Solana's SIMD-0500 Will Block Immutability for Programs Built on Old Bytecode

·24 views

A forthcoming Solana network change, SIMD-0500, will prevent developers from making older programs immutable if their bytecode is not updated to the current v3 format. The rule, already present in validators as of September 2026 but not yet active on mainnet, causes the SetAuthority instruction to fail for programs running on SBPF versions v0, v1, or v2. This affects a wide range of projects from 2023–2024, including token launches, NFT collections, and small DeFi protocols, that intended to renounce upgrade authority but have not yet done so. To freeze such a program after the gate activates, developers must first rebuild it with a current toolchain, deploy the upgrade, and only then revoke authority — a three-transaction process rather than a single step. A separate but related change under SIMD-0431 also sets a minimum extension size of 10,240 bytes when growing a program-data account via ExtendProgram.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

macOS Builds Hidden Family Relationship Graph on Every Mac

Since macOS 13, Apple's Mac software has run background daemons that construct a detailed graph of a user's relationships, contacts, communications, and movements. Security researchers The Bishop and The Knight found the data stored in plaintext SQLite databases under ~/Library/IntelligencePlatform, with a core triple store holding entity and predicate data along with confidence scores. Machine learning classifiers reportedly infer family roles, such as identifying a partner or child, by combining signals from contacts, photos, and Family Sharing. Their analysis also found that deleted contact information persists in a secondary table for roughly 48 hours. The researchers warn that concentrating this data creates a privacy single point of failure if it were accessed by malicious actors.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Should coding agent rules live in the repo or in the tool?

The article weighs two places to store standing instructions for coding agents: versioned files in the repository or built into the tool itself. Repo-based rules are reviewable, shared across the team, and travel with the codebase, but must be maintained per project. Tool-based rules work everywhere without setup, yet remain invisible to review and can conflict with a specific repo's conventions. The author's tool, Styx, bundles core guidance from several public repositories covering coding, interfaces, design review, and system design. The author argues that when the two sources conflict, the repository's rules should take precedence because it understands the project better than the tool does.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Pydio Cells security review: tokens, workspace access and public shares need separate inventories

Security assessments of Pydio Cells that only examine the login page can miss exposure through personal access tokens and public shares. Pydio documents personal access tokens as a substitute for the standard OAuth flow, and these can be scoped to a specific node, though they do not grant access independently of the user's workspace permissions. The article recommends reviewing each delegation path separately, including OAuth clients, tokens, workspace ACLs and public links, and revoking tokens that lack an owner or documented use. Public links should be inventoried for their creator, target, permission level and expiration, and tested after the creator's access is removed. ZoomEye counts from November 2026 are cited only as leads, since they do not confirm misconfiguration on any host.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Virginia Layoffs Hold Fifth Place Nationally in November WARN Data

Virginia ranks fifth nationally with 2,546 workers in WARN filings over the latest 90-day window, roughly 4% of the nationwide total of 65,089. So far in 2026 the state has logged 67 notices covering 8,394 workers, averaging about 125 workers per filing. That year-to-date figure is already close to 2024's full-year total and sits below 2025's 12,067 workers. Compared with the October 24 snapshot, the 2026 count rose by 659 workers, and 16 notices carry future effective dates. The largest recent filing is The Washington Post's 118-worker cut at its Springfield operation, with an effective date of December 31, 2026.

0 comments Read more at DEV Community