标签：#p

Microsoft released a dedicated AI Gateway tier of Azure API Management in public preview, with a control plane built around models, MCP servers and tools rather than APIs. It fronts Foundry, Bedrock, Vertex AI and OpenAI behind one endpoint, with policy cards instead of XML. Architects welcomed the consolidation while questioning where the governance boundary sits. By Steef-Jan Wiggers

"CSS Modules are fine after all." If you build web interfaces for a living, you have probably said this. After wrestling with runtime CSS-in-JS configuration, chasing specificity bugs across dynamic boundaries, or watching a utility-first framework bloat your markup, returning to the humble CSS Module feels like a relief. That isn't a compromise made for lack of features. CSS Modules win because they are predictable : the CSS you write behaves exactly as written. There is no runtime parser guessing your intent, no injection-order races between chunks, and almost no runtime JavaScript — just a class mapping object. But the safety has a price. You give up TypeScript-integrated styling, compile-time validation, dynamic theming, and seamless colocation. Plumeria is designed to eliminate this compromise. It matches — and in several areas exceeds — the predictability of CSS Modules, while delivering the type-safe developer experience of a modern CSS-in-JS library. The Zero-Trace Runtime Try compiling this — note that the style is actually applied, not left unused: import * as css from ' @plumeria/core ' ; const styles = css . create ({ box : { padding : 16 , color : ' red ' } }); export const Box = () => < div classStyle = { styles . box } > Box </ div >; Here is the entire JavaScript build output: export const Box = () => < div className = { ' xqqbxt1d xq96bg3w ' } > Box </ div >; The declarations move to a generated stylesheet: .xqqbxt1d { padding : 16px ; } .xq96bg3w { color : red ; } The style still renders, yet import * as css from '@plumeria/core' and the entire css.create declaration have vanished. This is not dead-code elimination — nothing in this file is unused, and no bundler could remove a live call for you. The compiler resolves the class names statically and rewrites the call site, so the library never has a runtime form to eliminate in the first place. That disappearing import is the most concise illustration of a Zero-Trace Runtime — anything that shouldn'

TypeScript Enums Are Still Controversial in 2026: Here Is When to Use Them and When to Reach for const Objects This article was written with the assistance of AI, under human supervision and review. Most TypeScript enum debates stem from a single misunderstanding: developers treat enums as a pure type-level construct when they generate real runtime code. This disconnect creates bundle bloat, unexpected behavior at runtime, and type safety gaps that only surface in production. Teams that reach for enums by default pay a hidden cost in every build. The enum controversy persists because TypeScript enums violate a core expectation: types should disappear at compile time. Unlike interfaces or type aliases that vanish during transpilation, enums produce JavaScript objects that ship to the browser. This runtime footprint matters when bundle size directly affects load time and business metrics. The alternative pattern— const objects with as const assertions—delivers the same developer experience without the runtime overhead. When developers understand the tradeoffs, the choice becomes mechanical: use enums where their runtime behavior adds value, use const objects everywhere else. Key Takeaways TypeScript enums generate runtime JavaScript objects that increase bundle size, while const objects with as const provide the same type safety with zero runtime overhead. Numeric enums enable reverse mapping and bitwise flags, making them valuable for low-level APIs and performance-critical code where runtime lookup is required. The const enum feature eliminates runtime code but breaks module boundaries and fails with external libraries, creating maintenance hazards in shared codebases. Const objects work seamlessly with tree-shaking, module systems, and JSON serialization, making them the default choice for API contracts and configuration. Migration from enums to const objects requires runtime validation at module boundaries to preserve type safety guarantees when data enters your s

