What's Changed

• Changelog for v0.53.0-preview.0 by @gemini-cli-robot in #28507
• Changelog for v0.52.0 by @gemini-cli-robot in #28508
• chore(release): bump version to 0.54.0-nightly.20260722.gf743ab579 by @gemini-cli-robot in #28510
• fix(caretaker): sanitize and wrap issue title in untrusted_context by @chadd28 in #28352
• chore(caretaker): update vitest to v3.2.4 and add package-lock.json files by @chadd28 in #28409
• fix(core): rotate session ID on model fallback to prevent stateful API errors by @amelidev in #28469
• feat(caretaker-triage): post comment before auto-closing issues by @chadd28 in #28411
• fix(core): enforce HTTPS for GoogleCredentialsAuthProvider to prevent cleartext leakage by @amelidev in #28517
• fix(core): filter out thought parts from getHistoryTurns when context management is disabled by @DavidAPierce in #28509

Full Changelog: v0.52.0-nightly.20260723.g9681621c6...v0.54.0-nightly.20260726.g3818efbbf

What's Changed

• Changelog for v0.53.0-preview.0 by @gemini-cli-robot in #28507
• Changelog for v0.52.0 by @gemini-cli-robot in #28508
• chore(release): bump version to 0.54.0-nightly.20260722.gf743ab579 by @gemini-cli-robot in #28510
• fix(caretaker): sanitize and wrap issue title in untrusted_context by @chadd28 in #28352
• chore(caretaker): update vitest to v3.2.4 and add package-lock.json files by @chadd28 in #28409
• fix(core): rotate session ID on model fallback to prevent stateful API errors by @amelidev in #28469
• feat(caretaker-triage): post comment before auto-closing issues by @chadd28 in #28411
• fix(core): enforce HTTPS for GoogleCredentialsAuthProvider to prevent cleartext leakage by @amelidev in #28517
• fix(core): filter out thought parts from getHistoryTurns when context management is disabled by @DavidAPierce in #28509

Full Changelog: v0.52.0-nightly.20260723.g9681621c6...v0.54.0-nightly.20260726.g3818efbbf

Earlier this year, Apple decided to completely discontinue its Pro Display XDR, which was an amazing piece of hardware but hadn’t been updated in years and was still $6,000+. Their new lineup consists of a Studio Display and the new Studio Display XDR, which are impressive in their own right, but now both only offer 27-inch 5K displays. The XDR starts at an insane $3,299 and can be spec’d up to $3,600 before tax. So now the door is open for someone to deliver a larger retina-class monitor for Mac users, and that is exactly what the new Meirro Pro does. The Meirro Pro is a 32-inch, 6K monitor made of a full aluminum construction. It is a single-cable solution and brings an adjustable stand for just $1,199. I’ve been using it as my primary display, and while a few compromises helped Meirro reach that price, this might be the most convincing Studio Display alternative I’ve tested. Here’s what you need to know.

Apple has a lineup of multiple new Macs launching later this year. This includes the first-ever touchscreen MacBook, the first M6 machines, and more. Here’s everything we know so far about new Macs launching soon.

Yesterday Bloomberg’s Mark Gurman detailed a years-long roadmap for upcoming Macs, and per his report, it sounds like two new models might skip the base M5 chip and go straight to M6.

Apple devices were long known for having some of the highest-quality LCD screens in the business, and that remains the case for today’s MacBooks. The company upped the ante first through retina displays and then mini-LED backlighting. This is the reason Apple has been in no great hurry to adopt OLED technology.

It has, however, been making a phased transition to OLED. Apple first introduced the display tech with the Apple Watch, followed up with iPhone and iPad models, and the MacBook Pro is next in line for the upgrade …

• fix(core): sequentially verify cached credentials and restore GOOGLE_APPLICATION_CREDENTIALS fallback by @luisfelipe-alt in #28472
• feat(evals): add eval coverage report command by @ved015 in #28169

Full Changelog: v0.52.0-nightly.20260722.gc776c665b...v0.52.0-nightly.20260723.g9681621c6

Apple released the all-new MacBook Neo earlier this year, and it’s been a resounding success by all indications. Here’s everything we know so far about what’s next for Apple’s most affordable laptop …

• Refactor: exclude transient CI configuration files from workspace context by @DavidAPierce in #28216
• feat(caretaker-triage): add triage worker core foundational modules by @chadd28 in #28163
• feat(caretaker-egress): implement octokit github action handler for egress service by @chadd28 in #28303
• chore(release): bump version to 0.52.0-nightly.20260707.g27a3da3e8 by @gemini-cli-robot in #28323
• Changelog for v0.51.0-preview.0 by @gemini-cli-robot in #28320
• Changelog for v0.50.0 by @gemini-cli-robot in #28322
• fix(core-tools): bypass LLM correction for JSON and IPYNB files in write_file and replace by @amelidev in #28223
• fix(core): use unambiguous previous intent label in fallback summary by @amelidev in #28343
• feat(caretaker-triage): implement main worker execution loop and egress action publisher by @chadd28 in #28306
• fix(privacy): show a clear message when the account has no Code Assist tier by @ompatel-aiml in #28304
• fix(core): enrich shared project quota limit errors with setup hint by @amelidev in #28391
• fix(a2a-server): ensure task cancellation aborts execution loop by @luisfelipe-alt in #28316
• fix(core): simplify plan mode write policy to support relative paths by @DavidAPierce in #28398
• feat(core): Bump node google-auth-library version to 10.9.0 by @jerrylin3321 in #28385
• chore/release: bump version to 0.52.0-nightly.20260715.gfa975395b by @gemini-cli-robot in #28402

Full Changelog: v0.51.0...v0.52.0

• fix(core,a2a): group cancelled tool responses and coalesce consecutive roles to prevent 400 Bad Request by @luisfelipe-alt in #28407
• feat(caretaker-triage): implement LLM triage orchestrator and container build by @chadd28 in #28345
• refactor(cli): align macOS permissive Seatbelt profiles with deny-default model by @ompatel-aiml in #28424
• fix(core): mitigate infinite ReAct loops and prompt injection loops by @amelidev in #28429
• fix(a2a-server): enforce workspace trust and task isolation to prevent RCE by @luisfelipe-alt in #28470
• fix(core): sequentially verify cached credentials and restore GOOGLE_APPLICATION_CREDENTIALS fallback by @luisfelipe-alt in #28472
• feat(evals): add eval coverage report command by @ved015 in #28169

Full Changelog: v0.52.0-preview.0...v0.53.0-preview.0

A new report from Bloomberg today offers an in-depth look at Apple’s Mac pipeline. The report details updates coming to the MacBook Pro, MacBook Air, iMac, and much more over the next several years.

Improvements

• Use adaptive thinking controls for Kimi models on Anthropic-compatible providers, with summarized reasoning output by default. (@chouqin)

Bugfixes

• Reduce OpenAI provider header timeouts during slow connection setup.
• Respect provider-defined reasoning options instead of falling back to the wrong reasoning controls.
• Restore Azure Cognitive Services endpoint support for Azure-hosted models.

Desktop

Improvements

• Sync the embedded terminal theme with the app theme.
• Improve the review panel so open file tabs can stay aligned with the current diff view.
• Rewrite the v2 prompt input for more reliable command, context, shell, attachment, and history interactions.
• Improve review panel resizing and sticky controls.

Bugfixes

• Preserve command drafts in the command menu.
• Avoid session view failures when message parent links are missing.
• Prevent sending empty prompt text parts.
• Restore model variant selection accessibility.
• Show keybind tooltips on prompt input controls. (@ProdigyRahul)
• Deduplicate repeated file entries in diff summaries.
• Prevent recovery window handling from touching destroyed windows.

Thank you to 3 community contributors:

• @jerome-benoit:
  • fix(nix): relax Bun version check for desktop build (#36767)
  • fix(nix): restore desktop integration (#37197)
• @ProdigyRahul:
  • fix(app): show keybind tooltips on prompt input controls (#37824)
• @chouqin:
  • feat(opencode): use adaptive thinking effort for kimi family on anthr… (#37696)

There have been growing complaints about users experiencing beach balls on the Mac when running macOS 26.5, with some also saying that their trackpad becomes completely unresponsive for several seconds at a time.

Activity Monitor typically reveals three culprits, and there does now appear to be a reliable solution to the problem …

In March, Apple announced it was discontinuing the Mac Pro and confirmed that it had no plans to offer future Mac Pro hardware.

A new report from Bloomberg today offers more context on Apple’s Mac Pro strategy, with a surprising tidbit on something Apple was working on …

After successful runs, clamp the proposal to the job bounds and persist an exact one-shot slot marker so maintenance preserves only that timestamp. Clear the marker on runs, edits, and schedule normalization; preserve existing no-proposal, skip, timeout, and error scheduling behavior.

• feat(caretaker-triage): implement LLM triage orchestrator and container build by @chadd28 in #28345
• refactor(cli): align macOS permissive Seatbelt profiles with deny-default model by @ompatel-aiml in #28424
• fix(core): mitigate infinite ReAct loops and prompt injection loops by @amelidev in #28429

Full Changelog: v0.52.0-nightly.20260716.g3ff5ba20f...v0.52.0-nightly.20260718.gacae7124b

Apple will reportedly launch its next-generation Apple Silicon chip, the M6, later this year. Here’s everything we know so far, including why this generation will be unprecedented in the Apple Silicon era.

When Apple finally responded to the dramatically increased costs of memory and other components, the company didn’t hold back. Some of the price hikes exceeded 50%, while memory and storage upgrades literally doubled in some cases.

There’s a strong possibility that these higher prices will remain in effect for years, and quite possibly permanently …

The release, timed to land just ahead of the 2026 World Artificial Intelligence Conference in Shanghai, is a dramatic escalation in the global AI arms race and a watershed moment for the open-source AI movement. It also marks a remarkable comeback for a company whose market position had eroded significantly over the past 18 months following DeepSeek's meteoric rise.

Full model weights are scheduled to be released on July 27, according to details shared by researchers who reviewed the company's technical documentation. If you want to take Kimi K3 for a spin right now, you can — just head to kimi.com, sign up with a Google account or phone number (no credit card required), and start chatting with what may be the most powerful open-source model ever built.

Inside the architecture that powers the world's largest open-source AI model

Kimi K3 is a frontier-class large language model with 2.8 trillion total parameters — roughly 75 percent larger than DeepSeek's V4 Pro, which the company's own timeline chart shows at approximately 1.6 trillion parameters. The model features a 1-million-token context window, native visual understanding capabilities, and an always-on reasoning mode that the company calls "thinking mode."

The model is built on two key architectural innovations developed internally at Moonshot AI: Kimi Delta Attention, a hybrid linear attention mechanism, and Attention Residuals, which the company describes as a drop-in replacement for residual connections that delivers consistent scaling gains. Both techniques were previously published as open research by the Moonshot team on GitHub.

On the API side, Kimi K3 is compatible with the OpenAI SDK, lowering the integration barrier for developers already building on OpenAI or Anthropic toolchains. The model is priced at $3 per million input tokens and $15 per million output tokens, with cached input tokens dropping to just $0.30 per million — pricing that positions it roughly in line with mid-tier offerings from Western labs, but at a performance level the company claims approaches the top of the market. A promotional top-up rebate running through August 12 offers up to 30 percent back in vouchers for API credits of $1,000 or more.

As Xinhua reported, a Moonshot AI executive explained the significance of the parameter count in simple terms: parameters are like neural connections in the human brain, and nearly 3 trillion of them means the model can "store more knowledge and patterns in its brain, understand more, think deeper, and answer more accurately."

Benchmark results show Kimi K3 trading blows with Claude and GPT at the top of the leaderboard

The benchmark results, drawn from public leaderboard data and a private evaluation by analytics firm Artificial Analysis, tell a striking story.

On GDPval-AA v2, a benchmark measuring real-world tasks across 44 occupations and 9 major industries, Kimi K3 scored 1,687 — placing it third overall, behind only Claude Fable 5 Max (1,815) and GPT-5.6 Sol Max (1,747.8), and ahead of Claude Opus 4.8 (1,600).

On AA-Briefcase, a private agentic benchmark from Artificial Analysis designed to test long-horizon knowledge work, K3 climbed to second place with a score of 1,527 — beating GPT-5.6 Sol Max (1,495) and trailing only Fable 5 Max (1,587).

Perhaps most impressively, K3 achieved a state-of-the-art score of 91.2 out of 100 on BrowseComp, a benchmark for long-horizon, high-difficulty information seeking.

The company says it accomplished this in a single-agent setup using its 1-million-token context window, without any context compression or additional context management techniques — a feat that suggests raw context length, when paired with strong retrieval capabilities, may be more powerful than elaborate multi-agent workarounds.

As one widely followed AI commentator put it on social media: "Open source is no longer lagging six months behind Western closed-source models. Read that again, and think about what it all means."

That observation captures the significance of the moment. For much of the past three years, open-source models have typically trailed their proprietary counterparts by a meaningful margin. Kimi K3 appears to have closed that gap almost entirely.

How a 48-hour autonomous chip design demo reveals Moonshot's real ambitions

Beyond raw benchmarks, Moonshot AI showcased a proof-of-concept that may be even more revealing of K3's capabilities and the company's strategic direction.

In a demonstration documented in the company's technical materials, Kimi K3 was tasked with designing a physical chip to run a nano-scale version of itself. Over 48 hours of continuous autonomous agent operation, K3 independently completed the chip's full construction pipeline — from architectural design through optimization and verification — using open-source electronic design automation tools. The result was a tiny but functional chip design, just 4 square millimeters, that achieved timing convergence at 100 MHz and could decode more than 8,700 tokens per second in simulation.

This is not a production chip. It is a demonstration of what Moonshot AI clearly views as the next competitive frontier: long-range autonomous agent capabilities. The ability to sustain coherent, multi-step technical work over a 48-hour window — reading documentation, making design decisions, running verification loops, and iterating on failures — represents a qualitative leap beyond the kind of single-turn question-answering that defined the first generation of large language models.

The company also highlighted a case in computational astrophysics, where K3 reportedly reproduced the universal I-Love-Q relation — a complex calculation that typically takes a senior researcher one to two weeks — in approximately two hours, reading and cross-validating more than 20 papers and implementing a complete numerical pipeline along the way.

Moonshot AI's fall and rise tells the story of China's brutal AI market

To understand why Kimi K3 matters, you need to understand where Moonshot AI was 18 months ago — and how far it fell.

Founded in 2023 by Yang Zhilin, a Tsinghua University graduate who previously conducted research at Google and Meta, Moonshot AI quickly became one of China's most prominent AI startups. The company gained early traction in 2024 when users flocked to its Kimi platform for its long-text analysis capabilities and AI search functions. By early 2026, it had raised roughly $1.5 billion across multiple rounds, with its valuation climbing from $2.5 billion to $4.3 billion and the company reportedly seeking a new round at $5 billion.

Then DeepSeek happened. The release of DeepSeek's low-cost R1 model in January 2025 disrupted the entire Chinese AI landscape, and Moonshot AI was among the hardest hit. Kimi, which had ranked third in monthly active users in China, slid to seventh. The company's strategic pivot to open-source models — beginning with Kimi K2 in July 2025 and accelerating with K2.5 in January 2026 — was in large part an effort to reclaim relevance.

Kimi K3 is the culmination of that effort — and the sheer scale of the model suggests that Moonshot AI has been planning this move for some time. Training a 2.8-trillion-parameter model requires enormous computational resources and months of preparation, which means the architectural and infrastructure decisions behind K3 were likely locked in well before the model reached the public.

Why open-sourcing the world's biggest model is a geopolitical chess move

The decision to release K3's full weights on July 27 is strategically significant and worth parsing carefully.

The company's own timeline chart of open-source frontier model scale positions K3 as a dramatic outlier, towering above competitors like DeepSeek (1.6T), Xiaomi (1.02T), and Alibaba (397B). By releasing the world's largest open-source model, Moonshot AI is making a bid to become the center of gravity for the global open-source AI developer community.

This follows a broader trend among Chinese AI companies. As Reuters noted, open-sourcing allows companies to "showcase their technological capabilities and expand developer communities as well as their global influence, a strategy likely to help China counter U.S. efforts to limit Beijing's tech progress." DeepSeek, Alibaba, Tencent, and Baidu have all released open-source models. But none have released anything at this parameter count.

For enterprise technology leaders, the implications are concrete. A 2.8-trillion-parameter open-source model that performs at near-frontier levels creates new options for companies that want to fine-tune, self-host, or build proprietary systems on top of a capable base model — without being locked into API contracts with OpenAI or Anthropic. The trade-off, of course, is that running a model of this size requires substantial GPU infrastructure. Inference at 2.8 trillion parameters is not something that runs on a single server rack.

That said, Moonshot AI has signaled awareness of this challenge. Its Mooncake project, which won the Best Paper award at FAST 2025, pioneered KV-cache-centric disaggregated serving for large language models — an architecture designed specifically to make inference at extreme scale more practical and cost-efficient.

Kimi Code and a three-tier model lineup form the foundation of Moonshot's enterprise play

Alongside K3, Moonshot AI continues to invest heavily in its coding agent ecosystem. Kimi Code, the company's open-source coding tool that competes with Anthropic's Claude Code and Google's Gemini CLI, received two major updates on the same day as K3's launch — versions 0.25.0 and 0.26.0 — adding features like expanded subagent tooling, background task management, and security fixes.

The Kimi Code CLI has accumulated over 3,100 stars on GitHub and features integration with VSCode, Cursor, and Zed. The latest release expanded the "coder subagent" tool set to include background tasks, todo lists, plan mode, skill invocation, and nested agents — effectively turning the coding agent into a multi-layered autonomous system capable of managing complex software engineering projects with minimal human intervention.

This is not incidental. Coding tools have become a critical revenue driver for AI labs. As Anthropic disclosed in January, Claude Code reached $1 billion in annualized recurring revenue. By building Kimi Code as an open-source alternative that defaults to Kimi's own models — but supports other providers — Moonshot AI is positioning itself to capture developer workflows and, eventually, enterprise contracts.

The company's model lineup now includes three tiers: K3 as the flagship ($3/$15 per million tokens for input/output), K2.7 Code as a specialized coding model ($0.95/$4), and K2.6 as a general-purpose option ($0.95/$4). All three support context windows of 256,000 tokens or above, with K3 offering the full 1-million-token window. Context caching is automatic — no cache ID, TTL, or extra parameter is required — a small but meaningful developer-experience advantage over competitors that require explicit cache management.

What Kimi K3 means for the future of enterprise AI and the global model landscape

Kimi K3's release forces a recalibration of several assumptions that have guided enterprise AI strategy.

The performance gap between open-source and proprietary models has functionally closed at the frontier. If K3's benchmark numbers hold up under independent evaluation — and particularly once the open weights are available for community testing on July 27 — it will be difficult for closed-source providers to justify premium pricing purely on the basis of capability.

The locus of AI innovation, meanwhile, continues to shift. China's AI ecosystem, which many Western observers questioned after early struggles with chip export restrictions, has now produced a model that competes with the best systems from companies with direct access to Nvidia's most advanced hardware. The architectural innovations behind K3 — particularly the hybrid linear attention mechanism — suggest that algorithmic efficiency may matter as much as raw compute.

And the agentic capabilities demonstrated by K3 — chip design, multi-week research compression, long-horizon information seeking — point toward a future where AI models are not just answering questions but autonomously executing complex, multi-day projects. For enterprises evaluating AI investments, this shifts the value proposition from "productivity copilot" to "autonomous technical workforce."

Xinhua, China's state news agency, framed the release as a national milestone, reporting that K3 "marks a new step forward in the development of China's artificial intelligence models." Liu Tieyan, dean of the Zhongguancun Academy in Beijing, was quoted as saying that a wave of Chinese open-source models has moved from isolated breakthroughs to collective advancement, providing "new solutions and new paths" for global AI development.

Just two years ago, Moonshot AI was a scrappy startup named for the audacious problems it hoped to solve. Eighteen months ago, it was a cautionary tale about how quickly a market darling can lose its footing. Today, it is the maker of the world's largest open-source AI model — one that can, given 48 hours and an internet connection, design a chip to run itself. The frontier, it turns out, is not a place. It is a race. And the field just got a lot more crowded.

• Type the gradle, swift, and pre_commit ecosystems by @JamieMagee in #15534
• Default cooldown to 3 days when default-days is not specified (behind a feature flag) by @robaiken with @Copilot in #15344
• Use shared base cooldown in git_submodules by @robaiken in #15537
• [Update graph] Avoid PathDependenciesNotReachable killing the whole job by @brrygrdn in #15522
• [Update Graph] Ensure that txt/in pairs are included properly in layers when working out references by @brrygrdn in #15581
• build(deps): bump opentofu to 1.12.1 by @RinseV in #15231
• Type the Sentry before_send processors by @JamieMagee in #15569
• Clear T.untyped from four strong updater files by @JamieMagee in #15570
• feat(opentofu): use registry API for multi-platform lockfile hashes by @diofeher in #15296
• julia: various fixes by @IanButterworth in #15549
• Type git_metadata_fetcher's git responses by @JamieMagee in #15572
• pre-commit: add regression tests for prerelease version filtering by @v-HaripriyaC in #15542
• add test ensuring duplicate PRs aren't submitted in security jobs by @brettfo in #15584
• Clear T.untyped from already-strong ecosystem files by @JamieMagee in #15573
• Update branch name case values to align with schema accepted values by @AbhishekBhaskar in #15592
• julia: fix TypeError when a cooldown is configured by @IanButterworth in #15591
• Fix codespell typo in updater job spec by @thavaahariharangit with @Copilot in #15599
• Swift: SemVer-compliant version comparison and validation by @v-HaripriyaC in #15589
• Type git source details by @JamieMagee in #15593
• Expose typed git source details by @JamieMagee in #15594
• v0.387.0 by @dependabot-core-action-automation[bot] in #15604

New Contributors

• @RinseV made their first contribution in #15231

Full Changelog: v0.386.0...v0.387.0

• Refactor: exclude transient CI configuration files from workspace context by @DavidAPierce in #28216
• feat(caretaker-triage): add triage worker core foundational modules by @chadd28 in #28163
• feat(caretaker-egress): implement octokit github action handler for egress service by @chadd28 in #28303
• chore(release): bump version to 0.52.0-nightly.20260707.g27a3da3e8 by @gemini-cli-robot in #28323
• Changelog for v0.51.0-preview.0 by @gemini-cli-robot in #28320
• Changelog for v0.50.0 by @gemini-cli-robot in #28322
• fix(core-tools): bypass LLM correction for JSON and IPYNB files in write_file and replace by @amelidev in #28223
• fix(core): use unambiguous previous intent label in fallback summary by @amelidev in #28343
• feat(caretaker-triage): implement main worker execution loop and egress action publisher by @chadd28 in #28306
• fix(privacy): show a clear message when the account has no Code Assist tier by @ompatel-aiml in #28304
• fix(core): enrich shared project quota limit errors with setup hint by @amelidev in #28391
• fix(a2a-server): ensure task cancellation aborts execution loop by @luisfelipe-alt in #28316
• fix(core): simplify plan mode write policy to support relative paths by @DavidAPierce in #28398
• feat(core): Bump node google-auth-library version to 10.9.0 by @jerrylin3321 in #28385
• chore/release: bump version to 0.52.0-nightly.20260715.gfa975395b by @gemini-cli-robot in #28402

Full Changelog: v0.51.0-preview.0...v0.52.0-preview.0

• Changelog for v0.50.0-preview.1 by @gemini-cli-robot in #28150
• Fix no_proxy test by @jerrylin3321 in #28131
• chore(release): bump version to 0.51.0-nightly.20260625.g3fbf93e26 by @gemini-cli-robot in #28151
• Vertex base url update by @DavidAPierce in #28145
• fix(security): enforce case-insensitive sensitive path blocklist and vscode hitl by @luisfelipe-alt in #27966
• fix(core-tools): resolve defensive path resolution for at-reference files and fix macOS tests by @luisfelipe-alt in #28053
• feat(caretaker): implement Cloud Run webhook ingestion service by @chadd28 in #28015
• fix(core): resolve symbolic link directory escape in memory import processor by @luisfelipe-alt in #28233
• feat(caretaker): egress cloud run service skeleton by @chadd28 in #28167
• fix(sandbox): make ~/.gitconfig read-only in the macOS sandbox by @ompatel-aiml in #28221
• fix(core): preserve escape sequences in string literals for modern models by @luisfelipe-alt in #28299
• fix(core): strip thoughts from scrubbed history turns and resolve thought leakage by @amelidev in #27971

Full Changelog: v0.50.0...v0.51.0

While Apple’s latest AppleCare+ price increase for Mac and iPad is small in isolation, it makes AppleCare One an even better value. Apple increasing the price of Mac and iPad hardware also makes warranty coverage a stronger consideration.

1Password is launching a new Claude integration for Mac users today. It’s designed to let Anthropic’s AI agent sign in to websites without seeing your password or two-factor authentication code.

Today, Thinking Machines—the highly capitalized American AI startup founded by former OpenAI CTO Mira Murati—released Inkling, its first major language model under an enterprise-friendly Apache 2.0 open source license, and it boasts high, if sub state-of-the-art, performance for open weights models on third-party benchmarks, specifically software engineering (77.6% on SWE-bench Verified, where it beats fellow U.S. open rival Nvidia Nemotron 3's 71.9%) and voice understanding (91.4% on VoiceBench compared to 94.4% for Gemini 3.1 Pro on high reasoning effort).

Another differentiator: Thinking Machines notes that Inkling was designed "to answer directly on topics that may be subject to censorship," offering enterprises concerned about factual outputs, irrespective of controversy or sensitivity, a more trustworthy option.

Coming in at 975 billion total parameters, Inkling is a natively multimodal, open-weights Mixture-of-Experts (MoE) system capable of reasoning across text, images, and audio. The weights are already available on Hugging Face and the company's own model training application programming interface (API), Tinker.

Designed to balance cost against performance through a novel "controllable thinking effort" mechanism, the model represents a significant departure from the black-box scaling strategies of frontier competitors.

Alongside the flagship model, Thinking Machines also announced a preview of Inkling-Small, a lighter 276-billion-parameter alternative optimized for workloads where low latency and cost are paramount.

Benchmarks Show a Powerful, High-End, Sub State-of-the-Art Model

While Inkling is a formidable multimodal engine, it lands in a fiercely competitive 2026 open-weight landscape characterized by highly specialized MoE architectures. Rather than attempting to dominate every leaderboard, Thinking Machines explicitly designed Inkling—with 975 billion total and 41 billion active parameters—as a broad, balanced generalist.

For example, it comes in near the middle high-end of benchmark performance 1257 on Design Arena’s Agentic Web Dev leaderboard measuring human scores of frontend web design.

