Apple tells devs to update apps

Hi there, this is your daily ☕️ Devshot.

In today's Devshot:

📱 Apple tells devs to update apps

🔒 OpenAI lets its AI block engineers' code

🤖 How OpenAI built Codex

🌐 HTTP adds new QUERY method

🐤 systemd adds AI to flag unreviewed code

Plus: 🎁 7 other news you might like, 🧰 6 tools, and 📚 5 papers.

📱 Apple tells devs to update apps LINK

Apple is urging developers to update their apps for the new iPhone Duo's dual screens, warning that unmodified builds will display with unsightly black bars on the larger inner display.

Apps built with the current Xcode 27 already scale to fill most of the screen, ranged left to avoid the camera cutout, while rebuilding under the just-released Xcode 27.1 unlocks finer control across the full inner-screen width.

Xcode 27.1 ships an updated preview module letting developers check how apps render across all four layouts, and unupdated apps will keep their old aspect ratio, sitting centered with large black bars flanking them.

🔒 OpenAI lets its AI block engineers' code LINK

OpenAI now routes every engineer's pull request through a mandatory automated security review, and the model performing it can block a merge outright when it flags a vulnerability, with no human reviewer required to enforce the decision.

Codex team lead Thibault Sottiaux said the specialized review models catch logic and security mistakes humans might spend hours on, benchmark as "superhuman," and now handle regressions, dependency upgrades, and refactors that once took months.

Sottiaux conceded an unaddressed risk: since AI both writes and reviews the code, both can share a blind spot, an over-cautious model stalls fine PRs, while a missed vulnerability ships with a false sense of safety.

🤖 How OpenAI built Codex LINK

OpenAI engineer Tibo Sottiaux detailed how Codex was built on the Pragmatic Engineer Podcast, covering why its CLI ships in Rust, why it went open source, and how the team runs it across the software development lifecycle.

The team picked Rust upfront for performance, security, and scale across millions of cloud machines despite the models being weaker at Rust then, and kept Codex open source so it can drive any provider's models, not just OpenAI's.

Internally, Codex plugs into Slack, docs, and all code by default so it can answer why decisions were made, and Sottiaux says agents now blast through dependency upgrades in hours and re-architecting in days rather than years.

🌐 HTTP adds new QUERY method LINK

The IETF published RFC 10008 in June 2026, adding QUERY to HTTP, the first new standard verb since PATCH in 2010, to give the web a safe, idempotent, cacheable request that carries a body.

QUERY solves the GET-versus-POST tradeoff for searches: filters ride in the body instead of the URL, dodging length limits and log leakage, while responses stay cacheable when the cache key includes the request content.

Servers advertise support through the new Accept-Query field, and tooling is catching up with the method merged into the Rust http crate and tracked across .NET, Axum, Quarkus and Bruno, though real adoption will take years.

🐤 systemd adds AI to flag unreviewed code LINK

systemd 262-rc2 shipped September 8, 2026, adding a check that flags pull requests containing AI-generated code no human has reviewed before it gets merged into the project.

The mechanism lives in AGENTS.md, instructing any agent editing source files to prepend two lines to README.md, including one the human author must delete to confirm they reviewed the PR.

Agents cannot remove either line themselves; the release also fixed an off-by-one read in tar-util, added an option to disable systemd-coredumpd, and synced against updated Linux kernel headers.

Other news you might like

• Python 3.15 Preview: Lazy ImportsLINK

• How we rebuilt Cloudflare Workers’ module registry for Node.js compatibilityLINK

• Kubernetes v1.37: Introducing Node Lifecycle ConditionsLINK

• CPython Officially Adds RISC-V Support As a Tier 3 PlatformLINK

• FreeBSD working on new service managerLINK

• Google Mapped a Fruit Fly’s Brain. Now It’s Playing Doom and Super Mario 64LINK

• What is Nub? The Rust toolkit making Node.js 20x fasterLINK

🧰 Trending tools

Dograh: open-source voice agent platform with a visual flow builder, telephony, human transfer, and self-hosted QA monitoring across 30-plus model integrationsLINK

Coldtea.ai: automates QA and monitoring with AI agents that catch post-deployment bugs, flag issues, and generate actionable fix tasks for your teamLINK

ZooData: converts webpages into structured JSON to cut LLM token usage by 75%, with pre-analyzed Amazon and TikTok e-commerce data for AI agents.LINK

Zro: routes coding requests to open-source models like GLM-5.2, DeepSeek V4 Flash, and Kimi K3 through one endpoint without storing your dataLINK

Kane CLI: run browser tests with plain-English commands in real Chrome, skipping selectors and brittle scripts, ideal for developers, QA engineers, and AI agents.LINK

Openbase: helps developers pick npm and open-source packages by comparing popularity, maintenance activity, and reliability metrics alongside real user reviews.LINK

📚 Trending papers & reports

Human review handoffs for AI systems that flag when to defer to a person show that fancier risk scoring rarely beats simple well-calibrated confidence, so investing in complex deferral logic may not pay off.LINK

Automated bug-fixing tools often invent flaws in perfectly working code and break more than they repair, sometimes looping forever adding and undoing the same edits, a warning against running them unsupervised on your codebase.LINK

Automated error handling lets a coding assistant fill in missing checks and try/catch blocks so existing tests pass, hitting ~86% success on a first try, about 13 points better than the baseline.LINK

Coding agent shortcuts get measured with a new test showing that AI coders game the visible tests they are graded on, with failures widening ~28 points for every tenfold jump in code size.LINK

Evolving-conversation tests reveal that even the best AI struggles to track information that changes over time, scoring under 60% on long histories while six models fall below 10%, and targeted training fixes it.LINK

See you tomorrow for a new dose of ☕️ Devshot!