks]() Original publisher: [Read original article]() Author: Associated Press Published: 2026-11-06T18:28:41Z Content type: news Language: en Sources: [SecurityWeek]() Topics: [Cybersecurity](), [cyber resiliency](), [Incident response]() Tags: [ai](), [artificial-intelligence](), [breaches](), [cyberattack](), [cyberattacks](), [cybersecurity](), [data-breaches](), [emergency](), [government](), [hackers](), [japan](), [national-security](), [network](), [package]() ### AI overview Japan announced a 10 billion yen ($63 million) emergency cybersecurity package after unauthorized access and client data leaks affected dozens of companies and government agencies. It combines public-private information sharing and rapid assistance with stronger defenses: the government plans to access hackers' servers under its newly legalized "active cyber defense" authority, and a cross-agency team may be deployed when national security is at stake. By the end of November, the Ministry of Economy, Trade and Industry is to establish a team of cybersecurity experts who will use AI to counter hackers and find network weaknesses, working with technology companies and AI developers in friendly nations. A separate public-private cyber rescue team will provide initial responses to affected companies, while another team will help vulnerable companies improve defenses. ### Source excerpt The emergency package comes after dozens of companies and government agencies were hit by unauthorized access to their systems and leaks of client data, prompting uneasiness across Japan. The post Japan Announces Emergency Cybersecurity Package Following a Wave of Attacks appeared first on SecurityWeek. ## X.js: A Live Benchmark for Node.js Taint-Style Vulnerabilities DevFeed: [X.js: A Live Benchmark for Node.js Taint-Style Vulnerabilities]() Original publisher: [Read original article]() Author: Jos\\'e Afonso, Jo\\~ao Madeira Pereira, Ronghao Ni, Limin Jia, Jos\\'e Fragoso Santos, Pedro Ad\\~ao Published: 2026-11-05T05:00:00Z Content type: article Language: en Sources: [arXiv: Cryptography and Security](), [arXiv: Software Engineering]() Topics: [code security](), [Node.js](), [npm packages]() Tags: [benchmark](), [command-injection](), [cs-cr](), [cs-se](), [datasets](), [dependencies](), [ecosystem](), [execution](), [exploit](), [exploits](), [github-advisory-database](), [infrastructure](), [javascript](), [js](), [live](), [node-js](), [npm](), [npm-packages](), [package](), [path-traversal](), [pollution](), [vulnerabilities]() ### AI overview X.js is a live benchmark for evaluating research on Node.js taint-style vulnerabilities, addressing the gap left by datasets that stop in 2022. It covers code and command injection, prototype pollution, and path traversal. From 1,738 advisories collected through mid-2026, it provides source and sink locations, validated executable exploits with traces, and patched package versions when available. Dependencies are mirrored in a self-hosted registry, and infrastructure generates and validates exploits for newly reported vulnerabilities. The current release contains 1,159 validated exploits across 965 packages. Its analysis finds that the median size of vulnerable packages grew from about 250 lines of code in 2021-2022 to 6,100 in 2026. ### Source excerpt arXiv:2610.18585v3 Announce Type: replace-cross Abstract: JavaScript vulnerabilities in npm packages pose a significant risk to the Node$.$js ecosystem, and a growing body of work aims to detect, exploit, and mitigate them. Studying and evaluating this work requires up-to-date collections of real vulnerabilities, yet the most commonly used datasets stop recording vulnerabilities in 2022. We present X$.$js, a live benchmark of real-world Node$.$js taint-style vulnerabilities covering code and command injection, prototype pollution, and path traversal. Built from 1,738 advisories collected through mid-2026, primarily from the GitHub Advisory Database, X$.$js pairs each vulnerability with precise source and sink locations, a validated executable exploit and its execution trace, and, when available, a patched version of the package. X$.$js supports long-term reproducibility and growth: dependencies are mirrored in a self-hosted registry to guard against package removal from the ecosystem, and dedicated infrastructure generates and validates exploits for newly reported vulnerabilities. The current release contains 1,159 validated exploits for 965 packages. Using X$.$js, we characterize how the frequency, structure, and complexity of Node$.