devopsy.kinsta.cloud

Author: Joab Jackson

Reflex’s Newly Open-Sourced XY Library Offers Faster Python Charting

A newly open-sourced Python charting library, called XY, from Reflex offers an advantage few other charting tools provide: massive scalability.

The library rethinks how to render a set of points on the computer screen, and opens new possibilities for using charts in daily workflows.

Most Python charting libraries today, such as Plotly, Bokeh, or Matplotlib, take a similar approach to creating charts: they serialize every data point and send it to the browser, where it is usually parsed by JavaScript. GPU acceleration can help, though portraying thousands to millions of rows can hog memory, slow interactions and frequently lead to crashes.

The XY library shifts all this heavy data processing to speedy Rust-built libraries, where the rendering job can be matched to the pixel/density surface of the screen. The core then only sends to the screen what the screen can physically display.

The library keeps the chart values in a ColumnStore format. The Rust-compiled libraries compute the level of detail, and transfers the results out as typed binary buffers.

A New Kind of Charting

This approach brings untold benefits, not the least of which is the memory saved by not sending data the browser can’t use.

The time it takes to render a chart stays about the same—around 80 milliseconds—regardless of whether you are plotting 10,000 or 10 million points.

While reducing the number of points, the software preserves the peaks, troughs and overall shape of the data. Even outliers and tail behavior is captured.

Another benefit is that the rendered charts are dynamic. Should the user want to zoom into a region of a chart, XY will recalculate the new area of interest. The user can drill all the way down to individual data points.

Reflex built XY to be a drop-in replacement for Matplotlib workflows. Existing charts in the pyplot format can be rerendered with XY.

The developers admit that XY doesn’t cover some charts rendered by other libraries. This initial release of XY only handles two-dimensional charts. It doesn’t draw polar or 3D charts. Overall, Plotly, Bokeh, and Matplotlib cover more chart types.

A New Horizon for Charts

The ability to quickly render large charts opens a new range of uses previously considered impracticable.

Entire datasets can be rendered without additional sampling. Dashboards can now show live data. The chart.append() method updates an existing chart, meaning dashboards can connect to a live data source without requiring a rebuild.

The library also sets the stage for sharing charts as stand-alone interactive files. A 10-million-point interactive scatter chart exports to 258 KiB of HTML, which is small enough to send as an e-mail attachment. The Plotly equivalent would be 259 MiB, Reflex calculated.

Time series data – Telemetry, market tick data, and log-derived metrics – can also be plotted. The library “renders the full series in one pass with every spike and drop intact, and zoom resolves them without a second query,” the documentation notes.

Installing XY into your Python environment is simple: either `pip install XY` or `uv add XY`, depending on which packager you are using. Import the library in your code and then the numbers can be added through a Python container. NumPy may or may not be used for this task.

Of course, XY can be integrated into Reflex, the company’s open source Python-based Web framework. Any XY chart can be turned into a Reflex component. No JavaScript, iframe, or separate chart service is required.

August 13, 2026
Open Source Code Just as Secure as Proprietary Software—If You Manage It Right, Says CISA
Open source can be just as safe as proprietary software, though government agencies (and private enterprises) should take additional measures to secure it properly, according to a new guide published by the U.S. Cybersecurity and Infrastructure Security Agency (CISA).

The report, “Open Source Software: Security Principles and Practices,” provides with guidance to help agencies comply with two Presidential Executive Orders (14144 and 14306) which both urged them to do a more thorough job securing the software they use, a response to recent exploits like Log4Shell and XZ utils.

CISA acknowledges that open source can provide immeasurable benefits to government agencies, not merely because it is available without licensing fees, but also because agencies can extend the software to meet their own requirements. But at the same time, open source software must be managed differently than proprietary software.

Malicious hackers (and increasingly AI agents) use vulnerabilities to gain entry and exploit systems. In the case of the vendor software, it is the vendor’s responsibility to provide timely updates should a software vulnerability be found, which agencies should apply as soon as possible.

With open source software, however, agencies need to take a more proactive role in patching and understand the dependencies, or additional software components, that an open source package relies on. Those components also need to be secured, the guidance advises.

The guidance describes established principles for patching. It also provides a framework to evaluate trustworthiness and risk tolerance of software packages, as well as a set of best practices to procure, deploy and maintain open source software.

