July 16, 2026

Under the new default, Dependabot waits until a package release has been present in its registry for at least three days before opening a version-update pull request. The delay gives maintainers and the community time to expose broken or compromised releases. It requires no configuration across supported ecosystems on GitHub's hosted service, with Enterprise Server support planned for version 3.23.

The cooldown affects version updates only; security updates for known vulnerabilities still open immediately. Teams can change the duration or opt out through the cooldown configuration option. Monitoring routine update latency separately from emergency-fix latency lets maintainers preserve the safer default and grant exceptions only where freshness has measurable value.

The generally available REST surface provides GET, POST, PATCH, and DELETE operations for custom patterns at repository, organization, and enterprise scope. Teams can generate definitions for internal tokens or connection strings, inventory them across scopes, and compare intended configuration with deployed state. Access is for Secret Scanning customers, so automation should use narrowly scoped permissions for each management level.

The API covers basic creation, modification, and deletion, but candidate dry runs and final publishing remain in the GitHub interface. That limits unattended deployment while also preserving a review boundary against noisy or incomplete regular expressions. A practical flow keeps rationale and target scope in version control, applies the API change, and requires UI approval of detection examples before publication.

Preview 6 is the sixth prerelease of .NET 11 and spans the development stack rather than one isolated feature. Runtime work includes async, JIT, and NativeAOT improvements, while libraries add asynchronous DataAnnotations validation and System.Text.Json serialization for C# union types. C#, EF Core, F#, MAUI, and the container images also receive targeted updates.

For everyday tooling, dotnet test gains options and clearer output, and xUnit v3 and NUnit templates support Microsoft's testing platform. The SDK can publish multi-architecture containers with Podman. The web framework adds asynchronous minimal-API validation, automatic CSRF protection, and OpenAPI 3.2 as the default, so evaluation should capture changes in existing tests, generated contracts, and authentication flows together.

The Notebook editor is now the default experience for ipynb files, with split panes, cell tags, selected-line execution, export to Quarto, Python, or R, and inline PDF rendering. The Packages pane can search, install, update, and remove packages in active R and Python sessions, and it helps teams compare environments with requirements.txt or renv.lock. These core editing and dependency features have left preview.

Posit Assistant, which replaces the legacy AI experience, is also generally available and can be governed by administrators through ai.enabled. DeepSeek support remains experimental, while Microsoft Foundry support is generally available. Data Explorer adds Excel and compressed CSV, TSV, and Parquet access through DuckDB, but Data Connections remains a preview, so rollout plans should preserve these stage differences.

The new cf.logCustomData() helper lets viewer-request and viewer-response functions add decision values to a CloudFront access-log record. Experiment variants, authentication results, and routing destinations can therefore sit beside the request they influenced. This removes much of the later joining previously required when function output lived only in a separate CloudWatch Logs stream.

The capability is available at all CloudFront edge locations and supports both real-time logs and standard logging v2. The helper has no extra charge, although normal function invocation and log delivery pricing still applies, and console.log remains available. A safe rollout starts with a few non-sensitive, bounded fields and measures whether they actually reduce investigation time.

The exporter is implemented as a small HTTP server that translates external state into Prometheus text format, with /metrics separated from the /healthz liveness endpoint. Counters represent cumulative totals, gauges represent values that rise and fall, and histograms capture distributions. The container example uses a multi-stage build and a non-root distroless runtime image to reduce the production attack surface.

With Prometheus Operator, the ServiceMonitor selector must match Service labels, including the release label expected by Prometheus; scrape annotations are an alternative. Collection alone does not make a signal available to HorizontalPodAutoscaler. Prometheus Adapter must expose it through the Custom Metrics API, and teams should test missing, delayed, and spiking data before linking it to scaling behavior.

On July 3, the .AL operator published a new DNSKEY and stopped serving the old key while the root DS record still referenced the old one. Validating resolvers therefore rejected responses. Cloudflare deployed a Negative Trust Anchor to all 1.1.1.1 users by 17:15 UTC, roughly three hours after the break, treating the zone as temporarily unsigned to restore resolution at the cost of suspending DNSSEC authenticity guarantees.

Responses served under that NTA carried EDE 33 together with EDE 9 for the underlying missing DNSKEY, allowing clients to distinguish a NOERROR answer from a DNSSEC-validated answer. IANA has assigned EDE 33 and kdig recognizes its name, but the defining Internet-Draft is still headed for IETF DNSOP discussion and an Unbound implementation is under review. Monitoring systems should account for uneven implementation while preserving the signal.

The Code tab on each crate page presents the contents of the published version with a file tree, search, syntax highlighting, and shareable line links. It can expose generated files such as normalized Cargo metadata that may not exist in the linked repository. Behind the feature, the registry converts non-seekable gzipped tar archives into ZIP files and JSON manifests, then serves requested files from its CDN with HTTP range requests; older versions were backfilled.

The update also adds RustSec-derived banners for unmaintained crates and suggestions for standard-library replacements, completes the frontend migration to Svelte, and stabilizes search by bounding ranking work to 1,000 matches while precomputing reverse-dependency counts. Teams can add artifact browsing to dependency review, but should still test compatibility before replacing a warned package.

Qwen 3.5-397B carries roughly 400 GB of weights and activates only part of its 512 experts for each token. Google avoided applying one partitioning scheme to both the model's two KV heads and its expert count, instead using eight-way attention data parallelism with eight-way expert parallelism. JAX and Pallas implementations package operations such as Batched RPA, Grouped GEMM, and SparseCore unpermutation as reusable kernels.

Google reports that, between April and June, the work improved decode-heavy throughput by about 3.1x and prefill-heavy throughput by about 4.7x at concurrency 512 on one host with four Ironwood chips and eight logical devices. The company is integrating the work into vLLM and SGLang, but these are configuration-specific vendor measurements. Adoption requires a reproduction using the team's own input lengths, output lengths, batching, and communication profile.

RFC 9989 changes organizational-domain discovery when a DMARC record is absent. Instead of relying on an external Public Suffix List, a receiver walks parent DNS names with a maximum of eight queries. That can alter which policy boundary some systems select. IIJ recommends publishing explicit records on organizational domains and the subdomains actually used so older RFC 7489 receivers and newer implementations reach more consistent outcomes.

The new np tag can assign a separate policy to messages claiming to come from nonexistent subdomains, and IIJ recommends np=reject. Enforcement including p=reject can still affect forwarding and mailing-list interoperability, so operators should validate aggregate reports first. An inventory of sending domains followed by explicit records, monitoring, and staged rejection reduces transition ambiguity.

LY Corporation defines AI Driven Development as one connected process across requirements, design, implementation, and review, with humans retaining intent and important decisions rather than delegating the work wholesale. The workshop gathered 112 people in 21 teams including LINE Plus, each bringing a real business topic. Participation was team-based and included planners, leaders, and decision makers rather than only individual developers.

The recurring bottleneck was not tool operation but missing specifications, vocabulary, code relationships, and review criteria that AI could use. A two-day exercise will not persist without a follow-up owner, evaluation method, and handoff into daily work. Programs should therefore measure context-preparation effort, reasons outputs fail review, and artifacts that reach the next stage instead of counting prompts or seats.

Publickey’s reporting on Gartner’s forecast adds an organizational constraint: AI-enabled smaller teams should not be treated as a head-count reduction tactic, and leaders must design for broad product and agent-supervision skills while preserving junior-talent development. That reinforces LY Corporation’s practical finding that ownership and decision criteria must extend beyond the workshop.