🏑
  • ↔
  • β†’
  1. October 19, 2026
    1. πŸ”— 19h/chernobog v6.4.0 release

      Chernobog 6.4.0

      Changes in v6.3.1...v6.4.0.

      • Semantic MBA synthesis beyond the rule catalog β€” a bounded Z3-backed
        pass simplifies typed 8-, 16-, 32-, and 64-bit expressions across basic blocks,
        with explicit conversions, overlapping register views, byte-addressed memory,
        and proven loop invariants. Replacements require an equivalence proof, followed
        by an independent check of the emitted microcode. Unsupported effects,
        inconclusive proofs, and exhausted budgets preserve the original expression.

      • Nested arithmetic and Boolean reconstruction β€” bottom-up linear MBA
        reconstruction exposes identities inside larger expressions and cancels
        arithmetic across Boolean subexpressions. Boolean synthesis, modular affine
        fitting, known-bit comparison reduction, and bounded unsigned division
        simplification recover smaller expressions beyond fixed patterns. Constant
        division can become a constant or a threshold comparison when the proven
        quotient range permits it.

      • Caller-context simplification β€” pure scalar helper calls can become
        constants or smaller symbolic expressions after substituting their actual
        arguments. Local value propagation and facts from both sides of a branch
        expose opaque predicates and constant branches, including after a helper result
        is assigned to a local. Emitted ctree expressions are checked with their casts
        and integer promotions; unsupported or effectful helpers remain calls.

      • Deep deobfuscation β€” the new Deep deobfuscation (Chernobog) action
        raises the shared semantic-analysis budget from 1 s to 30 s per function.
        Scripts can use chernobog_deep_deobfuscate(ea),
        chernobog_deep_deobfuscate_text(ea), and chernobog_mba_smt_stats(ea).
        These are analysis budgets, not hard limits on total decompiler runtime.
        See semantic MBA synthesis
        for the model and limits.

      • 32-bit saved-register stack stubs β€” native analysis recognizes bounded
        PE32-style dispatch stubs ending in RET 4 or XCHG [ESP], reg; RET,
        including supported PUSH substitutions. It records the handler target and
        continuation with dependency-tracked proof ownership. When the complete stub
        and handler belong to the same function, early Hex-Rays lowering replaces the
        final return with an explicit pop, any required stack adjustment, and a direct
        jump while retaining preceding stack accesses and register restorations.
        See stack-stub recovery.

      • Call-boundary string inspection β€” strings observed when rax stops before
        an unmodeled call are available through IDC, inspection JSON, and the evidence
        workspace's Observed strings table. They remain inspection observations;
        decompiler rewrites and proof consumers still require their existing
        completed-run evidence. Entry-input collection examines at most 256 incoming
        references, reports truncation, and supports cooperative cancellation through
        static analysis, input planning, and call-summary collection.

      • WARBIRD diagnostic exploration β€” a bounded symbolic explorer supports
        native admission profiles for ci, ClipSp, and PEAuth through four IDC functions:
        chernobog_warbird_profiles, chernobog_warbird_start,
        chernobog_warbird_poll, and chernobog_warbird_cancel. It models finite
        successor-key splits, aliased byte memory, supported scalar and legacy 128-bit
        XMM operations, native setup and dispatcher execution, bounded stack growth,
        and selected pool-allocation effects. Counted-store loop relations and guarded
        forward-state joins retain correlated state and memory-effect histories.
        Reports expose unsupported paths and resource limits; database changes
        invalidate results. This is diagnostic exploration only: all corpus entries
        remain partial, no pseudocode is replaced, and whole-entry semantic equivalence
        is not established.         See WARBIRD implementation status.

      • Pseudocode stability β€” caller-context updates run after view navigation
        completes and keep the displayed function, microcode, and text synchronized.
        Pending updates are discarded on function changes or plugin shutdown. Empty
        branch bodies retain the SDK's required placeholder, and zero-width integer
        terms are rejected during call simplification.

    2. πŸ”— persiyanov/herdr-reviewr herdr-reviewr 0.48.0 release

      Added

      • Review prefix : review_prefix puts your own text above the comments on every send and copy.
        Thanks @macintacos (#129).
    3. πŸ”— modem-dev/hunk v0.24.0 release

      Hunk 0.24: beyond the diff

      Hunk 0.24 brings complete-file and directory browsing, a live workspace compass, npm-installed extensions, and version-matched agent skills into your terminal review workspace. Worker highlighting makes startup interaction smoother, while a round of memory fixes keeps large reviews and long-running sessions leaner.

      For npm- and curl-managed installs:

      hunk update 0.24.0
npm install -g hunkdiff@0.24.0

      Homebrew availability will be verified after publication; until then, Homebrew propagation is pending. The commands above select the exact release for npm- and curl-managed installations.

      Explore the source and find your next review

      hunk open shows complete syntax-highlighted files and browses directories with lazy loading, live refresh, and keyboard or mouse navigation. Inspect the surrounding source without manufacturing a diff. The new read-only workspace status view brings together staging state, tracked and untracked changes, and sibling worktrees, with navigation into history and full diff reviews. Static and versioned JSON status output are available too. #1148, #1067

      Automatic diff layout now uses the space actually left after side panes and padding: opening a pane can switch to unified, and closing it can restore split. auto_split_min_width controls the threshold, while scroll_off keeps surrounding context visible during line navigation. Binary files remain reachable through file navigation and sidebar clicks, and the sidebar follows held file-navigation keys without overriding ordinary manual scrolling. #1170, #1109, #1178, #1085

      Keep reviews responsiveβ€”and let old reviews go

      Syntax highlighting runs in a worker by default, with grammar warmup during startup to reduce the input stall after the review first appears. Large-diff highlight failures use bounded retries rather than restarting on every scroll. #1105, #785

      Live reloads no longer retain every previous review's files and render state. Nonwrapped reviews reuse geometry across terminal resizes, and keyboard navigation leaves copy-selection content lazy rather than materializing it eagerly. Sessions also stop repeatedly submitting a rejected review to an unchanged daemon while retaining recovery when the review or daemon changes. #1201, #1200, #1202, #1199

      Review reliability improves too: wheel scrolling no longer leaves comments targeting stale lines, notes survive reloads that temporarily omit their files, suspended windows keep their sessions registered, and terminal-editor handoffs release Hunk's stdin reader before launching the editor. #1143, #1164, #1131, #1134, #1165

      Performance note: release benchmarks have no gated regressions against 0.23.0 or beta.1. The known sidebar-follow tradeoff from beta.1 remains relative to beta.0: navigation p95 is 42.74 ms versus beta.0's 36.35 ms, beta.1's 44.55 ms, and 0.23.0's 46.32 ms. This preserves correct sidebar following during held navigation and resizing.

      Easier extensions, agent setup, and shell navigation

      hunk extension install accepts npm packagesβ€”including scopes, versions, ranges, and tagsβ€”alongside Git sources, without running npm lifecycle scripts. Folder-local package imports work in compiled Hunk binaries. Extensions gain generation-scoped presentation filters and independent left/right pane controls. #1162, #1163, #1118, #1171

      Install agent pointer skills through the skills CLI; hunk skill show supplies the full instructions matched to your installed Hunk version. Bash and Zsh completions help discover commands, flags, and supported values. The note-composer save shortcut is now remappable, and hunk gh --help and the docs cover more of the available review workflows. #1167, #1157, #962, #1186

      Compatibility notes

      • Default theme: github-dark-default is the default again. Set theme = "terminal", pass --theme terminal, or use the theme picker to keep following your terminal palette. This differs from 0.23 and the 0.24 betas. #1195
      • Automatic layout: the default threshold is 160 available diff columns, excluding panes and outer padding. Configure auto_split_min_width or select explicit split/unified mode to override it.
      • Navigation context: scroll_off defaults to five rows; scroll_off = 0 or --scroll-off 0 restores edge-only scrolling.
      • Highlighting: --fast is now a no-op and will be removed in a later release. Windows compiled binaries and custom themes with syntax_scopes continue to highlight inline.
      • Patch validation: nonempty input without recognizable file changes now fails explicitly instead of silently opening an empty review. Genuinely empty reviews have their own message. #1183, #1182
      • Extensions: the public API is version 31. Gate new APIs on hunk.apiVersion when supporting older Hunk versions.
      • Persistent state: Hunk uses the XDG state directory while preserving existing state and global extension locations. Agent notes start hidden; use the review controls to reveal them.
      • Runtime requirements: npm installations require Node.js 22 or newer; standalone binaries do not require Node.js.

