Developer ports 30M-download cron library to Go, uncovers bug fuzzing could never catch

·1 views

A developer ported cron-parser, a TypeScript library with roughly 30 million npm downloads per month, to Go over a weekend, producing 2,234 lines of code with zero external dependencies. To verify correctness across two incompatible runtimes, they ran over 36,000 differential tests by treating the original TypeScript test suite as an oracle rather than translating it. Despite thorough fuzzing, a critical bug went undetected: the Go port defaulted to UTC while the TypeScript version inherited the system timezone via Luxon, causing 91 of 130 recorded test cases to silently return wrong results. The fuzzer had missed this entirely because every generated test explicitly supplied a timezone, bypassing the default-timezone code path altogether. The case highlights a structural limitation of differential fuzzing — generated test corpora can only probe assumptions the test author thought to encode, not implicit runtime behaviors.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Transformers 5.15.0 and Meta Muse Glimmer Lead Latest AI Releases

A review of eleven recent AI and agent updates found only two meeting a strict 36-hour recency threshold. Meta Muse Glimmer is a roughly 30-billion-parameter multimodal model released under Apache 2.0, designed for agentic workloads with 4-bit weights reportedly under 20 GB. Hugging Face's Transformers 5.15.0 adds support for Muse Glimmer, FSDP plans across 94 causal-LM classes, batched Omni audio generation, and Tekken tokenizer support. The update also introduces notable breaking changes, including opt-in kernels for linear-attention families and revised cache-cropping behavior using negative offsets. Six additional tools — including SGLang 0.5.17, Anthropic Python SDK 0.121.0, and Pydantic AI 2.27.0 — are flagged for a broader 72-hour watchlist pending further verification.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Engineering Team Shrinks 190 GB Production Database to 45 GB Before Cloud Migration

A software team reduced a production database from 190 GB to 45 GB in a single overnight maintenance window ahead of a cost-sensitive cloud migration. Initial measurements revealed that only 106.7 GB of the 190.6 GB allocated was actually in use, meaning 84 GB was simply unreclaimed empty space from past growth spikes. The team found that the largest storage offenders were not high-row-count tables but blob-heavy tables with relatively few rows, including one configuration table consuming 13 GB across just 21,000 rows. To prevent the transaction log from overwhelming available disk space during bulk deletions, the database was temporarily switched from full to simple recovery mode, keeping log size stable at 6.5 GB throughout the three-hour operation. The team documented six key lessons, emphasizing the importance of measuring allocated versus used space and ranking tables by size in megabytes rather than row count before planning any cleanup.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

How to Secure Your Software Supply Chain With SBOMs, Signing, and SLSA

Most production code consists of third-party dependencies that are trusted by default, making the software supply chain a prime attack vector, as seen in incidents like SolarWinds and the xz backdoor. A Software Bill of Materials (SBOM) provides a machine-readable inventory of every component in a software artifact, enabling faster vulnerability assessment when new CVEs emerge. Code signing and provenance verification — facilitated by tools like Sigstore — help confirm that artifacts are genuine and unmodified throughout the build process. The SLSA framework offers a tiered maturity model for hardening build pipelines, while least-privilege CI practices and dependency hygiene further reduce exposure. Shifting security checks as early as possible in the pipeline — ideally at pull-request stage — significantly reduces the cost and impact of discovering vulnerabilities later in production.

0 comments Read more at DEV Community

ProgrammingHacker News ·

Tail-call optimization in C is relatively recent

Article URL: https://lwn.net/Articles/1034703/ Comments URL: https://news.ycombinator.com/item?id=49242297 Points: 3 # Comments: 0

0 comments Read more at Hacker News