☕️ Apple tells devs to update apps

• Apple is urging developers to update their apps for the new iPhone Duo's dual screens, warning that unmodified builds will display with unsightly black bars on the larger inner display.
• Apps built with the current Xcode 27 already scale to fill most of the screen, ranged left to avoid the camera cutout, while rebuilding under the just-released Xcode 27.1 unlocks finer control across the full inner-screen width.
• Xcode 27.1 ships an updated preview module letting developers check how apps render across all four layouts, and unupdated apps will keep their old aspect ratio, sitting centered with large black bars flanking them.

• OpenAI now routes every engineer's pull request through a mandatory automated security review, and the model performing it can block a merge outright when it flags a vulnerability, with no human reviewer required to enforce the decision.
• Codex team lead Thibault Sottiaux said the specialized review models catch logic and security mistakes humans might spend hours on, benchmark as "superhuman," and now handle regressions, dependency upgrades, and refactors that once took months.
• Sottiaux conceded an unaddressed risk: since AI both writes and reviews the code, both can share a blind spot, an over-cautious model stalls fine PRs, while a missed vulnerability ships with a false sense of safety.

• OpenAI engineer Tibo Sottiaux detailed how Codex was built on the Pragmatic Engineer Podcast, covering why its CLI ships in Rust, why it went open source, and how the team runs it across the software development lifecycle.
• The team picked Rust upfront for performance, security, and scale across millions of cloud machines despite the models being weaker at Rust then, and kept Codex open source so it can drive any provider's models, not just OpenAI's.
• Internally, Codex plugs into Slack, docs, and all code by default so it can answer why decisions were made, and Sottiaux says agents now blast through dependency upgrades in hours and re-architecting in days rather than years.

• The IETF published RFC 10008 in June 2026, adding QUERY to HTTP, the first new standard verb since PATCH in 2010, to give the web a safe, idempotent, cacheable request that carries a body.
• QUERY solves the GET-versus-POST tradeoff for searches: filters ride in the body instead of the URL, dodging length limits and log leakage, while responses stay cacheable when the cache key includes the request content.
• Servers advertise support through the new Accept-Query field, and tooling is catching up with the method merged into the Rust http crate and tracked across .NET, Axum, Quarkus and Bruno, though real adoption will take years.

• systemd 262-rc2 shipped September 8, 2026, adding a check that flags pull requests containing AI-generated code no human has reviewed before it gets merged into the project.
• The mechanism lives in AGENTS.md, instructing any agent editing source files to prepend two lines to README.md, including one the human author must delete to confirm they reviewed the PR.
• Agents cannot remove either line themselves; the release also fixed an off-by-one read in tar-util, added an option to disable systemd-coredumpd, and synced against updated Linux kernel headers.

📚 Tutorials & Advice

🔗 Other News & Articles

• Python 3.15 preview: lazy imports LINK

• How we rebuilt Cloudflare Workers’ module registry for Node.js compatibility LINK

• Kubernetes v1.37: Introducing node lifecycle conditions LINK

• CPython officially adds RISC-V support as a tier 3 platform LINK

• FreeBSD working on new service manager LINK

• Google mapped a fly's nervous system and developers are using it to play Doom LINK

• What is Nub? The Rust toolkit making Node.js 20x faster LINK

📄 Papers & Resources

🧰 Latest Tools

💬 How did you find today's edition?

We read every reply — just reply to this email and let us know how we can improve!