--- title: Best Collections posts — May 2026 | daily.dev description: The most upvoted Collections posts from May 2026, curated by the daily.dev community. canonical: https://daily.dev/sources/collections/best-of/2026/05 twitter:card: summary_large_image twitter:site: @dailydotdev og:url: https://daily.dev/sources/collections/best-of/2026/05 og:type: website og:site_name: daily.dev og:title: Best Collections posts — May 2026 | daily.dev og:description: The most upvoted Collections posts from May 2026, curated by the daily.dev community. og:image: https://media.daily.dev/image/upload/s--VAY5ToZt--/f_auto/v1724209435/public/daily.dev%20-%20open%20graph --- # Best of Collections — May 2026 1. 1 [](https://daily.dev/posts/github-confirms-internal-repository-breach-via-poisoned-vs-code-extension-wyxybuh8c "GitHub confirms internal repository breach via poisoned VS Code extension") Article Collections · 16w GitHub confirms internal repository breach via poisoned VS Code extension A malicious version of the Nx Console VS Code extension (v18.95.0) was live on the Visual Studio Marketplace for 11–18 minutes on May 18, 2026, long enough for a GitHub employee with auto-update enabled to have their credentials stolen. The breach gave attackers (TeamPCP/UNC6780) access to roughly 3,800 internal GitHub repositories. The attack chain started a week earlier with a compromised TanStack npm package that stole a contributor's GitHub CLI token, which was then used to publish the backdoored extension. The payload targeted GitHub, npm, AWS/GCP, SSH, and Vault credentials, exfiltrating data over HTTPS and DNS tunneling. GitHub confirmed no customer data was affected. TeamPCP has a documented history of rapid supply chain attacks against developer infrastructure. The incident highlights systemic weaknesses in the VS Code Marketplace: no security review, no kill-switch for installed versions, default auto-update, and broad extension permissions. Developers who had Nx Console installed around that date should rotate all credentials and audit repository activity. 203 33 2. 2 [](https://daily.dev/posts/what-s-new-in-tailwind-css-v4-2-and-v4-3-oybkeyde7 "What's new in Tailwind CSS v4.2 and v4.3") Article Collections · 17w What's new in Tailwind CSS v4.2 and v4.3 Tailwind CSS v4.2 and v4.3 bring several notable additions. v4.2 introduces four new color palettes (mauve, olive, mist, taupe), a dedicated webpack plugin with 2x+ build speed improvements, logical property utilities for RTL support, and OpenType font feature controls. v4.3 adds first-party scrollbar styling utilities (scrollbar-width, scrollbar-color, scrollbar-gutter), a new @container-size utility for height-based container queries, zoom and tab-size utilities, stacked/compound variants in @variant, default values in functional utilities, and improvements to the upgrade tool's canonicalizer. 177 21 3. 3 [](https://daily.dev/posts/bun-is-being-rewritten-in-rust-moving-away-from-zig-4ty7usyvh "Bun is being rewritten in Rust, moving away from Zig") Article Collections · 17w Bun is being rewritten in Rust, moving away from Zig Bun's creator Jarred Sumner used Claude as a coding agent to port over one million lines of Zig code to Rust in roughly six days, shipping the result as a near-complete rewrite. The port passed 99.8% of Bun's test suite, reduced binary size, and matched or slightly exceeded performance benchmarks. The motivations were Zig's persistent memory bugs, its pre-1.0 instability, and a no-AI contribution policy that conflicted with Anthropic's (which acquired Bun's parent company) working style. However, the rewrite contains \~10,000 unsafe blocks, is non-idiomatic Rust, and critically, no human has fully reviewed the codebase — it was written and reviewed by Claude. Several security bug reports have already appeared, yt-dlp deprecated Bun support above 1.3.14 citing reliability concerns, and Electrobun announced it's decoupling from Bun. The episode raises unresolved questions about AI-generated codebases: test suites validate known paths but can't catch subtle invariants or concurrency bugs, and the gap between generating a million lines of code in six days versus understanding what it does remains a fundamental challenge. 