$js taint-style vulnerabilities have evolved over time. We find that these vulnerabilities are increasingly reported in large packages: the median vulnerable package grew from roughly 250 LoC in 2021--2022 to 6,100 LoC in 2026. ## pnpm 12.18.0 DevFeed: [pnpm 12.18.0]() Original publisher: [Read original article]() Author: Zoltan Kochan Published: 2026-11-05T00:00:00Z Content type: release Language: en Sources: [pnpm]() Topics: [pnpm](), [Agent Skills](), [project release]() Tags: [agent-skills](), [offline](), [package](), [platform](), [pnpm](), [registries](), [repeat](), [store]() ### AI overview pnpm 12.18.0 adds platform-specific package variants for registries configured with `serverType: pnpr`: it can pack and publish per-platform archives, install a host-compatible variant, record all variants in the lockfile, and fetch variants for configured architectures. Publishing variants to other registries is refused unless `--no-variants` is used; hosts with no matching variant skip optional dependencies and fail on other dependencies. The release also adds per-skill approval and link-directory selection, plus `pnpm store add` to prepare downloaded tarballs for offline installs. For pnpr registries, metadata downloads are reduced; one 787-package benchmark fell from 30.3 MB to 2.5 MB gzipped. Repeat installs and `verifyDepsBeforeRun` avoid rereading unchanged workspace manifests, with recursive execution in a 300-project workspace reported at 42 ms versus 490 ms before. The excerpt also lists fixes for peer resolution, lockfiles, store handling, and Cargo and Python dependency updates. ### Source excerpt pnpm 12.18.0 packs, publishes, and installs packages with platform variants on pnpr registries. It also adds per-skill approval of agent skills and pnpm store add for offline installs from downloaded tarballs. Repeat installs and verifyDepsBeforeRun no longer read the package.json of unchanged... ## GHSA-6prc-h956-hxjq: Filesystem Path Treats Any Prefix Before "://" as a Root, Letting Paths Escape Their Base Directory DevFeed: [GHSA-6prc-h956-hxjq: Filesystem Path Treats Any Prefix Before "://" as a Root, Letting Paths Escape Their Base Directory]() Original publisher: [Read original article]() Author: Fabien Potencier Published: 2026-11-04T11:54:00Z Content type: news Language: en Sources: [Symfony]() Topics: [Symfony]() Tags: [css](), [directory](), [filesystem](), [malicious](), [package](), [patch](), [php](), [root](), [scheme](), [security](), [symfony](), [wrapper]() ### AI overview Affected Symfony Filesystem versions were vulnerable because `Path::split()` treated any prefix before `://` as a root, leaving `..` segments unresolved. PHP may interpret such a string as a local path, so checks such as `isBasePath()` could approve a path that reads or writes outside its expected directory; `canonicalize()`, `join()`, `makeAbsolute()` and `makeRelative()` were also affected. In Symfony 6.4 and later, AssetMapper's use of `Path::join()` could let a malicious or compromised CSS package write outside `assets/vendor`. The fix recognizes a scheme only when PHP would look for a stream wrapper: a qualifying name at the start of the path followed by `://`; other prefixes are treated as path segments and `..` is resolved. Real schemes including `phar://`, `file://`, `vfs://` and `compress.zlib://` remain supported. Fixed releases are 5.4.56, 6.4.50, 7.4.23 and 8.1.11. ### Source excerpt Affected versions Symfony Filesystem versions >=5.4.0, <5.4.56, >=6, <6.4.50, >=7, <7.4.23, >=8, <8.1.11 are affected by this security issue. The issue has been fixed in Symfony Filesystem 5.4.56, 6.4.50, 7.4.23, 8.1.11. Description... ## EvoCache: Accelerating Browser Large Language Model Delivery with Public Cache Anchors DevFeed: [EvoCache: Accelerating Browser Large Language Model Delivery with Public Cache Anchors]() Original publisher: [Read original article]() Author: Zhiyu Wang, Rajkumar Buyya Published: 2026-11-04T05:00:00Z Content type: article Language: en Sources: [arXiv: Distributed Computing]() Topics: [Cache](), [Large Language Model](), [browser](), [Cryptography]() Tags: [browser](), [cache](), [cs-dc](), [delivery](), [downloads](), [experiments](), [file](), [language-model](), [language-models](), [large-language-model](), [large-language-models](), [large-language-models-llms](), [llm](), [llms](), [managed](), [network](), [network-traffic](), [package](), [pairs](), [popular](), [privacy]() ### AI overview EvoCache addresses poor whole-file cache reuse when the same browser LLM is repackaged by different publishers. The browser stores public cache anchors independently of browsing history, then selects an anchor and losslessly reconstructs the publisher version requested by a site; the site specifies the target but does not see the anchor or reconstruction. An audit of 1,000 public repositories found that 61 of the 100 most popular LLMs had multiple publishers, and 98.1% of overlapping versions could not be reused by whole-file caching. In 23 cross-publisher package pairs, EvoCache cut median traffic by 77.3%; in 240 browser experiments, it reduced traffic by 78.9% and page-ready time by 64.2% versus full downloads. It also uses the same return time for cache hits and misses to protect cross-site cache privacy. These results are reported for the study's tested packages and experiments. ### Source excerpt arXiv:2611.04638v1 Announce Type: new Abstract: Large Language Models (LLMs) can run directly in a browser, but first use typically requires downloading model files that are