But China’s leading AI labs have produced models with elite reasoning and coding capabilities, posing a stiff challenge to Inkling's generalist approach and ultimately outperforming it on general and coding benchmarks.

• GLM 5.2: Widely considered the top open-weight reasoning model available in the benchmark set, GLM 5.2 outperforms Inkling on pure coding, agentic, and complex reasoning tasks. It scores 62.1% on SWEBench Pro (Public) compared to Inkling’s 54.3%, and a massive 82.7 on Terminal Bench 2.1 against Inkling’s 63.8. GLM 5.2 also holds the edge in text-only reasoning, scoring 40.1% on HLE (text only) versus Inkling's 30.0%.

• DeepSeek V4 Pro: DeepSeek maintains an edge in several strict coding and factuality domains, beating Inkling on SWEBench Verified (80.6% vs. 77.6%) and SimpleQA Verified (57.0% vs. 43.9%). However, Inkling successfully overtakes DeepSeek V4 Pro in mathematical problem-solving, achieving 97.1% on AIME 2026 compared to DeepSeek's 96.7%.

• Kimi K2.6: This model outpaces Inkling across multiple technical benchmarks, delivering higher scores on GPQA Diamond (91.1% vs. 87.9%), BrowseComp (83.2% vs. 77.1%), and HLE with tools (54.0% vs. 46.0%). Yet Inkling proves more resilient on general chat instruction following, scoring 79.8% on IFBench compared to Kimi K2.6's 76.0%.

Against its primary U.S.-based open-weight competition, Inkling demonstrates strong parity and frequent superiority.

• Nemotron 3 Ultra: Inkling consistently outperforms this U.S. rival across reasoning and coding. Inkling posts 97.1% on AIME 2026 and 77.6% on SWEBench Verified, beating Nemotron's 94.2% and 70.7%, respectively. Furthermore, Inkling significantly leads in agentic workflows, scoring 74.1% on MCP Atlas against Nemotron's 44.7%.

When compared to closed-source juggernauts like Claude Fable 5, GPT 5.6 Sol, and Gemini 3.1 Pro, Inkling trails in peak reasoning and software engineering autonomy, but remains highly competitive in multimodality.

• Coding and Reasoning: Closed models maintain a commanding lead. Claude Fable 5 (max) hits 95.0% on SWEBench Verified and 53.3% on HLE (text only), far outpacing Inkling's 77.6% and 30.0%. GPT 5.6 Sol dominates Terminal Bench 2.1 with an 89.5, easily clearing Inkling's 63.8.

• Native Multimodality: Inkling's native visual and audio capabilities hold their own. On the MMMU Pro (Standard 10) vision benchmark, Inkling's 73.3% is competitive, though trailing Claude Fable 5's 84.2% and GPT 5.6 Sol's 83.0%. In audio processing, Inkling scores a highly respectable 77.2% on MMAU, keeping it within striking distance of Gemini 3.1 Pro's 82.5%.

If an enterprise workflow demands elite software engineering autonomy or the highest bounds of text-only reasoning, models like GLM 5.2 or proprietary systems like Claude Fable 5 maintain the edge.

However, Inkling carves out a unique and highly defensible position: it is the most capable open-weight foundation model that natively fuses text, vision, and audio, while simultaneously offering developers direct programmatic control over the cost-to-performance ratio.

The Shift from Static Reasoning to Controllable Thinking

Rather than attempting to build a singular "god model" optimized strictly for state-of-the-art benchmark domination, Thinking Machines engineered Inkling for adaptability and efficiency in real-world workflows.

The standout feature of this release is Inkling's "controllable thinking effort." Developers can programmatically adjust the model's reasoning budget—scaling from 0.2 to 0.99—to dictate how hard the AI should "think" before generating an output.

As the company noted, "Inkling's continuous thinking effort lets you pick your point on the cost/performance curve—reaching the same score with a fraction of the tokens".

In practical terms, this allows enterprises to deploy Inkling with lower token expenditure for simpler tasks, while cranking up the compute overhead for complex, multi-step reasoning challenges. However, by keeping the thinking effort lower and generating fewer tokens, the cost-conscious enterprise can achieve high quality results and performance on simple tasks while spending less money, or, in the case of those running models locally, less costs on energy and compute resources.

During the model’s large-scale reinforcement learning (RL) training over 30 million rollouts, researchers observed an emergent phenomenon they called "chain of thought condensation". Over time, Inkling naturally learned to compress its internal reasoning steps—dropping grammatical overhead and connectives—while reaching the same accurate conclusions, resulting in drastically reduced latency.

Epistemics and Censorship Resistance

A notable element of Thinking Machines' release is its explicit focus on the model's epistemics—specifically its calibration, instruction following, and resistance to censorship.

In an ecosystem where open-weight models adopt either overly restrictive safety guardrails or echo state-aligned ideological talking points, Inkling was intentionally trained to answer directly on politically sensitive or heavily censored topics.

To validate this approach, Thinking Machines submitted Inkling to the Propaganda and Censorship Eval developed by AI startup Cognition. According to the published findings, Inkling demonstrated "strong patterns of censorship non-compliance," effectively resisting ideological capture or boilerplate refusals when presented with sensitive subjects.

Despite its resistance to censorship, the model maintains a robust defense against genuinely malicious, dangerous, or illegal queries. On the StrongREJECT benchmark—which tests responses to unambiguous harmful requests—Inkling scored 98.6%, placing it in line with strict frontier safety standards. Furthermore, on the FORTRESS benchmark, Inkling successfully navigated the line between safety and over-refusal: it achieved a 78.0% refusal rate on adversarial queries (such as those involving weapons, cyberattacks, or violence) while maintaining a 95.9% compliance rate on benign, look-alike queries.

Thinking Machines noted that typical open-weight vulnerabilities remain within the architecture. Internal safety evaluations revealed an "occasional tendency to comply with role-play and indirectly framed prompts concerning harmful topics". The company advised enterprise developers to treat the model's built-in refusals as just one layer of security, recommending the downstream deployment of external moderation tools—such as Llama Guard—to filter adversarial jailbreaks and enforce use-case-specific safety policies at the application level.

Under the Hood: Architecture and Multimodality

Inkling's scale is staggering, yet sparse. The MoE architecture features 975 billion total parameters, but only 41 billion parameters are active during any given token generation. It supports a massive context window of 1 million tokens and diverges from typical transformer models by using relative positional embeddings instead of the industry-standard Rotary Positional Embedding (RoPE).

True to the company's foundational vision, Inkling was trained from scratch to be natively multimodal. Unlike models that rely on bolted-on external encoders, Inkling uses an encoder-free early fusion approach. It directly ingests audio as discrete dMel spectrograms and visual data as 40x40 pixel patches via a hierarchical multi-layer perceptron (hMLP), projecting all modalities into a shared hidden space.

Licensing: True Open-Source for the Enterprise

For enterprise IT teams and developers, the most disruptive aspect of Inkling may be its licensing. Inkling is released under the permissive Apache 2.0 license.

In an ecosystem where many so-called "open" models from Western labs are tethered to dual-use commercial licenses, acceptable use restrictions, or revenue caps, an Apache 2.0 designation makes Inkling a true open-source foundation. This gives developers the legal freedom to download, modify, integrate, and commercialize the model weights entirely royalty-free.

The model is readily deployable across major open-source inference libraries—including SGLang, vLLM, TokenSpeed, and llama.cpp—and comes with a native NVFP4 quantized checkpoint optimized for NVIDIA Blackwell systems.

Community Reactions: The Engineering Feat

The AI community's response has been swift, praising both the model's openness and the underlying engineering execution.

In a post on X, Thinking Machines co-founder John Schulman reflected on the rapid development cycle: "Inkling is out today, with open weights and in Tinker. It's been fun to watch this one come together: pretraining began last winter, and starting in mid-January a small team built up the coding, reasoning, and agentic training from there. We learned a lot building it, and I hope people find good uses for it."

Horace He, a researcher at Thinking Machines (previously from PyTorch), underscored the difficulty of the task in another post on X: "It truly takes a village to release a model, perhaps especially an open weights model. Actually doing the entire process from scratch, from data to pretraining to posttraining to actual release, gives a lot of appreciation for anyone who does it!"

The broader open-source ecosystem has also embraced the technical integrations. Lysandre Debut, the Chief Open-Source Officer at Hugging Face, shared his enthusiasm regarding the model's optimization in his own X post: "One thing I find quite striking is how much easier accelerating models has become... We replaced the model's causal Conv1D with the `causal-conv1d` kernel. One line changed, +4% tokens per second. We then replaced its attention implementation with FlashAttention-4. Another single change, another +11%. That's a total throughput improvement of about 15%, without changing the model architecture or retraining anything."

Tiezhen Wang, an ecosystem growth expert and ex-Googler, celebrated the release as a massive win for the open-source community, listing the model's impressive specifications on X, highlighting its "975B total, 41B active" size, "Native MTP support," and the highly coveted "Apache 2.0 license."

Background: The Road to Inkling

To understand the significance of Inkling, one has to look back at the rapid trajectory of Thinking Machines over the past 18 months.

When Mira Murati departed OpenAI in late 2024 to found Thinking Machines alongside industry veterans like John Schulman and Barret Zoph, the stated goal was to pivot away from building isolated autonomous agents. Instead, the company aimed to build flexible, multimodal systems designed for genuine human-AI collaboration and open science.

By July 2025, the startup had secured a historic $2 billion seed round led by Andreessen Horowitz at a $12 billion valuation. At the time, Murati promised the impending release of a product with a "significant open source component" to empower researchers and startups.

The company’s philosophy began coming into sharper focus in October 2025 with the launch of Tinker, a Python-based API for large language model fine-tuning that gave researchers granular control over training pipelines without the friction of distributed compute management.

That same month, Thinking Machines researcher Rafael Rafailov delivered a provocative critique of the AI industry at TED AI. He argued that the current trajectory of simply throwing more compute at models was fundamentally flawed, noting that today's systems take shortcuts—like wrapping code in try/except blocks—because they are trained strictly for task completion rather than genuine learning.

Rafailov posited that the first artificial superintelligence would not be a "god model," but rather a "superhuman learner" capable of meta-learning and internalizing abstractions. Inkling’s architecture—specifically its controllable thinking effort and its ability to organically compress its chain of thought during RL—feels like the first tangible realization of Rafailov's thesis.

In May 2026, the lab teased its technical prowess with the research preview of TML-Interaction-Small, a system that eliminated "turn-based" chat by processing inputs and outputs simultaneously in 200ms chunks. This "full-duplex" breakthrough proved the company could build highly responsive, natively multimodal models from scratch.

Now, with Inkling out in the wild, Thinking Machines has delivered on its foundational promises. By offering a massive, natively multimodal model under a true open-source license, they aren't just giving developers a new tool—they are attempting to fundamentally rewrite the economics and accessibility of frontier AI development.

As Bloomberg reports, Apple has increased its monthly and annual AppleCare+ rates for new Mac and iPad customers. Here are the details.

While macOS is generally very stable, there are times when an app will crash and your Mac will offer to send a diagnostic report to Apple.

A new form of Mac malware has been discovered, which creates fake versions of this form, requesting your Mac password as part of the data collection. If you comply, it will get access to a huge range of personal data, including your password managers and cryptocurrency wallets …

Important

This release applies to self-hosted deployments. Cloud web remains on the previous stable release, and the Cloud Desktop App release is deferred, while the personal-workspace data-loss issue (#6483) is being addressed.

This patch release resolves a Desktop App login loop when signing in to self-hosted instances, adds support for running containers under arbitrary non-root user IDs, and enables response-cookie capture for Agent-routed requests, alongside a lighter JSON response renderer.

What's Changed

• feat: allow containers to run with arbitrary non-root UIDs by @mirarifhasan in #6481
• fix: desktop login loop caused by empty auth cookies by @CuriousCorrelation in #6502
• fix: bump relay for agent response-cookie capture and pin fork revisions by @CuriousCorrelation in #6496
• fix(common): lazy-load jq-wasm in the JSON lens renderer by @hassams in #6463

New Contributors

• @hassams made their first contribution in #6463

Full Changelog: 2026.6.0...2026.6.1

Apple just released a MacBook Pro update in March, but there’s more coming soon. Apple is expected to debut one of its biggest MacBook Pro updates ever as soon as later this year. Here’s everything we know so far … including details on a surprising recent twist.

• fix(core): enrich shared project quota limit errors with setup hint by @amelidev in #28391
• fix(a2a-server): ensure task cancellation aborts execution loop by @luisfelipe-alt in #28316
• fix(core): simplify plan mode write policy to support relative paths by @DavidAPierce in #28398
• feat(core): Bump node google-auth-library version to 10.9.0 by @jerrylin3321 in #28385

Full Changelog: v0.52.0-nightly.20260713.gf354eebaf...v0.52.0-nightly.20260714.gfa975395b

The answer is no.

This is a genuine IBM Quantum System One, housed within a sophisticated dilution refrigerator designed to keep its superconducting quantum processor at temperatures only a fraction of a degree above absolute zero.

The striking gold structure that catches everyone's attention is not the quantum processor itself. The processor is tiny compared with the surrounding equipment and sits deep inside the system. Much of what you can see exists to cool, control and protect the processor from heat, vibration and electrical interference.

It is a fascinating sight and well worth stopping to admire when passing through Waterloo.

More Than a Display

What many people do not realise is that IBM's quantum technology is not simply something to observe through glass.

Through the IBM Quantum Platform, researchers, developers, students and organisations can access IBM quantum computers remotely through the cloud.

IBM currently offers access to quantum processing units, or QPUs, alongside documentation, tutorials, learning resources and software tools. Its platform also provides a limited amount of free execution time, allowing users to experiment with real quantum hardware rather than relying only on simulators.

Developers can create and execute quantum circuits using Qiskit, IBM's open-source software development kit for quantum computing.

For developers, the basic installation begins with:

pip install qiskit
pip install qiskit-ibm-runtime

The IBM Quantum Platform includes resources covering quantum information science, optimisation, Hamiltonian simulation and machine learning. It also offers tools such as Composer, which allows users to construct and run quantum circuits visually.

Quantum computing is no longer confined entirely to specialist laboratories. Developers and researchers can already gain practical experience with real quantum hardware.

Why Does a Quantum Computer Need to Be So Cold?

IBM's systems use superconducting qubits, which are extremely sensitive to their surroundings.

At ordinary temperatures, heat and electrical noise would disrupt the fragile quantum states needed for computation. The dilution refrigerator therefore cools the processor through several stages until it reaches temperatures close to absolute zero.

This extremely controlled environment allows the qubits to retain their quantum properties long enough for calculations to be performed.

It is an extraordinary feat of engineering.

Will Quantum Computers Break Today's Encryption?

This is the question cybersecurity professionals hear most often.

Not today.

Current quantum computers do not have the scale, reliability or fault tolerance required to break the public key cryptography used across banking, virtual private networks, digital certificates, software signing and secure communications.

However, a sufficiently powerful and fault-tolerant quantum computer could theoretically use Shor's algorithm to undermine widely used public key algorithms, including:

• RSA
• Elliptic Curve Cryptography, or ECC
• Diffie-Hellman key exchange
• Elliptic Curve Diffie-Hellman

That does not mean organisations should panic. It does mean they should begin preparing before such capability exists.

Post-Quantum Cryptography Is Already Here

The transition towards quantum-resistant cryptography is already under way.

In August 2024, the U.S. National Institute of Standards and Technology published its first three finalised Post-Quantum Cryptography standards.

• FIPS 203: ML-KEM for establishing shared secret keys.
• FIPS 204: ML-DSA for digital signatures.
• FIPS 205: SLH-DSA for stateless hash-based digital signatures.

These standards give governments, technology providers and organisations a foundation for moving towards cryptographic methods designed to resist both conventional and quantum-enabled attacks.

The Risk Is Not Only in the Future

One important concern is sometimes described as harvest now, decrypt later.

An attacker may collect encrypted information today in the hope of decrypting it in the future, once more capable quantum technology becomes available.

This matters most where information must remain confidential for many years, such as:

• Government and defence information
• Intellectual property and trade secrets
• Long-term commercial agreements
• Personal, medical or financial records
• Critical infrastructure designs
• Authentication and identity information

The urgency of Post-Quantum Cryptography (PQC) planning should therefore be based not only on when a cryptographically relevant quantum computer may arrive, but also on how long an organisation's data must remain protected.

What Should Organisations Be Doing Today?

For most organisations, the first challenge is not selecting a new algorithm. It is understanding where cryptography is already being used.

Cryptographic dependencies may be embedded within applications, network protocols, certificates, hardware, cloud services, APIs, supplier products and legacy systems.

You cannot migrate what you have not identified.

1. Build a cryptographic inventory

Identify where encryption, digital signatures, certificates, key exchange mechanisms and cryptographic libraries are used.

The inventory should cover:

• Applications and databases
• Web services and APIs
• TLS certificates
• VPNs and remote-access technologies
• Identity and authentication platforms
• Code-signing and software-update processes
• Hardware security modules
• Cloud services
• Third-party and supplier solutions
• Operational technology and embedded devices

2. Identify quantum-vulnerable algorithms

Determine where RSA, ECC, Diffie-Hellman and related public key algorithms are used.

Do not assume that a certificate-management database alone provides a complete view. Cryptography may also be hard-coded into applications, libraries, firmware and external services.

3. Map cryptography to business services

A technical inventory is useful, but it becomes more valuable when linked to critical business services.

Organisations should understand:

• Which important services depend on vulnerable cryptography
• What information those services protect
• How long that information must remain confidential
• What would happen if the cryptography could no longer be trusted
• Which suppliers or platforms must be upgraded first

4. Design for cryptographic agility

Cryptographic agility is the ability to replace algorithms, protocols, certificates and keys without rebuilding an entire system.

New systems should avoid unnecessary dependencies on a single algorithm or cryptographic implementation. Cryptographic choices should be configurable, documented and capable of being updated as standards and threats evolve.

5. Engage suppliers

Organisations depend heavily on software vendors, cloud providers, network suppliers and managed service providers.

Useful questions include:

• Where does your product use RSA, ECC or Diffie-Hellman?
• Do you maintain a cryptographic bill of materials?
• What is your roadmap for supporting NIST PQC standards?
• Will customers need new hardware or software?
• Will hybrid classical and post-quantum modes be supported?
• How will certificates, keys and protocols be migrated?
• What testing has been completed for performance and interoperability?

6. Test before large-scale migration

Post-quantum algorithms can have different key sizes, signature sizes, processing requirements and network implications.

Organisations should test their effect on applications, protocols, devices and infrastructure before committing to widespread deployment.

7. Establish governance and ownership

PQC migration is not solely a security engineering problem. It may require coordination across:

• Cybersecurity
• Enterprise architecture
• Infrastructure and cloud teams
• Application development
• Procurement
• Legal and privacy teams
• Risk and compliance
• Business service owners

Clear ownership, funding, milestones and reporting will be essential for what is likely to become a multi-year transformation programme.

A Practical Post-Quantum Cryptography Roadmap

A proportionate roadmap could follow four stages.

Discover

• Build the cryptographic inventory
• Identify vulnerable algorithms
• Map dependencies to critical services
• Assess long-term confidentiality requirements

Prioritise

• Rank systems by business criticality and data sensitivity
• Identify difficult-to-replace legacy technology
• Assess supplier readiness
• Determine where harvest-now-decrypt-later risk is greatest

Prepare

• Introduce cryptographic agility requirements
• Update procurement and architecture standards
• Establish governance and ownership
• Begin laboratory testing and controlled pilots

Migrate and validate

• Deploy approved algorithms using a risk-based sequence
• Validate interoperability and performance
• Retire vulnerable cryptographic dependencies
• Collect evidence that migration has been completed successfully

Final Thoughts

Standing in front of IBM Quantum System One was a fascinating reminder that the future often arrives quietly.

Today's immediate cybersecurity priorities remain ransomware, identity compromise, supply chain risk, exposed services and weak security controls. Quantum computing does not replace those priorities.

However, responsible security leadership also means recognising risks that require years of preparation.

Quantum computing is no longer confined entirely to theoretical research. Developers and researchers can already access real quantum processors through services such as the IBM Quantum Platform.

That does not mean organisations need to rush into an uncontrolled migration. It means they should begin understanding their exposure, improving cryptographic agility and establishing a structured roadmap.

The organisations that start mapping their cryptographic landscape today will be better prepared when quantum-safe migration becomes a business requirement rather than a future consideration.

Useful Resources

• IBM Quantum Platform
• IBM Quantum
• NIST Post-Quantum Cryptography Project
• NIST FIPS 203: ML-KEM
• NIST FIPS 204: ML-DSA
• NIST FIPS 205: SLH-DSA

• I tested 42 pairs of wireless earbuds to find the best in US

• Sign up for the Filter US newsletter, your weekly guide to buying fewer, better things

In a feat of engineering that borders on magic, the best wireless earbuds can silence the noisy world around you at the tap of a finger. So, why would you buy open earbuds, which are specifically designed to let in environmental sounds?

Frankly, I didn’t understand the appeal of them either until I started testing them, and now I use open earbuds even more than my noise-cancelling earbuds. For situations from hiking to running errands, these are the headphones you should be wearing. Here’s what you’re missing out on, and a few of the best pairs to try.

Best overall open-ear earbuds:
Soundcore Aeroclip Open-Ear Earbuds

Best premium open-ear earbuds:
Bose Ultra Open Earbuds

Apple has already launched three new MacBooks this year, but one more model rumored for this fall—MacBook Ultra—could make for Apple’s largest lineup of MacBooks ever.

Apple’s plans for new high-end MacBooks are coming into focus after recent Bloomberg reports, with a MacBook Ultra and new M6 MacBook Pro both now expected to launch this fall.

As a child, I was so fond of reading what I saw as beautiful. Even when above [lacking] the understanding.

The perception of beauty came mainly from the cover and the fonts used ( same today ) or from the place the book occupied on my father’s shelf.

One of them was Tuareg. More than once I took this classic from the home library, only to glance at the first page with no interest. It was only decades later — some years ago — that I saw the title again, and read with pleasure and no difficulties. It’s not a hard read, even to a 12 year-old, probably only the argument, the plot, didn’t catch me by then.

Anyway, I was attracted to the book, as if simply wanting to read it made me part of the classic, the intellectual.

I have less of this today. [I mean,] Not the inability to read a lot of books, but the urge to be a consumer of certain cultural product. Maybe due to not greeding to build a personal image, content without exposition.

Still, sometimes, wanting to consume a piece of media and being unable to.. I wanted a story of robots, the book I though was not available [(All Systems Red)], so I bought one of scientific fiction.

Somehow it attracted me when I flipped the few pages of Planet of Exile at the bookstore, an item that could lead me to a travel outside of this place, an escape. At home, I immediately saw I couldn’t grasp it. There were too many characters (too many = more than two in the first page, specially when another atmosphere is the location, a new physics to grasp). Too much information, can’t retain the minimum necessary in the way to the second, third… fifth page, by when more is being presented. This was always a disability of mine, focused on a little tiny thing, intensely, for some time, all lost in some weeks or months. I know it happens to me , because people are able to remember the names of the cars of the movie Cars. Not an incredible feat for them (maybe they haven’t paid attention, nor actively tried to remember, only did), and something strange to me.

It was decided to register this because when I saw myself unable to read the [Ursula] Le Guin’s book, I got nervous. I’ve already been forgetting more ultimately, take confused steps, and now I can’t center on a book?! What’s happening?

But then I took a breath: much can be going way too wrong from current circumstances outside and inside, but your limited comprehension of the world (and its art) is very part of you. This trace, or frailty, of your character, is not your brain rotting, it’s part of what you have been since always.

Thank you.

Provide feedback on this episode.

According to the latest Power On newsletter from Mark Gurman, Apple is preparing to include up to 1.5TB of RAM in the upcoming M7 Ultra chip. This’ll mean Apple Silicon will finally match the highest RAM configuration available on the highest end 2019 Intel Mac Pro.

The product is powered by OpenAI's latest flagship model, GPT-5.6, and is designed to go far beyond generating text. ChatGPT Work can gather context from connected apps, files, and workflows to produce finished documents, spreadsheets, presentations, reports, and websites. The agent takes a stated outcome, breaks it into smaller steps, and stays with complex projects for hours, completing them independently.

The launch marks OpenAI's clearest attempt yet to reposition ChatGPT as a workplace platform rather than a chatbot — and it arrives at a moment of extraordinary financial significance for the company. Last month, OpenAI confidentially submitted a draft S-1 registration statement to the SEC, initiating what could become one of the largest technology IPOs in history, with reported valuations clustering between $730 billion and $852 billion and annualized revenue that has blown past $25 billion.

In a short demonstration and conversation with VentureBeat on Friday, Ty Geri, a product manager at OpenAI who helped build ChatGPT Work, said the product's mission is to democratize the kind of agentic AI capabilities that OpenAI's internal engineering tool, Codex, has already demonstrated. "What's really exciting is we've seen how much Codex has been able to push the frontier of what we can get done with these AI tools, as opposed to just getting information or answers or guidance," Geri said. "Our internal adoption of Codex is literally an exponential curve across every single product function and every single use case."

Why OpenAI built a persistent virtual machine that works from the beach

The core architectural bet behind ChatGPT Work is a persistent cloud-based virtual machine that runs on OpenAI's servers, always available to the user regardless of which device they happen to be on. That marks a deliberate departure from competitors whose agents require a local machine to remain powered on and connected.

"What's really exciting about ChatGPT Work is that it's a virtual machine in the cloud that's always on for you, and this is available across all of our paid tiers," Geri said. "All Plus users are getting this. I think that's a very unique aspect of this."

The mobile-first aspect of the launch is something Geri described as "missing from the market." He pointed to the ability to create a website on a phone and share it with collaborators as a particularly novel capability. "Sites are new in general to Codex. They launched in Codex about a week and a half ago, but now we're launching also in web and mobile. You can create a site on your phone at the beach and share it with your friends," he said.

ChatGPT Work will roll out beginning with Pro, Enterprise, and Edu users, and will expand to Plus and Business users over the next few days. In the interview, Geri emphasized that the availability of the product to Plus subscribers — not just premium tiers — is central to OpenAI's strategy. "It's accessible to all paid plans, including Plus users, which in my opinion is a really big feat, and really part of that OpenAI mission, which is about bringing all this power to as many people," he said.

How MCP plugins connect ChatGPT Work to Slack, Gmail, and GitHub

The product relies on MCP-based plugins to connect to external services like Gmail, Google Calendar, Slack, and GitHub. When asked whether the plugin architecture is based on the Model Context Protocol standard, Geri confirmed: "These are all based on MCP." He added that connecting multiple Gmail accounts — a frequent user request — "is definitely on the roadmap."