105 17 4. 4 [](https://daily.dev/posts/microsoft-s-redesigned-windows-11-run-dialog-is-faster-and-supports-dark-mode-msrntidoz "Microsoft's redesigned Windows 11 Run dialog is faster and supports dark mode") Article Collections · 18w Microsoft's redesigned Windows 11 Run dialog is faster and supports dark mode Microsoft has rebuilt the Windows 11 Run dialog (Win+R) using C#/WinUI 3 and .NET AOT compilation. The new dialog loads in 94ms median versus 103ms for the legacy version. It's built on the same CmdPal codebase as PowerToys' Command Palette, meaning PowerToys contributors are now technically Windows contributors. New features include \`\~\` shortcut for home directory navigation. The Browse button was removed after telemetry from 35 million usage samples showed fewer than 0.0038% of users ever clicked it. The feature is currently opt-in on the Windows Insider Experimental Channel. 80 8 5. 5 [](https://daily.dev/posts/bun-v1-3-14-built-in-image-processing-global-virtual-store-http-3-and-more-sntpql4my "Bun v1.3.14: built-in image processing, global virtual store, HTTP/3, and more") Article Collections · 17w Bun v1.3.14: built-in image processing, global virtual store, HTTP/3, and more Bun v1.3.14 ships with a native image processing API (Bun.Image) that claims to outperform sharp, \~7x faster warm installs via a global virtual store, experimental HTTP/2 and HTTP/3 client support in fetch(), and HTTP/3 (QUIC) server support in Bun.serve(). The fs.watch() backend has been fully rewritten for Linux, macOS, and FreeBSD. Additional highlights include \~12% faster ESM module loading, a JavaScriptCore engine upgrade with 565 upstream commits, cross-language LTO reducing Windows binary size by up to 18 MB, Bun.Terminal on Windows via ConPTY, FreeBSD and Android builds, and 92 bug fixes including Node.js compatibility and memory leak improvements. 68 3 6. 6 [](https://daily.dev/posts/andrej-karpathy-joins-anthropic-enblahrxp "Andrej Karpathy joins Anthropic") Article Collections · 16w Andrej Karpathy joins Anthropic Andrej Karpathy, co-founder of OpenAI and former Tesla AI director, has joined Anthropic to lead a new pre-training research team. He will report to Nicholas Joseph and focus on using Claude to accelerate the research that produces future Claude models — a direction he had already been exploring publicly with his open-source 'autoresearch' project. The hire is part of a broader talent acquisition push at Anthropic, which is also bringing in ex-xAI and ex-Meta engineers while reportedly approaching a $950 billion valuation. Fellow ex-OpenAI co-founder John Schulman is already at the company. Karpathy noted his passion for education remains but is paused for now. 59 8 7. 7 [](https://daily.dev/posts/google-engineer-charged-with-using-internal-search-data-to-win-1-2m-on-polymarket-dllwzov6o "Google engineer charged with using internal search data to win $1.2M on Polymarket") Article Collections · 15w Google engineer charged with using internal search data to win $1.2M on Polymarket A Google information-security engineer, Michele Spagnuolo, has been federally charged with using confidential internal Google search-trend data to place $2.7 million in bets on Polymarket, earning $1.2 million in profit. Trading as 'AlphaRaccoon', he allegedly exploited an internal tool to bet on outcomes in Polymarket's 2025 Year-in-Search prediction market. Charges include commodities fraud, wire fraud, and money laundering, with a parallel CFTC civil case filed. Polymarket's blockchain-based structure made his trading history traceable. This is the second federal criminal case tied to Polymarket and the first involving misappropriated data from a major tech platform, adding pressure to prediction markets amid ongoing congressional probes and bans in Spain and India. 69 17 8. 