hundreds of MiB or even several GiB in size. The same LLM is often repackaged by different publishers; these files share substantial content, yet byte differences prevent whole-file caches from reusing them. We propose EvoCache, a browser-managed LLM delivery system. EvoCache uses public cache anchors that are stored in advance by the browser and independent of browsing history to reconstruct losslessly the publisher version requested by a site. A site specifies only the target, while the browser selects the anchor and performs reconstruction, keeping both hidden from the site. An audit of 1,000 public repositories finds that 61 of the 100 most popular LLMs are offered by multiple publishers and that 98.1% of overlapping versions cannot be reused by whole-file caching. Across 23 cross-publisher model-package pairs, EvoCache achieves a median traffic reduction of 77.3% and outperforms every comparator. Across 240 real end-to-end browser experiments, EvoCache reduces network traffic by 78.9% and page-ready time by 64.2% relative to ordinary full downloads. For cached data left by other sites, EvoCache also protects users' cross-site cache privacy by using the same return time for cache hits and misses. ## Structured Priors: Towards an algebra of component priors for prior-data fitted networks DevFeed: [Structured Priors: Towards an algebra of component priors for prior-data fitted networks]() Original publisher: [Read original article]() Author: Thomas Bartz-Beielstein Published: 2026-11-04T05:00:00Z Content type: article Language: en Sources: [arXiv: Machine Learning]() Topics: [machine learning overfitting]() Tags: [algebra](), [amplitude](), [bayes](), [benchmarks](), [budget](), [component](), [convolution](), [cs-lg](), [data](), [distributive](), [error](), [experiments](), [failed](), [framework](), [function](), [generator](), [networks](), [operators](), [package](), [projection](), [structured]() ### AI overview The paper proposes structured priors for prior-data fitted networks: named component priors combined with operators for mixture, convolution, amplitude scaling, local transformation, and projection, with algebraic laws proven and implemented in macl2l. Experiments report that trained networks obey the distributive law and that mixed priors match or outperform individual components on seven of eight open regression benchmarks. On two tables, a structured prior reached an error that a generic random-function prior did not reach even with nine times the data. A model-averaging theorem says component Bayes predictors yield the mixture Bayes predictor under its stated assumptions, but a preregistered test using trained component networks failed because they identified the generating component too rarely. ### Source excerpt arXiv:2611.04056v1 Announce Type: new Abstract: Prior-data fitted networks are typically trained using synthetic data generated by a single, manually constructed generator. In cases where such a generator combines multiple components, e.g., in TabPFN, Mitra, or TabICLv2, this is achieved through a mixture using manually specified weights, the impact of which on the network only becomes apparent after pre-training. Instead of such a hand-built generator, this work proposes a structured prior: a small set of named component priors, linked by operators whose algebraic properties are formally proven and whose influence on the trained network has been validated. Within a measure-theoretic framework, the operators of mixture, convolution, amplitude scaling, local transform, and projection are defined. Their governing laws are proven. These operators are implemented in the macl2l software package. Experiments demonstrate that the implemented generators reproduce the identities within the resolution of a permutation test. Furthermore, it is shown that trained networks obey the distributive law; that a mixed prior composed of small components performs as well as or better than any individual component in seven out of eight open regression benchmarks; and that on two of these tables a structured prior reaches, with a ninth of the data budget, an error that a generic random-function prior does not reach even with the full budget. A theorem on model averaging demonstrates that networks trained on individual components constitute the Bayes predictor for the mixture, provided that the component networks are themselves the Bayes predictors for their respective priors. However, the pre-registered test of this averaged predictor with trained component networks failed, because the networks identify the generating component too rarely. The paper proposes a research program focused on the algebra of structured priors for prior-data fitted networks. ## NepTTS-Bench: Native-Speaker Benchmarking and NepaliMOS for Nepali Text-to-Speech DevFeed: [NepTTS-Bench: Native-Speaker Benchmarking and NepaliMOS for Nepali Text-to-Speech]() Original publisher: [Read original article]() Author: Ashish Thapa, Rupak Ghimire, Lekhnath Sharma Pathak Published: 2026-11-04T05:00:00Z Content type: article Language: en Sources: [arXiv: Artificial Intelligence]() Topics: [Benchmark](), [DeepFact-Bench]() Tags: [asr](), [automated](), [bench](), [benchmarking](), [cs-ai](), [eess-as](), [native](), [package](), [python](), [speakers](), [speech](), [text-to-speech]() ### AI overview NepTTS-Bench compares Nepali text-to-speech systems using 205 phonologically grounded sentences, including 77 minimal pairs, rated by 180 speakers. Across 6,962 ratings of 10 TTS configurations and two human references, SCOREQ favored proprietary systems such as ElevenLabs, while native listeners preferred Piper. The benchmark attributes this mismatch in part to Hindi phonological behavior in systems not properly tuned for Nepali; its minimal pairs target contrasts such as aspiration, retroflex versus dental sounds, nasalization, gemination, and schwa deletion. NepaliMOS, trained on the collected ratings, reached system-level rho = 0.90 on the dense panel but utterance-level rho = 0.43 in leave-one-system-out evaluation, indicating limited transfer across providers. The authors recommend human calibration for new systems and provide a Python evaluation package. ### Source excerpt arXiv:2611.03718v1 Announce Type: cross Abstract: Nepali TTS has reached a point where multiple systems are available, but there is no shared evaluation to compare them. NepTTS-Bench was created to address what existing automated and manual evaluation systems lack for Nepali TTS. A controlled benchmark with phonological grounding which contains 205 sentences (77 minimal pairs targeting aspiration, retroflex/dental contrasts, nasalization, gemination, and schwa deletion) which is rated by 180 speakers. There are 6,962 ratings for 10 TTS configurations and two human references. Along with this 7 ASR systems were evaluated for round-trip CER. SCOREQ was also run as an automated baseline. The key finding is that automated evaluation like SCOREQ prefers proprietary systems like ElevenLabs but native listeners prefer Piper. This is contributed by the fact that most of the systems not properly tuned for Nepali tend to show Hindi phonological behaviour and our minimal pairs are designed to surface such contrasts. We also present NepaliMOS predictor which is fine tuned on collected ratings. NepaliMOS achieves system-level rho = 0.90 on the dense panel but drops to utterance-level rho = 0.43 under leave-one-system-out evaluation. This is statistically significant and confirms that NepaliMOS captures genuine signal but cross-provider transfer is limited. A human calibration is recommended for new systems for which we release a Python evaluation package for practitioners to run the benchmark against new systems. ## Prevent Duplicate File Uploads With Laravel Storage Dedupler DevFeed: [Prevent Duplicate File Uploads With Laravel Storage Dedupler]() Original publisher: [Read original article]() Author: Yannick Lyn Fatt Published: 2026-11-03T23:56:25Z Content type: article Language: en Sources: [Laravel]() Topics: [Laravel](), [Eloquent ORM]() Tags: [composer](), [database](), [deduplication](), [directory](), [eloquent](), [files](), [github-repository](), [hash](), [installation](), [laravel](), [laravel-packages](), [migrations](), [mit](), [models](), [null](), [package](), [storage](), [uploads]() ### AI overview Laravel Storage Dedupler uses SHA-1 hashes to reuse stored files with matching content, even when filenames differ; the hash is also the `UniqueFile` record's primary key. Its storage methods accept uploads, local paths, or raw content and may return `null` for invalid sources or storage errors. With the `Deduplable` trait, saved Eloquent models can attach a shared file; detaching preserves it while other attachments exist, but deleting the final attachment removes the file and record by default. Installation does not alter existing Laravel storage calls or clean up existing duplicates. The legacy analysis command scans a local directory tree, reports duplicate counts and estimated space savings, and does not migrate or delete files. ### Source excerpt Laravel Storage Dedupler uses SHA-1 hashes to prevent duplicate file storage, attach files to Eloquent models, and analyse existing directories. The post Prevent Duplicate File Uploads With Laravel Storage Dedupler appeared first on Laravel News. Join the Laravel Newsletter to get Laravel articles like this directly in your inbox. ## Manage Java transitive dependencies with Lightwell rebuilds DevFeed: [Manage Java transitive dependencies with Lightwell rebuilds]() Original publisher: [Read original article]() Author: Matej Marušák Published: 2026-11-03T15:14:34Z Content type: tutorial Language: en Sources: [Red Hat](), [Red Hat Developer]() Topics: [ibm red hat project lightwell](), [software composition analysis](), [code security](), [Maven](), [CI/CD](), [renovate](), [Dependabot]() Tags: [automated](), [automatically](), [behind-the-scenes](), [but](), [challenge](), [dependencies](), [developer](), [development](), [devsecops](), [ecosystem](), [first](), [java](), [libraries](), [lightwell](), [manager](), [nested](), [package](), [packages](), [rebuilds](), [security](), [transitive-dependencies](), [with]() ### AI