In practical terms, agencies wishing to use open source should establish a process that supports staff in choosing the software that meets the agency’s needs but minimizes risks to the agency.

For instance, an agency’s Office of the Chief Information Officer may set up a system to pre-approve certain software libraries for use in the agency. Automated tools could help verify safe software packages, and reviews would consider potential risk exposure. The CIO could still individually sign off on higher-risk components, such as operating systems.

To help agencies, CISA produced the C4 Framework, which can be used to assess the trustworthiness of a software package. It looks at four factors (the four Cs):
- Codebase: Take a look at the actual source code and dependencies that make up the software component of interest. How recently was the last update committed? How many vulnerabilities have been found? How many out-of-date dependencies does it rely on?
- Community: How robust is the community that maintains and contributes to the project? Is it part of a foundation, or managed by a private company?
- Conduct: How is the project managed? Is there a vulnerability disclosure process? Do the project leaders follow their own code of conduct?
- Configuration: Is the default configuration secure? Are there guides for use in highly-sensitive environments?
Open source AI systems should go through additional checks, CISA recommends. Agents should get sufficient transparency into the training data, in addition to the software itself. “Only with transparency and access can agencies understand and study the software, analyze it for vulnerabilities, and remediate any found vulnerabilities or risks,” the guide recommends.

CISA has targeted this report to U.S. federal agencies, though the advice here is rock-solid for use in the industrial sector as well. Many businesses in finance and health care, for instance, routinely follow government guidance. So if your organization uses open source in any capacity, this report may be worth checking out.
July 31, 2026
Ornith Models Automate Agentic Coding With Self-Scaffolding

Ornith, a new family of open source LLM models from the DeepReinforce research collective, takes a novel approach to executing coding and debugging tasks: It generates an architectural framework to give the user’s harness a structured instruction set – a scaffold – to create an agent to complete the job.

Available in a set of four variants, the Ornith family was trained to work comfortably with complex software repositories undertaking complicated long-horizon jobs. Sure, LLMs can do these tasks now – until the job gets too complex. Ornith’s self-generated scaffolding ensures that it doesn’t forget the plot along the way.

“The model continuously improves not only its code generation abilities but also the orchestration strategy used to solve software engineering problems,” wrote AI tutorial engineer Mehul Gupta, in an introductory post.

Deep Reinforcement Expansion Pack

Ornith reads the user’s instruction, but instead of executing it directly it builds a scaffold, a learnable object. The scaffold serves as a place where Ornith can design –and refine – the architecture for the job.

According to Gupta, the scaffold is where the LLM can detail the reasoning sequences, memory organization, debugging strategy, tool invocation order and execution planning. The user’s harness then interprets the scaffold to generate an agent to execute the task.

When the job is finished, the scaffold is deleted. When a new task comes up, Ornith builds a fresh scaffold to execute that job.

“By jointly optimizing the scaffold and the resulting solution, the model can discover better search trajectories and generate higher-quality solutions,” the researchers state in a post.

Ornith builds the scaffolding from a set of rules developed in the model during training time. These models were built from an exhaustive self-learning process that used deep reinforcement learning techniques to computationally rotate through the possible ways of addressing an issue.

Four Models

Ornith’s four variants are: 9B Dense, 31B Dense, 35B MoE and 397B MoE. The “Dense” models activate every parameter (as measured by the “B” in the name), whereas the MoE (Mixture of Experts) models activate only the parameters needed based on their relevance for the task, though they have additional reasoning tools for specialized functions.

Each of the variants are built atop the open source Gemma 4 and Qwen 3.5, allowing the researchers to layer coding-specific deep RL rules over those models’ inherent fluency in language and world knowledge.

The dense models are best suited for running on local hardware. Ideal for a laptop, 9B Dense can write small scripts and execute various single-file cleanup tasks, whereas the 31B Dense requires a full workstation with up to 48GB of VRAM, but can internalize a full view of a complicated multi-file repository for tougher problems.

The MoE variants are best run in the cloud. The 35B MoE is perhaps best suited for quick continuous integration patching and code review. The 397B MoE is the flagship model, a competitor to Opus 4.7, in the organization’s estimation. This behemoth requires a cluster of GPUs to run smoothly, and can tackle the hardest coding problems.