8 [](https://daily.dev/posts/chrome-148-quietly-downloads-4gb-gemini-nano-model-plus-new-css-and-media-features-vkbebrnfh "Chrome 148 quietly downloads 4GB Gemini Nano model, plus new CSS and media features") Article Collections · 17w Chrome 148 quietly downloads 4GB Gemini Nano model, plus new CSS and media features Chrome 148 silently downloaded a 4GB Gemini Nano model file (\`weights.bin\`) onto users' machines without notification, prompting privacy and environmental concerns from researcher Alexander Hanff who argues it violates GDPR. The model powers features like Help Me Write and scam detection and can be disabled in Chrome Settings > System. The release also formally exposes the Prompt API, giving web developers direct access to Gemini Nano for text, image, and audio inputs with structured output support. Additional updates include name-only CSS container queries (no longer requiring \`container-type\`) and lazy loading support for \`video\` and \`audio\` elements via the \`loading\` attribute. 43 4 9. 9 [](https://daily.dev/posts/ibm-granite-4-1-how-the-8b-model-beats-a-32b-moe-6dkxujokc "IBM Granite 4.1: how the 8B model beats a 32B MoE") Article Collections · 18w IBM Granite 4.1: how the 8B model beats a 32B MoE IBM has released Granite 4.1, its largest model family to date, featuring dense decoder-only language models at 3B, 8B, and 30B parameters trained on \~15 trillion tokens under Apache 2.0\. The standout result is the 8B instruct model matching or outperforming the previous 32B MoE model across benchmarks like ArenaHard, BFCL V3, and GSM8K. Training used a five-phase pre-training pipeline, 4.1M fine-tuning samples filtered via LLM-as-Judge, and a four-stage RLHF pipeline using on-policy GRPO with DAPO loss. Long-context support reaches 512K tokens on the 8B and 30B models via staged context extension with model merging. The family also includes Granite Vision 4.1, Granite Speech 4.1 (5.33% WER), Granite Guardian 4.1 for safety moderation, and a multilingual embedding model supporting 200+ languages. All models are available on Hugging Face and IBM watsonx, with support for vLLM, SGLang, llama.cpp, and Ollama. 41 1 10. 10 [](https://daily.dev/posts/ask-com-shuts-down-after-nearly-30-years-pkrxuvjtv "Ask.com shuts down after nearly 30 years") Article Collections · 18w Ask.com shuts down after nearly 30 years Ask.com shut down on May 1, 2026, after nearly 30 years online. IAC, which acquired the site in 2005, announced it is exiting the search business entirely. Originally launched in 1996 as Ask Jeeves, the service was notable for its natural-language question interface — a cartoon butler that let users ask questions in plain English rather than constructing keyword queries. It never seriously challenged Google and had been coasting on minimal traffic since around 2010\. The shutdown drew little attention, though the author notes a certain irony: Ask Jeeves pioneered the conversational question-answering interface that is now standard in every LLM product, but the industry took 25 years to catch up, by which point the original had been forgotten. 36 3 11. 11 [](https://daily.dev/posts/claude-opus-4-8-released-with-longer-autonomous-work-and-improved-self-assessment-qgragmydo "Claude Opus 4.8 released with longer autonomous work and improved self-assessment") Article Collections · 15w Claude Opus 4.8 released with longer autonomous work and improved self-assessment Anthropic released Claude Opus 4.8 on May 28, about 41 days after Opus 4.7\. Pricing remains unchanged at $5/$25 per million tokens, while Fast mode dropped to $10/$50 — roughly 3x cheaper with 2.5x the speed. Key improvements include 4x better honesty/reliability (flagging bugs rather than hallucinating), SWE-bench Pro scores rising from 64.3% to 69.2%, configurable effort controls (low/medium/high/x-high/max), and dynamic multi-agent workflows in research preview that can coordinate hundreds of parallel subagents for large codebase tasks. The Messages API now supports mid-conversation system prompt updates without breaking cache, and minimum prompt cache size dropped from 4,096 to 1,024 tokens. Early adopters like Cursor, Devin, and Augment Code report real reliability gains in production. Independent benchmarks show meaningful improvement over 4.7, though GPT-5.5 remains competitive depending on workload. Anthropic also teased Mythos-class models — a tier above Opus — currently in restricted access due to cybersecurity concerns, with general release expected soon. The company announced a $65B Series H at a $965B valuation. 