The experience is designed to be action-oriented from the first interaction. ChatGPT Work offers a personalized onboarding flow that surfaces different suggested use cases depending on the user's role. Geri demonstrated how the system, detecting his role as a product manager, immediately suggested tasks like evaluating AI systems, building research artifacts, and managing his calendar. "You can start with a simple task like catch me up on Slack or Teams or read today's calendar," Geri said. He described a scenario where the system reviewed his calendar, identified scheduling conflicts, flagged meetings requiring preparation, and then — on his instruction — declined, accepted, or rescheduled events directly.

Users can also customize the agent by teaching it their writing style, organizing outputs into projects, and — in a lighter touch — choosing a virtual pet that accompanies them in the interface. The interface also introduces a hosted website feature that allows users to build and share interactive sites directly through ChatGPT Work, turning what would typically be a static slide deck into a dynamic, collaborative artifact. "Now we suddenly have a collaborative interface that's actually more exciting and more accessible than a slide deck, which has all these formatting restrictions," Geri said.

Scheduling 10 bug bashes at once: what agentic productivity looks like in practice

Geri's own usage of ChatGPT Work illustrates the breadth of tasks the system can handle. In the run-up to the product's launch, he needed to organize pre-release testing sessions — known internally as "bug bashes" — across dozens of features and team members.

"I just come to ChatGPT Work and say, 'Set up a bug bash for all the distinct features in ChatGPT Work. Add all the people that worked on that feature,' and it can check Slack, it can check GitHub, it can check Docs, and find a time that works for the four highest contributors to that feature," Geri said. "It went and scheduled 10 bug bashes, all coordinated across all those different people. That would have taken me 30 minutes at least."

But Geri pushed back against the characterization that ChatGPT Work is limited to rote administrative work. He described using it for analytically complex tasks like identifying the biggest causes of user churn for specific product features and generating product solutions — work he said would previously have taken months. "Things that we would have spent three months doing, we can now spend a week doing — and do much more, and make a much better product," Geri said. "Bugs that we would have found three or four weeks from now, we can now find within two days and fix for our users."

He also described handing off the tedium of product testing itself. "It used to be that even though like the most interesting part of my job is like what to test, I would actually end up having to spend most of my job doing the testing, which is like me taking a mouse and like clicking on the same thing over and over again, like five times," Geri said. "Instead, now I can define what do we want to test, and ChatGPT Work or Codex can actually go test it for me, deliver me that bug report, and then we can work on fixing that bug."

What OpenAI says about data privacy when AI reads your Slack and email

When pressed on data privacy concerns — given that ChatGPT Work pulls sensitive information from workplace tools like Slack, Google Drive, and email — Geri said privacy "is incredibly important, and the most important part of this is it's always in the user's control."

He pointed to OpenAI's existing enterprise security infrastructure, noting that "enterprise accounts have ZDR, and users can always opt out of letting their conversations help improve future models, which many users do." The comment aligns with assurances OpenAI made when it first launched ChatGPT Enterprise in August 2023, when the company wrote in a blog post that it does "not train on your business data or conversations."

The privacy question carries additional weight now because of the sheer volume of sensitive workplace data ChatGPT Work is designed to access. Unlike a chatbot session where a user voluntarily pastes text into a prompt, ChatGPT Work actively reaches into connected systems — reading Slack messages, scanning calendar invitations, pulling GitHub commit histories — to assemble context for its tasks. That represents a fundamentally different data surface area than anything OpenAI has offered before, and one that enterprise security teams will scrutinize carefully before granting access.

ChatGPT Work enters a three-way arms race with Anthropic and Microsoft

ChatGPT Work lands squarely in the middle of what has become the defining competitive battlefield in enterprise AI: the race to build autonomous workplace agents that can go beyond generating text and actually execute tasks.

The product arrives months after Anthropic took Claude Cowork out of preview and into general availability in April, bringing its AI agent to web and mobile platforms aimed at helping enterprise users monitor and manage long-running AI-driven tasks from anywhere. Meanwhile, Microsoft made Copilot Cowork generally available worldwide on June 16, built in partnership with Anthropic to move beyond chat and into execution. The three products — ChatGPT Work, Claude Cowork, and Microsoft Copilot Cowork — now compete directly for the attention of enterprise IT departments and individual knowledge workers alike.

The convergence is striking. All three products share a remarkably similar vision: a persistent AI agent running in the cloud that can break complex tasks into steps, connect to workplace tools via plugins, and produce finished outputs rather than just conversational replies. All three work across desktop, web, and mobile.

What distinguishes OpenAI's approach is its raw consumer distribution advantage. ChatGPT has reached 900 million weekly active users, and OpenAI now has 50 million paying subscribers. More than 9 million paying business users rely on ChatGPT for work, and 92% of Fortune 500 companies now use ChatGPT. By making ChatGPT Work available to Plus subscribers at $20 a month — not just Enterprise or Pro customers — OpenAI is betting that broad accessibility will drive adoption faster than any competitor can match.

OpenAI's product manager says AI is a partner, not a replacement — with a caveat

When asked about the potential impact on the labor market, Geri was careful with his framing. He declined to speak broadly about workforce disruption but offered his personal experience as a product manager whose day-to-day work has been substantially reshaped by the tool.

"My job is not to schedule bug bashes and find out who contributed to a specific feature. That's a task I do in my job, but that's not my job," Geri said. "My job is to make an amazing product." He described ChatGPT Work as "a partner" and "an extension of me, certainly not a replacement," adding: "Everybody feels far more productive than before, but is also almost working harder than before, because you get to work on all the things you want to work on as opposed to the drudgery around it."

But Geri was also careful not to minimize the sophistication of the work the agent can handle. "I also don't want to say that it's only doing mundane tasks because, like something like hill climbing retention curves on a given feature is not mundane. It's actually really hard to do," he said. The distinction matters. If ChatGPT Work were merely automating calendar invitations and expense reports, it would be a convenience tool. The fact that Geri describes it compressing three months of analytical product work into a single week suggests something with far greater implications for how teams are structured and staffed.

An IPO-bound company needs ChatGPT Work to prove enterprise AI can generate revenue

The timing of ChatGPT Work's launch is impossible to separate from OpenAI's IPO trajectory. The company needs to demonstrate that it can convert its massive consumer user base into durable enterprise revenue — a narrative that becomes significantly more compelling with a product explicitly designed around professional workflows.

OpenAI said it is generating $2 billion in revenue per month, growing four times faster than Alphabet and Meta did at comparable stages, with enterprise now making up more than 40% of revenue and on track to reach parity with consumer by the end of 2026. But OpenAI remains heavily loss-making, and the company does not expect to reach profitability until around 2030, with internal projections suggesting losses of $14 billion in 2026 alone.

The competitive dynamics are unprecedented. Anthropic filed for its own IPO on June 1 at a $965 billion valuation, setting up simultaneous public listings from the two most prominent AI startups in history. Whether both can sustain their lofty valuations under the scrutiny of public market investors will depend in large part on whether products like ChatGPT Work and Claude Cowork deliver measurable productivity gains to paying enterprise customers.

The launch also caps a product trajectory that began with ChatGPT Enterprise in August 2023, accelerated through the release of OpenAI's Operator agent in January 2025, and continued through Operator's deprecation and shutdown on August 31, 2025, when its capabilities were folded into the ChatGPT agent framework. ChatGPT Work is the consolidation of those efforts into a single, unified product — one that pairs GPT-5.6's three model variants (Sol for power, Luna for speed, and Terra for balanced everyday use) with a persistent cloud environment and an expanding library of MCP plugins.

The future of work may already be running in the cloud

When asked whether ChatGPT Work signals a shift toward a new kind of operating system — one where users interact with their computers primarily through an AI agent rather than through traditional mouse-and-keyboard interfaces — Geri stopped short of making sweeping predictions. But he hinted at the direction OpenAI sees ahead.

"Anybody who has worked with Codex or now ChatGPT Work will realize how exciting it is to interact with your environment and your computer via the agent," he said. "Especially in the desktop app, where the model has access to your entire machine and can interact with websites on your behalf — it's really able to be an extension of you and a real partner, and that certainly feels like the future."

At the end of the interview, Geri circled back to something personal. "I've never enjoyed work as much as I have in the last month using ChatGPT Work and Codex," he said — a striking admission from a product manager who, until recently, spent a meaningful share of his days clicking through the same interface five times in a row just to see if it would break. OpenAI is now asking 900 million users to believe that feeling scales. For a company weeks away from one of the largest public offerings in history, the answer to that question is worth roughly $850 billion.

OpenAI is pulling the plug on its dedicated web browser, ChatGPT Atlas. Instead of investing in an AI browser with a small user base, the company is improving agentic web use features inside the new ChatGPT desktop app.

While ChatGPT Atlas may not have gained much traction, AI browsers can be useful for automating tasks like research, browser tidiness, and more. Here are options available on the Mac.

• fix(core): strip thoughts from scrubbed history turns and resolve thought leakage by @amelidev in #27971
• Refactor: exclude transient CI configuration files from workspace context by @DavidAPierce in #28216
• feat(caretaker-triage): add triage worker core foundational modules by @chadd28 in #28163
• feat(caretaker-egress): implement octokit github action handler for egress service by @chadd28 in #28303
• chore(release): bump version to 0.52.0-nightly.20260707.g27a3da3e8 by @gemini-cli-robot in #28323
• Changelog for v0.51.0-preview.0 by @gemini-cli-robot in #28320
• Changelog for v0.50.0 by @gemini-cli-robot in #28322
• fix(core-tools): bypass LLM correction for JSON and IPYNB files in write_file and replace by @amelidev in #28223
• fix(core): use unambiguous previous intent label in fallback summary by @amelidev in #28343
• feat(caretaker-triage): implement main worker execution loop and egress action publisher by @chadd28 in #28306

Full Changelog: v0.51.0-nightly.20260707.g15a9429b6...v0.52.0-nightly.20260710.ga4c91ce19

• feat: add OpenRouter detector by @McPatate in #4500
• Integrations fully codeowns detectors by @trufflesteeeve in #5104
• [INS-332] Add New Relic Insights Insert key detector by @mustansir14 in #4778
• [INS-351] Added Duffel Token Detector by @MuneebUllahKhan222 in #4795
• [INS-341] Added Shippo detector by @MuneebUllahKhan222 in #4820
• [INS-467] Add IPinfo detector to default detectors list by @mustansir14 in #4970
• fix: reject --include-repos/--exclude-repos with --repo in github scan by @kashifkhan0771 in #5112
• [INS-468] Add improved lob detector to defaults.go by @mustansir14 in #4971
• feat(action): add image input to allow registry mirror overrides by @eightseventhreethree in #4965
• feat: Support archived repo exclusion from GH org scans by @hibare in #4875
• [INT-715] Retry transient failures when verifying OpenAI keys by @bill-rich in #5117
• [INS-410] Added batch token detector by @MuneebUllahKhan222 in #4824
• [INT-650] Don't log as error when git diff is too long by @bill-rich in #5113

New Contributors

• @McPatate made their first contribution in #4500
• @eightseventhreethree made their first contribution in #4965

Full Changelog: v3.95.8...v3.95.9

Highlights:

• [Florian Quèze] Add “/” and “f” keyboard shortcuts to focus the panel filter box (#6025)
• [Markus Stange] Change profile.shared.stackTable.prefix to prefixOffset (delta from current index) (#6089)
• [Markus Stange] Implement column sorting in the marker table (#6083)
• [cathaysia] feat: invert call stack in flame graph to render as icicle graph (#6090)

Other Changes:

• [Sky Ning] Add workflow to insert PR preview links (#6133)
• [Markus Stange] Make it easier to create upside-down flame graphs (#6128)
• [Markus Stange] Use appropriate highlighter dialects for ts + jsx (#6141)
• [cathaysia] style: add .editorconfig (#6142)
• [Nazım Can Altınova] Prevent long source URLs from overflowing the code error overlay (#6147)
• [Nazım Can Altınova] Extract a runCommand helper for profiler-cli command handlers (#6148)
• [cathaysia] feat(theme): add color-scheme meta (#6150)
• [Nazım Can Altınova] Add an early throw for the this.querier and remove the non-null asserts in the cli codebase (#6145)
• [skylarkning] Improve preview link discovery (#6149)
• [Nazım Can Altınova] Sync: l10n → main (July 9, 2026) (#6155)

Big thanks to our amazing localizers for making this release possible:

• de: Michael Köhler
• el: Jim Spentzos
• en-GB: Ian Neal
• es-CL: ravmn
• fr: Théo Chevalier
• fy-NL: Fjoerfoks
• ia: Melo46
• it: Francesco Lodolo [:flod]
• nl: Fjoerfoks
• ru: Valery Ledovskoy
• tr: Nazım Can Altınova
• zh-TW: Pin-guang Chen

Find out more about the Firefox Profiler on profiler.firefox.com! If you have any questions, join the discussion on our Matrix channel!

1 post - 1 participant

Read full topic

This Week in Rust is openly developed on GitHub and archives can be viewed at this-week-in-rust.org. If you find any errors in this week's issue, please submit a PR.

Want TWIR in your inbox? Subscribe here.

Updates from Rust Community

Official

• Maintainer spotlight: Gen Li (@rami3l)
• Together for a healthier Clippy

Newsletters

• The Embedded Rustacean Issue #75

Project/Tooling Updates

• copper-rs v1.0.0: the open source deterministic robotics OS is now stable.
• Rayfish: Your own private network. No servers, no setup.
• rama v0.3.0 — network service framework ready to be used by the wider Rust community
• kache 0.9.0: supply-chain hardening + read-only CI cache
• GuardianDB - PostgreSQL and P2P/Local-First Together
• Nectar: a Rust-like language that compiles your whole web app to WebAssembly
• logdrain: Fast, Embeddable Log-Template Mining in Rust
• sheathe: Packaging the World's Video in Pure Rust
• wickra: streaming-first technical indicators
• Xcelerator Solver v0.1.0 -- deterministic symbolic regression
• dlt-tui 1.1.0 - a fast TUI viewer for automotive DLT (AUTOSAR Diagnostic Log and Trace) files
• RSSH v0.2.11 — terminal workflows, safer SSH key import, and observable AI ops
• k8s-scale-app-rs: Scale or Restart a Kubernetes Deployment from a CronJob
• M-vis v0.5.0-rc1 update
• FlareDB: An Apache Beam Native Streaming Database built in Rust
• mqtt-typed-client 0.2: a type-safe async MQTT client on rumqttc
• RootAsRole: v4.0.0 Major release, secure execution, new logo
• A Cross-Platform Rust UI Framework via Qt’s Bridging Technology
• Jam Programming Language
• Sōzu 2.1.0: UDP load balancing for the programmable edge
• b0nker: a minimal container runtime written in Rust

Observations/Thoughts

• [video] Rust Berlin Meetup 25/06/2026 Livestream
• [video] How do you rewrite C/C++ projects to Rust? – JetBrains interview with Luca Palmieri, Mainmatter
• Investigating why RustCrypto is slow: Deep dive into SIMD instructions and hardware acceleration
• bool as u32
• A Rust-to-Lean Verification Pipeline with AI Provers: An Experience Report
• Work In Progress Rust
• [video] OpenAI just spent $600k on Rust
• [audio] Rising Academies with Dylan Brown - Rust in Production Podcast

Rust Walkthroughs

• [series] Bevy Tutorial: Build Your First 3D Editor - Create a 3D Space on an Infinite Grid
• Learn Axum Basics and Routing by Building a URL Shortener
• [series] Rama 101.1: HTTPS clients and layers of abstraction

Miscellaneous

• Clickable euler diagram of all the Rust week talks

Crate of the Week

This week's crate is apis-saltans, a Zigbee implementation including a coordinator API.

Thanks to Richard Neumann for the self-suggestion!

Please submit your suggestions and votes for next week!

Calls for Testing

An important step for RFC implementation is for people to experiment with the implementation and give feedback, especially before stabilization.

If you are a feature implementer and would like your RFC to appear in this list, add a call-for-testing label to your RFC along with a comment providing testing instructions and/or guidance on which aspect(s) of the feature need testing.

No calls for testing were issued this week by Rust, Cargo, Rustup or Rust language RFCs.

Let us know if you would like your feature to be tracked as a part of this list.

Call for Participation; projects and speakers

CFP - Projects

Always wanted to contribute to open-source projects but did not know where to start? Every week we highlight some tasks from the Rust community for you to pick and get started!

Some of these tasks may also have mentors available, visit the task page for more information.

* Protocol - Extend bit-exactness tests to f64 reconstruction targets
* Dofigen - No image tag replacement flag for the generate command

If you are a Rust project owner and are looking for contributors, please submit tasks here or through a PR to TWiR or by reaching out on Bluesky or Mastodon!

CFP - Events

Are you a new or experienced speaker looking for a place to share something cool? This section highlights events that are being planned and are accepting submissions to join their event as a speaker.

If you are an event organizer hoping to expand the reach of your event, please submit a link to the website through a PR to TWiR or by reaching out on Bluesky or Mastodon!

Updates from the Rust Project

598 pull requests were merged in the last week

Compiler

• enable eager param_env norm in new solver
• lint on core::ffi::c_void as a return type
• polish some macro parsing code
• resolve: no allocation in resolve_ident_in(_local)_module_*
• simplify option-iterator flattening in the compiler
• stabilize #[my_macro] mod foo; (part of proc_macro_hygiene)

Library

• add std::io::cursor::WriteThroughCursor
• implement Box::as_non_null()
• implement DoubleEndedIterator::next_chunk_back
• implement IntoIterator for [&[mut]] Box<[T; N], A>
• implement ptr::{read,write}_unaligned via repr(packed)
• move SizeHint and IoHandle to core::io
• move std::io::Seek to core::io
• optimize ArrayChunks::try_rfold with DoubleEndedIterator::next_chunk_back
• stabilize feature(atomic_from_mut)

Cargo

• bindeps: register transitive artifact targets
• avoid cloning parsed TOML manifest in ManifestErrorContext
• avoid extra clone of parsed TOML manifest
• remove unneeded cloning when parsing package index
• change HashMaps and HashSets in Cargo to use Fxhasher
• do not pass lint rustflags when --cap-lints=allow is set
• fixed Compilation::deps_output only taking the last dep
• pre-allocate a few vectors
• stabilize build-dir layout v2
• use a set when checking visited workspace members

Rustdoc

• fix crash when trying to inline foreign item which cannot have attributes
• show use-site paths for unevaluated const array lengths

Clippy

• chunks_exact_to_as_chunks: Don't report expressions with const parameters
• chunks_exact_to_as_chunks: Don't report expressions with type params
• missing_trait_methods: MSRV/unstable awareness
• vec_init_then_push: don't lint pushes from a macro expansion
• inline_modules: ignore cfg(test) modules in test builds
• match_same_arms: keep arm-level expectations working under an outer allow
• unnecessary_operation: avoid bad ! suggestions
• unnecessary_unwrap_unchecked: don't trigger inside the _unchecked fn
• add required parentheses when the needless_bool suggestion is an operand
• fix ICE when resolving local in unnecessary_unwrap_unchecked
• fix infinite_loop false positive inside gen blocks
• fix manual_c_str_literals suggestion when the trailing backslash is escaped
• fix strlen_on_c_strings incorrect suggestion logic
• fix suspicious_operation_groupings duplications
• lint bit width
• optimize Msrv::meets calls
• bail out of unicode lint scans when the snippet is pure ASCII
• skip the HIR parent walk in is_in_test_function when there are no test items
• place generated impl block after the existing impl block
• refactor StringAdd lint pass
• refactor suspicious_xor_used_as_pow
• remove lower_ty in uninhabited_reference
• respect the configured MSRV in manual_is_variant_and's map() == Some(_) rewrite
• rewrite mut_mut
• rewrite redundant_else as a late pass
• rewrite tuple_array_conversions

Rust-Analyzer

• SCIP: exclude leading/trailing trivia in definition ranges
• SCIP: remove dead inlay_hints field
• feat(ide-diagnostics): add diagnostics for invalid union patterns (E0784)
• internal(query-group-macro): remove the arity test
• add tree top method to Syntax node
• add handler for E0627
• supports multi arms for replace_match_with_if_let
• fix UB in smol_str borsh_non_utf8 test cases
• fix generic param for generate_default_from_enum_variant
• walkthrough_create_project file not packaged
• assertion failure on closure with unbound function
• avoid panic in convert_tuple_struct_to_named_struct on nested pattern usage
• configuration syntax for nvim-lsp
• correct resolution to value when it shares the same name with type
• exclude impls on the error type from impl enumeration
• fix crash on extract_variable when selecting unresolved macro call
• fix crash on completion inside macros
• fix handling of params of coroutine fns
• handle more cases of cfgs in expr store lowering
• no generate with default assoc item
• panics in unwrap_return_type, remove_underscore, and promote_local_to_const
• hoist attribute qualifier segment collection
• reduce parser joint-token allocation
• project-model: don't pass metadata extra args to sysroot
• project-model: introduce cargo.configPath
• provide startup time to ready log point and associated benchmark

Rust Compiler Performance Triage

This week was dominated by wild swings in benchmarks of the new-solver, which is not enabled by default, yet. Apart from that, we got a very few notable changes, only one unexpected speedup from a bugfix in rustdoc.

Triage done by @panstromek. Revision range: 7dc2c162..3659db0d

Summary:

1 Regression, 1 Improvement, 4 Mixed; 3 of them in rollups 17 artifact comparisons made in total

Full report here

Approved RFCs

Changes to Rust follow the Rust RFC (request for comments) process. These are the RFCs that were approved for implementation this week:

• No RFCs were approved this week.

Final Comment Period

Every week, the team announces the 'final comment period' for RFCs and key PRs which are reaching a decision. Express your opinions now.

Tracking Issues & PRs

• Lint against invalid POSIX symbol definitions
• Document NonNull layout guarantees
• Tracking Issue for slice_split_once

• Let the OS handle stack growth
• Add target_feature_available_at_call_site

• Empty repr(Rust) enums are ZSTs

No Items entered Final Comment Period this week for Cargo, Language Team, Leadership Council, Rust RFCs or Unsafe Code Guidelines.

New and Updated RFCs

• Update RFC template
• RFC: Store registry tokens in the OS credential store by default

Upcoming Events

Rusty Events between 2026-07-08 - 2026-08-05 🦀

Virtual

• 2026-07-08 | Virtual (Cardiff, GB) | Rust and C++ Cardiff
• Operating Systems Book Club: Introduction + Processes
• 2026-07-08 | Virtual (Girona, ES) | Rust Girona
• Sessió setmanal de codificació / Weekly coding session
• 2026-07-09 | Virtual (Nürnberg, DE) | Rust Nuremberg
• Rust Nürnberg online
• 2026-07-14 | Virtual (Dallas, TX, US) | Dallas Rust User Meetup
• Second Tuesday
• 2026-07-15 | Virtual (Girona, ES) | Rust Girona
• Sessió setmanal de codificació / Weekly coding session
• 2026-07-15 | Hybrid (Vancouver, BC, CA) | Vancouver Rust
• Jiff
• 2026-07-16 | Hybrid (Seattle, WA, US) | Seattle Rust User Group
• July, 2026 SRUG (Seattle Rust User Group) Meetup
• 2026-07-16 | Virtual (Berlin, DE) | Rust Berlin
• Rust Hack and Learn
• 2026-07-19 | Virtual (Dallas, TX, US) | Dallas Rust User Meetup
• Rust Deep Learning: Third Sunday
• 2026-07-21 | Virtual (London, UK) | Women in Rust
• Lunch & Learn: Learning Rust as First Programming Language
• 2026-07-21 | Virtual (Washington, DC, US) | Rust DC
• Mid-month Rustful
• 2026-07-22 | Virtual (Girona, ES) | Rust Girona
• Sessió setmanal de codificació / Weekly coding session
• 2026-07-28 | Virtual (Dallas, TX, US) | Dallas Rust User Meetup
• Fourth Tuesday
• 2026-07-29 | Virtual (Girona, ES) | Rust Girona
• Sessió setmanal de codificació / Weekly coding session
• 2026-07-30 | Virtual (Berlin, DE) | Rust Berlin
• Rust Hack and Learn
• 2026-08-02 | Virtual (Dallas, TX, US) | Dallas Rust User Meetup
• Rust Deep Learning: First Sunday
• 2026-08-04 | Virtual (London, GB) | Women in Rust
• 👋 Community Catch Up
• 2026-07-29 | Virtual (Girona, ES) | Rust Girona
• Sessió setmanal de codificació / Weekly coding session
• 2026-08-05 | Virtual (Indianapolis, IN, US) | Indy Rust
• Indy.rs - with Social Distancing

Asia

• 2026-07-18 | Bangalore, IN | Rust Bangalore
• July 2026 Rustacean Meetup

Africa:

• 2026-07-14 | Johannesburg, ZA | Johannesburg Rust Meetup
• Debugging a production grade Open Source Rust crate

Europe

• 2026-07-08 | Dublin, IE | Rust Dublin
• Join us live and INPERSON for Rust 262
• 2026-07-09 | Berlin, DE | Rust Berlin
• Rust Berlin on location 🏳️‍🌈 - Edition 015
• 2026-07-09 | Frankfurt, DE | Rust Rhein-Main
• Building Cross Platform Applications with Ply
• 2026-07-09 | Switzerland, CH | PostTenebrasLab
• Rust Meetup Geneva
• 2026-07-15 | Dortmund, DE | Rust Dortmund
• Teach and Hack at Projektspeicher
• 2026-07-21 | Leipzig, DE | Rust - Modern Systems Programming in Leipzig
• Supercharge Rust funcs with implicit arguments and context-generic programming
• 2026-07-23 | Berlin, DE | Rust Berlin
• Rust Berlin Talks: The next generation
• 2026-07-23 | London, UK | London Rust Project Group
• Rama modular service framework for Rust
• 2026-07-23 | Paris, FR | Rust Paris
• Rust meetup #87
• 2026-07-30 | Manchester, GB | Rust Manchester
• Rust Manchester July Code Night

North America

• 2026-07-09 | Lehi, UT, US | Utah Rust
• Utah Rust July Meetup
• 2026-07-09 | Mountain View, CA, US | Hacker Dojo
• RUST MEETUP at HACKER DOJO
• 2026-07-11 | Boston, MA, US | Boston Rust Meetup
• MIT Rust Lunch, July 11
• 2026-07-15 | Hybrid (Vancouver, BC, CA) | Vancouver Rust
• Jiff
• 2026-07-16 | Hybrid (Seattle, WA, US) | Seattle Rust User Group
• July, 2026 SRUG (Seattle Rust User Group) Meetup
• 2026-07-18 | Boston, MA, US | Boston Rust Meetup
• North End Rust Lunch, July 18
• 2026-07-21 | San Francisco, CA, US | San Francisco Rust Study Group
• Rust Hacking in Person
• 2026-07-22 | Austin, TX, US | Rust ATX
• Rust Lunch - Fareground
• 2026-07-22 | Los Angeles, CA, US | Rust Los Angeles
• Rust LA: Rust in Distributed Systems with Flight Science!
• 2026-07-25 | Boston, MA, US | Boston Rust Meetup
• Porter Square Rust Lunch, July 25
• 2026-07-25 | Brooklyn, NY, US | Flower
• BOG-A-THON 2
• 2026-07-30 | Atlanta, GA, US | Rust Atlanta
• Rust-Atl
• 2026-08-01 | Boston, MA, US | Boston Rust Meetup
• Chinatown Rust Lunch, Aug 1
• 2026-08-04 | Boston, MA, US | Boston Rust Meetup
• Evening Boston Rust Meetup at Red Hat, Aug 4

Oceania

• 2026-07-09 | Brisbane City, QL, AU | Rust Brisbane
• Rust Brisbane • July 2026
• 2026-07-21 | Barton, AU | Canberra Rust User Group
• July Meetup
• 2026-07-23 | Perth, AU | Rust Perth Meetup Group
• Rust Perth: July Meetup!
• 2026-07-30 | Melbourne, AU | Rust Melbourne
• Rust Melbourne July 2026

If you are running a Rust event please add it to the calendar to get it mentioned here. Please remember to add a link to the event too. Email the Rust Community Team for access.

