Supply chain attacks are becoming more frequent, and far more serious.

What are sensible practices to protect against these when using Node or Python packages?

I assume pinning versions is the bare minimum; for those with security teams / tools: why else do you do / can you do?

You're right.

It sounded like you were a proponent for having the "allow" flag enabled by default. I misinterpreted your message.

Public code makes sense to be used for training. But GitHub includes many other (if not all) data of yours in this training now if you opt-in.

#Europe’s $24 Trillion Breakup With Visa and Mastercard Has Begun

https://europeanbusiness

#PaymentSovereignty

AI tooling for software engineering How are software engineers using AI tools today? How has AI changed your work routines and the way you approach software development? Your responses will help paint an accurate picture of where we are...

If you are a dev / eng manager and would like to get a detailed report on how dev teams actually use AI tools, what is trending down/up: share what you do in our @Pragmatic_Eng survey and we'll share back a detailed report:

You can take the survey here: www.surveymonkey.com/r/tpe-ai-sur...

Ingress NGINX: Statement from the Kubernetes Steering and Security Response Committees In March 2026, Kubernetes will retire Ingress NGINX, a piece of critical infrastructure for about half of cloud native environments. The retirement of Ingress NGINX was announced for March 2026, after...

Ingress NGINX: Statement from the Kubernetes Steering and Security Response Committees-

Great read!

« Why We've Tried to Replace Developers Every Decade Since 1969 »

Excellent article à lire ⤵️

www.caimito.net/en/blog/2025...

Interesting read. Thanks for sharing @renovatebot.com 👍

Le premier intérêt de Kubernetes n'est pas le scaling mcorbin Tech Blog

Sur le blog: Le premier intérêt de Kubernetes n'est pas le scaling

"K8S c’est bien que pour les grosses entreprises", "On est pas Netflix/
Google", "Sans milliers de conteneurs ça sert à rien"…​ Vous avez déjà vu ces commentaires sur K8S ? Ces gens ont tout faux.

mcorbin.fr/posts/2025-1...

Stepping down as maintainer after 10 years · Issue #3777 · mockito/mockito In March 2026, I will be Mockito maintainer for 10 years (nearly a third of my whole life). Looking ahead, I decided that a decade milestone is a good moment to pass on maintainership to other folk...

Tim van der Lippe: Stepping down as Mockito maintainer after 10 years

#java #mock #mockito #testing

github.com/mockito/mock...

Sur Reddit, il se passe pas un jour sans que quelqu'un en parle depuis plusieurs mois déjà 😅. Et encore plus suite à la toute dernière annonce. Mais effectivement pas vu grand chose passer ici 🤷🏼‍♂️
Le choix d'une alternative est loin d'être évident en plus..

Has your #OpenTelemetry usage increased in the last year? What about #Prometheus?

These are the questions we're asking in the 4th annual Observability Survey. Share your perspective & you could win Grafana swag!

We'll publish a report & analysis in 2026: https://grafana.com/observability-survey/

Let's look at four possibilities that JDK 17 adoption could unlock for the upcoming #Scala versions. 🧵

scala script exit code should be non-0 for missing parameters · Issue #16040 · scala/scala3 Compiler version 3.2.0 Minimized code fun.sc: @main def fun(i: Int): Unit = { println("foo") } scala fun.sc echo $? Output Illegal command line: more arguments expected 0 Expectation The exit code ...

It could be great but it has a couple of pending bugs preventing usage in production IMHO, like github.com/scala/scala3... :'(

#OpenTelemetry has approved the new special interest group for Service and Deployment Semantic Conventions!

Let's face it: we all have some sort of deployment env attribute. is it 𝚙𝚛𝚘𝚍𝚞𝚌𝚝𝚒𝚘𝚗? 𝚙𝚛𝚘𝚍? is it even the same attribute across your org? and across the different cloud providers you use?
🧵

GitHub - qodo-ai/pr-agent: 🚀 PR-Agent: An AI-Powered 🤖 Tool for Automated Pull Request Analysis, Feedback, Suggestions and More! 💻🔍 (For more advanced: check Qodo Merge) 🚀 PR-Agent: An AI-Powered 🤖 Tool for Automated Pull Request Analysis, Feedback, Suggestions and More! 💻🔍 (For more advanced: check Qodo Merge) - qodo-ai/pr-agent

Just discovered github.com/qodo-ai/pr-a..., let's give it a try!
A fair free tier, OSS, works on-prem... 🙏

Definitely! Just built some kind of internal dashboard on top of another tool's data. Took me ~1 day instead of ~3 days if I had done it entirely by myself. Code is not perfect but good enough after a few iterations and detailed requirements (incl. the tech stack to use).