37 4 12. 12 [](https://daily.dev/posts/wordpress-7-0-what-s-new-and-what-it-means-for-developers-bxtug3jp5 "WordPress 7.0: What's new and what it means for developers") Article Collections · 15w WordPress 7.0: What's new and what it means for developers WordPress 7.0 'Armstrong' released May 20, 2026, introducing an AI Connectors screen for integrating OpenAI, Gemini, and Claude via a new WP AI Client and Abilities API. The block editor gains responsive visibility controls, per-block custom CSS, visual revisions, and three new blocks (Icons, Breadcrumbs, Headings). A site-wide Command Palette (Cmd/Ctrl+K) lands in the admin UI. PHP minimum is raised to 7.4, and developer-facing additions include pseudo-element support in theme.json, Block Selectors API, WP-CLI 3.0, and expanded DataViews/DataForms APIs. 24 Core and 16 Gutenberg accessibility fixes target WCAG 2.2 AA compliance. Real-time collaboration was cut from this release. A known publishing screen bug affects non-block editor on custom post types; WordPress 7.0.1 is planned for mid-to-late June. 32 3 13. 13 [](https://daily.dev/posts/php-retires-its-custom-license-in-favor-of-bsd-three-clause-u8gnsjq2t "PHP retires its custom license in favor of BSD three-clause") Article Collections · 18w PHP retires its custom license in favor of BSD three-clause The PHP project has officially retired its custom PHP License and relicensed its codebase under the three-clause BSD license. The old PHP License 3.01 and Zend Engine License 2.0 were problematic: neither was OSI-approved, both were GPL-incompatible, and they caused recurring headaches for Linux distribution packagers. Ben Ramsey led the effort starting July 2025, tracking down original PHP Group members for written consent and securing sign-off from Perforce Software (owner of Zend Engine rights). The RFC also proposes removing build-time linking options for GPLv3 libraries (GNU Readline and GDBM) to further simplify packaging. The vote passed 47–0 with 2 abstentions. 32 14. 14 [](https://daily.dev/posts/what-s-new-in-expo-sdk-56-gab9nzpgs "What's new in Expo SDK 56") Article Collections · 16w What's new in Expo SDK 56 Expo SDK 56 ships with React Native 0.85, React 19.2, and Hermes V1 as the default JS engine. The headline feature is \`@expo/ui\` reaching stable status, offering true SwiftUI and Jetpack Compose components as drop-in replacements for eight popular community packages. Performance improvements include precompiled XCFrameworks cutting iOS clean build times by up to 65%, Swift calling JSI directly (roughly 2x faster sync calls), and a Kotlin compiler plugin eliminating runtime reflection for 70% faster module initialization. New \`useNativeState\` hook integrates with react-native-worklets for flicker-free UI thread state. Expo Router v56 forks React Navigation internals for direct control, adds streaming SSR, and introduces a codemod for the breaking import changes. Expo Go is no longer available on app stores for SDK 56; development builds are now the recommended path. 29 4 15. 15 [](https://daily.dev/posts/cisa-contractor-left-aws-govcloud-credentials-and-plaintext-passwords-in-a-public-github-repo-for-si-bxb5plvqv "CISA contractor left AWS GovCloud credentials and plaintext passwords in a public GitHub repo for six months") Article Collections · 16w CISA contractor left AWS GovCloud credentials and plaintext passwords in a public GitHub repo for six months A contractor working for CISA maintained a public GitHub repository named 'Private-CISA' containing plaintext passwords, AWS GovCloud credentials, SSH private keys, authentication tokens, and Kubernetes config files for roughly six months. The repository held \~844 MB of sensitive data with obviously named files. GitGuardian researcher Guillaume Valadon discovered it via automated scanning on May 14, confirmed credentials granted high-privilege access to three AWS GovCloud accounts and CISA's GitHub enterprise org. After responsible disclosure was ignored, journalist Brian Krebs was contacted, and the repo came down within a day — but exposed AWS keys remained valid for 48 more hours, and a critical RSA private key stayed active for days. The contractor had deliberately disabled GitHub's built-in secret scanning and was using a personal account to sync work files. CISA, whose mandate is advising the US government on cybersecurity, has pledged additional safeguards. Basic preventive measures — password managers, separate work/personal accounts, secret scanning, short-lived credentials — would have prevented the incident entirely. 