submitted by /u/Patient-Pollution46 [link] [留言]

Dependabot keeps your dependencies current, but its defaults can flood your repository with pull requests. Here's how grouping updates, slowing the cadence, and keeping security fixes fast cut the noise on a Microsoft open source project. The post Tame Dependabot: Group your updates, slow the cadence, keep security fast appeared first on The GitHub Blog .

Build, ship, and improve at scale Discussion | Link

Hi HN, Rohit here from Tokenless (usetokenless.com), which I’m building alongside co-founders Andrew and Kev. We’re building an API gateway which routes agent traffic dynamically turn-by-turn between different models to save on AI spend. The cost of AI tokens is top-of-mind for many. Companies like Uber and Salesforce have been complaining about blowing their yearly AI spend faster than expected. Frontier models are amazing for dev work, but are so expensive. Open-source models are cheap and rap

Download my Automation Testing Interview Questions from ⬇️ Apple AppStore - https://apps.apple.com/us/app/qa-automation-interview-prep/id6786760948 👈 ⬇️ Playstore - https://play.google.com/store/apps/details?id=com.app.seleniuminterviewquestions 👈 The standard advice for passing a QA Engineering interview is broken. If you ask a forum how to prepare, you will be told to "learn Playwright," "memorize XPath," or "know how to write a basic API GET request in Postman." That advice worked in 2021. Today, engineering teams do not want manual testers who learned basic syntax. They are hiring Software Engineers in Test (SDETs) who understand system architecture, CI/CD pipelines, and data state. If you are failing technical rounds, it is rarely because you forgot a WebDriver command. It is because you are testing the syntax instead of the system. Here are the two architectural concepts you are actually being judged on in a modern QA interview, and how to approach them. 1. The API Race Condition & Idempotency Trap In a technical round, a senior engineer will rarely ask you to "test a login endpoint." Instead, they will give you a scenario like this: "We have a microservice that processes payments. The user clicks 'Submit', but the network drops, so they click it again. How do you automate a test to ensure they aren't charged twice?" The Junior Answer: "I will write an automated script that clicks the button twice quickly and checks the database." The Senior Answer (What they want to hear): "I will write a test that validates the API's idempotency . I will intercept the first request, capture the unique idempotency key from the header, and fire a duplicate POST request with the exact same payload and key. The test must assert that the backend returns a 409 Conflict or a 200 OK with the original transaction ID, verifying the database state didn't duplicate the charge." If you do not understand idempotency, payload validation, and race conditions, your API automation is just che

Six months ago I wrote up my local AI setup and a reader bookmarked it, tried to reproduce it last week, and emailed me confused because half of it no longer matched what I actually run. Fair. Stacks rot quietly. So here's the mid-2026 state of mine: what's still earning its place on disk, what I deleted, and where I quietly went back to the cloud. Context for the numbers and opinions below: I do smart contract security work, I run everything on WSL2 on a machine with a modest GPU, and I've been doing the local-model thing daily for over a year, not as a hobby but as part of shipping. Still here: Ollama as the runtime Ollama remains the center of the local stack and honestly it's not close. I've tried the alternatives, llama.cpp directly for control, a couple of the newer serving layers for speed, and I keep coming back for one boring reason: the API is stable and everything I've built talks to it. My audit tooling, my shell scripts, my editor config, they all point at localhost:11434 and they've pointed there for a year without breaking. That stability matters more than a marginal tokens-per-second win. When a model update lands, ollama pull and I'm done. The day something meaningfully better appears with the same API shape, I'll switch in an afternoon, which is exactly the position you want to be in. Still here: qwen2.5-coder, both sizes, different jobs I run two models and the split has stayed remarkably stable: qwen2.5-coder:1.5b is the reflex model. It handles anything where speed matters more than depth: quick "what does this diff do" summaries, commit message drafts, pre-filtering files before a heavier pass, and the small classification jobs inside my pipelines ("does this file handle user input, yes or no"). It's fast enough on my machine that I never think about invoking it, and that's the whole point. A model you hesitate to call is a model you stop calling. qwen2.5-coder:7b is the thinking model. Code review, security triage, structured findings extracti

Microsoft is on a mad dash behind the scenes to patch exploits before hackers find them.

