标签：#rce

GitHub热门项目 | ML-powered manga translator, written in Rust. | Stars: 5,136 | 109 stars this week | 语言: Rust

GitHub热门项目 | 🚀 通用 AI IDE 账号管理工具：支持 Antigravity / Codex / GitHub Copilot / Windsurf / Kiro / Cursor / Gemini-cli / CodeBuddy，多账号切换、配额监控、自动唤醒与多开实例管理。 🚀 Universal AI IDE account manager for Antigravity / Codex / GitHub Copilot / Windsurf / Kiro / Cursor / Gemini-cli / CodeBuddy, with multi-account switching, quota monitoring, wake-up automation, and multi-insta | Stars: 15,751 | 75 stars today | 语言: Rust

GitHub热门项目 | Collection of effects for React: Border beam, Liquid Gooey | Stars: 1,921 | 54 stars today | 语言: TypeScript

GitHub热门项目 | 🙌 OpenHands: AI-Driven Development | Stars: 84,010 | 120 stars today | 语言: TypeScript

GitHub热门项目 | 免费无广告的追剧资源指南，人工精选资源、每天检测资源有效性。收录在线影视、影视APP、网盘搜索、磁力BT、字幕、TVBox / 影视仓空壳软件/配置地址、IPTV直播源、会员拼团、影视相关开源项目。开源，社区共同维护。 | Stars: 5,766 | 71 stars today | 语言: JavaScript

GitHub热门项目 | 🎬 Fully automated YouTube channel management with AI agents. Creates, optimizes & publishes videos 24/7. Works with FREE Gemini API or OpenAI. No coding required! | Stars: 1,937 | 118 stars today | 语言: JavaScript

GitHub热门项目 | An open-source, GPU-accelerated physics simulation engine built upon NVIDIA Warp, specifically targeting roboticists and simulation researchers. | Stars: 5,341 | 15 stars today | 语言: Python

GitHub热门项目 | Community-contributed instructions, agents, skills, and configurations to help you make the most of GitHub Copilot. | Stars: 37,813 | 47 stars today | 语言: Python

Floating labels. Inline validation. Custom checkboxes, radios, and a toggle switch. A gradient button with a press-down micro-interaction. Every bit of it below is CSS — no form library, no useState , no event listener wiring up a class toggle. That's form.fscss — the module in the FSCSS ecosystem. Same philosophy each time: solve the hard visual problem once, ship it as importable mixins, let the browser do the actual work. <script src= "https://cdn.jsdelivr.net/npm/fscss@1.1.24/exec.min.js" defer ></script> <style> @import (( * ) from form ) @ form-root () @ form-group (. form-group ) @ form-input (. form-input ) @ form-label (. form-label ) @ form-float (. form-group , . form-input , . form-label ) @ form-checkbox (. form-checkbox ) @ form-btn (. form-btn ) @ form-btn-primary (. form-btn-primary ) </style> <div class= "form-group" > <input class= "form-input" type= "text" placeholder= " " > <label class= "form-label" > Full name </label> </div> <label class= "form-checkbox" > <input type= "checkbox" checked ><span></span> I agree to the Terms </label> <button class= "form-btn form-btn-primary" > Create account </button> The two tricks doing all the work Forms feel like they need JavaScript because most tutorials reach for it immediately. Two native CSS mechanisms cover almost everything a "modern" form needs. Floating labels run entirely on :placeholder-shown . Give the input placeholder=" " — a literal space, not empty — and the browser now knows, purely in CSS, whether the field is empty and unfocused: .form-input :focus + .form-label , .form-input :not ( :placeholder-shown ) + .form-label { top : -9px ; font-size : 11px ; color : var ( --form-accent ); } No state, no class toggling on keyup. The label just reacts to what the browser already knows about the input. Checkboxes, radios, and the switch all use the classic checkbox-hack: the real <input> stays in the DOM (so it keeps native keyboard support and form submission) but is visually hidden, and a sibling

TL;DR Welcome back to Dev Opportunity Radar. This is a weekly series where I share opportunities,...

