InfoQ

Yelp Combines Native and Server-Driven UI for Its AI Assistant

Leela Kumili — Fri, 06 Nov 2026 14:25:00 GMT

Yelp combines native mobile controls with server-driven conversation rendering in its AI Assistant using the CHAOS framework. The architecture separates view configuration from conversation data, supports backend-driven chat interactions, and enables faster UI updates without new app releases. Yelp also discusses cross-platform challenges and reuse for its Biz Ask Anything pilot.

By Leela Kumili

GitLab 19.5 Makes Agentic Development a Governed Part of the DevOps Platform

Craig Risi — Fri, 06 Nov 2026 12:00:00 GMT

GitLab 19.5, released on October 15, puts agentic software development and governance at the centre of the platform, making its GitLab MCP server generally available while expanding how external AI agents can interact with GitLab.

By Craig Risi

TypeScript 7.1 Beta: Restores the Compiler API and Makes Vue and Svelte First-Class

Daniel Curtis — Fri, 06 Nov 2026 11:06:00 GMT

TypeScript 7.1 Beta, announced October 20, 2026, restores the compiler API removed in 7.0, now split into separate entry points. It adds content mappers, letting tools like Vue check non-standard files. One Vue project's type checks fell from 14.19 to 3.10 seconds. An editor issue remains open, and teams may need TypeScript 6 alongside 7.

By Daniel Curtis

Presentation: The Socio-Technical Staff+ Engineer: Architecture, Culture and Organisational Change

Vanessa Formicola — Fri, 06 Nov 2026 11:00:00 GMT

Vanessa Formicola shares how technical leaders can move beyond "wishful architecture" by practicing holistic socio-technical engineering. She discusses why engineering leaders must account for organizational maturity, reward structures, geopolitical climate, and team dynamics, framing the staff-plus role as designing the conditions for technology to thrive rather than just picking tools.

By Vanessa Formicola

AWS Ships Continuum for Code Vulnerabilities

Steef-Jan Wiggers — Fri, 06 Nov 2026 10:00:00 GMT

AWS has made Continuum for code vulnerabilities generally available in two regions. The service proves exploitability by running real exploits in a sandbox, then opens fixes as pull requests. Published pricing charges per finding processed as well as per line of code, and practitioners are asking what would justify letting it merge fixes on its own.

By Steef-Jan Wiggers

Article: Identity as an Architectural Concern: Enterprise IAM Beyond Authentication

Vaishnavi Khosla — Fri, 06 Nov 2026 09:00:00 GMT

The way you design your identities will drive your data models, your service scope, and your revocation policies; enterprise identity management is thus an architectural problem, not an afterthought. Based on our experience in service account governance, this article touches upon graph vs. RBAC, integrating a vault you don't own, and bounding revocation latency for an event stream.

By Vaishnavi Khosla

Vault Fork OpenBao Adds External Keys and Quantum-Ready TLS

Matt Saunders — Fri, 06 Nov 2026 09:00:00 GMT

OpenBao has released version 2.7, adding read scaling for PostgreSQL-backed deployments, support for external hardware security module (HSM) and key management service (KMS) keys, and post-quantum cryptographic algorithms. The release also introduces control groups for human review of sensitive operations and new headers intended to keep requests consistent across load-balanced OpenBao nodes.

By Matt Saunders

GitHub Actions Lockfiles Reach GA to Secure Workflow Dependencies

Claudio Masolo — Fri, 06 Nov 2026 09:00:00 GMT

GitHub has made workflow dependency lockfiles for GitHub Actions generally available on October 28, 2026, two weeks after the feature entered public preview. Workflows can maintain clear tag and branch references.

By Claudio Masolo

Edera's Object Capability Bounded Authority Promises to Isolate Credentials From AI Agent Workloads

Olimpiu Pop — Fri, 06 Nov 2026 06:06:00 GMT

Edera announced Object Capability Bounded Authority, a security model that separates an AI agent's or MCP server's required authority from the credentials behind it. Hypervisor-enforced capabilities limit agents to specific actions without storing secrets in the workload. Initial releases cover scoped command execution and workload identity; credential-brokered API access will follow.

By Olimpiu Pop

Google Cloud API Gateway Introduces Streaming Support for Real-Time and AI-Powered Applications

Sergio De Simone — Thu, 05 Nov 2026 16:00:00 GMT

Google has announced the public preview of streaming support for API Gateway, extending its traditional request-response model to support applications requiring real-time communication. According to Google, this is particularly relevant for AI applications that provide streaming model responses, multi-step agent workflows, and interactive sessions.

By Sergio De Simone

Leapwork Play Reaches GA with Governance for Playwright Tests

Mark Silvester — Thu, 05 Nov 2026 15:56:00 GMT

Leapwork Play adds requirement traceability and approval workflows around portable Playwright tests. Full governance and audit capabilities require an enterprise package.

By Mark Silvester

Building a Culture for a Kubernetes-Based Platform in a Bank

Ben Linders — Thu, 05 Nov 2026 11:11:00 GMT

In banking, open source can earn trust by running real workloads, as Marcy Paramonova and Stéphane Cusin explained in their talk Building Cloud Native Culture in a Bank at KubeCon & CloudNativeCon Europe. Deploying Kubernetes was the easy part; the hard part was culture: community of practice, shared knowledge, rituals, ownership. Teams try things, keep what works, and improve bottom-up.

By Ben Linders

Presentation: Zero Trust Agent Systems that Pass Audits and Still Ship

Advait Patel — Thu, 05 Nov 2026 11:00:00 GMT

Advait Patel shares a playbook for securing AI agent systems in production. He discusses moving defense boundaries from the prompt to the tool layer, enforcing scoped workload identities, and mitigating prompt injection via tool outputs. He explains how to structure audit-ready observability and implement kill switches to protect critical data while keeping deployment fast and compliant.

By Advait Patel

Inkitt Builds a One-Shot PR Creator with Resumable Agent Orchestration

Leela Kumili — Wed, 04 Nov 2026 14:36:00 GMT

Inkitt built a one-shot pull request creator that automates small, low-risk code changes from task intake to draft PR creation. Its event-driven orchestrator persists workflow state, coordinates short-lived coding agent containers, bounds retries, and enforces permission restrictions while retaining human review and approval before changes can be merged.

By Leela Kumili

Presentation: Panel: Who Builds the Frontend Now? (And What Breaks When They Do)

Luca Mezzalira, James Hall, Danielle An, Ivan Zarea — Wed, 04 Nov 2026 11:00:00 GMT

The panelists explain how AI tools and vibe coding reshape frontend and mobile engineering. They share insights on evolving junior developer roles, managing AI-generated code review fatigue, designing systems for autonomous agents, enforcing architectural guardrails, and navigating economic shifts in open-source software sustainability.

By Luca Mezzalira, James Hall, Danielle An, Ivan Zarea