☕️ Cursor launches its own model router

Hi there, this is your daily ☕️ Devshot.

In today's Devshot:

🖱️ Cursor launches its own model router

🧊 FreeBSD froze ports over a 150MB commit

☁️ Cloudflare adds Cache Response Rules

🤖 Dependabot now waits 3 days before updates

⚛️ Jotai v2.20 reworks its store for speed

Plus: 🎁 13 other news you might like, 🧰 6 tools, and 📚 5 papers.

🖱️ Cursor launches its own model router LINK

Cursor Router looks at each coding request (how hard it is, what it's for, and the surrounding code) then sends it to whichever model fits best, so developers no longer pay frontier prices for simple work.

Instead of picking one model by hand in Cursor's settings and sticking with it, developers get automatic routing plus three modes that shift the balance between speed, cost, and raw power for each task.

Router draws on Cursor's Composer and Grok 4.5 models plus outside providers, saved early customers 30-50% versus Opus 4.8, and ships to Teams and Enterprise only, matching similar routers from Ramp and Meta's Switchboard.

🧊 FreeBSD froze ports over a 150MB commit LINK

FreeBSD froze its ports tree for over 48 hours after a 150MB binary landed in the repository, prompting core@ to halt all commits while they roll back the offending change and clean up the history.

The commit added the full github-copilot-cli Linux binary through its FreeBSD port, which normally just uses Linuxulator to run the unmodified binary rather than porting the closed-source tool itself.

The blob broke the GitHub mirror by exceeding the 100MB filesize limit and introduced questionable licensing into the tree, though ports wasn't compromised and users' systems remain unaffected.

☁️ Cloudflare adds Cache Response Rules LINK

Cloudflare launched Cache Response Rules, a new rule type that runs after the origin replies but before content is written to cache, letting you fix caching problems that only surface in the origin's response.

The rules support three actions: stripping headers like Set-Cookie, ETag, and Last-Modified that break caching, managing cache tags for purge-by-tag, and modifying Cache-Control directives, all without any origin code changes.

Setting `cloudflare_only: true` on a directive adjusts how Cloudflare caches while leaving the downstream browser Cache-Control value untouched, and when a Cache Rule and Cache Response Rule conflict, the response rule wins.

🤖 Dependabot now waits 3 days before updates LINK

Dependabot now enforces a three-day cooldown by default before opening pull requests for version updates, giving maintainers, researchers, and scanners time to catch a malicious release before it reaches your build pipeline.

The delay applies only to version bumps, not security updates, which still open immediately since holding back a fix for a publicly disclosed vulnerability would leave you exposed longer than necessary.

Three days was chosen because reviewed supply chain attacks on packages like chalk, axios, and Solana web3.js were caught within hours, and you can override the window using the cooldown option in dependabot.yml.

⚛️ Jotai v2.20 reworks its store for speed LINK

Jotai v2.20.0 has shipped, reworking the internal store building blocks that library authors depend on to boost performance in high-throughput scenarios while leaving the everyday application API completely unchanged for typical React developers.

The update fixes a reported performance regression by dropping the WeakMap approach used to make building blocks flexible, instead passing everything as parameters, alongside type narrowing for hooks and lazy handling of new atom state.

The breaking change affects downstream tooling, prompting jotai-devtools v0.14.0 to add support and drop older versions, while patches v2.20.1 and v2.20.2 cover edge cases ahead of a planned v3 that redesigns these internals and drops CommonJS builds.

Other news you might like

• The Cloud Software Factory Build GuideLINK

• JWT authentication: Best practices and when to use itLINK

• Provisioning for the Agentic Era: How Databricks Built a Self-Serve Infrastructure Vending MachineLINK

• How to replace screen recordings with RemotionLINK

• Using `animation-composition` in CSS to Avoid Redeclaring Other ValuesLINK

• Outperforming Fable 5 at half the price: meet model synthesis, a new server-side tool on DigitalOcean Inference EngineLINK

• The Pulse: New trend - concern about massive increase in code review loadLINK

• Geekbench 7 will push your computer or phone even harder for better benchmarkingLINK

• Meta Develops Switchboard to Route Simpler AI Tasks to Cheaper ModelsLINK

• Runway launches AI model router as generative media gets crowdedLINK

• Poolside's Laguna S 2.1 is a small open-weight coding model that punches well above its sizeLINK

• Article: Multi-Agent AI for Production Security Operations: An A2A and MCP Architecture in a 5G CoreLINK

🧰 Trending tools

Sim: a workspace for building and deploying AI agents visually or with code, connecting to 1,000+ integrations and every major LLM provider.LINK

ZooData: converts any URL into structured JSON for AI agents, reducing LLM token usage by ~75% while adding pre-analyzed e-commerce insights for Amazon and TikTok.LINK

Humalike x Hermes: gives AI agents turn-taking APIs and models so they know when to speak, wait, or interrupt in natural conversation.LINK

Replay QA: records website sessions in a dedicated browser, letting you inspect them later with devtools and share reproducible bug reports with your team.LINK

FetchSandbox: simulates webhooks, retries, and async workflows against 60+ real APIs, letting developers reproduce bugs deterministically without burning quota or using staging.LINK

Kastra: enforces runtime authorization policies for AI agents, blocking unauthorized tool use, prompt injection, and data leaks before actions execute.LINK

📚 Trending papers & reports

AI coding assistants shift maintainer workload toward writing longer documentation and troubleshooting external API dependencies, not less overall upkeep, based on 179 AI-assisted GitHub repositories versus matched traditional ones.LINK

Cross-team design updates get auto-translated from technical change logs into plain-language summaries, so engineers from different disciplines can understand each other's edits without learning each other's modeling tools.LINK

Requirements documentation quality can be modeled as tracking how efficiently project knowledge flows from stakeholders to developers, letting teams simulate and fix why good specs still get ignored in agile workflows.LINK

Prolog coding mistakes from 7,201 real student submissions now power a bug-generating tool that mimics classroom errors so closely, 16,000 test cases matched real mistake patterns within two percentage points, improving automated coding feedback tools.LINK

Software optimization shortcuts shows many software engineering problems, like configuration tuning or effort estimation, can be solved up to 100x faster by first checking if the data is simpler than it looks, before reaching for costly AI methods.LINK

See you tomorrow for a new dose of ☕️ Devshot!