Jobs

Please see the latest Who's Hiring thread on r/rust

Quote of the Week

if a ptr is dereferenced in a forest and nobody hears it, is it sound?

– Kornel on rust-users

Thanks to Cerber-Ursi for the suggestion!

Please submit quotes and vote for next week!

This Week in Rust is edited by:

• nellshamrell
• llogiq
• ericseppanen
• extrawurst
• U007D
• mariannegoldin
• bdillo
• opeolluwa
• bnchi
• KannanPalani57
• tzilist

Email list hosting is sponsored by The Rust Foundation

Discuss on r/rust

• fix/verify release npm ci ignore scripts by @rmedranollamas in #28116
• fix(ci): prevent workspace binary shadowing in release verification by @galdawave in #28132
• Feat/tool registry discovery by @ved015 in #28113
• fix(ci): prevent bad NPM releases and promote job crashes by @galdawave in #28147

Full Changelog: v0.49.0...v0.50.0

• Changelog for v0.50.0-preview.1 by @gemini-cli-robot in #28150
• Fix no_proxy test by @jerrylin3321 in #28131
• chore(release): bump version to 0.51.0-nightly.20260625.g3fbf93e26 by @gemini-cli-robot in #28151
• Vertex base url update by @DavidAPierce in #28145
• fix(security): enforce case-insensitive sensitive path blocklist and vscode hitl by @luisfelipe-alt in #27966
• fix(core-tools): resolve defensive path resolution for at-reference files and fix macOS tests by @luisfelipe-alt in #28053
• feat(caretaker): implement Cloud Run webhook ingestion service by @chadd28 in #28015
• fix(core): resolve symbolic link directory escape in memory import processor by @luisfelipe-alt in #28233
• feat(caretaker): egress cloud run service skeleton by @chadd28 in #28167
• fix(sandbox): make ~/.gitconfig read-only in the macOS sandbox by @ompatel-aiml in #28221
• fix(core): preserve escape sequences in string literals for modern models by @luisfelipe-alt in #28299
• fix(core): strip thoughts from scrubbed history turns and resolve thought leakage by @amelidev in #27971

New Contributors

• @jerrylin3321 made their first contribution in #28131

Full Changelog: v0.50.0-preview.1...v0.51.0-preview.0

Bugfixes

• Better classify Z.ai context-window overflow errors so oversized requests surface the right failure mode (@fengjikui)
• Handle unavailable config directories more gracefully when reading config files

Desktop

Improvements

• Restore model details tooltips in the model picker (@arvsrn)
• Refresh the v2 command palette to better match the rest of the new desktop UI (@arvsrn)

Bugfixes

• Make terminal shortcuts take priority when the terminal is focused
• Show unread state on tabs with pending questions
• Keep session tab titles available after reloads while session data is still loading
• Apply theme changes only after you select them in Settings
• Fix macOS titlebar appearance mismatches in Sequoia and adjust traffic light placement (@arvsrn)

Thank you to 3 community contributors:

• @arvsrn:
  • feat(app): align cmd k menu with v2 styles (#35152)
  • feat(app): visual improvements (#35134)
  • feat(app): reintroduce model context tooltip in model selector (#35087)
  • feat(app): change traffic light position, fix sequoia bug (#35081)
• @StarpTech:
  • fix(core): expand home-relative permission paths (#35737)
• @fengjikui:
  • fix(llm): classify zai token limit overflow (#35671)

See the installation instructions for details, but it's easy:

• macOS: brew install ddev/ddev/ddev or just brew upgrade ddev.
• Linux: Use sudo apt-get update && sudo apt-get install ddev, see apt/yum installation
• Windows and WSL2: Download the Windows Installer; you can run it for install or upgrade.
  ⚠️ Traditional Windows users (not WSL2): If needed, the installer will prompt you to uninstall the previous system-wide installation to avoid conflicts with the new per-user installation.
• Consider ddev delete images or ddev delete images --all after upgrading to free up disk space used by previous Docker image versions. This does no harm.
• Consider ddev config --auto to update your projects to current configuration.

Highlights

Blog announcement: https://ddev.com/blog/release-v1-25-3/

• New Docker Compose library: Improved UX during ddev start and ddev stop; the separate ~/.ddev/bin/docker-compose binary is no longer needed and can be removed
• Faster ddev start: Reduced startup time by running post-healthcheck tasks concurrently, thanks to @jonesrussell
• Faster ddev stop: Fixed a bug in the webserver startup script that added an unnecessary ~10-second delay
• MariaDB 12.3 LTS support
• Podman and Docker rootless are no longer experimental: Both are now stable and ready for general use:
  • macOS (Podman rootless)
  • Linux/WSL2 (Docker rootless)
  • Linux/WSL2 (Podman rootless)

Breaking Changes

• Remove support for XDG_CONFIG_HOME, replaced by DDEV_XDG_CONFIG_HOME. Support for ~/.config/ddev on Linux is unchanged. This change was needed because some IDEs, such as PhpStorm, don't always see XDG_CONFIG_HOME set in the terminal (see this issue), which caused the IDE to recreate the ~/.ddev directory repeatedly
• Use stricter permissions for world-writable directories inside ddev-webserver. If you had post-start hooks that wrote to /usr/local/bin, update them to use ~/.local/bin instead, thanks to @AkibaAT
• Move N_PREFIX from /usr/local to /usr/local/n. This shouldn't affect most people, unless you referenced a full path such as /usr/local/bin/npm - the new location is /usr/local/n/bin/npm, or simply use npm without a full path
• Remove the ddev dr alias for ddev drush, since dr is now a built-in command for Drupal 11.4+

Features

• Node.js improvements: preserve nodejs_version in .ddev/config.yaml, and install several Node.js versions with n install <version> inside the web container
• Docker rootless on Linux no longer requires no-bind-mounts; disable it with ddev config global --no-bind-mounts=false
• Support the gvisor-tap-vsock network driver in Docker rootless
• Add new ddev dr command for Drupal 11.4+
• Allow using Mutagen together with ddev config global --use-hardened-images=true
• ddev version and ddev config now work even when Docker isn't running or is broken, and ddev poweroff shows progress output instead of appearing to hang
• Improve ddev list and ddev describe layout on narrow terminals
• Add OSC 8 terminal hyperlink support to ddev list, ddev describe, ddev add-on list, and ddev add-on search
• Show human-readable output when checking available disk space, thanks to @wolcen
• Always pull images when using ddev start --no-cache
• Respect the COMPOSER_NO_BLOCKING environment variable from the host in ddev composer
• Add ddev config global --docker-buildx-version to specify which Docker Buildx version to use (advanced use only)
• Respect docker-buildx installed via snap on Linux
• Support Debian, Kali, and eLxr WSL2 distros in the Windows installer, and avoid installing docker-ce over an existing Docker Desktop docker binary
• Add ddev utility addon-update-checker command for add-on maintainers
• Add #ddev-interactive option for add-on actions, thanks to @AkibaAT
• Add x-ddev.omit-ddev-labels extension to skip com.ddev.* label injection for specific services
• Support the Flatpak user binary for DBeaver on Linux, thanks to @nickchomey
• Add a quickstart for Drupal 12 (HEAD), thanks to @rpkoller
• Add troubleshooting for Let's Encrypt certificate failures, thanks to @jonpugh

Bug Fixes

• Windows installer: fix installation on WSL2 Ubuntu 26.04, which previously failed due to the deprecated wslu package
• Suppress 404 logs for favicon.ico and robots.txt; in some cases these caused Nginx to run a PHP script twice
• Prevent recursion in global web command wrappers
• Use the correct settings.ddev.php for each Drupal version
• Fix a bug where .ddev/apache/apache-site.conf went missing when using a custom Nginx config
• Detect a missing docker CLI, which is required when using Mutagen
• Limit the ENV HOME="" workaround for MySQL 8.x to the database context only
• Podman and macOS: restrict the keep-id userns setting to Linux only
• Use the nodejs_version set during the ddev-webserver image build; if you installed global npm packages in post-start hooks, move them to extra Dockerfiles instead
• Use wrapper scripts in ddev-dbserver to avoid mysql deprecation warnings with MariaDB 11.x+
• Warn when the CAROOT environment variable is set but the mkcert CA files (needed for HTTPS in your browser) are inaccessible
• Normalize OSTYPE detection on Linux, thanks to @Mikee-3000
• Avoid double-sourcing bashrc configuration in ddev ssh
• Skip OS-generated metadata files (.DS_Store, Thumbs.db, desktop.ini) during custom-config detection and in .ddev/.gitignore
• Restore path autocompletion for ddev add-on get
• Don't prompt to run ddev poweroff after updating ddev-ssh-agent
• Fix a case typo in ddev sequelace so Sequel Ace is detected on case-sensitive macOS filesystems, thanks to @mficzel

Internal Changes

• Migrate DDEV documentation from Material for MkDocs to Zensical
• Upgrade Bubble Tea (ddev tui) to v2
• Add light/dark/system preference variants for the brand logo
• Remove automated testing on macOS Intel; macOS amd64 binaries are still built and distributed, only CI testing on Intel hardware is removed
• Add automated testing for macOS Podman rootless
• Improve the test embargo system for Go, Bats, and CI workflows; tests can now be skipped when needed
• Add custom GitHub workflows to run tests on branches without opening a PR
• Rework local HTTP test helpers for clearer failure output
• Remove the build step for the Docker image used in ddev auth ssh
• Bump all Go dependencies

Minor Updates

• PHP 8.4.22 and 8.5.7

What's Changed

• test: Reenable Drupal 12 bats test (#8346) [skip ci] by @rpkoller in #8346
• chore(claude): fix PreToolUse hook matcher for git commit static analysis (#8345) [skip ci] by @stasadev in #8345
• docs(add-ons): Minor updates to creating-add-ons.md by @rfay in #8347
• perf: combined startup time optimizations, for #8096 by @jonesrussell in #8145
• fix(windows): remove wslu from installer, fixes #8326 by @stasadev in #8351
• fix(webserver): replace phar.io/filippo.io links with GitHub releases, improve Dockerfile, for #8012 by @stasadev in #8352
• docs(quickstart): add a quickstart for Drupal 12 (#8357) [skip ci] by @rpkoller in #8357
• feat(docker): always pull images with --no-cache by @stasadev in #8363
• fix(download-images): pull webserver image, for #8304 by @stasadev in #8358
• fix(start): use image digest for rebuild detection, fix rand and ssh-agent data races, for #8145 by @stasadev in #8359
• fix(test): skip TestCheckLiveConnectivityWithProject on Rancher/Colima/Lima, fix misleading WSL2 labels by @rfay in #8365
• docs(windows): add WSL2 installation step to Docker docs by @stasadev in #8355
• chore: fix claude hooks and update agent docs [skip ci] by @rfay in #8370
• chore: remove macOS amd64 CI testing (#8372) [skip ci] by @rfay in #8372
• fix(drupal): use configured project type for settings.php version selection by @rfay in #8366
• ci: run golangci-lint by @stasadev in #8375
• docs(mutagen): explain how to reset to the default mode, fixes #8367 by @silverham in #8368
• docs(configuration): Add ddev config --database=<database type>:<version> example command (#8387) [skip ci] by @silverham in #8387
• build: bump fuxingloh/multi-labeler from 4 to 5 (#8385) [skip ci] by @dependabot[bot] in #8385
• docs: clarify --cleanup --name for single snapshot deletion (#8384) [skip ci] by @CallMeLeon167 in #8384
• docs(add-ons): add real example for bats testing (#8377) [skip ci] by @stasadev in #8377
• fix(commands): normalize $OSTYPE detection for linux, fixes #8382 by @Mikee-3000 in #8383
• docs: Add Xcode iOS simulator info (#8371) [skip ci] by @jamesmacwhite in #8371
• feat(utility): add ddev utility addon-update-checker command by @stasadev in #8373
• fix(add-ons): autocomplete for path by @stasadev in #8376
• test(wsl2): fix TestHostDBPort by @stasadev in #8391
• test(windows): fix TestUtilityAddonUpdateCheckerCmd, for #8373 by @stasadev in #8394
• docs(quickstart): Add description to Drupal Git clone example by @gitressa in #8395
• fix(ddev-webserver): ddev stop takes 10s due to bash deferring SIGTERM during foreground cat, fixes #8295 by @rfay in #8396
• docs: unify homeadditions path resolution and Composer auth.json handling by @eiriksm in #8400
• docs(providers): align --environment examples and flags, fixes #8402 by @stasadev in #8403
• test(share): improve cloudflared debug output on unmarshal errors by @rfay in #8398
• ci(github): reorganize test jobs, add custom workflow_dispatch, remove unused workflows by @stasadev in #8401
• feat(add-on): add #ddev-interactive option for actions, fixes #8155 by @AkibaAT in #8381
• refactor(tui): upgrade bubbletea/bubbles/lipgloss to v2 by @stasadev in #8404
• ci: add DDEV_EMBARGO_PHP_VERSIONS to skip specific PHP versions in TestPHPConfig [skip ci] by @rfay in #8407
• feat: use docker-compose library, optionally download docker-buildx, fixes #7915, for #8295 by @stasadev in #8234
• ci(docs): add stable docs branch workflow, fixes #7862 by @stasadev in #8408
• ci(forks): fetch variables from public-variables branch by @stasadev in #8410
• ci(wsl2): read public-variables in pwsh, for #8410 by @stasadev in #8411
• ci: improve test embargo system for Go, bats, and CI workflows by @stasadev in #8413
• docs(config): improve wording for database and docker_buildx_version, for #8387 by @stasadev in #8409
• refactor: improve CheckAvailableSpace reliability and output, fixes #8388 by @wolcen in #8412
• ci(buildkite): fix MSYS path conversion breaking public-variables fetch on Windows, for #8410 by @stasadev in #8416
• docs(brand-guide): add light, dark, and auto logo variants to logos table, fixes #8417 by @stasadev in #8419
• feat(docs): migrate from mkdocs-material to zensical, fixes #7840, fixes #8216 by @stasadev in #8421
• docs(add-ons): mention #ddev-generated in quickstart by @chx in #8420
• ci(docs): enable zensical strict mode, use dynamic Pages base URL, for #8421 by @stasadev in #8423
• fix(ddev-dbserver): unlink stale socket before mysqld init by @stasadev in #8424
• test: add details to TestCmdAddonPHP by @stasadev in #8425
• chore(sponsors): update percentage and api link [skip ci] by @stasadev in #8427
• ci(pr): migrate to ddev/commit-message-checker@v3 by @stasadev in #8428
• test(lima): fix broken cleanup in TestCmdAddonPHP, for #8425 by @stasadev in #8430
• fix: replace remaining world writeable directories, fixes #8251 by @AkibaAT in #8379
• chore(composer): add COMPOSER_NO_BLOCKING by @stasadev in #8432
• fix(exec): allocate TTY only when stdout is also a terminal, for #8234 by @stasadev in #8431
• feat(docker-rootless): remove no-bind-mounts requirement, test gvisor-tap-vsock by @stasadev in #8426
• build: pin Node.js to 24.15.0, fixes #8436 by @stasadev in #8438
• test(linux): wait for nc to bind before asserting in port-diagnose tests by @stasadev in #8446
• test: rework local HTTP test helpers with clearer failure output by @stasadev in #8447
• fix(nodejs): move install to Dockerfile, add ~/n/bin to PATH, fixes #8414, fixes #8415 by @stasadev in #8443
• fix(zensical): retry strict build on false-positive "page does not exist" warnings by @stasadev in #8451
• ci(linux): use full homebrew formulae name, fixes #8450 by @stasadev in #8455
• test(quickstart): update asterios page check by @stasadev in #8454
• feat: add MariaDB 12.3 LTS support, fixes #8452 by @rfay in #8453
• fix(dbserver): use wrapper scripts for MariaDB 11.x+ MySQL compat, fixes #6861 by @stasadev in #8456
• test(buildkite): Fix brew upgrade to use -y for new 6.0.0 release, fix setup-homebrew by @rfay in #8469
• build(gnupg): Remove references to obsolete gnupg2 by @rfay in #8475
• fix: recreate service on ddev utility rebuild -s, support profile services by @stasadev in #8463
• fix(nodejs): preserve nodejs_version in config.yaml, fixes #8186 by @stasadev in #8462
• fix(nodejs): move N_PREFIX to /usr/local/n and make it writable, fixes #8465 by @stasadev in #8467
• fix(nginx): suppress favicon.ico and robots.txt 404 logs, fixes #7010 by @stasadev in #8461
• fix(ssh): use RawCmd to avoid double-sourcing bashrc, fixes #5232 by @stasadev in #8460
• docs: install util-linux-extra in Docker setup, fixes #8350 (#8480) [skip ci] by @rfay in #8480
• feat: improve ddev list/describe table layout, add OSC 8 terminal hyperlinks, fixes #5535, fixes #6113 (#8474) [skip ci] by @rfay in #8474
• fix: skip OS-generated metadata files in custom-config detection and .ddev/.gitignore, fixes #8418 (#8478) [skip ci] by @rfay in #8478
• fix(mutagen): detect missing docker CLI early, fixes #8457 by @rfay in #8479
• docs(docker): add troubleshooting for permission denied, for #8471 (#8483) [skip ci] by @stasadev in #8483
• test(quickstart): update shopware6 by @stasadev in #8482
• fix: warn when CAROOT is set but CA files are inaccessible, fixes #8485 (#8486) [skip ci] by @rfay in #8486
• fix(tui): prevent docker/cli stdin from consuming TUI shortcuts, fixes #8440 by @stasadev in #8489
• fix: add /usr/local/n/bin to sudo secure_path, fixes #8488 by @stasadev in #8490
• fix(start): show warnings from log-stderr.sh on start, fixes #8441 by @stasadev in #8481
• build(deps): bump go dependencies, migrate to go-github v88 by @stasadev in #8492
• test(quickstart): pin @sveltejs/adapter-node@5.5.4 by @stasadev in #8497
• test(docs): Ignore link check URLs [skip ci] by @rfay in #8499
• build: bump actions/checkout from 6 to 7 (#8504) [skip ci] by @dependabot[bot] in #8504
• fix: restrict XDG_CONFIG_HOME to Linux, add DDEV_XDG_CONFIG_HOME for cross-platform overrides, fixes #8493 by @rfay in #8494
• fix(webserver): prevent recursion in global web command wrappers, for #6902 by @stasadev in #8495
• fix(nodejs): always install gulp-cli and yarn, fixes #8496 (#8498) [skip ci] by @stasadev in #8498
• feat(windows): support Debian and Kali WSL2 distros in GUI installer, fixes #8439, fixes #8468 by @rfay in #8464
• build: Fix gomt error that crept in [skip ci] by @rfay in #8509
• test: Add script to compare start time performance [skip ci] by @rfay in #8510
• test(quickstart): remove pin for @sveltejs/adapter-node, for #8497 by @stasadev in #8511
• ci(github): add brew sandbox setup, remove obsolete env, for #8469 by @stasadev in #8512
• fix(mysql): guard ENV HOME injection to db context only, fixes #8508 by @stasadev in #8513
• fix(docker): do not cache build on start, fixes #8433 by @stasadev in #8506
• feat(drupal): Support new dr command built into drupal11.4+, fixes #8500 by @rfay in #8507
• fix(dbeaver): Add flatpak user binary path to search list, fixes #8517 by @nickchomey in #8518
• refactor(auth-ssh): remove build step, fixes #8501 by @stasadev in #8503
• feat: allow mutagen with use-hardened-images, for #3680 by @stasadev in #8491
• feat(docker): respect docker-buildx from snap on linux, fixes #8515 by @stasadev in #8519
• docs: replace newgrp with sg for docker group activation, fixes #8350 by @rfay in #8524
• fix(commands): correct case typo in ddev sequelace, fixes #8521 (#8522) [skip ci] by @mficzel in #8522
• build(deps): bump moby and docker-compose by @stasadev in #8523
• docs: skip codeberg, use stable link for docs in github workflows (#8528) [skip ci] by @stasadev in #8528
• build: remove pin for Node.js, for #8438 by @stasadev in #8527
• fix(start): do not ask for poweroff with new ddev-ssh-agent, fixes #8520 by @stasadev in #8525
• ci(podman): update workflow for Podman 6 by @stasadev in #8526
• fix(podman): restrict keep-id userns to Linux only, fixes #8223, fixes #8529 by @stasadev in #8516
• docs: Remove link to very old processwire thread (#8533) [skip ci] by @rfay in #8533
• fix: continue when #ddev-generated is missing in generate config functions, for #2305 by @stasadev in #8532
• docs: Ignore winaero.com, cert expired [skip buildkite] (#8537) [skip ci] by @rfay in #8537
• ci: add macOS Podman rootless Buildkite pipeline, for #8223 (#8530) [skip ci] by @rfay in #8530
• test(auth-ssh): harden ddevauthssh.expect against passphrase prompt race by @stasadev in #8536
• build: bump actions/cache from 5 to 6 (#8538) [skip ci] by @dependabot[bot] in #8538
• fix: stop honoring XDG_CONFIG_HOME on Linux too, use DDEV_XDG_CONFIG_HOME, fixes #8493 by @stasadev in #8531
• fix: correct typos in global and project config comment docs (#8541) [skip ci] by @stasadev in #8541
• test: fix TestCheckForMultipleGlobalDdevDirs on Windows, for #8531 (#8542) [skip ci] by @rfay in #8542
• feat: add x-ddev.omit-ddev-labels to skip com.ddev.* label injection, fixes #8389 by @stasadev in #8540
• build(docker): bump images to v1.25.3 for release, fixes #8544 by @stasadev in #8547
• ci(buildkite): trim podman machine and run maintenance post-test (#8551) [skip ci] by @stasadev in #8551
• docs(typo3): require Camino theme, drop empty distribution prompt (#8548) [skip ci] by @rfay in #8548
• docs(hosting): add guidance for Let's Encrypt failures by @jonpugh in #8543
• docs(docker): add Podman and Docker rootless setup, fixes #8434 by @stasadev in #8552
• ci(macos): untap pre-installed aws/tap before brew install by @rfay in #8559
• docs(wsl2): use Ubuntu-26.04 instead of Ubuntu-24.04, for #8326, for #8408 by @stasadev in #8553
• fix(webserver): restore nonstandard router port in HTTP_HOST for nginx-fpm, fixes #8554 by @rfay in #8555
• fix(router): temp pin for traefik:3.6.13, for #8562 by @stasadev in #8564
• fix(shopware): pin Twig <3.28 to work around admin HTTP 500 by @rfay in #8557
• docs: add TYPO3 special handling for ddev share, fixes #7799 by @rfay in #8556

New Contributors

• @silverham made their first contribution in #8368
• @CallMeLeon167 made their first contribution in #8384
• @Mikee-3000 made their first contribution in #8383
• @wolcen made their first contribution in #8412
• @chx made their first contribution in #8420
• @mficzel made their first contribution in #8522
• @jonpugh made their first contribution in #8543

Full Changelog: v1.25.2...v1.25.3

Improvements

• Added a code mode MCP adapter for running confined orchestration scripts against connected MCP tools.
• Hid the execute tool unless code mode is enabled.

Bugfixes

• Fixed paginated MCP tool catalogs losing tool metadata and output schema validation.
• Preserved low reasoning effort for OpenRouter small-model variants instead of disabling it.
• Fixed GitHub Copilot model routing to honor each model's advertised chat or responses endpoint.
• Fixed session lists to match equivalent instance directories reliably.
• Fixed Cerebras reasoning replay so earlier assistant reasoning is sent back in the provider-supported field.

TUI

Bugfixes

• Fixed spinner registration so loading indicators keep rendering across TUI surfaces.

Desktop

Improvements

• Show draft server status in the title bar.
• Unified the provider connect flow across the app.
• Improved the integrated terminal experience. (@arvsrn)
• Added reopening for closed tabs and background tab opening. (@usrnk1)
• Improved model search in picker dialogs. (@arvsrn)
• Added recently closed projects to Home. (@usrnk1)
• Made tab navigation respond on mouse down in the new layout.
• Overhauled the v2 review panel. (@arvsrn)
• Refined the session tab preview popover. (@usrnk1)

Bugfixes

• Fixed new sessions from Home using the wrong project.
• Fixed first-launch onboarding so it only appears when appropriate.
• Improved large review pane performance.
• Fixed timeline loads that started on assistant replies by backfilling the missing user turn.
• Restored typing in the composer while the window is unfocused.
• Fixed dropdown search behavior. (@arvsrn)
• Kept the v2 review pane mounted when switching session tabs.
• Kept the terminal mounted when switching session tabs in a workspace.
• Fixed session tab busy indicators to stay scoped to the correct server.
• Fixed child-session navigation and lineage resolution during tab transitions.
• Kept desktop window tabs after closing and reopening the app.

Thank you to 3 community contributors:

• @usrnk1:
  • feat(desktop): refine session tab preview popover (#34792)
  • feat(desktop): add recently closed projects to home (#34926)
  • feat(desktop): papercut fixes (#34939)
  • feat(desktop): reopen closed tabs and background tab open (#35010)
• @arvsrn:
  • feat(app): v2 review panel overhaul (#31882)
  • feat(app): align subagent UI with v2 (#34931)
  • feat(app): improvements to model search (#34954)
  • feat(app): dropdown search fix (#34961)
  • feat(app): terminal improvements (#34747)
• @StarpTech:
  • feat(tui): add debug info dialog with copy to clipboard (#35004)

Today’s macOS 27 Golden Gate beta 3 release includes two new wallpaper and screen saver options for your Mac.