      Community contributors

      All merged pull requests

      Release notes : https://hunk.dev/changelog/0.24/
      Full changelog : v0.23.0...v0.24.0

    4. πŸ”— persiyanov/herdr-reviewr herdr-reviewr 0.47.0 release

      Added

      • Split view : | shows the diff side by side, and comments, find and copy work on both halves. diff_view = "split" starts a fresh pane in split.
        Thanks @Tarektouati (#116).

      • Breaking:| is a new default key. A [keybindings] config that already uses | now collides and must move it.

  2. October 18, 2026
    1. πŸ”— r/Harrogate Harrogate's best story? rss

      With a town teaming with History, what is something you know for fact or have been told and choose to believe about Harrogate? Think ghost stories, superstitions and plots!

      Do NOT let the truth get in the way of a good story.

      submitted by /u/RevolutionaryTap3911
      [link] [comments]

    2. πŸ”— pydantic/monty v1.2.0 - 2026-10-18 release

      What's Changed

      New Contributors

      Full Changelog : v1.1.0...v1.2.0

    3. πŸ”— persiyanov/herdr-reviewr herdr-reviewr 0.46.2 release

      Fixed

      • Toggle from a plugin's pane : opening from a pane inside another plugin's checkout, like herdr-file-viewer, now reviews the agent's repo, else another pane's, not that checkout.
        Thanks @Branpolo (#130).
    4. πŸ”— persiyanov/herdr-reviewr herdr-reviewr 0.46.1 release

      Fixed

      • Windows install from PowerShell 7 : installing no longer fails at "verifying checksum" when herdr was started from pwsh 7.
        Thanks @v-senninha-v (#127) and @Yivas (#142).
  3. October 17, 2026
    1. πŸ”— IDA Plugin Updates IDA Plugin Updates on 2026-10-17 rss

      IDA Plugin Updates on 2026-10-17

      New Releases:

      Activity:

    2. πŸ”— HexRaysSA/plugin-repository commits sync repo: ~1 changed rss 
      sync repo: ~1 changed

## Changes
- [BinaryLens](https://github.com/lumice/binarylens):
  - 1.2.0: archive contents changed
    3. πŸ”— r/Harrogate Map to help house hunters rss

      Map to help house hunters | Seen people posting these for Sheffield and York so thought I’d have a go, first iteration… submitted by /u/LegitimateInternet13
      [link] [comments]
      ---|---

    4. πŸ”— HexRaysSA/plugin-repository commits sync repo: +1 release rss 
      sync repo: +1 release

## New releases
- [capa](https://github.com/mandiant/capa): 10.0.0
    5. πŸ”— r/Harrogate Is Harrogate better now or was it better in the past ? rss

      Is Harrogate better now or was it better in the past ? | submitted by /u/LowGuide2746
      [link] [comments]
      ---|---

    6. πŸ”— smol-machines/smolvm smolvm v1.30.1 release

      What's Changed

      • Expose the engine's CLI commands as a library module by @BinSquare in #1847
      • Avoid unnecessary disk staging when paused resume inputs fit in tmpfs by @BinSquare in #1849
      • Give machine create a window above the image pull deadline so a large image's seed build is not cut off at five minutes by @BinSquare in #1848
      • Build a paused machine's export beside its data directory by @BinSquare in #1850
      • Prepare SmolVM v1.30.1 for release by @BinSquare in #1851

      Full Changelog : v1.30.0...v1.30.1

    7. πŸ”— smol-machines/smolvm smolvm v1.30.0 release

      What's Changed

      • Pin and checksum nfpm in the package repository workflow instead of resolving latest through the rate-limited GitHub API by @BinSquare in #1826
      • Pull large registry blobs in parallel ranged parts by @BinSquare in #1828
      • machine run: Accept --expose-socket and --mount-socket in ephemeral vms by @yorickvP in #1245
      • Add pack list for pulled artifacts by @BinSquare in #1831
      • Let embedders start a background command on a local machine by @BinSquare in #1832
      • Ignore the zip extraction advisories for utoipa-swagger-ui's build-time unpack by @BinSquare in #1837
      • perf(network): disable Nagle on host TCP relay sockets by @BinSquare in #1833
      • Run sysctl by its absolute path for checkpoints on macOS by @BinSquare in #1836
      • Ask registries for Docker manifest types when resolving an image by @BinSquare in #1838
      • Keep balloon page releases inside one guest memory region by @BinSquare in #1834
      • preserve empty directories across cache expiry and remounts by @BinSquare in #1835
      • Use server-side S3 copies for file renames by @BinSquare in #1839
      • Keep S3 staged writes coherent across file handles by @BinSquare in #1840
      • Cache missing S3 children from complete directory listings by @BinSquare in #1842
      • Build a paused machine's export outside its locks by @BinSquare in #1843
      • Disable Nagle on guest-facing TCP relay sockets by @BinSquare in #1844
      • Pin libkrun at the balloon free page hint round fix by @BinSquare in #1845
      • Prepare SmolVM v1.30.0 for release by @BinSquare in #1846

      New Contributors

      Full Changelog : v1.29.1...v1.30.0

    8. πŸ”— Filip Filmar Bazelizing a Custom RISC CPU with 4x4 Systolic Matrix Accelerator rss

      Open-source digital signal processing and machine learning accelerators are frequently published as student or research projects. While the RTL architecture is often innovative, the surrounding build and test scaffolding frequently suffers from workstation-specific assumptions, absolute file paths, and missing simulation fixtures.

      In this case study, we document the Bazelization of Custom-RISC-CPU-with-Systolic-Matrix-Accelerator, authored by Mathew George. By applying Bazel and rules_openxc7, we transformed this 2D systolic array processor into a portable, reproducible hardware project that synthesizes and outputs a valid FPGA bitstream in under 25 seconds from a clean slate.

    9. πŸ”— Filip Filmar Bazelizing mmRISC-2: A Full RISC-V SoC with rules_openxc7 rss

      Converting existing open-source FPGA projects to Bazel and rules_openxc7 transforms fragile, vendor-locked hardware build scripts into reproducible, sandboxed workflows. This case study examines our complete Bazelization of mmRISC-2, a comprehensive, silicon-proven RISC-V system-on-chip authored by Munetomo Maruyama.

      By pairing Bazel’s fine-grained dependency tracking with open-source EDA tools (Yosys, Slang, nextpnr-xilinx, Project X-Ray, and openFPGALoader), developers can clone the repository and produce a fully placed, routed, and verified bitstream for the Digilent Arty A7-100T board with a single terminal command.