This is a submission for DEV's Summer Bug Smash: Clear the Lineup powered by Sentry . The bug When you call @google/genai in streaming mode and the model asks to run a tool, Sentry's JavaScript SDK records that tool call to the span twice. One tool call in, two entries out. The attribute that carries them is gen_ai.response.tool_calls . It should hold one object per call. For a single streamed controlLight call it held two. Worse, the two did not even agree on their shape. Here is a real capture, which I come back to at the end: [ { "id" : "call_2079699" , "args" :{ "colorTemperature" : "warm" , "brightness" : 30 }, "name" : "controlLight" }, { "type" : "function" , "id" : "call_2079699" , "name" : "controlLight" , "arguments" :{ "colorTemperature" : "warm" , "brightness" : 30 }} ] Same id, same call, listed twice. One entry keys the parameters under args , the other under arguments . Anything reading this later sees two tool invocations where the model made one. Following the value The streaming instrumentation lives in packages/server-utils/src/ai/google-genai/streaming.ts . Every chunk of the stream runs through handleCandidateContent . That function wrote tool calls from two places: function handleCandidateContent ( chunk , state , recordOutputs ) { if ( Array . isArray ( chunk . functionCalls )) { state . toolCalls . push (... chunk . functionCalls ); // push #1 } for ( const candidate of chunk . candidates ?? []) { // ...finish reasons... for ( const part of candidate ?. content ?. parts ?? []) { if ( recordOutputs && part . text ) state . responseTexts . push ( part . text ); if ( part . functionCall ) { state . toolCalls . push ({ // push #2 type : ' function ' , id : part . functionCall . id , name : part . functionCall . name , arguments : part . functionCall . args , }); } } } } Push #1 spreads chunk.functionCalls into the accumulator. Push #2 walks candidate.content.parts and pushes every functionCall it finds. They look like two different sources. They

Every generative-AI app I worked on hit the same wall. Pick a backend — OpenAI for images, Volcengine for video, Mureka for music — and before long the app is full of that provider's SDK quirks: its field names, its sync-vs-async polling loop, its error shapes. Then if want to swap one backend, or add a second one for failover, and it's a rewrite. mm-gateway is an open-source Python gateway that sits in front of that mess. One provider-neutral contract — over 13 backends : OpenAI · Google · xAI · DashScope · Volcengine · Flux · Stability · ElevenLabs · MiniMax · Mureka · ACE-Step · OpenRouter · UdioAPI The idea is simple: provider wire formats never appear in application code. Every request goes through a strict, modality-specific envelope — an ordered list of typed input parts plus provider-neutral parameters — and each backend adapter translates that to its native SDK or REST shape. For more information, visit https://github.com/sloth-os/mm-gateway

As someone who is constantly exploring ways to make AI applications faster and cheaper, I found...

A hands-on test of BGE-M3 + Qwen3 (RAG vs. direct-context answering) on a real research paper and a full-length book including a retrieval bug hiding in a footnote, and one surprisingly good model behavior. I wanted to answer a simple question: when you feed a document to an AI model, is it actually reading it or just pattern-matching to whatever text happens to look similar to your question? So I built a small open-source pipeline to test this directly. For any document and question, it generates two separate answers: RAG answer: BGE-M3 finds the most relevant chunks of the document, and Qwen3 answers using only those chunks. Direct answer: Qwen3 reads the raw document text directly, no retrieval involved. Both run on a free Google Colab GPU. I kept the retrieval side deliberately "vanilla" fixed-size chunking, plain cosine similarity, no reranking, no fancy tricks so I could see exactly where the basic version breaks before adding any fixes. Before running my first real test, I already knew one thing to guard against: reference lists. Early experimentation (not covered here) showed that a paper's bibliography, once chunked like any other text, can get retrieved as if it were real content a citation for a paper about "text embeddings" can look deceptively similar to a generic question about a document's topic. So going in, my pipeline already strips everything after a References/Bibliography heading before chunking. With that fix in place, I ran two real tests. Test 1: A research paper on Nepali legal machine translation First document: a SIGUL 2024 workshop paper on a bidirectional English-Nepali machine translation system for the legal domain. Question: "What is this paper about?" RAG answer: This paper presents the first transformer-based bidirectional machine translation system for the English-Nepali legal domain, using a custom-built parallel corpus of 125,000 sentences. It achieves encouraging BLEU scores and addresses the scarcity of domain-specific legal tr