Apple is expected to launch its next-generation M6 chip this fall, but rumors indicate the new chip could skip a number of new products.

⚠️ Breaking Change: Signed templates required for JavaScript protocol

Starting with v3.11.0, custom templates that use the javascript: protocol must be digitally signed before Nuclei will load or execute them. Unsigned JavaScript templates are now skipped during template loading and when referenced from workflows.

Why this change

This release continues the security hardening started in v3.10.0 (sandbox enforcement, network policy checks, stricter code-template handling, YAML include protections, and related fixes in #7469). The JavaScript protocol exposes Go-backed modules through Nuclei's JS runtime, which significantly increases attack surface compared with request-only templates. Requiring signatures brings JavaScript templates in line with the existing protections for code-protocol templates.

Who is affected

What to do

Sign your custom templates with:

nuclei -sign -t /path/to/your-template.yaml

See the Template Signing documentation for key generation, verification, and signing templates that reference external JavaScript or code files.

🔒 Security

• feat(templates): require signatures for javascript templates by @dwisiswant0 in #7514

Other Changes

• bump x/crypto and go-pkcs12 by @dogancanbakir in #7516
• general maintenance and cleanup by @Mzack9999 in #7469

Full Changelog: v3.10.0...v3.11.0

Earlier this week, Bloomberg’s Mark Gurman revealed that Apple has a new M7-powered entry level MacBook Pro in the pipeline for spring 2027. This isn’t an ordinary MacBook Pro refresh though. It’ll bring the upcoming redesign down to the entry level, something that previously wasn’t expected.

BenQ has been making excellent Mac-friendly monitors for years, and their new MA270S is the creme de la creme of their lineup. It’s a 27-inch 5K monitor, but with a feature that most monitors don’t ship with: a glossy finish.

All of Apple’s displays ship with glossy finishes by default, but for one reason or another, matte finishes have dominated the external monitor market – and BenQ is bucking that trend. This makes the MA270S much more at home with the Mac.

• feat(caretaker): egress cloud run service skeleton by @chadd28 in #28167

Full Changelog: v0.51.0-nightly.20260702.gff00dacd9...v0.51.0-nightly.20260703.gf7af4e518

Bugfixes

• Force reasoning mode for OpenAI-compatible reasoning models so reasoning settings apply reliably on custom deployments
• Stop replaying stale GitHub Copilot response item IDs, avoiding follow-up request failures

Desktop

Bugfixes

• Let question prompts be minimized and restored without dismissing them (@arvsrn)
• Clean up stale empty and old draft store files to reduce desktop state buildup
• Keep pending question requests open while reviewing them, instead of dismissing them accidentally (@eXamadeus)
• Keep session page failures scoped to the affected tab instead of breaking the whole app

Improvements

• Improve markdown and message layout alignment in the v2 session UI (@arvsrn)
• Add a searchable v2 model picker and model management flow in the composer (@arvsrn)
• Show a hover preview for session tabs with the project, path, branch, and server (@usrnk1)
• Streamline WSL server setup with clearer distro checks and install flows (@arvsrn)
• Keep desktop tabs scoped to each window so windows restore their own tab sets

Thank you to 3 community contributors:

• @arvsrn:
  • feat(app): v2 wsl ui (#34233)
  • feat(app): composer improvements (#34720)
  • feat(app): more v2 ui alignment (#34465)
  • feat(app): minor fixes (#34748)
• @eXamadeus:
  • fix(app): question UI fixes and UX improvements (#34116)
• @usrnk1:
  • feat(desktop): session tab hover preview popover (#34678)
  • feat(desktop): improve markdown heading spacing in session timeline (#34738)

• fix(core-tools): resolve defensive path resolution for at-reference files and fix macOS tests by @luisfelipe-alt in #28053
• feat(caretaker): implement Cloud Run webhook ingestion service by @chadd28 in #28015

New Contributors

• @chadd28 made their first contribution in #28015

Full Changelog: v0.51.0-nightly.20260630.gae0a3aa7b...v0.51.0-nightly.20260701.g7f00c5fe5

Rumors indicate Apple’s long-expected MacBook Pro redesign will be branded ‘MacBook Ultra’ instead. Here’s why this could be good news for MacBook Pro users in light of a previous redesign misstep.

Bugfixes

• Enable adaptive thinking for Claude Sonnet 5.
• Prefer MCP content responses over structured output when both are present.
• Reconnect MCP servers after OAuth even if the server was disabled. (@MaxAnderson95)
• Request MCP refresh-token scope during OAuth.
• Show MCP OAuth completion errors instead of a generic failure.
• Refresh cached remote skills.
• Preserve skill resource paths.
• Pick better default small models across providers.
• Scope MCP auth status to each server URL.

TUI

Improvements

• Add a yolo mode to auto-approve permissions.
• Pass ServerAuth headers through external served TUI connections. (@OpeOginni)

Desktop

Improvements

• Autocomplete MCP resources in the composer.
• Add workspace controls when starting a new session.
• Show stored token and cost totals in the session context. (@OpeOginni)

Bugfixes

• Autocomplete configured references in prompts.
• Restore the prompt cursor when the composer regains focus.
• Remember the last active desktop URL across restarts.
• Preserve the selected model when promoting a session. (@usrnk1)
• Keep session pages in sync during concurrent events.
• Support normal auth input prompts in the desktop connect-provider dialog. (@OpeOginni)
• Prevent hidden terminal tabs from hanging or resizing incorrectly.
• Re-enable auto-accept in session settings.
• Keep session tabs scoped to the correct server.
• Remember the selected home project and server.

SDK

Improvements

• Add a live event subscription stream.
• Add SDK access to active sessions.
• Restore session runtime operations such as event streaming, interrupts, and message lookup.
• Add paged durable session history.
• Add session permission request create and fetch endpoints.

Bugfixes

• Preserve V2Event names in SSE streams.
• Wake embedded session execution after new prompts.
• Improve V2 runtime tool results and avoid duplicate model switch events.
• Resolve MIME types for prompt attachments sent by URI.

Thank you to 11 community contributors:

• @usrnk1:
  • feat(app): refine session UI styling (#33860)
  • fix(desktop): preserve selected model during session promotion (#34466)
  • fix(desktop): context menu button / tab intermittent issue (#34420)
  • feat(desktop): add hover background to session title and single-click edit (#34589)
  • feat(app): hide separators around active tabs (#34591)
  • feat(desktop): polish inline session title editing (#34607)
  • feat(desktop): make error view draggable (#34627)
  • feat(desktop): polish tooltips and session search (#34632)
• @arvsrn:
  • feat(app): updates to design system (#34066)
  • feat(app): update home screen alignment + markdown styles (#34172)
  • feat(app): minor visual updates (#34205)
  • feat(app): new debug bar (#34237)
  • feat(app): sticky session list header (#34220)
  • feat(app): show loader on session hover (#34224)
  • feat(app): new timeline header (#34192)
  • feat(app): improve projects sidebar reactivity (#34391)
  • feat(app): update message part ui to v2 (#34394)
  • feat(app): align slash popover to v2 tokens (#34286)
• @ariane-emory:
  • docs(providers): document blacklist and whitelist model filtering (#33792)
• @Slickstef11:
  • docs: route enterprise contact links (#34080)
• @affanali2k3:
  • fix(app): slow tooltip display for models (#30745)
• @OpeOginni:
  • fix(desktop): recognize normal auth metadata input prompts in connect provider dialog (#33024)
  • feat(desktop): Display stored totals for Tokens and Cost in Desktop Session Context (#28887)
  • feat(tui): integrate ServerAuth headers into transport configuration for external served TUI thread (#29876)
• @BenGu3:
  • fix(tui): register prompt.skills keybinds (#34180)
• @neriousy:
  • fix(app): disable add project when given server is offline (#34294)
  • fix(app): disable empty server chevron (#34292)
• @MaxAnderson95:
  • fix(mcp): reconnect after OAuth even when server is disabled
• @StarpTech:
  • fix(console): cancel upstream provider requests (#34467)
• @runvip:
  • fix(docs): fix Russian translation for index.mdx (#34001)

Anthropic just launched a brand-new desktop app called Claude Science. The new app joins the main Claude app on the Mac, which includes Claude AI, Cowork, and Code.

• Bazel: Fix prerelease filtering with same-release-line scoping by @v-HaripriyaC in #15332
• Respect cooldown for Docker digest updates and suppress multi-arch no-ops by @robaiken in #15354
• Bypass npmrc min-release-age for transitive npm security updates by @robaiken in #15386
• Ratchet the Sorbet T.untyped burndown by @JamieMagee in #15399
• feat(docker): implement single-platform image detection and optimize manifest fetching logic by @jpinz in #15390
• Fix private registry config not found error not being raised issue in npm_and_yarn by @AbhishekBhaskar in #15394
• don't fail if nuget cred is missing url by @brettfo in #15378
• Type commit_message_options with a value object by @JamieMagee in #15400
• Type the Dependabot config file parser by @JamieMagee in #15401
• Fix Terraform registry replacement typing and credential semantics by @thavaahariharangit with @Copilot in #15406
• fix: avoid path collisions for SHA-pinned GitHub Actions by @markhallen in #14806
• Nix: skip flake inputs pinned to a bare commit SHA by @JamieMagee in #15412
• Type the vulnerability version-range renderer by @JamieMagee in #15402
• Add JobCommand enum and Command property to NuGet Job model by @brettfo in #15277
• Upgrade Ruby to 4.0.5 by @Bo98 in #14830
• Bump updater-core image to RubyGems/Bundler 4.0.13 by @JamieMagee in #15256
• Fix issue with PrivateRegistryConfigNotFound error incorrectly firing when scope is configured by @AbhishekBhaskar in #15416
• Fake MSBuild SolutionDir during NuGet discovery (#13756) by @brettfo in #15392
• NuGet: Filter all editable files not present prior to discovery by @brettfo in #15358
• Support Central Package Versions updates in XmlFileWriter by @brettfo in #15409
• [Update Graph] Report empty manifests as present but empty instead of omitting them by @brrygrdn in #15427
• Fix vcpkg empty PRs for up-to-date baselines by @JamieMagee in #15420
• Nix: update NixOS channel tarball inputs by @JamieMagee in #15413
• fix(opentofu): accept terraform_registry credentials for OCI registry tags by @thavaahariharangit in #15422
• Commit changes to workspace member TOML files by @crabbit-git in #15142
• Fix COREPACK_NPM_REGISTRY trailing slash causing pnpm HTTP 404 on private registries by @thavaahariharangit with @Copilot in #15444
• Map additional NuGet feed errors to private_source_bad_response by @brettfo in #15426
• Support version and security NuGet job commands by @brettfo in #15430
• Show the vcpkg release tag instead of master in PR titles by @JamieMagee in #15433
• Register MSBuild before running the job so early NuGet errors are reported by @brettfo in #15431
• Add a baseline to vcpkg projects missing one by @JamieMagee in #15432
• Fix file updater failed to update for all support files sentry error by @AbhishekBhaskar in #15421
• Skip disabled Maven repositories by @adoroszlai in #15443
• v0.384.0 by @dependabot-core-action-automation[bot] in #15438

New Contributors

• @crabbit-git made their first contribution in #15142
• @adoroszlai made their first contribution in #15443

Full Changelog: v0.383.0...v0.384.0

Read more at: https://hoppscotch.com/blog/hoppscotch-v2026-6-0.

What's Changed

• fix(mock-server): persist isPublic on creation, default to private by @mirarifhasan in #6410
• fix(backend): enforce ownership on user history and private User fields by @mirarifhasan in #6409
• fix(backend): reject path/query/fragment in SMTP URL validation by @mirarifhasan in #6413
• feat(sh-admin): surface which config fields block saving by @nivedin in #6385
• chore: security patch for the dependency chain v2026.6.0 by @mirarifhasan in #6450
• feat(mock-server): append /backend to domain-based URL when subpath access is enabled by @mirarifhasan in #6448
• fix(common): resolve environment variables in inherited collection headers by @sahil29roy in #6447
• feat(desktop): desktop cookie persistence and reapplication by @CuriousCorrelation in #6416
• fix(desktop): sync self-hosted instance version from manifest by @cassiocauee in #6423
• feat: add Thai translation by @anusoft in #6449
• docs(js-sandbox): update development instructions by @abhaybansal0322 in #6387
• fix(common): rewrite Finnish language pack by @roopepaajanen in #6402
• fix(common): add missing Chinese locale keys by @nikhil-shukl in #6363
• refactor(common): improve syncing systems and remove platform-wise duplications by @anwarulislam in #6334
• feat(common): add OAuth2 token type selector for id_token support by @anwarulislam in #6444
• fix(common): defer CookieJarService binding by @CuriousCorrelation in #6478

New Contributors

• @sahil29roy made their first contribution in #6447
• @cassiocauee made their first contribution in #6423
• @anusoft made their first contribution in #6449
• @abhaybansal0322 made their first contribution in #6387
• @roopepaajanen made their first contribution in #6402
• @nikhil-shukl made their first contribution in #6363

Full Changelog: 2026.5.0...2026.6.0

Three AirDrop vulnerabilities have been discovered by security researchers, affecting both iPhone and Mac, with similar ones found in Android’s Quick Share.

An attacker could easily exploit the vulnerabilities to cause AirDrop, AirPlay, Handoff, Universal Clipboard, and Continuity Camera to crash and remain unavailable for as long as the attack continues …

Check out Lambda at: albertatech.co/lambda #ad

Later this year, Apple will be debuting an updated version of the Mac Studio with M5 Max and M5 Ultra chips – a long awaited refresh. The current Mac Studio, released in early 2025, includes an M4 Max and M3 Ultra chip, so at least on the high end, it’s pretty behind.

According to Bloomberg’s Mark Gurman, the M5-based Mac Studio, which should just be a chip upgrade, is still on track to launch this year. Looking ahead to 2028, there may be more interesting changes in the pipeline.

Apple’s upcoming touchscreen MacBook lineup will be powered by the existing M5 Pro and M5 Max chips, according to a new report from Bloomberg.

Apple announced sweeping price increases across its product lineup yesterday, including raising the base price of the MacBook Neo from $599 to $699.

As something of a consolation, Apple today added the MacBook Neo to its Certified Refurbished store. This gives shoppers a way to save, while still buying directly from Apple.

You can, however, get a brand new MacBook Neo for even less on Amazon …

• fix/verify release npm ci ignore scripts by @rmedranollamas in #28116
• fix(ci): prevent workspace binary shadowing in release verification by @galz10 in #28132
• Feat/tool registry discovery by @ved015 in #28113
• fix(ci): prevent bad NPM releases and promote job crashes by @galz10 in #28147

Full Changelog: v0.49.0-preview.0...v0.50.0-preview.1

• chore(release): bump version to 0.48.0-nightly.20260609.g3a13b8eeb by @gemini-cli-robot in #27779
• ci(dependabot): enable cooldown period for npm packages by @ruomengz in #27743
• refactor(core): standardize tool output formatting by @galz10 in #27772
• ci: update workflow logging and policy configurations by @galz10 in #27853
• fix(core): Ensure zero-quota limits fail fast to prevent retry loop hang by @luisfelipe-alt in #27698
• fix(core): handle multi-line escaped quotes in stripShellWrapper by @sanchezcoraspe in #27467
• fix(cli): prevent path traversal vulnerabilities during skill install… by @ompatel-aiml in #27767
• Fix/pending tools and trust overrides by @jvargassanchez-dot in #27854
• ci: use internal environment for scheduled nightly releases (#27865) by @rmedranollamas in #27939
• feat(core): Support GDC air-gapped Service Identity after auth library update by @sidhantgoyal-droid in #27956
• fix(cli): handle tmux false positive background detection by @amelidev in #27572
• Add static eval source analyzer by @ved015 in #27631
• fix(config): migrate coreTools setting to tools.core by @galz10 in #27947
• fix(core-tools): resolve defensive path resolution for at-reference files by @luisfelipe-alt in #27943
• Revert "fix(core-tools): resolve defensive path resolution for at-reference files" by @galz10 in #27992
• chore(release): bump version to 0.49.0-nightly.20260617.g4d3dcdce1 by @gemini-cli-robot in #28003
• Changelog for v0.48.0-preview.0 by @gemini-cli-robot in #27999
• fix(ci): provide fallbacks for package variables in nightly release by @galz10 in #28016
• chore(deps): pin dependencies and enforce 14-day update cooldown by @galz10 in #27948
• fix(ci): append trailing slash to registry url in npmrc by @rmedranollamas in #28038
• feat: add eval:inventory CLI command and reporting logic by @ved015 in #28009
• fix: resolve workspace publish failures and scheduler event loop starvation by @rmedranollamas in #28063
• fix(ci): use wombat dressing room fallback in nightly release to prevent ENEEDAUTH by @rmedranollamas in #28104
• Add JSON output for eval inventory by @ved015 in #28058

New Contributors

• @sanchezcoraspe made their first contribution in #27467
• @sidhantgoyal-droid made their first contribution in #27956
• @amelidev made their first contribution in #27572

Full Changelog: v0.47.0...v0.49.0

A new report from Counterpoint Research predicts that Apple will gain market share across four major product categories this year, setting new records in three of them. Here are the details.

Apple is planning a big change to its Apple Silicon strategy for the Mac. A new report from Bloomberg today details that Apple does not plan to release higher-end versions of the upcoming M6 chip. Instead, it will release the base M6, then immediately shift its focus to the M7 lineup. Here’s what to expect.

Improvements

• Add session snapshots and revert controls so you can roll a session back to an earlier message, including file changes.

Bugfixes

• Always print the MCP OAuth URL so manual sign-in still works when opening the browser flow.

Desktop

Improvements

• Add Chrome-style tab cycle shortcuts with mod+1 through mod+9.
• Add draggable tabs. (@arvsrn)
• Improve the empty home state when you have no sessions. (@arvsrn)
• Restyle the jump-to-latest button in the v2 session view. (@arvsrn)
• Improve the redesigned desktop layout, including better titlebar tabs and archived sessions. (@arvsrn)

Bugfixes

• Keep prompt drafts attached to the correct project server.
• Restore consistent titlebar tab sizing and layout.
• Restore home actions when session lists are empty or still loading.
• Keep todo docks in place when switching between sessions.
• Automatically close tabs for sessions that no longer exist.
• Keep provider dialogs, prompt rollbacks, and async attachments tied to the session where they started.
• Clear late session notifications after you open the session.
• Remove the session loading stripe.

Thank you to 2 community contributors:

• @isaachuangGMICLOUD:
  • docs: add GMI Cloud provider entry to providers directory (#32914)
• @arvsrn:
  • feat(app): draggable tabs (#31364)
  • feat(app): ui improvements (#32438)
  • fix(app): update all v1 new-session icons (#32017)
  • feat(app): no sesssions empty state (#33315)
  • feat(app): restyle v2 jump-to-latest button (#33809)

• fix(cli): prevent path traversal vulnerabilities during skill install… by @ompatel-aiml in #27767
• Fix/pending tools and trust overrides by @jvargassanchez-dot in #27854
• ci: use internal environment for scheduled nightly releases (#27865) by @rmedranollamas in #27939
• feat(core): Support GDC air-gapped Service Identity after auth library update by @sidhantgoyal-droid in #27956
• fix(cli): handle tmux false positive background detection by @amelidev in #27572
• Add static eval source analyzer by @ved015 in #27631
• fix(config): migrate coreTools setting to tools.core by @galz10 in #27947
• fix(core-tools): resolve defensive path resolution for at-reference files by @luisfelipe-alt in #27943
• Revert "fix(core-tools): resolve defensive path resolution for at-reference files" by @galz10 in #27992
• chore(release): bump version to 0.49.0-nightly.20260617.g4d3dcdce1 by @gemini-cli-robot in #28003
• Changelog for v0.48.0-preview.0 by @gemini-cli-robot in #27999
• fix(ci): provide fallbacks for package variables in nightly release by @galz10 in #28016
• chore(deps): pin dependencies and enforce 14-day update cooldown by @galz10 in #27948
• fix(ci): append trailing slash to registry url in npmrc by @rmedranollamas in #28038
• feat: add eval:inventory CLI command and reporting logic by @ved015 in #28009
• fix: resolve workspace publish failures and scheduler event loop starvation by @rmedranollamas in #28063
• fix(ci): use wombat dressing room fallback in nightly release to prevent ENEEDAUTH by @rmedranollamas in #28104
• Add JSON output for eval inventory by @ved015 in #28058
• fix/verify release npm ci ignore scripts by @rmedranollamas in #28116
• fix(ci): prevent workspace binary shadowing in release verification by @galz10 in #28132
• Feat/tool registry discovery by @ved015 in #28113

New Contributors

• @sidhantgoyal-droid made their first contribution in #27956
• @amelidev made their first contribution in #27572

Full Changelog: v0.48.0-nightly.20260613.g9e5599c32...v0.49.0-nightly.20260625.gd845bc5d4

Improvements

• Added MCP server instructions to session context. (@Arcadi4)
• Added Opencode-managed provider integration support.
• Added MCP resource template listing.
• Added MCP resource read tools.
• Added a --mini CLI mode.

Bugfixes

• Hid MCP resource template tools when access is denied.
• Prevented MCP resource tools from colliding when servers expose the same keys.
• Emitted skill base directories as filesystem paths instead of file:// URLs. (@shyuan)
• Restored legacy MCP tool names for existing integrations.
• Restored v1 account config loading.
• Bound MCP OAuth callbacks to IPv4 loopback for better local auth reliability. (@he-yufeng)
• Preserved structured error details in surfaced failures.
• Fixed snapshots from subdirectories so they only include the right files and paths.
• Fixed ACP resource text sourcing on Windows and other cross-platform path cases.
• Preserved file source paths in ACP resource text.
• Waited for plugins before loading reference-backed config and system context.
• Hid gpt-5.5-pro when using Codex OAuth.

TUI

Improvements

• Added a configurable keybind to open the diff viewer.
• Added diff viewer support for comparing against the main branch.

Bugfixes

• Prevented worker rejections from breaking the TUI process.

Desktop

Improvements

• Kept draft prompt state per tab.
• Added a new session progress indicator. (@arvsrn)
• Added mobile bottom navigation.
• Added collapsible server sections. (@arvsrn)
• Added server-aware session routes to keep same-session navigation separated across servers.

Bugfixes

• Always applied safe-area insets.
• Made session navigation more stable and faster.
• Routed new sessions through tabs correctly.
• Cleared viewed session notifications reliably.
• Scoped drafts created from Home to the right server and project.
• Throttled directory tree loading.
• Persisted drafts and prompt state more reliably.
• Improved iOS PWA shell behavior.
• Refined the mobile session layout.
• Added the server button dropdown. (@arvsrn)
• Restored review line comments.
• Improved the mobile home layout.

SDK

Improvements

• Exposed provider integration IDs in the SDK.

Extensions

Improvements

• Added namespaced plugin hook APIs.
• Added the V2 plugin API for Effect and Promise plugins.

Thank you to 6 community contributors:

• @remorses:
  • feat(llm): add video and audio media support to Gemini protocol (#31889)
• @arvsrn:
  • feat(app): collapsible servers (#33384)
  • fix(app): add server button dropdown (#33358)
  • feat(app): new session progress indicator (#32662)
  • feat(app): update all components to use v2 tokens (#33598)
• @ReStranger:
  • fix: Skip bun version check for nix version (#33166)
• @he-yufeng:
  • fix(mcp): bind oauth callback to IPv4 loopback (#30022)
• @shyuan:
  • fix(skill): emit base directory as filesystem path, not file:// URL (#33580)
• @Arcadi4:
  • feat(mcp): append server instructions to context (#32490)

Apple has a new MacBook Ultra rumored to launch this fall as part of its expanding ‘Ultra’ lineup. Here are six new features expected with the MacBook Ultra.

The USB-C standard effectively played a nasty trick on us, especially where cables are concerned. That’s because it isn’t really a standard at all, but is instead merely a common plug and socket form-factor that can encompass a wide range of capabilities and standards.

Ensuring you buy the right USB-C cable for your needs has been a problem for many years now. That’s because you don’t want to buy a cable that doesn’t fully meet the standards, but at the same time there’s no point in paying for a higher-spec cable than you need for your particular application …

macOS Golden Gate is filled with hints about the Mac gaining touch support, and a supply chain leaker just added more confirmation that a new touchscreen-equipped MacBook is coming soon.

Bugfixes

• Honor configured agent step limits by forcing a final text response instead of failing mid-run.
• Fix Devstral model detection when provider IDs use different casing. (@Robin1987China)
• Pass configured custom headers to Copilot model requests.

Improvements

• Add high and max thinking variants for GLM-5.2 across supported providers. (@imranshaiedi-byte)
• Stop wrapping follow-up user messages in a steering reminder so prompt caching stays effective.

TUI

Bugfixes

• Only show the background subagent shortcut when the server supports it.

Thank you to 4 community contributors:

• @Grantmartin2002:
  • fix(core): fix command docs in customize-opencode skill (#32718)
• @Robin1987China:
  • fix(opencode): use toLowerCase for Devstral model detection (#33109)
• @kimnamu:
  • fix(experimental llm pkg): forward topK to Converse via additionalModelRequestFields (#33030)
• @imranshaiedi-byte:
  • feat(opencode): expose High/Max thinking variants for GLM-5.2 (#32446)

Available now in beta, Lettera is a standalone Markdown editor app built around the same editor that powers Bear 2. Here are the details.

Changed

• Switched Google OAuth callback hostname from localhost to 127.0.0.1 to prevent IPv6 loopback fallback delays and proxy routing interception.

Fixed

• Fixed OpenCode Go usage reporting to synthesize /usage limits from OMP-observed request costs for the 5h, weekly, and monthly provider caps. (#2942)
• Fixed MiniMax Anthropic-compatible requests to serialize adaptive thinking without an invalid Anthropic output_config.effort tier (#2928).

@oh-my-pi/pi-catalog

Fixed

• Fixed MiniMax Anthropic-compatible M2/M3 thinking metadata to expose the adaptive transport and keep M2 mandatory reasoning floored (#2928).

@oh-my-pi/pi-coding-agent

Fixed

• Fixed /model in the TUI to open the model setup picker again, leaving /switch as the temporary session model switcher (#2933).
• Fixed OpenCode Go sessions recording per-request cost history so /usage can show local cap utilization. (#2942)

@oh-my-pi/pi-natives

Added

• Added Fortran support to the AST tooling, including file/alias resolution.

