Rails and Nuxt Hit by Critical RCEs; MCP 2.0 Drops SSE for Stateless HTTP

·1 views

Two critical remote code execution vulnerabilities were disclosed this week affecting Rails and Nuxt applications running in production, requiring immediate patching. On the protocol side, mcp-handler version 2.0.0 implements the July 2026 MCP specification, replacing HTTP+SSE transport with a stateless Streamable HTTP model suited for serverless environments like AWS Lambda and Cloudflare Workers. The update removes the /sse and /message endpoints entirely, returning 410 Gone, and requires Node.js 20 or later along with a migration to the new MCP server SDK. Separately, AI Gateway is passing through provider-side cost and performance improvements, including an 80% price reduction for Luna tokens and a 2.5x speed boost for Sol's fast mode, with no code changes needed. ThinkingMachines also launched a smaller variant of its Inkling model via AI Gateway, featuring controllable reasoning effort, multimodal support, and an optional Zero Data Retention flag for compliance-sensitive deployments.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

How a Marketplace Buy Box Works and Why Getting It Right Is Hard

A marketplace buy box is the mechanism that selects one winning seller offer to appear on the main 'add to cart' button when multiple sellers list the same product. The winning offer is typically chosen through a sequential set of criteria: stock availability comes first, followed by the lowest price, then seller quality signals such as premium-seller status, and finally a fixed tiebreaker rule. Because most buyers purchase without comparing all available offers, holding the buy box position captures the majority of sales for a given product, making it the most commercially valuable spot on a product page. The selection logic must be fully deterministic — returning the same winner on every page load — since any randomness erodes trust for both buyers and sellers. Poorly designed buy box logic can inadvertently reward the wrong seller behaviour, such as favouring the cheapest seller who is chronically out of stock, while sound logic can push sellers toward better pricing, reliability, and service quality.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

New Metrics CD and RLF Proposed to Fix Cyclomatic Complexity's Testing Blind Spots

A software developer has proposed two new code-quality metrics — Coverage Difficulty (CD) and Responsibility Load Factor (RLF) — to address limitations in the widely used Cyclomatic Complexity (CC) measurement. CC, a heuristic dating to the 1970s, treats nested and parallel branches identically, which can underestimate the actual effort required to write exhaustive tests. CD estimates the true number of test cases needed by multiplying nested branch weights and summing parallel ones, rather than simply counting branch points. RLF is calculated by dividing CD by CC, with values significantly above 1.8 signaling that a function is far harder to test than its CC score suggests. The author also recommends refactoring high-RLF functions into flat lookup tables, a pattern they call Cross-Mapped Programming, to reduce hidden testing complexity.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

How Solana's Account Model Enables Parallel Transactions Unlike Ethereum

Solana processes over 1,000 transactions per second at minimal cost by separating execution logic from data, unlike Ethereum where smart contracts store both together. On Ethereum, this bundled design causes state contention, forcing transactions that touch the same contract to be processed sequentially rather than simultaneously. Solana addresses this through its account model, where executable Programs handle logic while separate non-executable accounts store data. Because each Solana transaction must declare upfront which data accounts it will read or write, the runtime can identify non-overlapping transactions and process them in parallel. This architectural difference is a key reason Solana has gained traction in DeFi and real-world asset tokenization.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Finite State Machines and Zero-Trust Auth Can Make AI Agents More Reliable

Autonomous AI agents often fail in production due to unconstrained behavior, including infinite loops, unauthorized actions, and inconsistent outputs, according to a technical analysis published on tamiz.pro. The piece argues that Large Language Models alone lack built-in mechanisms for strict process control, state management, or secure interaction with external systems. Finite State Machines (FSMs) are proposed as a solution, enforcing deterministic, auditable workflows by restricting agents to well-defined states and transitions at any given moment. Alongside FSMs, the Zero-Trust security model is recommended to govern how agents access resources, applying principles such as least-privilege access and continuous verification. Together, these two paradigms are presented as essential engineering guardrails for building predictable and secure agentic AI systems.

0 comments Read more at DEV Community