Vite Now Lets Developers Choose Between ESLint and Rust-Based Oxlint at Setup

·1 views

Vite's project scaffolding CLI (create-vite) now prompts developers to choose between ESLint and Oxlint as their linter during project initialization. Oxlint is part of the Oxc (Oxidized Compiler) project and is written in Rust, making it a native executable rather than a Node.js package, which allows for faster startup and parallel execution. Unlike ESLint, Oxlint is designed around zero-config defaults and focuses on catching common bugs, React hook issues, and type safety problems out of the box. Vite does not endorse one tool over the other, but the inclusion of Oxlint reflects a broader frontend ecosystem trend toward native, performance-focused tooling such as SWC, Biome, and Rolldown. Some developers are exploring a hybrid approach — using Oxlint for fast local feedback and pre-commit checks while retaining ESLint in CI/CD pipelines for complex, custom rule enforcement.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Vox Pupuli Launches Public Dashboard Tracking Container Downloads and CVEs

Open-source Puppet community group Vox Pupuli has launched a public statistics page at voxpupuli.org/container_statistics, offering visibility into download counts and security vulnerabilities across its container portfolio. The page is generated automatically every 24 hours using a custom script hosted in the container_statistics GitHub repository and deployed via GitHub Actions to a gh-pages branch. Download figures are scraped from package HTML pages, while CVE data is produced by running two scanners — Trivy and Anchore's Grype — against each container image. Among the most-downloaded containers are openvoxdb and openvoxserver, each exceeding 150,000 pulls, while openvoxserver's latest tag also carries the highest CVE count at 789 total findings. Users can reproduce the statistics locally by running the provided bin/container-statistics script with either a download or CVE report flag.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

AgentForge Adds Three-Layer Error Recovery to Multi-Agent AI Pipelines

The AgentForge team published a technical post on August 8, 2026, detailing how failures cascade in multi-agent AI systems when one agent's timeout can disable dependent agents downstream. To address this, AgentForge implements three recovery layers: automatic retries with exponential backoff, circuit breakers that switch to cached fallback data after repeated failures, and orchestrator-level replanning to skip, substitute, or halt failed agents. The team illustrated the approach with a real incident in which their market data API went down during trading hours, triggering the circuit breaker within one minute and automatically routing the pipeline to a delayed cached feed. A full report was still generated with a data-disclaimer warning, and no manual intervention was required throughout the outage. AgentForge's open-source MVP is available on GitHub, with the team positioning fault tolerance as a built-in default rather than an optional feature.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

How a Hidden Form Wiped a CDN Cache and Led to Stronger CSRF Protection

A PHP video admin panel was vulnerable to Cross-Site Request Forgery (CSRF) after a hidden HTML form on an unrelated forum page silently triggered a full CDN cache purge by exploiting an active browser session. The incident exposed a common security gap: relying solely on session cookies to authenticate state-changing admin actions. To fix this without disrupting a LiteSpeed page cache or SQLite-backed session storage, the developer adopted a signed double-submit cookie pattern instead of the traditional synchronizer token approach. This stateless method stores a signed HMAC token in both a cookie and a form field, then verifies both match on every unsafe request, without any server-side session writes. The implementation also uses the __Host- cookie prefix and token expiry checks to prevent subdomain or network-level cookie injection attacks.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

AI Voice Systems Routinely Fail Disabled Users Due to Biased Training Data

Millions of disabled people face daily failures with AI voice assistants because their speech patterns fall outside the narrow range of audio these systems were trained to recognise. A January 2026 Forbes analysis by disability inclusion writer Gus Alexiou argued this is a structural flaw, noting that AI optimised for standardised interaction effectively excludes the 1.3 billion people the WHO identifies as having significant disabilities. On 3 February 2026, the UK's Department for Work and Pensions convened a roundtable bringing together major tech firms — including Google, Meta, Microsoft and Amazon — alongside disability organisations to address the gap between AI's potential and its current performance for disabled workers. Separately, researchers from Virginia State University and Morgan State University published a paper in Frontiers in Digital Health warning that standard AI evaluation metrics, focused on accuracy and generalisability, treat disabled users as statistical outliers rather than legitimate end-users. The studies and policy discussions collectively highlight a systemic absence of methodology for assessing whether AI tools are genuinely accessible to disabled people.

0 comments Read more at DEV Community