Killer Performance

With this diversity of models, Ornith’s performance metrics are “just killing it all over the place,” with impressive marks across small, middle and large LLM categories, observed the Hyderabad, Telangana-based Data Science in Your Pocket YouTube channel. This is “a breakthrough … one of a kind model,” they noted.

In company tests, Ornith-1.0-397B outperformed Claude Opus 4.7 on Terminal-Bench 2.1, a benchmark for LLMs in terminal environments, scoring 77.5 to Claude’s 70.3.

Likewise, Ornith-1.0-35B significantly outperforms similar mid-sized models, including Qwen 3.5 (9 billion parameters) and Gemma 4 (12 billion parameters). It even rivaled the 31-billion-parameter Gemma 4 model.

July 1, 2026
Homebrew to Packages: No ID, No Service

Homebrew, the unofficial but default package manager for many Apple Mac users, now has safeguards to prevent supply-chain attacks.

The approach mimics how GitHub just fortified npm against attacks by establishing a set of trusted repositories to download from.

“The Homebrew team is aware of the supply-side security issues with other package managers. We’ve taken various steps to mitigate these risks for our users,” wrote current Homebrew Project Leader Mike McQuaid in the 6.0.0 introductory post.

Check the Guestlist

When Max Howell created Homebrew in 2009, he consistently named features with terms from beer brewing and consumption. Thus, when a user needs new software on their machine, they open a “tap” to a third-party repository.

Now, the software’s maintainers have added a safety mechanism to tap, preventing execution of installation code whose source hasn’t already been vetted by the user or by Homebrew itself. It debuted with the release of Homebrew 6.0.0 last week.

The Homebrew core engine now performs a gate check for each download request. Homebrew will block any tap that is not on a pre-approved list. The list is based on remote fully-qualified URLs. Other taps on the Internet will be considered untrusted until the user deems otherwise.

Users can still download third-party software, but only after issuing a separate command: ‘brew trust user/repo’.

Users can also add third-party taps, including their own. To install an untrusted app, the user specifies in the command the full qualified domain path to the installation formula.

Homebrew halts dependency downloading from untrusted sources, instead of silently downloading it in the background as previous versions did.

A Boolean `trusted` field is also baked into Homebrew’s state management, which gives auditors information on which downloaded taps are trusted.

Package maintainers may need to change their installation instructions and README files to detail how to put their repositories on their personal trust lists. Those with Homebrew baked into their CI/CD pipelines will need to write ‘brew trust’ commands into their setup scripts at the appropriate points.

New Recipe for Brewers

Every application in the Homebrew ecosystem must include a Ruby script that tells Homebrew how to download, compile and/or install the software. This is where the trouble starts.

Homebrew hasn’t yet been hit with any major attempts to poison its core repositories (that we know of), though other repositories, such as npm and PyPI, have been hit hard. Attackers altered setup scripts to sneak in poisoned packages (see: Shai-Hulud was one recent npm attack that used this approach).

In fact, the npm maintainers at GitHub re-engineered how npm downloads software using an approach similar to Homebrew’s, namely by blocking any installation scripts that don’t already have user approval. This update should come with the release of npm v12 due next month.

Brewski Changes for Linux Users Too

In addition to serving the Mac community, Homebrew is also used quite a bit in the Linux community as well. McQuaid and his colleagues did some security work for this group as well. They incorporated Bubblewrap into Homebrew, so that the software sandboxes application builds, tests and post-install phases (replicating a functionality Macs already offer).

With 6.0.0, this feature is automatically enabled for developers. When they test new software installations, Bubblewrap confines any actions taken by the start-up scripts to a new mount namespace.

Homebrew 6.0 is the first major release since version 5.0 last November. In addition to the security features, it also includes a new JSON API, which should speed downloads and reduce network chatter.

June 22, 2026
MiMo Code Is the Open Source Answer to Claude Code

Terminal-based coding assistants for AI-curious developers are hot these days, and the most popular choice appears to be Claude Code. But Anthropic’s commercial offering has a new open source rival: MiMo Code, released under an MIT license by Chinese smartphone giant Xiaomi.

Unlike Claude Code, MiMo Code is not restricted to a specific LLM provider. It was also optimized for “long-horizon automated programming tasks,” according to the introductory blog entry. The software aims to “maintain decision quality and state continuity over dozens or even hundreds of execution steps.”

The AI community has taken notice of this release. Since its v0.1 release last week, MiMo Code has garnered 9,000 stars on GitHub, and has been forked 783 times.