A couple of weeks ago I dropped the CRA text (the EU's cybersecurity regulation for IoT devices) into ChatGPT and asked when the main requirements actually kick in. The answer was confident and wrong - it mixed up the date the regulation entered into force (2024) with the date the requirements actually apply (2027). Three years off, stated like an obvious fact. My team (Platanor, embedded security for IoT) has been building an internal reference on CRA/RED/NIS2/CSA for a few months now, and this is exactly the kind of mix-up we kept running into whenever we just threw the regulation PDF at a model. The problem isn't the model. It's how the source is laid out: dates are scattered across different articles with no explicit link between them, token-based chunking cuts sentences off mid-article, and the model has no way to tell how fresh the text is. When we rebuilt the base as a public repository, we fixed this with file structure, not prompting. Cut by article headings, not by tokens: ### Article 13 Obligations of manufacturers 1. When placing a product... ### Article 14 Reporting obligations... ### Article N is a natural boundary. Each chunk stays whole - the article never gets split mid-sentence. Source priority, written into the file itself, not the prompt: primary source > official related documents > third-party summaries > our own analysis. The model sees this right next to the content, not as an instruction that's easy to lose in a long chat. A verification date on every file: > Last verified: 2026-08-10. > Annex I application deadline: 11 December 2027 (not to be confused with the entry-into-force date - 10 December 2024). That one line is what removed the exact error I opened with. llms.txt at the repo root - an index of every file, so an agent can pick what to load instead of reading the whole repository. The same questions now get answered correctly - not because the model got smarter, but because the source stopped being one continuous wall of text. We pac

How to rescue abandoned open-source projects, modernize build systems, and generate multi-architecture Docker images (x86_64, ARM64) in a single afternoon with Antigravity.

Nearly every AI agent benchmark you read is unfalsifiable. Not wrong, necessarily - unfalsifiable. There's a blog post with a bar chart, a claim that framework A beat framework B, and no way for you to check it. No run count. No model version. No raw output. Often no cost. You are asked to trust a summary statistic produced by people with an interest in the result. We publish agent benchmarks, so this is our problem too. This post is about the evidence bundle we settled on, and how you can pull one down and take it apart in about two minutes. Every command below is one I actually ran while writing this, with its real output pasted in. The claim we're going to try to break From one of our pilot runs: LangGraph 1.2.9 and Pydantic AI 2.13.0 both completed 20 of 20 tasks under gpt-4o , at a total spend of $0.094275. That's the sort of sentence you'd normally have to take on faith. Let's not. Two minutes to verify it yourself The bundle is a directory in a public repo. Pull it: BASE = "https://raw.githubusercontent.com/benchclawio/harness/main/results/gpt-4o-vs-gpt-4o-mini-tool-calling-2026-07-24" for f in SHA256SUMS README.md gpt4o-pilot-manifest-v0.4.0.json \ scored-pilot-gpt4o-raw-2026-07-24.jsonl \ scored-pilot-raw-2026-07-24.jsonl \ scored-pilot-analysis-2026-07-24.json \ scored-pilot-gpt4o-analysis-2026-07-24.json \ real-pilot-status-manifest-v0.3.0.json ; do curl -sfO " $BASE / $f " done First question: is this the same data we published, or has something drifted? sha256sum -c SHA256SUMS README.md: OK gpt4o-pilot-manifest-v0.4.0.json: OK real-pilot-status-manifest-v0.3.0.json: OK scored-pilot-analysis-2026-07-24.json: OK scored-pilot-gpt4o-analysis-2026-07-24.json: OK scored-pilot-gpt4o-raw-2026-07-24.jsonl: OK scored-pilot-raw-2026-07-24.jsonl: OK That's the cheapest integrity control there is and almost nobody ships it. It costs one line in your run script and it means a reader can tell the difference between the file you published and a file someone edited afte

