#code

hahah great talk. zig is C but fixed.

A compelling replacement to C/C++.

parsing and formatting phone numbers

Duktape is an embeddable Javascript engine, with a focus on portability and compact footprint.

Duktape is easy to integrate into a C/C++ project: add duktape.c, duktape.h, and duk_config.h to your build, and use the Duktape API to call ECMAScript functions from C code and vice versa.

Connecting the most prolific open source maintainers & contributors with their next jobs

The thread is called “Who is hiring?” And they get posted monthly-ish.

schema reference

Octopus takes over where your CI server ends, modelling the entire release orchestration process of software. This includes:

Release versioning
Environment promotion (beyond simple dev/test/prod workflows)
Deployment automation
Progressive software delivery (rolling deployments, blue/green, canary)
Configuration management
Approvals & ITSM integration
Deployment freezes
Coordinating deployments across projects and their dependencies

Decoupling the CI platform from the CD platform allows teams to bring their favorite CI tool - and most organizations have more than one - while we focus on giving you the most powerful best-of-breed CD capabilities. Octopus integrates with popular CI tools like GitHub Actions, Jenkins or TeamCity, letting them do what they do best - the CI part of the feedback loop. Octopus then takes over “artifact-forward”, and handles the release and deployment aspects of CD in advanced ways that no CI/CD tool can.

To measure the adversarial robustness of AI agents, we introduce AgentDojo, an evaluation framework for agents that execute tools over untrusted data. To capture the evolving nature of attacks and defenses, AgentDojo is not a static test suite, but rather an extensible environment for designing and evaluating new agent tasks, defenses, and adaptive attacks. We populate the environment with 97 realistic tasks (e.g., managing an email client, navigating an e-banking website, or making travel bookings), 629 security test cases, and various attack and defense paradigms from the literature. We find that AgentDojo poses a challenge for both attacks and defenses: state-of-the-art LLMs fail at many tasks (even in the absence of attacks), and existing prompt injection attacks break some security properties but not all. We hope that AgentDojo can foster research on new design principles for AI agents that solve common tasks in a reliable and robust manner.

A library that uses zod schemas to generate an Open API Swagger documentation.

A comprehensive list of 500+ verified bots and web crawlers from CloudFlare Radar, available as a JSON dataset for bot detection, user agent analysis, and web scraping identification.

Why

Identifying legitimate bots from malicious scrapers is essential for web security and analytics. This package provides the official CloudFlare Radar verified bots directory, helping you:

Detect verified bots – Identify legitimate crawlers like Googlebot, Bingbot, and more
Filter analytics – Exclude known bots from your traffic reports
Allow-list crawlers – Permit verified bots while blocking suspicious traffic
User agent lookup – Match user agent strings against known bot patterns

Simple cross-stack type-safety for your API, with just a sprinkle of TypeScript magic ✨

🛟 Contract-First API
🌈 It's just HTTP/REST
🔒 Supports all Standard Schema validation libraries
📦 OpenAPI generation

tRPC allows you to easily build & consume fully typesafe APIs without schemas or code generation. Features

✅  Well-tested and production ready.
🧙‍♂️  Full static typesafety & autocompletion on the client, for inputs, outputs, and errors.
🐎  Snappy DX - No code generation, run-time bloat, or build pipeline.
🍃  Light - tRPC has zero deps and a tiny client-side footprint.
🐻  Easy to add to your existing brownfield project.
🔋  Batteries included - React.js/Next.js/Express.js/Fastify adapters. (But tRPC is not tied to React, and there are many community adapters for other libraries)
🥃  Subscriptions support.
⚡️  Request batching - requests made at the same time can be automatically combined into one
👀  Quite a few examples in the ./examples-folder

A simple tool to automate version bumps, changelogs, and releases using Conventional Commits.

📄 Uses conventional-changelog to parse commits, determine the next version, and generate a changelog.
🗂️ Supports monorepos and can release multiple packages in a single run.
🧩 Flexible and extensible with custom addons for different project types.
🚀 Has GitHub Action to automate releases in CI/CD pipelines.

interface ToolAnnotations { title?: string; readOnlyHint?: boolean; destructiveHint?: boolean; idempotentHint?: boolean; openWorldHint?: boolean; }

Additional properties describing a Tool to clients.

NOTE: all properties in ToolAnnotations are hints. They are not guaranteed to provide a faithful description of tool behavior (including descriptive properties like title).

Clients should never make tool use decisions based on ToolAnnotations received from untrusted servers.

ChatGPT can directly run Bash commands now. Previously it was limited to Python code only, although it could run shell commands via the Python subprocess module. It has Node.js and can run JavaScript directly in addition to Python. I also got it to run “hello world” in Ruby, Perl, PHP, Go, Java, Swift, Kotlin, C and C++. No Rust yet though! While the container still can’t make outbound network requests, pip install package and npm install package both work now via a custom proxy mechanism. ChatGPT can locate the URL for a file on the web and use a container.download tool to download that file and save it to a path within the sandboxed container.

Is this a data exfiltration vulnerability though? Could a prompt injection attack trick ChatGPT into leaking private data out to a container.download call to a URL with a query string that includes sensitive information?

I don’t think it can. I tried getting it to assemble a URL with a query string and access it using container.download and it couldn’t do it. It told me that it got back this error:

ERROR: download failed because url not viewed in conversation before. open the file or url using web.run first.

This looks to me like the same safety trick used by Claude’s Web Fetch tool: only allow URL access if that URL was either directly entered by the user or if it came from search results that could not have been influenced by a prompt injection.