Blog

CVE-2026-92707: nested MessagePack array headers could reuse the same trailing bytes to pass the length check, so deserializing into object allocated thousands of times the payload size. The fix, a before/after probe, and why SignalR apps on .NET 8 through 11 RC 1 need a direct package pin.

EF Core 11 stops escaping '/', '\', '?' and '#' in generated Cosmos DB id values, so documents written by EF Core 8-10 stop resolving by key. How to find out if you are affected, when to set the EscapeIllegalCosmosIdCharacters switch, and how to rewrite the ids safely with a transactional batch.

A September 2026 comparison of GitHub Copilot code review, Cursor Bugbot, and anthropics/claude-code-action@v1 running the code-review plugin: what each one reads, what it skips, what it costs per review, and which to put on which repo.

The full path from an AGP 8 Flutter app that applies kotlin-android to AGP 9.1 with android.builtInKotlin=true on Flutter 3.47. Every step was built and measured, including the two edits that look optional and are not: kotlinOptions is a compile error under KGP 2.2+, and the KGP line in settings.gradle.kts has to stay.

describeEnum has been deprecated since Flutter 3.16 and its removal PR is approved. How to replace every call with Enum.name (Flutter 3.47.4, Dart 3.13), handle enum-like classes and diagnostics, find the calls hiding in dependencies like flutter_svg 1.x, and what the build error looks like once it is gone.

Polly 8.8.0 adds EnableReloadsWithMonitor, so a resilience pipeline can hot-reload from a feature flag or remote config monitor that is not registered in DI. A probe shows the rebuild, and one trap: context.GetOptions still reads the DI monitor and returns defaults.

Xcode 27 refuses to build anything below macOS 12, and Flutter 3.47 moved its own floor from 10.15 to 12.0. What the automatic migration rewrites, the three places it silently skips (custom values, Podfile post_install overrides, plugin podspecs), and a Podfile fix for teams still on Flutter 3.44.

Ship skwasm with flutter build web --wasm when your dependencies compile to Wasm: it downloads less and rendered 36% more frames than CanvasKit on a heavy scene. On Flutter 3.47.x, keep it single-threaded until the multi-threaded text crash fix leaves beta.

Claude Code 2.1.274 still loads only CLAUDE.md. Bridge AGENTS.md with an @AGENTS.md import or a symlink, then avoid the three traps: imports that don't expand from a subdirectory, symlinks that Windows checks out as a 9-byte text file, and Edit refusing to write through the link. Includes a CI check and a SessionStart hook for repos you don't own.

Use Microsoft.Data.SqlClient. System.Data.SqlClient is deprecated, already emits CS0618 on every type you touch, and loses its .NET assets when .NET 8 goes end of support on November 10, 2026, the same day .NET 11 ships. The measured feature gap, the Encrypt default that breaks the migration, and the 7.0 package split.