And unlike Claude Code, which costs $20 a month to start, MiMo is free, and may not even require connecting to a cloud provider, if the user installs a model on their own machine.

Tackling Long Horizon Memory Retention

Large Language Models (LLMs) are inherently stateless. They don’t remember the context from one task to the next.

To maintain continuity, the frontier lab model providers resubmit all the source material with each prompt. For long-running agentic operations, this approach can be prohibitively costly, so it falls on the code assist tools to maintain the context of long-running jobs.

Such tools typically manage this problem by providing LLMs with a short summary of previous work. Such automated compression, however, can lead to errors in long-term reasoning.

Instead, MiMo Code tasks a sub-agent to extract key information to store in a copy of SQLite, or in markdown files, which later can be consulted. The software also runs two background processes, called “Dream” and “Distill” to deduplicate identical material and derive reusable CLI commands, respectively.

MiMo Code also comes with provisions for running complex jobs in parallel.

“When the task scale becomes large enough — for example, migrating an entire project from one programming language to another — and dozens or even hundreds of parallel work units need to be coordinated simultaneously, round-by-round tool calls are no longer sufficient,” the company blog post stated.

A weakness of agents is that they specify orchestration logic in natural language, which is a recipe for errors.

MiMo Code’s Dynamic Workflow casts orchestration logic as JavaScript that runs in an isolated sandbox. Because the code is deterministic, all the threads of a workflow are guaranteed to execute: There are no hanging “if” statements without corresponding “then” executions. There are no “for … while” loops that prematurely stop functioning.

A New Way to Run Agents

Unlike Claude Code, MiMo Code does not wire the user to a single proprietary environment. Installing the application involves downloading the code and installing via a npm command (It requires Node.js to run)

In fact, as a Linux terminal application, MiMo Code doesn’t need to connect to external resources at all. Using the Ollama framework, users can run MiMo Code against a model, such as Qwen 2.5 Coder, running directly in the environment.

For benchmarks, Xiaomi paired MiMo Code with the latest release of its own model, the MiMo-V2.5 released in April. In three separate benchmarks (SWE-bench Verified, SWE-bench Pro and Terminal Bench), MiMo Code outperformed Claude Code – running either Claude Sonnet or MiMo-V2.5 – in running one-shot repository-level issues.

“Most of MiMo Code’s design goals—multi-turn memory, background state maintenance, completion verification, and cross-session evolution—mainly show their value in real development scenarios that continue for dozens of turns,” Xiaomi’s blog post boasted.

In a video review, Tyson Cung compared MiMo Code and Claude Code across a few real-world scenarios. He concluded MiMo is best for prototyping and learning projects, but Claude Code is best for production work, where the safety guardrails can be well worth the $20 monthly fee.

“The best way to decide is to try both,” Cung concluded. “Use each one on a real project and see which one fits your workflow.”

June 15, 2026
Cohere’s North Mini Code Lets Devs Stack Their Own AI

Toronto startup Cohere has released an open-weight model designed for developers to use to build their own AI stack.

The open-weight North Mini Code is a 30-billion-parameter “mixture-of-experts” (MoE) model. MoE equips a model with specialized neural nets for individual tasks, such as mathematics and code generation. Mistral pioneered this approach to compete with larger LLMs.

As a result, when it comes time to produce an answer, the GPU won’t need all 30 billion parameters. Instead, a router function picks the most appropriate experts to complete the task, reducing the working size to 3 billion parameters. This means the model, slimmed to 4 bit quantization, can be managed by a single NVIDIA H100 GPU.

In fact, you won’t need a data center of H100s at all to run this model. The open weight release, optimized for software engineering agentic tasks, is one of a growing number of technologies built with the intention to democratize AI – in this case for developers.

“Local deployment is one way of empowering people and making AI really something that works for them,” said Nick Frosst, in a video introduction to the model.

The weights of North Mini Code, under an Apache 2.0 license, are available on Hugging Face, and can be accessed from the Cohere API, Cohere Model Vault and OpenRouter LLM marketplace. It can also work with Cohere’s turnkey AI workplace platform, North.

“North Mini Code is designed for speed and efficiency, with a strong focus on minimizing total cost of ownership,” the blog post announcing the release stated.

Individuals and companies who want to aggressively use AI but worry about the high costs of commercially provided tokens should think about incorporating this mid-sized model into an AI stack.

