Block consolidates 450 repos, Valkey automates backporting

Valkey 9.1 deployed an AI agent to auto‑cherry‑pick bug fixes across its many release branches, wiping out hours of manual backport labor. The bot resolves merge conflicts, runs CI pipelines and frees maintainers to focus on core engineering, boosting reliability for a data store that underpins critical applications.

Block merged roughly 450 JVM repositories into a single monorepo, eliminating version drift across Cash App and Square. The new repo handles about 8,800 weekly builds with a 90th‑percentile CI duration of ten minutes, boosting developer visibility and coordination.

Headlamp 0.43 adds native Windows Arm64 binaries and signed macOS builds, expanding the UI’s reach to developers on more platforms. It also introduces Bengali and other RTL language support, a dry‑run preview for rollbacks, node‑upgrade visualizations, and an alert label editor, tightening operational confidence and usability.

By 2026 a CI/CD breach now averages $5.1 million, so pipelines are the new attack frontier. The post mandates OIDC‑based short‑lived tokens, mandatory SBOMs, SLSA‑Level 3 attestation, and AI‑driven library checks to keep builds immutable and verifiable. Adopt these to turn your delivery chain from liability into a security shield.

Checkmarx’s latest SAST release bundles a rule‑based scanner, a fine‑tuned security LLM, and a Findings Analysis Engine that filters true from false positives before developers see them. The trio claimed a 0.499 F1 score, over twice the category average, and uncovered dozens of bugs missed by leading frontier models. It signals a move from pure AI scanning to AI‑enhanced triage.

Traditional cloud apps grant access once at login, leaving the rest of the session vulnerable. A continuous authorization architecture re‑evaluates permissions on each action using risk‑tiered checks and behavioral baselines, closing the gap for regulated data workloads.