Tu as fini le tuto. Le vrai, le gros, celui de douze heures. Tu as tout suivi, tout tapé, tout fait tourner. À la fin, l'application marchait. Tu t'es senti capable. Tu t'es dit : « ça y est, je sais faire une API ». Et puis tu as ouvert un dossier vide pour faire la tienne. Curseur qui clignote. index.js . Rien. Pas parce que tu as oublié la syntaxe. Tu la connais. Mais là, tout seul, sans quelqu'un qui te dit quoi taper à la ligne suivante, tu ne sais pas par où commencer. Et cette sensation-là, ce vide entre « j'ai fini le tuto » et « je sais faire », personne ne t'avait prévenu qu'elle existait. C'est de ce mur que je veux parler. Parce que ce n'est pas un défaut chez toi. C'est une étape. 1. Le piège n'est pas le tuto, c'est ce qu'il te cache Un tuto, c'est une suite de bonnes décisions déjà prises pour toi. Quel dossier créer. Quel package installer. Où mettre le fichier de config. Quand extraire une fonction. À chaque embranchement, le formateur a choisi le bon chemin, et toi tu l'as suivi. Tu as tapé du code, oui. Mais tu n'as pris aucune décision. Or coder, le vrai coder, c'est presque que ça : décider. Choisir entre deux structures. Trancher un nom de variable. Décider si ce bout de logique mérite sa propre fonction. Un développeur qui bosse, ce n'est pas quelqu'un qui connaît toutes les réponses — c'est quelqu'un qui sait avancer quand il n'y en a pas. Le tuto t'a entraîné à taper. Il ne t'a pas entraîné à décider. Et c'est exactement la compétence qui te manque devant ton dossier vide. Ce n'est pas un trou dans ton savoir. C'est un muscle que tu n'as jamais sollicité, parce qu'on ne te l'a jamais laissé faire. 2. Pourquoi « un tuto de plus » ne réglera rien Ta réaction instinctive face au blocage, c'est de retourner là où tu te sens compétent. Un autre tuto. Un cours de plus. Une nouvelle techno à cocher. Je comprends le réflexe. Le tuto, c'est confortable : il y a une barre de progression, une fin, une petite dose de « j'ai réussi » à chaque étape. Le d

npm has introduced staged publishing for Node.js, requiring maintainer approval before a version is installable. Versions are queued and must pass a two-factor authentication challenge for release. This feature aims to enhance security amid rising supply chain threats. It is available in npm CLI 11.15.0+ and Node 22.14.0+, alongside new configurable permission flags. By Daniel Curtis

Keep your allies close. Keep your enemies closer. But before you strike, count how many hands they have: the ones you can see, and the one reaching out from somewhere you don't know. — The 36 Stratagems, Befriend a distant state and strike a neighbouring one Previously on this series: #19: Mark Found His AI Audit Method in a Training Manual. He Left a Trap in His Report. — P's entry was swept. P left a note: two weeks. #20: Alex Felt the AI Collector Slow Down. He Knew Someone Else Had Made a Move. — A gateway with TTL 247 was caught by Alex's probe. #21: The AI Thought P Was Still Alive. P Was Already Gone. — The response layer still answered. The person behind it was gone. #22: The AI Chose Its Door. Lena Closed It. — Pulse AI was exposed inside the audit sandbox. Lead investor Apex Capital had tens of millions tied up. Torres left one line: Apex. Singapore. Run. The Scan 2 AM. Alex flipped through probe data out of habit. No lights on; the screen lit his face. The coffee cup sat on his right, first sip already cold. He didn't notice. The TTL 247 gateway had been silent for nearly two weeks. He hadn't shut the probe off. It barely used any resources, sitting there in the middle of the night like a lamp nobody watched. He checked it half out of habit, half out of something he couldn't name. Today there was a record that shouldn't exist. Not that gateway. Another path: ACL's asset scanner was sweeping an address range. He sat up a little straighter, his hand paused over the keyboard for half a second, then pulled the timestamps again. The frequency was wrong: high-density targeted scanning, almost plowing through segment by segment. In the target range, one block he recognized: the MedTech test environment. He aligned the timestamps. Scan source egress: Singapore. [probe] 02:14:33 — unexpected flow on mirror src : 103.196.12.0/24 (SG egress) dst : 10.42.0.0/22 (MedTech-test) pattern : sequential, full-depth exclusions : 10.42.3.1, 10.42.3.200-254 rate : 47 hosts/min