Eclipse Temurin container image OS Renovate preset A Renovate preset to suggest OS updates for Eclipse Temurin container images

I've started sharing some useful Renovate presets:
- Eclipse Temurin container image OS upgrades: medium.com/@gaeljw/ecli...
- Scalafmt Maven Spotless plugin upgrades: medium.com/@gaeljw/7694...

More to come... :)

#renovate #eclipsetemurin #scalafmt #spotless

Top 30 Argo CD Anti-Patterns to Avoid When Adopting Gitops Many teams adopt Argo CD quickly but later face slowdowns and developer frustration. Learn 30 common GitOps antipatterns to avoid and keep deployments efficient.

If you’re an Argo CD user — whether you’re just getting started or already an expert — this article is a great read on common anti-patterns to avoid when adopting GitOps👇

Amusing how 99% of people using LLMs forget how these things work:

They are advanced probability machines. They generate the next most likely token (word) based in the input and their training.

Under the hood, it’s a giant matrix multiplication that has eerily good output.

I like value classes for this (or opaque type in Scala). Hopefully Java will soon have them, IIRC it's planned as part of Valhalla project 🤞

𝗦𝘂𝘀𝘁𝗮𝗶𝗻𝗮𝗯𝗶𝗹𝗶𝘁𝘆 𝗶𝗻 𝗼𝗽𝗲𝗻 𝘀𝗼𝘂𝗿𝗰𝗲 𝗶𝘀𝗻'𝘁 𝗮𝗯𝗼𝘂𝘁 𝗰𝗼𝗱𝗲. 𝗜𝘁'𝘀 𝗮𝗯𝗼𝘂𝘁 𝗰𝗮𝗿𝗲.

Open source projects don’t fail because of bad technology.
They fail because contributors burn out, communities fracture, or energy fades.

Technical debt matters.

State of Scala 2025 Survey Hi, We’re gathering insights from Scala developers, engineers, and enthusiasts (not just tech leaders!) worldwide - all to understand how our language is evolving, what challenges people are facing, and where we're heading next. Your voice matters - whether you're a seasoned expert or just getting started with Scala. Help shape the future of Scala by sharing your experience - plus, enter to win a Nintendo Switch 2! ⏱️ Takes 5-10 minutes! 🎁 Leave your email to enter our giveaway! 🌍 Join developers globally - share your Scala story! Thank you for being a part of the Scala community! 📄 By taking part in the survey, you agree to the terms of our Prize Draw Rules, including eligibility, winner selection, and data usage details.

Now is the time to complain about the tooling and other pain points of Scala. Fill out the official State of Scala 2025 survey! 👇 #scala forms.gle/k6uzfsbxJVDs...

User feedback Survey: Building Multi cluster Management and Monitoring tool. Thank you for taking the time to participate in this survey! The Kubernetes SIG Multi cluster UX Working Group is conducting a survey to gather insights from users, operators, and developers on how…

Do you run multi-cluster Kubernetes setups? Open Source Kubernetes is building a tool for multi-cluster management and monitoring- and we'd love your feedback! Check it out here and share your experiences in this survey! docs.google.com/forms/d/e/1F...

Bundle upload times out after switching to Sonatype Central · Issue #597 · xerial/sbt-sonatype Describe the bug We moved to using Sonatype Central for publishing artifacts and several attempts to run sonatypeBundleRelease end with a BUNDLE_UPLOAD_FAILURE error after about 30 seconds (see the...

Tried to. When using sbt-sonatype, it's just a configuration change (🙏 thanks to the maintainers). But.. so far I've been hit by timeouts (github.com/xerial/sbt-s...).

As someone who has no idea of what it implies to build an IJ plugin, I'd be curious to learn about what it concretely means to implement the Scala plugin. Some kind of architecture review of what the plugins does and how it integrates with IJ platform, the Scala compiler, SBT, code highlighting... 🤷🏼‍♂️

Hi Scala devs!

If the IntelliJ Scala Plugin team gave a talk 🎙️, what would you be most interested in hearing about?
Drop your ideas in the replies 👇

SO frustrating when (at a larger company) you need another service make a small change... so you ask the team owning it to do it, and they tell you "sorry, can't do now, we can do it maybe in 2-3 months"

SO liberating when you can just make the change yourself and submit the PR

What is in your tech stack? Hi 👋 this is Gergely and Elin at The Pragmatic Engineer. We want to know what tools, languages, frameworks and platforms you're using today! We want to get a realistic snapshot of what the industry is...

📣 What's in your tech stack? Me and @gergely.pragmaticengineer.com want to know!

We're doing our biggest @pragmaticengineer.com survey yet, to get a realistic snapshot of what the industry is using, loving and disliking, and we need your help! 🙏

www.surveymonkey.com/r/whatisyour...