  4. October 16, 2026
    1. πŸ”— IDA Plugin Updates IDA Plugin Updates on 2026-10-16 rss

      IDA Plugin Updates on 2026-10-16

      New Releases:

      Activity:

      • augur
        • 302c9939: Merge pull request #14 from 0xdea/dependabot/github_actions/actions-d…
        • 10bcff96: ci: bump taiki-e/install-action
      • capa
        • 7a235c46: Sync capa rules submodule
        • 85813ebc: Merge pull request #3197 from mandiant/release-v10.0.0
      • haruspex
        • 95aad893: Merge pull request #17 from 0xdea/dependabot/github_actions/actions-d…
        • 769f3a26: ci: bump taiki-e/install-action
      • ida-cli
        • 27a54cca: test(nexus): keep frozen baseline decompile requests plain
        • 83b0ebff: Merge master while preserving Nexus lifecycle and listing contracts
        • 761a0fde: fix(cli): display string contents and segment address ranges
        • 8c376b7f: test: separate MCP fixture startup from response bounds
        • 03677e29: fix(nexus): preserve early disconnect ordering and shared lease cleanup
        • acb61ba5: test(nexus): model public recovery probes in diagnostic open tests
        • 6739b35b: fix(nexus): veto rollback on external IDA locks and replaced snapshots
        • 5e430261: fix(nexus): retry initial Root failures and roll back recovery artifacts
        • efbee3c0: test(nexus): capture Root Node visibility failures and isolate reopen…
        • 91022c33: fix(nexus): isolate diagnostics and opt in to IDB hashes
        • 7dd8c2da: fix(nexus): refuse writeback after owner Root Node loss
        • 54e4c60c: test(nexus): model public state-directory resolution in cache probes
        • 8bc34664: fix(nexus): close cache review residuals and isolate fixture startup …
        • 582568b7: test(nexus): retain zero-metadata contract with owner diagnostics
        • b72d987f: test(nexus): load metadata diagnostics in standalone tools fixture
        • c9b1374e: diagnose(nexus): retain owner evidence for missing input metadata
        • 41d34736: fix(nexus): address N7a cache coordination review
        • ff486d34: test(nexus): discover generation databases in N6 persistence fixtures
        • 35fc2311: feat(nexus): coordinate generation cache GC and cancellable input pre…
        • 08055fe1: docs: accept N6 after F1 review
      • idamcp
        • 5fb2f304: Optionally show Hex-Rays warnings in decompile_function
      • oh-my-pi-schema
        • f9244c8b: chore(sync): merge upstream oh-my-pi v18.11.1
      • omp-zh-i18n
        • f81111c4: feat(i18n): localize for official v18.11.0 (v18.11.0-zh)
      • rhabdomancer
        • 2aa7dd92: Merge pull request #16 from 0xdea/dependabot/github_actions/actions-d…
        • b7e4d022: ci: bump taiki-e/install-action
      • ToCode
        • 216f1f9d: Merge pull request #21 from buzzer-re/dev
        • b160c8b6: Release 0.3.2
        • 70cf5454: Merge pull request #20 from buzzer-re/dev
        • 435657fe: Add ToCode live for .NET
        • 6f0a5815: Add ToCode live: MCP server, incremental sync, and the agent skill
    2. πŸ”— roboflow/supervision supervision-0.31.0 release

      v0.31.0 β€” Depth, moving cameras and pose mAP

      supervision now sees depth: load depth maps from your model or stereo rig, measure how far each object is, and draw the map.

      • sv.DepthMap measures the distance to every detection and colours depth over any image, no OpenCV needed.
      • PolygonZone and LineZone keep counting in the right place while the camera pans.
      • KeyPointMeanAveragePrecision scores pose models the way pycocotools does.
      • Kosmos-2 , Gemini 3.6/3.7 and MediaPipe hands now load straight into Detections and KeyPoints.
      • MeanAveragePrecision runs far faster on crowded images and lets you raise the detection cap.

      It's a drop-in upgrade if 0.30.x showed you no deprecation warnings, apart from four output changes. sv.ByteTrack with the supervision.tracker package, supervision.keypoint, sv.LMM, the legacy sv.MeanAveragePrecision and a few helpers are gone; the Migration guide has the swaps.

      ✨ Spotlights / highlights

      image

      Depth maps: load, measure and draw

      sv.DepthMap holds metric depth, stereo disparity or relative depth for one frame, and keeps track of which one it is. sv.DepthCamera converts disparity to metres, measure_detections writes the median depth under each object to detections.data ("depth_m" when the map can give metres), and sv.DepthAnnotator colours the map over an image without OpenCV. sv.DepthClipRange keeps one colour scale across a whole video, so colours don't flicker between frames. Loaders read Roboflow Inference, Ultralytics, Transformers, and 16-bit PNG and PFM dataset files such as KITTI and Middlebury. (#2691, #2692, #2693, #2694)

      import numpy as np
import supervision as sv

depth = np.full((100, 100), 20.0, dtype=np.float32)
depth[20:40, 20:40] = 4.0
depth_map = sv.DepthMap(depth, kind="depth_m")

detections = sv.Detections(xyxy=np.array([[20, 20, 40, 40], [60, 60, 90, 90]], dtype=float))
detections = depth_map.measure_detections(detections)
detections.data["depth_m"]  # array([ 4., 20.], dtype=float32)

annotated = sv.DepthAnnotator().annotate(np.zeros((100, 100, 3), np.uint8), depth_map)

      Zones that follow the camera

      Zones used to assume a fixed camera; when it panned, the scene slid out from under the zone. PolygonZone.trigger and LineZone.trigger now take an optional per-frame coord_transform that maps detection anchors back into the frame the zone was drawn on. Any object with abs_to_rel and rel_to_abs works, as described by the new sv.CoordinatesTransformation protocol, including the transformations from the trackers motion estimator. Drawing is unchanged, and coord_transform=None keeps current results. (#2657)

      import numpy as np
import supervision as sv

class CameraShift:
    def abs_to_rel(self, points): return points + [50, 0]
    def rel_to_abs(self, points): return points - [50, 0]

zone = sv.PolygonZone(polygon=np.array([[0, 0], [100, 0], [100, 100], [0, 100]]))
car = sv.Detections(xyxy=np.array([[120.0, 40.0, 140.0, 60.0]]))
zone.trigger(car)                                 # array([False])
zone.trigger(car, coord_transform=CameraShift())  # array([ True])

      COCO keypoint mAP for pose models

      sv.metrics.KeyPointMeanAveragePrecision scores sv.KeyPoints predictions by Object Keypoint Similarity at ten thresholds from 0.50 to 0.95, and its scores agree with pycocotools COCOeval(..., "keypoints"). COCO greedy matching is now vectorized for box and keypoint mAP. In the benchmark reported with that change, one image with 1000 predictions and a 1000-detection cap dropped from 35.9 s to 0.5 s. MeanAveragePrecision also takes max_detection_thresholds for scenes with more than 100 objects. (#2687, #2733, #2716)

      import numpy as np
import supervision as sv
from supervision.metrics import KeyPointMeanAveragePrecision

targets = sv.KeyPoints(
    xy=np.array([[[10, 10], [60, 10], [35, 80]]], dtype=np.float32),
    class_id=np.array([0]),
    data={"area": np.array([4000.0])},
)
predictions = sv.KeyPoints(
    xy=np.array([[[11, 10], [60, 12], [35, 79]]], dtype=np.float32),
    class_id=np.array([0]),
    detection_confidence=np.array([0.9]),
)
metric = KeyPointMeanAveragePrecision(sigmas=[0.25, 0.25, 0.25])
metric.update(predictions, targets).compute().map50  # 1.0

      More models, and the matcher behind the metrics

      sv.Detections.from_vlm parses Kosmos-2 grounding results (sv.VLM.KOSMOS_2) and Gemini 3.6 and 3.7 structured boxes and polygon masks. sv.KeyPoints.from_mediapipe loads MediaPipe hand landmarks, with class_id 0 for a left hand and 1 for a right hand. sv.match_detections exposes the one-to-one greedy IoU matcher the metrics use, for comparing two models or auditing labels against predictions. (#1903, #2504, #2283, #2557)

      import supervision as sv

caption = "a snowman next to a fire"
entities = [("a snowman", (0, 9), [(0.1, 0.2, 0.4, 0.9)]), ("a fire", (19, 25), [(0.5, 0.6, 0.8, 0.95)])]
detections = sv.Detections.from_vlm(sv.VLM.KOSMOS_2, (caption, entities), resolution_wh=(640, 480))

pairs, unmatched_a, unmatched_b = sv.match_detections(detections_a, detections_b)

      πŸ”„ Migration guide

      No breaking changes beyond the APIs deprecated in 0.26–0.28 and scheduled for removal in 0.31.0. If 0.30.x printed no deprecation warnings for your code, only the four output changes at the end of this section can affect it.