23 2 16. 16 [](https://daily.dev/posts/rolldown-1-0-and-vite-8-0-rust-based-bundler-replaces-esbuild-and-rollup-b90b3kpyo "Rolldown 1.0 and Vite 8.0: Rust-based bundler replaces esbuild and Rollup") Article Collections · 17w Rolldown 1.0 and Vite 8.0: Rust-based bundler replaces esbuild and Rollup Vite 8.0 has shipped with Rolldown as its sole bundler, replacing both esbuild and Rollup. Rolldown is written in Rust and built on the Oxc toolchain, delivering 10-30x faster builds than Rollup with performance comparable to esbuild. The release adds DevTools for build analysis, Wasm support in SSR, and browser console log forwarding. A full bundle mode is on the roadmap, promising 3x faster dev server startup and 10x fewer network requests. This follows a broader trend of rewriting JavaScript toolchain components in Rust or Go, alongside projects like Turbopack, Rspack, and TypeScript's native compiler. 23 1 17. 17 [](https://daily.dev/posts/anthropic-partners-with-spacex-to-double-claude-code-rate-limits-ww14kienq "Anthropic partners with SpaceX to double Claude Code rate limits") Article Collections · 18w Anthropic partners with SpaceX to double Claude Code rate limits Anthropic experienced severe compute shortages over several weeks, causing silent rate limit reductions, Claude Code access cuts, and degraded model performance. The root cause was 80x annualized demand growth against a planned 10x, driven largely by Claude Code adoption. Anthropic resolved the crunch by leasing Colossus 1 — xAI's 220,000+ GPU supercomputer in Memphis — from SpaceX, doubling Claude Code rate limits, removing peak-hour throttling, and substantially raising API limits. The deal is a short-term 180-day lease with a 90-day mutual cancellation clause, not the multi-year $45B deal some outlets reported. The arrangement is notable because xAI makes Grok, a direct Claude competitor, and Anthropic had previously banned xAI developers from its API. Separately, Anthropic published a postmortem acknowledging three overlapping product bugs that degraded Claude Code quality between March and April, none of which affected underlying model weights. 18 3 18. 18 [](https://daily.dev/posts/valve-raises-steam-deck-oled-prices-by-up-to-44--wqmii1ak2 "Valve raises Steam Deck OLED prices by up to 44%") Article Collections · 15w Valve raises Steam Deck OLED prices by up to 44% Valve has raised Steam Deck OLED prices by 40-43%: the 512GB model now costs $789 (up from $549) and the 1TB model is $949 (up from $649). The increases are attributed to industry-wide NAND flash and DRAM shortages, partly driven by AI infrastructure demand, alongside geopolitical supply chain pressures. Valve isn't alone — Nintendo, Sony, and Microsoft have all raised hardware prices recently. The hike also has implications for Valve's planned Steam Machine desktop console and Steam Frame, reportedly pushing their 2026 launch windows back further. At current component costs, a desktop Steam Machine with dedicated graphics would likely need to launch above $1,200, undermining its core value proposition as an affordable Linux gaming box. The Steam Deck OLED is now significantly pricier than the Nintendo Switch 2 ($449), erasing its former price advantage in the handheld gaming market. 24 11 19. 