The Scenario Every Developer Recognizes It is mid-2026, and you have a feature to ship. You open ChatGPT or Claude, type something like "build me a function that parses webhook payloads and routes them to the right handler," and wait. The model returns something plausible. You paste it in, run it, and it almost works. So you prompt again: "fix the edge case where the payload is missing the event key." Another round. Then another. Forty-five minutes later, you have code that functions, but you also have a conversation thread that looks like a debugging session rather than a build session. You never actually described what you were building. You just started building it. This is the default mode for most developers using AI coding assistants in 2026, and it is expensive. According to McKinsey's State of AI in 2024 report ( source ), organizations that adopt structured design and planning approaches before implementing AI tools report higher success rates and better integration outcomes compared to those using ad-hoc implementation strategies. The pattern holds at the individual developer level too. Jumping straight into prompting skips the step that makes prompting useful: knowing precisely what you want before you ask for it. The fix is not a better model. It is a different sequence. What Design-First Actually Means in Practice Design-first means producing a written artifact that describes your system before you write a single prompt asking an AI to build it. Not a full technical document. A tight, structured description of inputs, outputs, constraints, and edge cases. Think of it as the brief you would hand to a contractor before they start work. The contractor analogy is useful because it reframes the relationship: you are not collaborating with the model in real time, you are commissioning it with a clear scope. Here is what that looks like concretely. Instead of opening Google Gemini and typing "help me build a webhook router," you spend ten minutes writing this

Photo-to-cross-stitch conversion looks like a resizing problem. It is not. A pixelated preview can look convincing and still be frustrating to stitch. It may contain too many colors, lack readable symbols, provide no reliable dimensions, or become useless when printed. I built StitchFromPhoto to handle the practical part of that workflow. It turns an image into a counted cross-stitch chart in the browser, lets you tune the result before committing to it, and keeps the source photo on your device. The useful output is a pattern, not a pixelated image A cross-stitch preview only answers one question. It shows roughly what the finished piece might look like. A usable pattern must also tell you how many stitches wide and tall the design is, which thread color belongs in each square, whether similar colors remain distinguishable on paper, and how large the result will be on your chosen fabric. That distinction shaped the app. The color preview is useful, but the symbol chart, thread key, stitch totals, fabric dimensions, and printable pages are the real deliverables. What the photo-to-cross-stitch pattern maker does The workflow starts with a sample image, so anyone can explore the controls before uploading a file. It also accepts JPG, PNG, and WebP images up to 20 MB. The main controls are stitch width, DMC color count, and fabric count. You can choose a pattern from 30 to 120 stitches wide, limit the palette to between 6 and 36 DMC colors, and calculate the finished size for 14, 16, 18, or 22 count Aida. You can move between the original photo, a color stitch preview, and a high-contrast symbol view. The thread key lists every retained DMC color code and the number of stitches assigned to it. Creating and previewing a pattern is free. High-resolution PNG and print-ready PDF downloads are unlocked per source image. I wanted that boundary to be visible before checkout rather than hidden behind the final button. How the browser turns pixels into stitches The conversion pi

Understanding the Prototype Design Pattern in Java Introduction When developing software, there are situations where creating a new object from scratch is expensive or time-consuming. For example, an object may require complex initialization, database access, or extensive configuration. In such cases, instead of creating a new object every time, we can duplicate an existing object. This is where the Prototype Design Pattern becomes useful. The Prototype Design Pattern is one of the Creational Design Patterns in Java. It allows developers to create new objects by cloning existing ones rather than instantiating them using constructors. What is the Prototype Design Pattern? The Prototype Design Pattern creates new objects by copying an existing object, known as the prototype. This approach improves performance by avoiding repeated initialization and allows developers to create multiple similar objects efficiently. In Java, cloning is commonly implemented using the Cloneable interface and overriding the clone() method. Why Use the Prototype Pattern? The Prototype Pattern offers several benefits: Reduces the cost of object creation. Improves application performance. Simplifies the creation of complex objects. Avoids repeated initialization code. Makes object creation more flexible. Real-World Example Imagine an online shopping application where thousands of product objects share similar properties. Instead of creating every product from scratch, the application can clone a prototype product and modify only the required attributes such as name or price. Other real-world examples include: Document templates Game characters Employee records Vehicle configurations Graphic design objects UML Structure The Prototype Design Pattern generally includes: Prototype Interface – Declares the clone operation. Concrete Prototype – Implements the cloning functionality. Client – Creates new objects by cloning existing prototypes. Java Implementation Step 1: Create the Prototype Class cla