      Removed | Use instead
      ---|---
      sv.ByteTrack and the supervision.tracker package | ByteTrackTracker from the trackers package (pip install trackers); call update() instead of update_with_detections()
      supervision.keypoint | supervision.key_points
      sv.LMM, Detections.from_lmm | sv.VLM, Detections.from_vlm
      legacy sv.MeanAveragePrecision (supervision.metrics.detection) | sv.metrics.MeanAveragePrecision
      sv.denormalize_boxes(normalized_xyxy=...) | sv.denormalize_boxes(xyxy=...)
      supervision.dataset.utils.mask_to_rle / rle_to_mask | sv.mask_to_rle / sv.rle_to_mask
      ensure_cv2_image_for_annotation | ensure_cv2_image_for_class_method (supervision.utils.conversion)
      ensure_pil_image_for_annotation | ensure_pil_image_for_class_method (supervision.utils.conversion)
      ensure_cv2_image_for_processing | ensure_cv2_image_for_standalone_function (supervision.utils.conversion)
      create_tiles, overlay_image (also sv.overlay_image), validate_keypoint_confidence, validate_keypoints_fields | no direct replacement 

      # before
tracker = sv.ByteTrack()
detections = tracker.update_with_detections(detections)
map_result = sv.MeanAveragePrecision.from_detections(predictions=predictions, targets=targets)

# after
from trackers import ByteTrackTracker
from supervision.metrics import MeanAveragePrecision

detections = ByteTrackTracker().update(detections)
map_result = MeanAveragePrecision().update(predictions, targets).compute()

      Four behaviour changes can alter output: sv.Detections raises on non-finite boxes, sv.CSVSink writes arrays as JSON lists, ConfusionMatrix.from_detections rejects lists of different length, and multi-class mAR @ K scores follow COCO. Details under Changed and Fixed.

      πŸ“ Notable changes

      πŸš€ Added

      • Depth maps. sv.DepthMap, sv.DepthAnnotator, sv.DepthClipRange and sv.DepthCamera, with to_depth, measure_detections, resize, crop, value_at, DepthAnnotator(scale="metric"), and loaders from_inference, from_ultralytics, from_transformers, from_png16 and from_pfm. (#2691, #2692, #2693, #2694)
      • Camera-motion-aware zones. PolygonZone.trigger and LineZone.trigger accept coord_transform, typed by the new sv.CoordinatesTransformation protocol. (#2657)
      • COCO keypoint mAP. sv.metrics.KeyPointMeanAveragePrecision for sv.KeyPoints, matching pycocotools keypoint evaluation. (#2687)
      • Configurable mAP detection limits. Keyword-only max_detection_thresholds on MeanAveragePrecision; the default (1, 10, 100) is unchanged. (#2716)
      • Mask confusion matrix. sv.ConfusionMatrix.from_detections and benchmark accept metric_target=MetricTarget.MASKS and match by mask IoU, on dense masks or CompactMask. (#2612)
      • Metric result aggregation. MetricResult base class for metric results, plus aggregate_metric_results() and plot_aggregate_metric_results() to compare several results in one table or grouped bar chart. (#2498)
      • Public matcher. sv.match_detections returns one-to-one greedy IoU matches and the unmatched indices on each side, optionally per class. (#2557)
      • Kosmos-2. sv.VLM.KOSMOS_2 in sv.Detections.from_vlm, one detection per grounded region. (#1903)
      • Gemini 3.6 and 3.7. sv.VLM.GOOGLE_GEMINI_3_6 and sv.VLM.GOOGLE_GEMINI_3_7 parse the structured {"boxes": [...]} format, including normalized polygon masks. (#2504)
      • MediaPipe hands. sv.KeyPoints.from_mediapipe loads hand landmarks from the Tasks HandLandmarker and the legacy Hands solution, with a new hand skeleton, class_id 0 for left and 1 for right, and the handedness score in data["handedness_score"]. (#2283)

      🌱 Changed

      • sv.Detections validates xyxy: non-finite (NaN, inf) or non-numeric boxes now raise ValueError instead of failing later. (#2503)
      • sv.ConfusionMatrix.from_detections raises when predictions and targets differ in length, instead of scoring the shorter list. (#2612)
      • sv.CSVSink writes NumPy arrays in data and custom_data as JSON lists instead of NumPy's truncated str() form; parse array cells with json.loads. (#2707)
      • sv.Detections.with_nmm and sv.mask_non_max_merge merge CompactMask unions without full-image allocations; the error for mismatched image shapes now names both shapes. (#2606, #2616)
      • sv.Detections.from_inference(compact_masks=True) crops each polygon mask to the polygon instead of the whole image, cutting time and memory for many polygons on large images. (#2678)
      • COCO greedy matching in MeanAveragePrecision and KeyPointMeanAveragePrecision is vectorized; results are unchanged. (#2733)
      • sv.ComparisonAnnotator builds its mask union from CompactMask crops in place instead of allocating a full (N, H, W) stack. (#2495)

      ❌ Removed

      • APIs deprecated since 0.26.0–0.28.0 and scheduled for 0.31.0: sv.ByteTrack and the supervision.tracker package (use trackers.ByteTrackTracker), the supervision.keypoint module (use supervision.key_points), sv.LMM and Detections.from_lmm (use sv.VLM and from_vlm), the legacy sv.MeanAveragePrecision (use sv.metrics.MeanAveragePrecision), create_tiles, overlay_image, ensure_cv2_image_for_annotation, ensure_pil_image_for_annotation and ensure_cv2_image_for_processing (use the ensure_*_for_class_method / ensure_cv2_image_for_standalone_function decorators), validate_keypoint_confidence, validate_keypoints_fields, the normalized_xyxy argument of sv.denormalize_boxes (use xyxy), and the supervision.dataset.utils import path for mask_to_rle / rle_to_mask. (#2582)