AI on a Budget

When “you’re calling an API, you’re suddenly beholden to whatever that cost is,” Frosst said, referring to the commercial AI providers whose services have caught the attention of the public. As the period of subsidized tokens comes to a close, organizations and end-users will start scrutinizing their AI usage. They may find many of their jobs won’t necessarily need the full power (and expense) of a behemoth LLM service.

In the video, Frosst demonstrated a project he was working on, to build a thermostat regulator for his home, using North Mini Code running on his Mac Studio, with the help of MLX. The job took only about 20 GB of working memory.

Larger projects he ships off to an LLM, but many jobs of this size can be run on the user’s own machine (perhaps with a memory upgrade).

“When there’s something complicated, maybe I call out to a different model, a bigger one on an API,” Frosst said. “When there’s something simple, I just call the local model.”

“I think that’s a pattern that’s going to become a lot more popular, especially now as the price of tokens is suddenly something that people are thinking about,” he said.

North Mini Code charted a 33.4 on the Artificial Analysis Coding Index, placing it well above the average of 15, from among 128 comparable models (such as Mistral’s Devstral Small, Poolside, Qwen and Google Gemma).

The coding index found North Mini Code to be very fast, though it is very verbose. Producing 208 tokens a second, North Mini Code is “notably fast,” the site noted. In the benchmark, it generated 75 million tokens, more than three times the average.

In other words, the model is a bit chatty. Perhaps in future releases North Mini Code will be better able to keep its thought process to itself, and just deliver the needed solutions.

June 12, 2026
Perplexity Bumblebee Shakes Loose Hidden Threats on Dev Desktops

The fight to maintain security has moved to the engineer’s messy desktop.

Last week, AI search provider Perplexity open-sourced an internal tool, Bumblebee, for checking developer machines, either Linux or macOS, for vulnerable software.

Continuous integration pipelines have baked security checks into them, with Software Bills of Materials (SBOMs) ensuring that the correct version of a package makes it to runtime. So malicious attackers are gravitating to the underbelly of enterprise security, the developer’s laptop.

Most developer machines are no doubt teeming with unpatched and outdated software, byproducts of various experiments and projects. There’s probably an outdated version of Node.js on most machines, or perhaps a never-used Warp terminal. Or maybe they downloaded a malware-infested package at some point, and it is just sitting on the hard drive waiting to be activated.

And certainly, many Perplexity engineers have plentiful recipes for agents lying around, which could be augmented with evil commands without the engineer’s knowledge.

The dev’s local environment also likely has valuable credentials that can be used to further infiltrate a secured environment.

Bumblebee Goes from Folder to Folder Picking out Vulnerabilities

Bumblebee is a read-only scanner that is installed on developer computers to search for vulnerable software. It looks for packages, extensions, and AI tool configurations that have been used in other security breaches.

“Bumblebee is useful to all security teams. Whenever a new vulnerability is reported, they need to know right away if any of their machines were exposed,” stated the Perplexity blog about the Bumblebee release.

It should be noted that running Bumblebee requires a fair amount of preparation work for the organization.

In Perplexity’s case, the company built a catalog of potential threats, where each attack was manually reviewed. Potential threats can be identified from internal research, as well as from public disclosures, or third-party security consultations.

Each potential threat gets a GitHub pull request containing source links and a structured description detailing the ecosystem, and the name and version of the compromised software. The PR is manually reviewed, and if found relevant, entered into a catalog.

With this catalog, Bumblebee then checks the organization’s developer and engineer computers for these potential attack points. It can do either routine scans, as a part of a routine fleet maintenance schedule. Or, it can also perform a targeted scan of individual repositories or workspaces. It can also do a “response sweep” for a recently unearthed vulnerability.

Specifically, it looks for compromises in package managers. Yarn, npm, pnpm, Bun, PyPI, Go modules, RubyGems and Composer are all supported. It also inspects editor and browser extensions and MCP agent configurations.

According to Perplexity, it was important to keep Bumblebee as “read only” so any scanning activities don’t inadvertently kick malware into action.

The company also stresses that Bumblebee is not an Endpoint Detection and Response (EDR) platform that continuously monitors endpoint devices for runtime intrusions.

“SBOMs help answer what shipped, and EDR helps answer what ran or touched the network, but supply-chain response often needs a different view: messy local state across lockfiles, package-manager metadata, extension manifests, and supported developer-tool configs,” Bumblebee’s GitHub page states.