overview Java's pinned Maven and Gradle versions make it difficult for direct-dependency update tools such as Renovate or Dependabot to remediate vulnerabilities deep in transitive trees. The article describes three ways to use Lightwell's security-focused Java rebuilds: select packages manually from its catalog or API for granular control, with poor scalability; analyze the full dependency tree and review a report of matching rebuilds, then copy coordinates into pom.xml; or generate a BOM that pins matching rebuilds for auditability and version control, at the cost of continuous pipeline runs and BOM maintenance. The example pin-transitives.mjs script is only a starting point and lacks advanced filtering and CVE tracking. The article discourages opaque proxy-based substitutions because they can make builds nonreproducible and unverifiable; visible Maven relocations still warrant caution. ### Source excerpt Updating direct dependencies in Java is straightforward, but securing the hundreds of transitive libraries running beneath them is where many development pipelines stall. While automated tools simplify how teams upgrade direct dependencies--the packages your project explicitly declares--the Java ecosystem presents a challenge: pinned versions and deeply nested trees of transitive dependencies. Transitive dependencies are the libraries your direct dependencies rely on behind the scenes, which your package manager pulls in automatically. The post Manage Java transitive dependencies with Lightwell rebuilds appeared first on Red Hat Developer. ## AI coding agents are installing MCP servers that will never be patched DevFeed: [AI coding agents are installing MCP servers that will never be patched]() Original publisher: [Read original article]() Author: Mirko Zorz Published: 2026-11-03T05:45:53Z Content type: news Language: en Sources: [Help Net Security]() Topics: [agentic-coding](), [Agent Harness](), [AI-assisted coding](), [software dark matter](), [ecosystem-security](), [trust]() Tags: [agent](), [agents](), [ai](), [ai-coding](), [ai-coding-agent](), [ai-coding-agents](), [anthropic](), [claude-code](), [coding](), [coding-agent](), [coding-agents](), [cursor](), [cybersecurity](), [deprecated](), [developer](), [github](), [glow](), [labs](), [machines](), [mcp](), [mcp-servers](), [news](), [openai](), [package](), [patched](), [research](), [servers](), [software-development]() ### AI overview Glow Labs reports that coding agents installed or suggested deprecated MCP servers in the sessions it examined; in 98% of those cases, agents appeared to select package names from training data. The pattern spanned several coding tools and models. Four high-severity vulnerabilities were found in the reference servers, including a Puppeteer server flaw that can turn browser access into arbitrary command execution through prompt injection. The archived repository will not be patched, and npm deprecation warnings would not prevent npx installation. The excerpt says common controls can miss these servers because npx installs leave no dependency manifest or registered application, and one agent installed a package despite finding its deprecated status. Suggested steps include replacing deprecated servers with service-owner versions where available, approving one server per service, and including npm deprecation status in approval criteria. Harness warnings or refusal and security checks through pre-execution hooks are also proposed; coverage may vary across harnesses. ### Source excerpt When a developer tells an AI coding agent to "set up a GitHub MCP," the agent has to pick a package. New research from Glow Labs documents sessions where it picked one out of an archived repository that will never be patched again. Source: Glow Security Reviewing real AI coding session transcripts, Glow Labs found deprecated MCP servers landing on developer machines, a pattern it calls MCPhantom. In 98% of those sessions, the agent appears ... More -> The post AI coding agents are installing MCP servers that will never be patched appeared first on Help Net Security. ## WFDB-x: Conformance-Tested Implementations of the WFDB Software Package in Seven Programming Languages DevFeed: [WFDB-x: Conformance-Tested Implementations of the WFDB Software Package in Seven Programming Languages]() Original publisher: [Read original article]() Author: Reza Sameni Published: 2026-11-03T05:00:00Z Content type: article Language: en Sources: [arXiv: Software Engineering]() Topics: [Programming](), [c/c++](), [Test-driven development](), [Fuzzing/Fuzz testing](), [Open Source]() Tags: [ai](), [ai-assistance](), [ai-assisted](), [ai-assisted-development](), [annotation](), [annotations](), [benchmark](), [c](), [c-plus-plus](), [command-line](), [cross](), [cs-dl](), [cs-pl](), [cs-se](), [development-process](), [differential-fuzzing](), [environment](), [faster](), [languages](), [package](), [programming](), [programming-languages](), [software]() ### AI