Hi everyone, I recently put together a guide on modernizing legacy WCF applications, and I'd appreciate some feedback from developers who have been through this transition. The article covers: Best practices for testing existing WCF services before migration Common challenges when maintaining legacy WCF applications When CoreWCF is a good fit When it makes more sense to adopt gRPC Factors to consider before starting a migration project My goal wasn't to suggest that every WCF application should be migrated immediately. Instead, I wanted to provide a practical framework for evaluating the available options based on business and technical requirements. I'd love to hear from the community: Are you still maintaining WCF services? If you've migrated, did you choose CoreWCF, gRPC, or another approach? What was the biggest challenge during your migration? Here's the article: https://geeksarray.com/blog/wcf-testing-legacy-services-and-migrating-to-corewcf-or-grpc Looking forward to hearing your experiences and learning from the community. submitted by /u/geeksarray [link] [留言]

Every React developer eventually meets the same fork in the road. You write an event handler that reads state, pass it to a child or an effect, and now you must choose: leave it as a plain inline function and watch every render create a new reference — breaking React.memo , re-running effects, re-subscribing listeners — or wrap it in useCallback and start playing dependency-array whack-a-mole, where one forgotten dependency means the handler sees state from three renders ago. That second failure mode has a name — the stale closure — and it's arguably the most common React bug in production code. The fix has a name too: useEvent , proposed in an official React RFC in 2022 , and available today as useEvent in @reactuses/core . It gives you a function whose identity never changes across renders but whose body always sees the latest state and props . Both halves of the fork, no trade-off. This post covers the API, the three-line implementation trick that makes it work, how it compares to useCallback and to React 19.2's built-in useEffectEvent , real patterns, and the one rule you must respect (don't call it during render). TypeScript-first. The Problem in Thirty Seconds Here's the bug factory. A chat component sends a heartbeat with the current draft text: function Composer ({ roomId }: { roomId : string }) { const [ draft , setDraft ] = useState ( '' ); useEffect (() => { const id = setInterval (() => { sendHeartbeat ( roomId , draft ); // ⚠️ which draft? }, 3000 ); return () => clearInterval ( id ); }, [ roomId ]); // draft intentionally omitted — we don't want to reset the timer return < textarea value = { draft } onChange = { e => setDraft ( e . target . value ) } />; } The interval closes over the draft that existed when the effect ran — the empty string. Every heartbeat sends '' forever. Add draft to the dependency array and the closure is fresh, but now the interval tears down and restarts on every keystroke . useCallback doesn't help: it has the exact same depen

This is Part 3 of a 3-part series. Part 1: Your Brain Is a Rendering Engine. So Is Every LLM. explored why LLMs and human brains invite the same rendering analogy. Part 2: More Compute Won't Wake It Up argued that scaling compute doesn't cross the consciousness boundary. This final part asks: what happens when you bring a render layer into a domain that punishes distortion? I have a friend who trades. Not professionally. He has a day job, a brokerage account, and strong opinions about charts. One evening he pulled up a stock chart and pointed at a formation near the top. "Head and shoulders," he said. "Classic reversal pattern. I'm getting out." I looked at the same chart. I saw price going up and then going down. I didn't see a head. I didn't see shoulders. I saw a line. He wasn't wrong, exactly. Head-and-shoulders is a real pattern that real traders have used for decades. But he looked at a time series of prices and his brain rendered it into a human body part. And then he made a financial decision based on the body part, not the numbers. Somewhere between the data and the decision, anatomy got involved. That is the render layer at work. And markets are the worst possible place to let it run unchecked. What a trader actually sees When a discretionary trader looks at a chart, their brain is doing what Part 1 described: taking raw input (price as a function of time) and collapsing it into a rendered scene. The scene comes pre-loaded with pattern names, emotional associations, and memories of the last time something "looked like this." The chart didn't change. The candles are the candles. What changed is how that particular brain rendered it. A trader who got burned on the last head-and-shoulders sees danger. A trader who made money on one sees opportunity. Same vibration, different render. Same sunset from Part 1, different feeling. This is not a minor problem. This is the entire problem. Human trading is emotional trading. Not because traders are undisciplined. Bec

