This week's developer digest covers: Microsoft's dynamic Windows Runtime API projection for Node.js enabling native API calls from JavaScript; npm's new publish-time malware scanning with dual-use metadata requirements; Node.js security patches across 22.x–26.x addressing 11 vulnerabilities including HTTP/2 and Permission Model flaws; GitHub's stacked pull requests entering public preview; a critical Rails Active Storage CVE allowing unauthenticated file reads via image uploads; Kimi K3, an open 2.8T-parameter model with 1M-token context and frontier coding benchmarks; a deep dive on revisiting microkernels with modern hardware; RBS 4.1.0 with JRuby/WebAssembly support; Octane, a compiled React-compatible framework eliminating virtual DOM; and Argo, a tool for generating demo videos from Playwright scripts.
