What's up friends, Adam here. This is Chinsall News Week of April 27th, 2026. Fresh off the press, literally hours old at this point, Warp is now open source. Yes, your favorite terminal in mine too, besides the ghost, of course, is now open source.
Years ago, we had Zack on the pod and pressured him, highly suggested I should say that Warp be open source. And the day is finally here. They are now open source. The primary reason is quote that we think we can ship a better Warp more quickly if we open source and work with our community.
End quote. The congrats, Zack. I'm excited. Are you excited?
OK, well, let's get into the news. Bitwarden CLI has been compromised. Yes, Bitwarden's official command line told that hit last Thursday, our friends at Sockit are on the beat. They flagged a malicious CLI published to NPM as part of the same check marks themed supply chain campaign that's been going through the development during this past few weeks.
Here's what matters. The CLI is now the tool by definition that sits next to our secrets. And the compromised build was scraping get up tokens, AWS, Azure, NGCP credentials, NPM config, SSH keys, the good stuff, right? Shell profiles, and even your cloud and MCP config files out of the spoofed audit.check marks.cx endpoint.
So if you ran Bitwarden or BW the command on a dev machine or a CI runner in the past few weeks, this is an instant response. This is not a patch cycle. And our friends at Sockit say quote, the compromise follows the same get up action supply chain vector identified in the broader check marks campaign end quote. So this is a strategic attack and our dev tools from the cross hairs.
TypeScript 7.0 beta. TypeScript 7.0 hit beta last Tuesday after more than a year of porting from a JavaScript based boot store compiler to a go rewrite. The team is shipping it with one headline number about 10x faster than 6.0. The big picture.
This is the most ambitious thing TypeScript has done since a language shipped. Microsoft didn't add features. They rewrote the core in a different language to break a performance ceiling that JavaScript bootstrap TNC was never going to clear. And they say stable is within the next two months.
Daniel Ross and Wazar, TypeScript program manager from Microsoft says this quote, it is highly stable, highly compatible, and ready to put to the test in your daily workflows and CI pipelines today. So you got your marching orders using your workflows today, using your pipelines today, and enjoy TypeScript 7.0. Ubuntu 26.0 4 LTS is here. OK, so Resolute Raccoon shipped on Thursday.
Fantastic news for our home labbers out there who are on the edge of Ubuntu. I know that's what I use in my VMs and containers. So I'm excited to finally get my templates updated to Ubuntu 26.0 4 up from 24.0 4. This is the LTS release your server will run for the next five years on through April 2036.
So that's a long time. The most interesting call on the release isn't the kernel or the desktop. It's canonical pumping the brakes on the rust, core, util swap. It's kind of the judgment that makes the LTS worth trusting.
Plan your fleet upgrade window. Now I know I am. If rust everywhere lands by 26.10 as targeted, this LTS is the on it. And now time for some sponsored news.
Well, I'm here with Nicky Pike from coder.com, secure environments where devs and agents work in parallel. Nicky, the thing on my mind this week is the laptop. How secure? How at risk are we?
The laptop is the is the trap here. And not only because of the fact that it could be stolen, you could lose it. It breaks and you're out of work while you're waiting for a new one. But there's also just the consistency you got there.
We all know developers, developers are going to be looking for some of the latest and greatest. And if you're not really controlling how they get out there, that's where you get this. It works on my machine. It doesn't work on in production.
It doesn't work anywhere else because you don't have that consistency. You don't have that ability to really standardize what that environment looks like. But there's also the security and the supply chain aspect of this. When you have local machines out there, look at the Shai Halud.
That virus that went out not long ago. This was a compromise of the MPM public repositories. They went and downloaded things. MPM did what it did.
Next thing you know, you're compromised. But when you use something like what we're doing with cloud development environments, then you can mandate. And you can put restrictions on there to say, hey, you can only go get your packages from our private repo. Those packages are expected to have been thoroughly vetted.
We know that they're clean. Now does this stop everything like Shai Halud? No, if that compromised package gets into your private repo, you can still have that. But it really reduces the surface area of the attack.
And it also reduces the blast area of the compromise should it happen because if your laptop gets compromised and you have to kill the laptop for whatever reason, that's weeks out of work while you're either fixing that or you're getting a new laptop in. The cloud development environments allows you to kill that, start back up fresh and you're back and running in five minutes. You don't have to wait all that time. All right, friends, go to codert.com, give your developers room to build and run parallel agents inside secure self-hosted environments.
Again, codert.com. Spinal Compiles Ruby to native binaries. Our favorite programmer, Matt, drops spinal on Friday. Thank you, Matt, of course, for Ruby.
It is a head of time compiler that takes Ruby source, emits standalone C and runs it through GCC or C line to produce a native binary. And the benchmark sets about 11.6x faster and on compute heavy workloads, Conway's game of life is the canonical example and it tops 86x. And if you ask me this change of the framing for what Ruby can be used for, the immediate obvious win is small CLIs, Lambda functions and short-lived processes. Basically, anywhere C Ruby startup cost was a tax to you and push it to go or rust, now Ruby is an option.
And here's the cool thing, Ruby on more serious infrastructure. The cleanest read of this is that Matt's is signaling Ruby's future has a typed pre-compiled lane next to his dynamic one. The crystal community has been making this case for years, but the difference is this one's coming from Matt's himself. It's not a fork, it's a direction.
PG backrest is no longer being maintained. After 13 years, David Steele has stepped away from PG backrest, the repository is archived, the Ruby leads with quote, notice of obsolescence end quote, the standard backup tool for production poster deployments has lost its maintainer and won't be patched going forward. This is not a hobby crate, gone dormant. PG backrest is a tool a lot of operations teams have woven into the fabric of what they do, their run books, their backup automation, their disaster recovery plans.
And when the next CVE hits and this maintainer's gone, it's not getting patched, not eventually, it's not at all. The sentiment can be read directly from David Steele, quote, rather than do the work poorly and or sporadically, I think it makes sense to have a hard stop end quote. They have it good for you to call the ball, draw the line and step away as you need to. So if you run PG backrest in production, this is a this week task.
Don't delay it. And who knows what's to come for? PG backrest, next week we may have a new headline about it. We shall see.
Our friends, this shows done tons of links in the newsletter, check it out as well. Also tune into Change Log 680, talking to a million watt and burger, explore with agents, design our database veteran, X, GitHub, next, and now design intent at augment code. Once again, Change Log 680. And again, thank you to Coder for sponsoring this episode.
That's it, we're done. We'll see you soon.