Stale CDK build files can trick AI tools into recommending deleted infrastructure

·1 views

A developer discovered that CDK monorepos can retain orphaned CloudFormation templates in the cdk.out build directory even after stacks are deleted, because each new synth only writes current templates without removing old ones. Since cdk.out is listed in .gitignore by default, these leftover files are invisible to version control, code reviews, and CI pipelines, making them nearly impossible to detect. An infrastructure drift analyzer running against such a repo falsely flagged deleted resources as 'defined but not deployed,' generating multiple medium-severity findings all confidently citing real file paths on disk. The problem is compounded in monorepos with many stacks, where a single deleted stack can flood the report with one erroneous finding per resource, and orphaned export values can cause downstream stacks to fail silently at deploy time. The bug was fixed and a regression fixture was added after three reports from a user testing the analyzer against a CDK monorepo backed by a shared CloudFront distribution.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Java at 30: How a Consumer Electronics Project Became a Global Programming Language

Java is a high-level, platform-independent programming language built around the principle of 'Write Once, Run Anywhere,' allowing compiled bytecode to run on any compatible Java Virtual Machine. It was created by James Gosling and a team of engineers at Sun Microsystems, a US technology company known for hardware, software, and enterprise computing solutions. Development began in the early 1990s under the Green Project, which initially aimed to build software for consumer electronic devices rather than a general-purpose language. The language was originally named Oak before the project pivoted toward the internet, prompting a rename and significant revision into what became Java. Sun Microsystems was later acquired by Oracle, which now maintains and distributes the Java platform.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Dev Shares Key Lessons From Building and Launching First Chrome Extension

A developer built and published Promo Drop, a free Chrome extension that surfaces verified promo codes and cashback offers for products on Whop, after noticing how difficult such deals were to find. One major technical lesson was adapting to Manifest V3, which replaces persistent background pages with short-lived service workers, requiring all state to be stored externally rather than held in memory. To protect core business logic, the extension was kept deliberately thin, with code-finding functionality handled server-side so the method cannot be reverse-engineered from the client package. The developer also emphasized requesting minimal permissions and writing clear justifications for each, which helped speed up the Chrome Web Store review process. On the ethical side, affiliate attribution was designed to trigger only on genuine user actions, never silently overwriting existing affiliate links or dropping cookies in the background.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

QUASAR Method Cuts LLM Quantization Error by 29% with Minimal Training Overhead

Researchers introduced QUASAR, a new technique targeting a persistent accuracy gap in Quantization-Aware Training (QAT) for large language models, in a paper published in August 2026. QAT simulates quantization during training to outperform post-training methods at low bit-widths, but has long suffered a 'loss floor gap' where models converge to higher-than-optimal loss. QUASAR identifies the root cause as a misalignment between the quantized weights used in the forward pass and the full-precision weights updated by the optimizer. The method addresses this by adding a saliency-weighted reconstruction step inside the training loop, using gradient-based importance estimates to optimally fit dequantization parameters at each step. In testing at 2-bit precision, QUASAR reduced held-out KL divergence by up to 29% while adding only 1.4% to per-step training time.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Developer Builds Preemptive RTOS Kernel for STM32F446RE Microcontroller

A developer has released an open-source, statically allocated, fully preemptive RTOS kernel targeting the STM32F446RE microcontroller based on the ARM Cortex-M4 architecture. The project provides an end-to-end development environment built on CMSIS and STM32F4 HAL drivers, using a Makefile-based build system. The repository is organized into directories for source code, drivers, libraries, binaries, and Renode simulation files. Currently, the kernel lacks synchronization primitives such as queues, mutexes, and thread notifications, though the developer plans to add these features in the future. Renode simulation support is included to allow testing without physical hardware access.

0 comments Read more at DEV Community