Dev Desktops as an Emerging Threat Surface

With SBOMs and EDRs locking down everything, it’s not surprising malicious attackers are turning to the developer’s desktop as an access point for nefarious activities.

In 2022, continuous integration service provider CircleCI suffered a breach that stemmed from malware on an employee’s laptop. Malware planted on the device allowed attackers to purloin customer credentials.

The LastPass breach of that year also stemmed from a DevOps engineer’s home computer. A keylogger that got on the machine allowed attackers to snatch the engineer’s master password that would ultimately give them access to 14 LastPass code repositories.

As Perplexity realizes, work laptops are a serious blind spot in most organizational security-in-depth strategies. Bumblebee shows how to shore up these devices, and leave no honey for the malicious hacker.

May 26, 2026
OWASP Adopts CVE Lite CLI to Boost Dependency Scanning

Checking for dependency vulnerabilities in freshly developed software is usually done near the end of the build process. Remediation at that point can be tricky.

Now, JavaScript and TypeScript developers can check for vulnerabilities themselves as they – or their agents – write their source code, using an open source project called CVE Lite CLI.

Last month, the Open Worldwide Application Security Project (OWASP) accepted CVE Lite CLI as an incubating project. Sonu Kapoor specifically created CVE Lite CLI to check vulnerabilities earlier in the development cycle.

Kapoor’s approach can be seen as a form of “shift left,” where the developer assumes more responsibility in ensuring the security of their code. It differs from how vulnerability scanning is typically done within production workflows, where security is a separate test that happens at the end of the development cycle.

Once installed, the app can scan your lockfiles – the dependency tree configuration – and check the installed dependencies for any vulnerabilities they may have, by referencing the Open Source Vulnerabilities database. If a vulnerability is found, it then generates a set of ready-to-copy commands that can be pasted into the command line to update from your given package manager (npm, pnpm, Yarn and Bun are currently supported).

CVE Lite CLI can also work offline, caching all the CVEs on a local database.

Parent-Aware Guidance

Other interface-based vulnerability remediation tools include GitHub’s Dependabot, The Node Package Manager’s npm audit, Google’s OSV-Scanner, Snyk CLI and the Socket CLI.

CVE Lite is smart with the transitive dependencies, pinpointing the exact root level of an errant package.

“Transitive parent update guidance is one of CVE Lite CLI’s core differentiators,” the documentation claims. “Instead of telling users to install a vulnerable transitive package directly, the CLI points at the parent package that controls the dependency path.”

A direct dependency is easy to replace. Transitive dependencies, or dependencies embedded within other dependencies, are trickier to sort out.

But CVE Lite is smart enough to know when the package is transitive. A lot of package managers, if they can’t find the embedded package, or if the parent package prevents it from updating the problematic dependency, will just put the new version of the embedded dependency in the root directory, which is effectively useless.

CVE Lite takes a different approach: Instead of updating the package itself, it updates the parent package.

CVE Lite CLI can even work with the Node.js Hoist model, where all the packages reside in the node_modules folder, reducing the problem of recursive nesting, though obscuring the dependency tree for most scanners.

There are a few immediate limits with this developer-first approach which must be considered in an overall security defense strategy.

CVE Lite doesn’t provide any runtime protection, so an organization will need separate tooling for that function. It is wholly dependent on a single CVE database, and thus may miss some vulnerabilities that don’t get reported there. The offline cache will continually need to be updated when the software is online.

The Problem of Vendoring

Hidden dependencies remain a quagmire for the open source community in general, especially as unpatched vulnerabilities are the major source of supply chain attacks – witness the Mini Shai-Hulud attack earlier this month in which 170 npm and PyPI packages were poisoned.

A user may install an app that comes with its own set of dependencies. Unless the app itself is updated (if it is updated at all), it may contain libraries or other code that will have known vulnerabilities. This is sometimes called “vendoring,” where a software provider introduces hidden vulnerabilities through third-party software.

Mitchell Hashimoto, creator of the popular Ghostty terminal, recommends forking any dependencies you use, trimming them to just what you need, and then embed them in your code and never update them, at least until something breaks.

“I’ve always said that updating is way riskier than latent bugs (which can be tracked and CVEs monitored),” he wrote on X. “If you are updating a dependency, it’s on you to analyze every single commit in the full transitive set of dependencies.”