      πŸ”§ Fixed

      • sv.Detections.from_ultralytics no longer shifts or truncates segmentation masks when letterbox padding is fractional. (#2739)
      • Indexing sv.Detections with a Python list of booleans now selects list-valued data with the same mask as the arrays; it was read as positions. (#2737)
      • sv.move_boxes and InferenceSlicer no longer wrap integer coordinates when an offset crosses the dtype's range. (#2734)
      • sv.Detections.box_aspect_ratio no longer overflows on integer boxes at large coordinates. (#2729)
      • BlurAnnotator and PixelateAnnotator keep a (H, W, 1) grayscale channel axis instead of failing with a broadcasting error. (#2725)
      • Without OpenCV, thick line, polylines and drawContours outlines match OpenCV's LINE_8 pixels for thickness 2 or more. (#2727)
      • Without OpenCV, fillPoly paints the same boundary pixels as OpenCV, so polygon_to_mask and PolygonZone agree across backends. (#2730)
      • Without OpenCV, resize with INTER_NEAREST samples the same source pixels as OpenCV, which also aligns sv.CompactMask.resize across backends. (#2722)
      • sv.process_video stops reading the source when a callback or frame write fails, instead of decoding the rest of the video before raising. (#2720)
      • Label annotators with smart_position=True separate labels whose boxes share a center; before, only the last label was visible. (#2718)
      • Oriented-box MeanAveragePrecision keeps corner precision at large coordinates and puts objects in the right size bucket. (#2717)
      • sv.KeyPoints keeps all three coordinates when selecting a single key point with a NumPy integer index. (#2715)
      • Integer boxes and oriented boxes no longer land in the wrong object-size category when their area overflows the dtype. (#2713)
      • sv.CompactMask accepts NumPy's copy keyword, so NumPy 2 no longer warns on conversion. (#2708)
      • sv.CompactMask.resize matches dense nearest-neighbour resizing, including crops that become empty. (#2697, #2705)
      • DetectionDataset.as_yolo, as_pascal_voc and as_labelme export a mask with holes as one instance instead of one extra instance per hole; approximate_mask_with_polygons in supervision.dataset.utils gains the opt-in bridge_holes parameter that does this. (#2703)
      • sv.metrics.MeanAverageRecall applies the mAR @ K limit per class per image, as COCO does; multi-class scores were too low. (#2701)
      • sv.metrics.MeanAveragePrecision scores perfect predictions as exactly 1.0 instead of 0.99999988. (#2687)
      • from_vlm with Gemini 2.5 or 3.5 keeps a mask pixel only where the score exceeds 127 of 255; masks grew by half a mask pixel per side. (#2589)
      • from_vlm with Gemini 2.5 or 3.5 keeps masks for the detections that pass classes when a filtered-out item has no mask. (#2504)
      • from_vlm keeps class_id integer-typed when a classes filter removes every detection for PaliGemma, DeepSeek-VL2 and Gemini 2.0. (#2556)
      • from_ultralytics for Detections, KeyPoints and Classifications accepts NumPy-backed results, including Results.numpy(). (#2710)

      πŸ† Contributors

      • JANG BYUNGKUN (@8rulerstar) β€” added KeyPointMeanAveragePrecision and fixed perfect-prediction mAP scoring.
      • Caio Viotti (@cfviotti, LinkedIn) β€” added depth support: DepthMap, DepthAnnotator, DepthClipRange, DepthCamera and model loaders.
      • Kari Pikkarainen (@kari-pikkarainen, LinkedIn) β€” made zones follow camera motion with coord_transform.
      • Christoph Deil (@cdeil, LinkedIn) β€” added max_detection_thresholds to MeanAveragePrecision.
      • Raghav Rathi (@raghav-rathi, LinkedIn) β€” added mask targets to ConfusionMatrix.
      • shao (@shaoming11, LinkedIn) β€” added metric-result aggregation and sped up ComparisonAnnotator with compact masks.
      • David (@David-rn) β€” co-authored metric-result aggregation from the original proposal.
      • Jabrail (@jabrailkhalil) β€” added sv.match_detections.
      • Soumik Rakshit (@soumik12345, LinkedIn) β€” added Kosmos-2 support in from_vlm.
      • @Xayar145 β€” added Gemini 3.6 and 3.7 support in from_vlm.
      • @tarunbommawar27 β€” added MediaPipe hand landmarks to KeyPoints.from_mediapipe.
      • Advait Shukla (@AdvaitS) β€” made Detections reject non-finite or non-numeric boxes.
      • Avanish Garg (@avanish-garg, LinkedIn) β€” fixed CSVSink array output, CompactMask.resize and mask holes in dataset export.
      • Iuri de Silvio (@iurisilvio) β€” sped up Detections.from_inference with compact masks.
      • @trueoneplusone β€” sped up with_nmm for compact masks.
      • max (@quotentiroler) β€” vectorized COCO greedy matching in mAP.
      • A Aswanth Raj (@aswanth-07, LinkedIn) β€” fixed box_aspect_ratio overflow, CompactMask conversion and resize, single-point KeyPoints selection and NumPy-backed Ultralytics results.
      • Mohammad Hijjawi (@MohammadHijjawi97, LinkedIn) β€” fixed boolean-list Detections indexing and smart_position label overlap.
      • NIKHIL (@Nikhi00718) β€” fixed Ultralytics letterbox masks, grayscale blur and pixelate, process_video cleanup and box-area overflow in metrics.
      • kevin (@kevin9327) β€” fixed thick-line drawing without OpenCV and Gemini mask binarization, and typed the test suite.
      • Kaushik Reddy Lingireddy (@Lingikaushikreddy, LinkedIn) β€” fixed nearest-neighbour resize sampling without OpenCV.
      • peng xiang (@px12811) β€” fixed fillPoly rasterization without OpenCV.
      • Devulapalli Naga Sri Vaishnavi (@Vaishnavi220506) β€” fixed integer wrap in box translation and oriented-box mAP precision.
      • Muhammad Talha (@Talhax55z) β€” fixed per-class MeanAverageRecall scoring.
      • FootysHands (@ayo0la) β€” converted documentation examples to doctests.
      • Eesha (@eesha5) β€” fixed imports in docstring examples.
      • Jirka Borovec (@Borda, LinkedIn) β€” removed deprecated APIs, fixed from_vlm class_id dtype, followed up on with_nmm performance, and maintained docs, CI and release infrastructure.

      Automated contributions:@dependabot, @pre- commit-ci, @Copilot

      Full changelog : 0.30.0...0.31.0

    3. πŸ”— exe.dev Shake to Tell Shelley rss

      When I want to improve one of my iOS apps, I shake my phone, type in a prompt, and off it goes to Shelley, together with a screenshot!

      Iteration (culture) is eating planning (strategy) for lunch.

      I'm finding that grinding down the friction, even as minimal as getting myself to the agent input, enables iteration.

      Ideally, you could just customize the app from within itself, like Pliable does, but that would be against the app store rules.

    4. πŸ”— 3Blue1Brown (YouTube) There's never been a better time to go into math rss

      Sharing a few thoughts on the future of math These videos are funded directly by viewers: https://3b1b.co/support An equally valuable form of support is to simply share the videos. Home page: https://www.3blue1brown.com

      If you want a finger on the pulse of how mathematicians are feeling right now, take a look at this post on Proofs and Prompt: https://proofsandprompts.com/2026/10/08/100-reactions-to-100-solutions/

      Timestamps 0:00 - Math student angst 3:10 - How does math work? 11:24 - A proof machine 25:12 - A conjecture machine 26:59 - A theory machine 31:31 - If AI is better at everything 34:58 - The best time to enter math

      Secret Endscreen Vlog: https://youtu.be/4GV1qlv_3qU

      These animations are largely made using a custom Python library, manim. See the FAQ comments here: https://3b1b.co/faq#manim

      Music by Vincent Rubinetti. https://vincerubinetti.bandcamp.com/album/the-music-of-3blue1brown https://open.spotify.com/album/1dVyjwS8FBqXhRunaG5W5u

      3blue1brown is a channel about animating math, in all senses of the word animate. If you're reading the bottom of a video description, I'm guessing you're more interested than the average viewer in lessons here. It would mean a lot to me if you chose to stay up to date on new ones, either by subscribing here on YouTube or otherwise following on whichever platform below you check most regularly.