19 [](https://daily.dev/posts/flipper-one-announced-open-linux-handheld-built-on-rk3576-but-still-needs-community-help-to-ship-z8gtgcrsw "Flipper One announced: open Linux handheld built on RK3576, but still needs community help to ship") Article Collections · 16w Flipper One announced: open Linux handheld built on RK3576, but still needs community help to ship Flipper Devices has announced the Flipper One, an open-source Linux hardware device built on the Rockchip RK3576 SoC with 8 GB RAM, Wi-Fi 6E, dual Gigabit Ethernet, and an NPU for local AI. Unlike the Flipper Zero's radio focus, the One targets IP networking, packet analysis, VPN gateways, SDR, and on-device LLMs. It runs Debian 13 with KDE Plasma and two custom software layers. Six GitHub repos are already public with full schematics and PCB layouts. The announcement is explicitly a community call for contributors — key gaps include replacing a closed DDR initialization blob, OP-TEE support, NPU drivers, and mainline Linux kernel upstreaming for the RK3576\. No release date or firm price exists yet, with a target under $350 but flagged BOM and DRAM cost risks. 14 1 20. 20 [](https://daily.dev/posts/rust-1-96-0-released-new-range-types-pattern-assertions-and-two-cargo-security-fixes-b8qytlefo "Rust 1.96.0 released: new Range types, pattern assertions, and two Cargo security fixes") Article Collections · 14w Rust 1.96.0 released: new Range types, pattern assertions, and two Cargo security fixes Rust 1.96.0 introduces three new Copy-compatible Range types in core::range (Range, RangeFrom, RangeInclusive) that use IntoIterator instead of Iterator to avoid copy-during-iteration issues. Two new macros, assert\_matches! and debug\_assert\_matches!, are now stable for pattern-matching assertions with better diagnostics. WebAssembly targets now produce linker errors on undefined symbols instead of silently generating imports. The release also patches two Cargo security vulnerabilities: CVE-2026-5223 (tarball symlink extraction) and CVE-2026-5222 (URL normalization bug that could leak auth tokens to wrong registries), affecting all Cargo versions shipped with Rust 1.68–1.95. 15 21. 21 [](https://daily.dev/posts/linux-mint-s-may-2026-update-faster-nemo-new-screenshot-tool-and-theme-improvements-66i4ybccy "Linux Mint's May 2026 update: faster Nemo, new screenshot tool, and theme improvements") Article Collections · 15w Linux Mint's May 2026 update: faster Nemo, new screenshot tool, and theme improvements Linux Mint's May 2026 status report previews upcoming features for the next major release, expected around Christmas 2026\. Key highlights include removal of a 200ms lag in the Nemo file manager, a new screenshot tool integrated into the Cinnamon desktop with shadow controls and multi-monitor support, draggable Clutter dialogs, dark theme improvements, security updates, and new wireless networking support for WPA3 and Opportunistic Wireless Encryption (OWE). 12 22. 22 [](https://daily.dev/posts/claude-paid-plans-to-include-monthly-api-credit-starting-june-15-dg5jmou4w "Claude paid plans to include monthly API credit starting June 15") Article Collections · 17w Claude paid plans to include monthly API credit starting June 15 Anthropic is splitting Claude subscription billing starting June 15, creating separate monthly credit pools for programmatic usage (Agent SDK, claude -p, Claude Code GitHub Actions, third-party apps). Pro gets $20/month, Max 5x gets $100/month, and Max 20x gets $200/month in credits at API rates — a 25–40x reduction from what was previously available through the shared subscription pool. Developers who built tools on the Agent SDK, like T3 Code and OpenCode, are facing 5–10x cost increases. The change is framed as billing simplification but effectively routes third-party usage to full API pricing, improving unit economics ahead of a reported $950B funding round. Practical advice includes auditing token consumption now, setting budget alerts before June 15, and building multi-vendor optionality with local models for everyday tasks. 13 4 23. 23 [](https://daily.dev/posts/kde-plasma-6-7-beta-2-released-bug-fixes-land-across-three-branches-2ki6tucfu "KDE Plasma 6.7 Beta 2 released, bug fixes land across three branches") Article Collections · 14w KDE Plasma 6.7 Beta 2 released, bug fixes land across three branches KDE Plasma 6.7 released on June 16, 2026, bringing back classic KDE 4 themes (Oxygen and Air) with light/dark/twilight variants, per-screen virtual desktops after 21 years, and a new CSS-based Union theming engine in tech preview. Other highlights include a global microphone mute hotkey, quick light/dark toggle, revamped Discover software center, HDR improvements, new Wayland protocols, and Intel overlay planes support. The 6.7.1 point release followed a week later with crash fixes and KWin improvements. Plasma 6.7.2 targets a variable refresh rate crash on multi-monitor setups. Looking ahead, Plasma 6.8 development is underway with notable changes including dropping X11 entirely, enabling triple buffering for NVIDIA GPUs by default, and low battery notifications in full-screen apps. 18 3 24. 