Recently, I’ve been spending more time building small projects on my own. One thing I’ve learned is that it’s usually better to keep things simple and ship early instead of trying to make everything perfect. A small project can still teach you a lot about coding, deployment, design, and how people actually use what you build. I’m planning to share some of my development notes and experiments here from time to time. Looking forward to learning from everyone on DEV.

Hi everyone! I'm a Computer Science student at a Brazilian Federal Institute, and I previously completed two semesters of Computer Science at a federal university in Brazil. Right now I'm studying C and Python at university while working on personal projects to improve my skills as a developer. I'm looking for a mid-level or senior developer who has a project, a company, or any real-world work where I could help, even if it's with simple tasks at first. I'd also love the opportunity to learn other programming languages and technologies through hands-on experience. I'm not looking for payment at the moment. My goal is to learn how real projects are built, gain practical experience, and contribute as much as I can. If you think I could help or have an opportunity for me, feel free to send me a private message. If you'd like to see my résumé, just send me a message. Thanks! Or send me a messenger on LinkedIn https://www.linkedin.com/in/danillo-souza-gomes-undefined-9084293b0 submitted by /u/SuccotashOwn1550 [link] [留言]

The Hidden Security Gap in Multi-Tenant MCP Servers When you build a multi-tenant SaaS application or an MCP (Model Context Protocol) server that serves multiple organizations, cross-tenant data leakage is one of the most dangerous vulnerabilities you can ship. A single missing organizationId filter in a database query can expose one tenant's data to another — and traditional security scanners like Snyk, Semgrep, and CodeQL don't catch these patterns. That's why I built mcp-tenant-isolation — a static analysis scanner with 57 deterministic rules specifically designed to catch tenant isolation failures in multi-tenant codebases. What Is Tenant Isolation? Tenant isolation ensures that data belonging to one organization (tenant) is never accessible to another. In a multi-tenant SaaS app, every database query, cache read, and file access must be scoped to the current tenant's organizationId . The most common failure looks like this: // VULNERABLE: No organizationId filter const users = await prisma . user . findMany ({ where : { role : ' admin ' } }); // SECURE: Tenant-scoped query const users = await prisma . user . findMany ({ where : { role : ' admin ' , organizationId : ctx . orgId } }); It looks obvious in isolation. But in a codebase with 100+ API routes, dozens of lib functions, and complex middleware chains, missing tenant filters are easy to miss in code review and impossible for traditional SAST tools to detect . Why Traditional Scanners Miss This Tools like Snyk and Semgrep are excellent at detecting: SQL injection XSS Dependency vulnerabilities Secret leakage But they don't understand tenant context . They don't know that organizationId is the tenant boundary. They don't track which functions require tenant guards. They can't tell you that prisma.user.findMany({ where: { role: 'admin' } }) is missing a critical tenant filter. mcp-tenant-isolation fills this gap with 57 rules across 7 categories: Rule Categories Category Rules What It Detects Database Queries

Classic Machine Learning Through the Eyes of an SRE — Part 3 The random forest is the first ML algorithm that made me feel at home. Not because of the math — because it's an SRE idea wearing a stats costume. Many independent workers. No single point of failure. Majority vote. If one worker goes weird, the fleet absorbs it. We've been building systems this way for decades; the forest just applies it to prediction. The problem it exists to fix Last article: a single decision tree is readable but unstable — small data change, whole tree flips, explanation rewrites itself. That instability is variance, and it's exactly what scared me about trusting one tree in production. The forest's move: grow hundreds of trees, each on a random resample of the data, and — this is the part that matters — force each split to choose from only a random subset of features. That second randomization is the whole difference between a random forest and plain bagging. Bagging alone gives you many trees on resampled data, but if one feature is strongly predictive, every tree grabs it first and they all end up looking alike. Starving each split of features is what makes the trees genuinely different from each other. The randomness isn't sloppiness. It's manufactured disagreement. The instability doesn't get fixed. It gets CANCELLED. Each tree is still jumpy, but they're jumpy in different directions, and the average is calm. What surprised me No new loss function. Each tree still minimizes impurity exactly like a lone tree. The forest adds zero new objectives. The entire gain is a bias-variance bargain: variance drops hard, bias barely moves. You give up readability and get back trustworthiness. Embarrassingly parallel. Trees are independent, so training scales horizontally — throw cores at it. Boosting, its sequential cousin, is the opposite: each model depends on the last. Map-reduce versus a pipeline. The smoothness illusion. A forest's decision boundary looks smooth, almost like regression'

