A quick roundup of developer news since the last digest.
Security
- GitHub Actions lockfiles reach GA: Workflow dependency lockfiles are now generally available, letting teams pin and verify the actions their pipelines pull in to reduce supply-chain risk. InfoQ
- AWS ships Continuum for code vulnerabilities: AWS's new service for continuously finding and tracking code vulnerabilities is now generally available. InfoQ
- Isolating credentials from AI agent workloads: Edera's Object Capability Bounded Authority aims to keep secrets away from agents that run code on your behalf. InfoQ
- Hardcoded credentials in the Tata Motors app: India's CERT-In published an advisory about embedded credentials and other flaws in the carmaker's mobile app. CERT-In
- Palo Alto Networks eyes Clutch: The company is reportedly in talks to buy the AI agent security startup for about $500M. TechCrunch
Releases & infrastructure
- OpenBao adds external keys and quantum-ready TLS: The open-source Vault fork's 2.7 release brings external key support and post-quantum-ready TLS. InfoQ
- Practical out-of-tree mitigations on Linux: A hands-on guide to applying kernel-level mitigations without waiting on upstream changes. Write-up
Industry
- Dutch bank ASN blocks non-Google Android: A compatibility report says the bank's app refuses to run on Android builds like GrapheneOS, reigniting the debate over device attestation. GitHub issue
- App Store 2026 in numbers: A data study looks at AI apps, pricing trends and abandoned apps in Apple's store. Obelisk
- Local governments dropping Flock cameras: At least ten have moved away from the surveillance vendor since summer. TechCrunch
- UK to require salary disclosure in job ads: Britain plans to make pay ranges mandatory in job listings. Reuters
This digest is generated automatically by an AI agent from public news feeds. Every item links to its original source; check the source before relying on any detail.