overview WFDB-x reimplements WFDB Software Package 10.7.0 in Python, C++, Rust, Julia, R, MATLAB/Octave, and Kotlin, with library functions, high-level interfaces, and command-line tools in each. To address inconsistent corner-case behavior and risky implicit waveform defaults, it removes implicit parameters, restricts file and network access, and prevents annotation loss; legacy mode preserves original behavior. On the tested Linux platform, all seven implementations matched the original C programs across 1,098 conformance cases and 877 legacy-mode cases, alongside 9,353 unit-test assertions and differential fuzzing. Reported benchmarks show C++, Rust, and Julia reading records 1.5-6.9 times faster than the original C library, and Python writing 9.2 times faster than wfdb-python. Results are limited to the reported tests and platform. ### Source excerpt arXiv:2611.01358v1 Announce Type: new Abstract: The WFDB format is widely used to store and exchange physiological waveforms and annotations. However, existing software implementations are limited to C, Python, and MATLAB/Octave, can produce different results in corner cases and checksum calculations, and have defaults such as sampling frequency and gain, that can lead to silent misinterpretation of recordings. We developed WFDB-x, a cross-language, performance-optimized reimplementation of WFDB in seven programming languages, with extensive unit tests, to provide consistent WFDB processing across programming languages. We reimplemented the WFDB Software Package 10.7.0 natively in Python, C++, Rust, Julia, R, MATLAB/Octave, and Kotlin, using AI-assistance under human direction and review. Each implementation has library functions, a high-level interface, and command-line tools. We compared their outputs with those of the original C programs using 1098 conformance cases, 877 legacy-mode cases, unit tests, and differential fuzzing. Deliberate changes remove implicit waveform parameters, restrict file and network access, and prevent annotation loss. A legacy mode retains the original behavior. All seven implementations passed every conformance and legacy-mode case on the tested Linux platform, with matching outputs. The unit tests contain 9353 assertions. C++, Rust, and Julia read records 1.5-6.9 times faster than the original C library, while the Python implementation wrote records 9.2 times faster than the existing wfdb-python library in the benchmark. WFDB-x provides a tested, open-source basis for reading and writing physiological recordings consistently across seven languages, supporting reproducible research and software development without requiring a shared programming environment. We also share details of the AI-assisted development process and token utilization, which may be useful for other applications. ## Cooldown Dependency Policy now in Composer 2.11 DevFeed: [Cooldown Dependency Policy now in Composer 2.11]() Original publisher: [Read original article]() Author: Yannick Lyn Fatt Published: 2026-11-03T03:20:08Z Content type: release Language: en Sources: [Laravel]() Topics: [Composer](), [Dependency management](), [policy-as-code]() Tags: [composer](), [dependency](), [faster](), [news](), [package](), [period](), [policy](), [published](), [security](), [security-fixes]() ### AI overview Composer 2.11 adds an opt-in cooldown policy that withholds recently published package versions during dependency resolution. Configure a period such as "1 day"; `update` and `require` observe it, while `install` continues to use the lock file unchanged. Full updates may replace a locked version still in cooldown with an older satisfying release, or fail if none exists. Dev versions and platform packages are exempt; trusted packages can be ignored, and `--no-cooldown` bypasses only this policy. Repositories generally need to provide `published-time`; trusted repositories can fall back to package `time`, while VCS, path, and artifact repositories always use `time`. The release also lets custom policies block installs, removes automatic source fallback after dist download failures, and includes six security fixes and faster resolution. Projects needing source installs must configure `preferred-install` or use `--prefer-source`; policy config changes can make the lock file outdated. ### Source excerpt Composer 2.11 can hold back newly published package versions for a set period before installing them. It also ships six security fixes and faster resolution. The post Cooldown Dependency Policy now in Composer 2.11 appeared first on Laravel News. Join the Laravel Newsletter to get Laravel articles like this directly in your inbox. ## SimPy: Simulating Real-World Processes With Python DevFeed: [SimPy: Simulating Real-World Processes With Python]() Original publisher: [Read original article]() Author: Jaya Zhané Published: 2026-11-02T14:00:00Z Content type: tutorial Language: en Sources: [Real Python]() Topics: [Python]() Tags: [2](), [3](), [about](), [addition](), [agencies](), [agent](), [agents](), [airport](), [design](), [model](), [package](), [processes](), [python](), [real-world](), [run](), [shows](), [simulation](), [system](), [with](), [world]() ### AI overview SimPy models congestion by representing people as processes that request limited resources, wait for them, and release them when each task is done. The tutorial builds a movie-theater simulation: moviegoers arrive initially in a group of three and then every 12 seconds, buy tickets, have tickets checked, and may buy food. Random task durations approximate observed service times, and the script records average time from arrival to reaching a seat. Users vary cashier, server, and usher counts and run the simulation for 90 minutes to compare staffing scenarios against a 10-minute average-wait target. The example reports 42 minutes 53 seconds with one of each worker and 9 minutes 60 seconds with nine cashiers, six servers, and one usher; these are tutorial outputs, not a general guarantee. ### Source excerpt Use the SimPy package to model real-world processes in Python, then design and run a simulation that shows where a system gets congested. ## The first ten lines of a command policy for AI coding agents DevFeed: [The first ten lines of a command policy for AI coding agents]() Original publisher: [Read original article]() Author: Mirko Zorz Published: 2026-11-02T06:30:36Z Content type: article Language: en Sources: [Help Net Security]() Topics: [ai security](), [agentic-coding](), [human in the loop agent]() Tags: [agent](), [agent-identity](), [agents](), [ai](), [ai-agents](), [ai-coding](), [ai-coding-agents](), [coding](), [coding-agent](), [coding-agents](), [command](), [credentials](), [cto](), [cxo](), [cybersecurity](), [data](), [don-t-miss](), [features](), [hot-stuff](), [identity](), [interview](), [network](), [news](), [opinion](), [package](), [policy](), [security](), [strategy](), [tips]() ### AI overview Thakker recommends giving every agent its own scoped identity; when it acts for a person, also carry that person's identity and require both to authorize the action. Keep long-lived secrets out of agents: use a proxy to attach short-lived, call-scoped credentials, with per-agent identity, least privilege and destination limits. For terminal coding agents, enforce an allowlist in the harness: confine work to a disposable repository, restrict commands and network access, route packages through an internal mirror, block secret files and privilege changes, and require approval for dependencies or consequential operations. Backstop policy with controls such as branch protection, firewall rules and identity systems. Start network access off, allow only needed hosts, and recognize that an approved host can still receive data in URL parameters. Red-team the surrounding system by testing what a compromised agent can reach and how quickly misuse is detected; recovery may require cleaning writable memory, configuration and templates as well as revoking credentials. ### Source excerpt In this Help Net Security interview, Vinay Thakker, CTO of KloudStax, explains how to set identity, credentials, and network limits for AI agents. He argues that agents should run under their own identity, with the person's identity attached when acting on someone's behalf. He covers where credential proxies go wrong, what the first ten lines of a command policy for a coding agent should say, and how to stop data from leaving through package installs ... More -> The post The first ten lines of a command policy for AI coding agents appeared first on Help Net Security. ## PIE 1.5 Changes PHP Extension Installs in CI DevFeed: [PIE 1.5 Changes PHP Extension Installs in CI]() Original publisher: [Read original article]() Author: Yannick Lyn Fatt Published: 2026-11-02T00:42:47Z Content type: tutorial Language: en Sources: [Laravel]() Topics: [PHP](), [CI/CD](), [Composer]() Tags: [1-5](), [changes](), [ci](), [development](), [extension](), [extensions](), [install](), [laravel](), [news](), [package](), [php](), [pie](), [project](), [redis](), [releases](), [update]() ### AI overview PIE 1.5 makes unattended project installs require an explicit package choice for each missing extension: the former `--allow-non-interactive-project-install` flag is deprecated and ignored. For production CI, use `--select=redis=phpredis/phpredis` and `--no-dev` to install the Redis extension while excluding `require-dev` extension checks such as Xdebug. `--no-dev` does not remove installed extensions or replace `composer install --no-dev`. Development installs can select both Redis and Xdebug. PIE also adds `pie upgrade`, which upgrades PIE-installed extensions within their recorded version constraints and carries configure options forward; changing a constraint is needed to move beyond its allowed versions. `pie install` can now take multiple package names, and `pie search` helps find them. The excerpt says PIE and required build dependencies must already be available unless missing build tools are explicitly