May 26, 2026
Spacelift Intelligence Vibe-Codes Infrastructure
Whether the DevOps shops like it or not, they are feeling the pressure from AI. They’re expected to move more quickly, alongside their dev counterparts. The gruntwork that used to take weeks can be automated away, leaving time for fast prototyping, so the managers think.

According to Google Cloud’s 2025 DORA State of AI-assisted Software Development Report, 90% of developers now use AI tools, and 25% are now working alongside AI assistants.

Users of the Spacelift Infrastructure-as-Code platform now have some help with this automation, thanks to a new feature offering a conversational interface that purports to explain what is going on with their IT operations, and even make changes on the user’s behalf if necessary.

“Platform teams are expected to respond at the speed of experimentation while still maintaining security, compliance, and operational consistency,” wrote Technical Senior Product Manager Tim Davis, in a blog item posted today.

It is an application that essentially provides a spatial awareness of your infrastructure. It has access to your assets, all the building blocks inside Spacelift.

Lift Off

Spacelift’s eponymously-named flagship orchestration platform manages infrastructure-as-code (IaC)-style deployments.

Marcin Wyszynski, co-founder of Spacelift, in an interview with devopsy.kinsta.cloud, described the core Spacelift package as “multiplayer mode for infrastructure,” allowing multiple DevOps personnel to collaborate across multiple IaC tools.

When you have multiple people working on a project, there is a danger, without the proper toolset, that their changes could overwrite each other. “The moment you’re working as multiple people, you need some form of synchronization,” Wyszynski said.

Originally, Spacelift extended the capabilities of Terraform, and was grouped in an emerging set of tools known as TACOS (Terraform Automation and Collaboration Software).

Spacelift quickly expanded beyond Terraform into an IaC-agnostic platform that can also be used with other IaC deployment tools, such as Ansible, CloudFormation, Pulumi, and OpenTofu, an open source fork of Terraform (Terraform is now owned by IBM).

The new Intelligence feature builds off of a previous update from the company, the open source Spacelift Intent, released in September, provided a way to make changes in the infrastructure using conversational language. It essentially was an MCP server provisioned to execute changes on your infrastructure,” Wyszynski said.

Trust Incrementally

Spacelift Intelligence takes Intent a step further, in that it understands how your infrastructure is currently set up. It extends a new conversational interface that provides specific system-level information.

“A common theme among many of our customers is that infrastructure is a big, difficult topic, and there’s so many moving parts to it, and Spacelift is in the unique position to connect all of those dots and provide a single layer of understanding of what we’re doing, why we’re doing it,”

Leveraging Spacelift’s core platform, Intelligence can be used by DevOps to quickly spin up prototypes and testing scenarios. It uses Claude Sonnet 4.6, though users can plug in their own LLM.

With this software users can:
- Ask questions about infrastructure state, changes and issues,
- Provision and manage infrastructure using natural language, while staying within policy guardrails,
- Receive AI-generated diagnostics,
- Cut onboarding time through guided learning.
Of course, businesses are not going to initially trust AI with their infrastructure, the very lifeblood of their business. The company set up its software to adopt incrementally, allowing users to build trust over time. Start with visibility, then move towards provisioning and automation.

Less Drift, Faster Experimentation

In his post, Davis shared some lessons the company learned from customers after fielding Spacelift Intent.

Cityblock Health, for instance, used Intent to get a handle on their infrastructure. Developers already had access to self-service infrastructure, but without central guidance or policy control, the platform team found all the deployments increasingly difficult to track. Intent eliminated the need for developers to understand the company’s cloud constructs. Instead, they deployed through natural language. The platform-defined policies kept everyone on the same page.

“For Cityblock, that shift was less about replacing Infrastructure as Code and more about changing how teams reached it,” he wrote.

For Vega, an asset manager platform provider, Intent brought the ability to experiment much more quickly, without touching production systems. It allowed developers and engineers to spin up new assets within a pre-defined set of guardrails, which ultimately hastened experimentation

Other Spacelift customers include Duolingo, Figma, Moody’s, Checkout.com, 1Password, and Redfin.

Spacelift will be demonstrating Spacelift Intelligence at its booth (#796) at KubeCon + CloudNativeCon Europe 2026, being held next week in Amsterdam.
March 18, 2026