Linux Foundation Launches Akrites to Coordinate Open-Source Vulnerability Fixes

·1 views

The Linux Foundation launched Akrites on June 25, 2026, an initiative designed to coordinate vulnerability discovery, remediation, and disclosure for critical open-source software. The effort brings together a multi-stakeholder coalition of roughly 25 to 30 organizations, including AWS, Google, Microsoft, JPMorganChase, Anthropic, OpenAI, and several open-source foundations. Unlike approaches that measure success by the volume of vulnerabilities reported, Akrites prioritizes ensuring that fixes are implemented upstream and that patches are actually deployed by downstream users. The initiative was formed in response to AI-enabled scanning tools that can rapidly increase the number of potential vulnerabilities requiring assessment, framing this as a coordination challenge rather than purely a discovery problem. Akrites does not introduce a new commercial product or compliance framework, but instead aims to align industry stakeholders around a shared, practical security lifecycle for open-source software.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Common Mem0 Bug Leaks One User's Memories Into Another's Session

A widespread integration error in Mem0-powered AI agents causes user memories to bleed across sessions when the search() function is called without proper identity filters. Developers typically scope memory writes with a user_id but neglect to apply the same filter on read queries, allowing the vector store to return semantically similar results from any user. The bug passes undetected in single-user development environments and only surfaces once multiple real users interact concurrently. Mem0 supports three identity dimensions — user_id, agent_id, and run_id — and failing to apply all relevant filters consistently on both add() and search() calls can expose the wrong memories to the wrong agent or session. The fix requires matching every search() call with the same scoping identifiers used during the original memory write.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Developer Builds GitOps Pipeline to Prevent Accidental Rollback Overwrites

A developer running a home Kubernetes lab discovered a critical process gap after successfully rolling back an app from Version 3 to Version 2: the local YAML configuration file still referenced Version 3, meaning a future deployment could silently undo the fix. To address this, they designed a GitOps workflow where Git serves as the single source of truth for the intended cluster state. Under the new model, CI pipelines can build and propose releases via pull requests, but are explicitly denied Kubernetes credentials and cannot deploy directly to the cluster. A human reviewer merges approved changes into Git, after which Argo CD — a tool running inside the cluster — continuously reconciles the live environment to match the recorded state. This setup ensures that any drift between what is running and what is intended is automatically detected and corrected without relying on manual memory.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

How to Make the Case for AI Agents When You Don't Choose Your Tools

Many professionals lack the freedom to choose their AI tools, instead working with whatever their employer licenses — a reality often overlooked in advice about AI agents. The most common corporate objection to adopting capable AI agents is cost, but the underlying concern is typically data privacy and the risk of sending sensitive information to external providers. Both Anthropic and OpenAI now offer enterprise-tier agreements — including opt-in zero data retention options — that explicitly exclude business API inputs and outputs from model training. The author argues that framing AI adoption as a procurement decision, comparable to existing third-party tools like CRMs or error trackers, is more persuasive than leading with technical capability. A secondary financial argument notes that unused enterprise AI licences already represent a sunk cost, making inaction the more expensive outcome.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

13 Native Browser APIs Now Baseline in 2026, Replacing Common JS Libraries

As of 2026, thirteen web APIs have achieved Baseline status, meaning they are fully supported across all major browsers without polyfills. These native APIs can replace widely used libraries such as Moment.js, Lodash, Axios, UUID, and clipboard.js, potentially eliminating over 115 KB of gzipped bundle weight. Key additions include structuredClone for deep copying objects, crypto.randomUUID for generating unique identifiers, and Intl.RelativeTimeFormat for human-readable relative timestamps. Other notable APIs include the native dialog element for modals, IntersectionObserver for lazy loading, and ResizeObserver for element-level resize detection. Developers are encouraged to audit their dependencies and replace these packages with built-in browser capabilities to reduce bundle sizes and simplify codebases.

0 comments Read more at DEV Community