We just shipped EverShop 2.2.1 — the largest release since 2.0. It folds in the React 19 work that had been sitting in an unpublished 2.1.3 branch and stacks four months of development on top of it: a visual page builder, a blog module, entity custom fields, a multi-language storefront with a translated admin, a rebuilt shipping and fulfillment stack, built-in cloud storage, product recommendations, and a serious security and performance pass. If you're upgrading an existing store, one number to keep in mind: 31 database migrations across 10 modules run automatically on first start. Several of them transform data and drop legacy tables, so back up your database first and read the breaking-changes section below. This release also patches several security vulnerabilities, so upgrading promptly is the right move. Here's a tour of what's new, and what you'll need to change if you maintain themes or extensions. Visual Page Builder The headline feature is a drag-and-drop editor for the storefront, living at /admin/page-builder . You edit any storefront route — plus CMS pages and landing pages — by composing widgets into your theme's areas, with layout-aware drag/drop. The workflow is draft-based: changes accumulate in a per-admin, per-theme draft changeset with per-widget auto-save. When you're ready you can publish immediately, or schedule a rollout for later — and those rollout plans stay editable and cancelable right up until they run. There's inline editing on the canvas (text and images edited in place, with an image picker that understands cloud storage), a layers panel, a "Globals" view for site-wide areas, and per-widget styling controls. Link fields resolve products, categories, CMS pages, and blog posts through a single unified link resolver. Because it's touching public-facing content, the whole editor pipeline went through a dedicated security-hardening pass and ships with an end-to-end test suite. Blog module EverShop now has a first-class blog core module: p

When a language-learning product says it teaches “the sounds of French,” one deceptively simple question appears immediately: how many sounds are there? There is no useful answer without first defining the job the inventory is meant to do. A phonological analysis, a pronunciation dictionary, a speech-recognition system, and a beginner curriculum can all model French sound structure differently without one of them necessarily being careless. They have different users, evidence, and failure costs. Our team encountered this while turning Parle's internal pronunciation inventory into a public CSV. We needed a list that could connect IPA symbols to French spelling patterns, example words, and short mouth cues for English-speaking beginners. We also needed to avoid presenting one product's learning model as the only correct account of French phonology. The result is a bounded dataset of 35 practical sound entries. This article explains the design decisions, the schema, and the limits we published with it. A teaching inventory is a model, not a census The International Phonetic Alphabet gives us a shared notation for describing speech sounds. It does not require every analyst or teacher to draw identical category boundaries for every language variety. The official IPA chart is a notation system; selecting a French inventory still requires linguistic and pedagogical decisions. Counts can change when an inventory treats any of the following differently: a contrast that is maintained by some speakers but merged by others; a marginal or loan sound that appears mainly in borrowed words; schwa, whose realization and deletion depend heavily on context and variety; a historical contrast that remains visible in spelling but not in every speaker's production; a phonetic realization versus a contrastive phoneme; a glide represented separately from its related vowel. For a curriculum, the important question is not “What number wins?” It is “What distinctions and cues help this audienc

Ruby Rose Bloom sells one-of-a-kind vintage — a self-hosted storefront, no Shopify, no marketplace underneath it. Search Console's "Merchant opportunities" report told me 3 active products weren't showing up on the Shopping tab, and I went looking for the setting to fix. There wasn't one. What I actually found, three days of digging later, is that "get into Merchant Center" is not one thing — it's several different surfaces, each fed by a different mechanism, and the one everyone talks about (the Shopping tab) turned out to be the least interesting of them. This post is the question I actually had, answered with screenshots taken today: I have a storefront. What does getting into Merchant Center buy me, and where do my products actually end up? It also has an ending I didn't plan. After three days of feed fields and structured data I opened one Search Console report I'd been ignoring and found that Google had indexed 5 of my 436 pages — and, chasing that, that essentially none of my product photos were in the image index either. Those two sections are the most useful thing here, and they're the part I'd read first if I were you. What Merchant Center actually is Before the surfaces: Merchant Center is not an ads product by default. There are two lanes. Free listings are unpaid — you register a feed, Google reviews the items, approved items become eligible to appear in Shopping-related placements at no cost per click. This is the lane a small shop should care about first, because it costs nothing beyond the engineering time to feed it correctly. Shopping ads are the paid lane on top — you attach a budget and the same feed becomes the input to a campaign. Ruby Rose Bloom is running free listings only; there is no ad spend anywhere in this post. Free listings in Merchant Center: approved items, no ad spend, click potential still "available soon" on a three-day-old account. Free listings is the whole story for this shop. Worth saying plainly since most "how to get on Goo