      Mailing list: https://3blue1brown.substack.com Twitter: https://twitter.com/3blue1brown Bluesky: https://bsky.app/profile/3blue1brown.com Instagram: https://www.instagram.com/3blue1brown Reddit: https://www.reddit.com/r/3blue1brown Facebook: https://www.facebook.com/3blue1brown Patreon: https://patreon.com/3blue1brown Website: https://www.3blue1brown.com

    5. πŸ”— mandiant/capa v10.0.0 release

      This release fixes a security issue in how capa loads vivisect workspaces, a large batch of bug fixes, a new --reproducible flag for freeze, dependency updates, and 12 new rules. We'd like to thank the following contributors: Ange Albertini (@corkamig), @aryanyk, Luca Schrott (@1337Name), @eversinc33, Matt Williams (@mwilliams31), Rizky Mirzaviandy Priambodo (@Xavrir), Sukesh Kumar (@SkxOverKill), lakshit verma (@vee1e), @w3lld1, and others!

      Security

      Crafted .viv files could execute code when capa analyzed a sample: either the sample itself named *.viv, or a <sample>.viv next to it. capa now always parses samples as PE or ELF and only loads an existing <sample>.viv when CAPA_LOAD_VIV_WORKSPACE=1 is set. Only enable this for .viv files you trust.

      Affected: v9.4.0 and earlier.

      New Features

      • freeze: add --reproducible flag that zeros dynamic header metadata

      Breaking Changes

      • Remove redundant os_ parameter from capa.loader.collect_metadata(). External scripts calling this function must be updated to remove this argument. OS metadata now relies solely on the extractor yielding it via extract_global_features(). @mike-hunhoff #3076
      • Existing <sample>.viv vivisect workspace files are no longer loaded by default because loading them uses pickle deserialization. Set CAPA_LOAD_VIV_WORKSPACE=1 to opt in. @mr-tz #3191

      New Rules (12)

      Bug Fixes

      • fix: loader: inline vivisect workspace loading and gate .viv pickle deserialization behind CAPA_LOAD_VIV_WORKSPACE @mr-tz #3191
      • fix: freeze: omit null description fields from freeze JSON @SkxOverKill #3100
      • fix lots of linter errors identified by pyright @williballenthin #3052
      • fix: render_default always returns empty string @williballenthin #3012
      • fix: elf.py vdso_guess exception handler clobbers symtab_guess @williballenthin #3013
      • fix: _NoAddress.eq unconditionally returns True @williballenthin #3014
      • fix: capabilities/common.py: if va: drops address 0x0 @williballenthin #3015
      • fix: vverbose.py: render_call variable assigned but never used @williballenthin #3016
      • fix: extract_os yields duplicate/contradictory OS values @williballenthin #3017
      • fix: load_one_jsonl_from_path: finally block runs on unrelated exceptions @williballenthin #3018
      • fix: find_dynamic_limitations_from_cli overwrites instead of OR-ing @williballenthin #3019
      • fix: optimizer doesn't recurse into And/Or/Some children @williballenthin #3020
      • fix: address classes eq and lt assert on type @williballenthin #3021
      • fix: DNTokenOffsetAddress.eq lacks type guard @williballenthin #3022
      • fix: elffile.py: get_base_address returns None instead of NO_ADDRESS @williballenthin #3023
      • fix: base_extractor.py: metaclass is Python 2 syntax, ignored in Py3 @williballenthin #3024
      • fix: freeze/init.py: NO_ADDRESS < NO_ADDRESS returns True @williballenthin #3025
      • fix: dotnetfile.py: missing import for capa.features.extractors.common @williballenthin #3026
      • fix: rules/init.py: duplicate bytes_features line @williballenthin #3027
      • fix: EXTENSIONS_DYNAMIC has inconsistent leading dots @williballenthin #3028
      • fix: loader.py reads entire file for magic byte check @williballenthin #3029
      • fix: freeze/init.py: logically impossible condition @williballenthin #3030
      • fix: EXTENSIONS_ELF never referenced @williballenthin #3031
      • fix: correct off-by-one in get_dotnet_table_row so row_index=1 (first valid .NET metadata row) is no longer rejected @williballenthin
      • fix: add missing import for assert_never in cape extractor.py to avoid NameError when call argument has unexpected type @williballenthin
      • fix: stop mutating call.api in cape thread.get_calls; yield one CallHandle per call so the original API name is preserved for all handles @williballenthin
      • fix: use instruction_indices in is_security_cookie to handle single-instruction basic blocks where end_index is omitted, preventing KeyError on -1 @williballenthin
      • fix: guard get_operand_expressions against empty expression tree so Ghidra-exported BinExport2 files with empty operands no longer raise IndexError @williballenthin
      • fix: add return after zero-offset yield in extract_insn_offset_features so Offset(0) is not emitted twice @williballenthin
      • fix: use f-string in binexport2 extractor so unexpected global feature value appears in ValueError message @williballenthin
      • fix: correct scale/displacement expressions in get_operand_phrase_info 5-expression branch (used expression3 operator instead of expression4 value) @williballenthin
      • fix: use HasField instead of truthiness in _index_vertex_edges so call-graph edges to/from vertex 0 are not silently dropped @williballenthin
      • fix: change bare if to elif in get_backend_from_cli DRAKVUF branch to complete the if/elif chain @williballenthin
      • fix: close file handle in get_file_taste using a with statement @williballenthin
      • fix: correct off-by-one in dynamic analysis call_count debug log (enumerate -> explicit counter) @williballenthin
      • fix: correct capa/subscope-rule key in RuleMetadata so is_subscope_rule is no longer always False @williballenthin
      • fix: remove unreachable backports.functools_lru_cache fallback and dead dependency @williballenthin
      • fix: Scopes.from_dict uses cls instead of self so subclasses return the correct type @williballenthin
      • fix: correct wrong dict key in VMRay _compute_monitor_threads assertion (used thread_id instead of process_id) @williballenthin
      • fix: replace assert with isinstance guard in get_callee for invalid MethodSpec tokens @williballenthin
      • fix: remove unused imports of capa.engine, capa.helpers, and capa.features from cache-ruleset.py, detect-binexport2-capabilities.py, and show-capabilities-by-function.py @williballenthin (SURF-92)
      • fix: remove dead except ValueError clause in capa2sarif.py so JSONDecodeError is caught by the specific handler @williballenthin (SURF-91)
      • fix: dedent bulk-process.py main() body so explicit argv argument is used instead of silently ignored @williballenthin (SURF-90)
      • fix: guard statistics.quantiles/mean in compare-backends.py report() against empty duration lists @williballenthin (SURF-89)
      • fix: replace zipfile with pyzipper in minimize_vmray_results.py so output archive is AES-encrypted @williballenthin (SURF-88)
      • fix: assign yara_strings/yara_condition to empty string when Some has cmin=0 to prevent UnboundLocalError @williballenthin (SURF-87)
      • fix: parenthesize s_type checks in capa2yara.py so kid.name != "Some" guard applies to And/Or/Not uniformly @williballenthin (SURF-86)
      • fix: correct operator precedence in FeatureRegexRegistryControlSetMatchIncomplete to avoid false positives on unrelated currentcontrolset patterns @williballenthin (SURF-85)
      • fix: FeatureRegexRegistryControlSetMatchIncomplete now checks all Regex features instead of returning after the first @williballenthin (SURF-84)
      • fix: MissingStaticScope and MissingDynamicScope lint checks guard against absent scopes dict to prevent TypeError @williballenthin (SURF-83)
      • fix: MissingExampleOffset lint now reads scopes.static instead of obsolete scope key @williballenthin (SURF-82)
      • fix: extend MissingExampleOffset lint to validate dynamic examples using (pid:N,tid:N,call:N) format @williballenthin #3058
      • fix: invert scope filter in import-to-ida.py so function-scope rules are annotated instead of skipped @williballenthin (SURF-81)
      • fix: remove dead string literal in test_detect_duplicate_features @williballenthin (SURF-80)
      • fix: remove duplicate Rule.from_yaml call in test_scope_instruction_description @williballenthin (SURF-79)
      • fix: remove unused imports of capa.helpers, capa.features.basicblock, and redundant bare capa.features.extractors.base_extractor from test_freeze_dynamic.py @williballenthin (SURF-78)
      • fix: replace capa.main.find_capabilities with capa.capabilities.common.find_capabilities in test_com_feature_matching to avoid implicit transitive import dependency @williballenthin (SURF-77)
      • fix: correct test_json_meta to iterate list of function dicts and use correct address format for matched_basic_blocks assertion @williballenthin (SURF-76)
      • fix: remove unreachable StaticAnalysis assert in assert_meta and add dynamic fixture to test_doc_to_pb2 @williballenthin (SURF-75)
      • fix: correct self-comparison sa.max == sa.max to sa.max == sb.max in test_proto assert_statement @williballenthin (SURF-74)
      • fix: guard parse_node against missing "type" key to avoid TypeError crash @williballenthin (SURF-73)
      • fix: allocate feat_dict per feature in parse_json to avoid shared-reference aliasing @williballenthin (SURF-72)
      • fix: add missing capa.features.extractors.elf import to ghidra/helpers.py and ida/helpers.py @williballenthin (SURF-71)
      • fix: remove dead view_tab_rulegen assignment from CapaExplorerForm that was never read @williballenthin (SURF-70)
      • fix: remove dead reset_query method from CapaExplorerSearchProxyModel that was never called @williballenthin (SURF-69)
      • fix: remove unused imports of capa.rules and capa.engine from view.py @williballenthin (SURF-68)
      • fix: remove unused imports of capa.main, capa.render.json, and capa.features.extractors.ida.extractor from form.py @williballenthin (SURF-67)
      • fix: remove dead trim_function_name function from form.py that was never called @williballenthin (SURF-66)
      • fix: replace get_file_md5/get_file_sha256 with retrieve_input_file_md5/sha256 shims so all callers use consistent IDA version-aware API @williballenthin (SURF-65)
      • fix: rename dragEventEnter to dragEnterEvent so Qt dispatches drag-enter events correctly in CapaExplorerRulegenEditor @williballenthin (SURF-64)
      • fix: guard against None in lessThan else-branch so sorting columns with empty cells does not raise AttributeError @williballenthin (SURF-63)
      • fix: add explicit import capa.loader in form.py to avoid fragile transitive import dependency @williballenthin (SURF-62)
      • fix: initialize f=None before try block in load_capa_function_results to prevent UnboundLocalError in except handler @williballenthin (SURF-61)
      • fix: fix unreachable elif for NOT CompoundStatement so NOT rules render children in IDA plugin tree view @williballenthin (SURF-60)
      • fix: use next(iter(addrs)) instead of addrs.pop() to avoid mutating the feature cache in parse_features_for_tree @williballenthin (SURF-59)
      • fix: use integer division in get_printable_len for UTF-16 LE operands @williballenthin (SURF-58)
      • fix: break thunk chain loop after resolving import to avoid duplicate API features @williballenthin (SURF-57)
      • fix: pass insn instead of oper to getOperValue/getOperAddr in viv insn extractor @williballenthin (SURF-56)
      • fix: implement extract_function_loop in dnfile extractor to detect backward branches as loops @williballenthin (SURF-55)
      • fix: remove dead find_process function and helpers.py from cape extractor @williballenthin (SURF-54)
      • fix: remove dead interface_extract_* stub functions from viv basicblock, function, and insn extractors @williballenthin (SURF-53)
      • fix: remove unused import of capa.features.extractors.strings from binexport2 intel insn.py @williballenthin (SURF-52)
      • fix: remove extract_file_format from FILE_HANDLERS in five extractors to prevent duplicate Format features @williballenthin (SURF-51)
      • fix: replace assert with guard so 2-operand ARM ADD/SUB instructions are skipped instead of crashing @williballenthin (SURF-50)
      • fix: omit trailing -> suffix in syscall names when there is no return value @williballenthin (SURF-49)
      • fix: use AbsoluteVirtualAddress instead of FileOffsetAddress for string addresses in Ghidra and IDA file extractors @williballenthin (SURF-48)
      • fix: use dest.value.value and indirect_src.value.value for LLIL_CONST call destinations in binja insn.py @williballenthin (SURF-47)
      • fix: remove duplicate getPrevLocation call and dead loc variable in get_previous_instructions @williballenthin (SURF-46)
      • fix: unpack getByteDef offset and slice buffer so ENDBRANCH check applies to target address, not segment start @williballenthin (SURF-45)
      • fix: guard getByteDef against None return for unmapped addresses in viv insn extractor @williballenthin #3057
      • fix: correct inverted loop structure in extract_function_loop so each block edge is recorded as (src, dest) @williballenthin (SURF-44)
      • fix: initialize addr to None in Ghidra import extractors to prevent UnboundLocalError when external functions have no data references @williballenthin (SURF-43)
      • fix: replace assert with isinstance guard in get_callee for invalid MethodSpec tokens @williballenthin
      • fix: assign ConfigDict to model_config in ConciseModel so extra="ignore" is actually applied @williballenthin (SURF-42)
      • fix: replace assert with isinstance guard in get_callee for invalid MethodSpec tokens @williballenthin (SURF-41)
      • fix: incorrect bytes() constructor usage in buf_filled_with @mike-hunhoff #3077
      • fix: remove redundant code related to cli loading @mike-hunhoff #3076
      • fix: optimize all_zeros using fast bytes comparison @mike-hunhoff #3078
      • fix: duplicate rule candidate evaluation in optimized matching engine @mike-hunhoff #3080