What's Changed

• fix(coding-agent): restore /model role picker by @roboomp in #2938
• fix(ai/kimi): sanitize client device headers to avoid Cloudflare 520 errors by @usr-bin-roygbiv in #2939
• fix(coding-agent): bypass stream-interrupted guard for Gemini malformed function calls by @usr-bin-roygbiv in #2940
• fix(providers): add OpenCode Go usage reporting by @roboomp in #2947
• perf(auth): switch Google OAuth callback hostname to 127.0.0.1 for fast loopback by @cagedbird043 in #2932
• fix(providers): map MiniMax Anthropic thinking by @roboomp in #2934
• feat(coding-agent): add Fortran support by @TobiasLinnITHE in #2964

New Contributors

• @TobiasLinnITHE made their first contribution in #2964

Full Changelog: v16.0.6...v16.0.7

• Enigma detector enhance verification to prevent false verified findings by @shahzadhaider1 in #5011
• fix: scan files with lines exceeding bufio's default 64 KB token limit by @MuneebUllahKhan222 in #5022
• fix(postgres): honor ignore tags for default port URLs by @Dawn-Fighter in #4968
• Move to github.com/moby/moby/client from docker/docker by @trufflesteeeve in #4987
• fix: avoid terminal probes before CLI output by @Hackerchen716 in #4994
• Update test containers dependency by @trufflesteeeve in #4978
• Re-host pkg/handlers JSON test fixtures under the org by @amanfcp in #5023
• [INS-465] Add datadogapikey detector to defaults.go by @mustansir14 in #4969
• [INS-470] Add Tly detector to defaults.go, gate it behind feat flag and update its verification logic by @MuneebUllahKhan222 in #5006
• [INS-473] Add wit detector to defaults.go, gate it behind feat flag and update verification logic by @MuneebUllahKhan222 in #5008
• Updating Klaviyo PK new format by @breetan in #5009
• Restructure Klaviyo detector pattern tests by @martinlocklear in #5026
• Replace Renovate config with shared preset (high-risk tier) by @bryanbeverly in #4992
• set redacted value to last 4 characters of secret, to match how the secret type admin interface displays it by @jordanTunstill in #5027
• GitHub finegrained analyzer was improperly handling errors by @dustin-decker in #4498
• [INS-469] Added Rev detectors to defaults.go and gated it behind feature flag by @MuneebUllahKhan222 in #5005
• Fix Renovate lookup: update setup-captain version comment by @bryanbeverly in #4999
• [INS-472] [INS-515] Add user detector to defaults.go, gate it behind feat flag, update verification logic and add custom ep configuration by @MuneebUllahKhan222 in #5007
• Fix: Resolve known dedup issues in notifierWorker by @MuneebUllahKhan222 in #5028
• fix(dropbox): prevent long sl.u. tokens from being truncated by @lukem-ts in #5012
• fix: add filetype=sdist param to pypi detector by @lukem-ts in #4988
• Handlers - Embed small HTTP test fixtures by @amanfcp in #5001
• S3: surface bucket listing failures and fix multi-role object count by @shahzadhaider1 in #5035

New Contributors

• @Dawn-Fighter made their first contribution in #4968
• @Hackerchen716 made their first contribution in #4994
• @breetan made their first contribution in #5009
• @lukem-ts made their first contribution in #5012

Full Changelog: v3.95.4...v3.95.6

While macOS 27 introduces lots of new features, it does have a few drawbacks. One of these appeared to be that it bricked Time Capsules.

A Microsoft engineer has found a way to maintain compatibility, but it really just leads me to renew my belief that Apple needs to revive the product …

• chore(release): bump version to 0.48.0-nightly.20260609.g3a13b8eeb by @gemini-cli-robot in #27779
• ci(dependabot): enable cooldown period for npm packages by @ruomengz in #27743
• refactor(core): standardize tool output formatting by @galz10 in #27772
• ci: update workflow logging and policy configurations by @galz10 in #27853
• fix(core): Ensure zero-quota limits fail fast to prevent retry loop hang by @luisfelipe-alt in #27698
• fix(core): handle multi-line escaped quotes in stripShellWrapper by @sanchezcoraspe in #27467
• fix(cli): prevent path traversal vulnerabilities during skill install… by @ompatel-aiml in #27767
• Fix/pending tools and trust overrides by @jvargassanchez-dot in #27854
• ci: use internal environment for scheduled nightly releases (#27865) by @rmedranollamas in #27939
• feat(core): Support GDC air-gapped Service Identity after auth library update by @sidhantgoyal-droid in #27956
• fix(cli): handle tmux false positive background detection by @amelidev in #27572
• Add static eval source analyzer by @ved015 in #27631
• fix(config): migrate coreTools setting to tools.core by @galz10 in #27947
• fix(core-tools): resolve defensive path resolution for at-reference files by @luisfelipe-alt in #27943
• Revert "fix(core-tools): resolve defensive path resolution for at-reference files" by @galz10 in #27992

New Contributors

• @sanchezcoraspe made their first contribution in #27467
• @sidhantgoyal-droid made their first contribution in #27956
• @amelidev made their first contribution in #27572

Full Changelog: v0.47.0-preview.0...v0.48.0-preview.0

Apple has confirmed that its products will see price increases in the future due to ongoing memory supply constraints. Apple CEO Tim Cook delivered the bad news in an interview with The Wall Street Journal on Wednesday.

• docs(discussion): polish help docs by @babakks in #13632
• Support custom CLAUDE_CONFIG_DIR in install by @tommaso-moro in #13523
• chore(deps): bump golang.org/x/text from 0.37.0 to 0.38.0 by @dependabot[bot] in #13640
• chore(deps): bump charm.land/lipgloss/v2 from 2.0.3 to 2.0.4 by @dependabot[bot] in #13663
• chore(deps): bump golang.org/x/term from 0.43.0 to 0.44.0 by @dependabot[bot] in #13661
• chore(deps): bump github/codeql-action from 4.36.1 to 4.36.2 by @dependabot[bot] in #13619
• chore(deps): bump github.com/sigstore/sigstore-go from 1.1.4 to 1.2.1 by @dependabot[bot] in #13662
• chore(deps): bump golang.org/x/crypto from 0.52.0 to 0.53.0 by @dependabot[bot] in #13641
• Make filtering by bot authors more discoverable by @BagToad in #13642
• Bump Go in devcontainer by @spenserblack in #13674
• feat: add repo read-file and repo read-dir by @babakks in #13580
• fix(skills): stage updates in a temp dir and swap in-place by @SamMorrowDrums in #13449
• feat(skills): list available skills when install runs non-interactively by @SamMorrowDrums in #13548

Full Changelog: v2.94.0...v2.95.0

Added

• Added UMANS_WEBSEARCH_PROVIDER=native|exa support for routing Umans gateway-owned web search requests.

Fixed

• A single MCP tool whose input schema can't be emitted as a valid strict tool schema for the active provider no longer fails the whole turn with HTTP 400. convertTools (openai-responses) now validates each tool's emitted parameter schema for enum/const-vs-type contradictions that pass structural JSON-Schema validation but the provider rejects — e.g. a non-null enum on a type: "null" node, or an enum on an array node — and quarantines just the offending tool with a logger.warn naming the tool and schema path, keeping every other tool usable. Adds findStrictToolSchemaViolation to @oh-my-pi/pi-ai/utils/schema (#2652)
• Fixed OpenAI Responses-compatible streams from Ollama/local hosts dropping arguments for parallel tool calls whose deltas use fc_<call_id> item ids, which left earlier ast_grep calls with {} and failed validation. (#2715)
• Fixed dialect transcript rendering so literal thinking envelopes are unwrapped before adding the dialect's own thinking tags, preventing nested <thinking> output in advisor raw dumps (#2700).
• Fixed Anthropic-compatible Umans requests escaping client tool names and forwarding gateway web search headers so Kimi answers normally instead of returning raw gateway search results.
• Fixed Google Gemini tool calls with toolChoice: "auto" serializing an explicit toolConfig AUTO mode, which can cause Gemini-3 models to leak raw planning JSON instead of executing tools. (#2776)
• Fixed OpenAI-compatible Ollama completions that return empty finish_reason:length after filling num_ctx so they surface an actionable context-window error instead of an empty length stop. (#2774)
• Fixed Codex browser login issuing credentials for the opencode OAuth originator while OMP requests identify as pi, which could make the first authenticated Codex request return 401 (#2696).

@oh-my-pi/pi-catalog

Fixed

• Fixed Kimi output caps for Umans AI Coding Plan and Venice so discovery metadata cannot use context-sized token ceilings as request caps.
• Marked Umans Anthropic-compatible models as client-tool escaped so cached and bundled metadata do not expose web_search as a provider server tool.

@oh-my-pi/pi-coding-agent

Added

• Added the UMANS_WEBSEARCH_PROVIDER environment variable to CLI help for Umans gateway web search backend selection.

Changed

• The eager task (task.eager: always) and eager todo (todo.eager: preferred/always) hidden reminders now re-fire on the auto-continuation turn after a compaction (context-full / snapcompact / handoff / shake). Compaction summarizes away the first-message prelude, so the agent would otherwise silently lose the delegate-via-tasks / phased-todo guidance mid-work; the post-compaction todo nudge is reminder-only and never forces the todo tool onto the resumed turn.

Fixed

• Fixed edit-tool block operations on Emacs Lisp files: .el and .emacs paths now resolve top-level forms for SWAP.BLK, DEL.BLK, and INS.BLK.POST instead of reporting an unsupported-language block-resolution error.
• Fixed PDF reads leaking recoverable MuPDF WASM warnings into the terminal TUI by routing MuPDF output through the file logger before markit-ai loads it (#2766).
• Fixed /exit and /quit waiting one shutdown timeout per hanging extension by running session_shutdown handlers within a shared shutdown window (#2736).
• Fixed GitHub Copilot .github/instructions/*.instructions.md discovery by loading those files as rules that honor applyTo scoping, including always-apply ** files and rule://<name> access for glob-scoped entries (#2731).
• Fixed Windows bash-tool child processes defaulting interpreter pipe I/O to the ANSI codepage by adding UTF-8 encoding defaults when the inherited environment is unset (#2701).
• Fixed /advisor dump raw so Opus 4.5 thinking content that already includes literal <thinking> tags is not rendered with nested thinking tags (#2700).
• The plugin-extensions-discovery test suite no longer writes fixtures into — and rm -rfs the node_modules of — the developer's real ~/.omp/plugins. Its XDG_DATA_HOME isolation was a no-op on Windows (XDG is gated to Linux/macOS) and was bypassed in XDG-migrated Linux/macOS environments, so a local run could delete installed plugins. The suite now isolates the whole config root via an os.homedir() mock plus cleared XDG_* vars, with a pre-write guard that fails if resolution escapes the temp home (#2721).
• Installed plugins whose extensions manifest entry points at a directory of sub-extensions (the standard pi extensions/<name>/index.ts layout, e.g. pi.extensions: ["./extensions"]) are no longer rejected at install (declared extension entry not found on disk) or silently dropped at load. The plugin manifest resolver now resolves a directory the same way as the configured-directory (-e) extension loader: the directory's own package.json omp/pi extensions (authoritative — a missing declared entry is reported instead of falling back to a decoy index), then a direct index.{ts,js,mjs,cjs}, then a one-level scan of sub-extensions (#2713).
• Fixed OpenRouter @upstream routing selectors whose upstream slug also appears in the model id, so openrouter/...@deepseek:high keeps openRouterRouting.only instead of being consumed by provider-scoped fuzzy matching (#2708).
• Fixed omp plugin list --json omitting locally linked plugins that exist only in omp-plugins.lock.json and node_modules symlinks. (#2742)
• Fixed task subagents to install their configured ordered model candidates as child-session retry fallback chains, so retryable provider failures can advance to the next subagent model instead of failing the worker (#2750).
• Fixed empty reasonless aborted assistant turns to auto-retry without switching model fallback, so transient provider-side aborts after tool results do not end headless sessions (#2685).

@oh-my-pi/hashline

Fixed

• Auto-repaired duplicated JSX/XML closing boundary lines at the end of single-line replacement expansions. (#2705)

@oh-my-pi/pi-natives

Added

• Added Emacs Lisp (.el, .emacs, emacs-lisp/elisp) support to native tree-sitter language inference, enabling astGrep/astEdit, summarizeCode, and blockRangeAt on Emacs Lisp source.

@oh-my-pi/pi-tui

Fixed

• Fixed VS Code integrated terminal keypad digit CSI-u input being handled as navigation instead of text.
• Fixed xterm-compatible terminals scrolling the native viewport to the bottom on prompt-editor keypresses by disabling ?1010/?1011 while the TUI owns the TTY and restoring the prior set modes on exit (#2732).
• Fixed CMUX sessions being treated as direct terminals during resize/reset because they do not set TMUX/STY/ZELLIJ and may run with TERM=dumb; the renderer now treats CMUX workspace/surface env markers as multiplexer signals and preserves pane scrollback instead of emitting ED3 (CSI 3 J).
• Fixed a self-sustaining resize-redraw storm in Warp: the non-multiplexer resize fast path borrows the alternate screen, and Warp re-reports a one-row-different size whenever the alt buffer is toggled, so each drag frame fed back a fresh resize event and the TUI flooded ED3 full repaints with stable geometry. Resize now repaints in place (no alt-screen borrow, no ED3 rewrap) on terminals that re-report size on alt-screen toggles, matching the multiplexer path. Overridable with PI_TUI_RESIZE_IN_PLACE=1|0.

What's Changed

• fix(ai): route prefixed Responses tool deltas by @roboomp in #2719
• test(plugins): isolate discovery test from real ~/.omp on all platforms by @AsafMah in #2722
• fix(coding-agent): load GitHub Copilot instruction rules by @roboomp in #2734
• fix(tui): stop Warp resize feedback-loop redraw storm by @sorphwer in #2741
• fix(cli): speed up exit shutdown handlers by @roboomp in #2745
• fix(cli): list linked local plugins by @roboomp in #2746
• fix(providers): handle Umans Kimi output caps and web search by @oldschoola in #2751
• fix(agent): retry subagent model fallback chains by @roboomp in #2753
• fix(tui): detect CMUX as multiplexer by @pathard1128 in #2755
• fix(coding-agent): route MuPDF warnings to logger by @roboomp in #2772
• fix(ai): omit Google AUTO toolConfig by @roboomp in #2782
• feat(ast): add Emacs Lisp tree-sitter support by @ryjm in #2693
• fix(ai): unwrap thinking envelopes in raw dumps by @roboomp in #2702
• fix(tool): default Windows bash children to UTF-8 by @roboomp in #2704
• fix(hashline): drop duplicated JSX boundary echoes by @roboomp in #2709
• fix(providers): preserve OpenRouter upstream routing by @roboomp in #2710
• fix(openai-responses): quarantine invalid tool schemas instead of failing the whole turn (#2652) by @AsafMah in #2711
• fix(plugins): resolve directory extension manifest entries one level deep by @AsafMah in #2714
• fix(tui): preserve scrollback while editing by @roboomp in #2733

New Contributors

• @sorphwer made their first contribution in #2741
• @pathard1128 made their first contribution in #2755
• @ryjm made their first contribution in #2693

Full Changelog: v16.0.1...v16.0.2

New in v1.29

New Feature: Source Priority

With this feature, one can assign a numerical priority to sources when added or later through the source edit
command. Sources with higher priority are sorted first in the list of sources, which results in them getting put first
in the results if other things are equal.

Beyond the ability to slightly affect the result ordering, commands that primarily target available packages
(largely install) will now prefer to use a single result from a source with higher priority rather than prompting for
disambiguation from the user. Said another way, if multiple sources return results but only one of those sources has
the highest priority value (and it returned only one result) then that package will be used rather than giving a
"multiple packages were found" error. This has been applied to both winget CLI and PowerShell module commands.

REST result match criteria update

Along with the source priority change, the results from REST sources (like msstore) now attempt to correctly set the
match criteria that factor into the result ordering. This will prevent them from being sorted to the top automatically.

Minor Features

--no-progress flag

Added a new --no-progress command-line flag that disables all progress reporting (progress bars and spinners). This flag is universally available on all commands and takes precedence over the visual.progressBar setting. Useful for automation scenarios or when running WinGet in environments where progress output is undesirable.

Authenticated GitHub API requests in PowerShell module

The PowerShell module now automatically uses GH_TOKEN or GITHUB_TOKEN environment variables to authenticate GitHub API requests. This significantly increases the GitHub API rate limit, preventing failures in CI/CD pipelines. Use -Verbose to see which token is being used.

Bug Fixes

What's Changed

• Replaced "(C)" with "©" in the main menu. by @DandelionSprout in #5845
• Source priority by @JohnMcPMS in #6029
• Update json vcpkg by @JohnMcPMS in #6039
• Coalesce comments from loc suggestions by @JohnMcPMS in #6033
• Update Roadmap Milestones doc by @Kissaki in #5824
• Add copilot instructions by @JohnMcPMS in #6048
• Add --no-progress option by @JohnMcPMS in #6049
• Remove Crescendo PowerShell by @JohnMcPMS in #6056
• Fix casing of WinGet by @JohnMcPMS in #6059
• Added more info for "Installer Types" values in Settings.md. by @DandelionSprout in #6067
• Diagnostics update and stable DSC for tests by @JohnMcPMS in #6084
• feat: authenticate GitHub API requests using GH_TOKEN/GITHUB_TOKEN by @wmmc88 in #6071
• Tool to investigate SQLite compression by @JohnMcPMS in #6074
• Add dependencies only option by @JohnMcPMS in #6069

New Contributors

• @DandelionSprout made their first contribution in #5845
• @Kissaki made their first contribution in #5824
• @wmmc88 made their first contribution in #6071

Full Changelog: v1.29.30-preview...v1.29.70-preview

Note: This version is not fully localized yet. Localized strings will be included in a future build before stable release.

New in v1.29

New Feature: Source Priority

With this feature, one can assign a numerical priority to sources when added or later through the source edit
command. Sources with higher priority are sorted first in the list of sources, which results in them getting put first
in the results if other things are equal.

Beyond the ability to slightly affect the result ordering, commands that primarily target available packages
(largely install) will now prefer to use a single result from a source with higher priority rather than prompting for
disambiguation from the user. Said another way, if multiple sources return results but only one of those sources has
the highest priority value (and it returned only one result) then that package will be used rather than giving a
"multiple packages were found" error. This has been applied to both winget CLI and PowerShell module commands.

REST result match criteria update

Along with the source priority change, the results from REST sources (like msstore) now attempt to correctly set the
match criteria that factor into the result ordering. This will prevent them from being sorted to the top automatically.

Minor Features

Preserve installer arguments across export and import

winget export now captures the --override and --custom arguments that were used when a package was originally installed and saves them into the export file. When subsequently running winget import, those values are automatically re-applied during installation — --override replaces all installer arguments and --custom appends extra switches — so packages can be reinstalled with the same customizations without any manual intervention. Both fields are optional and independent of each other; packages without stored installer arguments are unaffected.

--no-progress flag

Added a new --no-progress command-line flag that disables all progress reporting (progress bars and spinners). This flag is universally available on all commands and takes precedence over the visual.progressBar setting. Useful for automation scenarios or when running WinGet in environments where progress output is undesirable.

MCP upgrade support

The WinGet MCP server's existing tools have been extended with new parameters to support upgrade scenarios:

• find-winget-packages now accepts an upgradeable parameter (default: false). When set to true, it lists only installed packages that have available upgrades — equivalent to winget upgrade. The query parameter becomes optional in this mode, allowing it to filter results or be omitted to list all upgradeable packages. AI agents can use this to answer requests like "What apps can I update with WinGet?"
• install-winget-package now accepts an upgradeOnly parameter (default: false). When set to true, it only upgrades an already-installed package and returns a clear error if the package is not installed (pointing to install-winget-package without upgradeOnly instead). AI agents can use this to answer requests like "Update WinGetCreate" or, in combination with find-winget-packages with upgradeable=true, "Update all my apps."

Authenticated GitHub API requests in PowerShell module

The PowerShell module now automatically uses GH_TOKEN or GITHUB_TOKEN environment variables to authenticate GitHub API requests. This significantly increases the GitHub API rate limit, preventing failures in CI/CD pipelines. Use -Verbose to see which token is being used.

Default priority of installer types

Installer type selection no longer depends on the order defined on the manifest. Instead, preference is given in this order:

• MSIX
• MSI / Wix / Burn
• Nullsoft / Inno / EXE
• Portable

When a user configures installer type requirements or preferences, the order in which they are listed is now respected during installer selection.

Improved list output when redirected

• winget list (and similar table commands) no longer truncates output when stdout is redirected to a file or variable — column widths are now computed from the full result set.
• Spinner and progress bar output are suppressed when no console is attached, keeping redirected output clean.

Log file naming strategy

Added a user setting (logging.fileNameStrategy) for controlling the default naming strategy for installer log files. Supported values are manifest (default), timestamp, guid, and shortguid. Only applies to logs generated by installers if the installer itself supports the logging switch / parameter.

Sortable list output

winget list now supports sorting results via --sort <field> (repeatable for multi-field sorting), --ascending/--descending direction flags, and a persistent output.sortOrder setting. Available sort fields: name, id, version, source, available, relevance. By default, results are sorted alphabetically by name when no query is present; use --sort relevance to preserve the previous source-determined ordering.

Bug Fixes

• winget export now works when the destination path is a hidden file
• Fixed the useLatest property in the DSC v3 Microsoft.WinGet/Package resource schema to emit a boolean default (false) instead of the incorrect string "false".
• SignFile in WinGetSourceCreator now supports an optional RFC 3161 timestamp server via the new TimestampServer property on the Signature model. When set, signtool.exe is called with /tr <url> /td sha256, embedding a countersignature timestamp so that signed packages remain valid after the signing certificate expires.
• File and directory paths passed to signtool.exe and makeappx.exe are now quoted, fixing failures when paths contain spaces.
• DSC export now correctly exports WinGet Admin Settings
• winget validate now performs case-insensitive comparison for file extensions where applicable
• winget source reset now properly resets default sources instead of removing them
• DSC v3 Microsoft.WinGet/Package resource now honors the installMode property to use silent or interactive installer switches as specified

What's Changed

• Make list details stable by @JohnMcPMS in #6020
• Move to IReference rather than custom enum for optional bool by @JohnMcPMS in #6022
• Apply latest loc patch by @florelis in #6023
• Bump version to 1.29 by @florelis in #6019
• Remove 'listDetails' from release notes for 1.29 by @florelis in #6026
• Update doc as WinGet is not in preview by @Gijsreyn in #5850
• Replaced "(C)" with "©" in the main menu. by @DandelionSprout in #5845
• Source priority by @JohnMcPMS in #6029
• Update json vcpkg by @JohnMcPMS in #6039
• Coalesce comments from loc suggestions by @JohnMcPMS in #6033
• Update Roadmap Milestones doc by @Kissaki in #5824
• Add copilot instructions by @JohnMcPMS in #6048
• Add --no-progress option by @JohnMcPMS in #6049
• Remove Crescendo PowerShell by @JohnMcPMS in #6056
• Fix casing of WinGet by @JohnMcPMS in #6059
• Added more info for "Installer Types" values in Settings.md. by @DandelionSprout in #6067
• Diagnostics update and stable DSC for tests by @JohnMcPMS in #6084
• feat: authenticate GitHub API requests using GH_TOKEN/GITHUB_TOKEN by @wmmc88 in #6071
• Tool to investigate SQLite compression by @JohnMcPMS in #6074
• Add dependencies only option by @JohnMcPMS in #6069
• docs: fix multiple documentation issues (#5296, #5921, #5108, #4372, #5867) by @GrantMeStrength in #6110
• Revert help link in DscCommand by @JohnMcPMS in #6111
• Update Moq, curl, and c-ares by @Trenly in #6112
• Add Timeserver Support for SourceCreator and support spaces in paths and file names by @Trenly in #6113
• Report skipped upgrades when install technology differs (upgrade --all) by @AMDphreak in #6096
• [AI Generated] Ensure correct DSC export of admin settings by @Trenly in #6109
• Update default for useLatest by @Trenly in #6114
• Add Update commands for MCP by @Trenly in #6117
• Preserve overrides with export and import by @Trenly in #6118
• Quote winget server path before calling CreateProcess by @yao-msft in #6122
• Update to spell check v26 by @Trenly in #6128
• Add issue types to issue templates by @denelon in #6139
• Improve MOTW error handling in download flow by @Trenly in #6127
• Allow exporting to hidden files by @Trenly in #5795
• Add thread globals for downloader thread by @Trenly in #6141
• Dynamically select drive for test by @Trenly in #6129
• Change how Truncation works by @Trenly in #6142
• Admin setting and group policy for configuration processor path argument by @JohnMcPMS in #6119
• Add comments to loc strings by @florelis in #6150
• Move XML ref ahead by @JohnMcPMS in #6154
• Add policy for notifying authors of Localization Restriction by @Trenly in #6156
• Dont log failures to get font title info by @dkbennett in #6163
• [ListCommand] Fix --source filter not restricting list output to specified source by @Madhusudhan-MSFT in #6159
• Improved manifest validations for MSI and Windows Feature names by @JohnMcPMS in #6170
• Mitigate packaged preindexed source open lock convoy by @mamoreau-devolutions in #6172
• Optimize packaged temp ACL handling without weakening ACL repairs by @mamoreau-devolutions in #6171
• Add telemetry event for index updates by @JohnMcPMS in #6175
• Make extension comparison case insensitive by @Trenly in #6182
• [Settings, ListCommand] Add sort types, settings infrastructure, and CLI arguments for output ordering by @Madhusudhan-MSFT in #6177
• Add setting for installer log file names by @Trenly in #5802
• Add JSON validation output and interop presentation model by @JohnMcPMS in #6183
• Add default installer precedence if not defined by user by @Trenly in #6123
• Standardize PR template with emoji sections and issue types by @denelon in #6207
• Add Copilot instructions for writing specifications by @denelon in #6205
• Fix policy bot bugs and expand label coverage by @denelon in #6202
• Report DSC execution diagnostics on a timer by @JohnMcPMS in #6196
• Store provisioning mitigation by @JohnMcPMS in #6194
• Add execution level to telemetry summary and logs by @JohnMcPMS in #6195
• Implement sort logic for winget list output
  by @Madhusudhan-MSFT in #6191
• VS Code WinGet log viewer tool by @JohnMcPMS in #6149
• Bump fast-uri from 3.1.0 to 3.1.2 in /tools/WinGetLogViewer by @dependabot[bot] in #6223
• Update configure export --all for recent DSC changes by @JohnMcPMS in #6222
• Mitigate stack overflow issue by @JohnMcPMS in #6224
• Reset default sources without dropping them by @Trenly in #6187
• Enable transitive pinning for central package management by @florelis in #6225
• Configuration processor auditing improvements by @JohnMcPMS in #6193
• Update rest source and wingetutil interop to include 1.28 manifest by @yao-msft in #6234
• Move pre-check errors to post-check by @JohnMcPMS in #6236
• In-proc certificate pinning validation override by @JohnMcPMS in #6233
• Change symlink verification to avoid redirection guard policy by @JohnMcPMS in #6239
• Bump uuid and @azure/msal-node in /tools/WinGetLogViewer by @dependabot[bot] in #6241
• Bump qs from 6.15.1 to 6.15.2 in /tools/WinGetLogViewer by @dependabot[bot] in #6246
• Ensure portable command alias does not escape directory by @florelis in #6251
• Make sfs-client a vcpkg port by @florelis in #6243
• Bump tmp from 0.2.5 to 0.2.7 in /tools/WinGetLogViewer by @dependabot[bot] in #6252
• Honor DSCv3 package installMode for silent and interactive by @Trenly in #6249
• Fix triage label getting removed by @Trenly in #6254
• lowercase ARM64 for vcpkg by @JohnMcPMS in #6256

New Contributors

• @DandelionSprout made their first contribution in #5845
• @Kissaki made their first contribution in #5824
• @wmmc88 made their first contribution in #6071
• @GrantMeStrength made their first contribution in #6110
• @AMDphreak made their first contribution in #6096
• @mamoreau-devolutions made their first contribution in #6172

Full Changelog: v1.28.240...v1.29.240

New in v1.29

New Feature: Source Priority

With this feature, one can assign a numerical priority to sources when added or later through the source edit
command. Sources with higher priority are sorted first in the list of sources, which results in them getting put first
in the results if other things are equal.

