Dependabot Now Opens Pull Requests for Shared AI Agent Skill Updates via APM

·5 views

Dependabot added support for APM, a Microsoft-published dependency manager for AI agent packages such as skills, prompts, and MCP servers. A tester pinned a shared skill repository to a tagged release in a consuming project and confirmed that a newer tag produced a Dependabot pull request updating the manifest and lockfile. The beta ecosystem required an explicit configuration flag in the tester's GitHub runs as of November 11, 2026, despite the announcement describing general availability. The pull request changed only apm.yml and apm.lock.yaml, leaving the installed skill file untouched until a later install.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Browser-based GIF compression and resizing without uploading files to a server

Chat apps still enforce upload limits on GIFs, and sending clips to online compressors raises privacy concerns. The approach described decodes and re-encodes GIFs entirely inside a browser tab, using a Web Worker to keep the main thread responsive. Memory is managed with a total pixel cap and downscaling for oversized files, while frame delays are clamped to 20 ms to avoid clients playing them slower. Opaque animations are further shrunk by writing only changed pixel regions between frames. To hit byte targets, the tool steps through a fixed sequence of color, scale, and frame reductions until the output fits.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

How an iPhone Microphone Is Turned Into a Decibel Meter

A developer at W Lab describes building Noise Meter, an iPhone app that displays sound levels in decibels and logs them overnight. The core challenge is disabling iOS's default microphone processing, such as gain control and noise suppression, which would distort readings. The app applies standard frequency weightings (A, C, and Z) using filters derived from IEC 61672-1, adapted to the device's sample rate. Measurements are averaged into per-second records that track both energy-based equivalent levels and short-term peaks. The post also explains that dBFS readings must be converted to dB SPL to match standard sound level meter output.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Contao Edit-Multiple Flaw Let Restricted Users Modify Folders Outside Their Filemount

A vulnerability tracked as CVE-2026-126662 in the Contao content management system allows backend users restricted to one filemount to change folders outside that boundary via the Edit-Multiple bulk action. The flaw is an access-control bypass and requires an existing backend account with file-manager permissions. Contao lists affected versions as 4.0.0 before 5.3.54, 5.4.0 before 5.7.17, and 6.0.0 before 6.0.6, with fixes available in the corresponding patched releases. The advisory does not establish that outside files are executable, that anonymous visitors can exploit it, or that exploitation has occurred. Administrators are advised to update, verify restricted-user behavior, review file-change logs, and compare affected folders against trusted backups if the boundary may have been crossed.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Nvidia's ASPIRE Lets Robots Write, Debug and Reuse Their Own Skills

Nvidia researchers, working with several universities, have introduced ASPIRE, a framework that lets robots generate their own control code, detect failures, repair them, and store verified fixes as reusable skills. Unlike most robot learning systems that discard solutions after each task, ASPIRE is designed so that experience accumulates over time. It relies on code-as-policy, where a language model produces Python control programs rather than raw motor commands, making the logic readable and transferable across robot bodies and environments. The system operates in a continuous learning loop supported by fine-grained execution traces that help pinpoint exactly where a multi-step task went wrong. Nvidia released an initial skill library in June 2026 and a broader open-source version, ASPIRE v1.0, in October 2026.

0 comments Read more at DEV Community