OpenAI Winds Down Cursor Contract & Devin Desktop Launches & pnpm 12.0 Ships

OpenAI ending its Cursor partnership, Windsurf rebrands to Devin Desktop with multi-agent support, and pnpm hits v12 with major breaking changes as the npm ecosystem consolidates around faster alternatives.

AI Coding Tools

Devin Desktop (formerly Windsurf) launches with an Agent Command Center for managing multiple agents in one place. All IDE extensions, workflows, settings, and in-progress work migrate automatically—no pricing changes for existing users. Windsurf for JetBrains (IntelliJ, PyCharm, WebStorm) continues separately. Read more
OpenAI is winding down its contract providing models to Cursor, with a proposed transition period ending November 12, 2026. Cursor users can bring their own OpenAI API key, use the Codex IDE extension with ChatGPT subscriptions, or switch to compatible gateway providers like Amazon Bedrock or Azure. Read more

Frameworks & Libraries

pnpm v12.1.0 shipped August 29, 2026—just three days after v12.0.0 on August 26. The major version bump introduces breaking changes while the 11.x line stays alive in parallel (11.25.0 also released August 29), giving the ecosystem time to adjust before the older branch is fully retired. Read more
Bun v1.4.0 (August 20) continues its aggressive release cadence—roughly every few weeks. As a full runtime, bundler, and package manager built on Zig and JavaScriptCore, bun install works as a drop-in npm replacement even in projects still running on Node.js. Read more
React and Vue drag-and-drop libraries have diverged: React ecosystem consolidated around @dnd-kit after Atlassian stopped maintaining react-beautiful-dnd, while Vue leans on vue-draggable-plus (newer) and SortableJS wrappers. A side-by-side tutorial with React 19 + dnd-kit v6 and Vue 3.5 + vue-draggable-plus shows where the approaches split in code and bundle size. Read more

Security

Five critical WordPress plugin flaws disclosed: CVE-2026-82222 (CVSS 10.0) in GiveWP ≤4.16.7.1 chains broken object deserialization with a gadget chain for RCE; CVE-2026-19598 (CVSS 9.8) in Pods – Custom Content Types and Fields ≤3.3.9 allows unauthenticated privilege escalation to admin, risking complete site takeover. Both require minimal prerequisites. Read more
CVE-2026-82452 (CVSS 9.3, CNA:VulnCheck CRITICAL): rust-iot-platform through commit 5df942ab lacks authentication guards on most REST API routes, allowing unauthenticated attackers to create, update, list, retrieve, and delete user accounts directly. Read more
CVE-2026-80725: Linux kernel GRO (Generic Receive Offload) out-of-bounds write when aggregating packets beyond 64KB. Improper validation of BIG TCP criteria allows non-IP protocols and encapsulated flows to bypass size checks, causing skb->mac_header wrapping and memory corruption. Read more

Open Source

EpicGames released Lore, a next-generation open-source version control system. Spans a family of repos with core library, server, CLI, plus SDKs for JavaScript, Python, C#, and Go. Fully open source with governance and maintainer docs. Read more
IBM Granite open-source AI models expand across language, code, and time-series modalities. Models and tools available on Hugging Face with code to download and experiment via the IBM-Granite GitHub organization. Focus on enterprise use cases and community-driven development. Read more

Dev Tools & IDEs

Junie CLI by JetBrains adds configuration file support (config.json) at user and project scopes. Supports MCP configuration, agent skills, custom slash commands, custom LLM models, and guidelines—with environment variable equivalents for CI and --config-location CLI flags. Read more