Beyond the ability to slightly affect the result ordering, commands that primarily target available packages
(largely install) will now prefer to use a single result from a source with higher priority rather than prompting for
disambiguation from the user. Said another way, if multiple sources return results but only one of those sources has
the highest priority value (and it returned only one result) then that package will be used rather than giving a
"multiple packages were found" error. This has been applied to both winget CLI and PowerShell module commands.

REST result match criteria update

Along with the source priority change, the results from REST sources (like msstore) now attempt to correctly set the
match criteria that factor into the result ordering. This will prevent them from being sorted to the top automatically.

Minor Features

Preserve installer arguments across export and import

winget export now captures the --override and --custom arguments that were used when a package was originally installed and saves them into the export file. When subsequently running winget import, those values are automatically re-applied during installation — --override replaces all installer arguments and --custom appends extra switches — so packages can be reinstalled with the same customizations without any manual intervention. Both fields are optional and independent of each other; packages without stored installer arguments are unaffected.

--no-progress flag

Added a new --no-progress command-line flag that disables all progress reporting (progress bars and spinners). This flag is universally available on all commands and takes precedence over the visual.progressBar setting. Useful for automation scenarios or when running WinGet in environments where progress output is undesirable.

MCP upgrade support

The WinGet MCP server's existing tools have been extended with new parameters to support upgrade scenarios:

• find-winget-packages now accepts an upgradeable parameter (default: false). When set to true, it lists only installed packages that have available upgrades — equivalent to winget upgrade. The query parameter becomes optional in this mode, allowing it to filter results or be omitted to list all upgradeable packages. AI agents can use this to answer requests like "What apps can I update with WinGet?"
• install-winget-package now accepts an upgradeOnly parameter (default: false). When set to true, it only upgrades an already-installed package and returns a clear error if the package is not installed (pointing to install-winget-package without upgradeOnly instead). AI agents can use this to answer requests like "Update WinGetCreate" or, in combination with find-winget-packages with upgradeable=true, "Update all my apps."

Authenticated GitHub API requests in PowerShell module

The PowerShell module now automatically uses GH_TOKEN or GITHUB_TOKEN environment variables to authenticate GitHub API requests. This significantly increases the GitHub API rate limit, preventing failures in CI/CD pipelines. Use -Verbose to see which token is being used.

Default priority of installer types

Installer type selection no longer depends on the order defined on the manifest. Instead, preference is given in this order:

• MSIX
• MSI / Wix / Burn
• Nullsoft / Inno / EXE
• Portable

When a user configures installer type requirements or preferences, the order in which they are listed is now respected during installer selection.

Improved list output when redirected

• winget list (and similar table commands) no longer truncates output when stdout is redirected to a file or variable — column widths are now computed from the full result set.
• Spinner and progress bar output are suppressed when no console is attached, keeping redirected output clean.

Log file naming strategy

Added a user setting (logging.fileNameStrategy) for controlling the default naming strategy for installer log files. Supported values are manifest (default), timestamp, guid, and shortguid. Only applies to logs generated by installers if the installer itself supports the logging switch / parameter.

Sortable list output

winget list now supports sorting results via --sort <field> (repeatable for multi-field sorting), --ascending/--descending direction flags, and a persistent output.sortOrder setting. Available sort fields: name, id, version, source, available, relevance. By default, results are sorted alphabetically by name when no query is present; use --sort relevance to preserve the previous source-determined ordering.

Bug Fixes

• winget export now works when the destination path is a hidden file
• Fixed the useLatest property in the DSC v3 Microsoft.WinGet/Package resource schema to emit a boolean default (false) instead of the incorrect string "false".
• SignFile in WinGetSourceCreator now supports an optional RFC 3161 timestamp server via the new TimestampServer property on the Signature model. When set, signtool.exe is called with /tr <url> /td sha256, embedding a countersignature timestamp so that signed packages remain valid after the signing certificate expires.
• File and directory paths passed to signtool.exe and makeappx.exe are now quoted, fixing failures when paths contain spaces.
• DSC export now correctly exports WinGet Admin Settings
• winget validate now performs case-insensitive comparison for file extensions where applicable
• winget source reset now properly resets default sources instead of removing them
• DSC v3 Microsoft.WinGet/Package resource now honors the installMode property to use silent or interactive installer switches as specified

What's Changed

• Make list details stable by @JohnMcPMS in #6020
• Move to IReference rather than custom enum for optional bool by @JohnMcPMS in #6022
• Apply latest loc patch by @florelis in #6023
• Bump version to 1.29 by @florelis in #6019
• Remove 'listDetails' from release notes for 1.29 by @florelis in #6026
• Update doc as WinGet is not in preview by @Gijsreyn in #5850
• Replaced "(C)" with "©" in the main menu. by @DandelionSprout in #5845
• Source priority by @JohnMcPMS in #6029
• Update json vcpkg by @JohnMcPMS in #6039
• Coalesce comments from loc suggestions by @JohnMcPMS in #6033
• Update Roadmap Milestones doc by @Kissaki in #5824
• Add copilot instructions by @JohnMcPMS in #6048
• Add --no-progress option by @JohnMcPMS in #6049
• Remove Crescendo PowerShell by @JohnMcPMS in #6056
• Fix casing of WinGet by @JohnMcPMS in #6059
• Added more info for "Installer Types" values in Settings.md. by @DandelionSprout in #6067
• Diagnostics update and stable DSC for tests by @JohnMcPMS in #6084
• feat: authenticate GitHub API requests using GH_TOKEN/GITHUB_TOKEN by @wmmc88 in #6071
• Tool to investigate SQLite compression by @JohnMcPMS in #6074
• Add dependencies only option by @JohnMcPMS in #6069
• docs: fix multiple documentation issues (#5296, #5921, #5108, #4372, #5867) by @GrantMeStrength in #6110
• Revert help link in DscCommand by @JohnMcPMS in #6111
• Update Moq, curl, and c-ares by @Trenly in #6112
• Add Timeserver Support for SourceCreator and support spaces in paths and file names by @Trenly in #6113
• Report skipped upgrades when install technology differs (upgrade --all) by @AMDphreak in #6096
• [AI Generated] Ensure correct DSC export of admin settings by @Trenly in #6109
• Update default for useLatest by @Trenly in #6114
• Add Update commands for MCP by @Trenly in #6117
• Preserve overrides with export and import by @Trenly in #6118
• Quote winget server path before calling CreateProcess by @yao-msft in #6122
• Update to spell check v26 by @Trenly in #6128
• Add issue types to issue templates by @denelon in #6139
• Improve MOTW error handling in download flow by @Trenly in #6127
• Allow exporting to hidden files by @Trenly in #5795
• Add thread globals for downloader thread by @Trenly in #6141
• Dynamically select drive for test by @Trenly in #6129
• Change how Truncation works by @Trenly in #6142
• Admin setting and group policy for configuration processor path argument by @JohnMcPMS in #6119
• Add comments to loc strings by @florelis in #6150
• Move XML ref ahead by @JohnMcPMS in #6154
• Add policy for notifying authors of Localization Restriction by @Trenly in #6156
• Dont log failures to get font title info by @dkbennett in #6163
• [ListCommand] Fix --source filter not restricting list output to specified source by @Madhusudhan-MSFT in #6159
• Improved manifest validations for MSI and Windows Feature names by @JohnMcPMS in #6170
• Mitigate packaged preindexed source open lock convoy by @mamoreau-devolutions in #6172
• Optimize packaged temp ACL handling without weakening ACL repairs by @mamoreau-devolutions in #6171
• Add telemetry event for index updates by @JohnMcPMS in #6175
• Make extension comparison case insensitive by @Trenly in #6182
• [Settings, ListCommand] Add sort types, settings infrastructure, and CLI arguments for output ordering by @Madhusudhan-MSFT in #6177
• Add setting for installer log file names by @Trenly in #5802
• Add JSON validation output and interop presentation model by @JohnMcPMS in #6183
• Add default installer precedence if not defined by user by @Trenly in #6123
• Standardize PR template with emoji sections and issue types by @denelon in #6207
• Add Copilot instructions for writing specifications by @denelon in #6205
• Fix policy bot bugs and expand label coverage by @denelon in #6202
• Report DSC execution diagnostics on a timer by @JohnMcPMS in #6196
• Store provisioning mitigation by @JohnMcPMS in #6194
• Add execution level to telemetry summary and logs by @JohnMcPMS in #6195
• Implement sort logic for winget list output
  by @Madhusudhan-MSFT in #6191
• VS Code WinGet log viewer tool by @JohnMcPMS in #6149
• Bump fast-uri from 3.1.0 to 3.1.2 in /tools/WinGetLogViewer by @dependabot[bot] in #6223
• Update configure export --all for recent DSC changes by @JohnMcPMS in #6222
• Mitigate stack overflow issue by @JohnMcPMS in #6224
• Reset default sources without dropping them by @Trenly in #6187
• Enable transitive pinning for central package management by @florelis in #6225
• Configuration processor auditing improvements by @JohnMcPMS in #6193
• Update rest source and wingetutil interop to include 1.28 manifest by @yao-msft in #6234
• Move pre-check errors to post-check by @JohnMcPMS in #6236
• In-proc certificate pinning validation override by @JohnMcPMS in #6233
• Change symlink verification to avoid redirection guard policy by @JohnMcPMS in #6239
• Bump uuid and @azure/msal-node in /tools/WinGetLogViewer by @dependabot[bot] in #6241
• Bump qs from 6.15.1 to 6.15.2 in /tools/WinGetLogViewer by @dependabot[bot] in #6246
• Ensure portable command alias does not escape directory by @florelis in #6251
• Make sfs-client a vcpkg port by @florelis in #6243
• Bump tmp from 0.2.5 to 0.2.7 in /tools/WinGetLogViewer by @dependabot[bot] in #6252
• Honor DSCv3 package installMode for silent and interactive by @Trenly in #6249
• Fix triage label getting removed by @Trenly in #6254
• lowercase ARM64 for vcpkg by @JohnMcPMS in #6256
• Apply latest loc patch by @florelis in #6262

New Contributors

• @DandelionSprout made their first contribution in #5845
• @Kissaki made their first contribution in #5824
• @wmmc88 made their first contribution in #6071
• @GrantMeStrength made their first contribution in #6110
• @AMDphreak made their first contribution in #6096
• @mamoreau-devolutions made their first contribution in #6172

Full Changelog: v1.28.240...v1.29.250

In macOS 26.4, Apple introduced new popup warnings when you try to paste a command into the Terminal. Now, a new support document explains why these and other Mac Terminal popups appear.

Improvements

• Added external browser OAuth for the Snowflake Cortex provider (@santigc6)
• Improved project copy management and move-session flows in v2

Bugfixes

• Recovered expired MCP sessions instead of leaving MCP tools disconnected
• Cleared closed MCP clients so stale MCP connections do not linger
• Returned structured MCP tool output in a readable form
• Fixed duplicate renderable IDs that could break TUI rendering
• Fixed commands using $ARGUMENTS so file contents are not injected twice (@verdverm)

TUI

Bugfixes

• Added auth headers to RunCommand fetch requests (@OpeOginni)

Desktop

Improvements

• Brought v2 visibility settings to the web app
• Refreshed the oc-2 color theme (@arvsrn)

Bugfixes

• Made the terminal resize gutter easier to grab
• Faded overflowing titlebar tabs instead of clipping them abruptly

Thank you to 5 community contributors:

• @verdverm:
  • fix(tui): double file content injection in commands using $ARGUMENTS (#31245)
• @arvsrn:
  • feat(app): update oc-2 colors (#31071)
• @Slickstef11:
  • docs: update North Mini Code privacy terms (#32096)
• @santigc6:
  • feat(opencode): add external browser OAuth for snowflake cortex provider (#31700)
• @OpeOginni:
  • fix(opencode): add authorization header to fetch requests in RunCommand (#29877)

Apple launched three new Macs earlier this year, but there are another four Macs rumored to debut throughout the remainder of the year. Here’s what’s coming.

macOS is designed to put your Mac to sleep when it is not being used. That is usually exactly what you want. Sleep saves power, protects battery life, and keeps a MacBook from running when it is closed and stuffed in a bag.

Sometimes tasks like downloads, backups, remote sessions, and AI coding need a temporary exception. Fortunately, there are some great Mac apps for giving you this control.

Improvements

• Added cwd support for local MCP servers so they can start from a workspace-relative directory. (@Grantmartin2002)
• Added connector-based authentication flows and support for stored provider credentials.
• Added v2 API endpoints to create and fetch sessions, list session questions, and resolve the active location.
• File reads now return raw content with the correct content type for API and SDK clients.
• MCP server log notifications are now surfaced in opencode logs.

Bugfixes

• Fixed Gemini tool schemas that used multi-type fields so compatible tools keep working. (@Killusions)
• Content-filtered model responses now surface as visible errors instead of failing silently. (@kkdawkins)
• Fixed MCP auth and debug requests dropping configured headers.
• Snapshot creation now reuses source Git objects to avoid long re-hashing delays on huge repos. (@dmtrKovalenko)
• Fixed MCP catalog request timeouts not applying when listing prompts, resources, or tools.

Thank you to 5 community contributors:

• @dmtrKovalenko:
  • fix(snapshot): reuse source git objects to avoid re-hashing huge repos (#31798)
• @tobwen:
  • fix(tui): preserve exit epilogue during scoped shutdown (#31805)
• @kkdawkins:
  • fix(opencode): surface content-filter finish reason as visible error (#31745)
• @Killusions:
  • fix(gemini): prevent gemini incompatibility with some tools (#31877)
• @Grantmartin2002:
  • feat(opencode): support cwd on local MCP servers (#30676)

This Week in Rust is openly developed on GitHub and archives can be viewed at this-week-in-rust.org. If you find any errors in this week's issue, please submit a PR.

Want TWIR in your inbox? Subscribe here.

Updates from Rust Community

Official

• How Josh helps Rust manage code across multiple repositories
• Maintainer spotlight: Tiffany Pek Yuan (@tiif)

Newsletters

• This Month in Rust OSDev: May 2026
• The Embedded Rustacean Issue #73

Project/Tooling Updates

• Announcing stdx, Rust's extended standard library
• OmniScope 0.2.0 released:FFI static detection tool based on LLVM IR
• Announcing Asterinas 0.18.0
• Oryxis SSH 0.8: split panes
• Ratatui 0.30.1 is released - a Rust library for cooking up terminal user interfaces
• @utoo/pack: A Next-Generation Build Tool Based on Turbopack
• Pico de Gallo - a USB-attached protocol bridge for developing embedded-hal drivers on your laptop
• kache 0.5.0: designing a correct compile-cache key
• Announcing smb2: a very fast pure-Rust SMB2/3 client

Observations/Thoughts

• Only Bounds
• Porting our Django backend to Rust improved the infra usage by 90%
• Decimal Crates Comparison and Benchmark | Chinese version
• TeaQL Robot Task Board: a Rust TUI showcase for auditable business workflows
• [video] Rayon is NOT for games - use this instead
• [audio] Veo with Anders Hellerup Madsen and Gorm Casper

Rust Walkthroughs

• [series] Who Runs Your Rust Future? Hands-On Intro to Async Rust
• Extend MySQL Using Rust
• Learn Rust Smart Pointers and Interior Mutability by Building Git Commit Graph Viewer
• heap underflow: classic algorithm solutions in idiomatic Rust, runnable in the browser

Crate of the Week

This week's crate is rustion, a SSH bastion server.

Thanks to handewo for the self-suggestion!

Please submit your suggestions and votes for next week!

Calls for Testing

An important step for RFC implementation is for people to experiment with the implementation and give feedback, especially before stabilization.

If you are a feature implementer and would like your RFC to appear in this list, add a call-for-testing label to your RFC along with a comment providing testing instructions and/or guidance on which aspect(s) of the feature need testing.

No calls for testing were issued this week by Rust, Cargo, Rustup or Rust language RFCs.

Let us know if you would like your feature to be tracked as a part of this list.

Call for Participation; projects and speakers

CFP - Projects

Always wanted to contribute to open-source projects but did not know where to start? Every week we highlight some tasks from the Rust community for you to pick and get started!

Some of these tasks may also have mentors available, visit the task page for more information.

• cuda-oxide Windows fork - test the Windows MSVC release on more CUDA/Windows setups
• openslate - add unit tests for slugify() in api/src/notes.rs
• openslate - add integration tests for notes CRUD in api/src/notes.rs
• openslate - add integration tests for auth flow in api/src/users.rs
• openslate - add unit tests for build_fts_query() in api/src/search.rs
• openslate - add integration tests for auth middleware and logout in api/src/auth.rs
• openslate - add integration tests for media endpoints (DB layer) in api/src/media.rs
• openslate - add unit tests for ext_from_mime() and filename_from_url() in api/src/media.rs
• reliakit - add a typed_csv example to the umbrella crate
• reliakit - implement CsvField for char
• reliakit - implement CsvField for the core::net address types
• reliakit - write a short "which resilience block do I use?" guide
• reliakit - extract a reusable rolling-window counter from RollingBreaker

If you are a Rust project owner and are looking for contributors, please submit tasks here or through a PR to TWiR or by reaching out on Bluesky or Mastodon!

CFP - Events

Are you a new or experienced speaker looking for a place to share something cool? This section highlights events that are being planned and are accepting submissions to join their event as a speaker.

If you are an event organizer hoping to expand the reach of your event, please submit a link to the website through a PR to TWiR or by reaching out on Bluesky or Mastodon!

Updates from the Rust Project

526 pull requests were merged in the last week

Compiler

• add extern "tail" calling convention
• add very basic "comptime" fn implementation
• avoid unreachable_code on required return values
• cleanup and optimize render_impls
• macros: report unbound metavariables directly
• rewrite rustc_span::symbol::Interner to avoid double hashing
• staticlib hide internal symbols

Library

• add APIs for case folding to the standard library
• add _value API for number literals in proc-macro
• further optimize SliceIndex<str> impl for Range<usize>
• improve TLS codegen by marking the panic/init path as cold
• perf: use get_unchecked for TwoWaySearcher
• stabilize PathBuf::into_string
• stabilize Result::map_or_default and Option::map_or_default

Cargo

• strip CR from cargo:token-from-stdout

Rustdoc

• IXCRE: preserve sizedness bounds on type params belonging to the parent item
• don't link doc(hidden) associated type projections
• fix trait impl ordering
• render impl restriction

Clippy

• support iter_mut in ITER_NEXT_SLICE
• borrowed_box: clean-up, improve suggestion message
• double_must_use: make the lint machine-applicable in single-attribute case
• iter_cloned_collect: split off the suggestion from the main message
• add manual_isolate_lowest_one lint
• detect more ranges in single_range_in_vec_init
• do not trigger inline_trait_bounds on auto-derived code
• extend extra_unused_lifetimes for spurious for<'a>
• large_const_arrays: check nested large arrays
• fix explicit_counter_loop false positive when the counter is only modified inside the else block of let...else binding
• fix result_large_err and result_unit_err not triggering on async functions
• fix unused_async_trait_impl suggestions with return statements
• fix lints duplications in unknown_attribute and renamed_builtin_attr
• obtaining the metadata of a const pointer is a const operation
• perf: avoid cloning associated items in empty_line_after
• perf: skip the boxed_local walk for functions without a Box parameter
• perf: skip the inline_always relevance walk for items without the attribute

Rust-Analyzer

• feat(diagnostics): emit error for infer vars in non-inference contexts
• adopt uv's AI policy
• distribute windows builts with mimalloc
• lower field defaults to rustc_type_ir::Consts
• RunnableKind::Test should map to project_json::RunnableKind::TestOne
• extract_function misses &mut for container[i].mut_method()
• do not emit a "type annotations needed" error on include_bytes!() where the array length cannot be inferred
• no generate unused generic params in trait sign
• parse OR pattern types
• rename schema subItems with sub_items
• implement rust-analyzer/evaluatePredicate lsp extension
• parse unnamed enum variants

Rust Compiler Performance Triage

A fairly noisy week, with a bunch of small regressions contained within, leading to a slight increase on average in instruction counts. This week had a lot of large rollups, likely due to some CI problems, but thankfully many of those came with pre-triaged perf results by the time (thank you to those triagers!). Roughly similar slight regressions for cycles and wall times across the week.

Triage done by @simulacrum. Revision range: 4804ad7e..f3ef3bd8

2 Regressions, 0 Improvements, 10 Mixed; 5 of them in rollups 32 artifact comparisons made in total

Full report here

Approved RFCs

Changes to Rust follow the Rust RFC (request for comments) process. These are the RFCs that were approved for implementation this week:

• #![register_{attribute,lint}_tool]

Final Comment Period

Every week, the team announces the 'final comment period' for RFCs and key PRs which are reaching a decision. Express your opinions now.

Tracking Issues & PRs

• Document panic in RangeInclusive::from(legacy::RangeInclusive)
• Tracking Issue for explicit-endian String::from_utf16
• Tracking Issue for substr_range and related methods
• Decide and document where stdarch intrinsics are allowed to diverge from asm behavior
• Document that ManuallyDrop's Box interaction has been fixed
• Add temporary scope to assert_eq and assert_ne
• Clean up crate type names to fix dylib vs staticlib confusion
• Add T: PartialEq bounds to derived StructuralPartialEq impls.
• stabilize feature float_algebraic

• Deny todo!() in tidy

• Rust All Hands 2027

No Items entered Final Comment Period this week for Rust RFCs, Cargo, Language Team, Language Reference or Unsafe Code Guidelines.

Let us know if you would like your PRs, Tracking Issues or RFCs to be tracked as a part of this list.

New and Updated RFCs

• RFC for convenient, explicit closure capture using move($expr) expressions

Upcoming Events

Rusty Events between 2026-06-10 - 2026-07-08 🦀

Virtual

• 2026-06-10 | Virtual (Girona, ES) | Rust Girona
  • Weekly coding session
• 2026-06-12 | Virtual (Kenya, KE) | RustaceansKenya
  • RUST FOR CIVIC TECH
• 2026-06-16 | Virtual (Washington, DC, US) | Rust DC
  • Mid-month Rustful
• 2026-06-17 | Hybrid (Vancouver, BC, CA) | Vancouver Rust
  • Rust Study/Hack/Hang-out
• 2026-06-17 | Virtual (Girona, ES) | Rust Girona
  • Weekly coding session
• 2026-06-18 | Hybrid (Seattle, WA, US) | Seattle Rust User Group
  • June, 2026 SRUG (Seattle Rust User Group) Meetup
• 2026-06-18 | Virtual (Berlin, DE) | Rust Berlin
  • Rust Hack and Learn
• 2026-06-21 | Virtual (Dallas, TX, US) | Dallas Rust User Meetup
  • Rust Deep Learning: Third Sunday
• 2026-06-23 | Virtual (Dallas, TX, US) | Dallas Rust User Meetup
  • Fourth Tuesday
• 2026-06-23 | Virtual (London, UK) | Women in Rust
  • Lunch & Learn: What the heck are monads - and how do we fake them in Rust
• 2026-07-01 | Virtual (Indianapolis, IN, US) | Indy Rust
  • Indy.rs - with Social Distancing
• 2026-07-02 | Virtual (Berlin, DE) | Rust Berlin
  • Rust Hack and Learn
• 2026-07-02 | Virtual (Nürnberg, DE) | Rust Nuremberg
  • Rust Nürnberg online
• 2026-07-05 | Virtual (Dallas, TX, US) | Dallas Rust User Meetup
  • Rust Deep Learning: First Sunday
• 2026-07-07 | Virtual (London, GB) | Women in Rust
  • 👋 Community Catch Up

Europe

• 2026-06-10 | Köln, DE | Rust Cologne
  • Rust in June: Speedy Rust
• 2026-06-10 | München, DE | Rust Munich
  • Rust Munich 2026 / 2 - Hacking Evening
• 2026-06-11 | Berlin, DE | Rust Berlin
  • Rust Berlin on location 🏳️‍🌈 - Edition 014
• 2026-06-11 | Switzerland, CH | PostTenebrasLab
  • Rust Meetup Geneva
• 2026-06-12 - 2026-06-14 | Kraków, PL | Rustmeet
  • Rustmeet
• 2026-06-16 | Leipzig, DE | Rust - Modern Systems Programming in Leipzig
  • Interactive: Everything is Open Source
• 2026-06-16 | Milano, IT | Rust Language Milan
  • Real-time planning in Rust: SolverForge & SERIO
• 2026-06-18 | Aarhus, DK | Rust Aarhus
  • Talk Night at Danske Commodities
• 2026-06-18 | Barcelona, ES | BcnRust
  • 21st BcnRust Meetup
• 2026-06-19 | Dresden, DE | Rust Dresden
  • Second Meetup
• 2026-06-23 | Paris, FR | Rust Paris
  • Rust meetup #86
• 2026-06-23 | Warsaw, PL | Rust Warsaw
  • Rust Warsaw Meetup: June 2026
• 2026-06-25 | Berlin, DE | Rust Berlin
  • Rust Berlin Talks: The next generation
• 2026-07-02 | Edinburgh, GB | Rust and Friends
  • Bevy, Bits, & Cats (Rust July Talks)
• 2026-07-02 | Enschede, OV, NL | Baseflow Tech Meetups
  • AI Summit
• 2026-07-08 | Dublin, IE | Rust Dublin
  • Join us live and INPERSON for Rust 261

North America

• 2026-06-11 | Lehi, UT, US | Utah Rust
  • Utah Rust June Meetup
• 2026-06-11 | Mountain View, CA, US | Hacker Dojo
  • RUST MEETUP at HACKER DOJO
• 2026-06-11 | San Diego, CA, US | San Diego Rust
  • San Diego Rust June Meetup - Back in person!
• 2026-06-16 | San Francisco, CA, US | San Francisco Rust Study Group
  • Rust Hacking in Person
• 2026-06-16 | San Francisco, CA, US | San Francisco Rust Study Group
  • Rust Hacking in Person
• 2026-06-17 | Hybrid (Vancouver, BC, CA) | Vancouver Rust
  • Rust Study/Hack/Hang-out
• 2026-06-18 | Hybrid (Seattle, WA, US) | Seattle Rust User Group
  • June, 2026 SRUG (Seattle Rust User Group) Meetup
• 2026-06-24 | Austin, TX, US | Rust ATX
  • Rust Lunch - Fareground
• 2026-06-24 | Los Angeles, CA, US | Rust Los Angeles
  • Rust LA: Rust-Based Constraint Solvers in 2D Sketching with Zoo Technologies
• 2026-06-25 | Atlanta, GA, US | Rust Atlanta
  • Rust-Atl
• 2026-06-26 | New York, NY, US | Rust NYC
  • Rust NYC's Big Summer Social
• 2026-07-02 | Saint Louis, MO, US | STL Rust
  • Git is easy?