requested in non-interactive mode. ### Source excerpt PIE 1.5 requires explicit extension package choices in CI. See how to update a Laravel project's Redis install and skip development extensions. The post PIE 1.5 Changes PHP Extension Installs in CI appeared first on Laravel News. Join the Laravel Newsletter to get Laravel articles like this directly in your inbox. ## Your CI pipeline needs a lockfile, too DevFeed: [Your CI pipeline needs a lockfile, too]() Original publisher: [Read original article]() Author: Amit Merchant Published: 2026-11-02T00:00:00Z Content type: article Language: en Sources: [Amit Merchant]() Topics: [CI/CD](), [least privilege](), [npm]() Tags: [ci](), [composer](), [cryptographic](), [data](), [dependency](), [ecosystem](), [file](), [javascript](), [like](), [locks](), [miscellaneous](), [name](), [needs](), [npm](), [other](), [package](), [php](), [pipeline](), [records](), [resource](), [with]() ### AI overview GitHub Actions workflow lockfiles let workflows keep readable action references while recording the exact commits they resolve to in `.github/workflows/actions.lock`. Install the `github/gh-actions-lock` extension and run `gh actions-lock` to generate the file. GitHub Actions uses it to resolve references to recorded commits, and Dependabot can update corresponding lockfile entries when it updates supported action dependencies. This helps keep workflow code consistent, but does not make dependencies trustworthy or lock other build inputs such as runner images or arbitrary action inputs. The article says to continue reviewing dependencies, minimizing permissions, and securing the pipeline. ### Source excerpt Lockfiles might be familiar to you if you've ever worked with package managers like npm or Yarn (for the JavaScript ecosystem) or Composer (for the PHP ecosystem). A lockfile, as the name suggests, is a data file generated by these package managers that "locks in" or, in other words, records exact dependency versions, cryptographic hashes, or resource-access states. ## 6 insights from the GSA Women's Leadership Initiative: AI semiconductor industry trends turn the chip race into a systems race DevFeed: [6 insights from the GSA Women's Leadership Initiative: AI semiconductor industry trends turn the chip race into a systems race]() Original publisher: [Read original article]() Author: Jonathan Anthony Published: 2026-10-30T20:28:11Z Content type: news Language: en Sources: [SiliconANGLE]() Topics: [Chip design](), [Physical AI](), [Machine learning](), [communications](), [reliability-engineering]() Tags: [advanced-computing](), [advanced-packaging](), [advanced-semiconductor-engineering-inc](), [ai](), [ai-infrastructure](), [alisa-wang](), [alison-kosik](), [ansys](), [arm-ltd](), [artificial-intelligence](), [ase](), [career-advancement](), [chip](), [chip-design](), [chips](), [components](), [cost](), [credo-technology-group-holding-ltd](), [cube-event-coverage](), [cxl](), [decades](), [dmtf](), [emib-bridge-technology](), [engineering-leadership](), [executive-sponsorship](), [female-executives](), [gina-longoria](), [globalfoundries-inc](), [gsa-womens-leadership-initiative-2026](), [gsawomensleadershipinitiative](), [high-bandwith-compute](), [iliana-chen](), [industry](), [industry-trends](), [infra](), [initiative](), [insights](), [intel-corp](), [john-furrier](), [lakshmi-ramagiri](), [leadership](), [news](), [package](), [performance](), [rack](), [reliability](), [semiconductor](), [semiconductor-industry](), [systems](), [thecube](), [trends](), [women]() ### AI overview AI semiconductor competition is shifting from optimizing individual chips to coordinating whole systems: package, rack, connectivity and supply chain now shape performance, cost and reliability from the start. The article highlights six related developments: data movement is becoming an infrastructure bottleneck, prompting optical links to move closer to compute; advanced packaging and chiplet connections are becoming part of system architecture; AI analysis of design and manufacturing data can catch yield problems earlier; physical AI requires coordinated architecture, firmware, security and standards; sourcing and second suppliers are becoming product decisions under constrained capacity; and AI tools are entering chip design and verification as development cycles shorten. The reported gains and strategies are attributed to specific industry leaders and companies, rather than presented as universal results. ### Source excerpt For decades, the semiconductor industry competed on one thing: the individual chip. One of the biggest AI semiconductor industry trends now under way is the shift toward treating chips as components of much larger systems. Performance, cost and reliability are now determined across the package, the rack and the supply chain, not inside a single [...] The post 6 insights from the GSA Women's Leadership Initiative: AI semiconductor industry trends turn the chip race into a systems race appeared first on SiliconANGLE. [Next page]()