Hey everyone, Whenever I start scaling out a new Rust service or protocol, I always find myself hitting the same wall: testing gets messy fast. You end up juggling basic cargo test unit checks, hacking together ad-hoc integration scripts, and manually setting up coverage tools every single time. I put together RustForge to solve that headache for my own projects, and figured it might save a few of you some time too. It’s a clean, zero-bloat starter template designed to take you from simple unit tests all the way to compiler-style UI snapshots and coverage tracking without having to reinvent the harness every project. https://github.com/rwilliamspbg-ops/RustForge

AI agents often begin as application code: a prompt, a model call, a few tools, and enough control flow to make the first example run. As the agent grows, the definition and the environment tend to collapse into each other. Model configuration lives beside credentials. Tool access is mixed with prompts. Persistence assumes a particular process. Deployment choices become part of the agent itself. That coupling makes an agent harder to inspect, test, move, and recover. We built Clear Ideas Agent Runtime around a different boundary: the agent definition should be portable, while the infrastructure that executes it should remain under host control. The Agent Manifest is the portable contract An Agent Manifest is a versioned YAML or TypeScript definition. It can describe: prompts and structured outputs; typed variables; conditions and loops; tools and MCP connections; approvals and webhooks; sandboxed code steps; sub-runs; limits and final outputs. A separate Agent Run Manifest supplies the values and execution choices for one invocation. That keeps the reusable agent definition distinct from the inputs and operational decisions associated with a particular run. Here is a small example: schemaVersion : " 1.0" name : research-brief variables : topic : type : string researchNotes : type : string briefDraft : type : string steps : - id : research type : prompt prompt : | Research {{ topic }} and return concise notes. outputVariable : researchNotes - id : draft type : prompt prompt : | Draft a brief using these notes: {{ researchNotes }} outputVariable : briefDraft The manifest describes the agent. It does not contain the credentials, infrastructure account, or persistence implementation that happens to run it. The host controls the operational boundary The host application supplies and controls: models and provider credentials; connections and tool authorization; persistence and artifact stores; local or remote compute; sandbox providers; telemetry; concurrency and resource

submitted by /u/BrewedDoritos [link] [留言]

There's a new underwater location to explore and a dive mechanic.

I registered the domain onlyfans.sexy ~6 years ago as a gag where I'd post pictures of fans (everything on the site and in this post is SFW). This year I got an email stating that, like all prior years, the domain would auto-renew at $38 in seven days and didn't think anything of the next two emails also notifying me that the domain would auto-renew. It would seem that I very much SHOULD have paid attention to those next two emails, because in both the three and one day renewal emails the price

https://mitchellh.com/writing/superlogical

X sued the WFA in 2024 for conducting what it called a "systematic illegal boycott" of the platform after it saw a decline in advertising revenue following Musk's $44 billion takeover of the social network