      capa Explorer Web

      capa Explorer IDA Pro plugin

      • ida: display file-scope feature addresses (file:0x...) in rule generator tree and safely handle file-offset navigation/filtering @vee1e #3009

      Development

      • ci: key vivisect workspace cache on vivisect, viv-utils, python-flirt versions and FLIRT signatures, shared across Python versions @mr-tz #3195
      • ci: test macos-15-intel only on Python 3.10, matching the Intel build @mr-tz #3195
      • tests: update binja version to 5.3 @mr-tz #3011
      • ci: use explicit and per job permissions @mike-hunhoff #3002
      • replace black/isort/flake8 with ruff @mike-hunhoff #2992
      • ci: update GitHub Actions to support Node.js 24 (deprecate Node.js 20) @mr-tz #2984
      • tests: add snapshot tests for feature extraction @williballenthin #3069
      • tests: add more tests to exercise ELF OS detection @williballenthin #3098

      Raw diffs

    6. πŸ”— Kagi release notes Oct 16th, 2026 - Smarter search widgets, Privacy Pass upgrades, and a calmer Assistant rss

      Search

      • We added a small animation to the coin widget – and clicking the coin does another flip! Try it for yourself!

      • We've increased the Quick Bangs and Quick Snaps limit from 20 to 50 #11480 @Kage), and known scam / phishing sites are now blocked when Safe Search is enabled, rather than just being downranked.

      • The weather widget has been updated. Its triggers have been improved and now support more than 40 languages. This change closes several issues: #3348 @CrunchyFritos, #4525 @lawngnome, #4612 @laiz, #3326 @ak42, #6474 @bram

      Improvements and bug fixes

      Browser Extensions & Privacy Pass v1.0.13

      • Kagi Search Extension Firefox Container Support #11563 @michaeljcallahan
      • Provide option to disable adding context menus in Firefox extension #8139 @emptyjar
      • Privacy Pass now works with Quick Answer & Inline Summarize features
      • Fetching session cookies no longer fails under First-Party Isolation (privacy.firstparty.isolate), which is the default in the Tor browser
      • Website Info doesn't work on Privacy Pass #11609 @Kagi_Search_User

      Assistant

      • Response steps are now fully collapsible, giving you a calmer space to get all your work done.

