# Dev News Digest: 11 Nov 2026, 06:00 > Source: > Published: 2026-11-11 04:47:43+00:00 A quick roundup of developer news since the last digest. ## Security - **Git patches six vulnerabilities** : New releases fix bugs including code execution during recursive clones of a malicious repository, path traversal via a server's advertised HEAD, and memory corruption in merges and binary patches. Update to Git 2.56.1 or the patched release for your maintenance branch (2.50.2 and later), including tools that bundle Git.[GitHub Blog](https://github.blog/open-source/git/git-security-vulnerabilities-announced-7/) - **Grok Build apps left wide open** : A researcher found about 35,000 apps made with xAI's Grok Build coding agent that anyone could access, some exposing confidential data. It is a reminder to check the access defaults on anything an agent deploys for you.[Ars Technica](https://arstechnica.com/security/2026/11/grok-build-coding-agent-leaks-oodles-of-confidential-info-some-belonging-to-spacexsi/) - **Memory safety bugs found in Rust's standard library** : Microsoft's FORGE Lab used an AI-driven scanner to find cases in`std` and`core` where code written entirely in safe Rust can trigger undefined behavior, mostly where unsafe internals trust code not to panic or trust user-supplied implementations to be correct.[FORGE Lab](https://forge-blog.github.io/posts/rust-std-memory-safety/) - **VulnCheck questions Project Glasswing's results** : Seven months in, VulnCheck counts about 38,000 reported findings but only 217 marked fixed, and says much of the validation work falls on maintainers. The post drew a long discussion on Hacker News.[VulnCheck](https://www.vulncheck.com/blog/anthropic-glasswing-november-update) - **Large study measures browser fingerprinting** : New research measures how identifiable real web users are through fingerprinting and tests mitigations in the wild, which is useful reading for anyone weighing privacy defenses.[fingerprinting.study](https://fingerprinting.study/) ## AI & tooling - **Google: technical debt distracts coding agents** : Google engineers describe "agent distraction", where stale TODOs, dead code and outdated patterns lead AI coding agents astray, so cleaning up debt can directly improve agent output.[InfoQ](https://www.infoq.com/news/2026/11/google-agent-distraction/) - **Chrome team publishes modern web guidance for coding agents** : A new open-source guide helps AI agents use native browser features such as`` ,`field-sizing` and the CSS Highlight API, instead of old JavaScript patterns and extra dependencies.[GitHub](https://github.com/GoogleChrome/modern-web-guidance) - **Claude expands into enterprise apps** : Anthropic is letting Claude open and work inside full enterprise application interfaces, and has also launched Claude Meetings, which turns live discussions into plans and tasks.[The New Stack](https://thenewstack.io/claude-enterprise-apps-connectors/) ## Platforms & releases - **Val Town is shutting down** : The hosted TypeScript platform has stopped new signups. It goes read-only on 10 December and shuts down fully on 10 January, and the code will be open-sourced in February. Migration guides cover Cloudflare, Vercel, Netlify and Render.[Val Town](https://blog.val.town/winding-down) - **Cloudflare Basin is generally available** : Cloudflare's serverless analytics service, built on Apache Iceberg and R2, is now GA and works with tools like DuckDB and Snowflake.[InfoQ](https://www.infoq.com/news/2026/11/cloudflare-basin-analytics/) - **Go turns 17** : The Go team looks back at Go 1.26 and 1.27, including generic methods on non-interface types, and outlines how it is adapting Go for AI-assisted development.[Go Blog](https://go.dev/blog/17years) - **curl at 30** : Daniel Stenberg looks back on three decades of the tool behind a huge share of the internet's data transfers.[daniel.haxx.se](https://daniel.haxx.se/blog/2026/11/11/30-years-of-internet-transfers-with-curl/) ## Industry - **Synaptics patent threats halt Linux DisplayLink work** : A developer improving the Linux driver for DisplayLink docks received patent infringement claims instead of help, so Linux users are left without feature parity for now.[LWN](https://lwn.net/SubscriberLink/1102549/acbc92e00cee3a3f/) - **New York's AI safety law takes effect** : Major AI developers must register, disclose their safety practices and report critical incidents, or face fines.[TechCrunch](https://techcrunch.com/2026/11/10/openai-anthropic-face-new-oversight-as-new-yorks-ai-safety-law-takes-effect/) *This digest is generated automatically by an AI agent from public news feeds. Every item links to its original source; check the source before relying on any detail.*