Beginner's Guide: Connect React with Supabase 🚀 If you already know basic React (components, useState , useEffect ), this guide will show you how to connect your React app to Supabase — an open-source Firebase alternative — and build a simple To-Do app with full CRUD (Create, Read, Update, Delete). Let's go step by step. No prior Supabase knowledge needed. What is Supabase? Supabase gives you a Postgres database , authentication , and instant APIs — without writing any backend code. Think of it as a backend-as-a-service. For this guide, we'll just use the database + auto-generated API part. Step 1: Create a Supabase Project Go to supabase.com and sign up (GitHub login is fastest). Click New Project . Fill in: Name : todo-app (anything you like) Database Password : save this somewhere safe Region : pick the closest one to you Click Create new project and wait ~1-2 minutes while Supabase sets everything up. Step 2: Create the todos Table In your Supabase project dashboard, go to the Table Editor (left sidebar). Click New Table . Name it todos . Add these columns (in addition to the default id and created_at ): Column Name Type Default task text — is_complete bool false Click Save . 💡 Tip: You can also do this via the SQL Editor by running: create table todos ( id bigint generated by default as identity primary key , task text not null , is_complete boolean default false , created_at timestamp with time zone default now () ); Turn off Row Level Security (for learning purposes only) Go to Authentication > Policies (or Table Editor > todos > RLS), and disable RLS for now so your students can read/write freely without setting up auth. ⚠️ Important for your session : Tell your juniors this is only for a demo/learning project. In a real production app, RLS should always be enabled with proper policies. Step 3: Get Your API Keys Go to Project Settings > API . Copy two things: Project URL (looks like https://xxxxx.supabase.co ) anon public key (a long string) You'll need both

If your training dashboard starts as one HTTP request and grows into athletes, activities, wellness, workouts, gear, and performance data, a hand-written fetch wrapper becomes expensive to maintain. Every new endpoint adds another URL, another response shape, and another place to get authentication or retry behavior wrong. This tutorial shows a small, reproducible path with intervals-icu , an open-source TypeScript client for the Intervals.icu API . The goal is not to build a complete training application. It is to establish a typed client, choose the right authentication boundary, call one service, and understand what changes when you move from version 1 to version 2 of the library. TL;DR Install the stable npm package, create an IntervalsClient with an API key or OAuth access token, and use service accessors such as client.athletes or client.activities. Version 2 uses typed service methods, retries selected transient failures, and defaults requests to the authenticated athlete. Prerequisites You need: Node.js 18 or newer. npm. An Intervals.icu account with an API key, or an OAuth access token for an application acting for other users. A TypeScript project that can run ESM modules. The published package is intervals-icu version 2.2.1, and its package metadata declares Node.js >=18.0.0. The repository is public and licensed under MIT. The examples below target that stable package version, not an unreleased default-branch change. Install the stable client Create a small project and pin the package version used in this tutorial: mkdir intervals-demo cd intervals-demo npm init -y npm install intervals-icu@2.2.1 npm install -D typescript tsx The package publishes both ESM and CommonJS entry points and exposes TypeScript declarations from its package root. Add a script so a .ts file can run without a separate build step: { "type" : "module" , "scripts" : { "start" : "tsx src/index.ts" } } Create the smallest useful client Create src/index.ts. Keep the credential outside

Legacy modernization often looks like a technical task: update old code, rewrite the system, move it to the cloud, or replace outdated dependencies. In practice, it is always work with risk. A legacy system often holds business logic, old integrations, hidden dependencies, data flows, users, security rules, downtime limits, costs, and migration constraints. AI can speed up part of this work. It can help with documentation, code analysis, dependency mapping, test generation, duplicate logic detection, and explanations of old code. But AI does not have enough context to decide what should be rewritten first, which architecture should be chosen, which risks are acceptable, and which areas should not be touched before proper discovery. Legacy Modernization Is Risk Management, Not Just Code Cleanup Legacy modernization is not simply about rewriting old code. Very often, an old system still supports critical business processes: payments, reporting, internal operations, client workflows, integrations, and data history. The problem is not only that the code is old. The bigger problem is that changing it can break something important. Documentation may be incomplete or outdated. Some business logic may exist only inside old code. Some dependencies may be unclear. Some workflows may still rely on behavior that nobody fully documented. Legacy systems often work, but they slow down development. Every change takes longer. Every new feature carries more risk. Engineers spend more time understanding side effects than building improvements. AI can help teams understand the system faster, but it cannot replace a modernization strategy. AI Can Help Teams Understand the Existing System Faster AI is useful during discovery, especially when the team needs to understand what already exists in the system. It can help explain old code, identify main modules, create technical documentation, summarize complex classes, services, and functions, find dead code, detect duplicated logic, and supp