Oceania

• 2026-06-11 | Brisbane City, QL, AU | Rust Brisbane
  • Rust Brisbane • June 2026
• 2026-06-25 | Melbourne, AU | Rust Melbourne
  • Rust Melbourne June 2026

South America

• 2026-06-18 | Florianópolis, BR | Rust SC
  • Rust Floripa

If you are running a Rust event please add it to the calendar to get it mentioned here. Please remember to add a link to the event too. Email the Rust Community Team for access.

Jobs

Please see the latest Who's Hiring thread on r/rust

Quote of the Week

It's a footgun, yes, but it's a sound footgun.

– Prof. Dr. Ralf Jung on github

Thanks to Theemathas for the suggestion!

Please submit quotes and vote for next week!

This Week in Rust is edited by:

• nellshamrell
• llogiq
• ericseppanen
• extrawurst
• U007D
• mariannegoldin
• bdillo
• opeolluwa
• bnchi
• KannanPalani57
• tzilist

Email list hosting is sponsored by The Rust Foundation

Discuss on r/rust

Signed-off-by: Leonardo Di Giovanna <leonardodigiovanna1@gmail.com>

Signed-off-by: Leonardo Di Giovanna <leonardodigiovanna1@gmail.com>

Improvements

• Faster file search across large projects with the new fff-backed search tools. (@dmtrKovalenko)
• Added X-Session-Id headers for proxy setups that need sticky routing. (@songchaow)
• Added Cohere North model support.
• Added reasoning as an interleaved field option for vLLM providers. (@delta9000)
• mcp add now works in non-interactive flows.
• auth logout now supports search when choosing an account.

Bugfixes

• Improved MCP connection status messages so failures are easier to act on.
• Added Claude Fable reasoning support.
• MCP tool calls now receive abort signals, so cancellations stop more reliably.
• MCP catalogs now paginate correctly instead of truncating larger lists.
• OpenRouter reasoning variants now generate for all models. (@AnthonyMLau)
• Added MiniMax M3 thinking toggle support.
• Java multi-module Maven workspaces now resolve JDTLS from the topmost pom.xml. (@areyouok)
• MCP servers now respect advertised capabilities.
• Session lists now respect directory filters in workspace setups. (@rexdotsh)
• Sessions can recover once from provider context-overflow errors instead of failing immediately.
• Bedrock Mantle config now honors configured API key and region settings.

TUI

Improvements

• The session move flow now highlights project copies more clearly and keeps the current location selected.
• Project copies can now be deleted directly from the move dialog.

Bugfixes

• New project copies are now bootstrapped before the TUI switches into them.
• Moving a session now injects a reminder about the new working directory.

Desktop

Improvements

• Added a help button to the tabs bar.
• Prompt drafts are preserved while you switch tabs.
• File attachments now open in the active project.
• App updates now stay responsive and persist across restarts.
• Added WSL-backed Desktop support and WSL server management on Windows.
• Improved the sessions list UI. (@arvsrn)
• Improved the servers UI. (@arvsrn)

Bugfixes

• Updated Electron and fixed related panel layout issues.
• Fixed several WSL Desktop bugs. (@neriousy)
• Hidden agents no longer get cycled accidentally.
• MCP status now refreshes when the active directory changes.
• The Home screen now keeps a larger recent-session list with scrolling.

SDK

Improvements

• Large v2 tool outputs are now bounded and expose retained output paths for follow-up inspection.

Thank you to 11 community contributors:

• @rexdotsh:
  • fix(session): respect directory filter with workspaces (#30804)
• @arvsrn:
  • feat(app): improve servers UI (#30961)
  • feat(app): updates to project avatar (#30964)
  • feat(app): sessions list improvements (#30941)
• @dmtrKovalenko:
  • feat(opencode): fff search tools (#27802)
• @fancive:
  • docs: fix MCP header interpolation example to {env:VAR} (#31078)
• @robertDouglass:
  • fix(tui): sort connect providers alphabetically (#30891)
• @neriousy:
  • fix(desktop): few WSL bugs (#31095)
• @areyouok:
  • fix(lsp): resolve JDTLS root to topmost pom.xml in Java Maven multi-module projects (#28761)
• @remorses:
  • fix(session): merge per-call tool rules into session permission (#30529)
• @AnthonyMLau:
  • fix(opencode): generate reasoning variants for all OpenRouter models. (#30332)
• @delta9000:
  • feat: add "reasoning" as interleaved field option for vLLM providers (#30477)
• @songchaow:
  • feat: add X-Session-Id header for proxy cache routing affinity (#31511)

macOS 26 Tahoe made some polarizing design choices that evoked strong responses from critics. While the new design in macOS 27 Golden Gate is still all about Liquid Glass, Apple’s new Mac operating system corrects a lot of the mistakes Tahoe made.

Google Gemini for macOS was recently flagged for not being a very good app citizen on the Mac. Apple’s new macOS 27 Golden Gate seems to make an example out of apps like Gemini that sneakily run in the background after a user quits the software.

Today during its WWDC keynote, Apple unveiled the Mac’s next major software version: macOS Golden Gate. Here’s the full list of Mac models compatible with the update.

Fixed

• Fixed MiniMax-compatible OpenAI-completions hosts (e.g. minimax-code-cn/MiniMax-M3) losing tool-call arguments when the stream delivers function.arguments as a complete object instead of the OpenAI JSON-string contract. The streaming buffer previously concatenated the object into a string, coercing it to [object Object] and leaving bash/edit calls with empty or malformed inputs; the tool-call block now holds the object payload directly. (#1776)
• Fixed Cloud Code Assist (Gemini / Antigravity) rejecting tool schemas with Invalid JSON payload received. Unknown name "propertyNames" (HTTP 400) when a tool exposed a property literally named properties (e.g. the Resend MCP create_contact tool). The schema normalizer's insideProperties flag was re-asserted when descending into such a property's value schema, so Google-unsupported keywords (propertyNames, additionalProperties, …) nested inside it were never stripped. The flag is now only set when entering a real properties map from a schema node, not from within another properties map.
• Fixed local/self-hosted providers leaking machine-specific endpoints into the bundled models.json. A generate-models run on a machine with a LiteLLM proxy baked 1202 litellm models pinned to http://localhost:4000/v1 into the committed catalog. litellm (and lm-studio) now join ollama/vllm in the generator's discovery-only exclusion set, so local providers are never fetched during generation nor written to models.json — they are discovered dynamically at runtime instead. LiteLLM model discovery now enriches metadata against models.dev (the same reference source the other gateway providers use) rather than a bundled reference map. Added a regression test pinning the invariant (no local provider blocks, no loopback/private-network baseUrls in the bundled catalog).

@oh-my-pi/pi-coding-agent

Breaking Changes

• Removed synchronous readTextSync from SessionStorage and core implementations (MemorySessionStorage, FileSessionStorage, RedisSessionStorage, SqlSessionStorage), requiring callers to use async text reads
• Replaced the public SessionStorage readTextPrefix(path, maxBytes) and readTextSuffix(path, maxBytes) methods with readTextSlices(path, prefixBytes, suffixBytes): Promise<[string, string]>; custom session storage backends must implement the new combined slice API.

Added

• Added env-driven OpenTelemetry trace export. When OTEL_EXPORTER_OTLP_ENDPOINT (or OTEL_EXPORTER_OTLP_TRACES_ENDPOINT) is set, omp registers a global OTLP/proto trace exporter and switches on the agent loop's telemetry, so the invoke_agent / chat / execute_tool spans actually reach a collector instead of a no-op tracer. Honors the standard OTEL_* env contract (endpoint, headers, OTEL_SERVICE_NAME, OTEL_SDK_DISABLED and OTEL_TRACES_EXPORTER=none parsed case-insensitively) and the OTEL_INSTRUMENTATION_GENAI_CAPTURE_MESSAGE_CONTENT capture toggle; it is a no-op when no endpoint is configured. Only the http/protobuf transport is supported — a grpc or http/json OTEL_EXPORTER_OTLP*_PROTOCOL declines rather than misrouting spans. This makes the existing telemetry usable from headless hosts that run omp as a spawned child process, where an in-process TracerProvider registered by the parent can't reach the child. Uses the @opentelemetry/exporter-trace-otlp-proto 2.x line, which exports cleanly under Bun.

Fixed

• Fixed the status line session name (and the editor border / status-line gap fill) being nearly illegible on light themes.
• Added IndexedSessionStorage and SessionStorageBackend exports to support shared metadata-indexed session backends
• Added the tui.maxInlineImages setting (default 8) capping how many inline images render as live terminal graphics. Once a new image pushes the count past the cap, the oldest images are hidden via a full redraw — replaced by their [Image: …] text placeholder and purged from the terminal's graphics store — so long sessions with many screenshots/diagrams stop piling up images (and, on Kitty, stop leaving scrollback ghosts). Set to 0 to keep every image inline.
• Added a "View: terminal state" item to the /debug menu that prints the detected terminal, live geometry and cell size, multiplexer, and the negotiated subprotocols actually in use — graphics (Kitty/iTerm2/Sixel), desktop notifications (BEL/OSC 9/OSC 99, plus whether OSC 99 was confirmed via a device-attributes probe), OSC 8 hyperlinks, 24-bit color, DECCARA rectangular-SGR background fills, and DEC 2026 synchronized output — alongside the scrollback-clear strategy (CSI 22 J vs CSI 2 J redraw / ED3 eager-erase risk) and the raw TERM/TERM_PROGRAM/COLORTERM detection signals.
• Added a "Test: terminal protocols" item to the /debug menu that renders one live sample of every special escape protocol the renderer can emit — SGR text attributes (bold/italic/underline/strikethrough/inverse/dim), themed and 24-bit truecolor, OSC 8 hyperlinks, OSC 66 text sizing (large text), and an inline graphics swatch via the active image protocol (Kitty/iTerm2/Sixel, with a text fallback) — and fires a desktop notification, so you can eyeball which protocols the current terminal actually honors. The sample image is a gradient PNG generated in-process, so the graphics test needs no asset on disk.
• Added the tui.textSizing setting (default off) that renders Markdown H1 headings at 2x scale via Kitty's OSC 66 text-sizing protocol. It replaces the undocumented PI_TUI_TEXT_SIZING env var with a real setting, and only takes effect on Kitty terminals (where OSC 66 is implemented) — it is ignored everywhere else so headings never emit raw escape bytes.
• Added a lifecycle status to the /resume session picker. Each session's tail (last 32 KiB) is now read alongside the existing header window in a single pass, and its final message classified as done (the agent ended its turn and yielded control back), interrupted (a trailing tool call or tool result the loop never continued from), aborted, error, or pending (a trailing user message with no reply). The status renders as a colored segment on each session's metadata line. When the final message is larger than the tail window the status is omitted rather than guessed.
• Added support for disable-model-invocation: true frontmatter field from the Agent Skills standard. Skills using this field are now hidden from the system prompt listing, matching the behavior of hide: true.

Changed

• Changed the task tool description to tag read-only agents and explicitly forbid assigning them file edits/commands or offloading reasoning to quick_task/explore.
• Changed Redis and SQL session storage initialization to load only indexed metadata (size, mtimeMs) instead of full session content
• Changed SessionStorage read paths to rely on backend-backed metadata/indexed storage, so session content is fetched on demand rather than cached as full in-memory mirrors
• Changed session-list slice reads to go through SessionStorage.readTextSlices across all backends, removing the file-only single-open branch and caller-managed buffers. FileSessionStorage now reads both windows via peekFileEnds, while Redis and SQL backends encode session content once per combined read.
• Changed the ask tool transcript renderer to mark single-choice questions with circular radio glyphs (○/◉) instead of the rectangular checkbox glyphs (☐/☑) it shares with multi-select questions, so a "pick one" combo box visually reads as a radio group rather than a checklist. Multi-select questions keep checkboxes. Added a radio.selected/radio.unselected symbol pair across the unicode, nerd-font, and ASCII presets.
• Changed the ask tool transcript renderer to mark the chosen answer inside the question form rather than re-listing the questions in a detached summary block below it. Once a question is answered, the standalone prompt preview is dropped and the result redraws the same form — every offered option still shown, with the selected one(s) filled in (◉/☑, highlighted) and the rest dimmed (○/☐); custom free-text answers and cancellations render in place as the final entry. This removes the duplicate question/option listing that previously appeared once as the call preview and again as the result.
• Changed task-completion and ask desktop notifications to structured terminal notifications (title, body, type, and a focus-on-click action). On Kitty these render through OSC 99 as a proper title/body with click-to-focus; terminals without confirmed OSC 99 support collapse them to the previous single-line message (BEL/OSC 9).
• Updated the "each kitty/tmux split" tip to include cmux.

Fixed

• Fixed tiny-model startup in compiled binaries by resolving @huggingface/transformers and its runtime dependencies from the installed cache using package.json exports/main metadata, preventing module-resolution failures when launching models
• Fixed tiny runtime installation flow in compiled binaries by using the build-time resolved @huggingface/transformers version and ensuring the runtime lock directory’s parent exists before acquiring the install lock, preventing mismatch and setup failures on fresh installs
• Fixed the terminal protocol debug probe reusing one stable Kitty graphics id across repeated panels, which could move/replace an earlier swatch instead of rendering a new one.
• Fixed selector dialogs (the ask tool, hook prompts) collapsing to a single visible option on shorter terminals when options carried long descriptions: the highlighted option's wrapped description consumed the entire row budget, hiding every other option and making the menu feel unnavigable (down moved the lone visible entry, left/right did nothing). When the fully-expanded list overflows, HookSelectorComponent now renders a compact list — every option label stays on screen and only the highlighted option expands its description, truncated to the remaining rows — so the whole menu is always visible and the detail pane follows the cursor.
• Fixed read failing with "Path not found" on web URLs whose scheme // collapsed to a single / (e.g. https:/github.com/...), which happens when a URL is routed through Node's path.normalize/path.resolve. The fetch URL recognizer now accepts a single-slash scheme and repairs it back to // before fetching, so collapsed URLs resolve instead of falling through to filesystem lookup.
• Fixed subagent slow-model priority falling through to older Claude Opus aliases when Opus 4.8 is available by adding Opus 4.8 and 4.7 aliases ahead of older Opus fallbacks (#1753).
• Fixed the web-search provider selectors in TUI settings/setup to derive from the shared provider metadata, so newly added providers cannot be omitted from the preference list.

@oh-my-pi/pi-natives

Fixed

• Bounded sorted glob() scans to maxResults during uncached traversal and emitted onMatch callbacks only for entries admitted to the bounded top-maxResults heap so broad OMP find progress and timeout partials stay consistent with the returned mtime-ranked set while keeping parent-process memory bounded (#1761).
• Fixed wrapTextWithAnsi hanging (infinite loop) on text containing a BEL-terminated string escape — DCS/SOS/PM/APC (ESC P/ESC X/ESC ^/ESC _) closed by BEL instead of ST. ansi_seq_len_u16 only accepted the ST (ESC \) terminator for these (OSC already accepted both), so a BEL-terminated APC such as the TUI cursor marker (ESC _ pi:c BEL) was left unclassified: it was miscounted as visible width and break_long_word's non-ESC scan could not advance past the ESC, spinning forever. The terminator set now matches OSC (ST or BEL), and break_long_word defensively emits and steps over any escape it cannot classify so a malformed/unknown sequence can never wedge the wrap loop.

@oh-my-pi/swarm-extension

Fixed

• Fixed swarm /swarm run failing with authStorage/modelRegistry identity error (#1472)

@oh-my-pi/pi-tui

Added

• Added Kitty CSI 22 J screen-to-scrollback clears for non-destructive full paints, while keeping ED3 for destructive history/session rebuilds.
• Added Kitty OSC 99 rich notification formatting and startup capability probing.
• Added Kitty OSC 66 text-sized Markdown H1 headings (2x scale) plus native text-width support for OSC 66 spans. Off by default and gated to Kitty (the only terminal implementing OSC 66) via the TERMINAL.textSizing capability; hosts enable it through setTextSizing.
• Added Kitty Unicode placeholder image rendering (U=1 + U+10EEEE with explicit row/column diacritics): inline images are drawn as real text cells that carry the image id in their foreground color, so they survive horizontal slicing, reflow, and overlapping draws instead of relying on cursor-positioned a=p placements. Enabled by default on Kitty-family terminals; opt out with PI_NO_KITTY_PLACEHOLDERS=1, and falls back to direct placement when a grid exceeds the diacritic table's addressable range.
• Added Kitty temp-file image transmission (t=t): on local sessions, decoded PNG bytes are written to a tty-graphics-protocol temp file and the path is sent instead of in-band base64, gated behind a startup a=q,t=t support probe. Controlled by PI_KITTY_IMAGE_TRANSMISSION=direct|temp-file|auto; disabled over SSH unless explicitly forced.
• Added DECRQM capability detection for DEC private modes 2026 (synchronized output) and 2048 (in-band resize). Synchronized-output paint wrappers are dropped when the terminal reports 2026 unsupported (preserving the PI_NO_SYNC_OUTPUT override), and DEC 2048 in-band resize is enabled when supported — reported geometry and cell pixel size are updated from CSI 48 ; rows ; cols ; yPx ; xPx t reports, with SIGWINCH and CSI 16 t kept as fallbacks.
• Added an injectable render scheduler for TUI tests, allowing deterministic render drains without patching global clocks or event-loop timing.
• Added ImageBudget, an inline-image cap that keeps only the most recent N images as live terminal graphics and demotes older ones to their text fallback. Once a new image pushes the count past the cap, the renderer hides the oldest via a full redraw plus an explicit Kitty graphics purge (a=d,d=I) — text-clear escapes (CSI 2 J/CSI 3 J) do not remove Kitty images. Configure the cap via TUI#setMaxInlineImages (0 disables it).
• Changed Kitty inline images to a transmit-once + placement scheme: the base64 data is sent a single time (a=t) keyed by a stable image id, then every repaint emits only the tiny placement (a=p,i=…,p=…). Repaints — including full redraws — no longer re-send image data or stack duplicate placements, and the diff/line buffers and render caches hold short placement strings instead of multi-KB base64. The ImageBudget doubles as the transmit store (it tracks which ids are loaded and re-transmits after a purge frees the data). iTerm2/Sixel, which have no addressable image store, keep sending inline data as before.
• Added a renderer-level DECCARA rectangular-SGR optimizer that paints solid background panels/rows (Box/Text/Markdown fills, status bars, any full-width theme.bg row) as a single coalesced rectangle escape (CSI 2*x / CSI Pt;Pl;Pb;Pr;<sgr>$r / CSI *x) instead of emitting a full-width run of background-styled spaces on every visible row. It operates at emit time on the final ANSI strings — components are unchanged — and strips only trailing padding it can prove sits under a single non-default background span, coalescing vertically adjacent identical fills into one rectangle and falling back to the original bytes whenever the rectangle would not save bytes. Enabled only on Kitty, which implements the SGR-background extension (docs/deccara.rst); Ghostty is intentionally excluded because its CSI $r is unimplemented (ghostty-org/ghostty#632) and would drop the background entirely. Scrollback-bound rows and the append/scroll paths always keep the padded representation so native history preserves colored cells, and the PI_NO_DECCARA kill switch (plus tmux/screen/zellij detection) forces the fallback.
• Added CMUX_SURFACE_ID environment variable support to getTerminalId(), so cmux terminal surfaces get a stable identifier alongside kitty, tmux, macOS Terminal.app, and Windows Terminal — enabling per-surface session breadcrumbs for omp -c in cmux.

Changed

• Changed TUI tests to use Ghostty's VT engine (ghostty-web) instead of @xterm/headless.
• Changed the default inline-image live graphics budget from 3 to 8 images.

Fixed

• Fixed the DECCARA background-fill optimizer rejecting or repainting the wrong cells when a trailing fill crossed from default-background spaces into colored spaces.

• Fixed DEC private-mode reports with DECRPM status 3/4 being treated as unsupported, so permanent 2026/2048 reports stay recognized.

• Fixed OSC 66 text-sizing width and slicing edge cases, including ZWJ emoji payloads and partial slices through scaled spans.

• Fixed focused Input components following TUI#setShowHardwareCursor, so single-line prompts render either the terminal cursor or software cursor consistently with the editor.

• Fixed the DECCARA background-fill optimizer painting fills on the wrong rows ("split into unaligned halves") in the differential repaint path. When a diff grew the transcript past the viewport, writing the rewritten rows scrolled the terminal, but the absolute DECCARA rectangle coordinates were derived from the pre-scroll viewport top, so every fill landed scrollAmount rows too low while the relatively-positioned text settled correctly; rows scrolled into history were also shortened, dropping their background padding from native scrollback. Rectangles now target the post-scroll rows and only rows remaining in the final viewport are optimized.

• Fixed native scrollback desynchronization after terminal width or height changes reflowed overflowing content while the viewport was not at the bottom

• Fixed a notification chip (or any injected block) rendering on top of an actively streaming tool render on ED3-risk terminals (Ghostty/kitty/Alacritty/iTerm2). While a foreground tool streams, its header's elapsed-time counter ticks every frame; once output scrolls the header above the viewport top, each tick is an offscreen edit that — because the eager scrollback-rebuild opt-in is gated off on these terminals — repaints the viewport in place and advances the rendered line count without committing the new overflow to native history. #scrollbackHighWater then lagged the logical viewport top, so a later content shrink whose changes landed in the visible region slipped past the shrink-across-boundary guard and reached the differential emitter, which is anchored to #maxLinesRendered - height: it rewrote only the suffix, dropped the newly exposed top row, and left a blank at the bottom, drifting every row below the edit one line up so it painted over the rows above. Such shrinks now re-anchor the bottom of the viewport with a non-destructive repaint, and the foreground-streaming shrink-across-boundary case repaints the live tail instead of padding and pinning the pre-shrink viewport.

• Fixed a terminal resize during foreground-tool streaming on an unknown-viewport / ED3-risk host (Ghostty/kitty/Alacritty/iTerm2/WSL) leaving native scrollback permanently out of sync, so scrolling back after the turn showed missing rows. A pure geometry resize (no content change) takes the in-place viewport-repaint path, which — unlike a content-bearing resize that rebuilds via the geometry branch — never flagged native history. Because the prompt-submit checkpoint (refreshNativeScrollbackIfDirty) only rebuilds when scrollback is marked dirty on these hosts, the discrepancy was never reconciled. Overflowing geometry repaints whose viewport is not known to be at the bottom now mark scrollback dirty so the next checkpoint rebuilds an exact copy of the transcript.

@oh-my-pi/pi-utils

Added

• Added color helpers colorLuma (perceptual luma), relativeLuminance (WCAG, linearized sRGB), and hslToHex to the color utilities. The luminance helpers parse #rgb/#rrggbb hex and 256-color palette indices, returning undefined for unparseable values.

• Added peekFileEnds, a single-open head-and-tail file peek helper that reuses the head bytes for the tail when the file fits the head window.

• Added peekFileTail, the tail mirror of peekFile: reads up to the last maxBytes of a file ending at EOF, reusing the same pooled-buffer strategy (no per-call allocation for small reads).

What's Changed

• fix(search): default paths to workspace root instead of hard-failing by @GratefulDave in #1808
• fix: recognize disable-model-invocation from Agent Skills spec by @fabkho in #1803
• fix(coding-agent/mcp): handle async broken-pipe rejections in stdio transport by @VoidChecksum in #1783
• Fix slow agent Opus priority by @daandden in #1754
• fix(swarm): remove redundant authStorage discovery from swarm pipeline (#1472) by @WodenJay in #1726
• Fix web search provider TUI options by @daandden in #1685
• Add cmux terminal surface detection to getTerminalId by @basedcorp99 in #1702
• fix(natives): bound sorted glob scans by @roboomp in #1762
• fix(tui): cap session accent luminance on light themes by @paweljw in #1715
• feat(coding-agent): env-driven OTLP trace export for headless hosts by @cgreeno in #1797

New Contributors

• @GratefulDave made their first contribution in #1808
• @fabkho made their first contribution in #1803
• @WodenJay made their first contribution in #1726
• @paweljw made their first contribution in #1715
• @cgreeno made their first contribution in #1797

Full Changelog: v15.8.3...v15.9.0

Read more of this story at Slashdot.

BenQ has been making excellent Mac-friendly monitors for years, and their new MA270S is the creme de la creme of their lineup. It’s a 27-inch 5K monitor, but with a feature that most monitors don’t ship with: a glossy finish.

All of Apple’s displays ship with glossy finishes by default, but for one reason or another, matte finishes have dominated the external monitor market – and BenQ is bucking that trend. This makes the MA270S much more at home with the Mac.

A new post on Google’s Chromium blog shares the results of the latest Chrome performance benchmarks, including record scores on tests running on an M5 MacBook Pro. Here are the details.

Back in April, Google joined OpenAI and Anthropic in offering a dedicated Mac app for its AI chatbot software. Two months later, it’s clear that Gemini for Mac isn’t as good as it could be.

At the start of May, OpenAI released a playful feature inside its Codex desktop app for creating a virtual pet.

This silly little addition solved my biggest challenge with Codex: what should I do with it? My first real task with Codex was putting together a virtual Lil Finder Guy for fun.

A month later, I’m using two Mac apps that Codex built at my direction. Toying around with Codex Pets was the gateway for me to better understand its capabilities.

Bugfixes