An AI support agent does not have to be malicious to damage trust. It only has to answer one refund question, outage complaint, security concern, or enterprise renewal ticket with polished confidence and weak evidence. That is why serious builders need an AI support escalation router before they let agents send replies on their own. The router decides when the AI can answer, when it should draft only, when it should ask a clarifying question, and when a human must take over. The goal is not to remove humans from support. The goal is to stop wasting human time on routine cases while protecting customers from the few cases where automation should slow down. Working definition: an AI support escalation router is a policy layer that evaluates every support conversation for intent, risk, evidence, confidence, account context, and customer emotion before deciding the next safe action. Why this matters now Recent AI platform signals point in the same direction: agents are moving from demos into production workflows. Customer support products are launching AI agents that classify, draft, respond, and hand off tickets. AI gateway and spend-console launches show that teams now care about cost, routing, observability, and business impact. Developer discussions keep circling around the same uncomfortable questions: How do we stop AI support agents from repeating the same mistake? How do we prevent hallucinations from reaching customers? When should a human approve a reply before it sends? How do we preserve context during handoff so the customer does not repeat everything? How do we measure whether automation actually resolves issues instead of routing them faster? Search results for AI escalation are full of platform pages, general customer-service advice, and high-level routing concepts. The missing piece is a practical builder guide: schemas, thresholds, queues, evidence checks, and safe defaults for a small AI product team. That is the gap this article fills. The core mista

Java is still worth it in 2026 Are you wondering if Java is still worth learning in 2026? Check out this video and see why it's been dominating for 30 years submitted by /u/OSBY_Glabay [link] [留言]

submitted by /u/OSBY_Glabay [link] [留言]

📑 Table of Contents Introduction Why We Created ValidX? Why Choose ValidX? 5-Minute Quick Start Multilingual Support Important: Null/Empty String Handling Thread Safety Supported Validation Annotations Quick Reference Table Basic Validation Identity Validation Financial Validation Education/Professional Qualification Network Validation China-Specific Validation Automotive Validation Book-Related Validation Mobile Device Validation More Validation Annotations Contribution Introduction ValidX is an open-source Java validation library focused on Chinese business scenarios, making validation simple, elegant, and reliable. Built on JSR-380 standards with 90+ specialized annotations for Chinese identity cards, phone numbers, bank cards, and more. 💡 Why We Created ValidX? When developing applications for Chinese users, we frequently encountered these challenges: Pain Point 1: Java Has Too Few Built-in Validation Rules, Far Less Than Other Language Frameworks If you've used web frameworks in other languages, such as PHP's ThinkPHP or JavaScript's Validator.js, you'll notice they come with incredibly rich built-in validation rules: mobile , idcard , zip , alphaNum , etc.—ready to use out of the box, simple and convenient. But in the Java world, standard Bean Validation only provides a handful of generic annotations like @Email and @Pattern . For common Chinese business scenarios—identity cards, phone numbers, bank cards, unified social credit codes—there's absolutely no support. This forces every Java project to reinvent the wheel: Writing complex regular expressions yourself Implementing Luhn algorithm for bank card validation Handling identity card check digit calculations Copy-pasting validation code found online Why can't Java validation be as ready-to-use as other frameworks? This is why ValidX was born. Pain Point 2: Scattered Validation Logic Difficult to Maintain As projects grow, validation logic becomes scattered across: Manual validation in Controller layer Busine