24 [](https://daily.dev/posts/openai-codex-team-asks-users-what-long-standing-bugs-are-most-annoying-uwhr6txxy "OpenAI Codex team asks users what long-standing bugs are most annoying") Article Collections · 14w OpenAI Codex team asks users what long-standing bugs are most annoying The OpenAI Codex team is soliciting direct user feedback about long-standing bugs and persistent pain points in Codex. Thomas Sottiaux posted an open-ended question asking users which unfixed issues are most frustrating, with no predefined options — just an honest community ask. 15 5 25. 25 [](https://daily.dev/posts/perplexity-open-sources-bumblebee-a-security-scanner-for-developer-machines-wpybdcpnz "Perplexity open-sources Bumblebee, a security scanner for developer machines") Article Collections · 15w Perplexity open-sources Bumblebee, a security scanner for developer machines Perplexity has open-sourced Bumblebee, a read-only security scanner for Linux and macOS developer machines. It checks package managers (npm, PyPI, Go modules, RubyGems, Composer), editor and browser extensions, and AI tool/MCP configurations against a manually curated threat catalog. Unlike CI pipelines or EDR tools that focus on production environments, Bumblebee targets the often-neglected local developer environment — the attack surface behind breaches like CircleCI and LastPass. It supports routine fleet scans, project-specific workspace scans, and rapid response sweeps when new supply-chain vulnerabilities emerge. Being read-only is a deliberate design choice for safety across dev fleets. 21 3 [See all Collections archives](/sources/collections/best-of) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@graph":[{"@type":"CollectionPage","@id":"https://daily.dev/sources/collections/best-of/2026/05#page","url":"https://daily.dev/sources/collections/best-of/2026/05","name":"Best Collections Posts — May 2026","description":"The most upvoted Collections posts from May 2026, curated by the daily.dev community.","isPartOf":{"@type":"WebSite","url":"https://daily.dev"}},{"@type":"ItemList","@id":"https://daily.dev/sources/collections/best-of/2026/05#items","numberOfItems":25,"itemListElement":[{"@type":"ListItem","position":1,"url":"https://daily.dev/posts/github-confirms-internal-repository-breach-via-poisoned-vs-code-extension-wyxybuh8c","name":"GitHub confirms internal repository breach via poisoned VS Code extension"},{"@type":"ListItem","position":2,"url":"https://daily.dev/posts/what-s-new-in-tailwind-css-v4-2-and-v4-3-oybkeyde7","name":"What's new in Tailwind CSS v4.2 and v4.3"},{"@type":"ListItem","position":3,"url":"https://daily.dev/posts/bun-is-being-rewritten-in-rust-moving-away-from-zig-4ty7usyvh","name":"Bun is being rewritten in Rust, moving away from Zig"},{"@type":"ListItem","position":4,"url":"https://daily.dev/posts/microsoft-s-redesigned-windows-11-run-dialog-is-faster-and-supports-dark-mode-msrntidoz","name":"Microsoft's redesigned Windows 11 Run dialog is faster and supports dark mode"},{"@type":"ListItem","position":5,"url":"https://daily.dev/posts/bun-v1-3-14-built-in-image-processing-global-virtual-store-http-3-and-more-sntpql4my","name":"Bun v1.3.14: built-in image processing, global virtual store, HTTP/3, and more"},{"@type":"ListItem","position":6,"url":"https://daily.dev/posts/andrej-karpathy-joins-anthropic-enblahrxp","name":"Andrej Karpathy joins Anthropic"},{"@type":"ListItem","position":7,"url":"https://daily.dev/posts/google-engineer-charged-with-using-internal-search-data-to-win-1-2m-on-polymarket-dllwzov6o","name":"Google engineer charged with using internal search data to win $1.2M on Polymarket"},{"@type":"ListItem","position":8,"url":"https://daily.dev/posts/chrome-148-quietly-downloads-4gb-gemini-nano-model-plus-new-css-and-media-features-vkbebrnfh","name":"Chrome 148 quietly