Why Measuring Pull Requests May Be Hurting Your Software Team's Performance

·1 views

A software engineering advocate argues that measuring pull request metrics—such as duration and throughput—is counterproductive because PRs inherently slow down code integration and delivery. Citing a DX study of over 500 organizations, the author notes that the longer PRs remain open, the less code developers ship, particularly in high-performing teams. Rather than optimizing a practice that introduces delays, the author urges engineering leaders to adopt DORA metrics—deployment frequency, lead time for changes, change failure rate, and time to restore service—as more meaningful indicators of delivery performance. The piece contends that continuous integration with trunk-based development is a superior alternative, supported by over a decade of DORA research showing that speed and stability improve together. Using a marathon analogy, the author warns that measuring and rewarding PR efficiency is akin to timing tea service during a race—optimizing a stop that should not exist in the first place.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Guide Urges Local Businesses to Build Google Business Profile Contingency Plans

A Search Engine Land guide published on August 24, 2026, advises local businesses to prepare contingency plans in case their Google Business Profile is suspended, inaccessible, or requires reverification. The framework centers on four actions — Preserve, Recover, Replace, and Reduce — covering both immediate response and longer-term resilience. Businesses are urged to secure profile ownership, keep verification documents on hand, and maintain consistent name, address, and phone data across all platforms. When disruption occurs, a designated owner should manage the recovery process while simultaneously activating alternative lead sources such as paid search, social media, referral networks, and direct website contact routes. The guide does not discourage use of Google Business Profile but warns against treating it as the sole channel connecting prospective customers to a business.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

OpenWhispr offers local-first, privacy-focused voice-to-text for developers

OpenWhispr is an open-source voice dictation tool gaining traction on GitHub, having received 43 stars in a single day. The project supports local speech-to-text models such as Nvidia Parakeet and OpenAI's Whisper, allowing audio to be processed entirely on-device without sending data to third-party servers. It also offers a bring-your-own-key option for developers who prefer cloud-based inference for faster or more capable transcription. Local processing can reduce recurring API costs but may introduce latency on CPU-only hardware, with GPU acceleration requiring additional setup. The tool is aimed at developers who regularly dictate code, documentation, and notes, and want control over where their audio data is processed.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Developer finds CI catches dependency and security gaps missed in local environments

A backend developer shared lessons learned after setting up continuous integration (CI) on a solo project. The first CI run immediately revealed an undeclared dependency that worked locally but was missing from requirements.txt, exposing a classic environment mismatch. A pinned package version was also silently overwritten by a later install, a drift that went unnoticed until a manual code review. The developer also highlighted a deliberate API design choice: returning 404 instead of 403 for resources owned by other users, to avoid confirming whether a resource exists. The takeaway is that good backend hygiene relies on automated checks rather than memory or assumptions.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

AKS Path Traversal CVE-2026-32193 Can Escalate to Microsoft Copilot Hijack

A vulnerability tracked as CVE-2026-32193, rated 8.8 CVSS, affects Azure Kubernetes Service's file path handling, allowing attackers to escape a restricted directory via uncanonicalised path sequences. Discovered amid a record 206-vulnerability Patch Tuesday in June 2026, the flaw was widely underreported due to its low EPSS score and misleading automated writeups. Exploiting the bug grants root access on a managed AKS node, exposing kubelet credentials, service account tokens, and cloud identity material. Researchers warn this node-level compromise can extend to Microsoft Copilot if the assistant's identity holds broad API permissions reachable from the hijacked node. Microsoft has issued a fix in AKS node image build v0.20260213.5, and administrators are advised to upgrade all node pools and audit federated service account permissions immediately.

0 comments Read more at DEV Community