How-tos
Step by step, from real work.
Tutorial ·
Cloudflare Blocks Mixed-Use AI Crawlers on September 15. Here's the Fix Before Your Ad Revenue or Your AI Visibility Takes the Hit.
Cloudflare's default settings block mixed-use AI crawlers from ad-supported pages starting September 15, 2026. Here is the checklist I ran on my own site before the deadline, and the tradeoff nobody has actually measured.
Guide ·
Debian Just Voted on How Contributors Can Use AI. If You Maintain Any Open Source Project Alone, Steal Their Policy.
Debian ran an eight-way vote on generative AI and the winning option fits in one governing sentence: use whatever tool you want, you still own what you submit. Most solo maintainers don't have that sentence written down anywhere, and here's the CONTRIBUTING.md language to fix that today.
Guide ·
npm Packages Can Now Have Multiple Trusted-Publishing Configs. Set Yours Up Before January.
GitHub shipped three npm publishing changes on September 3, and buried in the boring infrastructure news is a real deadline: bypass-2FA tokens lose the ability to publish directly around January 2027.
Guide ·
PaperCut's Zero-Day Needed Two Emergency Patches in One Day. The First One Didn't Actually Fix It.
An actively-exploited, pre-auth RCE chain in PaperCut got an emergency patch on August 28, then a second emergency patch hours later after researchers bypassed the first one.
Guide ·
pnpm 12 Is a Rust Rewrite That Keeps Everything, Except the Way It Resolves Your Private Git Dependency
pnpm 12 went stable on August 26 with the same commands, flags, and lockfile format as pnpm 11. One breaking change will still take down a solo dev's build, and the fix is a git config line, not a manifest edit.
Guide ·
CISA Gave Federal Agencies Until Tomorrow to Patch Gitea. The Attack in the Wild Took Eleven Seconds.
CVE-2026-60004 turns ordinary repository write access into shell on your Gitea host, and with open registration on, an anonymous visitor can grant themselves that access. It went into the KEV catalog on August 25. Here is the Saturday checklist.
Guide ·
Your Site Sends the Same HTML to Chrome and to Agents. The Fix Has Been in HTTP Since 1997.
acceptmarkdown.com made the front page arguing that agents should get Markdown from the same URL browsers get HTML from. On a static Astro site the negotiation cannot happen in Astro, which makes this an nginx change. Measure your logs before you touch anything.
Guide ·
Anthropic's Python SDK Hit 1.0 and Took temperature Out With It. The Change That Will Actually Page You Is the Bedrock Default.
anthropic-sdk-python 1.0.0 shipped 20 August: httpx swapped for httpx2, Python 3.10 floor, and a set of long-deprecated parameters deleted. A silent region default becoming a hard error is the one that finds unpinned cron jobs.
Guide ·
The EU Chatbot Disclosure Rule Went Live on 2 August and You Are the Provider. Being Outside Europe Does Not Help.
Article 50 of the AI Act applies now. If you shipped a support chat widget, the duty to tell users they are talking to an AI is yours, it attaches from the first interaction, and it reaches non-EU providers whose output is used in the EU.
Guide ·
SvelteKit 3 Is in Release Candidate. $lib Is Now #lib, Config Moves to vite.config.ts, and a Codemod Handles Most of the Rest.
The RC landed on 13 August with one command that migrates most of an app. The parts that will actually cost you time are the Svelte 5 and Vite 8 floor, the alias rename, and the tsconfig change.
Guide ·
The OpenAI Assistants API Shuts Down in Five Days. There Is No Tool to Move Your Threads.
The endpoints going dark on August 26 is the part everyone planned for. The part nobody planned for: OpenAI is not shipping an automated migration for Threads, so the conversation history is what you actually lose.
Guide ·
Your GitHub OAuth App Has Been Accepting Wildcard Redirects the Whole Time. GitHub Just Told You, in a Blockquote.
The August 14 changelog led with multiple redirect URIs and refresh tokens. Near the bottom sits the disclosure that every app registered with a single callback URL has had wildcard matching enabled all along.