downloads 4GB Gemini Nano model, plus new CSS and media features"},{"@type":"ListItem","position":9,"url":"https://daily.dev/posts/ibm-granite-4-1-how-the-8b-model-beats-a-32b-moe-6dkxujokc","name":"IBM Granite 4.1: how the 8B model beats a 32B MoE"},{"@type":"ListItem","position":10,"url":"https://daily.dev/posts/ask-com-shuts-down-after-nearly-30-years-pkrxuvjtv","name":"Ask.com shuts down after nearly 30 years"},{"@type":"ListItem","position":11,"url":"https://daily.dev/posts/claude-opus-4-8-released-with-longer-autonomous-work-and-improved-self-assessment-qgragmydo","name":"Claude Opus 4.8 released with longer autonomous work and improved self-assessment"},{"@type":"ListItem","position":12,"url":"https://daily.dev/posts/wordpress-7-0-what-s-new-and-what-it-means-for-developers-bxtug3jp5","name":"WordPress 7.0: What's new and what it means for developers"},{"@type":"ListItem","position":13,"url":"https://daily.dev/posts/php-retires-its-custom-license-in-favor-of-bsd-three-clause-u8gnsjq2t","name":"PHP retires its custom license in favor of BSD three-clause"},{"@type":"ListItem","position":14,"url":"https://daily.dev/posts/what-s-new-in-expo-sdk-56-gab9nzpgs","name":"What's new in Expo SDK 56"},{"@type":"ListItem","position":15,"url":"https://daily.dev/posts/cisa-contractor-left-aws-govcloud-credentials-and-plaintext-passwords-in-a-public-github-repo-for-si-bxb5plvqv","name":"CISA contractor left AWS GovCloud credentials and plaintext passwords in a public GitHub repo for six months"},{"@type":"ListItem","position":16,"url":"https://daily.dev/posts/rolldown-1-0-and-vite-8-0-rust-based-bundler-replaces-esbuild-and-rollup-b90b3kpyo","name":"Rolldown 1.0 and Vite 8.0: Rust-based bundler replaces esbuild and Rollup"},{"@type":"ListItem","position":17,"url":"https://daily.dev/posts/anthropic-partners-with-spacex-to-double-claude-code-rate-limits-ww14kienq","name":"Anthropic partners with SpaceX to double Claude Code rate limits"},{"@type":"ListItem","position":18,"url":"https://daily.dev/posts/valve-raises-steam-deck-oled-prices-by-up-to-44--wqmii1ak2","name":"Valve raises Steam Deck OLED prices by up to 44%"},{"@type":"ListItem","position":19,"url":"https://daily.dev/posts/flipper-one-announced-open-linux-handheld-built-on-rk3576-but-still-needs-community-help-to-ship-z8gtgcrsw","name":"Flipper One announced: open Linux handheld built on RK3576, but still needs community help to ship"},{"@type":"ListItem","position":20,"url":"https://daily.dev/posts/rust-1-96-0-released-new-range-types-pattern-assertions-and-two-cargo-security-fixes-b8qytlefo","name":"Rust 1.96.0 released: new Range types, pattern assertions, and two Cargo security fixes"},{"@type":"ListItem","position":21,"url":"https://daily.dev/posts/linux-mint-s-may-2026-update-faster-nemo-new-screenshot-tool-and-theme-improvements-66i4ybccy","name":"Linux Mint's May 2026 update: faster Nemo, new screenshot tool, and theme improvements"},{"@type":"ListItem","position":22,"url":"https://daily.dev/posts/claude-paid-plans-to-include-monthly-api-credit-starting-june-15-dg5jmou4w","name":"Claude paid plans to include monthly API credit starting June 15"},{"@type":"ListItem","position":23,"url":"https://daily.dev/posts/kde-plasma-6-7-beta-2-released-bug-fixes-land-across-three-branches-2ki6tucfu","name":"KDE Plasma 6.7 Beta 2 released, bug fixes land across three branches"},{"@type":"ListItem","position":24,"url":"https://daily.dev/posts/openai-codex-team-asks-users-what-long-standing-bugs-are-most-annoying-uwhr6txxy","name":"OpenAI Codex team asks users what long-standing bugs are most annoying"},{"@type":"ListItem","position":25,"url":"https://daily.dev/posts/perplexity-open-sources-bumblebee-a-security-scanner-for-developer-machines-wpybdcpnz","name":"Perplexity open-sources Bumblebee, a security scanner for developer machines"}]},{"@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Sources","item":"https://daily.dev/sources"},{"@type":"ListItem","position":3,"name":"Collections","item":"https://daily.dev/sources/collections"},{"@type":"ListItem","position":4,"name":"Best of","item":"https://daily.dev/sources/collections/best-of"},{"@type":"ListItem","position":5,"name":"May 2026"}]}]} ```