      • A Help menu has been added to the sidebar for quick access to helpful links.
        {Assistant Help menu in sidebar}

      Apps

      • We saw reports from users unable to send follow-up messages on the mobile apps. This issue has been resolved. We apologize for the inconvenience.

      Improvements & Bug Fixes

      Translate

      • Kagi Translate has turned my blog post into a kagi.com page that outranks me, untranslated #11490 @AviD
      • Centred, dynamically expanding YouTube subtitles are nearly unreadable #10283 @JR

      Translate Extension

      • Kagi Translate Extension QOL Features #9470 @GravityMan
      • Proofread bang doesn't work when text contains a dot (in combination with Kagi translate plugin) #9734 @KagiMan
      • Proofread in Kagi Translate extension doesn't preserve line breaks #10634 @hmnd
    7. πŸ”— DioxusLabs/blitz v0.3.0-beta.4 release

      v0.3.0-beta.4

    8. πŸ”— HexRaysSA/plugin-repository commits sync repo: +7 releases rss 
      sync repo: +7 releases

## New releases
- [IDA-MCP-Hub](https://github.com/captain-ai-hub/ida-mcp): 0.9.7, 0.9.6, 0.9.5, 0.9.4
- [functionloader](https://github.com/tien0246/functionloader): 0.1.1
- [mcrit-ida](https://github.com/familiary/mcrit-plugin): 2.1.1, 2.1.0
    9. πŸ”— smol-machines/smolvm smolvm v1.29.1 release

      What's Changed

      • Keep host directory mounts in checkpoints on request and always when pausing by @BinSquare in #1793
      • Sweep partial downloads abandoned for a day that no pull holds, at most hourly from the pull path, so cancelled pulls no longer leave partial blobs on a node forever. by @BinSquare in #1794
      • Retry image pulls cut off by a dropped connection by @BinSquare in #1798
      • Let a branch set labels on its child by @BinSquare in #1799
      • Record machine lifecycle events in a local usage journal by @BinSquare in #1780
      • Extract a zstd-compressed agent rootfs without a zstd program by @BinSquare in #1801
      • Unpack image layers with GNU tar so symlinks keep their owners by @BinSquare in #1805
      • Count a macOS process's CPU time in nanoseconds instead of mach ticks by @AlixANNERAUD in #1807
      • Stop machine run -i spinning forever on macOS when stdin is /dev/null by @RitikaxG in #1804
      • Record symlink owners on their parent directory in Linux host-extracted layers by @BinSquare in #1809
      • Pin libkrun at the hinted free page zeroing fix, so a machine's later checkpoints, restores and branches skip memory the guest freed (2.4 GB to 0.26 GB in one test). by @BinSquare in #1800
      • Pin libkrun at the symlink owner record, so .smolmachine symlinks keep their image owners on Linux hosts by @BinSquare in #1810
      • Let a checkpoint capture reply once the artifact is held on the node and upload it later through POST /checkpoints/{key}/upload, so a caller no longer waits on a multi-gigabyte upload it does not need. by @BinSquare in #1795
      • Add serve --guest-rollout-port by @BinSquare in #1811
      • Mount the image seed behind every attached disk so exporting an image machine works when VMs run under their own uid by @BinSquare in #1812
      • Mirror the pod netns gateway neighbor and route state into the guest by @quantike in #1781
      • Keep the local API socket private before publishing it by @BinSquare in #1709
      • Avoid UID registry warnings when deleting unassigned VMs by @BinSquare in #1708
      • Resolve guest hostnames in image VMs and restored clones by @BinSquare in #1705
      • Preserve source VM CPU and memory when creating a pack by @BinSquare in #1693
      • Let non-root image users write to fresh workspaces by @BinSquare in #1688
      • Skip unused packed-layer device for VM-mode machines by @BinSquare in #1678
      • Preserve installed agent rootfs when relocating machine state by @BinSquare in #1667
      • Test the DNS allow-list helper against a fixed resolver, not the host's by @BinSquare in #1665
      • Fail a boot for lack of progress, not for being slow by @BinSquare in #1788
      • Make file operations target the filesystem exec uses and give each image run its own overlay by @BinSquare in #1564
      • Hash a published cache disk while it uploads instead of before by @BinSquare in #1814
      • Pin libkrun at the macOS symlink xattr fix, rebuild every bundled libkrun, and test packed symlinks by @BinSquare in #1817
      • Bump smolvm to 1.29.0 on main by @BinSquare in #1818
      • Read a chain with sixteen threads when flattening it for a publish by @BinSquare in #1823
      • Boot packed and cached runs on macOS in a fresh _boot-vm process so a registry pull no longer crashes the VM by @BinSquare in #1821
      • Show a running machine's CPU and memory usage with machine stats by @AlixANNERAUD in #1808
      • Accept a local archive, stdin or rootfs directory on pack create --image by @NickyHeC in #1797
      • Restamp skill packets on v1.29.0 and remove duplicated docs by @NickyHeC in #1822
      • Prepare SmolVM v1.29.1 for release by @BinSquare in #1824

      New Contributors

      Full Changelog : v1.28.1...v1.29.1

    10. πŸ”— New Music Releases The Smashing Pumpkins - Black Stars rss

      The Smashing Pumpkins - a new release is available:

      • 2026-10-16: Black Stars (Single)

      Amazon: Canada | Deutschland | France | United Kingdom | United States

      Visit muspy for more information.

    11. πŸ”— New Music Releases Caspian - Caspian rss

      Caspian - a new release is available:

      • 2026-10-16: Caspian (Album)

      Amazon: Canada | Deutschland | France | United Kingdom | United States

      Visit muspy for more information.

    12. πŸ”— New Music Releases Max Richter - While the Flood Rages rss

      Max Richter - a new release is available:

      • 2026-10-16: While the Flood Rages (Album)

      Amazon: Canada | Deutschland | France | United Kingdom | United States

      Visit muspy for more information.

    13. πŸ”— New Music Releases Paul Oakenfold - Eyes on You (Big Brother Theme) rss

      Paul Oakenfold - a new release is available:

      • 2026-10-16: Eyes on You (Big Brother Theme) (Single)

      Amazon: Canada | Deutschland | France | United Kingdom | United States

      Visit muspy for more information.

    14. πŸ”— New Music Releases Kings of Leon - KOYSAR rss

      Kings of Leon - a new release is available:

      • 2026-10-16: KOYSAR (Single)

      Amazon: Canada | Deutschland | France | United Kingdom | United States

      Visit muspy for more information.

    15. πŸ”— New Music Releases Eelke Kleijn - Her Name rss

      Eelke Kleijn - a new release is available:

      • 2026-10-16: Her Name (Single)

      Amazon: Canada | Deutschland | France | United Kingdom | United States

      Visit muspy for more information.

    16. πŸ”— New Music Releases Kygo - Before You Know It rss

      Kygo - a new release is available:

      • 2026-10-16: Before You Know It (Single)

      Amazon: Canada | Deutschland | France | United Kingdom | United States

      Visit muspy for more information.

    17. πŸ”— Ampcode News See Your Runner's Desktop rss

      You can now see and control your macOS or Linux runner's desktop. This is nice for trying native apps that Amp builds for you, such as iOS apps:

      Turn on Share This Mac's Display under Settings β€Ί Runner in the macOS app, or start your runner with amp --no-tui --desktop.

      The Runner tab in the Amp macOS app's settings, with Share This Mac's Display turned on and its Sharing status highlighted. The Runner tab in the Amp macOS app's settings, with Share This Mac's Display turned on and its Sharing status highlighted.

      Your Amp client connects directly to the runner, so it's nearly instant when the runner is on your local network or nearby.

      Read See and Control the Runner's Desktop for more details.

generated: October 19, 2026 at 16:16:37